Communication behavior deep analysis and early warning method and device based on network flow data

Abstract

The invention discloses a communication behavior deep analysis and early warning method and device based on network flow data, and the method comprises the steps: collecting the network flow data in real time, and constructing a power grid flow data set; preprocessing the power grid flow data set; based on the preprocessed power grid flow data, through a multi-layer neural network and a feature selection algorithm, extracting most representative communication behavior feature data, which is called an optimal feature data subset; establishing an LSTM-DAE deep learning optimization model to perform deep learning and training on the optimal feature data subset, and establishing a communication behavior analysis model; and performing real-time analysis on the new network flow data by using the communication behavior analysis model to identify an abnormal communication behavior, and triggering real-time early warning when the abnormal communication behavior is detected. The method has generalization ability for unseen flow data, and can effectively improve the accuracy and efficiency of behavior anomaly detection early warning.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a communication behavior in-depth analysis and early warning method and device based on network traffic data. Background Art

[0002] With the rapid development of the Internet, network traffic data has exploded, and various network applications and services have emerged one after another. In the process of digital transformation of power grids, the security of network communications for power digitalization has also become a focus of attention. The communication network carries a large amount of real-time data and control instructions, and its security is directly related to the stable operation of the power grid digital system. However, the current power communication network faces many security threats, such as hacker attacks, network viruses, and human intrusions. These threats may lead to serious consequences such as interruption of power grid digital communication, data leakage, or system crash.

[0003] In power companies, traditional network security monitoring methods mainly rely on tools such as firewalls and intrusion detection systems, but these methods often have problems such as high false alarm rates, high missed alarm rates, and slow response speeds, making it difficult to cope with increasingly complex network attacks. On the one hand, the boundaries of power grid communication networks are becoming increasingly blurred, and network attackers can bypass boundary protection through various means and directly attack the internal systems of the power grid; on the other hand, network attack methods are constantly being updated, and traditional static defense methods are no longer effective. Therefore, how to achieve real-time monitoring and in-depth analysis of network traffic data to accurately identify abnormal communication behaviors and trigger early warnings in a timely manner has become an urgent problem to be solved in the field of power network security.

[0004] In recent years, with the rapid development of technologies such as big data and artificial intelligence, new ideas and methods have been provided for the in-depth analysis and real-time warning of network traffic data. However, according to the work of the current inventors, the network traffic anomaly detection method combining LSTM and autoencoder in the prior art may have problems such as feature extraction limitations, insufficient model robustness, poor real-time performance, imperfect warning mechanism and limited generalization ability. These deficiencies affect the accuracy and timeliness of anomaly detection, and therefore need to be further optimized to improve detection efficiency and practicality. Summary of the invention

[0005] Purpose of the invention: In order to solve the above-mentioned technical problems, the purpose of the present invention is to provide a method and device for deep analysis and early warning of communication behavior based on network traffic data, which can collect network traffic data in real time, identify potential communication threats and abnormal behaviors through deep parsing and intelligent analysis, and trigger corresponding early warning mechanisms.

[0006] Technical solution: In the first aspect, a communication behavior in-depth analysis and early warning method based on network traffic data includes the following steps:

[0007] Collect network flow data in real time and build a power grid flow data set;

[0008] Preprocess the power grid flow data set to eliminate noise and invalid data by deleting redundant and missing values, feature encoding, and data normalization;

[0009] Based on the preprocessed power grid flow data, the most representative communication behavior feature data is extracted through a multi-layer neural network and feature selection algorithm, which is called the optimal feature data subset;

[0010] Combining the long short-term memory network LSTM and the denoising autoencoder DAE framework, an LSTM-DAE deep learning optimization model is established to conduct deep learning and training on the optimal feature subset data, and a communication behavior analysis model is established;

[0011] The communication behavior analysis model is used to analyze new network traffic data in real time to identify abnormal communication behavior and trigger real-time warnings when abnormal communication behavior is detected.

[0012] In the second aspect, a communication behavior in-depth analysis and early warning device based on network traffic data includes:

[0013] Data collection module, used to collect network flow data in real time and build a power grid flow data set;

[0014] The data preprocessing module is used to preprocess the power grid flow data set, eliminating noise and invalid data by deleting redundant and missing values, feature encoding, and data normalization;

[0015] The feature extraction module is used to extract the most representative communication behavior feature data based on the preprocessed power grid flow data through a multi-layer neural network and feature selection algorithm, which is called the optimal feature data subset;

[0016] The model building module is used to combine the long short-term memory network LSTM and the denoising autoencoder DAE framework to establish an LSTM-DAE deep learning optimization model to conduct deep learning and training on the optimal feature data subset and establish a communication behavior analysis model;

[0017] The communication behavior analysis and warning module is used to use the communication behavior analysis model to perform real-time analysis on new network traffic data to identify abnormal communication behavior and trigger a real-time warning when abnormal communication behavior is detected.

[0018] In a third aspect, the present invention also provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the in-depth analysis and early warning method of communication behavior based on network traffic data as described above are implemented.

[0019] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for in-depth analysis and early warning of communication behaviors based on network traffic data as described above.

[0020] Beneficial effects: (1) The present invention proposes a method and device for in-depth analysis and real-time warning of communication behavior based on network traffic data, which is aimed at the existing network traffic data anomaly analysis based on LSTM, and LSTM-AE network traffic anomaly detection combining LSTM and autoencoder, but its accuracy is limited by the noise in the training data, resulting in the model's inability to distinguish between normal, abnormal, and noisy data, which in turn leads to the problem of low detection accuracy. The method and device can capture and analyze network traffic data in real time, use deep learning algorithms to conduct deep learning and training of communication behavior, establish a communication behavior analysis model to conduct real-time analysis of new network traffic data, identify abnormal communication behavior, and trigger real-time warnings. At the same time, it also supports multiple warning information release channels, which is convenient for administrators or relevant security personnel to understand and respond to network security incidents in a timely manner.

[0021] (2) On the one hand, the present invention uses feature selection to more accurately capture time series feature data, effectively remove noise data, and improve processing efficiency; on the other hand, by combining the optimized LSTM and the denoising autoencoder DAE, the DAE is fully utilized to enable the model to have the ability of robust expression and the advantages of LSTM in time series data processing, effectively improving the accuracy of detecting abnormal communication behaviors, and timely discovering and responding to network attacks and malicious behaviors through communication anomaly detection and early warning, protecting organizations and individuals from losses. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flow chart of a method for in-depth analysis and early warning of communication behaviors based on network traffic data in an embodiment of the present invention;

[0023] Figure 2 It is a structural diagram of an LSTM-DAE optimization model of an autoencoder based on a long short-term memory network in an embodiment of the present invention;

[0024] Figure 3 It is a structural block diagram of a communication behavior in-depth analysis and early warning device based on network traffic data in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The present invention provides a method and device for in-depth analysis and early warning of communication behavior based on network traffic data, which effectively establishes a communication behavior analysis model, realizes the generalization capability for unseen traffic data, and better improves the accuracy and efficiency of behavior anomaly detection and early warning.

[0026] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention is further described in detail below through specific implementations and in conjunction with the accompanying drawings.

[0027] Embodiment 1

[0028] This embodiment provides a communication behavior deep analysis and early warning method based on network traffic data, which combines deep learning with power grid traffic data anomaly detection and analysis, and constructs a communication behavior analysis model with high robustness and strong generalization ability by introducing a denoising auto-encoder.

[0029] Reference Figure 1 , a communication behavior in-depth analysis and early warning method based on network traffic data, comprising the following steps:

[0030] S1, collects network flow data in real time and builds a power grid flow data set;

[0031] Use efficient traffic collection tools such as honeypot detection, terminal proxy, traffic probe and other methods to capture data packets in network communication in real time and extract key information, including source IP address, destination IP address, port number, transmission protocol, data packet size, timestamp and other information, and store the collected original network flow data in the form of pcap x.

[0032] S2, preprocessing the power grid flow data set to eliminate noise and invalid data by removing redundant and missing values, feature encoding, data normalization, etc.;

[0033] The purpose of step S2 is to effectively maintain the temporal and spatial structure of network traffic data through preprocessing and improve data quality.

[0034] The network traffic data, network traffic features, and network traffic feature set are represented by x, y, and S respectively, and the expressions of feature set S and feature y are as follows:

[0035] S={y1,y2,y3,.....y e} (1)

[0036] y={x1,x2,x3,...,x n} (2)

[0037] where ye represents the e-dimensional feature in the network traffic dataset, x n Indicates the nth piece of network traffic data.

[0038] Since some discrete features or symbolic features in the network traffic data x cannot be directly used as the input of the classifier, the original data is first filtered by removing redundancy and missing values, and then the features with a variance of 0 are removed. The feature set S1 after removing irrelevant features is obtained as follows:

[0039] S1={y1,y2,y3,.....y d ,d≤e} (3)

[0040] S3, feature extraction. Through multi-layer neural networks and feature selection algorithms, the most representative communication behavior features are extracted, effectively reducing the complexity of the model and improving computing efficiency. Then the data is normalized to optimize the model training process and improve the model stability and prediction accuracy.

[0041] S31, use the maximum information correlation to perform feature selection, and select t features with the highest attack correlation based on the correlation between the features and the attack types. There are k types of attacks in the network traffic data, and the number of network data of the jth attack type is n j , the average value of network traffic data The expression is:

[0042]

[0043] where x ij is the network traffic data corresponding to the jth attack type in the i-th network traffic, and n is the total number of network traffic data. The total sum of squares of the difference of network traffic data of each attack type is expressed as:

[0044]

[0045] The sum of squares of the differences in network traffic data for each attack type within the group is expressed as:

[0046]

[0047] in, It represents the average value of the j-th attack type, as follows:

[0048]

[0049] The sum of squares of the difference in attack types of network traffic data SSR is expressed as:

[0050]

[0051] The expression of the correlation function F(t) between network traffic data features and attack types is the ratio of the intra-class difference MSR to the inter-class difference MSE, as shown in the following formula:

[0052]

[0053] S32, for the network traffic feature set S1, calculate the F value of each feature and attack type. According to the F test distribution table, select the t features most relevant to the attack type. After selecting the features with the highest information relevance, the selected feature subset is:

[0054] S2={y1,y2,y3,...,y t ,t<d} (10)

[0055] S33, finally, the optimal feature data subset is selected by recursive feature elimination method, and random forest (RF) is used as a classifier to train each feature Y and phenotype Q, and the classifier is used to evaluate the impact of feature Y on phenotype Q. After multiple cross-validations, the optimal data set is found. The optimal feature data subset finally selected is:

[0056] S3={y1,y2,y3,...,y M ,M<t} (11)

[0057] S34, after feature selection, in order to effectively extract network traffic features from the optimal feature data subset, it is modeled as an N-dimensional discrete random process with M features and N time instants that is independent and identically distributed

[0058] {y m ∈R N ,m=1,2,...,M}. Assume that the characteristic subspace [y0,...y M-1 ]∈R N×M As a univariate mixture of M components, each element y of S3 mn The feature likelihood can be estimated using a probability density function as follows:

[0059]

[0060] in is the parameter μ m The instantaneous evaluation of m 2 is the univariate Gaussian distribution of the mth feature. The resulting likelihood space is:

[0061] Q=θ(S3) (15)

[0062] Q is a parameterized one-to-one transformation obtained by repeatedly applying (14) to the elements of y. The new parameter space Q = [q0,...,qM-1 ]∈R N×M Represents the instantaneous Gaussian likelihood calculation corresponding to each parameter of the data. Normalized likelihood feature sequence:

[0063]

[0064] where z=[z0,...,z N-1 ]∈[0,1].

[0065] The transformed normalized likelihood sequence z effectively captures the temporal dynamics of network traffic as well as the spatial characteristics of the initially extracted features.

[0066] S4, combined with LSTM to process long-term dependencies in sequence data, and used the denoising ability of the denoising autoencoder DAE to enhance the robustness and generalization ability of the model, effectively established the LSTM-DAE deep learning optimization model to conduct deep learning and training on the optimal feature subset, and established a communication behavior analysis model;

[0067] Reference Figure 2 ,The LSTM-DAE optimization model structure in the present invention includes the following parts.

[0068] Input layer: receives the original sequence data and performs preprocessing at the same time.

[0069] Denoising Autoencoder (DAE) part: The autoencoder consists of an encoder and a decoder. The encoder part is used for data dimensionality reduction, and the decoder part is used for data reconstruction. Denoising autoencoder refers to adding noise to the input data and trying to restore the original data in subsequent layers. This helps the model learn more robust feature representations. Compared with traditional autoencoders, denoising autoencoders can accept damaged data as input for training and try to restore the original data from the damaged data, realizing the functions of denoising and data recovery. The use of denoising autoencoders can better extract information from power grid flow time series and has higher robustness.

[0070] The encoder and decoder are implemented using LSTM. The long-term dependencies in the sequence data are captured by LSTM units. Each unit in the LSTM layer controls the flow of information through the forget gate, input gate, and output gate. The output of the LSTM layer is the hidden state of each time step in the sequence. These hidden states contain the contextual information of the sequence and will be used in the subsequent attention mechanism or output layer.

[0071] Among them, after the encoder LSTM layer, the attention mechanism (Attention) layer is connected, which receives the output of the encoder LSTM layer and calculates a weight vector to represent the importance of each element in the LSTM output sequence to the current output. Then, the weight vector is weighted and summed with the LSTM output to obtain the weighted representation. This helps the model pay more attention to the important parts of the sequence. The output of the attention mechanism is the weighted representation, which will be used as the input of the subsequent decoder LSTM layer.

[0072] Output layer: The output layer contains a fully connected layer to produce the final prediction results.

[0073] First, add noise to the clean input signal x The damage signal is obtained as shown in the following formula:

[0074]

[0075] Then the noise data is compressed and reconstructed, where W e (W d ) and b e (b d ) are the weights and bias parameters in the encoder (decoder), and σ is the nonlinear activation function, as shown in the following formula:

[0076]

[0077] The goal of the encoder is to reconstruct the input data as much as possible. The reconstruction loss function is shown below.

[0078]

[0079] According to an embodiment of the present invention, in the denoising autoencoder DAE model, z is added as input and transformed into z', forcing the model to learn the feature representation of the original data and enhance the robustness of the model. The data is then fed into a fully symmetrically connected recursive neural network. In the traditional model of a recursive neural network with only one hidden layer, the goal of the input layer and the output layer is to achieve joint transition, as shown in the following formula:

[0080]

[0081] Where σ, W, b are encoding conversion The activation function, weight space and bias vector of , may or may not be equal to the corresponding parameters of the reconstruction transformation ψ. The autocorrelated multilayer perceptron attempts to optimally solve the minimization problem through the back propagation of the error, and its formula is:

[0082]

[0083] The feature reconstruction loss is calculated by reducing the squared Euclidean distance:

[0084]

[0085] The mapping proposed in (20) is stateless and can fully capture the duration-based characteristics of the normalized likelihood sequence.

[0086] When the gradient backpropagates over time, the weight space W will experience a vanishing gradient problem. Since the duration of network flow may be unpredictable in the absence of any instantaneous changes, the likelihood sequence may exhibit arbitrary inactive blocks, thereby stopping the network training before fully representative learning. At the same time, since the feature extraction network of the DAE model is a shallow model, the feature learning ability is limited. In addition, the fully connected layer structure of the DAE model determines that it cannot extract time series information from the original data.

[0087] The LSTM-DAE deep learning optimization model first performs isochronous learning on the input feature vector time series data, and then reconstructs the encoded time series using the current implicit state and the value predicted in the previous step. The LSTM hidden unit includes the input gate (i t ), output gate (o t ) and the forget gate (f t ), while passing through the cell state c t Connect. LSTM unit h t The output of is passed as input to the next hidden unit in the recurrent network. Based on the LSTM-DAE deep learning optimization model, the potential representation h of (20) is replaced by:

[0088] h t =o t *σ h (c t ) (twenty three)

[0089] Among them t ,c t ∈R S are the output gates and cell state activation vectors of s LSTM units.

[0090] The LSTM cell state receives the cell state c of the previous moment t-1 , multiplied by the output value f of the forget gate t , plus the output value of the input gate, we get the current cell state c t , and then update the unit state in the LSTM neural network. t The calculation formula is as follows:

[0091]

[0092] Therefore, (23) and (24) are used to optimally control the flow and retention of information within the unit. The LSTM unit is evaluated by the following formula:

[0093] f t =σ g (W f z t +V f h t-1 +b f ) (25)

[0094] i t =σ g (W i z t +V i h t-1 +b i ) (26)

[0095] o t =σ g (W o z t +V o h t-1 +b o ) (27)

[0096] c t =σ h (W c z t +V c h t-1 +b c ) (28)

[0097] where W∈R h×d , V∈R h×h And b∈R h are the input weights, recurrent connection weights, and bias parameters that need to be learned during training of a denoising autoencoder with d inputs and h hidden units. The activation function is shown below:

[0098]

[0099] The main network architecture of the optimization model consists of LSTM layers, attention layers, and fully connected layers. l LSTM layers contain h hidden units, each of which is used to encode the compressed representation of the likelihood stream after transformation. The output of the hidden unit is then connected to the attention layer. The attention layer is added after the LSTM layer. The attention mechanism can help the model dynamically focus on important parts of the input sequence, thereby improving the prediction accuracy of the model. The attention layer usually performs a weighted summation on the output of the LSTM layer to obtain a weighted representation. The LSTM layer then performs decoding and reconstruction, and finally connects to a single fully connected layer of the corresponding unit, which produces a reconstructed output. To solve the minimization problem of formula (21), the mean absolute error loss function is used to estimate the stochastic gradient optimization based on adaptive learning:

[0100]

[0101] The mean square error is calculated as follows:

[0102]

[0103] Triggering the first training phase Previously, the initial value was set to c0=h0=0.

[0104] When training the model, the mean absolute error loss function MAE is used as the loss function and combined with the stochastic gradient optimization algorithm based on adaptive learning to fully utilize the robustness of MAE and the efficiency of the adaptive learning rate optimization algorithm. The specific steps are as follows:

[0105] Define model: Define a suitable neural network model according to task requirements.

[0106] Choose an optimization algorithm: Choose a stochastic gradient optimization algorithm based on adaptive learning, such as RMSProp or Adam.

[0107] Set the loss function: Use MAE as the loss function to measure the difference between the model prediction value and the true value.

[0108] Training model: Use training data to train the model, and the optimization algorithm will automatically adjust the model parameters according to the MAE loss function to minimize the loss value.

[0109] Evaluate the model: Use the validation set or test set to evaluate the performance of the model, and adjust the model structure or optimize the algorithm parameters based on the evaluation results.

[0110] Through the above steps, the MAE loss function and adaptive learning rate optimization algorithm can be effectively used to train the regression model and improve the prediction accuracy and robustness of the model.

[0111] S44, in order to obtain more accurate prediction results, LSTM must consider the setting of parameters. The performance of LSTM is improved by using the particle swarm algorithm (PSO) for hyperparameter selection. The process first initializes the group, then calculates the fitness value and updates the particle position. If the position of the particle does not meet the termination condition, the process will continue to iteratively calculate the fitness value until the condition is met. When the search space of each parameter meets the condition, the output result will be generated. The result output is the hyperparameter value for selecting the number of hidden layers and neurons, the activation function, the optimizer, the batch size, the loss function, etc. The particle swarm algorithm is a conventional particle swarm algorithm in the prior art, which will not be described here.

[0112] S5, through this model, new network traffic data is analyzed in real time to identify abnormal communication behavior and trigger real-time warnings.

[0113] S51, short time window The data features are converted into normalized likelihood flow z j . It is then passed to the recurrent network, where t1 and t2 are the initial and final time instants within the jth window, respectively. The normalized distance metric is calculated as:

[0114]

[0115] d j A decision statistic is calculated for each window and compared with a threshold τ to decide between the hypotheses {H0: normal traffic vector} and {H1: attack traffic vector} such that:

[0116]

[0117] Among them, τ is the optimal threshold, which maximizes the use of performance indicators for detection and early warning.

[0118] S52, using the constructed early warning model, real-time detection of the captured network traffic data is performed. When abnormal communication behavior is detected, the early warning mechanism is triggered. The threshold trigger mechanism is adopted, and the early warning is automatically triggered when the abnormal behavior exceeds the preset threshold. After the early warning is triggered, the system automatically generates early warning information containing detailed information of the abnormal behavior, risk assessment and response suggestions, and sends the early warning information to the administrator or relevant security personnel through preset release channels such as email, SMS, APP push, etc.

[0119] Furthermore, network traffic data is continuously monitored and analyzed to timely detect and respond to new threats and anomalies. At the same time, analysis methods and early warning mechanisms are adjusted based on feedback and results to improve their accuracy and effectiveness.

[0120] Embodiment 2

[0121] Reference Figure 3 ,This embodiment provides a communication behavior in-depth analysis and early warning device based on network traffic data;

[0122] Data collection module, used to collect network flow data in real time and build a power grid flow data set;

[0123] The data preprocessing module is used to preprocess the power grid flow data set, eliminating noise and invalid data by deleting redundant and missing values, feature encoding, and data normalization;

[0124] The feature extraction module is used to extract the most representative communication behavior feature data based on the preprocessed power grid flow data through a multi-layer neural network and feature selection algorithm, which is called the optimal feature data subset;

[0125] The model building module is used to combine the long short-term memory network LSTM and the denoising autoencoder DAE framework to establish an LSTM-DAE deep learning model to conduct deep learning and training on the optimal feature data subset and establish a communication behavior analysis model;

[0126] The communication behavior analysis and warning module is used to use the communication behavior analysis model to perform real-time analysis on new network traffic data to identify abnormal communication behavior and trigger a real-time warning when abnormal communication behavior is detected.

[0127] It should be understood that the communication behavior in-depth analysis and early warning device based on network traffic data in the embodiment of the present invention can implement all the technical solutions in the above-mentioned method embodiment, and the functions of its various functional modules can be specifically implemented according to the methods in the above-mentioned method embodiments. The specific implementation process can refer to the relevant description in the above-mentioned embodiments, which will not be repeated here.

[0128] Embodiment 3

[0129] This embodiment provides a computer device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of the in-depth analysis and early warning method of communication behavior based on network traffic data as described above are implemented.

[0130] Embodiment 4

[0131] This embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the communication behavior in-depth analysis and early warning method based on network traffic data as described above are implemented.

[0132] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices (systems), computer equipment or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0133] The present invention is described with reference to a flowchart of a method according to an embodiment of the present invention. It should be understood that each process in the flowchart and a combination of processes in the flowchart can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A device that specifies functions in a process or multiple processes.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A function specified in a process or multiple processes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 The steps of a specified function in a process or multiple processes.

Claims

1. A communication behavior in-depth analysis and early warning method based on network traffic data, characterized in that: The following steps are involved: Collect network flow data in real time and build a power grid flow data set; Preprocess the power grid flow data set to eliminate noise and invalid data by deleting redundant and missing values, feature encoding, and data normalization; Based on the preprocessed power grid flow data, the most representative communication behavior feature data is extracted through a multi-layer neural network and feature selection algorithm, which is called the optimal feature data subset; Combining the long short-term memory network LSTM and the denoising autoencoder DAE framework, an LSTM-DAE deep learning optimization model is established to conduct deep learning and training on the optimal feature data subset, and a communication behavior analysis model is established; The communication behavior analysis model is used to analyze new network traffic data in real time to identify abnormal communication behavior and trigger real-time warnings when abnormal communication behavior is detected.

2. The method according to claim 1, characterized in that Collect network flow data in real time and build a power grid flow data set. The specific methods include: Use traffic collection tools to capture data packets in network communications in real time and extract key information, including source IP address, destination IP address, port number, transmission protocol, packet size, and timestamp. Store the collected raw network flow data in the form of pcap to construct the power grid flow dataset x.

3. The method according to claim 1, characterized in that Based on the preprocessed power grid flow data, the most representative communication behavior data features are extracted through a multi-layer neural network and feature selection algorithm, which is called the optimal feature data subset. The specific methods include: For the network traffic feature set S1 = {y1, y2, y3, ..... y d ,d≤e}, calculate the F value of each feature and attack type, and select the t features most relevant to the attack type according to the F test distribution table. After selecting the feature with the largest information relevance, the selected feature subset is: S2={y1,y2,y3,...,y t ,t<d}; For the selected feature subset S2, random forest is used as the classifier to train each feature Y and phenotype Q, and the classifier is used to evaluate the impact of feature Y on phenotype Q. After multiple cross-validations, the optimal data set is found. The optimal feature data subset finally selected is: S3 = {y1, y2, y3, ..., y M ,M<t}.

4. The method according to claim 3, characterized in that The F value calculation method for each feature and attack type is as follows: Assume that there are k types of attacks in network traffic data, and the number of network data of the jth attack type is n j , the average value of network traffic data for: where x ij represents the network traffic data of the i-th label type, n is the total number of network traffic data; the total sum of squares of the network traffic data of each attack type SST is expressed as: The sum of squares of the differences in network traffic data for each attack type within the group is expressed as: in, Represents the average value of the j-th category label: The sum of squares of the difference in attack types of network traffic data SSR is expressed as: The expression of the correlation function F(t) between network traffic data characteristics and attack types is the ratio of the intra-class difference MSR to the inter-class difference MSE: in 5. The method according to claim 1, characterized in that The LSTM-DAE deep learning optimization model includes: Input layer: receives the original sequence data and performs preprocessing at the same time; Denoising autoencoder DAE part: It consists of an encoder and a decoder. The encoder part is used for data dimensionality reduction, and the decoder part is used for data reconstruction. The encoder and decoder are implemented using a long short-term memory network LSTM. The long-term dependencies in the sequence data are captured by the LSTM unit. Each unit in the LSTM layer controls the flow of information through the forget gate, input gate and output gate. The output of the LSTM layer is the hidden state of each time step in the sequence. Among them, after the encoder LSTM layer, the attention mechanism layer is connected to receive the output of the encoder LSTM layer, calculate a weight vector to represent the importance of each element in the LSTM output sequence to the current output, and perform a weighted summation of the weight vector and the LSTM output to obtain a weighted representation, which will be used as the input of the subsequent decoder LSTM layer; Output layer: Contains the fully connected layer, which is used to produce the final prediction results.

6. The method according to claim 5, characterized in that The LSTM layer includes h hidden units, and the LSTM hidden unit includes an input gate i t , output gate o t and forget gate f t , while passing through the cell state c t To connect, it is represented as: f t =σ g (W f z t +V f h t-1 +b f ) i t =σ g (W i z t +V i h t-1 +b i )) about t =σ g (IN o With t +V o h t-1 +b o ) c t =σ h (W c z t +V c h t-1 +b c ) where W∈R h×d , V∈R h×h And b∈R h are the input weights, recurrent connection weights, and bias parameters that need to be learned during training of an autoencoder with d inputs and h hidden units; h t =o t *s h (c t ) Among them t ,c t ∈R S is the output gate and cell state activation vector of s LSTM cells. The LSTM cell state receives the cell state c at the previous moment. t-1 , multiplied by the output value f of the forget gate t , plus the output value of the input gate, we get the current cell state c t , and then update the unit state in the LSTM neural network, c t The calculation formula is as follows: The loss function during training uses the reconstruction loss of the autoencoder.

7. The method according to claim 1, characterized in that Use the communication behavior analysis model to analyze new network traffic data in real time to identify abnormal communication behavior and trigger real-time warnings when abnormal communication behavior is detected. The specific methods include: Short time window The data features are converted into normalized likelihood flow z j , which is then passed to the recurrent network, where t1 and t2 are the initial and final time instants within the jth window, respectively, and the normalized distance metric is calculated as: d j Compute decision statistics for each window; D j It is compared with the threshold τ to decide between the hypothesis {H0: normal traffic vector} and {H1: attack traffic vector}, such that:

8. A communication behavior in-depth analysis and early warning device based on network traffic data, characterized in that: include: Data collection module, used to collect network flow data in real time and build a power grid flow data set; The data preprocessing module is used to preprocess the power grid flow data set, eliminating noise and invalid data by deleting redundant and missing values, feature encoding, and data normalization; The feature extraction module is used to extract the most representative communication behavior feature data based on the preprocessed power grid flow data through a multi-layer neural network and feature selection algorithm, which is called the optimal feature data subset; The model building module is used to combine the long short-term memory network LSTM and the denoising autoencoder DAE framework to establish an LSTM-DAE deep learning optimization model to conduct deep learning and training on the optimal feature data subset and establish a communication behavior analysis model; The communication behavior analysis and warning module is used to use the communication behavior analysis model to perform real-time analysis on new network traffic data to identify abnormal communication behavior and trigger a real-time warning when abnormal communication behavior is detected.

9. A computer device, characterized in that: include: one or more processors; Memory; as well as One or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and when the programs are executed by the processors, the steps of a communication behavior in-depth analysis and early warning method based on network traffic data as described in any one of claims 1-7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, the steps of a communication behavior in-depth analysis and early warning method based on network traffic data as described in any one of claims 1 to 7 are implemented.

Images