Twin neural network based advanced measurement system network intrusion detection method

Abstract

The application relates to a twin neural network-based advanced measurement system network intrusion detection method. The method comprises the following steps: obtaining a target data set associated with an advanced measurement system, and obtaining an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is obtained based on a pre-trained intrusion detection model; the initial network intrusion detection model is subjected to feature parameter freezing processing and feature fusion processing to obtain a network intrusion detection model to be trained; the network intrusion detection model is iteratively trained based on the target data set to obtain a target network intrusion detection model; and the target network intrusion detection model is used for network intrusion detection processing of the advanced measurement system. The method can improve the model performance of the target network intrusion detection model trained based on a small-labeled sample target data set, thereby improving the network intrusion detection accuracy of the advanced measurement system.

Description

Technical Field

[0001] The present application relates to the field of smart grid technology, and in particular to a method, apparatus, computer equipment, storage medium, and computer program product for detecting network intrusion in an advanced measurement system based on a twin neural network. Background Art

[0002] Advanced Metering Infrastructure (AMI) is a crucial component of the new power system, significantly driving the intelligentization of the power grid. AMI consists of smart meters (SM), data concentrators (DC), utilities, and the communication network between them. AMI uniquely enables interaction between user terminals and smart grid data management systems through a bidirectional communication network. It is a core component of the smart grid and a crucial foundation for interoperability between the power grid and the internet.

[0003] Smart meters in AMI use bidirectional communication with data management systems, enabling information exchange and assisting with time-of-use pricing. However, AMI's bidirectional communication also provides attackers with more points of entry, posing a potential threat to grid security. With the widespread access of a large number of smart terminals and heterogeneous communication links, the risk of cyberattacks is increasing. Therefore, ensuring the security of AMI communications is a crucial prerequisite for the stable operation of smart grids.

[0004] Deep learning-based anomaly detection has been widely used, but the success of deep learning models relies heavily on large amounts of training data and model depth. However, in real-world power grid applications, certain anomaly categories have only a small amount of data, or only a small amount of anomaly data has been labeled. Labeling unlabeled data consumes significant time and effort, making model training expensive. Therefore, in real-world applications, it is crucial to address the problem of how to implement AMI network intrusion detection with only small sample sizes and a reduced model size. Summary of the Invention

[0005] Based on this, it is necessary to provide a network intrusion detection method, device, computer equipment, computer-readable storage medium and computer program product for an advanced measurement system based on a twin neural network, which can improve the network intrusion detection effect of the advanced measurement system.

[0006] In a first aspect, the present application provides a network intrusion detection method for an advanced measurement system based on a twin neural network. The method comprises:

[0007] Obtaining a target data set associated with an advanced measurement system and an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0008] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0009] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0010] In one embodiment, the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-models include multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent convolutional layers for extracting semantic features;

[0011] The performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained includes:

[0012] Freezing the characteristic parameters of the shallow convolutional layer to obtain a frozen shallow convolutional layer;

[0013] Perform feature fusion processing on the deep convolution layer and the frozen shallow convolution layer to obtain the network intrusion detection model to be trained.

[0014] In one embodiment, obtaining the initial network intrusion detection model of the advanced measurement system includes:

[0015] The pre-trained intrusion detection model is obtained according to a network intrusion dataset; the labeled samples in the network intrusion dataset are more than the labeled samples in the target dataset;

[0016] A twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system.

[0017] In one embodiment, the network intrusion detection model is iteratively trained based on the target data set to obtain a target network intrusion detection model, including:

[0018] Inputting at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample;

[0019] Obtaining a loss value of the network intrusion detection model according to the feature vector;

[0020] According to the loss value, model parameters in the network intrusion detection model except the frozen shallow convolutional layer are iteratively updated to obtain the target network intrusion detection model.

[0021] In one embodiment, obtaining a target data set associated with an advanced measurement system includes:

[0022] Determining an initial data set associated with the advanced measurement system according to a network intrusion type of the advanced measurement system; the initial data set includes non-numerical features;

[0023] The initial data set is preprocessed to obtain the target data set; the target data set does not contain non-numerical features.

[0024] In one embodiment, after obtaining the target network intrusion detection model, the method further includes:

[0025] Obtaining current network data of the advanced measurement system;

[0026] The target network intrusion detection model is used to perform network intrusion detection on the current network data to obtain the network intrusion detection result of the advanced measurement system.

[0027] In a second aspect, the present application also provides a network intrusion detection device for an advanced measurement system based on a twin neural network. The device comprises:

[0028] A preprocessing module, configured to obtain a target data set associated with an advanced measurement system and an initial network intrusion detection model for the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0029] A model optimization module is used to perform feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0030] The model training module is used to iteratively train the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0031] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are performed:

[0032] Obtaining a target data set associated with an advanced measurement system and an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0033] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0034] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps:

[0036] Obtaining a target data set associated with an advanced measurement system and an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0037] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0038] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0039] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0040] Obtaining a target data set associated with an advanced measurement system and an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model;

[0041] Performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained;

[0042] Based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0043] The above-mentioned network intrusion detection method, device, computer equipment, storage medium and computer program product for an advanced measurement system based on a twin neural network obtain a target data set associated with the advanced measurement system, and obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; the initial network intrusion detection model is subjected to feature parameter freezing and feature fusion processing to obtain a network intrusion detection model to be trained; based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system. By adopting this method, an initial network intrusion detection model is constructed based on a pre-trained intrusion detection model. The pre-trained knowledge in the intrusion detection model can also be transferred to the initial network intrusion detection model, which helps to improve the processing capability of the model under a small number of samples. Feature parameter freezing processing is also used to retain the knowledge learned in pre-training, accelerate the model training process, and feature fusion processing is used to provide richer feature information, which can better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. While effectively improving the model performance of the target network intrusion detection model trained based on the target data set with few label samples, it also saves a lot of computing resources and time overhead, accelerates the model training process, and thus improves the accuracy of network intrusion detection of advanced measurement systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 1 is a flow chart of a network intrusion detection method for an advanced measurement system based on a twin neural network in one embodiment;

[0045] Figure 2 1. A schematic diagram of a flow chart of steps for freezing feature parameters and fusing features for an initial network intrusion detection model in one embodiment;

[0046] Figure 3 1 is a flow chart of a network intrusion detection method for an advanced measurement system based on a twin neural network in another embodiment;

[0047] Figure 4 Schematic diagram of a target network intrusion detection model framework in one embodiment;

[0048] Figure 5 1 is a structural block diagram of a network intrusion detection device of an advanced measurement system based on a twin neural network in one embodiment;

[0049] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0052] In one embodiment, Figure 1 As shown, a network intrusion detection method for an advanced measurement system based on a twin neural network is provided. This embodiment uses the method applied to a server as an example. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the server can be implemented as an independent server or a server cluster composed of multiple servers. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. In this embodiment, the method includes the following steps:

[0053] Step S101 : obtaining a target data set associated with an advanced measurement system, and obtaining an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model.

[0054] Among them, the target dataset is used to represent the network intrusion dataset with few labeled samples.

[0055] Among them, the intrusion detection model can be constructed based on Convolutional Neural Networks (CNN).

[0056] Specifically, the Advanced Metering Infrastructure (AMI) network structure includes home area networks (HANs), neighborhood area networks (NANs), and wide area networks (WANs). Based on the types of network attacks to which these networks are susceptible, matching datasets can be selected as the initial dataset. The server can perform preprocessing on the initial dataset, including data cleaning, feature quantization, feature optimization, and numerical normalization, to improve its quality. The server then obtains the target dataset. The server can also leverage pretrained intrusion detection models to construct the initial network intrusion detection model for the AMI.

[0057] It should be noted that both the intrusion detection model and the target network intrusion detection model are deep learning models used to detect network intrusions. However, the intrusion detection model is trained based on a conventional network intrusion dataset, while the target network intrusion detection model is trained based on a network intrusion dataset that is closely related to the advanced measurement system (such as the target dataset). Although the conventional network intrusion dataset contains a large number of labeled samples, the degree of correlation with the advanced measurement system is relatively low. Therefore, it is necessary to further construct and train the target network intrusion detection model so that the target network intrusion detection model can be used to more accurately detect network intrusions in the advanced measurement system.

[0058] Step S102 : performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained.

[0059] The server can further optimize the initial network intrusion detection model through feature parameter freezing and feature fusion. Specifically, the server can freeze the feature parameters of the pre-trained convolutional layers in the sub-model of the initial network intrusion detection model, directly using the model parameters of the convolutional layers in the pre-trained intrusion detection model. The server can also fuse the features output by the frozen convolutional layers with the features of the unfrozen convolutional layers to construct the network intrusion detection model to be trained.

[0060] Step S103 , iteratively training the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0061] Specifically, the server can divide the target data set into a training set and a test set, use the training set to train the network intrusion detection model, use the gradient descent algorithm to optimize the model parameters of the network intrusion detection model, and calculate the accuracy of the model after each round (epoch) of training. After the training is completed, the target network intrusion detection model is obtained.

[0062] In the above-mentioned network intrusion detection method for an advanced measurement system based on a twin neural network, a target data set associated with the advanced measurement system is obtained, and an initial network intrusion detection model of the advanced measurement system is obtained; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model; the initial network intrusion detection model is subjected to feature parameter freezing and feature fusion processing to obtain a network intrusion detection model to be trained; based on the target data set, the network intrusion detection model is iteratively trained to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system. By adopting this method, an initial network intrusion detection model is constructed based on a pre-trained intrusion detection model. The pre-trained knowledge in the intrusion detection model can also be transferred to the initial network intrusion detection model, which helps to improve the processing capability of the model under a small number of samples. Feature parameter freezing processing is also used to retain the knowledge learned in pre-training, accelerate the model training process, and feature fusion processing is used to provide richer feature information, which can better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. While effectively improving the model performance of the target network intrusion detection model trained based on the target data set with few label samples, it also saves a lot of computing resources and time overhead, accelerates the model training process, and thus improves the accuracy of network intrusion detection of advanced measurement systems.

[0063] In one embodiment, the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-models include multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent the pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent the convolutional layers for extracting semantic features. Figure 2 As shown, the above step S102 performs feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained, which specifically includes the following contents:

[0064] Step S201: freeze the feature parameters of the shallow convolutional layer to obtain a frozen shallow convolutional layer.

[0065] Specifically, a shallow convolutional layer refers to a convolutional layer that has been fully trained in advance and has good feature extraction capabilities. For example, if the convolutional layer in the pre-trained intrusion detection model has been fully trained in advance and has good feature extraction capabilities, then through transfer learning, the model parameters of the convolutional layer in the pre-trained intrusion detection model can be transferred to the shallow convolutional layer in the initial network intrusion detection model, so that the shallow convolutional layer retains the knowledge learned in the pre-trained intrusion detection model; then the server can freeze the feature parameters of the shallow convolutional layer in the shared sub-model in the initial network intrusion detection model to obtain a frozen shallow convolutional layer. That is, the frozen shallow convolutional layer does not update its model parameters during the training process, which helps save the training time of the shallow convolutional layer and thus accelerates the training process of the network intrusion detection model.

[0066] Step S202: performing feature fusion processing on the deep convolution layer and the frozen shallow convolution layer to obtain a network intrusion detection model to be trained.

[0067] It can be understood that the multiple convolutional layers of the sub-model may include some common convolutional layers in addition to shallow convolutional layers and deep convolutional layers.

[0068] Specifically, due to the large number of convolutional layers in a sub-model, the features captured by each convolutional layer vary significantly. Shallow convolutional layers focus more on extracting shallow features such as color and edges, while deeper convolutional layers focus more on the semantic features of the target. The server can fuse the features output by the deep convolutional layers with the frozen features output by the shallow convolutional layers to obtain the network intrusion detection model to be trained.

[0069] For example, suppose the shared sub-model in the initial network intrusion detection model is a CNN. CNNs typically consist of convolutional layers, pooling layers, and fully connected layers, extracting features from input data through forward propagation. Assume the sub-model CNN has eight convolutional layers (conv1, conv2, conv3, conv4, conv5, conv6, conv7, and conv8). Assuming the shallow convolutional layers are conv1, conv2, and conv3, and the deep convolutional layers are conv4, conv5, and conv8, the server can freeze the model parameters of conv1, conv2, and conv3 and only update the model parameters of other layers. Furthermore, the frozen features output by conv1, conv2, and conv3 are fused with the output features of conv4, conv5, and conv8 to form a better feature representation. Different features can provide more information, thereby improving model generalization. If some features fail, others can compensate. In addition, convolution is performed using the one-dimensional convolution function conv1d. Each convolution layer is followed by an activation layer (considering that AMI communication information values ​​are all non-negative, and to improve the convergence speed of the neural network, this invention uses the ReLU activation function as an example). The neuron activation value is set to 0.2-0.5, the number of filters is 8-32, and the convolution kernel size is 2-10. After the pooling layer calculates the results, it proceeds to the next convolution pooling layer and repeats the above process multiple times, with the filter size increasing in sequence, the convolution kernel size remaining unchanged, and the pooling layer settings remaining unchanged. After multiple convolution pooling cycles are completed, the fully connected layer is entered.

[0070] In this embodiment, feature parameter freezing is also used to retain knowledge learned in pre-training, accelerate the model training process, control the model's learning range, save a large amount of computing resources and time, accelerate the model training process, reduce the risk of model overfitting, and improve the model's generalization ability. By using feature fusion processing to provide richer feature information, it is possible to better capture the feature information of the input data, make the model more generalized, and improve the model's accuracy. By using multiple features, the risk of model overfitting can be further reduced, thereby significantly improving the model performance of the target network intrusion detection model obtained based on network intrusion detection model training.

[0071] In one embodiment, the above step S101, obtaining the initial network intrusion detection model of the advanced measurement system, specifically includes the following contents: obtaining a pre-trained intrusion detection model based on the network intrusion data set; the number of labeled samples in the network intrusion data set is more than the number of labeled samples in the target data set; constructing a twin network structure based on the intrusion detection model to obtain the initial network intrusion detection model of the advanced measurement system.

[0072] Among them, the network intrusion dataset can be a large public dataset, for example, the network intrusion dataset can be CIC-MalMem-2022 (a dataset specifically used to detect malicious memory modification techniques).

[0073] Specifically, the server can use a network intrusion dataset to pre-train an untrained intrusion detection model (such as a CNN) to obtain a pre-trained intrusion detection model. The server can then construct the intrusion detection model into an initial network intrusion detection model based on a twin network structure, such as a Siamese network. For example, the intrusion detection model can be used as a shared sub-model in the twin neural network.

[0074] In this embodiment, an initial network intrusion detection model is constructed by a pre-trained intrusion detection model, and the pre-trained knowledge in the intrusion detection model can be transferred to the initial network intrusion detection model, thereby improving the training effect of the model under the target data set of few-label samples of the advanced measurement system, thereby improving the model's network intrusion detection capability for the advanced measurement system.

[0075] In one embodiment, the above-mentioned step S103, based on the target data set, iteratively trains the network intrusion detection model to obtain the target network intrusion detection model, specifically including the following contents: inputting at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample; obtaining a loss value of the network intrusion detection model based on the feature vector; and iteratively updating the model parameters of the network intrusion detection model except for the frozen shallow convolutional layer based on the loss value to obtain the target network intrusion detection model.

[0076] Specifically, during the training of a network intrusion detection model, the number of samples input at each time is equal to the number of shared sub-models in the network intrusion detection model. For example, if the network intrusion detection model has two shared sub-models, two samples are input at each time, and these two samples can be from the same or different categories. Each shared sub-model in the network intrusion detection model processes one sample, such as performing feature extraction on the sample, and the server obtains a feature vector corresponding to each sample. The server can use a contrastive loss function as the loss function for the network intrusion detection model. The contrastive loss function aims to bring samples from the same category (positive samples) closer together in the feature space while distinguishing samples from different categories (negative samples). The server uses the contrastive loss function to calculate the loss value corresponding to the output feature vector. This loss value is then used to update all model parameters in the network intrusion detection model, except for the model parameters of the frozen shallow convolutional layers. After multiple iterative training cycles, the server obtains the target network intrusion detection model.

[0077] In practical applications, the server can also calculate the distance between at least two output feature vectors using the Euclidean distance algorithm, such as the torch framework function: torch.nn.functional.pairwise_distance(x1, x2, p=2, eps=10-06). The calculation formula for the one-dimensional Euclidean distance can be simplified to:

[0078]

[0079] Where D(x, y) represents the one-dimensional Euclidean distance between feature x and feature y, that is, the absolute difference between the two values.

[0080] Assume that the output of a set of one-dimensional feature vectors is (X a , X b ), the Euclidean distance between these two eigenvectors is expressed as , then the loss value can be expressed as:

[0081]

[0082] Where y represents (X a , X b ) matches, if matched, it is 1 and if not matched, it is 0; m is the set safety distance, when (X a , X b ) is less than m, the loss value will become 0, which makes the model update the target X a and X b It is similar rather than identical, thus ensuring the generalization ability of the model.

[0083] In this embodiment, the contrast loss function is used to achieve effective training of the network intrusion detection model, thereby improving the model accuracy of the target network intrusion detection model.

[0084] In one embodiment, the above step S101, obtaining a target data set associated with the advanced measurement system, specifically includes the following contents: determining an initial data set associated with the advanced measurement system according to the network intrusion type of the advanced measurement system; the initial data set contains non-numerical features; preprocessing the initial data set to obtain a target data set; the target data set does not contain non-numerical features.

[0085] Specifically, the server can determine the initial dataset associated with the advanced measurement system based on the network intrusion type of the advanced measurement system. For example, the home area network of the advanced measurement system mainly uses low-speed, short-distance communication and is vulnerable to denial of service (DoS) attacks and port monitoring or scanning (Probing) attacks. The neighborhood area network is used to aggregate smart meter data and is vulnerable to unauthorized access to local permissions (User-to-Root, U2R) attacks. The wide area network mainly uses high-speed, long-distance communication and transmits sensitive data information, which is vulnerable to unauthorized remote access attacks (Remote-to-Login, R2L). Therefore, the server can select the NSL-KDD dataset as the initial dataset associated with the advanced measurement system. The NSL-KDD dataset contains the above four types of attacks suffered by the advanced measurement system.

[0086] Furthermore, the server can preprocess the initial dataset, including: 1) data cleaning to remove duplicate or incomplete invalid data from the initial dataset. 2) digitization of the initial dataset, where digitization includes feature digitization and label digitization. Each data entry in the NSL-KDD dataset contains a three-dimensional symbolic feature and a label bit. Non-numeric features in the NSL-KDD dataset include protocol_type, service, and flag. Protocol_type includes three attributes: tcp, udp, and icmp. After digitization, they are represented by 0, 1, and 2, respectively. Similarly, service includes 70 attributes, represented by 0 to 69, and flag includes 11 attributes, represented by 0 to 10. This means that symbolic features can be digitized and mapped into digital features. Furthermore, in the initial dataset, communication data is divided into five categories: normal and four attack types. 3) Perform feature optimization on the initial dataset, using the random forest algorithm to calculate the feature importance of the initial dataset. The resulting redundant features are ranked based on their importance to reduce the interference of redundant features on model detection. 4) The feature value ranges in the initial dataset vary greatly. Directly using the normalized values ​​from the initial dataset for training will amplify the effects of high-value features. To eliminate the impact of excessive feature differences, normalize the features and uniformly map them to the [0, 1] interval without changing the feature weights. The specific calculation formula is:

[0087]

[0088] In the formula, x* is the normalized eigenvalue, x is the original feature data, and x max is the maximum value of the characteristic, x min is the minimum value of the feature.

[0089] In this embodiment, by performing preprocessing such as data cleaning, text digitization, feature optimization, and numerical normalization on the initial data set, the data quality of the processed target data set can be improved, thereby ensuring that the model can correctly identify and process data during the training process and improving the training effect of the model.

[0090] In one embodiment, after obtaining the target network intrusion detection model in step S103, the method further includes: obtaining current network data of the advanced measurement system; performing network intrusion detection on the current network data using the target network intrusion detection model to obtain network intrusion detection results of the advanced measurement system.

[0091] In actual applications, the server can collect current network data from the advanced measurement system in real time and input the current network data into the target network intrusion detection model. The target network intrusion detection model then performs network intrusion detection on the current network data and outputs the network intrusion detection results of the advanced measurement system. The network intrusion detection results can be normal or one of the four attack types: DoS, Probing, U2R, and R2L.

[0092] In this embodiment, after the target network intrusion detection model is trained, the target network intrusion detection model can also be used to perform network intrusion detection on advanced measurement systems in smart grid scenarios, thereby improving the accuracy of network intrusion detection on advanced measurement systems.

[0093] In one embodiment, Figure 3 As shown in FIG, another advanced measurement system network intrusion detection method based on a twin neural network is provided. Taking the application of this method to a server as an example, the method includes the following steps:

[0094] Step S301 : obtaining a target data set associated with an advanced measurement system, and obtaining an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model.

[0095] Step S302 : performing feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain a network intrusion detection model to be trained.

[0096] Step S303: Input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample.

[0097] Step S304: obtaining a loss value of the network intrusion detection model according to the feature vector; and iteratively updating the model parameters except for the frozen shallow convolutional layer in the network intrusion detection model according to the loss value to obtain a target network intrusion detection model.

[0098] Step S305: Acquire current network data of the advanced measurement system.

[0099] Step S306 , performing network intrusion detection on the current network data through the target network intrusion detection model to obtain a network intrusion detection result of the advanced measurement system.

[0100] The above-mentioned network intrusion detection method for advanced measurement systems based on twin neural networks can achieve the following beneficial effects: an initial network intrusion detection model is constructed based on a pre-trained intrusion detection model, and the pre-trained knowledge in the intrusion detection model can also be transferred to the initial network intrusion detection model, which helps to improve the model's processing capabilities under few samples; it also uses feature parameter freezing processing to retain the knowledge learned in pre-training, accelerates the model training process, and uses feature fusion processing to provide richer feature information, which can better capture the feature information of the input data, make the model more generalized, and improve the accuracy of the model. While effectively improving the model performance of the target network intrusion detection model trained based on the target data set with few label samples, it also saves a lot of computing resources and time overhead, accelerates the model training process, and thus improves the accuracy of network intrusion detection of advanced measurement systems.

[0101] In order to more clearly illustrate the advanced measurement system network intrusion detection method based on twin neural networks provided by the embodiments of the present disclosure, the above-mentioned advanced measurement system network intrusion detection method based on twin neural networks is specifically described below with a specific embodiment. Figure 4 This is a schematic diagram of the framework of the target network intrusion detection model. It provides another advanced measurement system network intrusion detection method based on twin neural networks, which can be applied to servers. Specifically, it includes the following contents:

[0102] (1) Dataset selection:

[0103] The NSL-KDD dataset is selected as the initial dataset of AMI.

[0104] (2) Dataset preprocessing:

[0105] Because each data in the NSL-KDD dataset contains a 3D symbolic feature and a label bit, the deep learning algorithm cannot process non-numerical features. It is necessary to perform preprocessing operations such as digitization, feature selection, and normalization on the dataset to obtain the target dataset.

[0106] (3) Pre-trained model:

[0107] A pre-trained model is obtained by pre-training on a deep convolutional neural network (such as CNN) based on a large public dataset (such as CIC-MalMem-2022).

[0108] (4) Construction of twin neural network model:

[0109] 41) Improve the submodules in the twin neural network model, taking the deep convolutional neural network (CNN) as an example:

[0110] The CNN network contains multiple convolutional layers. The first few layers are used to extract shallow features. The more layers there are, the deeper features can be extracted. The first few layers (for example, the first three layers) are frozen and the pre-trained model parameters in (3) are directly used through transfer learning. The latter layers (for example, the fifth layer) are optimized using fusion features, such as the fusion of features from the fourth, fifth, and final output layers (the eighth layer). This improves the generalization ability and accuracy of the model while saving computing resources and time.

[0111] 42) Calculation of feature distance of input samples:

[0112] During the training of the twin neural network model, two samples from the target dataset are input each time. These two samples can be from the same or different categories. After passing through the twin neural network model, two feature vectors are output. For each of the two feature vectors output, the distance between the two features is calculated using the Euclidean distance algorithm.

[0113] 43) Loss function:

[0114] Use a loss function (such as Contrastive Loss) to measure the similarity between the two output features.

[0115] (5) Training and validation:

[0116] Before training the Siamese neural network model, you need to load the data and divide it into training and test sets. Then, use the gradient descent algorithm to optimize the parameters and calculate the model's loss and accuracy at the end of each epoch.

[0117] In this embodiment, transfer learning technology is used to reduce the complexity of the model. Freeze feature freezing technology is used. The shallow layer of the pre-trained network model has been fully trained and has good feature extraction capabilities. The shallow feature parameters of the network are frozen and only the parameters of other layers are updated. This can retain the learned knowledge and accelerate the model's learning process on the task. Fusion feature fusion technology is used. Different features can provide more information, making the model more generalized, and can improve the accuracy, performance and expression of the model classification, thereby better capturing the information of the data, controlling the learning scope of the model, saving a lot of computing resources and time overhead, and accelerating the model training process. The use of these technologies not only improves the efficiency of the model and reduces the complexity of the model, but also achieves higher accuracy in detecting abnormal communication states of AMI, including Normal and four attacks: Dos, Probing, R2L, and U2R.

[0118] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0119] Based on the same inventive concept, the embodiment of the present application also provides an advanced measurement system network intrusion detection device based on a twin neural network for implementing the above-mentioned advanced measurement system network intrusion detection method based on a twin neural network. The implementation solution provided by the device is similar to the implementation solution described in the above-mentioned method. Therefore, the specific limitations of one or more embodiments of the advanced measurement system network intrusion detection device based on a twin neural network provided below can be found in the above-mentioned limitations of the advanced measurement system network intrusion detection method based on a twin neural network, and will not be repeated here.

[0120] In one embodiment, Figure 5 As shown, a network intrusion detection device 500 of an advanced measurement system based on a twin neural network is provided, comprising: a preprocessing module 501, a model optimization module 502 and a model training module 503, wherein:

[0121] The pre-processing module 501 is used to obtain a target data set associated with the advanced measurement system and an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on a pre-trained intrusion detection model.

[0122] The model optimization module 502 is used to perform feature parameter freezing and feature fusion processing on the initial network intrusion detection model to obtain the network intrusion detection model to be trained.

[0123] The model training module 503 is used to iteratively train the network intrusion detection model based on the target data set to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

[0124] In one embodiment, the initial network intrusion detection model includes at least two sub-models with identical structures and shared weights; the sub-models include multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent pre-trained convolutional layers; the pre-trained convolutional layers are obtained from a pre-trained intrusion detection model; and the deep convolutional layers are used to represent convolutional layers that extract semantic features. The model optimization module 502 is further configured to freeze feature parameters of the shallow convolutional layers to obtain frozen shallow convolutional layers; and perform feature fusion processing on the deep convolutional layers and the frozen shallow convolutional layers to obtain the network intrusion detection model to be trained.

[0125] In one embodiment, the preprocessing module 501 is also used to obtain a pre-trained intrusion detection model based on a network intrusion dataset; the number of labeled samples in the network intrusion dataset is greater than the number of labeled samples in the target dataset; a twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system.

[0126] In one embodiment, the model training module 503 is further used to input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample; based on the feature vector, a loss value of the network intrusion detection model is obtained; based on the loss value, the model parameters of the network intrusion detection model except for the frozen shallow convolutional layer are iteratively updated to obtain the target network intrusion detection model.

[0127] In one embodiment, the preprocessing module 501 is further used to determine an initial data set associated with the advanced measurement system based on the network intrusion type of the advanced measurement system; the initial data set contains non-numerical features; the initial data set is preprocessed to obtain a target data set; the target data set does not contain non-numerical features.

[0128] In one embodiment, the network intrusion detection device 500 of the advanced measurement system based on the twin neural network also includes an intrusion detection module for obtaining the current network data of the advanced measurement system; through the target network intrusion detection model, the current network data is subjected to network intrusion detection data to obtain the network intrusion detection results of the advanced measurement system.

[0129] Each module in the aforementioned advanced measurement system network intrusion detection device based on a twin neural network can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or can be stored in a computer device's memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0130] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data such as target data sets and network intrusion detection results. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network intrusion detection method of an advanced measurement system based on a twin neural network is implemented.

[0131] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0132] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0133] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0134] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0135] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above-mentioned embodiments. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like.

[0136] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0137] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A network intrusion detection method for an advanced measurement system based on a twin neural network, characterized in that: The method comprises: Acquire target data sets associated with advanced measurement systems; A pre-trained intrusion detection model is obtained based on a network intrusion dataset, wherein the labeled samples in the network intrusion dataset are more than the labeled samples in the target dataset; A twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on the intrusion detection model; the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-models include multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent convolutional layers for extracting semantic features; Freezing the characteristic parameters of the shallow convolutional layer to obtain a frozen shallow convolutional layer; Performing feature fusion processing on the deep convolution layer and the frozen shallow convolution layer to obtain a network intrusion detection model to be trained; Inputting at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample; Obtaining a loss value of the network intrusion detection model according to the feature vector; According to the loss value, the model parameters of the network intrusion detection model except the frozen shallow convolutional layer are iteratively updated to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

2. The method according to claim 1, characterized in that The obtaining of a target data set associated with the advanced measurement system includes: Determining an initial data set associated with the advanced measurement system according to a network intrusion type of the advanced measurement system; the initial data set includes non-numerical features; The initial data set is preprocessed to obtain the target data set; the target data set does not contain non-numerical features.

3. The method according to claim 1, characterized in that After obtaining the target network intrusion detection model, it also includes: Obtaining current network data of the advanced measurement system; The target network intrusion detection model is used to perform network intrusion detection on the current network data to obtain the network intrusion detection result of the advanced measurement system.

4. A network intrusion detection device for an advanced measurement system based on a twin neural network, characterized in that: The device comprises: A preprocessing module is used to obtain a target data set associated with an advanced measurement system; a pre-trained intrusion detection model is obtained based on a network intrusion data set; the network intrusion data set has more labeled samples than the target data set; a twin network structure is constructed based on the intrusion detection model to obtain an initial network intrusion detection model of the advanced measurement system; the initial network intrusion detection model is constructed based on the intrusion detection model; the initial network intrusion detection model includes at least two sub-models with the same structure and shared weights; the sub-model includes multiple convolutional layers; the multiple convolutional layers include shallow convolutional layers and deep convolutional layers; the shallow convolutional layers are used to represent the pre-trained convolutional layers; the pre-trained convolutional layers are obtained from the pre-trained intrusion detection model; the deep convolutional layers are used to represent the convolutional layers for extracting semantic features; A model optimization module is used to freeze the feature parameters of the shallow convolution layer to obtain a frozen shallow convolution layer; and perform feature fusion processing on the deep convolution layer and the frozen shallow convolution layer to obtain a network intrusion detection model to be trained; A model training module is used to input at least two samples in the target data set into the network intrusion detection model to obtain a feature vector corresponding to each sample; based on the feature vector, a loss value of the network intrusion detection model is obtained; based on the loss value, the model parameters of the network intrusion detection model other than the frozen shallow convolutional layer are iteratively updated to obtain a target network intrusion detection model; the target network intrusion detection model is used to perform network intrusion detection processing on the advanced measurement system.

5. The device according to claim 4, characterized in that The pre-processing module is further configured to determine an initial data set associated with the advanced measurement system according to the network intrusion type of the advanced measurement system; the initial data set includes non-numerical features; The initial data set is preprocessed to obtain the target data set; the target data set does not contain non-numerical features.

6. The device according to claim 4, characterized in that The network intrusion detection device of the advanced measurement system based on the twin neural network also includes an intrusion detection module for obtaining the current network data of the advanced measurement system; through the target network intrusion detection model, the current network data is subjected to network intrusion detection data to obtain the network intrusion detection result of the advanced measurement system.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 3 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images