Power grid protocol identification method and device based on knowledge graph, computer equipment, readable storage medium and program product

Abstract

The invention relates to a power grid protocol identification method, device and equipment based on a knowledge graph, a readable storage medium and a program product, and relates to the technical field of intelligent power grid communication. By adopting the method, the identification accuracy of the protocol category of the power grid flow data can be improved. The method comprises the following steps: extracting flow characteristic data and message header data from historical power grid flow data; according to the flow characteristic data, obtaining a trained power grid protocol identification model, and according to the message header data, obtaining a trained power grid protocol field identification model; performing relation extraction on the power grid flow data by using the power grid protocol identification model and the power grid protocol field identification model; according to the obtained protocol category label and the protocol field prediction value, constructing a power grid protocol knowledge graph; and based on the power grid protocol knowledge graph, adjusting a protocol category label prediction value output by the power grid protocol identification model, and identifying the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

Description

Technical Field

[0001] The present application relates to the field of smart grid communication technology, and in particular to a knowledge graph-based power grid protocol identification method, device, computer equipment, computer-readable storage medium and computer program product. Background Art

[0002] With the transformation of the global energy structure and the rapid development of information technology, smart grid has become a key direction for the modernization of power systems. In smart grids, various power devices and systems exchange data and control commands through complex communication protocols. The correct identification and execution of these protocols are crucial to the stable operation of the power grid, but the diversity and complexity of power grid communication protocols pose great challenges to protocol identification.

[0003] The protocol identification method in traditional technology mainly relies on predefined rules and patterns. This method is often difficult to identify when faced with new or variant protocols. At the same time, the noise, interference and security threats in the power grid environment also increase the difficulty of protocol identification, resulting in the problem of low recognition accuracy of the protocol identification method in current technology. Summary of the invention

[0004] Based on this, it is necessary to provide a knowledge graph-based power grid protocol identification method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides a method for identifying a power grid protocol based on a knowledge graph, comprising:

[0006] Acquire historical power grid flow data, and extract flow characteristic data and message header data from the historical power grid flow data;

[0007] According to the flow characteristic data, an initial power grid protocol recognition model is trained to obtain a trained power grid protocol recognition model, and according to the message header data, an initial power grid protocol field recognition model is trained to obtain a trained power grid protocol field recognition model;

[0008] Using the power grid protocol identification model and the power grid protocol field identification model to respectively perform relationship extraction on the power grid flow data, and obtain the protocol category label output by the power grid protocol identification model and the protocol field prediction value output by the power grid protocol field identification model;

[0009] Constructing a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value;

[0010] For the current power grid flow data, based on the power grid protocol knowledge graph, the protocol category label prediction value output by the power grid protocol identification model is adjusted, and the protocol category of the current power grid flow data is identified according to the adjusted protocol category label prediction value.

[0011] In one embodiment, constructing a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value includes:

[0012] According to the protocol category label, the target protocol category is determined, and according to the predicted value of the protocol field, the correlation between the power grid flow and the protocol field of the target protocol category is determined; according to the correlation, a power grid protocol subgraph is constructed with the target protocol category as the central node and the protocol field as the surrounding nodes; the power grid protocol subgraphs are connected through the common protocol fields of each of the target protocol categories to obtain the power grid protocol knowledge graph.

[0013] In one embodiment, before adjusting the predicted value of the protocol category label output by the power grid protocol identification model based on the power grid protocol knowledge graph, the method further includes:

[0014] The power grid protocol identification model is used to make a preliminary prediction on the protocol category of the current power grid flow data to obtain the predicted value of the protocol category label; the current power grid flow data is input into the power grid protocol field identification model to perform protocol field identification to obtain the current protocol field contained in the current power grid flow data.

[0015] In one embodiment, adjusting the predicted value of the protocol category label output by the power grid protocol identification model based on the power grid protocol knowledge graph includes:

[0016] Based on the structured information in the power grid protocol knowledge graph, the degree of association between the protocol category label prediction value and the current protocol field is calculated; according to the degree of association, the protocol category label prediction value output by the power grid protocol identification model is adjusted to obtain the adjusted protocol category label prediction value.

[0017] In one embodiment, the step of identifying the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value includes:

[0018] Among the adjusted protocol category label prediction values, identify the target protocol category label prediction value with the largest value; and determine the protocol category corresponding to the target protocol category label prediction value as the protocol category of the current power grid flow data.

[0019] In one embodiment, the method further includes: obtaining first feedback data of the grid protocol identification model and second feedback data of the grid protocol field identification model; updating model parameters of the grid protocol identification model according to the first feedback data, and updating model parameters of the grid protocol field identification model according to the second feedback data;

[0020] The using the power grid protocol identification model and the power grid protocol field identification model to respectively extract relationships from the power grid flow data comprises: using an updated power grid protocol identification model and an updated power grid protocol field identification model to respectively extract relationships from the power grid flow data.

[0021] In a second aspect, the present application also provides a knowledge graph-based power grid protocol identification device, including:

[0022] A data acquisition module, used to acquire historical power grid flow data, and extract flow characteristic data and message header data from the historical power grid flow data;

[0023] A model training module, used to train an initial power grid protocol recognition model according to the flow characteristic data to obtain a trained power grid protocol recognition model, and to train an initial power grid protocol field recognition model according to the message header data to obtain a trained power grid protocol field recognition model;

[0024] A relationship extraction module, used to use the power grid protocol identification model and the power grid protocol field identification model to respectively perform relationship extraction on the power grid flow data, and obtain the protocol category label output by the power grid protocol identification model and the protocol field prediction value output by the power grid protocol field identification model;

[0025] A graph construction module, used to construct a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value;

[0026] A category identification module is used to adjust the protocol category label prediction value output by the power grid protocol identification model for the current power grid flow data based on the power grid protocol knowledge graph, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0027] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0028] Acquire historical power grid flow data, and extract flow feature data and message header data from the historical power grid flow data; train an initial power grid protocol identification model according to the flow feature data to obtain a trained power grid protocol identification model, and train an initial power grid protocol field identification model according to the message header data to obtain a trained power grid protocol field identification model; use the power grid protocol identification model and the power grid protocol field identification model to respectively perform relationship extraction on the power grid flow data to obtain a protocol category label output by the power grid protocol identification model and a protocol field prediction value output by the power grid protocol field identification model; construct a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value; for current power grid flow data, adjust the protocol category label prediction value output by the power grid protocol identification model based on the power grid protocol knowledge graph, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0029] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0030] Acquire historical power grid flow data, and extract flow feature data and message header data from the historical power grid flow data; train an initial power grid protocol identification model according to the flow feature data to obtain a trained power grid protocol identification model, and train an initial power grid protocol field identification model according to the message header data to obtain a trained power grid protocol field identification model; use the power grid protocol identification model and the power grid protocol field identification model to respectively perform relationship extraction on the power grid flow data to obtain a protocol category label output by the power grid protocol identification model and a protocol field prediction value output by the power grid protocol field identification model; construct a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value; for current power grid flow data, adjust the protocol category label prediction value output by the power grid protocol identification model based on the power grid protocol knowledge graph, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0031] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0032] Acquire historical power grid flow data, and extract flow feature data and message header data from the historical power grid flow data; train an initial power grid protocol identification model according to the flow feature data to obtain a trained power grid protocol identification model, and train an initial power grid protocol field identification model according to the message header data to obtain a trained power grid protocol field identification model; use the power grid protocol identification model and the power grid protocol field identification model to respectively perform relationship extraction on the power grid flow data to obtain a protocol category label output by the power grid protocol identification model and a protocol field prediction value output by the power grid protocol field identification model; construct a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value; for current power grid flow data, adjust the protocol category label prediction value output by the power grid protocol identification model based on the power grid protocol knowledge graph, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0033] The above-mentioned power grid protocol identification method, device, computer equipment, computer-readable storage medium and computer program product based on knowledge graph extract traffic feature data and message header data containing protocol field information by using traffic feature extraction tools, and then pre-train the power grid protocol identification model and power grid protocol field identification model according to the extracted traffic feature data and message header data, and use the protocol category labels and protocol field prediction values ​​output by the trained model to construct a power grid protocol knowledge graph reflecting the correlation between protocol category labels and protocol field labels. For a new current power grid flow data, the degree of correlation between each label prediction value and the predicted protocol field is calculated according to the weight information in the power grid protocol knowledge graph, and the correlation degree and the label prediction value constitute an adjusted label prediction value. Finally, the protocol category of the current power grid flow data is identified according to the adjusted protocol category label prediction value. In summary, the entire application scheme adopts a protocol identification method based on knowledge graph, and significantly improves the accuracy of identifying the protocol category of power grid flow data by combining the prediction results of the pre-training model and the structured information in the knowledge graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0035] FIG1 is an application environment diagram of a knowledge graph-based power grid protocol identification method in one embodiment;

[0036] Figure 2A schematic diagram of a flow chart of a method for identifying a power grid protocol based on a knowledge graph in one embodiment;

[0037] Figure 3 A schematic diagram of a process for constructing a knowledge graph of a power grid protocol in one embodiment;

[0038] Figure 4 A schematic diagram of a process for constructing a knowledge graph of a power grid protocol in another embodiment;

[0039] Figure 5 It is a flowchart of a method for identifying a power grid protocol based on a knowledge graph in a specific embodiment;

[0040] Figure 6 It is a structural block diagram of a power grid protocol identification device based on a knowledge graph in one embodiment;

[0041] FIG. 7 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0043] The power grid protocol identification method based on knowledge graph provided in the embodiment of the present application can be applied in the application environment shown in FIG1. ​​The terminal communicates with the server through the network. The data storage system can store the data that the server needs to process. The data storage system can be integrated on the server, or placed on the cloud or other network servers.

[0044] Specifically, the knowledge graph-based power grid protocol identification method provided in the embodiment of the present application can be executed by a server.

[0045] Exemplarily, the server obtains historical power grid flow data, and extracts flow feature data and message header data from the historical power grid flow data; the server trains the initial power grid protocol recognition model according to the flow feature data to obtain a trained power grid protocol recognition model, and trains the initial power grid protocol field recognition model according to the message header data to obtain a trained power grid protocol field recognition model; the server uses the power grid protocol recognition model and the power grid protocol field recognition model to respectively extract relationships from the power grid flow data, and obtains the protocol category label output by the power grid protocol recognition model and the protocol field prediction value output by the power grid protocol field recognition model; the server constructs a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value; for the current power grid flow data, the server adjusts the protocol category label prediction value output by the power grid protocol recognition model based on the power grid protocol knowledge graph, and identifies the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0046] In the application environment shown in FIG1 , the terminal may be, but is not limited to, various personal computers, notebook computers, smart phones, and tablet computers. The server may be implemented as an independent server or a server cluster consisting of multiple servers.

[0047] In one embodiment, Figure 2 As shown, a method for identifying power grid protocols based on a knowledge graph is provided, and the method is applied to the server in FIG1 as an example for explanation, including the following steps:

[0048] Step S201, acquiring historical power grid flow data, and extracting flow characteristic data and message header data from the historical power grid flow data.

[0049] Specifically, the server first conducts an in-depth analysis of the power grid traffic, extracts key information that can represent the protocol characteristics, and extracts global features from the power grid traffic. It includes statistical features, packet size, etc., and extracts the message header containing protocol field information, divides it into message streams according to sessions, and strips off the data in the payload.

[0050] For example, the server extracts statistical features from the power grid source traffic pcap file by using the CICflowmeter traffic feature extraction tool, extracts the message header containing the protocol field information from the power grid source traffic pcap file, divides it into message streams according to the session, and strips off the data in the payload.

[0051] Multi-source similar flow merging: The server implements multi-source flow merging based on cosine similarity. When performing network flow analysis, processing and integrating similar flow data from different sources is a key task. To achieve this goal, we can use a method based on cosine similarity to analyze and merge multi-source flow. Cosine similarity is an indicator that measures the similarity between two flows. Its calculation formula is described as (1). When the cosine similarity of two flows reaches or exceeds the preset threshold When , we can consider that the two flows have high similarity, so they can be merged. It is determined based on actual experience.

[0052] (1)

[0053] In the above formula, v and s represent two different flows, M represents the dimension of the feature, and i represents the i-th flow feature.

[0054] Merged flow feature extraction: The server extracts and analyzes the global features of the merged traffic. , based on experience, for global features Simplify and select the features that best reflect the protocol category to obtain the one-dimensional feature set of power grid traffic , and obtain the binary data D of the message stream header stripped of the message stream payload data.

[0055] Step S202, training the initial power grid protocol recognition model according to the flow characteristic data to obtain a trained power grid protocol recognition model, and training the initial power grid protocol field recognition model according to the message header data to obtain a trained power grid protocol field recognition model.

[0056] Specifically, the server pre-trained power grid protocol recognition model can utilize a large amount of labeled power grid flow data to pre-train the power grid protocol recognition model. This recognition model is based on a convolutional neural network and can identify the protocol category to which unknown power grid flow belongs; the pre-trained power grid protocol field recognition model can utilize a large amount of labeled power grid message flow header data to pre-train the power grid protocol field recognition model. This recognition model is based on Transformer and can identify some common protocol fields contained in unknown power grid flow. This recognition model is a multi-label classification model.

[0057] For example, the server pre-trained power grid protocol recognition model can be used through the one-dimensional feature set of power grid traffic. , using a large amount of labeled power grid flow data, pre-training power grid protocol recognition model, the recognition model is based on convolutional neural network, can identify the protocol category to which unknown power grid flow belongs, the process of inputting feature set into convolutional neural network to obtain the result is given by calculation formula (2), where, is the convolution kernel, is bias.

[0058] (2)

[0059] The server pre-trained power grid protocol field recognition model can use the binary data D of the message flow header and a large amount of labeled power grid message flow header data to pre-train the power grid protocol field recognition model. The protocol fields contained in the power grid message flow header data will not be fully labeled, but some representative protocol fields will be selected based on practical experience. This recognition model is based on Transformer and can identify some common protocol fields contained in unknown power grid traffic.

[0060] Step S203, using the power grid protocol identification model and the power grid protocol field identification model to respectively extract relations from the power grid flow data, and obtain the protocol category label output by the power grid protocol identification model and the protocol field prediction value output by the power grid protocol field identification model.

[0061] Specifically, the server inputs the power grid flow data into the power grid protocol recognition model for relationship extraction, obtains the protocol category label output by the power grid protocol recognition model, and inputs the power grid flow data into the power grid protocol field recognition model for relationship extraction, obtains the protocol category label output by the power grid protocol field recognition model.

[0062] Step S204, constructing a power grid protocol knowledge graph based on the protocol category labels and protocol field prediction values.

[0063] Specifically, the server determines the target protocol category based on the protocol category label, and determines the correlation between the power grid flow and the protocol field of the target protocol category based on the predicted value of the protocol field; based on the correlation, a power grid protocol subgraph is constructed with the target protocol category as the central node and the protocol field as the surrounding nodes; the power grid protocol subgraphs are then connected through the common protocol fields of each target protocol category to obtain a power grid protocol knowledge graph.

[0064] Step S205, for the current power grid flow data, based on the power grid protocol knowledge graph, adjust the protocol category label prediction value output by the power grid protocol identification model, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0065] Specifically, the server calculates the degree of association between the protocol category label prediction value and the current protocol field based on the structured information in the power grid protocol knowledge graph; according to the degree of association, the server adjusts the protocol category label prediction value output by the power grid protocol identification model to obtain the adjusted protocol category label prediction value, and identifies the protocol category of the current power grid flow data based on the adjusted protocol category label prediction value.

[0066] The above-mentioned power grid protocol identification method based on knowledge graph extracts flow feature data and message header data containing protocol field information by using a flow feature extraction tool, and then pre-trains the power grid protocol identification model and the power grid protocol field identification model according to the extracted flow feature data and message header data, and uses the protocol category labels and protocol field prediction values ​​output by the trained model to construct a power grid protocol knowledge graph that reflects the correlation between the protocol category labels and the protocol field labels. For a new current power grid flow data, the degree of correlation between each label prediction value and the predicted protocol field is calculated according to the weight information in the power grid protocol knowledge graph. The correlation degree and the label prediction value constitute an adjusted label prediction value, and finally the protocol category of the current power grid flow data is identified according to the adjusted protocol category label prediction value. In summary, the entire application scheme adopts a protocol identification method based on knowledge graph, and significantly improves the accuracy of identifying the protocol category of power grid flow data by combining the prediction results of the pre-trained model and the structured information in the knowledge graph.

[0067] In one embodiment, if Figure 3 As shown, in the above step S204, a power grid protocol knowledge graph is constructed according to the protocol category label and the protocol field prediction value, which specifically includes the following steps:

[0068] Step S301, determining a target protocol category according to the protocol category label, and determining a correlation between a power grid flow of the target protocol category and a protocol field according to the predicted value of the protocol field.

[0069] Step S302: constructing a power grid protocol subgraph with the target protocol category as a central node and the protocol fields as surrounding nodes according to the association degree.

[0070] Step S303, connecting the power grid protocol subgraphs through the common protocol fields of each of the target protocol categories to obtain the power grid protocol knowledge graph.

[0071] Specifically, based on the extracted features and classification results, the server constructs a power grid protocol knowledge graph, which contains two types of nodes: protocol categories and protocol fields, as well as the association between them. A protocol field may be included in multiple types of protocols. The two types of nodes, protocol categories and protocol fields, are connected by edges, where the weight of the edge reflects the strength of association between different protocol categories and protocol fields. The knowledge graph can be dynamically updated to reflect changes in the power grid communication environment and the emergence of new protocols.

[0072] For example, Figure 4As shown, the server re-enters the training data, and based on the extracted features and classification results, constructs a power grid protocol knowledge graph, which contains two types of nodes, protocol categories and protocol fields, and the association between them. A protocol field may be included in multiple types of protocols. The two types of nodes, protocol categories and protocol fields, are connected by edges, where the weight of the edge reflects the strength of association between different protocol categories and fields. The recognition model trained in the above steps is used to extract the relationship of the power grid flow data in the training set, and the power grid protocol knowledge graph is constructed. For a piece of power grid flow data, the most likely protocol category label of the power grid flow data is output through the power grid protocol recognition model, and the predicted value of the protocol field contained in the power grid flow is output through the power grid protocol field recognition model, where the predicted value of each protocol field is the correlation between the protocol flow of the category and the protocol field. For the power grid flow of the protocol category, a subgraph with the protocol category as the central node and the protocol field as the surrounding nodes is constructed. Finally, a corresponding subgraph is constructed for the flow of each protocol category, and these subgraphs are connected through the common protocol field.

[0073] In one embodiment, before adjusting the predicted value of the protocol category label output by the power grid protocol identification model based on the power grid protocol knowledge graph, the method of the present application further includes the following steps:

[0074] The power grid protocol recognition model is used to make a preliminary prediction of the protocol category of the current power grid flow data to obtain the predicted value of the protocol category label; the current power grid flow data is input into the power grid protocol field recognition model for protocol field recognition to obtain the current protocol field contained in the current power grid flow data.

[0075] In the above step S205, based on the power grid protocol knowledge graph, adjusting the predicted value of the protocol category label output by the power grid protocol identification model specifically includes the following steps:

[0076] Based on the structured information in the power grid protocol knowledge graph, the correlation degree between the protocol category label prediction value and the current protocol field is calculated; according to the correlation degree, the protocol category label prediction value output by the power grid protocol identification model is adjusted to obtain the adjusted protocol category label prediction value.

[0077] Specifically, for the newly received current power grid flow data, the server first uses the power grid protocol recognition model to make a preliminary prediction of the protocol category, and then uses the power grid protocol field recognition model to predict the fields contained in the data. Then, combined with the structured information in the knowledge graph, the correlation between the first k predicted protocol category labels and the predicted protocol fields is calculated. According to the correlation degree, the predicted protocol category label prediction value is adjusted, and the protocol category prediction of the power grid flow is performed based on the adjusted protocol category label prediction value.

[0078] For example, for newly received power grid flow data, the server first uses the power grid protocol recognition model to make a preliminary prediction of the protocol category, and then uses the power grid protocol field recognition model to predict the fields contained in the data. Combined with the structured information in the knowledge graph, the degree of association between the first k predicted protocol category labels and the predicted protocol fields is calculated, where the value of k is determined based on practical experience. Specifically, for each predicted label in the first k predicted protocol category labels, combined with the weight information in the knowledge graph, its degree of association with each predicted protocol field is calculated and the average value is taken, as shown in calculation formula (3):

[0079] (3)

[0080] In the above formula, is the average value of the correlation between the protocol category label and the protocol field, m is the number of predicted protocol fields, is the knowledge graph constructed in the above steps, b is the protocol category label, ci is the protocol field, is the weight of the edge connecting the protocol tag and the protocol field in the knowledge graph. If the protocol field and the protocol tag are not adjacent nodes in the knowledge graph, the weight is 0. is a weight parameter used to adjust the importance of the degree of association versus the predictive value of the protocol category itself.

[0081] In one embodiment, in the above step S205, identifying the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value specifically includes the following steps:

[0082] Among the adjusted protocol category label prediction values, identify the target protocol category label prediction value with the largest value; and determine the protocol category corresponding to the target protocol category label prediction value as the protocol category of the current power grid flow data.

[0083] Specifically, the server compares the adjusted protocol category label prediction values, identifies the target protocol category label prediction value with the largest value, and determines the protocol category corresponding to the target protocol category label prediction value as the protocol category of the current power grid flow data.

[0084] For example, the server adds the average correlation degree to the predicted value of the predicted label itself to obtain the latest predicted value of the predicted label, and the label with the largest predicted value is the category of the protocol.

[0085] In one embodiment, the method of the present application further includes the following steps:

[0086] Acquire first feedback data of a power grid protocol identification model and second feedback data of a power grid protocol field identification model; update model parameters of the power grid protocol identification model according to the first feedback data, and update model parameters of the power grid protocol field identification model according to the second feedback data;

[0087] In the above step S203, the power grid protocol identification model and the power grid protocol field identification model are used to extract the relationship of the power grid flow data respectively, which specifically includes the following steps:

[0088] The updated power grid protocol identification model and the updated power grid protocol field identification model are used to extract relations from the power grid flow data respectively.

[0089] The first feedback data may be historical output data processed by a power grid protocol identification model, and the second feedback data may be historical output data processed by a power grid protocol field identification model.

[0090] Specifically, the server obtains first feedback data of the power grid protocol identification model and second feedback data of the power grid protocol field identification model; updates the model parameters of the power grid protocol identification model according to the first feedback data, and updates the model parameters of the power grid protocol field identification model according to the second feedback data; and uses the updated power grid protocol identification model and the updated power grid protocol field identification model to respectively extract relationships from the power grid flow data to obtain more accurate output data.

[0091] In this embodiment, by obtaining the first feedback data of the power grid protocol identification model and the second feedback data of the power grid protocol field identification model, the model parameters of the power grid protocol identification model are updated according to the first feedback data, and the model parameters of the power grid protocol field identification model are updated according to the second feedback data, so that the identification model can be updated and corrected in real time through the latest feedback data, which is conducive to obtaining a more accurate identification model.

[0092] In one embodiment, Figure 5 As shown, a power grid protocol identification method based on a knowledge graph in a specific embodiment is provided, which specifically includes the following steps:

[0093] Step S501, acquiring historical power grid flow data, and extracting flow characteristic data and message header data from the historical power grid flow data.

[0094] Step S502, training the initial power grid protocol recognition model according to the flow characteristic data to obtain a trained power grid protocol recognition model, and training the initial power grid protocol field recognition model according to the message header data to obtain a trained power grid protocol field recognition model.

[0095] Step S503, using the power grid protocol identification model and the power grid protocol field identification model to respectively extract relations from the power grid flow data, and obtain the protocol category label output by the power grid protocol identification model and the protocol field prediction value output by the power grid protocol field identification model.

[0096] Step S504, determine the target protocol category according to the protocol category label, and determine the correlation between the power grid flow and the protocol field of the target protocol category according to the predicted value of the protocol field; according to the correlation, construct a power grid protocol subgraph with the target protocol category as the central node and the protocol field as the surrounding nodes; connect the power grid protocol subgraphs through the common protocol fields of each target protocol category to obtain a power grid protocol knowledge graph.

[0097] Step S505, for the current power grid flow data, use the power grid protocol identification model to make a preliminary prediction on the protocol category of the current power grid flow data to obtain the protocol category label prediction value; input the current power grid flow data into the power grid protocol field identification model to perform protocol field identification to obtain the current protocol field contained in the current power grid flow data.

[0098] Step S506, based on the structured information in the power grid protocol knowledge graph, calculate the degree of association between the protocol category label prediction value and the current protocol field; according to the degree of association, adjust the protocol category label prediction value output by the power grid protocol identification model to obtain the adjusted protocol category label prediction value.

[0099] Step S507, identifying the target protocol category label prediction value with the largest value among the adjusted protocol category label prediction values; and determining the protocol category corresponding to the target protocol category label prediction value as the protocol category of the current power grid flow data.

[0100] The beneficial effects brought by the above embodiments are as follows:

[0101] The technical solution in this application draws on the application ideas of image knowledge graph in image classification, maps power grid flow data to knowledge graph, and uses the rich relationship information represented by knowledge graph to improve the accuracy and robustness of protocol category recognition. Based on the method of combining knowledge graph with artificial intelligence, it can more effectively identify and analyze communication protocols in the power grid, realize automatic protocol category prediction, fast speed and low hardware requirements, easy to deploy and apply in practice, thus providing support for the safe operation of smart grid.

[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a knowledge graph-based power grid protocol identification device for implementing the above-mentioned knowledge graph-based power grid protocol identification method. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above-mentioned method, so the specific limitations in one or more knowledge graph-based power grid protocol identification device embodiments provided below can refer to the limitations of the knowledge graph-based power grid protocol identification method above, and will not be repeated here.

[0104] In an exemplary embodiment, Figure 6 As shown, a power grid protocol identification device based on a knowledge graph is provided, comprising:

[0105] The data acquisition module 601 is used to acquire historical power grid flow data and extract flow characteristic data and message header data from the historical power grid flow data;

[0106] The model training module 602 is used to train the initial power grid protocol recognition model according to the flow characteristic data to obtain a trained power grid protocol recognition model, and to train the initial power grid protocol field recognition model according to the message header data to obtain a trained power grid protocol field recognition model;

[0107] The relationship extraction module 603 is used to use the power grid protocol identification model and the power grid protocol field identification model to respectively extract the relationship of the power grid flow data, and obtain the protocol category label output by the power grid protocol identification model and the protocol field prediction value output by the power grid protocol field identification model;

[0108] A graph construction module 604, used to construct a power grid protocol knowledge graph according to the protocol category labels and the protocol field prediction values;

[0109] The category identification module 605 is used to adjust the protocol category label prediction value output by the power grid protocol identification model for the current power grid flow data based on the power grid protocol knowledge graph, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

[0110] In one embodiment, the graph construction module 604 is also used to determine the target protocol category based on the protocol category label, and determine the correlation between the power grid flow and the protocol field of the target protocol category based on the predicted value of the protocol field; based on the correlation, construct a power grid protocol subgraph with the target protocol category as the central node and the protocol field as the surrounding nodes; connect the power grid protocol subgraphs through the common protocol fields of each target protocol category to obtain a power grid protocol knowledge graph.

[0111] In one embodiment, the knowledge graph-based power grid protocol identification device also includes a preliminary prediction module, which is used to use the power grid protocol identification model to make a preliminary prediction on the protocol category of the current power grid flow data to obtain a protocol category label prediction value; input the current power grid flow data into the power grid protocol field identification model to perform protocol field identification to obtain the current protocol field contained in the current power grid flow data.

[0112] In one embodiment, the category identification module 605 is also used to calculate the degree of association between the protocol category label prediction value and the current protocol field based on the structured information in the power grid protocol knowledge graph; according to the degree of association, the protocol category label prediction value output by the power grid protocol identification model is adjusted to obtain the adjusted protocol category label prediction value.

[0113] In one embodiment, the category identification module 605 is also used to identify the target protocol category label prediction value with the largest value among the adjusted protocol category label prediction values; and determine the protocol category corresponding to the target protocol category label prediction value as the protocol category of the current power grid flow data.

[0114] In one embodiment, the knowledge graph-based power grid protocol identification device also includes a preliminary prediction module, which is used to obtain first feedback data of the power grid protocol identification model and second feedback data of the power grid protocol field identification model; update the model parameters of the power grid protocol identification model according to the first feedback data, and update the model parameters of the power grid protocol field identification model according to the second feedback data; the relationship extraction module 603 is also used to use the updated power grid protocol identification model and the updated power grid protocol field identification model to respectively extract relationships from the power grid flow data.

[0115] Each module in the above-mentioned knowledge graph-based power grid protocol identification device can be implemented in whole or in part by software, hardware, and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0116] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG7. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store historical power grid flow data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a power grid protocol identification method based on a knowledge graph is implemented.

[0117] Those skilled in the art will understand that the structure shown in FIG. 7 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0118] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0119] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0120] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0121] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0122] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0123] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0124] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A power grid protocol identification method based on knowledge graph, characterized in that: The method comprises: Acquire historical power grid flow data, and extract flow characteristic data and message header data from the historical power grid flow data; According to the flow characteristic data, an initial power grid protocol recognition model is trained to obtain a trained power grid protocol recognition model, and according to the message header data, an initial power grid protocol field recognition model is trained to obtain a trained power grid protocol field recognition model; The power grid protocol identification model and the power grid protocol field identification model are used to respectively perform relationship extraction on the power grid flow data to obtain a protocol category label output by the power grid protocol identification model and a protocol field prediction value output by the power grid protocol field identification model; Constructing a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value; For the current power grid flow data, based on the power grid protocol knowledge graph, the protocol category label prediction value output by the power grid protocol identification model is adjusted, and the protocol category of the current power grid flow data is identified according to the adjusted protocol category label prediction value.

2. The method according to claim 1, characterized in that: The step of constructing a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value includes: Determine a target protocol category according to the protocol category label, and determine a correlation between the power grid flow of the target protocol category and the protocol field according to the predicted value of the protocol field; According to the association degree, constructing a power grid protocol subgraph with the target protocol category as a central node and the protocol field as a surrounding node; The power grid protocol subgraphs are connected through the common protocol fields of each of the target protocol categories to obtain the power grid protocol knowledge graph.

3. The method according to claim 1, characterized in that Before adjusting the predicted value of the protocol category label output by the power grid protocol identification model based on the power grid protocol knowledge graph, the method further includes: Using the power grid protocol identification model to preliminarily predict the protocol category of the current power grid flow data, and obtain the protocol category label prediction value; The current power grid flow data is input into the power grid protocol field identification model to perform protocol field identification, and the current protocol field contained in the current power grid flow data is obtained.

4. The method according to claim 3, characterized in that: The adjusting the predicted value of the protocol category label output by the power grid protocol identification model based on the power grid protocol knowledge graph includes: Based on the structured information in the power grid protocol knowledge graph, calculating the degree of association between the protocol category label prediction value and the current protocol field; According to the degree of association, the protocol category label prediction value output by the power grid protocol identification model is adjusted to obtain the adjusted protocol category label prediction value.

5. The method according to claim 4, characterized in that The step of identifying the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value includes: Among the adjusted protocol category label prediction values, identifying the target protocol category label prediction value with the largest value; The protocol category corresponding to the target protocol category label prediction value is determined as the protocol category of the current power grid flow data.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Acquire first feedback data of the power grid protocol identification model and second feedback data of the power grid protocol field identification model; updating the model parameters of the power grid protocol identification model according to the first feedback data, and updating the model parameters of the power grid protocol field identification model according to the second feedback data; The using the power grid protocol identification model and the power grid protocol field identification model to respectively extract relations from the power grid flow data comprises: The updated power grid protocol identification model and the updated power grid protocol field identification model are used to perform relationship extraction on the power grid flow data respectively.

7. A power grid protocol identification device based on knowledge graph, characterized in that: The device comprises: A data acquisition module, used to acquire historical power grid flow data, and extract flow characteristic data and message header data from the historical power grid flow data; A model training module, used to train an initial power grid protocol recognition model according to the flow characteristic data to obtain a trained power grid protocol recognition model, and to train an initial power grid protocol field recognition model according to the message header data to obtain a trained power grid protocol field recognition model; A relationship extraction module, used to use the power grid protocol identification model and the power grid protocol field identification model to respectively perform relationship extraction on the power grid flow data, and obtain the protocol category label output by the power grid protocol identification model and the protocol field prediction value output by the power grid protocol field identification model; A graph construction module, used to construct a power grid protocol knowledge graph according to the protocol category label and the protocol field prediction value; A category identification module is used to adjust the protocol category label prediction value output by the power grid protocol identification model for the current power grid flow data based on the power grid protocol knowledge graph, and identify the protocol category of the current power grid flow data according to the adjusted protocol category label prediction value.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images