A method and system for detecting anomaly in power ciphertext data based on function encryption

Abstract

The present invention discloses a method and system for detecting anomalies in electric power ciphertext data based on function encryption. The method comprises: sliding a time step on each electric power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal electric power time series data subsequences; constructing a corresponding abnormal electric power time series data subsequence according to at least one normal electric power time series data subsequence; encrypting the normal electric power time series data subsequence and the abnormal electric power time series data subsequence according to a preset function encryption mechanism, and inputting the encrypted normal electric power time series data and the abnormal electric power time series data into a pre-constructed LSTM-FCN network model to obtain an anomaly detection model through training; inputting the encrypted real-time electric power time series data sequence into the anomaly detection model, and the anomaly detection model outputs the detection result. The end-to-end time series anomaly detection method can directly output the detection result, reduce the intermediate steps, and improve the detection speed.

Description

Technical Field

[0001] The present invention belongs to the technical field of power data detection, and in particular relates to a method and system for detecting anomalies in power ciphertext data based on function encryption. Background Art

[0002] In the process of anomaly detection of ciphertext data, it is inevitable to perform relevant calculations on the ciphertext. At present, the fully homomorphic encryption algorithm can perform model training under ciphertext while ensuring that the ciphertext is not damaged. However, how to calculate the gradient and back propagate under fully homomorphic ciphertext is a difficulty to be solved. Function encryption can obtain the calculation results without leaking the plaintext, which is simpler and more efficient. At present, in the field of anomaly detection, anomaly detection technology based on deep learning has the advantages of fast speed, high accuracy, and can be used for high-dimensional data, and is widely used. The deep learning-based method learns the characteristics of the data by training the deep model. During reasoning, the data to be detected can be directly input into the model for anomaly detection. The current deep learning-based anomaly detection can be divided into reconstruction-based methods and prediction-based methods.

[0003] However, these methods still have certain limitations. For example, the reconstruction-based method only learns the distribution of normal data. Due to the generalization of neural networks, abnormal data can be reconstructed very well during reasoning. The prediction-based method relies on the training of a large amount of data and the extraction of data features. At the same time, the deep learning-based method has problems in training and reasoning of fully homomorphic ciphertexts, such as high computational complexity, large consumption of computing resources and storage space, difficulty in implementing gradient calculations in the encrypted domain, high precision loss and communication overhead. Summary of the invention

[0004] The present invention provides a method and system for detecting anomalies in electric power ciphertext data based on function encryption, which are used to solve the technical problem that it is difficult to perform anomaly detection on encrypted electric power data when storage resources and computing resources are limited.

[0005] In a first aspect, the present invention provides a method for detecting anomalies in power ciphertext data based on function encryption, comprising:

[0006] Obtaining power time series data of a continuous period of time in the power equipment under normal operating conditions, and sliding a time step on each power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences;

[0007] Constructing a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence;

[0008] The normal power time series data subsequence and the abnormal power time series data subsequence are encrypted according to a preset function encryption mechanism, and the encrypted normal power time series data and the first label corresponding to the normal power time series data, as well as the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data are input into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model;

[0009] A real-time power time series data sequence is acquired, data of the real-time power time series data sequence is encrypted according to the function encryption mechanism, and the encrypted real-time power time series data sequence is input into the anomaly detection model, and the anomaly detection model outputs a detection result.

[0010] In a second aspect, the present invention provides a power ciphertext data anomaly detection system based on function encryption, comprising:

[0011] An acquisition module is configured to acquire power time series data of a continuous period of time in the power equipment under normal operating conditions, and slide a time step on each power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences;

[0012] A construction module, configured to construct a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence;

[0013] A training module is configured to encrypt the normal power time series data subsequence and the abnormal power time series data subsequence according to a preset function encryption mechanism, and input the encrypted normal power time series data and the first label corresponding to the normal power time series data, and the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model;

[0014] The output module is configured to obtain a real-time power time series data sequence, encrypt the real-time power time series data sequence according to the function encryption mechanism, and input the encrypted real-time power time series data sequence into the anomaly detection model, and the anomaly detection model outputs a detection result.

[0015] According to a third aspect, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the steps of the method for detecting anomalies in power ciphertext data based on function encryption according to any embodiment of the present invention.

[0016] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor executes the steps of the method for detecting anomalies in power ciphertext data based on function encryption according to any embodiment of the present invention.

[0017] The present application discloses a method and system for detecting anomalies in electric power ciphertext data based on function encryption. Function encryption allows calculations to be performed directly on encrypted data, avoiding the high computational and communication overheads caused by homomorphic encryption. It can perform effective calculations without decrypting the data, ensuring data privacy while improving system efficiency. The result of function encryption can be directly interpreted as the result of plaintext operations, which makes it more intuitive and easy to understand when processing ciphertext data, and performs anomaly detection directly from input to output, reducing intermediate links and improving detection speed and efficiency. In a ciphertext environment, reconstruction and prediction methods may lead to inconsistent detection results due to different deviations between ciphertext and plaintext. The end-to-end method avoids this inconsistency by directly processing the ciphertext. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0019] Figure 1 A flowchart of a method for detecting anomalies in power ciphertext data based on function encryption provided by one embodiment of the present invention;

[0020] Figure 2 A structural block diagram of a power ciphertext data anomaly detection system based on function encryption provided by an embodiment of the present invention;

[0021] Figure 3 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] See also Figure 1, which shows a flow chart of a method for detecting anomalies in power ciphertext data based on function encryption of the present application.

[0024] like Figure 1 As shown, the power ciphertext data anomaly detection method based on function encryption specifically includes the following steps:

[0025] Step S101, obtaining power time series data of a continuous period of time in the power equipment under normal operating conditions, and sliding a time step on each power time series data each time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences.

[0026] In this step, a normal training data set is constructed based on each power time series data , is the data at the first time point, is the data at the second time point, is the data at the Nth time point;

[0027] According to the length The window slides on the data in the normal training data set, moving one time step each time, generating multiple overlapping normal power time series data subsequences, which are expressed as:

[0028] ,

[0029] In the formula, is the first normal power time series data subsequence, is the second normal power time series data subsequence, For the A normal power timing data subsequence.

[0030] Step S102: construct a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence.

[0031] In this step, random noise is added to the at least one normal power time series data subsequence to obtain an abnormal power time series data subsequence corresponding to the at least one normal power time series data subsequence, and the expression is:

[0032] ,

[0033] In the formula, is the ith abnormal power time series data subsequence, is the i-th normal power time series data subsequence, is random noise drawn from a normal distribution, is a normal distribution;

[0034] An abnormal value is inserted into a specific time series position in the at least one normal power time series data subsequence to obtain an abnormal power time series data subsequence corresponding to the at least one normal power time series data subsequence, and the expression is:

[0035] ,

[0036] In the formula, An abnormal value that is significantly different from the normal value. is the position of the abnormal value set in the normal power time series data subsequence, is the normal value at the ith position in the normal power time series data subsequence, is the position number in the normal power time series data subsequence;

[0037] A trend change is introduced into the normal power time series data in the at least one normal power time series data subsequence to obtain abnormal power time series data corresponding to the normal power time series data, and the expression is:

[0038] ,

[0039] In the formula, is the i-th abnormal power time series data, is the i-th normal power time series data, is the slope of the trend change of the i-th normal power time series data, is the intercept;

[0040] Drift is introduced into the normal power time series data in the at least one normal power time series data subsequence to obtain abnormal power time series data corresponding to the normal power time series data, and the expression is:

[0041] ,

[0042] ,

[0043] In the formula, is the drift amplitude, is a function that gradually increases after a certain time point, The time point at which the drift starts is set. is the time corresponding to the i position in the normal power time series data subsequence;

[0044] Randomly missing values ​​in the normal power time series data in the at least one normal power time series data subsequence, to obtain abnormal power time series data corresponding to the normal power time series data, the expression is:

[0045] ,

[0046] In the formula, is a missing value, is a random number generated from the range [0,1]. is the probability of losing data.

[0047] Step S103, encrypt the normal power timing data subsequence and the abnormal power timing data subsequence respectively according to a preset function encryption mechanism, and input the encrypted normal power timing data and the first label corresponding to the normal power timing data, as well as the encrypted abnormal power timing data and the second label corresponding to the abnormal power timing data into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model.

[0048] In this step, function encryption is used to encrypt normal data and simulated abnormal data, so that the server can perform training without knowing the plaintext to protect the privacy of the data, and the encrypted normal data and simulated abnormal data and corresponding labels are sent to the server;

[0049] The encryption mechanism includes key generation and key distribution processes, which are used by the server to calculate the ciphertext results without knowing the plaintext. This process needs to be completed by a trusted third party. The trusted third-party authority (TPA) is an entity trusted by both the client and the server. It is responsible for initializing the model by setting security parameters, providing key distribution services for the client and the server, and processing the function key request of the server during the model training or classification process, and generating function keys for it. TPA is only equivalent to the role of a trusted certificate authority in the existing public key infrastructure, and thereafter, it does not participate in any training or classification calculation process.

[0050] The normal power time series data subsequence and the abnormal power time series data subsequence are encrypted respectively according to the inner product function encryption algorithm. The inner product function encryption algorithm is formally defined as: , specifically:

[0051] Initialization algorithm Used to calculate and generate public and private key pairs, input given security parameters and vector length , output the public key and the master private key ;

[0052] Key generation algorithm Used to generate a function key with inner product function, input the master private key and the vector whose inner product is calculated Output function key ;

[0053] Encryption Algorithm Used to vectorize plain text To encrypt, enter the public key For the plaintext vector Encrypt and output ciphertext ;

[0054] Decryption algorithm Used to decrypt the result of the inner product function without revealing the plaintext vector Enter the public key , function key, ciphertext and vector , output the plaintext result of the function calculation .

[0055] First, the client applies for an inner product function encryption (IPFEA) request to the third party to encrypt the training data. The third party will call the Setup function to initialize and obtain the public key and master private key, and distribute the public key to the client. After receiving the public key, the client uses the Encrypt function to encrypt the data to obtain the ciphertext data, and sends the ciphertext data, data label and public key to the server.

[0056] It should be noted that the anomaly detection model includes a ciphertext convolution layer, a ciphertext fitting layer with a discriminative loss, and a discriminative network.

[0057] The ciphertext convolution layer uses a function to encrypt the input ciphertext data to obtain the plaintext result after convolution without knowing the plaintext. This process will apply for a function key request from a trusted third-party agency (TPA). This process will obtain a function key and then call IPFEA.Decrypt to calculate the plaintext result after the ciphertext convolution.

[0058] The identification network includes LSTM layer, FCN layer, feature fusion layer, and classification layer. The identification network inputs the plaintext result after ciphertext convolution, extracts the time series features of the plaintext result with LSTM layer, and extracts the spatial features with FCN. The extracted features are channel-joined and then pass through the coordinate attention layer and one-dimensional convolution respectively for multiplication to achieve the purpose of feature fusion. Then, the abnormal probability is obtained through the classification layer, and the abnormal probability is used as the prediction result. The classification layer includes one-dimensional convolution, MLP and softmax. The classification loss is calculated by comparing the prediction result with the true label, and then the ciphertext convolution layer and the identification network are trained by gradient descent. The expression of classification loss is:

[0059] ,

[0060] In the formula, is the classification loss, is the sample size, is the output of the identification network;

[0061] The ciphertext convolution layer includes a decryption network and an identification loss including an identification network. The decryption network converts the ciphertext data into plaintext data. The decryption network includes a parameter convolution structure and a time-dependent nonlinear reconstruction network. The specific process of constructing the time-dependent nonlinear reconstruction network is as follows:

[0062] According to the RNN input ciphertext data, the dependency between items in the subsequence is learned, and the expression is:

[0063]

[0064] In the formula, is the hidden state of the RNN at time step t, is the activation function of RNN, is the weight of RNN, is the value of the ciphertext data at position t in the subsequence, is the hidden state of the RNN at time step t-1, is the bias of RNN;

[0065] The hidden state of the RNN at the intermediate time step is added to the input of the MLP to learn the nonlinear characteristics of the data, expressed as:

[0066]

[0067] In the formula, is the output of the time-dependent nonlinear reconstruction network, is the activation function of MLP, is the weight of MLP, is the hidden state of the RNN intermediate time step, is the final output of RNN, is the bias of MLP;

[0068] The parameter convolution structure is used to convert the parameters of the ciphertext convolution layer to the same size as the output of the time-dependent nonlinear reconstruction network, and the expression is:

[0069] ,

[0070] In the formula, are the parameters of the ciphertext convolutional layer, is the weight of the convolution, is the bias of the convolution;

[0071] Will and Channel concatenation is performed, and the concatenated features are converted to the original sequence dimension size according to one-dimensional convolution. The expression is:

[0072] ,

[0073] In the formula, is the weight of the one-dimensional convolution, is the bias of the one-dimensional convolution, is the reconstructed plaintext data, for and Channel concatenation in the first dimension, It is a one-dimensional convolutional layer;

[0074] The reconstruction loss is calculated based on the reconstructed plaintext data and the output of the ciphertext convolution layer. The expression of the reconstruction loss is:

[0075] ,

[0076] In the formula, is the value of the output of the ciphertext convolution at the i-th position, is the value of the output of the decryption network at the i-th position;

[0077] The output of the ciphertext fitting layer is sent to the identification network to obtain the output and the output of the penultimate layer of the identification network as the predicted value. The output of the ciphertext convolutional network is sent to the identification network to obtain the output and the output of the penultimate layer of the identification network as the true value. The output of the ciphertext fitting layer is sent to the identification network to obtain the output and the output of the penultimate layer. The identification loss is calculated based on the predicted value and the corresponding true value. The expression of the identification loss is:

[0078] ,

[0079] In the formula, To identify the loss, To identify the output of the last layer of the network, To identify the output of the penultimate layer of the network, To identify the network's identification result for the i-th ciphertext convolution output sequence, To identify the identification result of the network for the i-th decryption network output sequence, To identify the eigenvalue of the second-to-last layer of the i-th ciphertext convolution output sequence, To identify the network, we need to find the feature value of the second-to-last layer of the i-th decryption network output sequence;

[0080] The total loss of the anomaly detection model is obtained according to the classification loss, the reconstruction loss and the identification loss, and the expression is:

[0081] ,

[0082] In the formula, is the total loss of the anomaly detection model.

[0083] Step S104, obtaining a real-time power time series data sequence, encrypting the real-time power time series data sequence according to the function encryption mechanism, and inputting the encrypted real-time power time series data sequence into the anomaly detection model, and the anomaly detection model outputs a detection result.

[0084] In this step, an acceptable error threshold is set to ensure that the reconstruction loss of the trained ciphertext fitting layer is within an acceptable range. Then, the ciphertext fitting layer is used instead of the ciphertext convolution layer when performing anomaly detection. This model is used for anomaly detection: the client encrypts the data to be detected in the same way and sends it to the server. After receiving the data, the server inputs it into the anomaly detection model to obtain the probability value of the anomaly. This process does not require the process of requesting a function key from a third party, which can improve the efficiency of anomaly detection. Then, the anomaly detection probability is compared with the preset anomaly detection threshold. If it is greater than the threshold, it is judged to be abnormal, otherwise it is judged to be normal. Finally, the anomaly detection result is returned to the client;

[0085] The execution process of secure convolution:

[0086] After the server receives the ciphertext data and label from the client, it needs to calculate the plaintext result of the convolution through secure convolution: the server sends the convolution kernel vector to TPA while receiving the ciphertext, and applies for the function key associated with the kernel vector to calculate the inner product value with the ciphertext. TPA calls IPFEA.KeyGen to generate the function key associated with the kernel vector and sends it to the server. The server receives it and calls IPFEA.Decrypt to decrypt and obtain the plaintext inner product result of the ciphertext and the vector.

[0087] Anomaly Detection Model:

[0088] After the server convolves the ciphertext data with the plaintext convolution result, the data will be input into the LSTM layer and FCN layer. LSTM extracts the temporal features of the data to build the front-end dependency relationship. Channel shuffling is performed before inputting into the LSTM layer. Channel shuffling can improve the model's expressiveness and computational efficiency, and promote information exchange between different channels by rearranging the output channels of the convolution layer. The LSTM layer consists of LSTM and dropout. LSTM can effectively capture the long-term dependency in time series data. Through its unique gating mechanism, it can keep memory over a long time step, thus avoiding the gradient vanishing or explosion problem in traditional RNN. Dropou prevents the model from overfitting by randomly discarding a part of neurons during the training process, thereby improving the generalization ability of the model. Dropout can make the model more stable during the training process, reduce the dependence on specific neurons, and thus improve the robustness of the model. The FCN layer consists of three one-dimensional convolution blocks and a global pooling layer. The local features of the data are extracted through convolution operations. The temporal features extracted by LSTM and the spatial feature information extracted by FCN are concat channel cascaded to fully consider the characteristics of the data during classification. Considering that simple concat cannot fully learn in terms of spatial position, coordinate attention is used to capture spatial direction information to generate a coordinate attention map, which is then multiplied with the result of a one-dimensional convolution of the cascade information. The multiplication result is flattened after a one-dimensional convolution and input into the multi-layer perceptron classification layer to obtain a binary classification result. Then, Softmax is used to map it to a range of 0 to 1 with a sum of 1. The class label with a larger value after Softmax is the prediction result. In the training phase, the binary cross entropy loss between the prediction result and the true label is calculated, and then gradient update and back propagation are performed to complete the model training; in the inference phase, i.e., the anomaly detection phase, the prediction result is returned, and data with a high probability of anomaly can also be returned to the client as needed.

[0089] In summary, the method of this application adopts function encryption technology, which allows calculations to be performed directly on encrypted data, ensuring that the data remains encrypted during the entire calculation process, thereby improving data security and privacy protection. Compared with homomorphic encryption, function encryption has significantly improved computational efficiency, especially avoiding the difficulty of gradient calculation under homomorphic ciphertext, reducing computational overhead and complexity;

[0090] Use the ciphertext fitting layer for learnable function encryption. When only function encryption is used, the reasoning process inevitably needs to communicate with a third party to request the function key. The learned ciphertext fitting layer can replace the ciphertext convolution layer during reasoning, reducing communication overhead and key storage space.

[0091] When encrypting the fitting function, a loss function from the discriminator network is used. The feature loss and classification loss of the penultimate layer are used to encrypt the fitting function accurately.

[0092] By using the encrypted convolution layer outside the LSTM module, the need for complex calculations inside the LSTM can be reduced, thereby optimizing the time complexity and improving the overall efficiency of the model. At the same time, applying function encryption in this layer avoids the complexity of applying function encryption in the LSTM and FCN branches.

[0093] Using normal time series data and simulated abnormal time series data for training can enable the model to better learn normal and abnormal patterns, thereby improving detection accuracy. Compared with reconstruction and prediction-based methods, end-to-end time series anomaly detection methods can directly output detection results, reduce intermediate steps, and improve detection speed.

[0094] See also Figure 2 , which shows a structural block diagram of a power ciphertext data anomaly detection system based on function encryption in the present application.

[0095] like Figure 2 As shown, the power ciphertext data anomaly detection system 200 includes an acquisition module 210, a construction module 220, a training module 230 and an output module 240.

[0096] Among them, the acquisition module 210 is configured to acquire the power time series data of the power equipment for a continuous period of time under normal operating conditions, and slide one time step on each power time series data each time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences; the construction module 220 is configured to construct a corresponding abnormal power time series data subsequence based on at least one normal power time series data subsequence; the training module 230 is configured to encrypt the normal power time series data subsequence and the abnormal power time series data subsequence according to a preset function encryption mechanism, respectively, and input the encrypted normal power time series data and the first label corresponding to the normal power time series data, as well as the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data into a pre-constructed LSTM-FCN network model to train and obtain an anomaly detection model; the output module 240 is configured to acquire a real-time power time series data sequence, encrypt the real-time power time series data sequence according to the function encryption mechanism, and input the encrypted real-time power time series data sequence into the anomaly detection model, and the anomaly detection model outputs a detection result.

[0097] It should be understood that Figure 2 Modules and references documented in Figure 1Therefore, the operations and features described above for the method and the corresponding technical effects are also applicable to Figure 2 The modules in it will not be described in detail here.

[0098] In some other embodiments, the embodiments of the present invention further provide a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor is caused to execute the power ciphertext data anomaly detection method based on function encryption in any of the above method embodiments;

[0099] As an implementation mode, the computer-readable storage medium of the present invention stores computer-executable instructions, and the computer-executable instructions are configured as follows:

[0100] Obtaining power time series data of a continuous period of time in the power equipment under normal operating conditions, and sliding a time step on each power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences;

[0101] Constructing a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence;

[0102] The normal power time series data subsequence and the abnormal power time series data subsequence are encrypted according to a preset function encryption mechanism, and the encrypted normal power time series data and the first label corresponding to the normal power time series data, as well as the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data are input into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model;

[0103] A real-time power time series data sequence is acquired, data of the real-time power time series data sequence is encrypted according to the function encryption mechanism, and the encrypted real-time power time series data sequence is input into the anomaly detection model, and the anomaly detection model outputs a detection result.

[0104] The computer-readable storage medium may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created according to the use of the power ciphertext data anomaly detection system based on function encryption, etc. In addition, the computer-readable storage medium may include a high-speed random access memory, and may also include a memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the power ciphertext data anomaly detection system based on function encryption via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0105] Figure 3 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 3 As shown, the device includes: a processor 310 and a memory 320. The electronic device may also include: an input device 330 and an output device 340. The processor 310, the memory 320, the input device 330 and the output device 340 may be connected via a bus or other means. Figure 3 In the example, the connection through the bus is taken as an example. The memory 320 is the above-mentioned computer-readable storage medium. The processor 310 executes various functional applications and data processing of the server by running the non-volatile software programs, instructions and modules stored in the memory 320, that is, the power ciphertext data anomaly detection method based on function encryption of the above-mentioned method embodiment is realized. The input device 330 can receive input digital or character information, and generate key signal input related to user settings and function control of the power ciphertext data anomaly detection system based on function encryption. The output device 340 may include display devices such as display screens.

[0106] The electronic device can execute the method provided by the embodiment of the present invention, and has the functional modules and beneficial effects corresponding to the execution method. For technical details not described in detail in this embodiment, please refer to the method provided by the embodiment of the present invention.

[0107] As an implementation mode, the electronic device is applied to a power ciphertext data anomaly detection system based on function encryption, and is used for a client, and includes: at least one processor; and a memory connected to the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can:

[0108] Obtaining power time series data of a continuous period of time in the power equipment under normal operating conditions, and sliding a time step on each power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences;

[0109] Constructing a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence;

[0110] The normal power time series data subsequence and the abnormal power time series data subsequence are encrypted according to a preset function encryption mechanism, and the encrypted normal power time series data and the first label corresponding to the normal power time series data, as well as the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data are input into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model;

[0111] A real-time power time series data sequence is acquired, data of the real-time power time series data sequence is encrypted according to the function encryption mechanism, and the encrypted real-time power time series data sequence is input into the anomaly detection model, and the anomaly detection model outputs a detection result.

[0112] Through the description of the above implementation modes, those skilled in the art can clearly understand that each implementation mode can be implemented by means of software plus a necessary general hardware platform, or of course by hardware. Based on such an understanding, the above technical solution can essentially or in other words be embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0113] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting anomaly in power ciphertext data based on function encryption, characterized in that: include: Obtaining power time series data of a continuous period of time in the power equipment under normal operating conditions, and sliding a time step on each power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences; Constructing a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence; The normal power time series data subsequence and the abnormal power time series data subsequence are encrypted according to a preset function encryption mechanism, and the encrypted normal power time series data and the first label corresponding to the normal power time series data, as well as the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data are input into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model; Acquire a real-time power time series data sequence, encrypt the real-time power time series data sequence according to the function encryption mechanism, and input the encrypted real-time power time series data sequence into the anomaly detection model, the anomaly detection model outputs a detection result, wherein the anomaly detection model includes a ciphertext convolution layer, a ciphertext fitting layer with a discrimination loss, and a discrimination network; The identification network includes an LSTM layer, an FCN layer, a feature fusion layer and a classification layer. The classification layer includes a one-dimensional convolution, an MLP and a softmax, which are used to calculate the classification loss by comparing the prediction results with the true labels, and train the ciphertext convolution layer and the identification network by the gradient descent method. The expression of the classification loss is: ， In the formula, is the classification loss, is the sample size, is the output of the identification network; The ciphertext convolution layer includes a decryption network and an identification loss including an identification network. The decryption network converts the ciphertext data into plaintext data. The decryption network includes a parameter convolution structure and a time-dependent nonlinear reconstruction network. The specific process of constructing the time-dependent nonlinear reconstruction network is as follows: According to the RNN input ciphertext data, the dependency between items in the subsequence is learned, and the expression is: In the formula, is the hidden state of the RNN at time step t, is the activation function of RNN, is the weight of RNN, is the value of the ciphertext data at position t in the subsequence, is the hidden state of the RNN at time step t-1, is the bias of RNN; The hidden state of the RNN at the intermediate time step is added to the input of the MLP to learn the nonlinear characteristics of the data, expressed as: In the formula, is the output of the time-dependent nonlinear reconstruction network, is the activation function of MLP, is the weight of MLP, is the hidden state of the RNN intermediate time step, is the final output of RNN, is the bias of MLP; The parameter convolution structure is used to convert the parameters of the ciphertext convolution layer to the same size as the output of the time-dependent nonlinear reconstruction network, and the expression is: ， In the formula, are the parameters of the ciphertext convolutional layer, is the weight of the convolution, is the bias of the convolution; Will and Channel concatenation is performed, and the concatenated features are converted to the original sequence dimension size according to one-dimensional convolution. The expression is: ， In the formula, is the weight of the one-dimensional convolution, is the bias of the one-dimensional convolution, is the reconstructed plaintext data, for and Channel concatenation in the first dimension, It is a one-dimensional convolution layer; The reconstruction loss is calculated based on the reconstructed plaintext data and the output of the ciphertext convolution layer. The expression of the reconstruction loss is: ， In the formula, is the value of the output of the ciphertext convolution at the i-th position, is the value of the output of the decryption network at the i-th position; The output of the ciphertext fitting layer is sent to the identification network to obtain the output and the output of the penultimate layer of the identification network as the predicted value. The output of the ciphertext convolutional network is sent to the identification network to obtain the output and the output of the penultimate layer of the identification network as the true value. The output of the ciphertext fitting layer is sent to the identification network to obtain the output and the output of the penultimate layer. The identification loss is calculated based on the predicted value and the corresponding true value. The expression of the identification loss is: ， In the formula, To identify the loss, To identify the output of the last layer of the network, To identify the output of the penultimate layer of the network, To identify the network's identification result for the i-th ciphertext convolution output sequence, To identify the identification result of the network for the i-th decryption network output sequence, To identify the eigenvalue of the penultimate layer of the ciphertext convolution output sequence of the network, To identify the feature value of the second-to-last layer of the i-th decryption network output sequence; The total loss of the anomaly detection model is obtained according to the classification loss, the reconstruction loss and the identification loss, and the expression is: ， In the formula, is the total loss of the anomaly detection model.

2. According to the method for detecting anomaly of power ciphertext data based on function encryption according to claim 1, it is characterized in that: The sliding window of the preset size slides one time step on each power time series data each time to obtain multiple overlapping normal power time series data subsequences including: Build a normal training data set based on various power time series data , is the data at the first time point, is the data at the second time point, is the data at the Nth time point; According to the length The window slides on the data in the normal training data set, moving one time step each time, generating multiple overlapping normal power time series data subsequences, which are expressed as: ， In the formula, is the first normal power time series data subsequence, is the second normal power time series data subsequence, For the A normal power timing data subsequence.

3. According to the method for detecting anomaly of power ciphertext data based on function encryption according to claim 1, it is characterized in that: The step of constructing a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence comprises: Random noise is added to the at least one normal power time series data subsequence to obtain an abnormal power time series data subsequence corresponding to the at least one normal power time series data subsequence, and the expression is: ， In the formula, is the i-th abnormal power time series data subsequence, is the i-th normal power time series data subsequence, is random noise drawn from a normal distribution, is a normal distribution; An abnormal value is inserted into a specific time series position in the at least one normal power time series data subsequence to obtain an abnormal power time series data subsequence corresponding to the at least one normal power time series data subsequence, and the expression is: ， In the formula, An abnormal value that is significantly different from the normal value. is the position of the abnormal value set in the normal power time series data subsequence, is the normal value at the ith position in the normal power time series data subsequence, is the position number in the normal power time series data subsequence; A trend change is introduced into the normal power time series data in the at least one normal power time series data subsequence to obtain abnormal power time series data corresponding to the normal power time series data, and the expression is: ， In the formula, is the i-th abnormal power time series data, is the i-th normal power time series data, is the slope of the trend change of the i-th normal power time series data, is the intercept; Drift is introduced into the normal power time series data in the at least one normal power time series data subsequence to obtain abnormal power time series data corresponding to the normal power time series data, and the expression is: ， ， In the formula, is the drift amplitude, is a function that gradually increases after a certain time point, The time point at which the drift starts is set. is the time corresponding to position i in the normal power time series data subsequence; Randomly missing values ​​in the normal power time series data in the at least one normal power time series data subsequence, to obtain abnormal power time series data corresponding to the normal power time series data, the expression is: ， In the formula, is a missing value, is a random number generated from the range [0,1]. is the probability of losing data.

4. The method for detecting anomaly of power ciphertext data based on function encryption according to claim 1 is characterized in that: The step of encrypting the normal power time series data subsequence and the abnormal power time series data subsequence according to a preset function encryption mechanism comprises: The normal power time series data subsequence and the abnormal power time series data subsequence are encrypted respectively according to the inner product function encryption algorithm, and the formal definition of the inner product function encryption algorithm is: , specifically: Initialization algorithm Used to calculate and generate public and private key pairs, input given security parameters and vector length , output the public key and the master private key ; Key generation algorithm Used to generate a function key with inner product function, input the master private key and the vector whose inner product is calculated Output function key ; Encryption Algorithm Used to vectorize plain text To encrypt, enter the public key For the plaintext vector Encrypt and output ciphertext ; Decryption algorithm Used to decrypt the result of the inner product function without revealing the plaintext vector Enter the public key , function key, ciphertext and vector , output the plaintext result of the function calculation .

5. A power ciphertext data anomaly detection system based on function encryption, characterized in that: include: An acquisition module is configured to acquire power time series data of a continuous period of time in the power equipment under normal operating conditions, and slide a time step on each power time series data at a time according to a sliding window of a preset size to obtain multiple overlapping normal power time series data subsequences; A construction module, configured to construct a corresponding abnormal power time series data subsequence according to at least one normal power time series data subsequence; A training module is configured to encrypt the normal power time series data subsequence and the abnormal power time series data subsequence according to a preset function encryption mechanism, and input the encrypted normal power time series data and the first label corresponding to the normal power time series data, and the encrypted abnormal power time series data and the second label corresponding to the abnormal power time series data into a pre-built LSTM-FCN network model to train and obtain an anomaly detection model; an output module configured to obtain a real-time power time series data sequence, encrypt the real-time power time series data sequence according to the function encryption mechanism, and input the encrypted real-time power time series data sequence into the anomaly detection model, wherein the anomaly detection model outputs a detection result, wherein the anomaly detection model includes a ciphertext convolution layer, a ciphertext fitting layer with a discrimination loss, and a discrimination network; The identification network includes an LSTM layer, an FCN layer, a feature fusion layer and a classification layer. The classification layer includes a one-dimensional convolution, an MLP and a softmax, which are used to calculate the classification loss by comparing the prediction results with the true labels, and train the ciphertext convolution layer and the identification network by the gradient descent method. The expression of the classification loss is: ， In the formula, is the classification loss, is the sample size, is the output of the identification network; The ciphertext convolution layer includes a decryption network and an identification loss including an identification network. The decryption network converts the ciphertext data into plaintext data. The decryption network includes a parameter convolution structure and a time-dependent nonlinear reconstruction network. The specific process of constructing the time-dependent nonlinear reconstruction network is as follows: According to the RNN input ciphertext data, the dependency between items in the subsequence is learned, and the expression is: In the formula, is the hidden state of the RNN at time step t, is the activation function of RNN, is the weight of RNN, is the value of the ciphertext data at position t in the subsequence, is the hidden state of the RNN at time step t-1, is the bias of RNN; The hidden state of the RNN at the intermediate time step is added to the input of the MLP to learn the nonlinear characteristics of the data, expressed as: In the formula, is the output of the time-dependent nonlinear reconstruction network, is the activation function of MLP, is the weight of MLP, is the hidden state of the RNN intermediate time step, is the final output of RNN, is the bias of MLP; The parameter convolution structure is used to convert the parameters of the ciphertext convolution layer to the same size as the output of the time-dependent nonlinear reconstruction network, and the expression is: ， In the formula, are the parameters of the ciphertext convolutional layer, is the weight of the convolution, is the bias of the convolution; Will and Channel concatenation is performed, and the concatenated features are converted to the original sequence dimension size according to one-dimensional convolution. The expression is: ， In the formula, is the weight of the one-dimensional convolution, is the bias of the one-dimensional convolution, is the reconstructed plaintext data, for and Channel concatenation in the first dimension, It is a one-dimensional convolution layer; The reconstruction loss is calculated based on the reconstructed plaintext data and the output of the ciphertext convolution layer. The expression of the reconstruction loss is: ， In the formula, is the value of the output of the ciphertext convolution at the i-th position, is the value of the output of the decryption network at the i-th position; The output of the ciphertext fitting layer is sent to the identification network to obtain the output and the output of the penultimate layer of the identification network as the predicted value. The output of the ciphertext convolutional network is sent to the identification network to obtain the output and the output of the penultimate layer of the identification network as the true value. The output of the ciphertext fitting layer is sent to the identification network to obtain the output and the output of the penultimate layer. The identification loss is calculated based on the predicted value and the corresponding true value. The expression of the identification loss is: ， In the formula, To identify the loss, To identify the output of the last layer of the network, To identify the output of the penultimate layer of the network, To identify the network's identification result for the i-th ciphertext convolution output sequence, To identify the identification result of the network for the i-th decryption network output sequence, To identify the eigenvalue of the penultimate layer of the ciphertext convolution output sequence of the network, To identify the feature value of the second-to-last layer of the i-th decryption network output sequence; The total loss of the anomaly detection model is obtained according to the classification loss, the reconstruction loss and the identification loss, and the expression is: ， In the formula, is the total loss of the anomaly detection model.

6. An electronic device, characterized in that: include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images