Power monitoring system network security alarm intelligent traceability method based on knowledge graph and graph convolutional network

Abstract

The invention discloses a power monitoring system network security alarm intelligent traceability method based on a knowledge graph and a graph convolutional network, and the method comprises the following steps: 1) constructing a network security knowledge graph representing alarm entities and relationships based on historical data of a network security alarm record text; 2) based on the network security knowledge graph, obtaining a vectorized expression of a current network security alarm record text, and performing format conversion to generate input data; 3) constructing a graph convolutional neural network, and training the graph convolutional neural network to obtain a network security alarm intelligent traceability model of the power monitoring system; and 4) inputting the input data into the network security alarm intelligent traceability model of the power monitoring system to generate network security alarm traceability information. According to the invention, intelligentization of power system network security traceability early warning is realized, and rapid and accurate intelligent traceability is carried out on massive alarm information.

Description

Technical Field

[0001] The present invention relates to the field of power systems and automation thereof, and specifically to an intelligent tracing method for network security alarms of power monitoring systems based on a knowledge graph and a graph convolutional network. Background Art

[0002] The safe operation of the power system is the foundation and lifeline of the national economic development, and the network security of the power monitoring system is the escort ship of the safe and stable operation of the power system. The traditional network security system mainly traces the source of alarm information based on expert experience and judgment. The alarm information collected by the monitoring center is traced by the staff and then the cause of the alarm is given. Disposal measures. Once a large number of alarm information flows in a short period of time, the method of manual judgment cannot achieve rapid tracing, which may lead to accidents. Therefore, there is an urgent need to study a network security alarm tracing method that does not rely on manual experience and can quickly process massive alarm information.

[0003] Artificial intelligence technology is a hot research topic in new power systems. Its efficient processing speed and independence from human assistance provide new ideas for solving network security problems. In recent years, the scale of power grids has become increasingly large. The use of new power monitoring devices and the large-scale access to intermittent clean energy have made the models constructed by traditional methods increasingly complex and unable to meet the current power grid's needs for alarm tracing. Machine learning and deep learning are artificial intelligence technologies that can efficiently process big data. Algorithms such as support vector machines, convolutional neural networks, and long short-term memory networks have been applied to event classification and tracing tasks. Although the above machine learning and deep learning methods have improved the intelligence of network security, textual and vectorized languages ​​cannot accurately and concisely represent the entities and relationships in the alarm causes, resulting in low efficiency in mining and utilizing alarm information.

[0004] In response to the above problems, scholars have introduced knowledge graphs into related research. Knowledge graphs are graph-based data organization structures with more accurate knowledge representation capabilities. They can accurately represent massive alarm entities and concisely represent the relationships between entities. Some scholars have proposed a knowledge graph construction framework for power grid dispatching fault handling services, which provides a solution for auxiliary decision-making in fault scenarios. However, the neural network with vector input cannot pay attention to the knowledge system implied by the "graph" structure of graph data, causing the artificial intelligence entity to ignore some effective information.

[0005] In summary, the existing network security traceability methods have the problems of high manual dependence, inability to quickly process massive alarm information, and low efficiency in mining and utilizing alarm information. Therefore, it is necessary to fully consider the intelligence and efficiency of alarm traceability and study the intelligent traceability method of network security alarms in power monitoring systems based on knowledge graphs and graph convolutional networks. Summary of the invention

[0006] The purpose of the present invention is to provide a method for intelligent tracing of network security alarms of a power monitoring system based on a knowledge graph and a graph convolutional network, comprising the following steps:

[0007] 1) Based on the historical text data of cybersecurity alarm records, a cybersecurity knowledge graph is constructed to represent massive alarm entities and relationships;

[0008] 2) Based on the network security knowledge graph, obtain the vectorized expression of the current network security alarm record text, convert the format, and generate input data;

[0009] 3) Construct a graph convolutional neural network and train it to obtain an intelligent tracing model for network security alarms in the power monitoring system;

[0010] 4) Input the input data into the intelligent tracing model of network security alarm of the power monitoring system to generate network security alarm tracing information.

[0011] Furthermore, the steps of constructing a network security knowledge graph representing alarm entities and relationships include:

[0012] 1.1) Knowledge extraction: Extract words representing entities and relationships in network security alarm records based on semantic matching technology to generate triples of alarm text;

[0013] 2.1) Graph generation: Generate a network security knowledge graph representing alarm entities and relationships based on multiple text triples;

[0014] 3.1) Knowledge representation: The words representing entities and relations are vectorized to obtain triples (h, r, t) representing entities and relations; where h is the head entity vector, r is the relation vector, and t is the tail entity vector; the relation vector r is the transformation of the head entity h and the tail entity t projected on a certain hyperplane.

[0015] Furthermore, the steps of knowledge extraction include:

[0016] 1.1.1) Jieba word segmentation database is used to segment the alarm information; the dictionary model is used to match and segment common words, and the probability model is used to segment industry-specific words; common word types include but are not limited to discovery, strategy and access, and industry-specific word types include but are not limited to address and port;

[0017] 1.1.2) Match the segmented alarm information according to the semantic characteristics of each type of alarm entity, and define the relationship between each type of entity. According to the entity extracted from each alarm information and the relationship between the defined entities, form a network security alarm text triple in the form of (head entity, relationship, tail entity).

[0018] Furthermore, the words representing entities and relations are vectorized through the TransH model.

[0019] Furthermore, when training the TransH model, the head entity vector h and the tail entity vector t are projected onto the hyperplane W r The projection vectors of the head entity vector h and the tail entity vector t are obtained, which are denoted as h ⊥ and t ⊥ , and the projection vector h ⊥ ,t ⊥ 、r ⊥ As training data; ⊥ is the relationship vector in the hyperplane W r The projection vector on ;

[0020] Among them, the projection vector h ⊥ ,t ⊥ 、r ⊥ Satisfy the following formula:

[0021] h ⊥ +r ⊥ ≈t ⊥ (1).

[0022] Furthermore, when performing format conversion, the alarm cause is converted into a one-hot vector using one-hot encoding technology.

[0023] Furthermore, the input data includes A and H (0) ; A∈n×n is the original adjacency matrix; the element A in the adjacency matrix A ij =1 means there is an edge connecting node i and node j, otherwise it is 0; H (0) ∈n×m includes the feature vectors of each node.

[0024] Furthermore, during the training of the graph convolutional neural network, the weight matrix is ​​adjusted through the back-propagation method;

[0025] Among them, the propagation method between the lth layer and the l+1th layer of the graph convolutional neural network is as follows:

[0026]

[0027] Where: A is the adjacency matrix of the graph; σ is the activation function; W (l) is the weight matrix to be trained; H (l+1) , H (l) It is the output of the l+1th layer and the lth layer of the graph convolutional neural network.

[0028] Furthermore, the graph convolutional neural network refers to an attention mechanism;

[0029] The attention mechanism Attention(Q,S) is expressed as follows:

[0030] Attention(Q,S)=∑<Q,S>.S(3)

[0031] Where: S represents the information source that needs to be processed, that is, the feature vectors of all neighbor nodes; Q is the feature vector of the current central node;

[0032] The attention coefficients between nodes of the graph convolutional neural network are as follows:

[0033]

[0034] Where: a ic is the attention coefficient between node i and node c; x i is the initial attribute information vector of node i; W∈R n '×n is to map the node feature vector from n-dimension to n'-dimension; D(i) is the set of neighbor nodes of node i; || represents the concatenation operation. c 、x d is the initial attribute information vector of nodes c and d; node d is the neighbor node of node i; LeakyReLU is the activation function.

[0035] Furthermore, the intelligent tracing model for network security alarms in the power monitoring system includes multiple basic classifiers;

[0036] When generating network security alarm tracing information, the output of these basic classifiers is processed using a weighted voting method to obtain the final network security alarm tracing information.

[0037] The technical effect of the present invention is unquestionable. Based on actual alarm data and combined with the problems existing in the current power system network security early warning, the present invention has designed an artificial intelligence model based on knowledge graph and deep learning algorithm to realize the intelligent tracing and early warning of power system network security, and to quickly and accurately trace the massive alarm information intelligently. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 Construct a flow chart for the knowledge graph based on knowledge extraction and knowledge representation;

[0039] Figure 2 Illustration of TransE and TransH models;

[0040] Figure 3 A full picture of the knowledge graph built based on actual data;

[0041] Figure 4 This is a graph convolutional neural network workflow diagram;

[0042] Figure 5 Workflow diagram for oversampling and ensemble learning;

[0043] Figure 6 is the training set data distribution;

[0044] Figure 7 is the test set data distribution;

[0045] Figure 8 This is an example of a ROC curve;

[0046] Fig. 9 Verify the effect of knowledge graph;

[0047] Fig.10 Verify the effect of graph attention network;

[0048] Fig.11 Comparison of ROC results. DETAILED DESCRIPTION

[0049] The present invention is further described below in conjunction with the embodiments, but it should not be understood that the above subject matter of the present invention is limited to the following embodiments. Without departing from the above technical ideas of the present invention, various substitutions and changes are made according to the common technical knowledge and customary means in the art, which should all be included in the protection scope of the present invention.

[0050] Embodiment 1:

[0051] See also Figures 1 to 11 , an intelligent tracing method for network security alarm of power monitoring system based on knowledge graph and graph convolutional network, comprising the following steps:

[0052] 1) Based on the historical text data of network security alarm records, a network security knowledge graph is constructed to represent alarm entities and relationships;

[0053] 2) Based on the network security knowledge graph, obtain the vectorized expression of the current network security alarm record text, convert the format, and generate input data;

[0054] 3) Construct a graph convolutional neural network and train it to obtain an intelligent tracing model for network security alarms in the power monitoring system;

[0055] 4) Input the input data into the intelligent tracing model of network security alarm of the power monitoring system to generate network security alarm tracing information.

[0056] The steps to construct a cybersecurity knowledge graph that represents alert entities and relationships include:

[0057] 1.1) Knowledge extraction: Extract words representing entities and relationships in network security alarm records based on semantic matching technology to generate triples of alarm text;

[0058] 1.2) Graph generation: Generate a network security knowledge graph representing alarm entities and relationships based on multiple text triples;

[0059] 1.3) Knowledge representation: Vectorize the words representing entities and relationships to obtain triples (h, r, t) representing entities and relationships; where h is the head entity vector, r is the relationship vector, and t is the tail entity vector; the relationship vector r is the transformation of the head entity h and the tail entity t projected on a certain hyperplane.

[0060] The steps of knowledge extraction include:

[0061] 1.1.1) Jieba word segmentation database is used to segment the alarm information; the dictionary model is used to match and segment common words, and the probability model is used to segment industry-specific words; common word types include but are not limited to discovery, strategy and access, and industry-specific word types include but are not limited to address and port;

[0062] 1.1.2) Match the segmented alarm information according to the semantic characteristics of each type of alarm entity, and define the relationship between each type of entity. According to the entity extracted from each alarm information and the relationship between the defined entities, form a network security alarm text triple in the form of (head entity, relationship, tail entity).

[0063] The TransH model is used to vectorize the words representing entities and relationships.

[0064] When training the TransH model, the head entity vector h and the tail entity vector t are projected onto the hyperplane W r The projection vectors of the head entity vector h and the tail entity vector t are obtained, which are denoted as h ⊥ and t ⊥ , and the projection vector h ⊥ ,t ⊥ 、r ⊥ As training data; ⊥ is the relationship vector in the hyperplane W r The projection vector on ;

[0065] Among them, the projection vector h ⊥ ,t ⊥ 、r ⊥ Satisfy the following formula:

[0066] h ⊥ +r ⊥ ≈t ⊥ (1).

[0067] When performing format conversion, the alarm cause is converted into a one-hot vector using the one-hot encoding technology.

[0068] The input data includes A and H (0) ; A∈n×n is the original adjacency matrix; the element A in the adjacency matrix A ij =1 means there is an edge connecting node i and node j, otherwise it is 0; H (0) ∈n×m includes the feature vectors of each node.

[0069] During the training of graph convolutional neural networks, the weight matrix is ​​adjusted through the back-propagation method;

[0070] Among them, the propagation method between the lth layer and the l+1th layer of the graph convolutional neural network is as follows:

[0071]

[0072] Where: A is the adjacency matrix of the graph; σ is the activation function; W is the weight matrix to be trained.

[0073] The graph convolutional neural network uses an attention mechanism;

[0074] The attention mechanism Attention(Q,S) is expressed as follows:

[0075] Attention(Q,S)=∑<Q,S>.S(3)

[0076] Where: S represents the information source that needs to be processed, that is, the feature vectors of all neighbor nodes; Q is the feature vector of the current central node;

[0077] The attention coefficients between nodes of the graph convolutional neural network are as follows:

[0078]

[0079] Where: a ic is the attention coefficient between node i and node c; x i is the initial attribute information vector of node i; W∈R n '×n is to map the node feature vector from n-dimension to n'-dimension; D(i) is the set of neighbor nodes of node i; || represents the concatenation operation. c 、x d is the initial attribute information vector of nodes c and d; node d is the neighbor node of node i; LeakyReLU is the activation function.

[0080] The intelligent tracing model for network security alarms in power monitoring systems includes multiple basic classifiers;

[0081] When generating network security alarm tracing information, the output of these basic classifiers is processed using a weighted voting method to obtain the final network security alarm tracing information.

[0082] Embodiment 2:

[0083] A method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, comprising the following steps:

[0084] 1) Based on the historical text data of network security alarm records, a network security knowledge graph is constructed to represent alarm entities and relationships;

[0085] 2) Based on the network security knowledge graph, obtain the vectorized expression of the current network security alarm record text, convert the format, and generate input data;

[0086] 3) Construct a graph convolutional neural network and train it to obtain an intelligent tracing model for network security alarms in the power monitoring system;

[0087] 4) Input the input data into the intelligent tracing model of network security alarm of the power monitoring system to generate network security alarm tracing information.

[0088] Embodiment 3:

[0089] A method for intelligent tracing of network security alarms of a power monitoring system based on a knowledge graph and a graph convolutional network, the technical content of which is the same as that of Example 2. Further, the steps of constructing a network security knowledge graph representing alarm entities and relationships include:

[0090] 1) Knowledge extraction: Based on semantic matching technology, words representing entities and relationships in network security alarm records are extracted to generate triples of alarm text;

[0091] 2) Graph generation: Generate a network security knowledge graph that represents alarm entities and relationships based on multiple text triples;

[0092] 3) Knowledge representation: Vectorize the words representing entities and relationships to obtain triples (h, r, t) representing entities and relationships; where h is the head entity vector, r is the relationship vector, and t is the tail entity vector; the relationship vector r is the transformation of the head entity h and the tail entity t projected on a certain hyperplane.

[0093] Embodiment 4:

[0094] A method for intelligent tracing of network security alarms in a power monitoring system based on a knowledge graph and a graph convolutional network, the technical content of which is the same as any one of Embodiments 2-3, and further, the step of knowledge extraction includes:

[0095] 1) Propose a network security alarm information word segmentation technology based on Jieba word segmentation library: Jieba word segmentation library is used to segment alarm information, and dictionary models are used to match and segment common words such as discovery, strategy and access. Probabilistic models are used to segment industry-specific words such as addresses and ports.

[0096] 2) A network security warning text triple method based on semantic matching technology is proposed: the warning information after word segmentation is matched according to the semantic characteristics of various warning entities, and the relationship between various entities is defined. According to the entity extracted from each warning information and the relationship between the defined entities, the network security warning text triple is formed in the form of (head entity, relationship, tail entity);

[0097] Embodiment 5:

[0098] A method for intelligent tracing of network security alarms in an electric power monitoring system based on a knowledge graph and a graph convolutional network. The technical content is the same as any one of Examples 2-4. Furthermore, the vocabulary representing entities and relationships is vectorized through a TransH model.

[0099] Embodiment 6:

[0100] A method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, the technical content of which is the same as any one of embodiments 2-5. Further, when the TransH model is trained, the head entity vector h and the tail entity vector t are projected onto the hyperplane W r The projection vectors of the head entity vector h and the tail entity vector t are obtained, which are denoted as h ⊥ and t ⊥ , and the projection vector h ⊥ ,t ⊥ 、r ⊥ As training data; ⊥ is the relationship vector in the hyperplane W r The projection vector on ;

[0101] Among them, the projection vector h ⊥ ,t ⊥ 、r ⊥ Satisfy the following formula:

[0102] h ⊥ +r ⊥ ≈t ⊥ (1).

[0103] Embodiment 7:

[0104] A method for intelligent tracing of network security alarms in an electric power monitoring system based on a knowledge graph and a graph convolutional network. The technical content is the same as any one of Examples 2-6. Furthermore, when performing format conversion, the alarm cause is converted into a One-hot vector using a one-hot encoding technique.

[0105] Embodiment 8:

[0106] A method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, the technical content of which is the same as any one of embodiments 2-7, and further, the input data includes A and H (0) ; A∈n×n is the original adjacency matrix; the element A in the adjacency matrix A ij =1 means there is an edge connecting node i and node j, otherwise it is 0; H (0) ∈n×m includes the feature vectors of each node.

[0107] Embodiment 9:

[0108] A method for intelligent tracing of network security alarms of a power monitoring system based on a knowledge graph and a graph convolutional network, the technical content of which is the same as any one of embodiments 2-8, and further, during the training of the graph convolutional neural network, the weight matrix is ​​adjusted by a back propagation method;

[0109] Among them, the propagation method between the lth layer and the l+1th layer of the graph convolutional neural network is as follows:

[0110]

[0111] Where: A is the adjacency matrix of the graph; σ is the activation function; W (l) is the weight matrix to be trained; H (l+1) , H (l) It is the output of the l+1th layer and the lth layer of the graph convolutional neural network.

[0112] Embodiment 10:

[0113] A method for intelligent tracing of network security alarms of a power monitoring system based on a knowledge graph and a graph convolutional network, the technical content of which is the same as any one of Embodiments 2-9, and further, the graph convolutional neural network refers to an attention mechanism;

[0114] The attention mechanism is expressed as follows:

[0115] Attention(Q,S)=∑<Q,S>.S(3)

[0116] Where: S represents the information source that needs to be processed, that is, the feature vectors of all neighbor nodes; Q is the feature vector of the current central node;

[0117] The attention coefficients between nodes of the graph convolutional neural network are as follows:

[0118]

[0119] Where: aic is the attention coefficient between node i and node c; x i is the initial attribute information vector of node i; W∈R n '×n To map the node feature vector from n dimension to n' dimension; D(i) is the set of neighbor nodes of node i; || represents the concatenation operation.

[0120] Embodiment 11:

[0121] A method for intelligent tracing of network security alarms of a power monitoring system based on a knowledge graph and a graph convolutional network, the technical content of which is the same as any one of Embodiments 2-10, and further, the intelligent tracing model of network security alarms of a power monitoring system includes multiple basic classifiers;

[0122] When generating network security alarm tracing information, the output of these basic classifiers is processed using a weighted voting method to obtain the final network security alarm tracing information.

[0123] Embodiment 12:

[0124] An intelligent tracing method for network security alarms in power monitoring systems based on knowledge graphs and graph convolutional networks. First, in order to solve the problem that massive alarm entities and relationships cannot be accurately and concisely represented by textual and vectorized languages, a knowledge graph construction and knowledge representation technology that simplifies the representation of massive network security alarm entities and relationships is proposed to achieve a simplistic representation of entities in massive alarm information. Secondly, in order to solve the problem that deep learning methods such as convolutional neural networks with vectors as input cannot fully utilize the graph data in the network security knowledge graph, an efficient and accurate intelligent tracing method for network security alarms based on graph convolutional networks and attention mechanisms is further proposed. The graph convolutional network is used to fully utilize the graph data, and the attention mechanism is used to strengthen the utilization of entities related to alarm information in the network security knowledge graph subgraph. Finally, in order to solve the problem that the probability of alarm causes such as equipment operation and regional alarms is too low, resulting in sample imbalance, which leads to the strong bias of the graph attention network towards high-proportion network security alarms, a network security alarm tracing sample imbalance processing technology based on oversampling and bagging ensemble learning is proposed to solve the problem of low traceability accuracy caused by imbalanced alarm causes. The data provided by an actual power grid company shows that the proposed method can quickly and accurately trace the source of massive alarm information, verifying the effectiveness and practical potential of the proposed method. The specific steps are as follows:

[0125] (1) Simplify the knowledge graph construction and knowledge representation technology that represents massive cybersecurity alert entities and relationships

[0126] The construction of the cybersecurity knowledge graph consists of two steps: knowledge extraction and graph construction and knowledge representation. The specific steps are as follows.

[0127] 1) A network security alarm information segmentation technology based on Jieba word segmentation is proposed. Each network security alarm sample consists of information such as "alarm description", "alarm site", "alarm device" and "alarm reason". Among them, "alarm description" contains the IP and port where the alarm occurs, in a format similar to "access that does not comply with the security policy is found, port a of the local address 10.70.xxx.xxx, access port b of the remote address 10.70.xxx.xx"; "alarm site" contains the site and voltage level where the alarm occurs, in a format similar to "110KVxx substation"; "alarm reason" is the cause of the alarm given by the staff after analysis, that is, the label for the training of the network security alarm traceability model. Therefore, Jieba word segmentation is performed on alarm information such as "alarm description", "alarm site" and "alarm device". Network security alarm information consists of common words and power industry-specific words. First, Jieba word segmentation database uses a dictionary model to match and segment common words such as discovery, strategy, and access in network security alarm information; further, a probability model is used to segment the remaining industry-specific words such as address, port, and substation in network security alarm information. In summary, Jieba word segmentation can split network security alarm statements into word forms. For example, the above "alarm description" word segmentation result is: "discovery / non-compliant / security / policy / of / access, local / address / 10.70.xxx.xxx / of / a / port, access / remote / address / 10.70.xxx.xx / of / b / port"; "alarm site" word segmentation result is: "110 / KV / xx / substation", which provides input for subsequent entity and relationship extraction.

[0128] 2) A network security alarm text triple method based on semantic matching technology is proposed. In the network security alarm information, there are alarm entities such as site, equipment, IP, port and site voltage level. The site and voltage level are recorded in the "alarm site"; IP and port are recorded in the "alarm details". First, the word-form alarm information obtained in 1) is matched according to the semantic characteristics of the alarm entity. The semantic matching technology scans the input word-form alarm information one by one and matches according to the semantic characteristics of the alarm entity. For example, the alarm information mentioned in 1), "110KV" is an entity of voltage level type, "xx substation" is an entity of site type, and "10.70.xxx.xxx" is an entity of IP type. Further, the relationship between network security alarm entity types is defined. There is a "belong to" or "own" relationship between every two types of alarm entities, such as the site "belongs to" the voltage level, the site "owns" the equipment and the IP "owns" the port. Finally, according to the entities extracted from each alarm information and the relationship between the defined entities, the network security alarm text triples are formed in the form of (head entity, relationship, tail entity). Since there are only two types of relationships in the network security alarm text triples, namely "own" and "belong to", but there are many massive entities such as sites, equipment and IP, there are the following three types of alarm text triples: ① one-to-one: (substation A, belongs to, 110KV), (power plant B, belongs to, 220KV); ② one-to-many: (10.70.xxx.xx, owns, port a), (10.70.xxx.xx, owns, port c); ③ many-to-one: (wind farm C, belongs to, 220KV), (photovoltaic power station D, belongs to, 220KV). Through entity and relationship extraction, the network security alarm information in the form of words is converted into network security alarm text triples, which provides input for the subsequent network security alarm knowledge graph construction.

[0129] After knowledge extraction, each alarm detail can be inferred to have multiple corresponding triples. Taking an alarm message in the sample as an example, the results are shown in Table 1:

[0130] Table 1 Example of alarm extraction results

[0131]

[0132]

[0133] The task of knowledge representation is to present the semantic relationships in the cybersecurity knowledge graph, and the textual information such as entities and relationships in digital form to the computer for understanding. The knowledge graph uses triples to store instances, namely (h, r, t). Among them, h is the head entity, r is the relationship, and t is the tail entity. The Trans E model represents the relationship and the entity as vectors in the same space. Given the fact (h, r, t), the vector r representing the relationship is interpreted as the translation between the head entity vector h and the tail entity vector t, that is, it satisfies:

[0134] h+r≈t(1)

[0135] However, since the model can only efficiently represent a one-entity-to-one-entity relationship pattern, for network security systems, the same entity may be represented by multiple entity relationships, and a large number of entities ultimately form an intricate network. The Trans E model based on a two-dimensional plane cannot handle one-to-many and many-to-many relationships well. In order to solve the complex relationship problem that the Trans E model cannot handle, the present invention introduces a knowledge graph embedding method Trans H based on hyperplane translation. Trans H regards the relationship r as the transformation of the projection of the head entity h and the tail entity t on a certain hyperplane. Trans H regards the vectors on the hyperplane as the vector representation of the relationship, rather than placing the relationship vector and the entity vector in the same vector space as Trans E. The head vector (h) and the tail vector (t) are projected on the hyperplane W r On the top, we get the projection vectors of h and t, which are h ⊥ and t ⊥ During training, h, r, and t follow the following equation:

[0136] h ⊥ +d ⊥ ≈t ⊥ (2)

[0137] Trans H does not use the original h and t vectors during training, but uses W r h and t are projected. For different relationships, h and t can have different performances, avoiding the two entities being too close during the training process. Therefore, the Trans H model can be used to convert the alarm information of the power monitoring system from text information that cannot be directly understood by computers into digital vector information, providing data information for subsequent tracing tasks.

[0138] Since the entities and relations in the alarm information have been extracted in the process of building the knowledge graph of the power situation awareness system, the entities, relations and attributes in the triples of the alarm information can be directly vectorized using knowledge representation technology. The results are shown in Table 2:

[0139] Table 2 Knowledge graph representation learning results

[0140] Entity Name Vector form 500KV XX substation [0.223,……,0.352] XX Center [0.536,……,0.831]

[0141] After extracting entity relationships based on semantic matching technology and learning knowledge graph representation based on Trans H, we obtained all the information needed to build a knowledge graph for power system network security based on 70,110 alarm information provided by a real power grid company. We used the Py2neo module to build a knowledge graph for power system network security on the Neo4j database, with alarm IP, alarm site, alarm device, alarm port, and alarm site voltage level as entity information. The relationship between each entity is represented by a vector arrow, and the relationship is described on the vector arrow to form a graph like Figure 3 The network security knowledge graph shown contains 12,000 nodes and 23,000 relationships. When a new alarm message is input, the network security knowledge graph will match the entities in it. When a matching entity is retrieved, it will take the entity as the starting point and search for adjacent nodes along the existing relationship. Finally, the adjacent nodes and the starting node together form a new graph data. Each node and relationship has a unique vector corresponding to it, realizing the accurate representation of the characteristics of network security alarm data.

[0142] (2) Intelligent tracing method based on graph convolutional neural network

[0143] The intelligent traceability method consists of two parts: input-output construction and intelligent reasoning.

[0144] For graph convolutional neural networks, it is not possible to directly use graph data or text information as input for traceability reasoning, and it is necessary to construct an input format that conforms to the graph convolutional neural network. In the process of building the knowledge graph of the power monitoring system, the representation learning technology based on Trans H has been used to vectorize graph data and text data, so it is necessary to construct the vectorized data into an input format that conforms to the graph convolutional neural network.

[0145] The input of the graph convolutional neural network consists of A and H (0) Composition, A is the original adjacency matrix A ij =1 means there is an edge connecting node i and node j, otherwise it is 0. (0) It is composed of the eigenvectors of each node. Since each node and relationship has a unique eigenvector, A is an n×n matrix, and H (0) is an n×m matrix, where m is the dimension of the feature vector. For the graph convolutional neural network model, the weight matrix W is initially a random matrix. During the network training process, the parameters are adjusted by back propagation. The output H of the lth layer (l)It will be used as the input matrix of the l+1 layer. Since the graph convolutional neural network is a supervised deep learning, it is also important to construct the output content reasonably to improve the training efficiency. Traversing the data provided by an actual power grid company, the alarm causes can be divided into the following five categories: daily operation of equipment, alarms in four and five zones, user access attempts, redundant services and others. These five types of alarm causes are encoded using unique hot coding.

[0146] Graph convolutional networks are an extension of traditional convolutional networks in non-Euclidean space. They can not only use multiple graph convolutional layers to automatically extract the features of input variables, but also take into account the topological structure between each node, making them very suitable for processing complex graph data. Compared with traditional machine learning, graph convolutional neural networks can not only use the local feature information of samples, but also learn structural information that represents local correlations. Each update of node features is the result of the joint action of multiple structural adjacent nodes. The propagation method between GCN layers is shown in formula (3).

[0147]

[0148] Where: A is the adjacency matrix of the graph; σ is the activation function; W is the weight matrix to be trained

[0149] However, the weights assigned to different neighbor nodes in the same-order neighborhood by the graph convolution network are indiscriminate, and the combination of neighbor node features and graph structure is closely related, which limits the generalization ability of the trained model on other graph structures. It is not easy for a single GCN to assign different learning weights to different neighboring nodes. Since there is a lot of redundant information in the warning information, in order to focus on the effective information during the convolution process, an attention mechanism is added to the GCN to form a graph attention network (GAT).

[0150] The attention mechanism assigns different weights to different focus parts in the model and extracts more important and critical information from them, thereby optimizing the model and making more accurate judgments. GAT considers the geometric relationship between the target node and other nodes in space, and can adaptively aggregate neighbor nodes and assign different weight coefficients to them, thereby better integrating the relevance of distribution network node features into the alarm tracing model. The attention mechanism can be shown as (4).

[0151] Attention(Q,S)=∑<Q,S>.S(4)

[0152] Where: S represents the information source that needs to be processed, that is, the feature vectors of all neighbor nodes; Q is some prior information, that is, the feature vector of the current central node.

[0153] The main steps of the GAT algorithm are usually node feature conversion, node-to-node attention coefficient calculation, and information aggregation. First, it is necessary to perform node feature conversion and calculate node-to-node attention coefficients. Take node i and its neighbor node c as an example:

[0154]

[0155] Where: a ic is the attention coefficient between node i and node c; x i is the initial attribute information vector of node i; W∈R n '×n is to map the node feature vector from n-dimension to n'-dimension; D(i) is the set of neighbor nodes of node i; || represents the concatenation operation;

[0156] The specific implementation process of intelligent traceability is described as follows.

[0157] Step 1: Extract entities and relationships from the original alarm information to generate power system network security triples.

[0158] Step 2: Use the Neo4j graph database to generate the power system network security triples into a power system network security knowledge graph, use the knowledge graph to complete knowledge expansion and knowledge generation, learn the entity relationship based on the Trans H model, and vectorize complex text information.

[0159] Step 3: Based on the input features of the graph convolutional neural network, construct the association matrix A and the feature matrix X, and use the one-hot encoding technology to convert the alarm cause into a one-hot vector.

[0160] Step 4: Build a GCN network, which consists of a GCN layer and an attention mechanism. Determine hyperparameters such as network depth n and hidden layer size, and set related parameters such as solver, learning rate, and number of iterations.

[0161] Step 5: Use the training set to train the GCN network, and the validation set to assist network training until convergence and stability.

[0162] Step 6: Use the trained GCN network to test the samples in the test set and output the traceability results.

[0163] (3) Multi-agent integrated traceability method based on ensemble learning

[0164] Since the proportion of various alarm causes in the alarm information of the power monitoring system varies greatly, there is a sample imbalance problem in the data, which leads to problems such as insufficient potential learning in the network training process and poor classification performance. Therefore, the ensemble learning method is used to improve the model, and the single GCN network is integrated into multiple basic classifiers. The weighted voting method is used to output the traceability results.

[0165] Considering that the frequency of occurrence of alarm causes in actual power system alarm information varies greatly, unbalanced sample labels pose great difficulties to the learning of artificial intelligence, resulting in large prediction deviations of the obtained artificial intelligence in some cases. An alarm tracing method based on ensemble learning is proposed to deal with the problem of unbalanced alarm information labels. The specific process is shown in the following four modules:

[0166] Module 1: Randomly extract the original training set through the Bootstraping module to form 10 randomly generated base training sets

[0167] Module 2: Provide the randomly generated base training set to 10 basic classifiers, each classifier outputs a unique vector result

[0168] Module 3: Use voting method to count the output results of each classifier, and finally output the result with the highest frequency

[0169] Through ensemble learning, the model’s ability to learn alarm causes with a small number of samples is enhanced, and ultimately a complete artificial intelligence entity for the network security alarm system is realized.

[0170] Embodiment 13:

[0171] The verification of an intelligent tracing method for network security alarms in power monitoring systems based on knowledge graphs and graph convolutional networks is as follows:

[0172] (1) Training sample acquisition and preprocessing

[0173] In this embodiment, data provided by an actual power company is used for training, which contains 70,110 pieces of alarm information from March 23, 2023 to May 22, 2023. The composition of the alarm information is mainly shown in Table 3, where "alarm description", "alarm site", "source site", "alarm device" and "alarm reason" are the input content of the model constructed by the present invention, and the training set and the test set are divided according to a ratio of 9:1.

[0174] Table 3 Alarm information example

[0175]

[0176] Table 4 Trans H model parameters

[0177] Trans H model parameters Numeric Learning Rate 0.001 Embeddingdim (the dimension of the embedding vector) 50 Margin (parameters of the loss function) 1.0 Norm (the type of norm used when calculating the score) 1

[0178] (2) Evaluation indicators

[0179] The present invention uses a common evaluation method in the field of machine learning and deep learning to evaluate the constructed model. The evaluation indicators are precision (P recision ), recall rate (Recall ), accuracy (A ccuracy ) and F 1_score , specifically defined as follows:

[0180] P recision =T P / (T P +F P )(1)

[0181]

[0182] Where T P 、T N 、F P 、F N is an element in the confusion matrix. P Refers to the correctly predicted positive examples, T N Refers to the correctly predicted counterexample, F P It means that the true value is a counter-example that is mistakenly predicted as a positive example. N It means that the true value is a positive example but is mistakenly predicted as a negative example, as shown in Table 5.

[0183] Table 5 Confusion matrix for classification problems

[0184] Tested positive Test negative Actually positive TP (true positive) FN (false negative) Actually negative FP (false positive) TN (true negative)

[0185] The ROC curve uses each value of the prediction result as a possible judgment threshold, and the corresponding sensitivity and specificity are calculated from it. The false positive rate (FPR) is used as the horizontal axis, as shown in (5); the true positive rate (TPR), i.e., sensitivity, is used as the vertical axis, as shown in (6).

[0186]

[0187] The area under the curve (AUC) is used as a measure of the model's prediction accuracy, and its value range is [0,1]. The larger the value, the stronger the model's judgment. For this model, the tracing process can be regarded as the process of classifying the alarm details into five categories, so the ROC curve is used as the evaluation indicator.

[0188] (3) Model parameters and comparative example settings

[0189] In order to verify the effectiveness of the knowledge graph-graph convolution early warning model constructed by the present invention, the power system network security early warning data provided by an actual power grid company was used as the experimental object, and 70,110 valid alarm information were used to verify the model. The model parameters are shown in the following table.

[0190] Table 6 GCN model parameters

[0191]

[0192]

[0193] In order to compare and analyze the improvement effects of knowledge graph, graph convolutional neural network and ensemble learning on the alarm tracing task, the present invention selects four models, namely GRU neural network, Bi LSTM-Attention, knowledge graph + SVM and knowledge graph + GCN (excluding ensemble learning), for comparison with Neo4j + GCN + ensemble learning established by the present invention.

[0194] (4) Knowledge Graph Effect Verification

[0195] In order to verify that the knowledge graph is better than the traditional model in classifying alarm information, the knowledge graph + GCN (excluding ensemble learning) model is compared with the power grid alarm information classification model based on the GRU neural network and the power grid alarm model based on the Bi LSTM-Attention. The power grid alarm information classification model based on the GRU neural network and the power grid alarm model based on the Bi LSTM-Attention are both based on deep learning methods.

[0196] It can be seen from the result graph that the GRU model and the Bi LSTM model cannot identify alarm cause models other than "redundant business", which proves that the traditional knowledge representation model cannot classify the alarm causes. However, after using the knowledge graph to vectorize the text, some alarm causes can be identified.

[0197] (5) Verification of the effect of graph attention network

[0198] In order to verify the improvement of the graph attention neural network on the effect of network security early warning, the knowledge graph + GCN (excluding ensemble learning) model is compared with the knowledge graph + SVM, where SVM is a machine learning method. By comparing the effects of machine learning and deep learning, it can be seen from the figure that compared with traditional machine learning methods, the model based on deep learning has a stronger ability to identify the causes of various alarms.

[0199] (6) Verification of ensemble learning effect

[0200] In order to verify that ensemble learning can improve the classification effect of the knowledge graph-graph convolution model on alarm information, the classification effect of the knowledge graph + GAT (without ensemble learning) model and the knowledge graph + GAT + ensemble learning model on alarm information is compared. Since the knowledge graph + GAT (without ensemble learning) model and the knowledge graph + GAT + ensemble learning model can both identify alarm information, the ROC graph can be used to compare their results.

[0201] It can be seen from the ROC graph that M1 is better than M2 and M3. Therefore, the model of knowledge graph + graph convolutional neural network is more accurate than the model of knowledge graph + machine learning. After adding integrated learning, the AUC value of the model is close to 1, and the accuracy is further improved.

[0202] In summary, based on actual alarm data and combined with the current problems in power system network security early warning, the present invention has designed an artificial intelligence model based on knowledge graph and deep learning algorithm to realize the intelligent tracing and early warning of power system network security, and to quickly and accurately trace the massive alarm information intelligently.

Claims

1. An intelligent tracing method for network security alarms in power monitoring systems based on knowledge graphs and graph convolutional networks, characterized in that: The following steps are involved: 1) Based on the historical text data of cybersecurity alarm records, a cybersecurity knowledge graph is constructed to represent the entities and relationships of massive cybersecurity alarms. 2) Based on the network security knowledge graph, the vectorized expression of the current network security alarm record text is obtained through knowledge representation, and the format is converted to generate input data; 3) Construct a graph convolutional neural network and train it to obtain an intelligent tracing model for network security alarms in the power monitoring system; 4) Input the input data into the intelligent tracing model of network security alarm of the power monitoring system to generate network security alarm tracing information.

2. According to claim 1, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, characterized in that: The steps to construct a cybersecurity knowledge graph that represents alert entities and relationships include: 1) Knowledge extraction: Based on semantic matching technology, words representing entities and relationships in network security alarm records are extracted to generate triples of alarm text; 2) Graph generation: Generate a network security knowledge graph that represents alarm entities and relationships based on multiple text triples; 3) Knowledge representation: Vectorize the words representing entities and relationships to obtain triples (h, r, t) representing entities and relationships; where h is the head entity vector, r is the relationship vector, and t is the tail entity vector; the relationship vector r is the transformation of the head entity h and the tail entity t projected on a certain hyperplane.

3. According to claim 2, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network is characterized in that: The steps of knowledge extraction include: 1) Jieba word segmentation database is used to segment the alarm information. The dictionary model is used to match and segment common words, and the probability model is used to segment industry-specific words. 2) Match the segmented alarm information according to the semantic characteristics of each type of alarm entity, and define the relationship between each type of entity. According to the entities extracted from each alarm information and the relationship between the defined entities, form a network security alarm text triple in the form of (head entity, relationship, tail entity).

4. According to claim 2, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network is characterized in that: The TransH model is used to vectorize the words representing entities and relationships.

5. According to claim 4, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network is characterized in that: When training the TransH model, the head entity vector h and the tail entity vector t are projected onto the hyperplane W r The projection vectors of the head entity vector h and the tail entity vector t are obtained, which are denoted as h ⊥ and t ⊥ , and the projection vector h ⊥ ,t ⊥ 、r ⊥ As training data; ⊥ is the relationship vector in the hyperplane W r The projection vector on ; Among them, the projection vector h ⊥ ,t ⊥ 、r ⊥ Satisfy the following formula: h ⊥ +r ⊥ ≈t ⊥ (1)。 6. According to claim 1, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network is characterized in that: When performing format conversion, the alarm cause is converted into a one-hot vector using the one-hot encoding technology.

7. According to claim 1, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, characterized in that: The input data includes A and H (0) ; A∈n×n is the original adjacency matrix; the element A in the adjacency matrix A ij =1 means there is an edge connecting node i and node j, otherwise it is 0; H (0) ∈n×m includes the feature vectors of each node.

8. According to claim 1, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, characterized in that: During the training of graph convolutional neural networks, the weight matrix is ​​adjusted through the back-propagation method; Among them, the propagation method between the lth layer and the l+1th layer of the graph convolutional neural network is as follows: Where: A is the adjacency matrix of the graph; matrix σ is the activation function; W (l) is the weight matrix to be trained; H (l+1) , H (l) It is the output of the l+1th layer and the lth layer of the graph convolutional neural network.

9. According to claim 1, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, characterized in that: The graph convolutional neural network uses an attention mechanism; The attention mechanism Attention(Q,S) is expressed as follows: Attention(Q,S)=∑<Q,S>.S(3) Where: S represents the information source that needs to be processed, that is, the feature vectors of all neighbor nodes; Q is the feature vector of the current central node; The attention coefficients between nodes of the graph convolutional neural network are as follows: Where: a ic is the attention coefficient between node i and node c; x i is the initial attribute information vector of node i; W∈R n'×n is to map the node feature vector from n-dimension to n'-dimension; D(i) is the set of neighbor nodes of node i; || represents the concatenation operation; x c 、x d is the initial attribute information vector of nodes c and d; node d is the neighbor node of node i; LeakyReLU is the activation function.

10. According to claim 1, a method for intelligent tracing of network security alarms in a power monitoring system based on knowledge graph and graph convolutional network, characterized in that: The intelligent tracing model for network security alarms in power monitoring systems includes multiple basic classifiers; When generating network security alarm tracing information, the output of these basic classifiers is processed using a weighted voting method to obtain the final network security alarm tracing information.

Images