Abnormality detection method and device of power terminal and electronic equipment

Abstract

The invention discloses an anomaly detection method and device for a power terminal and electronic equipment. The method comprises the steps that network protocol attribute information of the power terminal is acquired, feature extraction is carried out on the network protocol attribute information, attribute features are obtained, and the network protocol attribute information at least comprises a protocol type; transmission data of the power terminal are obtained, grammar keywords of the transmission data are recognized, grammar keyword characteristics are determined according to the grammar keywords, semantic keyword characteristics are determined at least according to the occurrence frequency of the grammar keywords, and the grammar keywords are keywords containing grammar; and establishing an anomaly detection model according to the attribute features, the grammar keyword features and the semantic keyword features, and determining whether the power terminal is abnormal or not according to the anomaly detection model. The technical problems that in the prior art, an Internet of Things terminal safety evaluation system is not suitable for the power terminal, and a trust evaluation technology cannot be simply applied to safety protection of the power terminal are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an abnormality detection method, device, computer-readable storage medium and electronic device for a power terminal. Background Art

[0002] With the continuous development of smart grids, malicious attacks on the communication between terminals and master stations have also emerged. Compared with master stations, power terminals are characterized by large number, wide range, outdoor operation, and easy access, making them easy targets for attackers. By attacking terminals trusted by the master station, attackers can easily obtain a large amount of data, affecting the security of the entire smart grid. Therefore, it is necessary to establish a trust assessment mechanism for power terminals to ensure that the master station obtains the security status of the terminal in real time.

[0003] Although the existing IoT terminal security assessment system can monitor IoT terminals, it is not suitable for power terminals. Existing trust assessment technology cannot be simply applied to the security protection of power terminals. The power system is generally located in an internal private network, with fixed equipment collection points, fixed applications, fixed users, etc. Therefore, it is necessary to further evaluate the power terminals with basic trust based on the device portrait and using the network process and proprietary protocol of the power terminal.

[0004] In summary, with the increasing number of power terminals and their increasingly widespread use, the security of the power system is under great threat. In order to strengthen the monitoring and evaluation of power terminal network security, a power terminal trust evaluation method is needed.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method, device, computer-readable storage medium and electronic device for detecting anomalies of a power terminal, so as to at least solve the technical problems in the prior art that the security assessment system of the Internet of Things terminal is not applicable to the power terminal and the trust assessment technology cannot be simply applied to the security protection of the power terminal.

[0007] According to one aspect of an embodiment of the present invention, there is provided a method for detecting an abnormality of an electric terminal, comprising: acquiring network protocol attribute information of the electric terminal, performing feature extraction on the network protocol attribute information to obtain attribute features, wherein the network protocol attribute information at least includes a protocol type; acquiring transmission data of the electric terminal, identifying grammatical keywords of the transmission data, determining grammatical keyword features based on the grammatical keywords, and determining semantic keyword features based at least on the occurrence frequency of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar; establishing an abnormality detection model based on the attribute features, the grammatical keyword features and the semantic keyword features, and determining whether the electric terminal has an abnormality based on the abnormality detection model.

[0008] Optionally, feature extraction is performed on the network protocol attribute information to obtain attribute features, including: establishing an attribute vector, wherein the attribute vector at least includes an attribute and an attribute value corresponding to the attribute; calculating the number of occurrences of the same attribute value, and calculating the ratio of the number of occurrences to the number of network protocol attribute information, and when the ratio is greater than a preset threshold, determining that the attribute corresponding to the attribute value is the attribute feature.

[0009] Optionally, identifying the grammatical keyword of the transmission data and determining the grammatical keyword feature based on the grammatical keyword includes: parsing the transmission data to identify the grammatical keyword; comparing the grammatical keyword with the attribute feature, and when the grammatical keyword is the same as any one of the attribute features, determining that the grammatical keyword is the grammatical keyword feature.

[0010] Optionally, the semantic keyword feature is determined at least according to the frequency of occurrence of the grammatical keyword, including: determining the number of occurrences of the grammatical keyword, obtaining the total amount of the transmitted data, calculating the ratio of the number of occurrences to the total amount, and obtaining the frequency of occurrence of each of the grammatical keywords; calculating the first occurrence time of every two grammatical keywords, calculating the absolute value of the difference between every two first occurrence times, and taking the maximum value of the absolute value of the difference as the slowest response time, and taking the minimum value of the absolute value of the difference as the fastest response time; determining the number of occurrences, the frequency of occurrence, the fastest response time and the slowest response time as the semantic keyword features.

[0011] Optionally, an anomaly detection model is established based on the attribute features, the grammatical keyword features and the semantic keyword features, including: establishing an influencing factor set based on the degree of deviation of the attribute features, the degree of deviation of the grammatical keyword features and the degree of deviation of the semantic keyword features; establishing an evaluation set based on the evaluation grade of the attribute features, the evaluation grade of the grammatical keyword features and the evaluation grade of the semantic keyword features; establishing an evaluation matrix based on the influencing factor set and the evaluation set, and obtaining weight vectors corresponding to the attribute features, the grammatical keyword features and the semantic keyword features, calculating the product of the weight vector and the evaluation matrix, and obtaining the anomaly detection model.

[0012] Optionally, establishing an impact factor set according to the deviation degree of the attribute feature, the deviation degree of the grammatical keyword feature and the deviation degree of the semantic keyword feature includes: determining the deviation degree of the attribute feature as in, represents the weight of the attribute feature, The average value of the terminal security baseline representing the attribute characteristics. represents the standard deviation of the terminal security baseline of the attribute feature, N represents the number of the attribute features, and TFD represents the degree of deviation of the attribute feature; the degree of deviation of the grammatical keyword feature is determined as in, represents the weight of the grammatical keyword feature, represents the average value of the grammatical keyword feature in the terminal security baseline, represents the standard deviation of the terminal security baseline of the grammatical keyword feature, M represents the number of the grammatical keyword features, and SFD represents the degree of deviation of the grammatical keyword feature; the degree of deviation of the semantic keyword feature is determined as in, represents the weight of the semantic keyword feature, represents the average value of the semantic keyword feature in the terminal security baseline, represents the standard deviation of the terminal security baseline of the semantic keyword feature, K represents the number of the semantic keyword features, and GFD represents the degree of deviation of the semantic keyword feature; the influencing factor set is established as U={TFD, SFD, GFD}.

[0013] Optionally, determining whether the power terminal has an abnormality according to the abnormality detection model includes: calculating the detection value of the abnormality detection model, and obtaining a basic trust value and the weight of the basic trust value; calculating a comprehensive trust value according to the formula T=αT0+(1-α)V, wherein α represents the weight of the basic trust value, T0 represents the basic trust value, V represents the detection value of the abnormality detection model, and T represents the comprehensive trust value.

[0014] According to another aspect of an embodiment of the present invention, there is also provided an abnormality detection device for an electric power terminal, comprising: an extraction unit, used to obtain network protocol attribute information of the electric power terminal, perform feature extraction on the network protocol attribute information to obtain attribute features, wherein the network protocol attribute information at least includes a protocol type; a first determination unit, used to obtain transmission data of the electric power terminal, identify grammatical keywords of the transmission data, determine grammatical keyword features based on the grammatical keywords, and determine semantic keyword features based on at least the frequency of occurrence of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar; a second determination unit, used to establish an abnormality detection model based on the attribute features, the grammatical keyword features and the semantic keyword features, and determine whether the electric power terminal has an abnormality based on the abnormality detection model.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting anomalies in a power terminal.

[0016] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing an abnormality detection method of an electric power terminal described in any one of the above.

[0017] In an embodiment of the present invention, the network protocol attribute information of the power terminal is obtained, and the network protocol attribute information is feature extracted to obtain attribute features, wherein the network protocol attribute information at least includes the protocol type; the transmission data of the power terminal is obtained, the grammatical keywords of the transmission data are identified, the grammatical keyword features are determined according to the grammatical keywords, and the semantic keyword features are determined at least according to the frequency of occurrence of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar; an anomaly detection model is established according to the attribute features, the grammatical keyword features and the semantic keyword features, and it is determined whether the power terminal is abnormal according to the anomaly detection model. Through the technical solution provided by the present invention, it is achieved to evaluate abnormal terminals through protocol features, extract grammatical keyword features and semantic keyword features, evaluate terminal status, and construct device portraits, thereby achieving the technical effect of effectively ensuring the master station's secure access control to the terminal, thereby solving the technical problem that the IoT terminal security assessment system in the prior art is not applicable to power terminals, and the trust assessment technology cannot be simply applied to the security protection of power terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for detecting abnormality of a power terminal according to an embodiment of the present invention;

[0020] Figure 2 is a flow chart of an abnormality detection method for a power terminal according to an embodiment of the present invention;

[0021] Figure 3 is a flow chart of power terminal monitoring based on network flow sequence according to an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of a trust assessment model based on device profiling according to an embodiment of the present invention;

[0023] Figure 5 is a flow chart of trust value calculation according to an embodiment of the present invention;

[0024] Figure 6 is a schematic diagram of abnormal evaluation of power terminal communication volume based on protocol analysis according to an embodiment of the present invention;

[0025] Figure 7 is a schematic diagram of an abnormality detection device for a power terminal according to an embodiment of the present invention.

[0026] The above drawings include the following reference numerals:

[0027] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] As introduced in the background technology, the IoT terminal security assessment system in the prior art is not applicable to power terminals, and trust assessment technology cannot be simply applied to the security protection of power terminals. In view of the above defects, an abnormality detection method, device, computer-readable storage medium and electronic device for a power terminal are provided in the embodiments of the present invention.

[0031] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0032] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of an abnormality detection method for a power terminal according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0033] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the abnormality detection method of the power terminal in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific example of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0034] According to an embodiment of the present invention, a method embodiment of a method for detecting an abnormality of an electric power terminal is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0035] Figure 2 is a flow chart of an abnormality detection method for a power terminal according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0036] Step S202, obtaining network protocol attribute information of the power terminal, performing feature extraction on the network protocol attribute information, and obtaining attribute features, wherein the network protocol attribute information at least includes a protocol type.

[0037] In this embodiment, obtaining the network protocol attribute information of the power terminal and performing feature extraction can help identify normal and abnormal behaviors of the power terminal. By analyzing the network protocol attribute characteristics, a behavior model of the power terminal can be established and abnormal behaviors that do not conform to the normal behavior model can be detected.

[0038] Figure 3 is a flow chart of power terminal monitoring based on network flow sequence according to an embodiment of the present invention, such as Figure 3 As shown, the basic attribute information of network traffic is collected, and then data preprocessing is performed to extract message information according to the network flow order. The specific steps are as follows: start, select the basic attributes of network traffic, preprocess, get the network traffic order, attribute clustering, feature word extraction, feature list matching, end.

[0039] Step S204, acquiring transmission data of the power terminal, identifying grammatical keywords of the transmission data, determining grammatical keyword features according to the grammatical keywords, and determining semantic keyword features at least according to the occurrence frequency of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar.

[0040] In this embodiment, acquiring the transmission data of the power terminal and identifying the grammatical keywords therein can help the system analyze the structure and patterns of the data. By determining the characteristics of the grammatical keywords, the system can establish a grammatical model of the data to better understand the organization form and relationship of the data. By determining the semantic keyword characteristics based on the frequency of occurrence of the grammatical keywords, important and frequently occurring keywords in the data can be found, thereby inferring the meaning and potential patterns of the data.

[0041] Step S206, establishing an anomaly detection model according to the attribute features, the grammatical keyword features and the semantic keyword features, and determining whether the power terminal has an anomaly according to the anomaly detection model.

[0042] In this embodiment, an anomaly detection model is established based on attribute features, grammatical keyword features and semantic keyword features, which can automatically identify and detect abnormal situations of power terminals. By analyzing and comparing the attribute features, grammatical keyword features and semantic keyword features of the power terminals, abnormal behaviors or states of the power terminals can be discovered in time, thereby improving the safety and stability of the system.

[0043] As can be seen from the above, in an embodiment of the present invention, network protocol attribute information of the power terminal is obtained, and feature extraction is performed on the network protocol attribute information to obtain attribute features, wherein the network protocol attribute information at least includes the protocol type; transmission data of the power terminal is obtained, grammatical keywords of the transmission data are identified, grammatical keyword features are determined based on the grammatical keywords, and semantic keyword features are determined at least based on the frequency of occurrence of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar; an anomaly detection model is established based on the attribute features, grammatical keyword features and semantic keyword features, and it is determined whether the power terminal has an abnormality based on the anomaly detection model, so as to evaluate the abnormal terminal by monitoring the external features of the network traffic, extract the key fields of each text message and statistically analyze the keyword frequency and time slot threshold, evaluate the terminal status, and at the same time, construct a device portrait from multiple aspects of network flow sequence, grammar and semantic analysis, and calculate the trust value in real time, thereby achieving the technical effect of effectively ensuring the master station's secure access control to the terminal.

[0044] The technical solution provided by the embodiment of the present invention solves the technical problems in the prior art that the IoT terminal security assessment system is not applicable to power terminals and the trust assessment technology cannot be simply applied to the security protection of power terminals.

[0045] According to the above-mentioned embodiment of the present invention, feature extraction is performed on network protocol attribute information to obtain attribute features, including: establishing an attribute vector, wherein the attribute vector at least includes an attribute and an attribute value corresponding to the attribute; calculating the number of occurrences of the same attribute value, and calculating the ratio of the number of occurrences to the number of network protocol attribute information, and when the ratio is greater than a preset threshold, determining that the attribute corresponding to the attribute value is an attribute feature.

[0046] In this embodiment, an attribute vector is established, and the ratio of the number of occurrences of the same attribute value to the number of network protocol attribute information is calculated, so as to confirm that the attribute corresponding to the attribute value is an attribute feature, which helps to construct an attribute vector, organize and count the attributes and attribute values. By calculating the number of occurrences of the same attribute value and comparing it with the number of network protocol attribute information, attribute values ​​with higher frequency can be found, thereby determining that they are attribute features.

[0047] Figure 4 is a schematic diagram of a trust assessment model based on device profiling according to an embodiment of the present invention, such as Figure 4As shown, the network flow is preprocessed, and then divided into the extraction of network traffic features and key protocol features. The extraction of network traffic features is divided into the following steps: obtaining the basic attributes of the network flow (transmission data), obtaining network traffic data, performing attribute clustering and feature word extraction, and obtaining network traffic features. The extraction of key protocol features is divided into the following steps: message parallel parsing, keyword extraction to obtain frequency thresholds, keyword matching to obtain time slot thresholds, and then obtaining key protocol features. Based on the network traffic features and key protocol features, the device can be profiled to obtain a device portrait, and further terminal trust assessment and terminal anomaly monitoring can be performed.

[0048] Collect the basic attribute information of network traffic, obtain the network traffic sequence vector, use message clustering technology, and complete the extraction of normal features through the network flow sequence. Mainly consider the IP, quantity, time slot, direction and total length of the network message, and do not consider the data part. Therefore, it can also be used for the transmission of data segment encrypted messages.

[0049] Specifically, it includes the following parts: 1) The message header information required to construct the network flow sequence includes IP address, protocol type, message length, message time slot and message direction. The collected message header information is further analyzed to obtain the network flow sequence vector; 2) The abnormal assessment usually adopts the message clustering method to extract the feature word feature list based on the network flow sequence vector. 3) The destination IP is represented by f1, the protocol type is represented by f2, the message size is represented by f3, the message time slot is represented by f4, and the message direction is represented by f5. Since most of the power Internet of Things uses intranet communication, the IP address is directly used as the last 8 bits. The message time slot is obtained by subtracting the time of the current message from the time of the last adjacent message. The receiving time slot is represented by 1 and the sending time slot is represented by 2. Subsequently, the expert voting algorithm is used to divide each message into words. To use the message clustering method, a set of three tuples must be defined to represent the network flow sequence vector, A = (S, P, V), where S is set as the data set to be processed, that is, the message set, and P is the attribute f in the network flow sequence. i A collection of V with attributes f i A set of specific values ​​in the message; 4) For a certain attribute P in the message i , if V i The values ​​of are the same, then these messages are divided into the same cluster, and then the attributes in the network flow sequence are classified to form a preliminary clustering result. By calculating each set V i The number of occurrences of the attribute is divided by the total number of messages. If the ratio is greater than 0.05, it indicates that the attribute is representative and suitable as a feature of the device portrait. If the ratio is lower than the threshold, the attribute is filtered out. 5) The feature words are grouped into set V i Sort the number of in descending order and set V i Each message S ini (S i ∈V i ) intersect until all feature word sets are approximately f i Only then can we get the feature word set.

[0050] like Figure 3 As shown, the collected message header information is further analyzed to obtain the network flow sequence vector. For a certain attribute Pi in the message, if V i The values ​​of are the same, then these messages are divided into the same cluster, and then the attributes in the network flow sequence are classified to form a preliminary clustering result. After that, the clustering result needs to be further filtered to be more accurate. By calculating each set V i The number of occurrences of the attribute is divided by the total number of messages to obtain the ratio of the attribute value to the number of messages. If the ratio is greater than 0.05, it indicates that the attribute is representative and suitable as a feature of the device portrait. On the contrary, if the ratio is lower than the threshold, the attribute is filtered out and the feature words are grouped into set V. i Sort the number of in descending order and set V i Each message S in i (S i ∈V i ) intersect until all feature word sets are approximately f i Only then can we get the feature word set.

[0051] According to the above-mentioned embodiment of the present invention, the grammatical keywords of the transmission data are identified, and the grammatical keyword features are determined according to the grammatical keywords, including: parsing the transmission data to identify the grammatical keywords; comparing the grammatical keywords with the attribute features, and when the grammatical keyword is the same as any one of the attribute features, determining that the grammatical keyword is a grammatical keyword feature.

[0052] In this embodiment, by comparing grammatical keywords with attribute features, the meaning of the data can be better understood, and the grammatical keyword features can be determined when the grammatical keywords are the same as the attribute features, thereby more effectively identifying abnormal situations, parsing the transmitted data and identifying grammatical keywords, which helps to quickly and accurately identify key information in the data.

[0053] It should be noted that the above-mentioned anomalies are detected by extracting the syntax and semantics of the message data segment. In terms of syntax detection, a parsing method synchronized with the data segment is designed to achieve rapid positioning of keywords and improve the parsing speed. After identifying the key fields, they are matched with the feature list. If they are not on the feature list, the syntax is considered to be abnormal.

[0054] In semantic detection, the frequency threshold of the keyword is obtained by counting the number of times each keyword appears in all data messages within a certain period of time, as well as the time difference between two adjacent different keywords. Therefore, by monitoring the keyword features of the terminal, abnormal monitoring is achieved.

[0055] The specific steps are as follows: 1) First locate the position of the key field in the message, cut it into multiple read nodes, and parse the protocol synchronously. If the position of the keyword is known in advance, set multiple cutoff points and quickly read the corresponding keyword content according to the number of keywords. If the keyword position is unknown, process the data segment of the message into blocks, insert (n-1) scanning points according to actual needs, and parse each data block; 2) Collect the traffic data of normal terminal communication, convert it into natural language, and calculate the number of repeated fields in its data segment X i , by calculating X i The frequency f of each keyword is determined by the ratio of the total messages t i , the formula is as follows 3) Calculate the time difference between the first appearance of different adjacent keywords; take the maximum value of the time difference as the maximum response time, and the minimum value as the fastest response time; 4) Based on the above three data values, the semantic keyword features of the protocol are obtained, and the actual running status is recorded. i , set the window range T, that is, the farthest recording point, and select several f with higher frequencies i Constitute the semantic image of the terminal. i When there is a significant deviation from the current data, or the keyword is outside the normal time range, the terminal is considered to be in an abnormal state.

[0056] According to the above embodiment of the present invention, the semantic keyword features are determined at least according to the frequency of occurrence of the grammatical keywords, including: determining the number of occurrences of the grammatical keywords, obtaining the total amount of transmitted data, calculating the ratio of the number of occurrences to the total number, and obtaining the frequency of occurrence of each grammatical keyword; calculating the first appearance time of every two grammatical keywords, calculating the absolute value of the difference between every two first appearance times, and taking the maximum value of the absolute value of the difference as the slowest response time, and taking the minimum value of the absolute value of the difference as the fastest response time; determining the number of occurrences, the frequency of occurrence, the fastest response time and the slowest response time as semantic keyword features.

[0057] In this embodiment, by counting the number of occurrences and frequency of each grammatical keyword, the importance and distribution of different keywords in the data can be understood, which is helpful to identify abnormal data. By calculating the difference in the first appearance time between different grammatical keywords, the response speed during data transmission can be analyzed, and abnormal response time can be identified to determine whether there is an abnormal situation. The determination of the fastest and slowest response times can also be used as a reference indicator for anomaly detection to help quickly locate and solve problems. Semantic keyword features can be used to describe grammatical features and response time features in transmitted data.

[0058] According to the above embodiment of the present invention, an anomaly detection model is established according to attribute features, grammatical keyword features and semantic keyword features, including: establishing an influencing factor set according to the degree of deviation of the attribute features, the degree of deviation of the grammatical keyword features and the degree of deviation of the semantic keyword features; establishing an evaluation set according to the evaluation level of the attribute features, the evaluation level of the grammatical keyword features and the evaluation level of the semantic keyword features; establishing an evaluation matrix according to the influencing factor set and the evaluation set, and obtaining weight vectors corresponding to the attribute features, the grammatical keyword features and the semantic keyword features, calculating the product of the weight vector and the evaluation matrix, and obtaining the anomaly detection model.

[0059] In this embodiment, by establishing influencing factor activation and evaluation sets, and establishing an evaluation matrix based on these sets, the weight vectors of attribute features, grammatical keyword features and semantic keyword features can be determined, thereby calculating the anomaly detection model, thereby promptly discovering and solving problems and ensuring the normal operation of the power terminal.

[0060] It should be noted that the above-mentioned anomaly detection model first extracts feature information from the real-time network traffic features, semantic keyword features, and syntactic keyword features of the terminal, and constitutes a set of trust assessment influencing factors by comparing the degree of deviation between the real-time features of the terminal and the features in the security baseline, such as the degree of deviation of the packet size and the number of packets, the degree of deviation of the source IP and the destination IP in the traffic features, and the degree of deviation of the semantic and syntactic keyword features. Secondly, the evaluation set is determined according to the terminal security protection strategy, the terminal evaluation model is established, and the real-time trust value is calculated; then the trust value is combined with the weighted trust value based on the terminal to obtain the comprehensive trust value of the terminal.

[0061] Figure 5 is a flow chart of trust value calculation according to an embodiment of the present invention. Figure 5 As shown in the figure, we first establish an impact factor set and an evaluation set. The impact factor set is represented by U = {TFD, SFD, GFD}, where TFD, SFD, and GFD represent the degree of deviation of traffic features, grammatical keyword features, and semantic keyword features, respectively. We establish an evaluation matrix, and the affiliation between the i-th element in the impact factor set U and the first element in the evaluation set F is recorded as e i1, the evaluation result of the i-th element is represented by the fuzzy set e i ={e i1 ,e i2 ,…,e in} indicates that the fuzzy set of m influencing factors constitutes the evaluation matrix E m*n , determine the weight set (of influencing factors). In the evaluation process, the importance of each influencing factor is different. The weight set corresponding to each influencing factor is determined using a relevant algorithm. The weight set is expressed as W = {W1, W2, …, W n}, using SPSS AU data science analysis platform, adopting the analytic hierarchy process (AHP) to obtain weights and establish an evaluation model. m*n After the weight vector of the influencing factor W is obtained, the vector W on the influencing factor set U is transformed into a fuzzy vector X on the set V through fuzzy transformation, which can be expressed as: X = W 1*m *E m*n ={x1,x2,…,x n}, obtain the terminal evaluation trust value, which can be calculated by the following formula: V = X * S, where S represents the trust value corresponding to the influencing factor in set u. V represents the final comprehensive evaluation of the trust value of the terminal, and calculates the comprehensive trust value. If it is the first trust evaluation of the terminal, the trust baseline value of the terminal is set to 0.8. Then use the following Bayesian formula to calculate the basic trust value of the terminal: In the formula, T0 is the basic trust value of the terminal; Y represents the number of normal accesses of the terminal; and N is the number of historical abnormal accesses.

[0062] In addition, it should be noted that in the establishment of the evaluation set, the trust evaluation module evaluates each influencing factor and obtains a score, which can be expressed as (taking TFD as an example): The evaluation set consists of different evaluation levels corresponding to different scores, which can be expressed as F = {untrusted terminal, suspicious terminal, trusted terminal}. Different trust value ranges can correspond to the evaluation levels in the F set, which can be expressed as S TFD ∈F, and then establish the evaluation matrix. There is a fuzzy relationship between the impact factor set U and the evaluation set F, which can be expressed as:

[0063] In the above embodiment of the present invention, a set of influencing factors is established according to the deviation degree of the attribute feature, the deviation degree of the grammatical keyword feature and the deviation degree of the semantic keyword feature, including: determining the deviation degree of the attribute feature as in, represents the weight of the attribute feature, The average value of the endpoint security baseline representing the attribute characteristics. The standard deviation of the terminal security baseline of the attribute feature is represented by N, the number of attribute features is represented by TFD, and the deviation degree of the attribute feature is determined by in, represents the weight of the grammatical keyword feature, The average value of the grammatical keyword characteristics in the endpoint security baseline. represents the standard deviation of the terminal security baseline of the grammatical keyword feature, M represents the number of grammatical keyword features, and SFD represents the degree of deviation of the grammatical keyword feature; the degree of deviation of the semantic keyword feature is determined as in, represents the weight of the semantic keyword feature, Represents the average value of semantic keyword features in the endpoint security baseline. represents the standard deviation of the terminal security baseline of the semantic keyword feature, K represents the number of semantic keyword features, and GFD represents the degree of deviation of the semantic keyword feature; the influencing factor set is established as U = {TFD, SFD, GFD}.

[0064] In this embodiment, by calculating the degree of deviation of attribute features, grammatical keyword features and semantic keyword features, a set of influencing factors is established to evaluate the safety of the power terminal. By comparing the degree of deviation with the average and standard deviation of the baseline, abnormal situations in the power terminal can be identified, thereby timely discovering potential safety hazards and taking corresponding preventive measures.

[0065] According to the above embodiment of the present invention, determining whether there is an abnormality in the power terminal according to the abnormality detection model includes: calculating the detection value of the abnormality detection model, and obtaining the basic trust value and the weight of the basic trust value; calculating the comprehensive trust value according to the formula T=αT0+(1-α)V, wherein α represents the weight of the basic trust value, T0 represents the basic trust value, V represents the detection value of the abnormality detection model, and T represents the comprehensive trust value.

[0066] In this embodiment, the credibility of the anomaly detection model for the detection results can be evaluated by calculating the comprehensive trust value. The basic trust value and the weight of the basic trust value are used to represent the basic credibility of the model. The detection value weight of the anomaly detection model is used to represent the specific anomaly detection result. By calculating the comprehensive trust value, the basic trust value and the detection value weight can be comprehensively considered to obtain the final trust value.

[0067] Figure 6 is a schematic diagram of anomaly assessment of power terminal communication volume based on protocol parsing according to an embodiment of the present invention, such as Figure 6As shown, parallel analysis is performed through pointer displacement and information segmentation to match the feature list; the keyword frequency, keyword combination frequency and time interval between keywords are counted, and finally threshold matching is performed. The distribution terminal anomaly detection method based on protocol parsing detects anomalies by extracting the syntax and semantics of the message data segment. In terms of syntax detection, a parsing method synchronized with the data segment is designed to achieve rapid positioning of keywords and improve the parsing speed. After identifying the key field, it is matched with the feature list. If it is not on the feature list, it is considered to be grammatically abnormal. In semantic detection, the threshold of the keyword frequency is obtained by counting the number of times each keyword appears in all data messages within a certain period of time, as well as the time difference between two adjacent different keywords. Therefore, by monitoring the keyword features of the terminal, anomaly monitoring is achieved.

[0068] like Figure 4 As shown, first, the network traffic is preprocessed to extract the order of the network flow, including IP address, traffic type, message length, message time slot and message direction. The order is divided using a clustering algorithm, and a device portrait is constructed based on basic traffic characteristics. Next, message blocking, synchronization parsing and keyword frequency analysis are used to process the protocol data segment. If the protocol field exceeds the protocol requirements, a grammatical judgment is performed on it, and semantic extraction is performed on high-frequency keywords and protocol content to construct a terminal device portrait. Finally, the network flow sequence, grammatical keywords and semantic keyword features are combined to construct a device portrait, and the threshold of each feature is determined to determine whether the terminal is abnormal.

[0069] The technical solution provided by the above embodiment of the present invention solves the following problems: 1) For the existing terminal trust evaluation scheme, a power terminal trust evaluation model based on device portrait with high detection rate and low false positive rate is proposed. The existing terminal trust evaluation scheme first identifies the power terminal device and registers it to the trust evaluation system, collects the device's behavior data, configuration information and other device-related data, and based on these data, uses pre-defined evaluation criteria and algorithms to calculate the trust of the device, and then decides whether it can access the characteristic power network according to the result, but the complexity and cost are too high, and the technology and use environment of the power terminal equipment often change, and it cannot respond to new security threats and risks in time; 2) A power terminal trust evaluation model based on device portrait is proposed to pre-process the network traffic. The order of the network flow is extracted, and then the protocol data segment is processed using message blocking, synchronization parsing and keyword frequency analysis. Finally, the device portrait is constructed by combining the network flow sequence, grammatical keywords and semantic keyword features, and the threshold of each feature is determined by experiment to determine whether the terminal is abnormal.

[0070] As can be seen from the above, in the embodiment of the present invention, a trust evaluation model of power terminals based on device portrait is proposed. First, an abnormal evaluation method based on network flow sequence is proposed. By monitoring the external characteristics of network flow, abnormal terminals are evaluated. The basic attributes of protocol data packets are collected from a normal network flow and preprocessed into a three-layer form. By extracting keywords, a feature list of network flow features can be obtained. Secondly, an abnormal evaluation method based on syntax and semantics is proposed. By constructing a protocol keyword feature list, protocol segmentation is used to implement parallel protocol parsing, and the key field position is quickly located to achieve syntax anomaly detection. For access behavior characteristics, a baseline of key features of access behavior is obtained by analyzing data packets, which improves the detection efficiency of power system anomalies and different network behaviors. Therefore, combined with network flow sequence, syntax and semantic analysis, a device portrait can be constructed to ensure the safety of power grid terminals. Finally, a trust evaluation method based on device portrait is proposed to calculate the trust value in real time, thereby evaluating the trust level of the terminal.

[0071] That is, the above technical solution provided by the embodiment of the present invention comprehensively considers multiple factors. First, abnormal terminals are evaluated by monitoring the external characteristics of network traffic. Secondly, the key fields of each text message are extracted, and the frequency of occurrence of keywords in the text messages is statistically analyzed to obtain the keyword frequency and time slot threshold for evaluating the terminal status. Therefore, combined with the network flow sequence, grammar and semantic analysis, a device portrait can be constructed to ensure the safety of the power grid terminal. Then, a trust evaluation method based on device portrait is proposed, which calculates the trust value in real time, has a high detection rate and a low false detection rate, and has high real-time performance, which is more suitable for power terminals.

[0072] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0073] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0074] According to an embodiment of the present invention, there is also provided an abnormality detection device for a power terminal for implementing the abnormality detection method for a power terminal. Figure 7 is a schematic diagram of an abnormality detection device for a power terminal according to an embodiment of the present invention, such as Figure 7 As shown, the device includes: an extracting unit 701, a first determining unit 703 and a second determining unit 705. The abnormality detection device of the power terminal is described below.

[0075] The extraction unit 701 is used to obtain network protocol attribute information of the power terminal, perform feature extraction on the network protocol attribute information, and obtain attribute features, wherein the network protocol attribute information at least includes a protocol type.

[0076] The first determination unit 703 is used to obtain transmission data of the power terminal, identify grammatical keywords of the transmission data, determine grammatical keyword features according to the grammatical keywords, and determine semantic keyword features at least according to the occurrence frequency of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar.

[0077] The second determination unit 705 is used to establish an abnormality detection model according to the attribute features, the grammatical keyword features and the semantic keyword features, and determine whether the power terminal has an abnormality according to the abnormality detection model.

[0078] It should be noted here that the above-mentioned extraction unit 701, first determination unit 703 and second determination unit 705 correspond to steps S202 to S206 in the above-mentioned embodiment, and the three modules have the same instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiment.

[0079] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, first, the extraction unit can be used to obtain the network protocol attribute information of the power terminal, and the network protocol attribute information can be feature extracted to obtain the attribute feature, wherein the network protocol attribute information at least includes the protocol type; then the first determination unit can be used to obtain the transmission data of the power terminal, identify the grammatical keywords of the transmission data, determine the grammatical keyword features according to the grammatical keywords, and determine the semantic keyword features at least according to the frequency of occurrence of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar; finally, the second determination unit can be used to establish an anomaly detection model according to the attribute features, grammatical keyword features and semantic keyword features, and determine whether the power terminal has an abnormality according to the anomaly detection model, thereby achieving the evaluation of abnormal terminals by monitoring the external features of network traffic, extracting the key fields of each text message and statistically analyzing the keyword frequency and time slot threshold, evaluating the terminal status, and at the same time, constructing a device portrait from multiple aspects of network flow sequence, grammar and semantic analysis, and calculating the trust value in real time, thereby achieving the technical effect of effectively ensuring the master station's secure access control to the terminal, and improving the security and stability of the system.

[0080] The technical solution provided by the embodiment of the present invention solves the technical problems in the prior art that the IoT terminal security assessment system is not applicable to power terminals and the trust assessment technology cannot be simply applied to the security protection of power terminals.

[0081] In an optional embodiment, the extraction unit includes: an establishment subunit for establishing an attribute vector, wherein the attribute vector includes at least an attribute and an attribute value corresponding to the attribute; a first calculation subunit for calculating the number of occurrences of the same attribute value, and calculating the ratio of the number of occurrences to the number of network protocol attribute information, and when the ratio is greater than a preset threshold, determining that the attribute corresponding to the attribute value is an attribute feature.

[0082] In an optional embodiment, the first determination unit includes: a parsing subunit, used to parse the transmitted data and identify grammatical keywords; a comparison subunit, used to compare the grammatical keywords with the attribute features, and when the grammatical keyword is the same as any attribute feature, determine that the grammatical keyword is a grammatical keyword feature.

[0083] In an optional embodiment, the first determination unit includes: a first determination subunit, used to determine the number of occurrences of a grammatical keyword, obtain the total amount of transmitted data, calculate the ratio of the number of occurrences to the total amount, and obtain the frequency of occurrence of each grammatical keyword; a second calculation subunit, used to calculate the first appearance time of every two grammatical keywords, calculate the absolute value of the difference between every two first appearance times, and use the maximum value of the absolute value of the difference as the slowest response time, and the minimum value of the absolute value of the difference as the fastest response time; the second determination subunit, used to determine the number of occurrences, frequency of occurrence, fastest response time and slowest response time as semantic keyword features.

[0084] In an optional embodiment, the second determination unit includes: a first establishing subunit, used to establish an influencing factor set according to the degree of deviation of the attribute feature, the degree of deviation of the grammatical keyword feature, and the degree of deviation of the semantic keyword feature; a second establishing subunit, used to establish an evaluation set according to the evaluation level of the attribute feature, the evaluation level of the grammatical keyword feature, and the evaluation level of the semantic keyword feature; a third establishing subunit, used to establish an evaluation matrix based on the influencing factor set and the evaluation set, and obtain the weight vectors corresponding to the attribute features, grammatical keyword features, and semantic keyword features, calculate the product of the weight vector and the evaluation matrix, and obtain the anomaly detection model.

[0085] In an optional embodiment, the first establishing subunit includes: a third determining subunit, configured to determine the degree of deviation of the attribute feature as in, represents the weight of the attribute feature, The average value of the endpoint security baseline representing the attribute characteristics. represents the standard deviation of the terminal security baseline of the attribute feature, N represents the number of attribute features, and TFD represents the degree of deviation of the attribute feature; the fourth determination subunit is used to determine the degree of deviation of the grammatical keyword feature. in, represents the weight of the grammatical keyword feature, The average value of the grammatical keyword characteristics in the endpoint security baseline. represents the standard deviation of the terminal security baseline of the grammatical keyword feature, M represents the number of grammatical keyword features, and SFD represents the degree of deviation of the grammatical keyword feature; the fifth determining subunit is used to determine the degree of deviation of the semantic keyword feature as in, represents the weight of the semantic keyword feature, Represents the average value of semantic keyword features in the endpoint security baseline. Represents the standard deviation of the terminal security baseline of the semantic keyword feature, K represents the number of semantic keyword features, and GFD represents the degree of deviation of the semantic keyword feature; the fourth establishment subunit is used to establish an influencing factor set U = {TFD, SFD, GFD}.

[0086] In an optional embodiment, the second determination unit includes: a third calculation subunit, used to calculate the detection value of the anomaly detection model, and obtain the basic trust value and the weight of the basic trust value; a fourth calculation subunit, used to calculate the comprehensive trust value according to the formula T=αT0+(1-α)V, wherein α represents the weight of the basic trust value, T0 represents the basic trust value, V represents the detection value of the anomaly detection model, and T represents the comprehensive trust value.

[0087] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include an abnormality detection method for an electric power terminal for executing any one of the above items.

[0088] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is run, any one of the above-mentioned abnormality detection methods for a power terminal is executed.

[0089] According to another aspect of an embodiment of the present invention, there is further provided a computer program product, comprising computer instructions, which, when executed by a processor, execute any one of the above-mentioned methods for detecting abnormalities in a power terminal.

[0090] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting abnormalities in power terminals.

[0091] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0092] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: obtaining network protocol attribute information of the power terminal, performing feature extraction on the network protocol attribute information to obtain attribute features, wherein the network protocol attribute information at least includes a protocol type; obtaining transmission data of the power terminal, identifying grammatical keywords of the transmission data, determining grammatical keyword features based on the grammatical keywords, and determining semantic keyword features based on at least the frequency of occurrence of the grammatical keywords, wherein the grammatical keywords are keywords that contain grammar; establishing an anomaly detection model based on the attribute features, grammatical keyword features and semantic keyword features, and determining whether there is an abnormality in the power terminal based on the anomaly detection model.

[0093] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: establishing an attribute vector, wherein the attribute vector includes at least an attribute and an attribute value corresponding to the attribute; calculating the number of occurrences of the same attribute value, and calculating the ratio of the number of occurrences to the number of network protocol attribute information, and when the ratio is greater than a preset threshold, determining that the attribute corresponding to the attribute value is an attribute feature.

[0094] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: parsing the transmission data to identify grammatical keywords; comparing the grammatical keywords with attribute features, and when the grammatical keyword is the same as any attribute feature, determining that the grammatical keyword is a grammatical keyword feature.

[0095] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: determining the number of occurrences of a grammatical keyword, obtaining the total amount of transmitted data, calculating the ratio of the number of occurrences to the total amount, and obtaining the frequency of occurrence of each grammatical keyword; calculating the first occurrence time of every two grammatical keywords, calculating the absolute value of the difference between every two first occurrence times, and taking the maximum value of the absolute value of the difference as the slowest response time, and taking the minimum value of the absolute value of the difference as the fastest response time; determining the number of occurrences, the frequency of occurrence, the fastest response time, and the slowest response time as semantic keyword features.

[0096] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: establishing an influencing factor set according to the degree of deviation of the attribute features, the degree of deviation of the grammatical keyword features, and the degree of deviation of the semantic keyword features; establishing an evaluation set according to the evaluation level of the attribute features, the evaluation level of the grammatical keyword features, and the evaluation level of the semantic keyword features; establishing an evaluation matrix according to the influencing factor set and the evaluation set, and obtaining weight vectors corresponding to the attribute features, the grammatical keyword features, and the semantic keyword features, calculating the product of the weight vector and the evaluation matrix, and obtaining an anomaly detection model.

[0097] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: determining the degree of deviation of the attribute feature is in, represents the weight of the attribute feature, The average value of the endpoint security baseline representing the attribute characteristics. The standard deviation of the terminal security baseline of the attribute feature is represented by N, the number of attribute features is represented by TFD, and the deviation degree of the attribute feature is determined by in, represents the weight of the grammatical keyword feature, The average value of the grammatical keyword characteristics in the endpoint security baseline. represents the standard deviation of the terminal security baseline of the grammatical keyword feature, M represents the number of grammatical keyword features, and SFD represents the degree of deviation of the grammatical keyword feature; the degree of deviation of the semantic keyword feature is determined as in, represents the weight of the semantic keyword feature, Represents the average value of semantic keyword features in the endpoint security baseline. represents the standard deviation of the terminal security baseline of the semantic keyword feature, K represents the number of semantic keyword features, and GFD represents the degree of deviation of the semantic keyword feature; the influencing factor set is established as U = {TFD, SFD, GFD}.

[0098] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: calculating the detection value of the anomaly detection model, and obtaining the basic trust value and the weight of the basic trust value; calculating the comprehensive trust value according to the formula T=αT0+(1-α)V, wherein α represents the weight of the basic trust value, T0 represents the basic trust value, V represents the detection value of the anomaly detection model, and T represents the comprehensive trust value.

[0099] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0100] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0103] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0105] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting abnormality of a power terminal, characterized in that: include: Acquire network protocol attribute information of the power terminal, perform feature extraction on the network protocol attribute information to obtain attribute features, wherein the network protocol attribute information at least includes a protocol type; Acquire transmission data of the power terminal, identify grammatical keywords of the transmission data, determine grammatical keyword features according to the grammatical keywords, and determine semantic keyword features at least according to the occurrence frequency of the grammatical keywords, wherein the grammatical keywords are keywords containing grammar; An anomaly detection model is established according to the attribute features, the grammatical keyword features and the semantic keyword features, and whether the power terminal has an abnormality is determined according to the anomaly detection model.

2. The abnormality detection method of the power terminal according to claim 1, characterized in that: Feature extraction is performed on the network protocol attribute information to obtain attribute features, including: Establishing an attribute vector, wherein the attribute vector at least includes an attribute and an attribute value corresponding to the attribute; The number of occurrences of the same attribute value is calculated, and the ratio of the number of occurrences to the number of network protocol attribute information is calculated. When the ratio is greater than a preset threshold, the attribute corresponding to the attribute value is determined to be the attribute feature.

3. The abnormality detection method of the power terminal according to claim 1, characterized in that: Identifying a grammatical keyword of the transmission data, and determining a grammatical keyword feature according to the grammatical keyword, including: Parsing the transmission data to identify the grammatical keywords; The grammatical keyword is compared with the attribute features, and when the grammatical keyword is identical to any one of the attribute features, the grammatical keyword is determined to be the grammatical keyword feature.

4. The abnormality detection method of the power terminal according to claim 1, characterized in that: Determining semantic keyword features at least according to the occurrence frequency of the grammatical keywords includes: Determine the number of occurrences of the grammatical keyword, obtain the total amount of the transmitted data, calculate the ratio of the number of occurrences to the total amount, and obtain the occurrence frequency of each of the grammatical keywords; Calculate the first appearance time of every two grammatical keywords, calculate the absolute value of the difference between every two first appearance times, and use the maximum value of the absolute value of the difference as the slowest response time, and use the minimum value of the absolute value of the difference as the fastest response time; The number of occurrences, the frequency of occurrence, the fastest response time, and the slowest response time are determined as the semantic keyword features.

5. The abnormality detection method of the power terminal according to claim 1, characterized in that: Establishing an anomaly detection model according to the attribute feature, the grammatical keyword feature and the semantic keyword feature includes: Establishing an impact factor set according to the deviation degree of the attribute feature, the deviation degree of the grammatical keyword feature and the deviation degree of the semantic keyword feature; Establishing an evaluation set according to the evaluation level of the attribute feature, the evaluation level of the grammatical keyword feature, and the evaluation level of the semantic keyword feature; An evaluation matrix is ​​established according to the influencing factor set and the evaluation set, and weight vectors corresponding to the attribute features, the grammatical keyword features and the semantic keyword features are obtained, and the product of the weight vector and the evaluation matrix is ​​calculated to obtain the anomaly detection model.

6. The abnormality detection method of the power terminal according to claim 5, characterized in that: Establishing an impact factor set according to the deviation degree of the attribute feature, the deviation degree of the grammatical keyword feature and the deviation degree of the semantic keyword feature includes: Determine the degree of deviation of the attribute characteristics as in, represents the weight of the attribute feature, The average value of the terminal security baseline representing the attribute characteristics. represents the standard deviation of the terminal security baseline of the attribute feature, N represents the number of the attribute features, and TFD represents the degree of deviation of the attribute feature; Determine the degree of deviation of the grammatical keyword feature as in, represents the weight of the grammatical keyword feature, represents the average value of the grammatical keyword feature in the terminal security baseline, represents the standard deviation of the terminal security baseline of the grammatical keyword feature, M represents the number of the grammatical keyword features, and SFD represents the degree of deviation of the grammatical keyword feature; Determine the degree of deviation of the semantic keyword feature as in, represents the weight of the semantic keyword feature, represents the average value of the semantic keyword feature in the terminal security baseline, ε GFDi represents the standard deviation of the terminal security baseline of the semantic keyword feature, K represents the number of the semantic keyword features, and GFD represents the degree of deviation of the semantic keyword feature; The influencing factor set is established as U={TFD, SFD, GFD}.

7. The abnormality detection method of the power terminal according to claim 1, characterized in that: Determining whether the power terminal has an abnormality according to the abnormality detection model includes: Calculating the detection value of the anomaly detection model, and obtaining a basic trust value and a weight of the basic trust value; The comprehensive trust value is calculated according to the formula T=αT0+(1-α)V, where α represents the weight of the basic trust value, T0 represents the basic trust value, V represents the detection value of the anomaly detection model, and T represents the comprehensive trust value.

8. An abnormality detection device for a power terminal, characterized in that: include: An extraction unit, configured to obtain network protocol attribute information of the power terminal, perform feature extraction on the network protocol attribute information, and obtain attribute features, wherein the network protocol attribute information at least includes a protocol type; A first determination unit is used to obtain transmission data of the power terminal, identify a grammatical keyword of the transmission data, determine a grammatical keyword feature according to the grammatical keyword, and determine a semantic keyword feature according to at least an occurrence frequency of the grammatical keyword, wherein the grammatical keyword is a keyword containing grammar; The second determination unit is used to establish an abnormality detection model according to the attribute feature, the grammatical keyword feature and the semantic keyword feature, and determine whether the power terminal has an abnormality according to the abnormality detection model.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the abnormality detection method for the power terminal according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing an abnormality detection method for an electric power terminal as described in any one of claims 1 to 7.

Images