A new energy power system network security intrusion detection method based on deep learning

Abstract

The present invention discloses a new energy power system network security intrusion detection method based on deep learning. The present invention obtains network attack case data of the new energy power system, pre-processes the obtained data, and analyzes the network traffic parameters, power parameters and frequency parameters in the network attack case data to obtain an attack performance index and a power performance model. The attack performance index and the power performance model are combined into data pairs and input into a pre-built deep learning model to obtain a feature learning model. The model can comprehensively learn the characteristic changes of network traffic and power system operating parameters when attacked, thereby overcoming the problem that the prior art only focuses on normal data features but does not learn enough abnormal data.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a new energy power system network security intrusion detection method based on deep learning. Background Art

[0002] As the global demand for clean energy continues to grow, new energy power systems have developed rapidly. These systems are highly dependent on advanced information technology to achieve efficient power generation, transmission, distribution and management; however, the widespread use of information technology has also brought unprecedented network security challenges to new energy power systems.

[0003] The existing new energy power system network security intrusion detection methods still have the following shortcomings:

[0004] In the network environment of the new energy power system, normal network traffic and power operation data far outweigh abnormal data. This causes the deep learning model to focus too much on the characteristics of normal data during training, but not enough on the abnormal data. The various parameters in the abnormal data are not associated with the type of network intrusion, resulting in the inability of the new energy power system to timely identify various types of network attacks and carry out targeted processing, and the detection accuracy and efficiency are low.

[0005] To this end, a new energy power system network security intrusion detection method based on deep learning is introduced. Summary of the invention

[0006] In view of this, the present invention provides a new energy power system network security intrusion detection method based on deep learning to solve the problems raised by the above background technology.

[0007] The purpose of the present invention can be achieved by the following technical solution: A new energy power system network security intrusion detection method based on deep learning, comprising:

[0008] Data collection: Obtain and pre-process the cyber attack case data of the new energy power system to obtain the evaluation data packets corresponding to each group of cyber attack case data of the new energy power system; the evaluation data packets contain network traffic change parameters, power parameters and frequency parameters;

[0009] Feature quantification: Extract evaluation data packets from each group of network attack case data and analyze them to obtain the attack performance index rcda and power performance model corresponding to each group of network attack case data;

[0010] Establish the model: combine the attack performance index rcda and power performance model of each group of network attack case data, and input each group of data pairs into the pre-built deep learning model for integration, and use the integrated deep learning model as the feature learning model of current new energy power system network security intrusion;

[0011] Intrusion determination: When determining that the power system network is intruded based on the preset determination rules, the network traffic characteristics, power parameters and frequency parameters of the new energy power system within the set time interval are collected, and the attack performance index rcda and the power performance model of the new energy power system within the set time interval are analyzed. After the analysis, the feature learning model is started and loaded to analyze the real-time analysis attack performance index rcda and the power performance model, so as to obtain the similarity evaluation index kred between each group of network attack case data and the current real-time analysis results, and the specific type of intrusion is determined based on the obtained similarity evaluation index kred of each group;

[0012] Intrusion processing: When determining the intrusion type of the renewable energy power system, execute the corresponding steps to handle it.

[0013] In some embodiments, the attack performance index rcda corresponding to each group of network attack case data is obtained, specifically:

[0014] Extract network traffic change parameters within a set time interval in each group of network attack case materials, and divide the set time interval into sub-interval windows according to a preset division ratio;

[0015] Extract the network traffic parameters at each time point in each sub-interval window, and calculate the change rate of the network traffic parameters at two adjacent groups of time points, that is, for each second of the network traffic parameter in each sub-interval window, calculate the difference between it and the network traffic parameter of the previous second, take the absolute value and divide it by the network traffic parameter of the previous second, so as to obtain the change rate of the network traffic size at each time point in each sub-interval window;

[0016] The average value of the change rate of each group of network traffic in each sub-interval window is calculated to obtain the average traffic change rate corresponding to each sub-interval window;

[0017] The average of the flow change rates corresponding to each sub-interval window is calculated to obtain the total flow rate, and then the highest flow change rate and the lowest flow change rate in each sub-interval window are extracted and the difference is calculated to obtain the total flow difference rate;

[0018] The reference flow total average rate and reference flow total difference rate corresponding to the preset flow total average rate and flow total difference rate respectively;

[0019] The total average rate of flow and the total difference rate of flow are calculated with the corresponding preset total average rate of reference flow and the total difference rate of reference flow, and then the two sets of ratios are summed to obtain the flow evaluation index y1;

[0020] A traffic threshold of a preset network traffic parameter is set. If the network traffic parameter at a certain time point within the set time interval exceeds the preset traffic threshold, the time point is marked as the starting point and timing begins. The timing ends when the network traffic parameter is lower than the preset traffic threshold. The highest network traffic parameter within the timing range is marked as the traffic peak value. Within the set time interval, the number of occurrences of the traffic peak value is counted as the peak number, and the peak number is divided by the set time interval to obtain the peak evaluation index y2.

[0021] In some embodiments, obtaining the attack performance index rcda corresponding to each group of network attack case data also includes:

[0022] According to the formula The flow evaluation index y1 and peak evaluation index y2 corresponding to each group of network attack case materials are weightedly calculated to obtain the attack performance index rcda corresponding to each group of network attack case materials; wherein a1 and a2 are the influencing weight factors of the flow evaluation index y1 and the peak evaluation index y2 respectively.

[0023] In some embodiments, the power performance model corresponding to each group of network attack case data is obtained, specifically:

[0024] Extract the power parameters within the set time interval in each group of network attack case materials, the power parameters include active power and reactive power, and preset the normal active power and normal reactive power of the power system; for the power parameters within the set time interval, calculate the mean of the active power and reactive power at each time point within the set time interval, and calculate the ratio of the two calculated mean values ​​to the corresponding preset normal active power and normal reactive power, so as to obtain the active ratio and reactive ratio;

[0025] Extract the frequency parameters within the set time interval in each group of network attack case materials, preset the nominal frequency of the power system, calculate the mean of the frequency parameters at each time point in the set time interval, and calculate the ratio between the mean and the nominal frequency to obtain the frequency ratio;

[0026] For the active ratio, reactive ratio and frequency ratio, the average values ​​are calculated to obtain the average power difference, the average reactive power difference and the average frequency difference;

[0027] The average power difference, the average power difference and the average frequency difference are used as the length, width and height of the three-dimensional rectangle respectively, and a three-dimensional rectangular model is constructed based on this, and the constructed three-dimensional rectangular model is used as the power performance model of the corresponding network attack case material;

[0028] Establish a model: combine the attack performance index rcda and power performance model of each group of network attack case data, and input each group of data pairs into a pre-built deep learning model for integration. The integrated deep learning model is used as the feature learning model of current new energy power system network security intrusion.

[0029] In some embodiments, the feature learning model is started and loaded to analyze the real-time analysis of the attack performance index rcda and the power performance model, specifically:

[0030] The feature learning model inputs the real-time analysis of the attack performance index rcda and the power performance model into each group of data for comparison;

[0031] For the attack performance index rcda contained in each data pair, the difference between the attack performance index rcda of the real-time analysis is calculated, and the absolute value is taken as the attack similarity index p1 between each data pair and the current real-time analysis result;

[0032] For the power performance model contained in each data pair, the volume ratio between the real-time analysis power performance model and the power performance model is first calculated, that is, the volume similarity index p2 between each data pair and the current real-time analysis result is obtained by calculating the volume ratio between the real-time analysis power performance model and the power performance model in the data pair;

[0033] The length value, width value and height value are extracted from the power performance model contained in each group of data pairs, and the ratio of the length value, width value and height value is calculated between the real-time analysis power performance model. The sum of each group of ratios is divided by the integer three to obtain the shape similarity index p3 between each group of data pairs and the current real-time analysis result.

[0034] In some embodiments, the similarity evaluation index kred between each group of network attack case data and the current real-time analysis result is obtained, specifically:

[0035] According to the formula , weighted calculation is performed on the attack similarity index p1, volume similarity index p2 and shape similarity index p3 between each group of data pairs and the current real-time analysis result, so as to obtain the similarity evaluation index kred between each group of network attack case data and the current real-time analysis result; wherein t1, t2 and t3 are respectively the preset influence weight factors corresponding to the attack similarity index p1, volume similarity index p2 and shape similarity index p3;

[0036] The network attack case data corresponding to the lowest similarity evaluation index kred is selected from the similarity evaluation index kred corresponding to each group of network attack case data, and the intrusion type of the selected network attack case is used as the intrusion type corresponding to the current determined intrusion.

[0037] In some embodiments, corresponding steps are executed for processing, specifically:

[0038] V1: Extract the network attack case data corresponding to the determined intrusion type, and use the countermeasures in the network attack case data as the reference countermeasures for the current new energy power system, and use the reference countermeasures for processing. If the processing fails, execute step V2;

[0039] V2: Eliminate the network attack case data corresponding to the lowest similarity evaluation index kred. After the elimination is completed, sort the similarity evaluation index kred corresponding to each group of network attack case data from small to large according to the index size, select the network attack case data in the top three groups, and use the response measures in the top three groups of network attack case data as alternative response measures for the current new energy power system, and use the alternative response measures for processing. If the processing still fails, trigger the abnormal signaling and execute step V3;

[0040] V3: Send the triggered abnormal signaling to the network security personnel, who will then conduct investigation and processing after receiving the triggered abnormal signaling, and at the same time back up the data in the new energy power network;

[0041] After the backup data is integrated into a data packet, X groups of digital codes are randomly generated for the data packet; X>8; after the X groups of digital codes are generated, a preset conversion formula is used to calculate the X groups of digital codes; after the calculation is completed, new X groups of digital codes are obtained; the new X groups of digital codes are randomly divided into three sets, each set containing X / 3 number of digital codes;

[0042] Draw a plane rectangular coordinate system, use two random groups of digital codes in the three sets as coordinate points, draw the numerical points corresponding to the positions of the three sets of coordinate points in the plane rectangular coordinate system, use each group of numerical points as the center of the circle, use the remaining digital codes in the three sets as the radius of the circle, draw a circle with the radius corresponding to the center of each group of circles, and connect the centers of each group of circles with line segments to obtain a group of graphics, and use the obtained graphics as the encrypted graphics corresponding to the current failed processing data packet, and use the encrypted graphics to encrypt and store the data packet, and at the same time encrypt the data packet and transmit it to network security personnel.

[0043] In some embodiments, it also includes:

[0044] Model optimization: During the intrusion processing, if the countermeasures corresponding to the network attack case data fail, the intrusion will be marked as a new type of network attack case data, and the feature learning model will be updated based on the marked new type of network attack case data.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] The present invention obtains network attack case data of new energy power systems, pre-processes the obtained data, and analyzes network traffic parameters, power parameters, and frequency parameters in the network attack case data to obtain an attack performance index and a power performance model. The attack performance index and the power performance model are combined into data pairs and input into a pre-built deep learning model to obtain a feature learning model. The model can comprehensively learn the feature changes of network traffic and power system operating parameters when attacked, overcoming the problem that the prior art only focuses on normal data features and does not learn abnormal data enough.

[0047] The present invention collects network traffic characteristics, power parameters and frequency parameters within a set time interval when determining intrusion, analyzes the attack performance index and power performance model, and the feature learning model compares the real-time analysis results with the historical data, comprehensively analyzes the attack similarity index, volume similarity index and shape similarity index, obtains the similarity evaluation index, selects the intrusion type of the network attack case data corresponding to the lowest similarity evaluation index as the determination result, and uses the determination method based on the similarity of historical cases to quickly and accurately determine the intrusion type, thereby improving the detection accuracy and efficiency;

[0048] After determining the intrusion type, the present invention first adopts the countermeasures in the corresponding case data; if it fails, the case data corresponding to the lowest similarity evaluation index is eliminated, and the countermeasures of the first three groups of case data in similarity evaluation index ranking are selected as alternatives. If it still fails, an abnormal signaling is triggered and the network security personnel are notified to check and handle it, and the data is backed up at the same time. This hierarchical processing method improves the ability to deal with intrusions;

[0049] When the countermeasures fail, the present invention marks the intrusion as a new type of network attack case data, updates the feature learning model based on this, continuously updates the model to adapt it to the new attack mode, improves the system's detection and response capabilities to new network attacks, and ensures the long-term effectiveness of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Further details, features and advantages of the present application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which:

[0051] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0052] Several embodiments of the present application will be described in more detail below with reference to the accompanying drawings so that those skilled in the art can implement the present application. The present application can be embodied in many different forms and purposes and should not be limited to the embodiments described herein. These embodiments are provided to make the present application comprehensive and complete, and to fully convey the scope of the present application to those skilled in the art. The embodiments do not limit the present application.

[0053] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with their meaning in the relevant art and / or the context of this specification, and will not be interpreted in an idealized or overly formal sense unless explicitly defined as such herein.

[0054] See also Figure 1 As shown, the new energy power system network security intrusion detection method based on deep learning includes:

[0055] Data collection: Obtain and pre-process the cyber attack case data of the new energy power system to obtain the evaluation data packets corresponding to each group of cyber attack case data of the new energy power system; the evaluation data packets contain network traffic change parameters, power parameters and frequency parameters;

[0056] Preprocessing includes data cleaning and format conversion;

[0057] Cyber ​​attack case data can be obtained from relevant websites or the security departments of cooperating power companies. Cyber ​​attack case data includes the characteristics of network traffic patterns and the impact of attacks on power system operating parameters;

[0058] Feature quantification: Extract evaluation data packets from each group of network attack case data and analyze them to obtain the attack performance index rcda and power performance model corresponding to each group of network attack case data;

[0059] The specific steps to obtain the attack performance index rcda are:

[0060] Extract network traffic change parameters within a set time interval in each group of network attack case materials, and divide the set time interval into sub-interval windows according to a preset division ratio;

[0061] It should be noted that, with respect to the attack process in each group of network attack case materials, the network traffic change characteristics within a set time interval are intercepted.

[0062] Extract the network traffic parameters at each time point in each sub-interval window, and calculate the change rate of the network traffic parameters at two adjacent groups of time points, that is, for each second of the network traffic parameter in each sub-interval window, calculate the difference between it and the network traffic parameter of the previous second, take the absolute value and divide it by the network traffic parameter of the previous second, so as to obtain the change rate of the network traffic size at each time point in each sub-interval window;

[0063] The average value of the change rate of each group of network traffic in each sub-interval window is calculated to obtain the average traffic change rate corresponding to each sub-interval window;

[0064] The average of the flow change rates corresponding to each sub-interval window is calculated to obtain the total flow rate, and then the highest flow change rate and the lowest flow change rate in each sub-interval window are extracted and the difference is calculated to obtain the total flow difference rate;

[0065] The reference flow total average rate and reference flow total difference rate respectively correspond to the preset flow total average rate and flow total difference rate; the reference flow total average rate and the reference flow total difference rate respectively represent the results of network flow parameters calculated by the new energy power system under normal operation;

[0066] The total average rate of flow and the total difference rate of flow are calculated with the corresponding preset total average rate of reference flow and the total difference rate of reference flow, and then the two sets of ratios are summed to obtain the flow evaluation index y1;

[0067] That is, it is calculated by the total average rate of flow / the total average rate of reference flow and the total difference rate of flow / the total difference rate of reference flow;

[0068] A traffic threshold of a preset network traffic parameter is set. If the network traffic parameter at a certain time point within the set time interval exceeds the preset traffic threshold, the time point is marked as the starting point and timing begins. The timing ends when the network traffic parameter is lower than the preset traffic threshold. The highest network traffic parameter within the timing range is marked as the traffic peak value. Within the set time interval, the number of occurrences of the traffic peak value is counted as the peak number, and the peak number is divided by the set time interval to obtain the peak evaluation index y2.

[0069] According to the formula The flow evaluation index y1 and the peak evaluation index y2 corresponding to each group of network attack case materials are weighted and calculated to obtain the attack performance index rcda corresponding to each group of network attack case materials; a1 and a2 are the influencing weight factors of the flow evaluation index y1 and the peak evaluation index y2 respectively;

[0070] The specific steps to obtain the power performance model are:

[0071] Extract the power parameters within the set time interval in each group of network attack case materials, the power parameters include active power and reactive power, and preset the normal active power and normal reactive power of the power system; for the power parameters within the set time interval, calculate the mean of the active power and reactive power at each time point within the set time interval, and calculate the ratio of the two calculated mean values ​​to the corresponding preset normal active power and normal reactive power, so as to obtain the active ratio and reactive ratio;

[0072] Extract the frequency parameters within the set time interval in each group of network attack case materials, preset the nominal frequency of the power system, calculate the mean of the frequency parameters at each time point in the set time interval, and calculate the ratio between the mean and the nominal frequency to obtain the frequency ratio;

[0073] For the active ratio, reactive ratio and frequency ratio, the average values ​​are calculated to obtain the average power difference, the average reactive power difference and the average frequency difference;

[0074] The average power difference, the average power difference and the average frequency difference are used as the length, width and height of the three-dimensional rectangle respectively, and a three-dimensional rectangular model is constructed based on this, and the constructed three-dimensional rectangular model is used as the power performance model of the corresponding network attack case material;

[0075] It should be noted that by performing the above processing on a large number of network attack case data, we can gain an in-depth understanding of the characteristics of various types of attacks and how they affect the system.

[0076] Establish the model: combine the attack performance index rcda and power performance model of each group of network attack case data, and input each group of data pairs into the pre-built deep learning model for integration, and use the integrated deep learning model as the feature learning model of current new energy power system network security intrusion;

[0077] Intrusion determination: Deploy sensors and data acquisition equipment on key network nodes and power equipment of the new energy power system, and determine when the power system network is invaded based on preset determination rules; for example, threshold determination; collect network traffic characteristics, power parameters and frequency parameters of the new energy power system within a set time interval, analyze the attack performance index rcda and power performance model of the new energy power system within the set time interval, start and load the feature learning model after analysis to analyze the real-time analysis attack performance index rcda and power performance model, so as to obtain the similarity evaluation index kred between each group of network attack case data and the current real-time analysis results, and determine the specific type of intrusion based on the obtained similarity evaluation index kred of each group;

[0078] Specifically:

[0079] The feature learning model inputs the real-time analysis of the attack performance index rcda and the power performance model into each group of data for comparison;

[0080] For the attack performance index rcda contained in each data pair, the difference between the attack performance index rcda of the real-time analysis is calculated, and the absolute value is taken as the attack similarity index p1 between each data pair and the current real-time analysis result;

[0081] For the power performance model contained in each data pair, the volume ratio between the real-time analysis power performance model and the power performance model is first calculated, that is, the volume similarity index p2 between each data pair and the current real-time analysis result is obtained by calculating the volume ratio between the real-time analysis power performance model and the power performance model in the data pair;

[0082] The closer the volume similarity index p2 is to 1, the more similar the two groups of power performance models are in overall size;

[0083] Extract the length value, width value and height value from the power performance model contained in each group of data pairs, and calculate the ratio of the length value, width value and height value with the real-time analysis power performance model, sum the ratios of each group and divide by the integer three to obtain the shape similarity index p3 between each group of data pairs and the current real-time analysis result;

[0084] The closer the shape similarity index m2 is to 1, the more similar the two groups of power performance models are in overall shape;

[0085] According to the formula , weighted calculation is performed on the attack similarity index p1, volume similarity index p2 and shape similarity index p3 between each group of data pairs and the current real-time analysis result, so as to obtain the similarity evaluation index kred between each group of network attack case data and the current real-time analysis result; wherein t1, t2 and t3 are respectively the preset influence weight factors corresponding to the attack similarity index p1, volume similarity index p2 and shape similarity index p3;

[0086] Select the network attack case data corresponding to the lowest similarity evaluation index kred from the similarity evaluation index kred corresponding to each group of network attack case data, and use the selected network attack case intrusion type as the intrusion type corresponding to the current intrusion determination;

[0087] It should be noted that the network attack case data corresponding to the lowest similarity evaluation index kred is selected from the similarity evaluation index kred corresponding to each group of network attack case data, and its intrusion type is used as the intrusion type corresponding to the current intrusion judgment. This matching method determines the intrusion type based on the historical case that is most similar to the current real-time situation, which can make full use of past response experience and knowledge, provide an accurate basis for formulating targeted response measures, and help to quickly and effectively respond to intrusion incidents and reduce damage to the new energy power system.

[0088] Intrusion processing: When determining the intrusion type of the new energy power system, execute the corresponding steps to handle it;

[0089] Specifically:

[0090] V1: Extract the network attack case data corresponding to the determined intrusion type, and use the countermeasures in the network attack case data as the reference countermeasures for the current new energy power system, and use the reference countermeasures for processing. If the processing fails, execute step V2;

[0091] V2: Eliminate the network attack case data corresponding to the lowest similarity evaluation index kred. After the elimination is completed, sort the similarity evaluation index kred corresponding to each group of network attack case data from small to large according to the index size, select the network attack case data in the top three groups, and use the response measures in the top three groups of network attack case data as alternative response measures for the current new energy power system, and use the alternative response measures for processing. If the processing still fails, trigger the abnormal signaling and execute step V3;

[0092] V3: Send the triggered abnormal signaling to the network security personnel, who will conduct investigation and processing after receiving the triggered abnormal signaling, and back up the data in the new energy power network at the same time; the data includes equipment status data, power transaction data and user information, etc.;

[0093] The operation parameter records of power generation equipment in the power system are very important for subsequent troubleshooting, equipment maintenance and power dispatching. By backing up, this data can be prevented from being lost and the long-term stable operation of the power system can be guaranteed;

[0094] After the backup data is integrated into a data packet, X groups of digital codes are randomly generated for the data packet; X>8 and is an integer that is a multiple of three, such as 9 / 12 / 15; after the X groups of digital codes are generated, a preset conversion formula is used to calculate the X groups of digital codes; the preset conversion formula is a simple addition, subtraction, multiplication and division formula, and the specific formula is set by the technician, such as , where u represents the specific digital code that is substituted into the conversion formula for calculation; after the calculation is completed, a new X group of digital codes is obtained; the new X group of digital codes are randomly divided into three sets, each set contains X / 3 number of digital codes;

[0095] It should be noted that the randomly generated X groups of digital codes are all positive integers.

[0096] Draw a rectangular coordinate system, use two random digital codes in the three sets as coordinate points, draw the numerical points corresponding to the positions of the three sets of coordinate points in the rectangular coordinate system, use each set of numerical points as the center of the circle, use the remaining digital codes in the three sets as the radius of the circle, draw a circle with the radius corresponding to the center of each set of circles, connect the centers of each set of circles with line segments after drawing the circle, and obtain a set of graphics, and use the obtained graphics as the encrypted graphics corresponding to the current failed processing data packet, and use the encrypted graphics to encrypt and store the data packet, and at the same time encrypt and transmit the data packet to network security personnel;

[0097] It should be noted that the method of randomly generating multiple sets of digital codes for data packets, calculating new digital codes through a preset conversion formula, and then dividing them into three sets, and using these digital codes in a specific way to draw graphics in a plane rectangular coordinate system as encryption graphics to encrypt, store and transmit data packets is innovative. This encryption method increases the complexity and randomness of data encryption, and may be more difficult to crack than traditional encryption methods, effectively improving the security of backup data.

[0098] Model optimization: During the intrusion processing, if the countermeasures corresponding to the network attack case data fail, the intrusion will be marked as a new type of network attack case data, and the feature learning model will be updated based on the marked new type of network attack case data;

[0099] Update feature learning models based on newly emerged attack samples and analysis results to improve the system’s detection and response capabilities;

[0100] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A new energy power system network security intrusion detection method based on deep learning, characterized in that: include: Data collection: Obtain cyber attack case data of the new energy power system and perform preprocessing to obtain evaluation data packages corresponding to each group of cyber attack case data of the new energy power system; The evaluation data packet includes network traffic change parameters, power parameters, and frequency parameters; feature Quantification: Extract evaluation data packets from each group of network attack case data and analyze them to obtain the attack performance index rcda and power performance model corresponding to each group of network attack case data; The attack performance index rcda corresponding to each group of network attack case data is obtained, specifically: Extract network traffic change parameters within a set time interval in each group of network attack case materials, and divide the set time interval into sub-interval windows according to a preset division ratio; Extract the network traffic parameters at each time point in each sub-interval window, and calculate the change rate of the network traffic parameters at two adjacent groups of time points, that is, for each second of the network traffic parameter in each sub-interval window, calculate the difference between it and the network traffic parameter of the previous second, take the absolute value and divide it by the network traffic parameter of the previous second, so as to obtain the change rate of the network traffic size at each time point in each sub-interval window; The average value of the change rate of each group of network traffic in each sub-interval window is calculated to obtain the average traffic change rate corresponding to each sub-interval window; The average of the flow change rates corresponding to each sub-interval window is calculated to obtain the total flow rate, and then the highest flow change rate and the lowest flow change rate in each sub-interval window are extracted and the difference is calculated to obtain the total flow difference rate; The reference flow total average rate and reference flow total difference rate corresponding to the preset flow total average rate and flow total difference rate respectively; The total average rate of flow and the total difference rate of flow are calculated with the corresponding preset total average rate of reference flow and the total difference rate of reference flow, and then the two sets of ratios are summed to obtain the flow evaluation index y1; A traffic threshold of a preset network traffic parameter is set. If the network traffic parameter at a certain time point within the set time interval exceeds the preset traffic threshold, the time point is marked as the starting point and timing begins. The timing ends when the network traffic parameter is lower than the preset traffic threshold. The highest network traffic parameter within the timing range is marked as the traffic peak value. Within the set time interval, the number of occurrences of the traffic peak value is counted as the peak number, and the peak number is divided by the set time interval to obtain the peak evaluation index y2. According to the formula The flow evaluation index y1 and the peak evaluation index y2 corresponding to each group of network attack case materials are weighted and calculated to obtain the attack performance index rcda corresponding to each group of network attack case materials; a1 and a2 are the influencing weight factors of the flow evaluation index y1 and the peak evaluation index y2 respectively; The power performance model corresponding to each group of network attack case data is obtained, specifically: Extract the power parameters within the set time interval in each group of network attack case materials, the power parameters include active power and reactive power, and preset the normal active power and normal reactive power of the power system; for the power parameters within the set time interval, calculate the mean of the active power and reactive power at each time point within the set time interval, and calculate the ratio of the two calculated mean values ​​to the corresponding preset normal active power and normal reactive power, so as to obtain the active ratio and reactive ratio; Extract the frequency parameters within the set time interval in each group of network attack case materials, preset the nominal frequency of the power system, calculate the mean of the frequency parameters at each time point in the set time interval, and calculate the ratio between the mean and the nominal frequency to obtain the frequency ratio; For the active ratio, reactive ratio and frequency ratio, the average values ​​are calculated to obtain the average power difference, the average reactive power difference and the average frequency difference; The average power difference, the average power difference and the average frequency difference are used as the length, width and height of the three-dimensional rectangle respectively, and a three-dimensional rectangular model is constructed based on this, and the constructed three-dimensional rectangular model is used as the power performance model of the corresponding network attack case material; Establish the model: combine the attack performance index rcda and power performance model of each group of network attack case data, and input each group of data pairs into the pre-built deep learning model for integration, and use the integrated deep learning model as the feature learning model of current new energy power system network security intrusion; Intrusion determination: When determining that the power system network is intruded based on the preset determination rules, the network traffic characteristics, power parameters and frequency parameters of the new energy power system within the set time interval are collected, and the attack performance index rcda and the power performance model of the new energy power system within the set time interval are analyzed. After the analysis, the feature learning model is started and loaded to analyze the real-time analysis attack performance index rcda and the power performance model, so as to obtain the similarity evaluation index kred between each group of network attack case data and the current real-time analysis results, and the specific type of intrusion is determined based on the obtained similarity evaluation index kred of each group; Intrusion processing: When determining the intrusion type of the renewable energy power system, execute the corresponding steps to handle it.

2. The method for detecting network intrusion in a new energy power system based on deep learning according to claim 1 is characterized in that: Start and load the feature learning model to analyze the real-time attack performance index rcda and power performance model, specifically: The feature learning model inputs the real-time analysis of the attack performance index rcda and the power performance model into each group of data for comparison; For the attack performance index rcda contained in each data pair, the difference between the attack performance index rcda of the real-time analysis is calculated, and the absolute value is taken as the attack similarity index p1 between each data pair and the current real-time analysis result; For the power performance model contained in each data pair, the volume ratio between the real-time analysis power performance model and the power performance model is first calculated, that is, the volume similarity index p2 between each data pair and the current real-time analysis result is obtained by calculating the volume ratio between the real-time analysis power performance model and the power performance model in the data pair; The length value, width value and height value are extracted from the power performance model contained in each group of data pairs, and the ratio of the length value, width value and height value is calculated between the real-time analysis power performance model. The sum of each group of ratios is divided by the integer three to obtain the shape similarity index p3 between each group of data pairs and the current real-time analysis result.

3. The method for detecting network intrusion in a new energy power system based on deep learning according to claim 2 is characterized in that: The similarity evaluation index kred between each group of network attack case data and the current real-time analysis results is obtained, specifically: According to the formula , perform weighted calculation on the attack similarity index p1, volume similarity index p2 and shape similarity index p3 between each group of data and the current real-time analysis result, so as to obtain the similarity evaluation index kred between each group of network attack case data and the current real-time analysis result; Where t1, t2 and t3 are respectively the preset influence weight factors corresponding to the attack similarity index p1, the volume similarity index p2 and the shape similarity index p3; The network attack case data corresponding to the lowest similarity evaluation index kred is selected from the similarity evaluation index kred corresponding to each group of network attack case data, and the intrusion type of the selected network attack case is used as the intrusion type corresponding to the current determined intrusion.

4. The method for detecting network intrusion in a new energy power system based on deep learning according to claim 3 is characterized in that: Execute the corresponding steps for processing, specifically: V1: Extract the network attack case data corresponding to the determined intrusion type, and use the countermeasures in the network attack case data as the reference countermeasures for the current new energy power system, and use the reference countermeasures for processing. If the processing fails, execute step V2; V2: Eliminate the network attack case data corresponding to the lowest similarity evaluation index kred. After the elimination is completed, sort the similarity evaluation index kred corresponding to each group of network attack case data from small to large according to the index size, select the network attack case data in the top three groups, and use the response measures in the top three groups of network attack case data as alternative response measures for the current new energy power system, and use the alternative response measures for processing. If the processing still fails, trigger the abnormal signaling and execute step V3; V3: Send the triggered abnormal signaling to the network security personnel, who will then conduct investigation and processing after receiving the triggered abnormal signaling, and at the same time back up the data in the new energy power network; After the backup data is integrated into a data packet, X groups of digital codes are randomly generated for the data packet; X>8; after the X groups of digital codes are generated, a preset conversion formula is used to calculate the X groups of digital codes; after the calculation is completed, new X groups of digital codes are obtained; the new X groups of digital codes are randomly divided into three sets, each set containing X / 3 number of digital codes; Draw a plane rectangular coordinate system, use two random groups of digital codes in the three sets as coordinate points, draw the numerical points corresponding to the positions of the three sets of coordinate points in the plane rectangular coordinate system, use each group of numerical points as the center of the circle, use the remaining digital codes in the three sets as the radius of the circle, draw a circle with the radius corresponding to the center of each group of circles, and connect the centers of each group of circles with line segments to obtain a group of graphics, and use the obtained graphics as the encrypted graphics corresponding to the current failed processing data packet, and use the encrypted graphics to encrypt and store the data packet, and at the same time encrypt the data packet and transmit it to network security personnel.

5. The method for detecting network intrusion in a new energy power system based on deep learning according to claim 4 is characterized in that: Also includes: Model optimization: During the intrusion processing, if the countermeasures corresponding to the network attack case data fail, the intrusion will be marked as a new type of network attack case data, and the feature learning model will be updated based on the marked new type of network attack case data.

Images