5G power terminal access threat detection method based on hybrid deep learning

Abstract

The invention provides a 5G power terminal access threat detection method based on hybrid deep learning, and relates to the technical field of network security, and the method comprises the steps: building and collecting a risk factor set, and taking the risk factor set as a threat feature vector, the risk factor set is composed of a physical security threat, a communication security threat, a network security threat, an identity authentication security threat and a data security threat of the 5G power terminal; and obtaining an improved RMSEN-BiLSTM model based on a plurality of residual multi-head extrusion excitation networks and a plurality of jump connection mechanisms, and inputting the threat feature vector into the improved RMSEN-BiLSTM model to obtain a threat classification result. According to the invention, the comprehensiveness and objectivity of 5G terminal access security risk assessment are enhanced, the possibility, the influence range and the hazard degree of 5G terminal risk events are accurately predicted, security policies are conveniently taken in advance, and the occurrence of security events is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a 5G power terminal access threat detection method based on hybrid deep learning. Background Art

[0002] 5G has proposed newer and more secure standards in terminal access authentication and communication encryption. However, during its application in the power industry, there are still many network security issues that have not been resolved. Key technologies such as 5G network slicing, core network sinking, software-defined virtualization, ultra-low latency service carrying, and large connections, as well as new network designs, while better supporting diversified application scenarios, have also posed new challenges to the existing power "partition isolation" network security protection system architecture, terminal access, monitoring and management.

[0003] Threat analysis of 5G terminal access is an active defense technology. Through appropriate threat analysis models, 5G terminal access threat analysis is analyzed and evaluated to predict the possibility, impact range and degree of harm of 5G terminal risk events, so that managers can take security strategies in advance to reduce the occurrence of security events. However, for users in the power industry, there are many types of 5G access terminals and diverse business classifications. The industry does not have a reasonable access threat analysis strategy that can accurately and effectively evaluate the overall situation on the access side.

[0004] Therefore, it is urgent to provide a solution to improve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a 5G power terminal access threat detection method based on hybrid deep learning to improve the problems in the above-mentioned background technology.

[0006] The present invention provides a 5G power terminal access threat detection method based on hybrid deep learning, which adopts the following technical solutions: Establish and collect a risk factor set, and use the risk factor set as a threat feature vector, wherein the risk factor set consists of physical security threats, communication security threats, network security threats, identity authentication security threats, and data security threats of 5G power terminals, and the threat feature vector consists of numerical threat feature vectors and non-numerical threat feature vectors; Based on multiple parallel squeezing incentive mechanisms and multiple jump connection mechanisms, an improved RMSEN-BiLSTM model is obtained, and the non-numerical threat feature vector and the numerical threat feature vector are respectively uniquely hot encoded and normalized and input into the improved RMSEN-BiLSTM model to obtain a threat classification result.

[0007] The beneficial effect of the 5G power terminal access threat detection method and system based on hybrid deep learning provided by the present invention is that the present invention enhances the comprehensiveness and objectivity of 5G terminal access security risk assessment, accurately predicts the possibility, scope of impact and degree of harm of 5G terminal risk events, facilitates the early adoption of security strategies, and reduces the occurrence of security incidents.

[0008] Optionally, the physical security threats include: physical damage, unauthorized access caused by exposed hardware interfaces, data theft, hardware Trojan horse implantation, side channel analysis attacks, fault attacks, counterfeit chips and reverse engineering; The communication security threats include: air interface protocol attacks, channel attacks, wireless private network communication blocking, and time synchronization attacks; The network security threats include: nday vulnerabilities, denial of service attacks; The identity authentication security threats include: eSIM is attacked by malicious eSIM files sent by the remote management platform; sensitive information is leaked in the transmission link between the terminal device, the operator's mobile communication network and the eSIM server; the process of transmitting, reading, writing and processing business data on the eSIM terminal is vulnerable to illegal access or malicious tampering; The data security threats include: inconsistent desensitization rules, insufficient monitoring of risky behaviors, and insufficient database operation and maintenance control.

[0009] Optionally, the process of collecting the physical security threat includes: collecting log information based on the device operation log, collecting the log information of the terminal device when the device restarts abnormally and the device configuration is changed, and the log information includes: the failure frequency and failure type of the terminal device; collecting the temperature, humidity, smoke and water immersion of the environment where the device is located based on the physical environment sensor; when the distance between the unauthorized person and the device is less than the safety distance threshold, obtaining abnormal information based on the video surveillance abnormality detection system; The process of collecting communication security threats includes: when an air interface protocol attack occurs, when the channel utilization rate and interference signal strength of the wireless private network exceed 230MHZ, the system will evaluate whether there is abnormally high-power channel congestion at the load center; The process of collecting network security threats includes: the system detects the chips of power terminals based on security diagnostic tools, the system detects software vulnerabilities based on vulnerability scanning tools, and identifies abnormal resource consumption and malicious process activities based on CPU, memory, and disk usage; The process of collecting identity authentication security threats includes: collecting the identity authentication log of the eSIM card based on the identity information key exchange behavior, obtaining the IP address, terminal device identification and timestamp requested when the eSIM card is activated; the system collects the operation log of the eSIM card, the identity of the monitor and the operation type collected by the remote management platform; based on the eSIM file data issued by the remote management platform, it performs integrity verification on it; The process of collecting data security threats includes: verifying the consistency of data before and after desensitization based on the frequency of use of desensitization rules; based on the anomaly detection system, the system will automatically collect operation log information triggered by the download and modification of sensitive data.

[0010] Optionally, the improved RMSEN-BiLSTM model is connected to 1 RMSEN layer and 2 BiLSTM layers from left to right, wherein the RMSEN layer is connected to 1 Conv layer, 3 RMSE layers, 1 normalization layer, 1 GAP layer and 1 fully connected layer from left to right, and each RMSE layer is composed of 4 convolutional layers, wherein the first 3 convolutional layers are connected from left to right, the 3rd convolutional layer is connected to a GAP layer, and the GAP layer is connected to the 4th convolutional layer.

[0011] Optionally, the GAP layer includes 3 structural layers connected in parallel from top to bottom, and each structural layer is connected to 1 FC layer, 1 BN layer, 1 RELU layer and 1 FC layer from left to right, wherein, in each structural layer, the first FC layer and the last FC layer are used to perform a jump connection mechanism on the pooled features according to the Sigmoid function and obtain fused features after weighting, and the fused features are passed to the 4th convolutional layer in the RMSE layer.

[0012] Optionally, the RMSEN layer includes a total of 13 convolutional layers, the size of the convolution kernel in each convolutional layer is 3, and the number of convolution kernels is 128, 256 and 512 respectively.

[0013] Optionally, the RMSEN layer is used to adaptively adjust feature weights according to multiple parallel squeezing incentive mechanisms and two fully connected layers and activation functions to generate multiple weight vectors, and multiply and weight the multiple weight vectors with the threat feature vector to obtain the final output after the RMSE operation, wherein the squeezing incentive mechanism includes two parts, a squeezing operation and an incentive operation, wherein the squeezing operation is used to obtain global statistical information, and the incentive operation is used to obtain multiple weight vectors.

[0014] Optionally, the mathematical expression of the extrusion operation is: ; The mathematical expression of the excitation operation is: ; The mathematical expression of the final output after the RMSE operation is: ; in, Representative The input size is Features, and They are sigmoid activation function and RELU activation function respectively. and Refers to the weights of the first and second fully connected layers respectively, represents the final output after RMSE operation, , , , represents multiple weight vectors, represents the sum operation, represents the feature representation vector obtained by a single residual squeezing excitation mechanism, Represents the global statistics generated by global average pooling, represents the extrusion operation, Represents the feature matrix The input size is The characteristics of The value of the element, Represents global statistics, Indicates statistical information Applying the weight matrix Operation, Indicates an incentive operation.

[0015] Optionally, the mathematical expression of the skip connection mechanism is: ; in, Indicates input Perform convolution operation, is the convolution kernel weight, is the activation function, Represents the final output of the residual block. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of a 5G power terminal access threat detection method based on hybrid deep learning provided by the present invention; Figure 2 This is a residual multi-head extrusion network model diagram provided by the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0018] The embodiment of the present invention provides a 5G power terminal access threat detection method based on hybrid deep learning, see Figure 1 ,include: S1. Establish and collect a risk factor set, and use the risk factor set as a threat feature vector. The risk factor set consists of physical security threats, communication security threats, network security threats, identity authentication security threats, and data security threats of 5G power terminals. The threat feature vector consists of a numerical threat feature vector and a non-numerical threat feature vector. S2. Based on multiple parallel squeezing incentive mechanisms and multiple jump connection mechanisms, an improved RMSEN-BiLSTM model is obtained, and the non-numerical threat feature vector and the numerical threat feature vector are respectively unique-hot encoded and normalized and input into the improved RMSEN-BiLSTM model to obtain a threat classification result.

[0019] In some embodiments, when executing step S1, the physical security threats include: physical damage, unauthorized access caused by exposed hardware interfaces, data theft, hardware Trojan implantation, side channel analysis attacks, fault attacks, counterfeit chips, and reverse engineering; In fact, there are many types of 5G power terminals, the number of devices is huge and widely distributed, and the deployment environment is complex and difficult to control. With the popularization of IPv6, these terminal devices are directly exposed to the Internet, further increasing the risk of becoming a target of attack.

[0020] Power terminals include remote terminal units, distribution transformer remote terminals, distribution terminal units, feeder terminal units, operation and maintenance monitoring terminals, primary and secondary fusion terminals, meter terminals in the power consumption system, and smart home terminals behind the user's meter. These devices face a variety of security threats, including physical damage, unauthorized access or data theft caused by exposed hardware interfaces, hardware Trojan implantation, side channel analysis attacks, fault attacks, counterfeit chips, and reverse engineering. However, the flexible networking and diverse access methods of terminal devices have greatly increased the difficulty of security management and protection, allowing attackers to exploit more attack paths, making it difficult to effectively defend through unified endpoint protection measures.

[0021] In some embodiments, when executing step S1, the communication security threats include: air interface protocol attacks, channel attacks, wireless private network communication blocking, and time synchronization attacks; In fact, 5G power terminal communications tend to be wireless, but at the wireless access network level it faces threats such as air interface protocol attacks, channel attacks, wireless private network communication blockages, and time synchronization attacks.

[0022] Specifically, air interface protocol attacks include fake base station attacks, session hijacking, and location information capture. A fake base station attack is when an attacker disguises himself as a legitimate operator base station and communicates at an illegally used frequency, causing the user's device to switch from a legitimate base station to a fake base station, thereby collecting the user's terminal information, and even forging a sending number to forcibly send short messages to terminals in the coverage area. Session hijacking attacks exploit the vulnerability of the open-air interface to steal authenticated session IDs and control the flow of session flows, causing session interruption or redirection. Location information capture attacks use monitoring devices to sniff paging messages, verify whether the target user is within the interception range, and obtain their location information.

[0023] Furthermore, air channel attacks involve radio frequency interference and spectrum abuse. Attackers may intentionally disrupt network radio frequency by interfering with radio frequency signals, causing related users to be unable to access the core network and its related services. Spectrum resource abuse is when attackers imitate the signal characteristics of legitimate users, occupy specific idle spectrum, and cause the authorized frequency band to be occupied, thereby preventing other normal users from obtaining the required spectrum resources, seriously affecting the normal operation of power terminals.

[0024] In fact, the 230MHz frequency band of the national power grid is susceptible to interference due to its low-frequency characteristics. Attackers can use a small number of high-power interference sources to block the communication of a large number of terminals, endangering the security of the system. Attackers can set up a small number of high-power broadband full-frequency interference sources in the load center area to block the communication between a large number of IoT terminals and the power distribution and utilization backend system, causing the business system based on the wireless private network to fail. This situation may cause serious security risks in the future power system with a high proportion of renewable energy.

[0025] Specifically, IoT terminals rely on satellite time synchronization. Since GPS and Beidou satellite systems do not have encrypted communications, they are vulnerable to attacks from forged navigation messages, which can lead to time confusion and subsequent system failure. In addition, power IoT terminals usually need to regularly synchronize time with the background system to keep the time deviation between the terminal and the background within a limited range.

[0026] The backend of the IoT system usually obtains the time reference through satellite time synchronization devices, which rely on the Global Positioning System (GPS) or Beidou satellite clock. Since the GPS and Beidou satellite time synchronization systems use unencrypted civilian code communications and lack the security of encryption authentication, attackers can send forged satellite navigation messages based on the format definition of satellite navigation messages to induce the time synchronization device to output incorrect time. By causing time disorder between the main station and the terminal of the IoT system, attackers can trigger functional failures and misjudgments of the system and the terminal, thereby achieving sabotage attacks.

[0027] In some embodiments, when executing step S1, the network security threats include: nday vulnerabilities, denial of service attacks; Specifically, 5G power terminals face hardware, software and system security threats, including chip hardware design defects, denial of service attacks, exploitation of system, protocol and software vulnerabilities, and may also be attacked by viruses and Trojans.

[0028] In fact, denial of service attacks hinder services by exhausting network resources, making it impossible to provide normal services. Signaling storms are a common type of denial of service attacks in 5G networks. When a large number of terminal devices access the network at the same time and send authentication and access information, a signaling storm will be triggered, causing the network speed to drop sharply or even become blocked. In addition, devices that fail to access usually repeat requests, further exacerbating network congestion and increasing the energy consumption of terminal devices.

[0029] Furthermore, power terminal equipment is often developed without sufficient security considerations, resulting in vulnerabilities. Due to the wide distribution of equipment and slow updates, nday vulnerabilities pose a major threat to 5G power terminals. In the terminal design and development process, there is usually insufficient security consideration, which may lead to various vulnerabilities. In addition, due to the wide distribution of power terminal equipment and the large differences in software and hardware environments, the update iteration of systems and applications is often not timely, which makes the vulnerability repair cycle longer, making nday vulnerabilities a serious security threat to 5G power terminals.

[0030] In some embodiments, when executing step S1, the identity authentication security threat includes: the eSIM is attacked by a malicious eSIM file sent by a remote management platform; sensitive information is leaked in the transmission link between the terminal device, the operator's mobile communication network and the eSIM server; the process of transmitting, reading, writing and processing business data on the eSIM terminal is susceptible to illegal access or malicious tampering; Specifically, the authenticity of terminal devices, especially IoT devices, is the key to defending against security attacks. The non-access layer of the 5G network no longer relies on SIM cards to identify devices, especially IoT devices that use flexible authentication methods.

[0031] Power terminals widely use eSIM cards as user identity authentication and key carriers for accessing 5G networks. They face the risk of duplication, theft or tampering, which will directly affect the identity authentication security of the terminal. During the use and activation of eSIM, the eSIM file is downloaded to the terminal device via the public network in an air interface transmission mode, and the eSIM card in the terminal can be managed through the remote management platform. Therefore, compared with traditional fixed storage SIM cards, eSIM cards face more security threats, including the following attacks: First, the eSIM card may be attacked by malicious eSIM files sent by the remote management platform; second, during the air interface transmission process, there is a risk of sensitive information leakage in the transmission link between the eSIM file and the terminal device, the operator's mobile communication network and the eSIM server; in addition, in the process of transmitting, reading, writing and processing business data on the eSIM terminal, it is vulnerable to attacks such as illegal access or malicious tampering.

[0032] In some embodiments, when executing step S1, the data security threats include: inconsistent desensitization rules, insufficient risk behavior monitoring, and insufficient database operation and maintenance control.

[0033] Specifically, the inconsistency of desensitization rules is reflected in: Some power companies still use scripts or manual desensitization, and the desensitization rules are not unified, which leads to a series of problems such as low desensitization efficiency, poor data quality after desensitization, and destroyed correlation between data.

[0034] Furthermore, the lack of risk behavior monitoring is reflected in: Power companies are large in scale, have complex systems, and have a large number of employees. It is difficult to detect and locate illegal operations such as unauthorized access, downloading or tampering with data in daily work, which often causes problems for the prevention and investigation of internal data security incidents.

[0035] Furthermore, the inadequacy of database operation and maintenance control is reflected in: The database of power enterprises is in a risky state of being directly exposed to the Internet. The operation and maintenance personnel do not perform database operation and maintenance operations according to the operating specifications or established plans, illegally export sensitive data, and there are no fine-grained audit records for database operation behaviors. Unclear data classification and grading mainly involve data leakage, data tampering, data loss and other aspects.

[0036] In some embodiments, when executing step S1, the process of collecting the physical security threat includes: collecting log information based on the device operation log, collecting log information of the terminal device when the device restarts abnormally and the device configuration changes occur, and the log information includes: the failure frequency and failure type of the terminal device; collecting the temperature, humidity, smoke and water immersion of the environment in which the device is located based on physical environment sensors; when the distance between the unauthorized person and the device is less than the safety distance threshold, obtaining abnormal information based on the video surveillance anomaly detection system.

[0037] In some embodiments, when executing step S1, the process of collecting communication security threats includes: when an air interface protocol attack occurs, when the channel utilization and interference signal strength of the wireless private network exceed 230MHZ, the system will evaluate whether there is abnormally high-power channel congestion at the load center.

[0038] In some embodiments, when executing step S1, the process of collecting network security threats includes: the system detects the chip of the power terminal based on a security diagnostic tool, the system detects software vulnerabilities based on a vulnerability scanning tool, and identifies abnormal resource consumption and malicious process activities based on CPU, memory, and disk usage.

[0039] In some embodiments, when executing step S1, the process of collecting identity authentication security threats includes: collecting the identity authentication log of the eSIM card based on the identity information key exchange behavior, obtaining the IP address, terminal device identification and timestamp requested when the eSIM card is activated; the system collects the operation log of the eSIM card, the identity and operation type of the monitor collected by the remote management platform; based on the eSIM file data issued by the remote management platform, perform integrity verification on it.

[0040] In some embodiments, when executing step S1, the process of collecting data security threats includes: verifying the consistency of data before and after desensitization based on the frequency of use of desensitization rules; based on the anomaly detection system, the system will automatically collect operation log information triggered by the download and modification of sensitive data.

[0041] In some embodiments, when executing step S2, the reason for using one-hot encoding is that non-numeric features cannot be directly used as input of the RMSEN-BiLSTM model, so one-hot encoding is used to convert the non-numeric threat feature vector in the data set into a numerical threat feature vector.

[0042] In some embodiments, when executing step S2, the improved RMSEN-BiLSTM model is connected to 1 RMSEN layer and 2 BiLSTM layers from left to right, wherein the RMSEN layer is connected to 1 Conv layer, 3 RMSE layers, 1 normalization layer, 1 GAP layer and 1 fully connected layer from left to right, and each RMSE layer is composed of 4 convolutional layers, wherein the first 3 convolutional layers are connected from left to right, the 3rd convolutional layer is connected to a GAP layer, and the GAP layer is connected to the 4th convolutional layer.

[0043] Specifically, the GAP layer includes 3 structural layers connected in parallel from top to bottom, and each structural layer is connected to 1 FC layer, 1 BN layer, 1 RELU layer and 1 FC layer from left to right, wherein, in each structural layer, the first FC layer and the last FC layer are used to perform a jump connection mechanism on the pooled features according to the Sigmoid function and obtain fused features after weighting, and the fused features are passed to the 4th convolutional layer in the RMSE layer.

[0044] Furthermore, the RMSEN layer includes 13 convolutional layers in total, the size of the convolution kernel in each convolutional layer is 3, and the number of convolution kernels is 128, 256 and 512 respectively.

[0045] Furthermore, the RMSEN layer is used to adaptively adjust feature weights according to multiple parallel squeezing incentive mechanisms, two fully connected layers and activation functions, generate multiple weight vectors, and multiply and weight the multiple weight vectors with the threat feature vector to obtain the final output after the RMSE operation, wherein the squeezing incentive mechanism includes two parts, a squeezing operation and an incentive operation, wherein the squeezing operation is used to obtain global statistical information, and the incentive operation is used to obtain multiple weight vectors.

[0046] Furthermore, the mathematical expression of the extrusion operation is: ; The mathematical expression of the excitation operation is: ; The mathematical expression of the final output after the RMSE operation is: ; in, Representative The input size is Features, and They are sigmoid activation function and RELU activation function respectively. and Refers to the weights of the first and second fully connected layers respectively, represents the final output after RMSE operation, , , , represents multiple weight vectors, represents the sum operation, represents the feature representation vector obtained by a single residual squeezing excitation mechanism, Represents the global statistics generated by global average pooling, represents the extrusion operation, Represents the feature matrix The input size is The characteristics of The value of the element, Represents global statistics, Indicates statistical information Applying the weight matrix Operation, Indicates an incentive operation.

[0047] Furthermore, the mathematical expression of the skip connection mechanism is: ; in, Indicates input Perform convolution operation, is the convolution kernel weight, is the activation function, Represents the final output of the residual block.

[0048] See also Figure 2 The residual multi-head squeezing network (RMSEN) consists of 1 convolutional layer (Conv layer), 3 RMSE layers, and a BN layer, connected to the RELU activation function and the GAP layer. The GAP layer is followed by a fully connected layer (FC layer), and the fully connected layer is followed by 2 BiLSTM layers. The BiLSTM layer includes: a sequentially connected FC layer, a bidirectional LSTM network, and a FC layer. Finally, the classification result is output through a Softmax classifier.

[0049] In each RMSE layer, there are 4 Conv layers in common, among which the 3rd Conv layer is jump-connected to the 4th Conv layer through the GAP layer. The GAP layer includes 3 upper and lower parallel structural layers. Each structural layer is connected to 1 FC layer, 1 BN layer, 1 RELU layer and 1 FC layer from left to right. Among them, in each structural layer, the first FC layer and the last FC layer are used to perform jump connection mechanism on the pooled features according to the Sigmoid function and obtain fused features after weighting, and the fused features are passed to the 4th convolutional layer in the RMSE layer.

[0050] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A 5G power terminal access threat detection method based on hybrid deep learning, characterized in that: include: Establish and collect a risk factor set, and use the risk factor set as a threat feature vector, wherein the risk factor set consists of physical security threats, communication security threats, network security threats, identity authentication security threats, and data security threats of 5G power terminals, and the threat feature vector consists of numerical threat feature vectors and non-numerical threat feature vectors; Based on multiple parallel squeezing incentive mechanisms and multiple jump connection mechanisms, an improved RMSEN-BiLSTM model is obtained, and the non-numerical threat feature vector and the numerical threat feature vector are respectively uniquely hot encoded and normalized and input into the improved RMSEN-BiLSTM model to obtain a threat classification result.

2. According to claim 1, a 5G power terminal access threat detection method based on hybrid deep learning is characterized in that: The physical security threats include: physical damage, unauthorized access caused by exposed hardware interfaces, data theft, hardware Trojan horse implantation, side channel analysis attacks, fault attacks, counterfeit chips and reverse engineering; The communication security threats include: air interface protocol attacks, channel attacks, wireless private network communication blocking, and time synchronization attacks; The network security threats include: nday vulnerabilities, denial of service attacks; The identity authentication security threats include: eSIM is attacked by malicious eSIM files sent by the remote management platform; sensitive information is leaked in the transmission link between the terminal device, the operator's mobile communication network and the eSIM server; the process of transmitting, reading, writing and processing business data on the eSIM terminal is vulnerable to illegal access or malicious tampering; The data security threats include: inconsistent desensitization rules, insufficient monitoring of risky behaviors, and insufficient database operation and maintenance control.

3. According to a 5G power terminal access threat detection method based on hybrid deep learning according to claim 1, it is characterized in that: The process of collecting the physical security threat includes: collecting log information based on the device operation log, collecting the log information of the terminal device when the device restarts abnormally and the device configuration changes, and the log information includes: the failure frequency and failure type of the terminal device; collecting the temperature, humidity, smoke and water immersion of the environment where the device is located based on the physical environment sensor; when the distance between the unauthorized person and the device is less than the safety distance threshold, obtaining abnormal information based on the video surveillance abnormality detection system; The process of collecting communication security threats includes: when an air interface protocol attack occurs, when the channel utilization rate and interference signal strength of the wireless private network exceed 230MHZ, the system will evaluate whether there is abnormally high-power channel congestion at the load center; The process of collecting network security threats includes: the system detects the chips of power terminals based on security diagnostic tools, the system detects software vulnerabilities based on vulnerability scanning tools, and identifies abnormal resource consumption and malicious process activities based on CPU, memory, and disk usage; The process of collecting identity authentication security threats includes: collecting the identity authentication log of the eSIM card based on the identity information key exchange behavior, obtaining the IP address, terminal device identification and timestamp requested when the eSIM card is activated; the system collects the operation log of the eSIM card, the identity of the monitor and the operation type collected by the remote management platform; based on the eSIM file data issued by the remote management platform, it performs integrity verification on it; The process of collecting data security threats includes: verifying the consistency of data before and after desensitization based on the frequency of use of desensitization rules; based on the anomaly detection system, the system will automatically collect operation log information triggered by the download and modification of sensitive data.

4. According to a 5G power terminal access threat detection method based on hybrid deep learning according to claim 1, it is characterized in that: The improved RMSEN-BiLSTM model is connected from left to right in sequence with 1 RMSEN layer and 2 BiLSTM layers, wherein the RMSEN layer is connected from left to right in sequence with 1 Conv layer, 3 RMSE layers, 1 normalization layer, 1 GAP layer and 1 fully connected layer, and each RMSE layer is composed of 4 convolutional layers, wherein the first 3 convolutional layers are connected from left to right in sequence, the 3rd convolutional layer is connected to a GAP layer, and the GAP layer is connected to the 4th convolutional layer.

5. According to claim 4, a 5G power terminal access threat detection method based on hybrid deep learning is characterized in that: The GAP layer includes three structural layers connected in parallel from top to bottom, and each structural layer is connected to one FC layer, one BN layer, one RELU layer and one FC layer from left to right. Among them, in each structural layer, the first FC layer and the last FC layer are used to perform a jump connection mechanism on the pooled features according to the Sigmoid function and obtain fused features after weighting, and the fused features are passed to the fourth convolutional layer in the RMSE layer.

6. According to claim 4, a 5G power terminal access threat detection method based on hybrid deep learning is characterized in that: The RMSEN layer includes 13 convolutional layers in total. The size of the convolution kernel in each convolutional layer is 3, and the number of convolution kernels is 128, 256 and 512 respectively.

7. According to claim 4, a 5G power terminal access threat detection method based on hybrid deep learning is characterized in that: The RMSEN layer is used to adaptively adjust feature weights according to multiple parallel squeezing incentive mechanisms, two fully connected layers and activation functions, generate multiple weight vectors, and multiply and weight the multiple weight vectors with the threat feature vector to obtain the final output after the RMSE operation, wherein the squeezing incentive mechanism includes a squeezing operation and an incentive operation, wherein the squeezing operation is used to obtain global statistical information, and the incentive operation is used to obtain multiple weight vectors.

8. According to claim 7, a 5G power terminal access threat detection method based on hybrid deep learning is characterized in that: The mathematical expression of the extrusion operation is: ； The mathematical expression of the excitation operation is: ； The mathematical expression of the final output after the RMSE operation is: ； in, Representative The input size is Features, and They are sigmoid activation function and RELU activation function respectively. and Refers to the weights of the first and second fully connected layers respectively, represents the final output after RMSE operation, , , , represents multiple weight vectors, represents the sum operation, represents the feature representation vector obtained by a single residual squeezing excitation mechanism, Represents the global statistics generated by global average pooling, represents the extrusion operation, Represents the feature matrix The input size is The characteristics of The value of the element, Represents global statistics, Indicates statistical information Applying the weight matrix Operation, Indicates an incentive operation.

9. According to a 5G power terminal access threat detection method based on hybrid deep learning according to claim 1, it is characterized in that: The mathematical expression of the skip connection mechanism is: ； in, Indicates input Perform convolution operation, is the convolution kernel weight, is the activation function, Represents the final output of the residual block.

Images