Power network security abnormal behavior early warning method and system based on community analysis

Abstract

The invention belongs to the technical field of network security, and discloses a power network security abnormal behavior early warning method and system based on community analysis, and the method comprises the steps: obtaining the historical behavior data of a power user, and building a personal behavior model; clustering analysis is carried out on the individual behavior models of all the power consumers, communities are divided, and a collective model is determined; collecting real-time behavior data of the power consumer, and establishing a current behavior model; judging whether the power users have abnormal behaviors according to the current model and the collective model; and if yes, obtaining a personal behavior model, analyzing an abnormal level and sending out a prompt. According to the method, the personal behavior model and the collective behavior model are established, and the real-time behavior analysis is combined, so that potential abnormal behaviors can be quickly and accurately identified. According to the method, the limitation of behavior analysis of a single power user is avoided, the detection capability of internal account attacks is improved, the severity of abnormal behaviors can be accurately evaluated, and the security of the system and the timeliness of protection are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically, to a method and system for early warning of abnormal behavior in power network security based on community analysis. Background Art

[0002] With the increasing development of power networks and the widespread application of smart grid technologies, the network security issues of power systems have become increasingly complex and severe. Traditional network security protection methods mainly target external network attacks, and identify and prevent external network attacks through border protection, traffic monitoring, and anomaly detection. These measures are highly effective in dealing with common external attacks, and can promptly detect and prevent traditional network attack methods such as DDoS attacks and virus intrusions. However, with the continuous evolution of attackers' methods, the attack methods against power networks are becoming more diverse and covert, especially the attacks using internal accounts, which are gradually becoming a difficulty in security protection.

[0003] Attacks from external networks are usually easier to detect by traditional security equipment and monitoring systems due to their obvious characteristics. However, when attackers obtain the accounts of legitimate power users and use these internal accounts to attack, the attack behavior is often hidden under normal operations and difficult to be identified in time by traditional security systems. This type of attack usually does not show significant abnormal traffic or system vulnerability exploitation, but instead uses the accounts of normal power users to access resources, operate data, and other activities, posing a great threat to the security of the power network. Although existing network security protection technologies can detect external attacks in real time, they lack effective early warning measures for problems such as abuse and theft of internal accounts, allowing attackers to hide in the internal network for a long time and conduct malicious activities such as data theft and destruction. Summary of the invention

[0004] In order to overcome the problem that the prior art lacks effective early warning means for internal account abuse, unauthorized operation and other issues, the present invention proposes a power network security abnormal behavior early warning method and system based on community analysis to solve the above problems.

[0005] The present invention provides the following technical solutions:

[0006] The abnormal behavior early warning method of power network security based on community analysis includes:

[0007] The present invention also provides a power network security abnormal behavior early warning system based on community analysis, which is used to implement a power network security abnormal behavior early warning method based on community analysis, comprising:

[0008] S1. Obtain the historical behavior data of all power users, establish a behavior model based on the historical behavior data, and record it as the personal behavior model of the power user;

[0009] S2. Perform cluster analysis on the individual behavior models of all power users, divide the individual behavior models of all power users into several categories, and use each category as a community; divide the power users into corresponding communities, and determine the corresponding collective model for each community;

[0010] S3, collecting real-time behavior data of power users, establishing a behavior model based on the real-time behavior data, and recording it as the current behavior model of the power user;

[0011] S4. judging whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs;

[0012] S5. When determining that the power user has abnormal behavior, obtain the power user's personal behavior model, analyze the power user's behavior abnormality level based on the power user's current behavior model and personal behavior model, and issue an abnormal reminder based on the power user's behavior abnormality level.

[0013] Preferably, the behavior data includes login logs, operation behavior logs and resource access logs; the steps of establishing the behavior model include: constructing a time vector based on the login log; constructing an operation vector based on the operation behavior log; constructing a resource vector based on the resource access log; and combining the time vector, operation sequence and resource vector to obtain a behavior model.

[0014] Preferably, the step of constructing the time vector includes: presetting the number of time periods m in a day; evenly dividing 24 hours in a day into m time periods; creating an m-dimensional initial time vector, each dimension of the initial time vector corresponds to a time period; initializing the values ​​of all dimensions of the initial time vector to 0; obtaining a login log, and extracting all login time points from the login log; for each extracted login time point, determining the time period to which the time point belongs; setting the value of the dimension of the initial time vector corresponding to the time period to 1; and using the initial time vector after the dimension values ​​are set as the time vector;

[0015] The step of constructing the operation vector includes: creating an operation dictionary, mapping each operation behavior to a unique operation number, obtaining an operation log, and converting all operations in the operation log into corresponding operation numbers in chronological order to obtain an operation sequence, presetting a sliding window to slide the operation sequence, extracting a subsequence of the operation sequence in each window, and for each subsequence, calculating the frequency of occurrence of each operation number therein to form a frequency vector, and superimposing all frequency vectors to obtain the operation vector;

[0016] The steps of constructing a resource vector include: creating a resource dictionary, mapping each resource to a unique resource number, obtaining a resource access log, converting all resources in the access log into corresponding resource numbers to obtain a resource sequence, calculating the number of times each resource number appears, creating a zero vector corresponding to the resource number one by one, filling the number of times each resource number appears to the corresponding position in the zero vector, and using the filled zero vector as the resource vector.

[0017] Preferably, the step of dividing the personal behavior models of all power users into several categories comprises:

[0018] S21, preset the number of categories k, and randomly select one model from the personal behavior models of all power users as the cluster center;

[0019] S22, for all personal behavior models that are not cluster centers, calculate the model distances between them and the cluster centers, and take the minimum value of the calculated model distances as the target distance of the personal behavior model;

[0020] S23, from all personal behavior models that are not cluster centers, a personal behavior model is selected as a cluster center according to the probability proportional to the target distance of the personal behavior model;

[0021] S24, repeat steps S22 to S23 until k cluster centers are selected;

[0022] S25, calculating the model distance between each individual behavior model and the k cluster centers, and assigning each individual model to the category to which the cluster center with the closest model distance belongs;

[0023] S26. For each category, calculate the average value of all models in the category and use the average value as the new cluster center;

[0024] S27, repeating steps S25 to S26 until the model distance between the new cluster center and the old cluster center is less than a preset center distance threshold, and obtaining the final classification results of k categories.

[0025] Preferably, the step of calculating the model distance includes:

[0026] The two models for which the model distance needs to be calculated are obtained and recorded as model A and model B respectively;

[0027] Obtain the time vector, operation vector and resource vector of model A;

[0028] Get the time vector, operation vector, and resource vector of model B;

[0029] Calculate the distances of the three corresponding vectors between model A and model B respectively;

[0030] Assign a preset weight to each vector distance, and the sum of these weights equals 1

[0031] The distances of the three vectors are weighted and added together to obtain the final model distance.

[0032] Preferably, determining the corresponding collective model for each community includes: determining the cluster center of each classification as the collective model of the corresponding community.

[0033] Preferably, the step of judging whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs includes:

[0034] The model distance between the current model of the power user and the collective model of the community to which the power user belongs is calculated; if the calculated model distance is greater than the preset safety distance, it is determined that the power user is abnormal; otherwise, it is determined that the power user is not abnormal.

[0035] Preferably, the step of analyzing the abnormal behavior level of the power user according to the current behavior model and the personal behavior model of the power user comprises:

[0036] Calculate anomaly index based on current behavior model and personal behavior model of power users;

[0037] Preset behavior abnormality level and corresponding abnormality index range;

[0038] The abnormal index interval in which the calculated abnormal index lies is used as the abnormal behavior level of the power user.

[0039] Preferably, the step of calculating the abnormality index includes:

[0040] Obtaining a time vector, an operation vector and a resource vector of a current behavior model of an electricity user;

[0041] Obtaining the time vector, operation vector and resource vector of the individual behavior model of the power user;

[0042] Calculate the outliers of the three corresponding vectors between the model's current behavior model and the model's individual behavior model respectively;

[0043] Assign a preset weight to each vector's outliers, and the sum of these weights equals 1

[0044] The outlier values ​​of the three vectors are weighted and added together to obtain the outlier index.

[0045] The present invention also provides a power network security abnormal behavior early warning system based on community analysis, which is used to implement a power network security abnormal behavior early warning method based on community analysis, comprising:

[0046] A personal model building module is used to obtain the historical behavior data of all power users, build a behavior model based on the historical behavior data, and record it as the personal behavior model of the power user;

[0047] The community division module is used to perform cluster analysis on the individual behavior models of all power users, divide the individual behavior models of all power users into several categories, use each category as a community, divide the power users into corresponding communities, and determine the corresponding collective model for each community;

[0048] A real-time model building module is used to collect real-time behavior data of power users, build a behavior model based on the real-time behavior data, and record it as the current behavior model of the power user;

[0049] An abnormality judgment module is used to judge whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs;

[0050] The abnormal analysis and reminder module is used to obtain the personal behavior model of the power user when it is judged that the power user has abnormal behavior, analyze the abnormal behavior level of the power user according to the current behavior model and personal behavior model of the power user, and issue an abnormal reminder according to the abnormal behavior level of the power user.

[0051] The present invention provides a method and system for early warning of abnormal behavior in power network security based on community analysis, which has the following beneficial effects:

[0052] By conducting an in-depth analysis of the historical behavior data of power users, we can establish a personal behavior model for power users, and further divide the behavior patterns of power users into communities through clustering algorithms, thereby forming a collective behavior model. By comparing the current behavior of power users with the collective behavior model of the community to which they belong, we can quickly and accurately identify potential abnormal behaviors, especially for internal account abuse.

[0053] By dividing the behaviors of power users into different communities through cluster analysis and establishing a collective model based on group behavior characteristics, the behavior patterns of power users can be captured more comprehensively, avoiding the limitations of single power user behavior analysis. Secondly, by comparing the current behavior model of power users with the collective model, abnormal behaviors that are obviously inconsistent with the community behavior model can be quickly screened out, greatly improving the ability to detect internal account attacks. In addition, by further comparing with the historical personal behavior model of power users, the solution can accurately assess the severity of abnormal behavior and issue corresponding warnings based on the abnormal level, ensuring the security of the system and the timeliness of protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1It is a flow chart of the method for early warning of abnormal behavior of power network security based on community analysis of the present invention;

[0055] Figure 2 It is a module schematic diagram of the power network security abnormal behavior early warning system based on community analysis of the present invention. DETAILED DESCRIPTION

[0056] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Example 1

[0058] See also Figure 1 In this embodiment, the abnormal behavior early warning method for power network security based on community analysis includes:

[0059] S1. Obtain the historical behavior data of all power users, establish a behavior model based on the historical behavior data, and record it as the personal behavior model of the power user;

[0060] In this embodiment, the login log in the behavior data records the login time of the power user; the operation behavior log records the various operations performed by the power user in the system, such as viewing documents, downloading files, etc.; the resource access log records the power user's access to various resources.

[0061] The behavior data includes login logs, operation behavior logs and resource access logs; the steps of establishing the behavior model include: constructing a time vector based on the login log; constructing an operation vector based on the operation behavior log; constructing a resource vector based on the resource access log; and combining the time vector, operation sequence and resource vector to obtain a behavior model.

[0062] The step of constructing the time vector includes: presetting the number of time periods m in a day; evenly dividing 24 hours in a day into m time periods; creating an m-dimensional initial time vector, each dimension of the initial time vector corresponds to a time period; initializing the values ​​of all dimensions of the initial time vector to 0; obtaining a login log, extracting all login time points from the login log; for each extracted login time point, determining the time period to which the time point belongs; setting the value of the dimension of the initial time vector corresponding to the time period to 1; and using the initial time vector after the dimension values ​​are set as the time vector;

[0063] The step of constructing the operation vector includes: creating an operation dictionary, mapping each operation behavior to a unique operation number, obtaining an operation log, and converting all operations in the operation log into corresponding operation numbers in chronological order to obtain an operation sequence, presetting a sliding window to slide the operation sequence, extracting a subsequence of the operation sequence in each window, and for each subsequence, calculating the frequency of occurrence of each operation number therein to form a frequency vector, and superimposing all frequency vectors to obtain the operation vector;

[0064] The steps of constructing a resource vector include: creating a resource dictionary, mapping each resource to a unique resource number, obtaining a resource access log, converting all resources in the access log into corresponding resource numbers to obtain a resource sequence, calculating the number of times each resource number appears, creating a zero vector corresponding to the resource number one by one, filling the number of times each resource number appears to the corresponding position in the zero vector, and using the filled zero vector as the resource vector.

[0065] In this embodiment, the steps for constructing the time vector are as follows: the number of time periods within a day is preset to be m=24, that is, a day is divided into 24 hours; a 24-dimensional initial time vector is created, each dimension corresponds to an hour, and the initial value is 0; all login time points are extracted from the login log; for each login time point, the hour to which it belongs is determined, and the value of the corresponding dimension is set to 1; and the final time vector is obtained.

[0066] For example, the login time of a certain power user is concentrated in 8:00-9:00, 12:00-13:00 and 18:00-19:00, then its time vector is: [0, 0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0]

[0067] This method can effectively capture the active time characteristics of power users and reflect the time periods of the day when power users usually log in to the system.

[0068] In this embodiment, the steps for constructing the operation vector are as follows: create an operation dictionary, map each operation behavior to a unique operation number, for example: login: 1, view document: 2, download file: 3, upload file: 4, send message: 5; convert all operations in the operation log into corresponding operation numbers to obtain an operation sequence; set the sliding window size to 5, and slide the operation sequence; for each subsequence in the window, calculate the frequency of occurrence of each operation number to form a frequency vector; superimpose all frequency vectors to obtain an operation vector. For example, the operation sequence of the power user is [1, 2, 3, 2, 4, 5, 2, 3, 4, 2], and the sliding window size is 5. Then, the frequency vector of the first window [1, 2, 3, 2, 4] is [0.2, 0.4, 0.2, 0.2, 0]; the frequency vector of the second window [2, 3, 2, 4, 5] is [0, 0.4, 0.2, 0.2, 0.2]; the frequency vector of the third window [3, 2, 4, 5, 2] is [0, 0.4, 0.2, 0.2, 0 .2]; the frequency vector of the fourth window [2, 4, 5, 2, 3] is [0, 0.4, 0.2, 0.2, 0.2]; the frequency vector of the fifth window [4, 5, 2, 3, 4] is [0, 0.2, 0.2, 0.4, 0.2]; the frequency vector of the sixth window [5, 2, 3, 4, 2] is [0, 0.4, 0.2, 0.2, 0.2]; all frequency vectors are superimposed to obtain the operation vector [0.2, 2.2, 1.2, 1.4, 1.0]. This method takes into account the frequency of the operation and the timing information of the operation, and can more accurately describe the operation behavior pattern of the power user;

[0069] In this embodiment, the steps of constructing a resource vector are as follows: create a resource dictionary and map each resource to a unique resource number, for example: document A: 1, document B: 2, document C: 3, picture D: 4, video E: 5. Convert all resources in the resource access log to corresponding resource numbers to obtain a resource sequence; calculate the number of occurrences of each resource number; create a zero vector that corresponds to the resource number one by one; fill the number of occurrences of each resource number to the corresponding position in the zero vector to obtain a resource vector.

[0070] For example, if the resource access sequence of a power user is [1, 2, 1, 3, 2, 4, 1, 5, 2, 1], then the resource vector is:

[0071] [4, 3, 1, 1, 1]. This method can reflect the preference of electricity users for different resources. The resource with more access times has a larger value in the vector.

[0072] By constructing the personal behavior model of power users through the above three vectors, it can reflect the behavioral characteristics of power users under normal circumstances from the three perspectives of active time, operating habits and resource preferences, and thus provide a basis for the subsequent judgment of power user behavior.

[0073] S2. Perform cluster analysis on the individual behavior models of all power users, divide the individual behavior models of all power users into several categories, and use each category as a community; divide the power users into corresponding communities, and determine the corresponding collective model for each community;

[0074] The step of dividing the individual behavior models of all power users into several categories comprises:

[0075] S21, preset the number of categories k, and randomly select one model from the personal behavior models of all power users as the cluster center;

[0076] S22, for all personal behavior models that are not cluster centers, calculate the model distances between them and the cluster centers, and take the minimum value of the calculated model distances as the target distance of the personal behavior model;

[0077] S23, from all personal behavior models that are not cluster centers, a personal behavior model is selected as a cluster center according to the probability proportional to the target distance of the personal behavior model;

[0078] S24, repeat steps S22 to S23 until k cluster centers are selected;

[0079] S25, calculating the model distance between each individual behavior model and the k cluster centers, and assigning each individual model to the category to which the cluster center with the closest model distance belongs;

[0080] S26. For each category, calculate the average value of all models in the category and use the average value as the new cluster center;

[0081] S27, repeating steps S25 to S26 until the model distance between the new cluster center and the old cluster center is less than a preset center distance threshold, and obtaining the final classification results of k categories.

[0082] The steps of calculating the model distance include:

[0083] The two models for which the model distance needs to be calculated are obtained and recorded as model A and model B respectively;

[0084] Obtain the time vector, operation vector and resource vector of model A;

[0085] Get the time vector, operation vector, and resource vector of model B;

[0086] Calculate the distances of the three corresponding vectors between model A and model B respectively;

[0087] Assign a preset weight to each vector distance, and the sum of these weights equals 1

[0088] The distances of the three vectors are weighted and added together to obtain the final model distance.

[0089] Determining the corresponding collective model for each community includes: determining the cluster center of each classification as the collective model of the corresponding community.

[0090] In this embodiment, the number of categories k is preset, which can be determined by past experience or the elbow coefficient method. First, a random model is selected from the personal behavior models of all electricity users as the cluster center. Then, the model distance between the personal behavior models of all non-cluster centers and this cluster center is calculated, and then the proportionality of the calculated model distance is used as the selection probability, and these personal behavior models are selected one by one as cluster centers. In this way, the farther the personal behavior model is from the original cluster center, the greater the probability of it being a cluster center; repeat the above operation until k cluster centers are selected; this method can select points that are farther away from each other as the initial cluster centers, which can usually bring better clustering effects, and can reduce the number of iterations and thus improve efficiency.

[0091] The model distance between each individual behavior model and k cluster centers is calculated, and each individual model is assigned to the category to which the cluster center with the closest model distance belongs.

[0092] The model distance can be calculated by the weighted sum of the distances between the three corresponding vectors; the distance between corresponding vectors can be measured by the cosine similarity between the vectors;

[0093] Use the preset weights ω1, ω2, and ω3 to balance the importance of these vectors in distance calculation. Specifically, the model distance can be calculated using the following formula:

[0094] Dis = ω1×(1-sim(At,Bt))+ω2×(1-sim(Ao,Bo))+ω3×(1-sim(Ar,Br)), where At is the time vector of model A, Ao is the operation vector of model A, and Ar is the resource vector of model A; Bt is the time vector of model B, Bo is the operation vector of model B, and Br is the resource vector of model B; sim() represents the cosine similarity of the two vectors in the brackets.

[0095] Next, for each category, calculate the average of all models in the category and use the average as the new cluster center. Repeat the steps of assigning and recalculating the cluster center until the model distance between the new cluster center and the old cluster center is less than the preset center distance threshold, and obtain the final classification results of k categories. Finally, the cluster center of each classification is determined as the collective model of the corresponding community. This method only considers the behavioral characteristics of power users and is not restricted by external information such as the department to which the power users belong. It can divide power users more flexibly and accurately, and provides a solid foundation for the subsequent analysis of power user behavior. By adjusting the weight parameters ω1, ω2, and ω3, the importance of different vectors in distance calculation can be balanced according to actual needs, thereby improving the accuracy and practicality of community division.

[0096] S3, collecting real-time behavior data of power users, establishing a behavior model based on the real-time behavior data, and recording it as the current behavior model of the power user;

[0097] S4. judging whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs;

[0098] The step of judging whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs includes:

[0099] The model distance between the current model of the power user and the collective model of the community to which the power user belongs is calculated; if the calculated model distance is greater than the preset safety distance, it is determined that the power user is abnormal; otherwise, it is determined that the power user is not abnormal.

[0100] In this embodiment, the behavior data of the power user is acquired in real time, and the behavior data is used in the same way as when establishing the personal model to establish a current behavior model based on the behavior data acquired in real time; at the same time, a collective model is acquired based on the community to which the power user belongs, and by calculating the model distance between the current model and the collective model, it is determined whether the calculated model distance is greater than a preset safety distance such as 1. If it is greater than 1, the power user's behavior is judged to be abnormal. This method quickly determines whether the power user's behavior is abnormal by comparing it with the collective model of the community, and decides whether to perform subsequent abnormality analysis based on the judgment result, thereby reducing the number of analyses and improving overall efficiency.

[0101] S5. When determining that the power user has abnormal behavior, obtain the power user's personal behavior model, analyze the power user's behavior abnormality level based on the power user's current behavior model and personal behavior model, and issue an abnormal reminder based on the power user's behavior abnormality level.

[0102] The step of analyzing the abnormal behavior level of the power user according to the current behavior model and the personal behavior model of the power user comprises:

[0103] Calculate anomaly index based on current behavior model and personal behavior model of power users;

[0104] Preset behavior abnormality level and corresponding abnormality index range;

[0105] The abnormal index interval in which the calculated abnormal index lies is used as the abnormal behavior level of the power user.

[0106] The calculation step of the abnormal index includes:

[0107] Obtaining a time vector, an operation vector and a resource vector of a current behavior model of an electricity user;

[0108] Obtaining the time vector, operation vector and resource vector of the individual behavior model of the power user;

[0109] Calculate the outliers of the three corresponding vectors between the model's current behavior model and the model's individual behavior model respectively;

[0110] Assign a preset weight to each vector's outliers, and the sum of these weights equals 1

[0111] The outlier values ​​of the three vectors are weighted and added together to obtain the outlier index.

[0112] In this embodiment, when it is determined through step S4 that the current behavior model is abnormal, the current behavior of the power user will be analyzed. The analysis is performed based on the current behavior model and the personal behavior model of the power user, specifically: calculating the abnormality index, determining the abnormality level according to the value of the abnormality index, and sending a reminder according to the abnormality level. The abnormality level and the corresponding abnormality index interval can be set manually, such as the abnormality level can include minor abnormalities, general abnormalities, important abnormalities and severe abnormalities. The corresponding abnormality index interval can be less than 2, greater than or equal to 2 and less than 6, greater than or equal to 6 and less than 12, and greater than or equal to 12. Different abnormality levels can set different reminder methods, and the reminder methods include system notifications, emails, text messages, and phone calls.

[0113] It should be noted that the anomaly index is obtained by weighting the anomaly values ​​of the three dimensions of time vector, operation vector and resource vector. The larger the value, the more serious the anomaly. The specific weight distribution of the three dimensions can be set based on experience and can be adjusted later according to actual conditions such as analysis accuracy.

[0114] In the time dimension, the higher the cosine similarity of two time vectors, that is, the closer it is to 1, the more likely it is that the electricity user is logging in himself, so the smaller the outlier value. The specific calculation formula can be: YCt = 1-sim(Dt, Gt), where YCt represents the outlier value of the time vector, Dt represents the time vector of the previous behavior model, and Gt represents the time vector of the personal behavior model.

[0115] Similarly, the higher the cosine similarity of two operation vectors, the greater the possibility that the operation is performed by the individual, and therefore the smaller the outlier value. The specific calculation formula can be: YCo=1-sim(Do,Go), where YCo represents the outlier value of the operation vector, Do represents the operation vector of the previous behavior model, and Go represents the operation vector of the personal behavior model.

[0116] Between two resource vectors, if the number of visits to a resource in the current behavior model is higher than the number of visits to the resource in the personal behavior model, the possibility of anomaly is higher, so the anomaly value is larger. The specific calculation formula can be: In the formula, YCf represents the abnormal value of the resource vector, n represents the dimension of the resource vector, max() represents the larger value of the two values ​​in the brackets, Dr represents the resource vector of the previous behavior model, Dr i represents the i-th element in Dr, and Gr represents the resource vector Gr of the individual model. i Represents the i-th element in Gr, and α represents the preset adjustment factor. The preset adjustment factor α is used to further adjust the impact of the number of visits. The smaller the adjustment factor α, the greater the impact of the number of visits. It can be set to 1 and adjusted later according to the actual situation.

[0117] Example 2

[0118] See also Figure 2 The present invention provides a power network security abnormal behavior early warning system based on community analysis, which is used to implement a power network security abnormal behavior early warning method based on community analysis, including:

[0119] A personal model building module is used to obtain the historical behavior data of all power users, build a behavior model based on the historical behavior data, and record it as the personal behavior model of the power user;

[0120] The community division module is used to perform cluster analysis on the individual behavior models of all power users, divide the individual behavior models of all power users into several categories, use each category as a community, divide the power users into corresponding communities, and determine the corresponding collective model for each community;

[0121] A real-time model building module is used to collect real-time behavior data of power users, build a behavior model based on the real-time behavior data, and record it as the current behavior model of the power user;

[0122] An abnormality judgment module is used to judge whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs;

[0123] The abnormal analysis and reminder module is used to obtain the personal behavior model of the power user when it is judged that the power user has abnormal behavior, analyze the abnormal behavior level of the power user according to the current behavior model and personal behavior model of the power user, and issue an abnormal reminder according to the abnormal behavior level of the power user.

[0124] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only one, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0125] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

[0126] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for early warning of abnormal behavior of power network security based on community analysis, characterized in that: include: S1. Obtain the historical behavior data of all power users, establish a behavior model based on the historical behavior data, and record it as the personal behavior model of the power user; S2. Perform cluster analysis on the individual behavior models of all power users, divide the individual behavior models of all power users into several categories, and use each category as a community; divide the power users into corresponding communities, and determine the corresponding collective model for each community; S3, collecting real-time behavior data of power users, establishing a behavior model based on the real-time behavior data, and recording it as the current behavior model of the power user; S4. judging whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs; S5. When determining that the power user has abnormal behavior, obtain the power user's personal behavior model, analyze the power user's behavior abnormality level based on the power user's current behavior model and personal behavior model, and issue an abnormal reminder based on the power user's behavior abnormality level.

2. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 1 is characterized in that: The behavior data includes login logs, operation behavior logs and resource access logs; The steps of establishing the behavior model include: constructing a time vector according to a login log; constructing an operation vector according to an operation behavior log; constructing a resource vector according to a resource access log; and combining the time vector, the operation sequence and the resource vector to obtain a behavior model.

3. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 2 is characterized in that: The step of constructing the time vector includes: presetting the number of time periods m in a day; evenly dividing 24 hours in a day into m time periods; creating an m-dimensional initial time vector, each dimension of the initial time vector corresponds to a time period; initializing the values ​​of all dimensions of the initial time vector to 0; obtaining a login log, extracting all login time points from the login log; for each extracted login time point, determining the time period to which the time point belongs; setting the value of the dimension of the initial time vector corresponding to the time period to 1; and using the initial time vector after the dimension values ​​are set as the time vector; The step of constructing the operation vector includes: creating an operation dictionary, mapping each operation behavior to a unique operation number, obtaining an operation log, and converting all operations in the operation log into corresponding operation numbers in chronological order to obtain an operation sequence, presetting a sliding window to slide the operation sequence, extracting a subsequence of the operation sequence in each window, and for each subsequence, calculating the frequency of occurrence of each operation number therein to form a frequency vector, and superimposing all frequency vectors to obtain the operation vector; The steps of constructing a resource vector include: creating a resource dictionary, mapping each resource to a unique resource number, obtaining a resource access log, converting all resources in the access log into corresponding resource numbers to obtain a resource sequence, calculating the number of times each resource number appears, creating a zero vector corresponding to the resource number one by one, filling the number of times each resource number appears to the corresponding position in the zero vector, and using the filled zero vector as the resource vector.

4. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 3 is characterized in that: The step of dividing the individual behavior models of all power users into several categories comprises: S21, preset the number of categories k, and randomly select one model from the personal behavior models of all power users as the cluster center; S22, for all personal behavior models that are not cluster centers, calculate the model distances between them and the cluster centers, and take the minimum value of the calculated model distances as the target distance of the personal behavior model; S23, from all personal behavior models that are not cluster centers, a personal behavior model is selected as a cluster center according to the probability proportional to the target distance of the personal behavior model; S24, repeat steps S22 to S23 until k cluster centers are selected; S25, calculating the model distance between each individual behavior model and the k cluster centers, and assigning each individual model to the category to which the cluster center with the closest model distance belongs; S26. For each category, calculate the average value of all models in the category and use the average value as the new cluster center; S27, repeating steps S25 to S26 until the model distance between the new cluster center and the old cluster center is less than a preset center distance threshold, and obtaining the final classification results of k categories.

5. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 4 is characterized in that: The steps of calculating the model distance include: The two models for which the model distance needs to be calculated are obtained and recorded as model A and model B respectively; Obtain the time vector, operation vector and resource vector of model A; Get the time vector, operation vector, and resource vector of model B; Calculate the distances of the three corresponding vectors between model A and model B respectively; Assign a preset weight to each vector distance, and the sum of these weights equals 1 The distances of the three vectors are weighted and added together to obtain the final model distance.

6. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 5 is characterized in that: Determining the corresponding collective model for each community includes: determining the cluster center of each classification as the collective model of the corresponding community.

7. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 6 is characterized in that: The step of judging whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs includes: The model distance between the current model of the power user and the collective model of the community to which the power user belongs is calculated; if the calculated model distance is greater than the preset safety distance, it is determined that the power user is abnormal; otherwise, it is determined that the power user is not abnormal.

8. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 7 is characterized in that: The step of analyzing the abnormal behavior level of the power user according to the current behavior model and the personal behavior model of the power user comprises: Calculate an abnormality index based on the current behavior model and personal behavior model of the power user; Preset behavior abnormality level and corresponding abnormality index range; The abnormal index interval in which the calculated abnormal index lies is used as the abnormal behavior level of the power user.

9. The method for early warning of abnormal behavior of power network security based on community analysis according to claim 8 is characterized in that: The calculation step of the abnormality index includes: Obtaining a time vector, an operation vector and a resource vector of a current behavior model of an electricity user; Obtaining the time vector, operation vector and resource vector of the individual behavior model of the power user; Calculate the outliers of the three corresponding vectors between the model's current behavior model and the model's individual behavior model respectively; Assign a preset weight to each vector's outliers, and the sum of these weights equals 1 The outlier values ​​of the three vectors are weighted and added together to obtain the outlier index.

10. A power network security abnormal behavior early warning system based on community analysis, used to implement the power network security abnormal behavior early warning method based on community analysis as claimed in any one of claims 1 to 9, characterized in that: include: A personal model building module is used to obtain the historical behavior data of all power users, build a behavior model based on the historical behavior data, and record it as the personal behavior model of the power user; The community division module is used to perform cluster analysis on the individual behavior models of all power users, divide the individual behavior models of all power users into several categories, use each category as a community, divide the power users into corresponding communities, and determine the corresponding collective model for each community; A real-time model building module is used to collect real-time behavior data of power users, build a behavior model based on the real-time behavior data, and record it as the current behavior model of the power user; An abnormality judgment module is used to judge whether the power user has abnormal behavior based on the current model of the power user and the collective model of the community to which the power user belongs; The abnormal analysis and reminder module is used to obtain the personal behavior model of the power user when it is judged that the power user has abnormal behavior, analyze the abnormal behavior level of the power user according to the current behavior model and personal behavior model of the power user, and issue an abnormal reminder according to the abnormal behavior level of the power user.

Images