An alarm information analysis method, system, device and storage medium

Abstract

The application discloses an alarm information analysis method, system, device and storage medium, comprising: acquiring an alarm log of a power network system, extracting a plurality of words in the alarm log, and generating a word vector set corresponding to the words; inputting the word vector set into a Transformer encoder and an HDP topic model respectively to obtain a local feature vector set and a global feature vector set respectively; performing feature fusion on the local feature vector set and the global feature vector set to obtain a comprehensive feature vector set; calculating the similarity of the comprehensive feature vector set through a Gaussian kernel function, and clustering and confirming an alarm category according to the similarity. The application can improve the identification accuracy and comprehensiveness of the power grid attack type, so as to accurately judge the attack category that the power grid may suffer.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to an alarm information analysis method, system, device and storage medium. BACKGROUND

[0002] The current power system is highly coupled with the information system, so the power system often faces the risk of network attacks, and with the continuous development of informationization of the power system, the access records generated by the power network system present an explosive growth, and some abnormal access records are alarm information.

[0003] In the prior art, since the alarm information does not have obvious labels, it often needs to be screened and judged by artificial means, so there are problems of abnormal diagnosis, low diagnosis efficiency, omission and misjudgment. Therefore, how to identify alarm information from massive information, analyze and judge the possible attacks on the power network system, and improve the maintenance efficiency of the power network system is a key problem. SUMMARY

[0004] The present application provides an alarm information analysis method, system, device and storage medium, which can improve the identification accuracy and comprehensiveness of the attack type of the power grid, so as to accurately judge the attack category that the power grid may suffer.

[0005] In a first aspect, the present application provides an alarm information analysis method, comprising:

[0006] Obtaining an alarm log of a power network system, extracting a plurality of words in the alarm log, and generating a word vector set corresponding to the words;

[0007] Inputting the word vector set into a Transformer encoder and an HDP topic model respectively to obtain a local feature vector set and a global feature vector set respectively;

[0008] Performing feature fusion on the local feature vector set and the global feature vector set to obtain a comprehensive feature vector set;

[0009] Calculating the similarity of the comprehensive feature vector set by a Gaussian kernel function, and clustering according to the similarity to confirm the alarm category.

[0010] The embodiments of the present application can accurately obtain the feature information contained in each word in the alarm log by extracting a plurality of words in the alarm log and generating a corresponding word vector set; by inputting the word vector set into a Transformer encoder and an HDP topic model respectively, a local feature vector set and a global feature vector set are obtained respectively, which can fully mine the information of the alarm log, accurately grasp the feature information contained in a single word and the theme information exhibited by a single word in the whole word, and further accurately grasp the semantic information of the alarm log; by using the fusion mode of the global feature vector set and the local feature vector set, the information of the alarm log is more comprehensively and accurately captured to improve the accuracy of subsequent similarity calculation; the similarity of the comprehensive feature vector set is calculated by a Gaussian kernel function, and the alarm logs with high semantic similarity are simplified into specific categories through clustering, so that the possible network attack categories suffered by the power grid can be accurately judged, and the identification accuracy and comprehensiveness of the power grid attack type are improved.

[0011] Further, the alarm log of the power network system is obtained, specifically:

[0012] The log record of the power network system is obtained.

[0013] The log record is format corrected and duplicate items are removed to obtain a cleaned log record.

[0014] Alarm keywords are set, and log records containing the alarm keywords are retained to obtain an alarm log.

[0015] In this way, by sequentially cleaning and filtering the log record, format error log records and normal log records can be removed, and alarm logs are retained to avoid false classification due to problems of the alarm log itself.

[0016] Further, the plurality of words in the alarm log are extracted, and a word vector set corresponding to the words is generated, specifically:

[0017] The plurality of words in the alarm log are segmented and stop words are removed by NLTK to obtain a word set.

[0018] The word set is input into a Word2vec model to obtain a word vector set corresponding to the words in the alarm log.

[0019] In this way, by segmenting the plurality of words in the alarm log and generating a corresponding word vector set, the feature information contained in each word in the alarm log can be accurately obtained.

[0020] Further, the local feature vector set is obtained, specifically:

[0021] fill information to vectors in the word vector set, unify lengths of vectors in the word vector set;

[0022] perform position encoding on a plurality of words in the alarm log to obtain position vectors corresponding to the words in the alarm log;

[0023] fuse the word vector set with unified lengths and the position vectors corresponding to the words to obtain an input word vector set;

[0024] input the input word vector set into a Transformer encoder to obtain an attention value set;

[0025] perform residual connection on the attention value set and the input word vector set, and perform layer normalization on a residual connection result to obtain a local feature vector set in the alarm log.

[0026] In this way, by filling the vectors in the word vector set to obtain the input word vector set, the lengths of samples in the alarm log can be kept consistent, and by introducing fusion of the word vector set and the position vectors corresponding to the words, the problem that the Transformer encoder cannot distinguish the position information of the words can be effectively solved. In addition, by performing residual connection on the attention value set and the input word vector set and performing layer normalization, the feature information contained in a single word can be accurately grasped, and thus the semantic information of the alarm log can be accurately grasped.

[0027] Further, the inputting of the input word vector set into the Transformer encoder to obtain the attention value set specifically comprises:

[0028] based on the input word vector set, obtaining a Query vector set, a Key vector set and a Value vector set;

[0029] performing dot product calculation on vectors in the Query vector set and the Key vector set to obtain attention scores of words in the alarm log;

[0030] scaling the attention scores and performing normalization processing through a function to obtain attention weights of the words in the alarm log;

[0031] based on the attention weights and the vector set, obtaining an attention value set of the words in the alarm log.

[0032] In this way, by inputting the input word vector set into the Transformer encoder, the syntactic and semantic features between the words in the same sentence can be captured.

[0033] Further, the global feature vector set is obtained, in particular:

[0034] The semantic feature weight set in the alarm log is calculated.

[0035] Based on the semantic feature weight set, a keyword set in the alarm log is extracted.

[0036] The keyword set is input into the HDP topic model to obtain a global feature vector set in the alarm log.

[0037] Thus, the HDP topic model can accurately obtain the theme information of a single word in the overall word and accurately grasp the semantic information of the alarm log.

[0038] Further, the semantic feature weight set in the alarm log is calculated, in particular:

[0039] Based on the cosine similarity between a plurality of vectors in the word vector set, a semantic similarity weight set is obtained.

[0040] The number of times of co-occurrence of words in the alarm log is counted to obtain a word co-occurrence weight set.

[0041] The term frequency weight set of the words in the alarm log is calculated based on TF-IDF.

[0042] Based on the semantic similarity weight set, the word co-occurrence weight set and the term frequency weight set, the semantic feature weight set in the alarm log is obtained.

[0043] Thus, by considering the semantic similarity weight, the word co-occurrence weight and the term frequency weight, the semantic feature weight is further confirmed, the information of the alarm log is fully mined, the theme information of a single word in the overall word is accurately grasped, and the semantic information of the alarm log is accurately grasped.

[0044] In a second aspect, the application provides an alarm information analysis system, comprising: an acquisition module, a feature obtaining module, a fusion module and a category confirming module.

[0045] The acquisition module is used to acquire an alarm log of a power network system, extract a plurality of words in the alarm log, and generate a word vector set corresponding to the words.

[0046] The feature obtaining module is used to input the word vector set into a Transformer encoder and an HDP topic model respectively to obtain a local feature vector set and a global feature vector set respectively.

[0047] The fusion module is configured to fuse the local feature vector set and the global feature vector set to obtain a comprehensive feature vector set.

[0048] The category confirmation module is configured to calculate the similarity of the comprehensive feature vector set by using a Gaussian kernel function, and confirm the alarm category according to the similarity.

[0049] The embodiments of the present application can accurately obtain the feature information contained in each word in the alarm log by extracting a plurality of words in the alarm log and generating a corresponding word vector set. The local feature vector set and the global feature vector set are obtained by respectively inputting the word vector set into a Transformer encoder and an HDP topic model, which can fully mine the information of the alarm log, accurately grasp the feature information contained in a single word and the topic information exhibited by a single word in the whole word, and further accurately grasp the semantic information of the alarm log. The global feature vector set and the local feature vector set are fused to more comprehensively and accurately capture the information of the alarm log, so as to improve the accuracy of subsequent similarity calculation. The similarity of the comprehensive feature vector set is calculated by using a Gaussian kernel function, and the alarm logs with high semantic similarity are simplified into specific categories by clustering, so that the possible network attack categories suffered by the power grid can be accurately determined, and the identification accuracy and comprehensiveness of the attack type of the power grid are improved.

[0050] In a third aspect, the present application provides a terminal device, characterized by comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the alarm information analysis method as described in the present application when executing the computer program.

[0051] In a fourth aspect, the present application provides a computer readable storage medium, characterized by comprising a stored computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to execute the alarm information analysis method as described in the present application when the computer program runs. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 is a flowchart of an embodiment of the alarm information analysis method provided by the present application;

[0053] Figure 2 is a scene diagram for confirming the alarm category provided by the present application;

[0054] Figure 3 is a flowchart of another embodiment of the alarm information analysis method provided by the present application;

[0055] Figure 4is a structural schematic diagram of an embodiment of an alarm information analysis system provided by the present application;

[0056] Figure 5 is a structural schematic diagram of a terminal device provided by the present application. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0058] It should be understood that the step numbers used herein are only for the convenience of description, and are not intended to limit the execution sequence of the steps.

[0059] It should be understood that the terms used in the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the present application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0060] The terms "comprise" and "include" indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not exclude one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0061] The term "and / or" refers to any combination of one or more of the associated listed items and all possible combinations thereof, and includes these combinations.

[0062] NLTK is a python-based open source word segmentation project, which can divide continuous word sequences into independent word sequences according to certain specifications, has the functions of simple word segmentation, command line word segmentation, part-of-speech tagging, and word position query, NLTK has a stop word library, which contains common but not substantive stop words in text.

[0063] Word2Vec model is a word embedding technology that can map words to vector space, which can convert words into dense low-dimensional vectors and preserve the semantic relationship in words, there are CBOW (continuous bag-of-word) and Skip-Gram (Continuous skip-gram Model) two algorithms, both of which train text data through shallow neural networks, and input text words into the model to get the corresponding word vectors.

[0064] The encoder of the Transformer uses an attention mechanism, because the attention mechanism can capture the syntactic and semantic features between words in the same sentence, and retain long-distance dependency features in the sentence. The Transformer encodes the entire input sequence and outputs attention encoding. The encoder is stacked by multiple layers of the same structure. Each layer of the structure is mainly composed of a multi-head attention and a feedforward neural network. The position encoding used by the Transformer is absolute position encoding.

[0065] TF-IDF (Term Frequency-Inverse Document Frequency) is a commonly used weighting technique in text mining, which is used to evaluate the importance of a word to a text. TF represents the frequency of a word, and the higher the frequency of a keyword in a text, the more important it is. IDF represents the universality of a word, and the higher the frequency of a file containing the word, the less important it is.

[0066] Please refer to Figure 1 The flowchart of the alarm information analysis method provided by the embodiment of the application comprises steps S1 to S4.

[0067] Step S1, obtaining the alarm log of the power network system, extracting a plurality of words in the alarm log, and generating a word vector set corresponding to the words; comprising steps S11 and S12.

[0068] Specifically, step S11, obtaining the alarm log of the power network system, specifically:

[0069] Obtaining the log record of the power network system; correcting the format of the log record and removing duplicates to obtain the cleaned log record; retaining the log record containing the alarm keyword by setting the alarm keyword to obtain the alarm log.

[0070] It should be noted that when correcting the format of the log record, a correct format regular expression needs to be designed first, and the log record with incorrect format is removed through the regular expression; and the specific operation of removing duplicates is to prepare an empty list, traverse all log records, and if the log record does not exist in the list, add it to the list, otherwise do not add it, and when the traversal is completed, the cleaned log record is obtained.

[0071] In this way, by sequentially cleaning and filtering the log record, the log record with incorrect format and the normal log record can be removed, and the alarm log is retained, so that incorrect classification is avoided due to problems of the alarm log itself.

[0072] Specifically, step S12, extracting a plurality of words in the alarm log, and generating a word vector set corresponding to the words, specifically:

[0073] The alarm log was segmented and stop words were removed using NLTK to obtain a word set {w1, w2, ..., w...}. p ,…,w q}; where w q This means that after removing stop words, the q-th word is retained, where q is the total number of words included.

[0074] Let the word set {w1, w2, ..., w p ,…,w q Input the Word2vec model to obtain the set of word vectors {v} corresponding to the words in the alarm log. a ,v b ,…,v p ,…,v q}, where v q It is the qth word. q The corresponding word vectors.

[0075] It should be noted that NLTK's built-in stop word list can remove meaningless words from the word set. That is, it iterates through all words in the word set, checks whether they are in the stop word list, and removes them from the word set if they exist.

[0076] By segmenting several words in the alarm log and generating corresponding word vector sets, the feature information contained in each word in the alarm log can be accurately obtained.

[0077] Step S2: Input the word vector set into the Transformer encoder and the HDP topic model respectively to obtain the local feature vector set and the global feature vector set respectively;

[0078] Specifically, the process of obtaining the local feature vector set is as follows:

[0079] Confirm the word vector set {v a ,v b ,…,v p ,…,v q The longest length of the word vectors in the set is determined by filling information into the vectors in the set of word vectors to unify the length of the vectors in the set of word vectors;

[0080] The alarm log is encoded using alternating combinations of sine and cosine functions to obtain the encoding element corresponding to each position, resulting in a position vector corresponding to each word in the alarm log; wherein the sine and cosine functions are respectively:

[0081]

[0082] In the formula, pos is the position index, j is the dimension index, and d is the position index.k It is the word vector dimension.

[0083] The word vector set with uniform length is summed element-wise with the position vectors corresponding to the words to achieve vector fusion, resulting in the input word vector set {input}. i1 input i2 ,…,input im ,…,input in};

[0084] The input word vector set is input into the Transformer encoder to obtain the attention value set; specifically:

[0085] Based on the input word vector set {input i1 input i2 ,…,input im ,…,input in}, multiply by the three weight matrices W obtained during training respectively. q W k W v This yields a set of query vectors, a set of key vectors, and a set of value vectors.

[0086] The attention score {Score} of the words in the alarm log is obtained by performing a dot product calculation on the vectors in the Query vector set and the Key vector set. 1,1 Score 1,2 Score 1,q The formula for calculating the dot product is:

[0087]

[0088] In the formula, Word m For the target words, Word n For the scoring words, Q m,j K is the j-th element of the target word Query vector. n,j This is the j-th element of the Key vector for the rating term.

[0089] For the attention score {Score 1,1 Score 1,2 Score 1,q} Scaling is performed, where the scaling formula is:

[0090]

[0091] In the formula, ScoreScale(Word m Wordn ) represents the scaling result, d k Score (Word) is the word vector dimension. m Word n () represents the attention score.

[0092] The attention weights of words in the alarm log are obtained by normalizing the data using the softmax function; the normalization formula is as follows:

[0093]

[0094] Among them, SoftWeight (Word m Word n ) represents the attention weight, ScoreScale(Word) m Word n ) represents the scaling result, and p represents the total number of words.

[0095] It should be noted that, due to the vector filling operation performed earlier, in order to prevent attention from being focused on the filling position, the attention score of 0 is replaced with negative infinity, and its weight is calculated as 0. The attention weight is between 0 and 1.

[0096] Based on the attention weights and the set of value vectors, a weighted sum is performed to obtain the set of attention values ​​{Atten} for the words in the alarm log. i,1 Atten i,2 ,…,Atten i,m}, where the formula for calculating and summing attention values ​​is:

[0097]

[0098] Among them, Atten i,m For alarm log l i The attention vector of the m-th word, SoftWeight(Word) m Word n ) represents the attention weight, Value j Let j be the j-th Value vector.

[0099] Finally, the attention value set and the input word vector set are residually concatenated, and the residual concatenation result is subjected to layer normalization to obtain the local feature vector set {Atten1, Atten2, ..., Atten...} in the alarm log. N}

[0100] It should be noted that the local feature vector is the representation vector after extracting contextual features from a single alarm log.

[0101] By filling the vectors of the word vector set to obtain the input word vector set, the sample length in the alarm log can be kept consistent. At the same time, by fusing the word vector set with the position vectors corresponding to the words, the problem that the subsequent Transformer encoder cannot distinguish the position information of the words can be effectively solved. In addition, by performing residual connection and layer normalization on the attention value set and the input word vector set, the feature information contained in a single word can be accurately grasped, thereby accurately grasping the semantic information of the alarm log.

[0102] Specifically, the process of obtaining the global feature vector set is as follows:

[0103] Calculate the set of semantic feature weights in the alarm log; specifically:

[0104] Based on the cosine similarity between several vectors in the word vector set, a semantic similarity weight set is obtained; wherein, the semantic similarity weight function is:

[0105]

[0106] In the formula, SimWeight(w i ,Log) refers to the w in the alarm log Log. i The semantic similarity weight, WS(w i ,w j The two words "w" in the alarm log are... i ,w j The cosine similarity, where p is the total number of words.

[0107] The frequency of co-occurrence of words in the alarm logs is counted to obtain a set of word co-occurrence weights; the word co-occurrence weight function is:

[0108]

[0109] In the formula, CoWeight(w i ,Log) refers to the w in the alarm log Log. i Word co-occurrence weight, WordCo(w i ,w j ) is the word w i With the word w j The number of times the word co-occurs, where k is the total number of alarm logs.

[0110] The term frequency weight set of words in the alarm log is calculated based on TF-IDF; wherein, the formula for calculating the term frequency weight is:

[0111]

[0112] In the formula, FreWeight(w i ,Log) refers to the w in the alarm log Log. i The word frequency weight, n i,j For the word w i In the alarm log j The number of times it appears in n k,j For the word w k In the alarm log j The number of times it appears in the log, |D| is the total number of all alarm logs, |j:w i ∈l j | indicates the word w i The number of alarm logs.

[0113] It should be noted that the FreWeight value is represented by the TF-IDF value, where TF is the frequency of the word in the alarm log and IDF is the prevalence of the word in the document.

[0114] Based on the semantic similarity weight set, the word co-occurrence weight set, and the word frequency weight set, the semantic feature weight set in the alarm log is obtained, wherein the formula for calculating the semantic feature weight is:

[0115] SemFeaWeight(w i Log) =

[0116] SimWeight(w i ,Log)*CoWeight(w i ,Log)*FreWeight(w i ,Log);

[0117] In the formula, SemFeaWeight(w i ,Log) refers to the word w in the alarm log Log. i The semantic feature weights, SimWeight(w) i ,Log) refers to the w in the alarm log Log. i The semantic similarity weight, CoWeight(w) i ,Log) refers to the w in the alarm log Log. i Word co-occurrence weight, FreWeight(w i ,Log) refers to the w in the alarm log Log. i Word frequency weighting.

[0118] It should be noted that the semantic similarity weight is the average of the sum of the semantic similarities between a word and other words in the alarm log; the word co-occurrence weight is the average number of times a word appears together with other words in the alarm log, divided by the number of times the word appears in the document; and the word frequency weight is calculated by the frequency of the word in the alarm log and the prevalence of the word in the document.

[0119] Based on the semantic feature weight set, extract the keyword set {Word1, Word2, ..., Word...} from the alarm log. k};

[0120] It should be noted that the keywords are sorted according to the weight of semantic features, and the keyword retention ratio is defined based on the number of words contained in the alarm log, thereby determining the number of keywords to be retained.

[0121] The keyword set {Word1,Word2,…,Word} k Input the HDP topic model to obtain the global feature vector set {vec1,vec2,…,vec} in the alarm log. i ,…,vec N}

[0122] It should be noted that the global feature vector is a representation vector after extracting the topic information features from the alarm log.

[0123] By considering semantic similarity weights, word co-occurrence weights, and word frequency weights, and then confirming semantic feature weights, we can fully mine the information in alarm logs. Furthermore, through the HDP topic model, we can accurately obtain the topic information displayed by individual words in the overall word list, and accurately grasp the semantic information of alarm logs.

[0124] Step S3: Perform feature fusion on the local feature vector set and the global feature vector set to obtain a comprehensive feature vector set;

[0125] Specifically, the local feature vector set {Atten1, Atten2, ..., Atten...} N} and the global feature vector set {vec1,vec2,…,vec i ,…,vec N The feature fusion is completed by concatenating the features to obtain the final comprehensive feature vector set {Atten1:vec1, Atten2:vec2,…,Atten}. N :vec N}

[0126] By fusing global and local feature vector sets, alarm log information can be captured more comprehensively and accurately, thereby improving the accuracy of subsequent similarity calculations.

[0127] Step S4: Calculate the similarity of the comprehensive feature vector set using the Gaussian kernel function, and perform clustering based on the similarity to confirm the alarm category;

[0128] Specifically, the similarity of the comprehensive feature vector set is calculated using a Gaussian kernel function, and spectral clustering is performed on the samples in the graph space. The model parameters of the spectral clustering are adjusted through multiple training iterations to obtain the optimal spectral clustering result, thereby confirming the category corresponding to the alarm log, and thus determining the network attack category. A schematic diagram illustrating the scenario for confirming the alarm category is shown below. Figure 2 As shown;

[0129] The formula for calculating the Gaussian kernel function is as follows:

[0130]

[0131] In the formula, x i ,x j Given two vector samples, ||x i -x j || represents the Euclidean distance between two vector samples, and σ is the bandwidth parameter of the Gaussian kernel function.

[0132] It's important to note that spectral clustering is a clustering model capable of handling nonlinear clustering structures. A key feature of spectral clustering as a clustering model is the incorporation of graph theory, transforming data into points in space. The similarity of textual data is then labeled with the distance between points and the weight of edges, and clustering is completed through eigenvalue decomposition of the graph. Furthermore, spectral clustering has the advantage of obtaining a globally optimal solution.

[0133] In this way, the similarity of the comprehensive feature vector set is calculated using a Gaussian kernel function, and alarm logs with high semantic similarity are simplified into specific categories through clustering.

[0134] It should be noted that this application can use alarm logs, which mainly consider attack categories such as brute-force attacks, eavesdropping attacks, XSS attacks, SQL injection attacks, DoS attacks, DDoS attacks, MITM attacks, and session hijacking attacks, as core clustering data for power system network attacks. After clustering processing, corresponding clusters are obtained, and their respective categories are determined, thus completing the clustering.

[0135] This application embodiment extracts several words from the alarm log and generates corresponding word vector sets, which can accurately obtain the feature information contained in each word in the alarm log. By inputting the word vector sets into the Transformer encoder and the HDP topic model respectively, local feature vector sets and global feature vector sets are obtained respectively. This process can fully mine the information of the alarm log, accurately grasp the feature information contained in a single word and the topic information displayed by a single word in the whole word, and thus accurately grasp the semantic information of the alarm log. By using the fusion of global feature vector sets and local feature vector sets, the information of the alarm log is captured more comprehensively and accurately, thereby improving the accuracy of subsequent similarity calculations. By calculating the similarity of the comprehensive feature vector sets using a Gaussian kernel function and simplifying alarm logs with high semantic similarity into specific categories through clustering, the types of network attacks that the power grid may suffer can be accurately determined, thereby improving the accuracy and comprehensiveness of power grid attack type identification.

[0136] This application also provides Figure 3 For ease of understanding, Figure 3 This is a flowchart illustrating another embodiment of the alarm information analysis method provided in this application, wherein... Figure 3 The steps involved have been detailed above and will not be repeated here.

[0137] Please refer to Figure 4 , Figure 4 A schematic diagram of an alarm information analysis system provided in an embodiment of the present invention includes: an acquisition module 01, a feature acquisition module 02, a fusion module 03, and a category confirmation module 04;

[0138] The acquisition module 01 is used to acquire alarm logs of the power network system, extract several words from the alarm logs, and generate a set of word vectors corresponding to the words.

[0139] The feature acquisition module 02 is used to input the word vector set into the Transformer encoder and the HDP topic model respectively, and obtain the local feature vector set and the global feature vector set respectively;

[0140] The fusion module 03 is used to fuse the local feature vector set and the global feature vector set to obtain a comprehensive feature vector set.

[0141] The category confirmation module 04 is used to calculate the similarity of the comprehensive feature vector set through the Gaussian kernel function, and to perform clustering based on the similarity to confirm the alarm category.

[0142] The information interaction and execution process between the modules in the above-mentioned alarm information analysis system are based on the same concept as the embodiment of the alarm information analysis method of the first aspect of the present invention, and the technical effects achieved are basically the same. For details, please refer to the description in the first embodiment of the method of the present invention, which will not be repeated here.

[0143] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the method in this embodiment, depending on actual needs.

[0144] Figure 5 This is a structural diagram of a terminal device. (Example) Figure 5 As shown, the terminal device 5 in this embodiment includes: at least one processor 501 ( Figure 5 (Only one is shown) a processor, a memory 502, and a computer program 503 stored in the memory 502 and executable on at least one processor 501, wherein the processor 501 executes the computer program 503 to implement the steps in any of the above method embodiments.

[0145] Terminal device 5 may be a computing device such as a smartphone, laptop, tablet, or desktop computer. This terminal device may include, but is not limited to, a processor 501 and a memory 502. Those skilled in the art will understand that... Figure 5 This is merely an example of terminal device 5 and does not constitute a limitation on terminal device 5. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0146] The processor 501 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0147] In some embodiments, memory 502 may be an internal storage unit of terminal device 5, such as a hard disk or memory of terminal device 5. In other embodiments, memory 502 may be an external storage device of terminal device 5, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on terminal device 5. Furthermore, memory 502 may include both internal and external storage units of terminal device 5. Memory 502 is used to store operating system, applications, bootloader, data, and other programs, such as program code for computer programs. Memory 502 may also be used to temporarily store data that has been output or will be output.

[0148] In addition, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the alarm information analysis method as described in Embodiment 1 above.

[0149] This application provides a computer program product that, when run on a terminal device, enables the terminal device to implement the steps described in the various method embodiments above.

[0150] In the several embodiments provided in this application, it will be understood that each block in the flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the figures. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved.

[0151] If a function is implemented as a software module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a terminal device to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0152] In summary, the alarm information analysis method, system, device, and storage medium provided by this invention can accurately obtain the feature information contained in each word in the alarm log by extracting several words from the alarm log and generating corresponding word vector sets. By inputting the word vector sets into the Transformer encoder and the HDP topic model respectively, local feature vector sets and global feature vector sets are obtained respectively. This process can fully mine the information of the alarm log, accurately grasp the feature information contained in a single word and the topic information displayed by a single word in the whole word, and thus accurately grasp the semantic information of the alarm log. By using the fusion of global feature vector sets and local feature vector sets, the information of the alarm log is captured more comprehensively and accurately, thereby improving the accuracy of subsequent similarity calculations. By calculating the similarity of the comprehensive feature vector sets using a Gaussian kernel function and simplifying alarm logs with high semantic similarity into specific categories through clustering, the types of network attacks that the power grid may suffer can be accurately determined, thereby improving the accuracy and comprehensiveness of power grid attack type identification.

[0153] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A method for analyzing alarm information, characterized in that, include: Obtain alarm logs from the power network system, extract several words from the alarm logs, and generate a set of word vectors corresponding to the words; The word vector set is input into the Transformer encoder and the HDP topic model respectively to obtain the local feature vector set and the global feature vector set respectively; The local feature vector set and the global feature vector set are fused to obtain a comprehensive feature vector set. The similarity of the comprehensive feature vector set is calculated using a Gaussian kernel function, and clustering is performed based on the similarity to confirm the alarm category; Specifically, obtaining the local feature vector set involves: unifying the length of the vectors in the word vector set by filling information into the vectors in the word vector set; performing position encoding on several words in the alarm log to obtain the position vectors corresponding to the words in the alarm log; fusing the word vector set with the unified length with the position vectors corresponding to the words to obtain the input word vector set; inputting the input word vector set into a Transformer encoder to obtain the attention value set; performing a residual connection between the attention value set and the input word vector set, and performing layer normalization on the residual connection result to obtain the local feature vector set in the alarm log. Specifically, obtaining the global feature vector set involves: calculating the semantic feature weight set in the alarm log; extracting the keyword set in the alarm log based on the semantic feature weight set; and inputting the keyword set into the HDP topic model to obtain the global feature vector set in the alarm log.

2. The alarm information analysis method according to claim 1, characterized in that, The acquisition of alarm logs from the power network system specifically involves: Obtain log records from the power network system; The log records are formatted and duplicates are removed to obtain cleaned log records; By setting alarm keywords, log records containing the alarm keywords are retained to obtain alarm logs.

3. The alarm information analysis method according to claim 1, characterized in that, The step of extracting several words from the alarm log and generating a set of word vectors corresponding to the words is as follows: The alarm log is segmented and stop words are removed using NLTK to obtain a word set. The set of words is input into the Word2vec model to obtain the set of word vectors corresponding to the words in the alarm log.

4. The alarm information analysis method according to claim 1, characterized in that, The step of inputting the set of input word vectors into the Transformer encoder to obtain the set of attention values ​​is specifically as follows: Based on the input word vector set, we obtain the Query vector set, the Key vector set, and the Value vector set; Attention scores for words in the alarm log are obtained by performing a dot product on the vectors in the Query vector set and the Key vector set. Scale the attention score and, through The function performs normalization to obtain the attention weights of the words in the alarm log; Based on the attention weight and the The vector set is used to obtain the attention value set of words in the alarm log.

5. The alarm information analysis method according to claim 1, characterized in that, The calculation of the semantic feature weight set in the alarm log is specifically as follows: Based on the cosine similarity between several vectors in the word vector set, a semantic similarity weight set is obtained; The number of times words co-occur in the alarm logs is counted to obtain a set of word co-occurrence weights. The word frequency weight set of the words in the alarm log is calculated based on TF-IDF; Based on the semantic similarity weight set, the word co-occurrence weight set, and the word frequency weight set, the semantic feature weight set in the alarm log is obtained.

6. An alarm information analysis system, characterized in that, include: The module includes an acquisition module, a feature acquisition module, a fusion module, and a category confirmation module. The acquisition module is used to acquire alarm logs of the power network system, extract several words from the alarm logs, and generate a set of word vectors corresponding to the words. The feature acquisition module is used to input the word vector set into the Transformer encoder and the HDP topic model respectively, and obtain the local feature vector set and the global feature vector set respectively; The fusion module is used to fuse the local feature vector set and the global feature vector set to obtain a comprehensive feature vector set; The category confirmation module is used to calculate the similarity of the comprehensive feature vector set using a Gaussian kernel function, and to perform clustering based on the similarity to confirm the alarm category; Specifically, obtaining the local feature vector set involves: unifying the length of the vectors in the word vector set by filling information into the vectors in the word vector set; performing position encoding on several words in the alarm log to obtain the position vectors corresponding to the words in the alarm log; fusing the word vector set with the unified length with the position vectors corresponding to the words to obtain the input word vector set; inputting the input word vector set into a Transformer encoder to obtain the attention value set; performing a residual connection between the attention value set and the input word vector set, and performing layer normalization on the residual connection result to obtain the local feature vector set in the alarm log. Specifically, obtaining the global feature vector set involves: calculating the semantic feature weight set in the alarm log; extracting the keyword set in the alarm log based on the semantic feature weight set; and inputting the keyword set into the HDP topic model to obtain the global feature vector set in the alarm log.

7. A terminal device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the alarm information analysis method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the alarm information analysis method as described in any one of claims 1 to 5.

Images