BiPMU-based power data encryption traffic attack prediction method and system
By introducing a loss compensation mechanism and residual attention module in the BiPMU model, the problem of feature information loss of neural networks when processing network traffic data in the power industry is solved, and the detection accuracy and system security of encrypted traffic attacks are improved.
Patent Information
- Application Number
- CN202411320231.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-23
- Publication Date
- 2025-01-07
AI Technical Summary
When processing network traffic data in the power industry, existing neural network-based intrusion detection methods, it is difficult to effectively detect encrypted traffic attacks due to nonlinear transformation.
A neural network model based on BiPMU is proposed. Through the loss compensation mechanism, the loss of feature information is reduced, and the residual attention module (RAM) and FFTBLOCK are used for feature extraction and fusion to enhance the detection accuracy of the model.
It significantly improves the accuracy of detection of encrypted traffic attack behavior, enhances the security and reliability of the system, and can more accurately understand the security threats faced by the information network system.
Smart Images
Figure CN119276551A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a method and system for predicting attacks on power data encryption traffic based on BiPMU. Background Art
[0002] The information system of the power industry is of vital importance as an important infrastructure for the operation of the country and society. Encrypted traffic attacks, as a hidden and complex means of network attack, pose a serious threat to the security of the information system of the power industry. In addition, traditional network security protection methods have gradually revealed their limitations in the face of ever-changing malicious traffic forms. The concealment and diversity of malicious traffic make traditional rule and signature detection methods no longer effective. In this context, deep learning, as a powerful machine learning technology, has attracted widespread attention from network security researchers. Malicious traffic identification methods based on deep learning have gradually become a cutting-edge technology for network attack detection because they can automatically learn features and patterns from raw data. It is necessary to build a solution that can detect and protect encrypted traffic attacks in a timely and accurate manner through deep learning technology. Wang et al. designed a hierarchical network threat situation assessment method based on the analytic hierarchy process and constructed a hierarchical network threat situation assessment indicator system using the analytic hierarchy process. Liu et al. proposed an NSSA enhancement method based on the attack and defense random game model (ADSGM). This method provides the best reinforcement solution by dynamically evaluating the network security status. Experimental results show that this method is more accurate and more suitable for real network environments.
[0003] The number of cyber attacks targeting power systems and causing physical and economic losses has increased rapidly. Among them, false data injection attacks are a type of cyber attacks targeting power grid monitoring systems that inject false measurements to poison the state estimation process. Attackers can successfully carry out false data injection attacks by damaging sensors or modifying system data, thereby manipulating power system state estimation. Gu et al. developed a network traffic anomaly detection system that compares the current baseline distribution with the entropy value of network traffic utilization, which can effectively detect network anomalies such as port scanning and different types of synchronization attacks. Mazel et al. introduced a method for unsupervised network anomaly detection by combining the association of inter-class and subspace clustering results. However, it is well known that identifying bad leverage points is challenging for such maximum normalized residual (LNR) statistical tests. In addition, machine learning algorithms have been widely used in power grid functions for control and monitoring purposes. For example, Gu and Lu proposed a naive Bayes (NB) feature embedding and an intrusion detection method based on support vector machine (SVM). Iwendi et al. used a correlation-based feature selection method to extract data features and then analyzed the reduced-dimensional data through an ensemble classifier to construct an intrusion detection system. However, they used different dimensionality reduction methods to remove redundant features of network traffic data. Then, they used CNN to extract features from the data. Muhammad et al. proposed an intrusion detection method based on stacked autoencoders (SAE) to improve the classification accuracy.
[0004] As the scale of the network continues to increase, network traffic is growing exponentially. Hassan et al. proposed a hybrid deep model network traffic detection system based on weight descent and convolutional neural network (CNN). CNN is used to extract features from network data, and the output of the pooling layer is used as the input of the weight descent long short-term memory network. The algorithm is tested using the UNSW-NB15 dataset, and the results show that the algorithm has good performance. Basant et al. calculated the characteristic entropy of network traffic within 60 seconds, set a fixed entropy threshold, and used support vector machine for classification, which achieved a higher accuracy than a single method. The combination of statistical methods is to reduce the high false alarm rate caused by the threshold, and the threshold of most methods needs to be adjusted. Ansari et al. proposed a deep learning model based on gated recurrent unit (GRU), which can learn the dependencies in the security alarm sequence and output possible future alarms based on the past alarm history of the attack source. Wang et al. proposed a long short-term memory (LSTM) neural network model to predict network traffic as a nonlinear system. According to the characteristics of autocorrelation, the autocorrelation coefficient is added to the model to improve the accuracy of the prediction model.
[0005] The above literature mainly focuses on intrusion detection based on different methods. Although it improves the accuracy of intrusion detection, it does not consider the loss of feature information caused by the nonlinear changes of neural networks. In addition, the difficulty of data processing is also increasing. Power flow data has the characteristics of large scale, wide diversity and high dimension, which greatly affects the function and efficiency of intrusion detection methods. Summary of the invention
[0006] In view of the above problems existing in the prior art, the present invention is proposed.
[0007] Therefore, the present invention provides a power data encryption flow attack prediction method based on BiPMU. In view of the current situation in the information system of the power industry, the data flow characteristics have stage-based concentration, which makes it difficult for traditional encryption behavior and abnormal communication behavior detection technologies to cope with. The existing neural network-based intrusion detection methods still need to perform a large number of nonlinear transformations when learning and characterizing data, resulting in a large amount of feature information loss. To address this problem, a new neural network model based on BiPMU is proposed. Compared with the traditional BiPMU, through loss compensation, SBiPMU can reduce the loss of feature information caused by nonlinear transformation when learning and characterizing network traffic data. Then, a new intrusion detection method is proposed using SBiPMU to monitor the security of the network. Finally, a corresponding prototype system is developed and its performance is verified. Experimental results show that the proposed intrusion detection method is more accurate than the previous intrusion detection method.
[0008] To solve the above technical problems, the present invention provides the following technical solutions: a power data encrypted traffic attack prediction method based on BiPMU, comprising: initializing the power data and converting the original power data into numerical data; performing deep processing on the power data that has completed preliminary processing according to a pre-set indicator system; using a feature extraction network BIMPU to process the traffic data, outputting features at different levels, applying a residual attention module RAM, selecting important feature channels and regions, dividing the feature map into blocks, linearly mapping them into embedded vectors, and performing feature extraction; removing the adaptive average pooling layer and the fully connected layer in the feature extraction network, retaining only the convolution layer, inputting the feature map into FFTBLOCK for feature fusion, and using the RAM module to emphasize key feature channels and regions; dividing the preprocessed data set into a training set and a test set, performing feature learning and characterization on the training set through BiPMU, calculating loss data, performing compensation learning on the loss data, and fusing the compensation data into the original data, so as to improve the detection accuracy of the model for encrypted traffic attack behaviors.
[0009] As a preferred solution of the BiPMU-based power data encryption traffic attack prediction method described in the present invention, the power data is initialized, including collecting and organizing the original power system data sequence containing malicious samples, ensuring data integrity and removing invalid or abnormal data, converting the original data format into a form suitable for deep learning model processing, performing data type conversion to convert non-numeric data into numerical data, performing feature scaling on features, and using the Min-Max scaling method to scale each value in the range of (0,1).
[0010] As a preferred solution of the BiPMU-based power data encryption traffic attack prediction method described in the present invention, the deep processing includes data standardization, normalization, feature selection, and feature engineering operations, which convert complex and diverse raw data into a data set that is conducive to model training and analysis.
[0011] As a preferred solution of the BiPMU-based power data encryption traffic attack prediction method described in the present invention, the deep processing includes data standardization, normalization, feature selection, and feature engineering operations, which convert complex and diverse raw data into a data set that is conducive to model training and analysis.
[0012] As a preferred solution of the BiPMU-based power data encryption flow attack prediction method of the present invention, wherein: the regional operation is expressed as,
[0013] F'=ω CA ⊙F
[0014] F”=ω SA ⊙F'
[0015] F res =F"+F
[0016] where ⊙ represents element-by-element multiplication.
[0017] As a preferred solution of the BiPMU-based power data encryption traffic attack prediction method described in the present invention, the removal of the adaptive average pooling layer and the fully connected layer in the feature extraction network includes separating the head average pooling layer and the fully connected layer from the ResNet architecture, relying only on the convolutional layer for feature extraction, and the feature maps of different stages encapsulate information of different scales. Only the last three feature maps are embedded in the FFM for fusion, and each feature map is independently subject to the RAM module.
[0018] As a preferred solution of the BiPMU-based power data encryption flow attack prediction method of the present invention, wherein: the calculation of loss data includes using O_BiPMU to learn and input data to obtain x t , use D_BiPMU to restore xt Get x out , from x input Subtract x from out Obtain loss data lc, use O_BiPMU to learn and represent the loss data lc, and obtain loss compensation data lc out , in x t Add lc out , make up x t The loss of feature information in is expressed as,
[0019] x t =O_BiPMU(x input )
[0020] x out =D_BiPMU(x t )
[0021] lc=x input -x out
[0022] lc out =O_BiPMU(lc)
[0023] x t =lc out +x t
[0024] Compensatory learning is performed on the lost data to restore the lost feature information, and the compensated data is integrated into the original data to improve the model's detection accuracy of encrypted traffic attack behaviors.
[0025] Another object of the present invention is to provide a power data encrypted traffic attack prediction system based on BiPMU. The power data initialization module ensures the standardization and digitization of power data, provides a unified data format for subsequent processing and analysis, and improves the processability of data and the compatibility of models. The deep data processing module extracts the deep-level features of power data through deep processing, enhances the expressiveness of data, and provides a high-quality data basis for subsequent feature extraction and model training. The feature extraction and attention module uses the BiMPU network and RAM module to effectively extract the multi-level features of the data, and screens out key feature channels and regions through the attention mechanism, which significantly improves the efficiency and accuracy of feature extraction. The feature fusion optimization module optimizes the computational complexity of the model by removing unnecessary network layers and using FFTBLOCK for feature fusion. At the same time, the use of the RAM module further strengthens the key features and improves the generalization ability and robustness of the model. The data set processing and model training module reasonably divides the data set to ensure the effectiveness of model training and testing. Feature learning and characterization are performed through BiPMU, and combined with loss compensation learning, which significantly improves the detection accuracy of the model for encrypted traffic attack behaviors and enhances the security and reliability of the system.
[0026] As a preferred solution of the BiPMU-based power data encryption flow attack prediction system described in the present invention, it includes a power data initialization module, a deep data processing module, a feature extraction and attention module, a feature fusion optimization module, and a data set processing and model training module;
[0027] The power data initialization module initializes the power data and converts the original power data into numerical data;
[0028] The deep data processing module performs deep processing on the power data that has completed preliminary processing according to a preset indicator system;
[0029] The feature extraction and attention module uses the feature extraction network BiMPU to process traffic data, outputs features at different levels, applies the residual attention module RAM, selects important feature channels and regions, divides the feature map into blocks, linearly maps it into embedding vectors, and performs feature extraction;
[0030] The feature fusion optimization module removes the adaptive average pooling layer and the fully connected layer in the feature extraction network, retains only the convolution layer, inputs the feature map into FFTBLOCK for feature fusion, and uses the RAM module to emphasize key feature channels and regions;
[0031] The data set processing and model training module divides the preprocessed data set into a training set and a test set, performs feature learning and characterization on the training set through BiPMU, calculates loss data, performs compensation learning on the loss data, and integrates the compensation data into the original data, thereby improving the model's detection accuracy for encrypted traffic attack behaviors.
[0032] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of any one of the methods for predicting power data encryption flow attacks based on BiPMU are implemented.
[0033] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods for predicting power data encryption flow attacks based on BiPMU are implemented.
[0034] Beneficial effects of the invention: Existing neural networks face challenges in processing high-dimensional time series data, which are often prone to feature loss due to nonlinear transformations. A new model, SBiPMU, is proposed, which can not only learn and represent through the temporal characteristics of data, but also compensate for feature loss due to nonlinear transformations, and has the ability to predict potential future attacks in the power industry compared to traditional BiPMU.
[0035] The attack prediction method using SBiPMU examines the attributes of network traffic data to determine the security status of the network. This enables network administrators to make full use of existing attack data and prediction capabilities to more accurately understand the security threats facing information network systems.
[0036] Based on SBiPMU, an attack prediction method is proposed, and its time complexity is analyzed. It is also compared with two other different attack prediction methods. The SBiPMU-based method is comparable to the other two methods in terms of time complexity. In addition, through performance evaluation, the SBiPMU-based method shows stronger detection capabilities compared with existing attack prediction methods. BRIEF DESCRIPTION OF THE DRAWINGS
[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.
[0038] Figure 1A schematic flow chart of a method for predicting power data encryption traffic attacks based on BiPMU is provided as an embodiment of the present invention. DETAILED DESCRIPTION
[0039] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.
[0040] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides a power data encryption flow attack prediction method based on BiPMU, comprising:
[0041] Step 1: In the initialization phase, the data set is first initialized and the original data is converted into numerical data for standardization. Standardization can eliminate the effects of different dimensions and magnitudes, making model training more stable and improving the convergence speed and accuracy of the model.
[0042] Step 2: In the preprocessing stage, the data is standardized, normalized, feature selected, and feature engineered; the data set is divided into multiple subsets, and divided into training sets and test sets. The purpose of dividing the data set into training sets and test sets is to evaluate the generalization ability of the model.
[0043] Step 3: In the deep feature extraction stage, the feature extraction network BIMPU is used to process the traffic data, output features at different levels, and apply the residual attention module RAM to select important feature channels and regions. The feature map is divided into blocks, linearly mapped into embedding vectors, and feature extraction is performed; this helps the model capture deeper and more representative information.
[0044] Step 4: In the deep feature fusion stage, remove the adaptive average pooling layer and the fully connected layer in the feature extraction network, retain only the convolution layer, input the feature map into FFTBLOCK for feature fusion, and use the RAM module to emphasize the key feature channels and areas; this can enhance the model's ability to recognize key features and improve the model's recognition accuracy.
[0045] Step 5: In the feature learning and compensation stage, the preprocessed data set is divided into a training set and a test set. Feature learning and characterization are performed on the training set through BiPMU to calculate the loss data. Compensation learning is performed on the loss data to restore the lost feature information. The compensated data is integrated into the original data to improve the model's detection accuracy for encrypted traffic attack behaviors and enhance the robustness of the model.
[0046] Step 1: First, collect and organize the original power system data sequence containing malicious samples to ensure data integrity and remove invalid or abnormal data. Then, convert the original data format into a form suitable for deep learning model processing, perform data type conversion to convert non-numeric data into numerical data, perform feature scaling on features, and use the Min-Max scaling method to scale each value in the (0,1) range. The scaling operation can be expressed as:
[0047]
[0048] Among them, X min and X max They are the maximum and minimum values of each feature in the dataset, ensuring that the dataset is in a standardized form, as well as basic data preprocessing operations such as missing value filling to ensure the validity and accuracy of the model input.
[0049] Step 2: According to the pre-set indicator system, the power data that has been preliminarily processed is deeply processed. This stage may include operations such as data standardization, normalization, feature selection, and feature engineering, with the purpose of converting complex and diverse raw data into data sets that are conducive to model training and analysis.
[0050] Step 3. Input the traffic data into the feature extraction network ResNet, which will output four feature layers in four stages. The low-level details are rich, while the high-level semantic information is rich. Different feature layers are input into the residual attention module respectively so that the network can select the feature channels and feature areas of interest. Finally, the feature map is divided into blocks and linearly mapped into embedding vectors and input into FFTBLOCK for feature fusion. The final embedding vector contains both high-level semantic information and fine feature information in the low-level feature map, providing richer and more effective fusion features for encrypted traffic identification. By placing the channel attention module and the spatial attention module in front and behind, after extracting the convolutional feature map F, the residual attention module (RAM) is equipped with channel and spatial attention mechanisms. First, the channel attention weight ω is calculated through the fully connected layer. CA , which is then applied to the feature vector F. Then, the spatial attention weights ω are calculated through another fully connected layer SA , and apply it to the weighted feature vector F'. Finally, the original feature vector F is combined with the feature vector F' processed by the attention mechanism to form the residual connection vector F res In addition, the introduction of regional operations helps to achieve better feature aggregation within the model. The specific steps are as follows:
[0051] F'=ω CA ⊙F
[0052] F”=ω SA ⊙F'
[0053] F res =F"+F
[0054] where ⊙ represents element-by-element multiplication.
[0055] Step 4. The algorithm separates the head average pooling layer and the fully connected layer from the ResNet architecture, and relies only on the convolutional layer for feature extraction. The feature maps at different stages encapsulate information of different scales. In order to suppress the excessive model complexity, only the last three feature maps are embedded in the FFM for fusion. In addition, in order to enhance the robustness of the model, each feature map is independently subject to the RAM module. This process highlights the network's priority feature channels and regions without changing the feature size.
[0056] Step 5: The model first uses O_BiPMU learning and inputs data to obtain x t , and then use D_BiPMU to restore x t To get x out , then, from x input Subtract x from out Finally, O_BiPMU is used to learn and represent the loss data lc to obtain the loss compensation data lc. out . After that, in x t Added lc out , making up for x t The specific steps are as follows:
[0057] x t =O_BiPMU(x input )
[0058] x out =D_BiPMU(x t )
[0059] lc=x input -x out
[0060] lc out =O_BiPMU(lc)
[0061] x t =lc out +x t
[0062] Compensation learning is performed on the lost data to restore the lost feature information. The compensated data is integrated into the original data to improve the model's detection accuracy for encrypted traffic attack behaviors.
[0063] Embodiment 2, the second embodiment of the present invention, is different from the previous embodiment in that:
[0064] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.
[0065] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.
[0066] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.
[0067] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0068] Embodiment 3, this embodiment provides a power data encrypted traffic attack prediction system based on BiPMU, characterized by: comprising a power data initialization module, a deep data processing module, a feature extraction and attention module, a feature fusion optimization module, and a data set processing and model training module;
[0069] The power data initialization module initializes the power data and converts the original power data into numerical data;
[0070] The deep data processing module performs deep processing on the power data that has completed preliminary processing according to a preset indicator system;
[0071] The feature extraction and attention module uses the feature extraction network BiMPU to process traffic data, outputs features at different levels, applies the residual attention module RAM, selects important feature channels and regions, divides the feature map into blocks, linearly maps it into embedding vectors, and performs feature extraction;
[0072] The feature fusion optimization module removes the adaptive average pooling layer and the fully connected layer in the feature extraction network, retains only the convolution layer, inputs the feature map into FFTBLOCK for feature fusion, and uses the RAM module to emphasize key feature channels and regions;
[0073] The data set processing and model training module divides the preprocessed data set into a training set and a test set, performs feature learning and characterization on the training set through BiPMU, calculates loss data, performs compensation learning on the loss data, and integrates the compensation data into the original data, thereby improving the model's detection accuracy for encrypted traffic attack behaviors.
[0074] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.
[0075] Embodiment 4 is the fourth embodiment of the present invention, which provides a power data encryption flow attack prediction method based on BiPMU. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through experiments.
[0076] Intelligent Perception of Cryptographic Threats and Traffic Attack Prediction in Smart Grids,In the high-tech environment of smart grids, the amount of business data is huge, the information system is increasingly complex, and the data is growing rapidly. The threat of encrypted traffic attacks has become one of the main challenges to information security in the power industry. Therefore, the development of technologies that can intelligently perceive and warn of cryptographic threats in the information system of the power industry is particularly critical in the current field of information security. In particular, intelligent detection technology for malicious encrypted traffic and abnormal communication behavior is an important part of building a comprehensive security protection system.
[0077] Step 1: In the initialization phase, the original power system data set containing malicious samples is first initialized to remove outliers and irrelevant data to ensure the quality of the data set. The original data is converted into numerical data and standardized to achieve Min-Max normalization so that the data has a uniform scale for easy model processing.
[0078] Step 2: In the preprocessing stage, the data is further processed according to the preset indicator system, including data standardization, normalization, feature selection and feature engineering. For unbalanced data sets, oversampling or undersampling can be used to balance the categories or generate synthetic samples;
[0079] Step 3: In the deep feature extraction stage, the feature extraction network is used to process the traffic data, output features at different levels, and use the skip connection of the residual network to alleviate the gradient vanishing problem. At the same time, the attention mechanism is used to focus on the key patterns in the traffic data and select important feature channels and regions. The feature map is divided into blocks and these blocks are converted into embedding vectors through linear mapping to capture local features;
[0080] Step 4: In the deep feature fusion stage, the adaptive average pooling layer and the fully connected layer in the feature extraction network are removed, and only the convolution layer is retained to reduce the risk of overfitting. FFTBLOCK is used to perform frequency domain analysis on the feature map to fuse the time domain and frequency domain features. At the same time, the RAM module is used to emphasize the key feature channels and regions to enhance the feature expression ability of the model.
[0081] Step 5: In the feature learning and compensation stage, the preprocessed data set is divided into a training set and a test set. Feature learning and characterization are performed on the training set through BIPMU to calculate the loss data. Compensation learning is performed on the loss data generated during the training process, and the lost feature information is restored through a specific compensation mechanism. The compensated data is integrated into the original data to improve the model's detection accuracy of encrypted traffic attack behaviors.
[0082] In the Internet of Things, power flow data exhibits characteristics such as massive, heterogeneous, multi-source, high-dimensional and time-series correlation, which may seriously affect the efficiency and accuracy of deep learning-based intrusion detection schemes. To address the above challenges, the intrusion detection scheme we proposed can significantly improve the overall performance. Finally, we implemented the SBiPMU-based intrusion detection scheme and obtained accurate experimental results using an Android malware dataset. Empirical data confirms that compared with previous intrusion detection methods, our proposed SBiPMU-driven scheme has significant improvements in both effect and efficiency.
Claims
1. A power data encryption traffic attack prediction method based on BiPMU, characterized by: include, Initialize the power data and convert the original power data into numerical data; According to the pre-set indicator system, the power data that has completed preliminary processing is deeply processed; The feature extraction network BIMPU is used to process traffic data, output features at different levels, apply the residual attention module RAM, select important feature channels and regions, divide the feature map into blocks, linearly map it into embedding vectors, and perform feature extraction; Remove the adaptive average pooling layer and fully connected layer in the feature extraction network, retain only the convolution layer, input the feature map into FFTBLOCK for feature fusion, and use the RAM module to emphasize key feature channels and areas; The preprocessed data set is divided into a training set and a test set. BiPMU is used to perform feature learning and characterization on the training set, calculate the loss data, perform compensation learning on the loss data, and integrate the compensated data into the original data to improve the model's detection accuracy of encrypted traffic attack behaviors.
2. The power data encryption flow attack prediction method based on BiPMU as claimed in claim 1, characterized in that: The power data initialization includes collecting and organizing the original power system data sequence containing malicious samples, ensuring data integrity and removing invalid or abnormal data, converting the original data format into a form suitable for deep learning model processing, performing data type conversion to convert non-numeric data into numerical data, and scaling the features. Scales each value in the (0,1) range using the Min-Max scaling method.
3. The BiPMU-based power data encryption flow attack prediction method according to claim 2, characterized in that: The deep processing includes data standardization, normalization, feature selection, and feature engineering operations, which convert complex and diverse raw data into data sets that are conducive to model training and analysis.
4. The BiPMU-based power data encryption flow attack prediction method according to claim 3, characterized in that: The feature extraction includes inputting the traffic data into the feature extraction network ResNet, outputting four feature layers in four stages, inputting different feature layers into the residual attention module respectively so that the network selects the feature channels and feature regions of interest, linearly mapping the feature map into blocks and inputting it into FFTBLOCK for feature fusion, and obtaining the embedded vector by placing the channel attention module and the spatial attention module in front and behind. After extracting the convolution feature map F, the residual attention module RAM is equipped with the channel and spatial attention mechanisms, and the channel attention weight ω is calculated through the fully connected layer. CA , applied to the feature vector F, and passing through another fully connected layer to compute the spatial attention weights ω SA , and applied to the weighted feature vector F', combining the original feature vector F with the feature vector F' processed by the attention mechanism to form a residual connection vector F res , regional operations are introduced to perform feature aggregation within the model.
5. The BiPMU-based power data encryption flow attack prediction method according to claim 4, characterized in that: The regional operation is expressed as, F'=ω CA ⊙F F”=ω SA ⊙F' F res =F”+F where ⊙ represents element-by-element multiplication.
6. The power data encryption flow attack prediction method based on BiPMU as claimed in claim 5, characterized in that: The method for removing the adaptive average pooling layer and the fully connected layer in the feature extraction network includes separating the head average pooling layer and the fully connected layer from the ResNet architecture, relying only on the convolutional layer for feature extraction, and encapsulating information of different scales in feature maps at different stages. Only the last three feature maps are embedded into the FFM for fusion, and each feature map is independently subject to the RAM module.
7. The BiPMU-based power data encryption flow attack prediction method according to claim 6, characterized in that: The calculation of loss data includes using O_BiPMU learning and inputting data to obtain x t , use D_BiPMU to restore x t Get x out , from x input Subtract x from out Obtain loss data lc, use O_BiPMU to learn and represent the loss data lc, and obtain loss compensation data lc out , in x t Add lc out , make up for xt 中 The loss of feature information is expressed as, x t =O_BiPMU(x input ) x out =D_BiPMU(x t ) lc=x input -x out lc out =O_BiPMU(lc) x t =lc out +x t Compensatory learning is performed on the lost data to restore the lost feature information, and the compensated data is integrated into the original data to improve the model's detection accuracy of encrypted traffic attack behaviors.
8. A system based on the BiPMU-based power data encryption flow attack prediction method according to any one of claims 1 to 7, characterized in that: Including power data initialization module, deep data preprocessing module, deep feature extraction module, deep feature fusion optimization module, feature learning and compensation module; The power data initialization module initializes the power data and converts the original power data into numerical data for standardization; The deep data preprocessing module performs deep processing on the power data that has completed preliminary processing according to a preset indicator system; The deep feature extraction module uses the feature extraction network BiMPU to process traffic data, outputs features at different levels, applies the residual attention module RAM, selects important feature channels and regions, divides the feature map into blocks, linearly maps it into embedding vectors, and performs feature extraction; The deep feature fusion optimization module removes the adaptive average pooling layer and the fully connected layer in the feature extraction network, retains only the convolution layer, inputs the feature map into FFTBLOCK for feature fusion, and uses the RAM module to emphasize key feature channels and regions; The feature learning and compensation module divides the preprocessed data set into a training set and a test set, performs feature learning and characterization on the training set through BiPMU, calculates loss data, performs compensation learning on the loss data, and integrates the compensation data into the original data, thereby improving the model's detection accuracy for encrypted traffic attack behaviors.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.