Construction method, device and equipment of intrusion detection model

Abstract

The embodiment of the invention discloses a construction method, device and equipment of an intrusion detection model. When the method provided by the embodiment of the invention is executed, firstly, a distributed architecture capable of realizing parallel computing of the intrusion detection task of the power internet of things can be established; and constructing a self-adaptive neural network model, and deploying the self-adaptive neural network model to the computing node of the distributed architecture to obtain a target node. And then active and passive combined network detection and data sensing tasks are distributed to the target node, so that context sensing data of all devices in the electric power Internet of Things are obtained. And inputting the context sensing data into the adaptive neural network model to obtain an intrusion detection model. According to the method, the distributed architecture is constructed, the computing resources of multiple computing nodes are fully utilized, the adaptive neural network model is constructed, and the mode of combining active detection and passive detection is combined, so that the network activity and data traffic in the power Internet of Things are comprehensively monitored and perceived, and the coverage range and accuracy of intrusion detection are improved.

Description

Technical Field

[0001] The present application relates to the field of constructing a single intrusion detection model, and specifically to a method, device and equipment for constructing an intrusion detection model. Background Art

[0002] The power Internet of Things effectively integrates the Internet of Things with the smart grid. Through the combination of various information sensing devices and communication information technology, through the mutual perception and feedback control of related objects, an intelligent power grid system is formed to achieve the effect of power intelligence. Intrusion detection of the power Internet of Things refers to identifying potential security threats and intrusion behaviors by monitoring and analyzing network traffic, device status and behavior in the power Internet of Things system, and taking corresponding measures to respond and defend.

[0003] At present, the common methods and technologies for intrusion detection in the power Internet of Things are to monitor the network traffic in the power Internet of Things system, analyze the source, destination, protocol and content of the data packets, and identify abnormal traffic and potential attack behaviors. However, the network traffic and device behavior in the power Internet of Things system are very complex, so the intrusion detection system may generate a high number of false alarms or miss real intrusion events. This will cause the security team to deal with a large number of false alarms or fail to detect real intrusions in time, reducing the credibility and effectiveness of intrusion detection.

[0004] Therefore, how to improve the credibility and effectiveness of intrusion detection is a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a method, device, and equipment for constructing an intrusion detection model to provide a new algorithm model for obtaining a power index during the power application process, thereby providing feedback on the actual power acquisition situation.

[0006] To solve the above problems, the technical solutions provided in the embodiments of the present application are as follows:

[0007] A method for constructing an intrusion detection model, the method comprising:

[0008] Establishing a distributed architecture, wherein the distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks in the power Internet of Things;

[0009] Constructing an adaptive neural network model, and deploying the adaptive neural network model to a computing node of the distributed architecture to obtain a target node;

[0010] Assigning active and passive combined network detection and data perception tasks to the target node, thereby obtaining context perception data of all devices in the power Internet of Things;

[0011] The context-aware data is input into the adaptive neural network model to obtain an intrusion detection model.

[0012] In some possible implementations, the process of constructing the adaptive neural network model includes:

[0013] Obtain historical traffic data in historical intrusion detection of the power Internet of Things, and divide the historical traffic data into a training data set, a test data set, and a verification data set;

[0014] The pre-built original convolutional neural network is optimized using the training data set, the test data set, the verification data set and a genetic algorithm to obtain the adaptive neural network model.

[0015] In some possible implementations, the construction process of the original convolutional neural network includes:

[0016] Constructing a basic neural network, wherein the basic neural network has a seven-layer structure;

[0017] Randomly performing layer mutation and parameter mutation on the layer structure in the basic convolutional neural network;

[0018] The original convolutional neural network is obtained by adaptively adjusting the layer structure of the basic convolutional neural network that undergoes the layer variation and the parameter variation.

[0019] In some possible implementations, optimizing the pre-built original convolutional neural network using a training data set, a test data set, a validation data set, and a genetic algorithm to obtain the adaptive neural network model includes:

[0020] Initializing the original convolutional neural network to obtain a first convolutional neural network;

[0021] Performing chromosome encoding on the first convolutional neural network to obtain a second convolutional neural network, and generating population individuals corresponding to the second convolutional neural network;

[0022] Using the training data set to train the second convolutional neural network to obtain a score value of the original convolutional neural network;

[0023] Using a genetic algorithm to perform N genetic iterations on the individuals of the population to obtain multiple genetic neural networks, and calculating the genetic generation number, where N is a positive integer greater than or equal to 1;

[0024] When the genetic generation satisfies a preset genetic generation and the score value satisfies a preset score value, selecting a genetic neural network that satisfies a preset condition from among the multiple genetic neural networks as a third convolutional neural network;

[0025] The validation data set and the test data set are used to perform hyperparameter tuning and testing on the third convolutional neural network to obtain the adaptive neural network model.

[0026] In some possible implementations, the assigning of active and passive combined network detection and data perception tasks to the target node, thereby obtaining context perception data of all devices in the power Internet of Things, includes:

[0027] Configure a passive detection task, an active detection task and allocate a data sensing task to the target node, wherein the active detection task has set a detection strategy and a detection cycle;

[0028] Performing real-time intrusion detection on the monitoring process of the target node to obtain a detection result;

[0029] Allocating the passive detection task and the active detection task to the target node according to the detection result;

[0030] In the process of allocating the passive detection task and the active detection task to the target node according to the detection result, contextual perception data of all devices in the power Internet of Things is obtained.

[0031] In some possible implementations, allocating the passive detection task and the active detection task to the target node according to the detection result includes:

[0032] When the detection result is that a potential intrusion behavior is identified and discovered within the current detection cycle, an active detection task is assigned to the target node in advance to perform active detection on the power Internet of Things, and the detection cycle is reset after the active detection is completed;

[0033] When the detection result is that no potential intrusion behavior is found within the detection cycle, a passive detection task is assigned to the target node to perform passive detection on the power Internet of Things according to the detection cycle.

[0034] In some possible implementations, inputting the context-aware data into the adaptive neural network model to obtain an intrusion detection model includes:

[0035] Preprocessing the context-aware data to obtain preprocessed data, and converting the preprocessed data into two-dimensional image data;

[0036] Extracting features from the two-dimensional image data to obtain a valid feature set;

[0037] The effective feature set is input into the adaptive neural network model to obtain the intrusion detection model.

[0038] A device for constructing an intrusion detection model, the device comprising:

[0039] A building unit, used for building a distributed architecture, wherein the distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks of the power Internet of Things;

[0040] Constructing a deployment unit, which is used to construct an adaptive neural network model, and deploying the adaptive neural network model to a computing node of the distributed architecture to obtain a target node;

[0041] A first allocation unit is used to allocate active and passive combined network detection and data perception tasks to the target node, so as to obtain context perception data of all devices in the power Internet of Things;

[0042] The first input unit is used to input the context-aware data into the adaptive neural network model to obtain an intrusion detection model.

[0043] A device for constructing an intrusion detection model, the device comprising a memory and a processor, the memory being used to store programs or codes, and the processor being used to run the programs or codes stored in the memory to implement the method for constructing an intrusion detection model as described above.

[0044] A computer-readable storage medium stores codes. When the codes are executed, a device executing the codes implements the method for constructing an intrusion detection model as described above.

[0045] Compared with the prior art, this application has the following beneficial effects:

[0046] The present application provides a method, device and equipment for constructing an intrusion detection model. Specifically, when executing the method for constructing an intrusion detection model provided in the embodiment of the present application, a distributed architecture can be first formed. The distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks in the power Internet of Things. Next, an adaptive neural network model is constructed, and the adaptive neural network model is deployed to the computing node of the distributed architecture to obtain the target node. Then, the active and passive combined network detection and data perception tasks are assigned to the target node, so as to obtain the context perception data of all devices in the power Internet of Things, and the context perception data is input into the adaptive neural network model to obtain the intrusion detection model. The present application constructs a distributed architecture, makes full use of the computing resources of multiple computing nodes, realizes parallel computing of tasks, and then constructs an adaptive neural network model, combines active detection and passive detection, and can comprehensively monitor and perceive network activities and data traffic in the power Internet of Things, including host activity, network traffic characteristics, etc., to improve the coverage and accuracy of intrusion detection. At the same time, combining context perception data with the neural network model can make full use of context information to enhance the intrusion detection capability of the model and improve the model's recognition ability for complex intrusion behaviors. In addition, by building a combined active and passive power Internet of Things detection system, giving priority to passive detection, and calling active detection tasks after detecting potential intrusion behavior, the network traffic and device behavior in the power Internet of Things can be continuously monitored to detect abnormal activities and potential intrusion behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A method flow chart of a method for constructing an intrusion detection model provided in an embodiment of the present application;

[0049] Figure 2 A schematic diagram of the structure of an intrusion detection model construction device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] To facilitate understanding of the technical solutions provided by the embodiments of the present application, the background technology involved in the embodiments of the present application will be described below.

[0052] The Internet of Things is a product of the big data era. It grasps all the data of objects based on the functions of obtaining information such as sensors and QR codes, and maximizes the perception of objects, so it has the characteristics of comprehensive perception; secondly, based on the various advantages generated by computer integration, the Internet of Things can rely on or use the information of computer equipment to transmit the information of objects in real time to any region or to any third party, so it has the characteristics of reliable transmission; finally, since cloud computing processors can analyze large amounts of data and information and implement intelligent control of objects, the function of intelligent management can be realized.

[0053] The power Internet of Things effectively integrates the Internet of Things and the smart grid. Through the combination of various information sensing devices and communication information technology, through the mutual perception and feedback control of related objects, an intelligent power grid system is formed to achieve the effect of power intelligence. Electricity is widely used in people's lives, and efficient technical support is the prerequisite for the good operation of resources. Through the updating and superposition of technology, the heavy power process becomes easier to observe and operate, reducing a lot of manpower consumption and saving time. In short, the power Internet of Things mainly collects information from electricity users and information from power generation equipment in the power generation department to realize intelligent services of data sharing.

[0054] Intrusion detection in the power Internet of Things refers to identifying potential security threats and intrusion behaviors by monitoring and analyzing network traffic, device status and behavior in the power Internet of Things system, and taking corresponding measures to respond and defend.

[0055] At present, the common methods and technologies for intrusion detection in the power Internet of Things are: by monitoring the network traffic in the power Internet of Things system, analyzing the source, destination, protocol and content of the data packet, etc., to identify abnormal traffic and potential attack behaviors. Common technologies include intrusion detection system (IDS) and intrusion prevention system (IPS). Or collect and analyze the security logs of the power Internet of Things system to identify abnormal events and attack traces. By auditing and analyzing the security logs, potential intrusion behaviors can be discovered in time and corresponding countermeasures can be taken. However, the network traffic and device behavior in the power Internet of Things system are very complex, so the intrusion detection system may generate a high number of false alarms or miss real intrusion events. This will cause the security team to deal with a large number of false alarms or fail to detect real intrusions in time, reducing the credibility and effectiveness of intrusion detection.

[0056] In order to solve this problem, a method, device and equipment for constructing an intrusion detection model are provided in the embodiment of the present application. A distributed architecture is first established. The distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks in the power Internet of Things. Then an adaptive neural network model is constructed, and the adaptive neural network model is deployed to the computing nodes of the distributed architecture to obtain the target node. Next, the active and passive combined network detection and data perception tasks are assigned to the target node, so as to obtain the context perception data of all devices in the power Internet of Things, and the context perception data is input into the adaptive neural network model to obtain the intrusion detection model. The present application constructs a distributed architecture, makes full use of the computing resources of multiple computing nodes, realizes parallel computing of tasks, and then constructs an adaptive neural network model, combines active detection and passive detection, and can comprehensively monitor and perceive network activities and data traffic in the power Internet of Things, including host activity, network traffic characteristics, etc., to improve the coverage and accuracy of intrusion detection. At the same time, combining context perception data with the neural network model can make full use of context information to enhance the intrusion detection capability of the model and improve the model's recognition ability for complex intrusion behaviors. In addition, by building a combined active and passive power Internet of Things detection system, giving priority to passive detection, and calling active detection tasks after detecting potential intrusion behavior, the network traffic and device behavior in the power Internet of Things can be continuously monitored to detect abnormal activities and potential intrusion behaviors.

[0057] See also Figure 1 , which is a flow chart of a method for constructing an intrusion detection model provided in an embodiment of the present application, such as Figure 1 As shown, the method for constructing the intrusion detection model may include steps S101-S104:

[0058] S101: Establishing a distributed architecture, wherein the distributed architecture is a distributed architecture for implementing parallel computing of intrusion detection tasks in the power Internet of Things.

[0059] In order to build an intrusion detection model, the construction system of the intrusion detection model first needs to establish a distributed architecture that can realize parallel computing of intrusion detection tasks in the power Internet of Things.

[0060] Among them, the distributed architecture can realize the parallel computing of the power Internet of Things intrusion detection task. The distributed architecture is an architectural pattern for designing and deploying computer systems, in which tasks and data are divided into multiple subtasks and data blocks, and these subtasks and data blocks are processed simultaneously on multiple computing devices (nodes). These computing devices can exchange data and coordinate tasks through network communication. The goal of the distributed architecture is to improve the performance, reliability and scalability of the system.

[0061] S102: Construct an adaptive neural network model, and deploy the adaptive neural network model to the computing nodes of the distributed architecture to obtain a target node.

[0062] After the distributed architecture is formed, the intrusion detection model construction system can construct an adaptive neural network model and deploy the adaptive neural network model to the computing nodes of the distributed architecture to obtain the target node.

[0063] In some possible implementations, the process of constructing the adaptive neural network model includes A1-A2:

[0064] A1: Obtain historical traffic data in historical intrusion detection of the power Internet of Things, and divide the historical traffic data into a training data set, a test data set, and a verification data set.

[0065] In order to build an adaptive neural network model, the intrusion detection model construction system first needs to obtain the historical traffic data in the historical intrusion detection of the power Internet of Things, and divide the historical traffic data into training data set, test data set and verification data set.

[0066] In some possible implementations, the historical traffic data may include, but is not limited to, network packet information, traffic statistics data, connection logs, etc.

[0067] In some possible implementations, the method further includes:

[0068] The historical traffic data is preprocessed, and the preprocessed historical traffic data is divided into the training data set, the test data set and the verification data set.

[0069] In some possible implementations, preprocessing the historical traffic data may include, but is not limited to, data cleaning, feature extraction, feature conversion, sample balancing, etc. of the collected historical traffic data to ensure the quality and applicability of the data.

[0070] A2: Utilizing the training data set, the test data set, the validation data set and a genetic algorithm to optimize the pre-built original convolutional neural network to obtain the adaptive neural network model.

[0071] After obtaining the training data set, the test data set and the validation data set, the intrusion detection model construction system can use the training data set, the test data set, the validation data set and the genetic algorithm to optimize the pre-constructed original convolutional neural network to obtain the adaptive neural network model.

[0072] In some possible implementations, the construction process of the original convolutional neural network includes B1-B3:

[0073] B1: Construct a basic neural network, which has a seven-layer structure.

[0074] To construct the original convolutional neural network, the intrusion detection model construction system first needs to build a basic neural network with a seven-layer structure. The purpose of building a seven-layer convolutional neural network is to enable the network to learn and extract more advanced features from the original input data through the feature extraction and dimensionality reduction process of the layer structure, thereby enhancing the network's understanding of complex patterns and abstract concepts.

[0075] In some possible implementations, the seven-layer structure is respectively a primary convolution layer, a maximum pooling layer, a secondary convolution layer, a primary average pooling layer, a secondary average pooling layer, a fully connected layer, and a classification layer.

[0076] Specifically, the effects and purposes of each layer are as follows:

[0077] First-level convolution layer and maximum pooling layer: Through convolution and maximum pooling operations, the network can extract local features of the input data while reducing the dimension of the data and retaining important information.

[0078] Secondary convolution layer and primary average pooling layer: Through further convolution and average pooling, the network can further extract higher-level features and enhance the network's ability to abstract input data.

[0079] Secondary average pooling layer: further reduces the dimension of feature mapping and reduces computational complexity.

[0080] Fully connected layer: Linearly combines feature maps to extract high-level features and learn complex patterns.

[0081] Classification layer: maps the output of the network to different categories to complete the classification task.

[0082] In this application, the constructed seven-layer convolutional neural network has stronger feature abstraction ability, complex pattern learning ability and computational efficiency than traditional neural networks, and is suitable for processing complex tasks and large-scale data.

[0083] B2: Randomly perform layer mutation and parameter mutation on the layer structure in the basic convolutional neural network.

[0084] After constructing the basic neural network, the construction system of the intrusion detection model also needs to randomly mutate the layer structure and parameters of the basic convolutional neural network.

[0085] The purpose of randomly selecting the basic convolutional neural network structure for layer variation and parameter variation in this application is to increase the diversity of the network, avoid falling into the local optimal solution, and better explore the global optimal solution. Through adaptive adjustment, the network can automatically adjust the structure according to specific tasks and data characteristics, improving the adaptability and performance of the network. Such an optimization method can effectively optimize the network structure, so that the convolutional neural network has better performance in the power Internet of Things intrusion detection task.

[0086] B3: Adaptively adjust the layer structure of the layer variation and the parameter variation in the basic convolutional neural network to obtain the original convolutional neural network.

[0087] After randomly performing layer mutation and parameter mutation on the layer structure of the basic convolutional neural network, the construction system of the intrusion detection model can increase the diversity and complexity of the network through adaptive adjustment, and improve the adaptability and performance of the network. The original convolutional neural network obtained through layer mutation, parameter mutation and adaptive adjustment can adapt to different tasks and data characteristics.

[0088] In some possible implementations, adaptive adjustment based on the layer structure of the variant layer means that if the variant layer is a convolution layer, the number of feature maps of the convolution layer is halved and copied and placed behind the convolution layer; if the variant layer is a pooling layer, the pooling layer is replaced by a convolution layer with a step size of 2.

[0089] In some possible implementations, adaptive adjustment based on the layer structure with parameter variation means that if a parameter variation occurs in the convolution layer, the number of feature maps of the convolution layer is doubled, if a parameter variation occurs in the pooling layer, the pooling method is changed, and if a parameter variation occurs in the fully connected layer, the number of neurons in the fully connected layer is halved.

[0090] In some possible implementations, the adaptive neural network model is obtained by optimizing the pre-built original convolutional neural network using a training data set, a test data set, a validation data set, and a genetic algorithm, including C1-C6:

[0091] C1: Initialize the original convolutional neural network to obtain a first convolutional neural network.

[0092] In order to obtain an adaptive neural network model, the construction system of the intrusion detection model first needs to initialize the connection mode and corresponding parameters of each layer in the original convolutional neural network, so as to obtain the first convolutional neural network. The purpose of initialization is to generate an initial population in the genetic algorithm, that is, a group of original convolutional neural networks, and provide initial values ​​for the connection mode and parameters of each layer of each network. The purpose of doing this is to try different network structures and parameter combinations from the perspective of diversity, increase the search space, and improve the exploration ability of the genetic algorithm to find a better network structure and parameter configuration.

[0093] C2: Perform chromosome encoding on the first convolutional neural network to obtain a second convolutional neural network, and generate population individuals corresponding to the second convolutional neural network.

[0094] After obtaining the first convolutional neural network, the intrusion detection model construction system also needs to perform chromosome encoding on the first convolutional neural network to obtain the second convolutional neural network, and generate population individuals corresponding to the second convolutional neural network. The purpose of determining population individuals is to perform iterative optimization of genetic algorithms. In genetic algorithms, it is necessary to perform genetic operations on population individuals, including crossover, mutation and other operations, to generate new individuals, and then select individuals with higher fitness as the parents of the next generation, thereby optimizing and evolving a better solution.

[0095] In some possible implementations, when generating population individuals, initial chromosomes can be generated by random generation or other heuristic methods. Population individuals refer to a set of chromosomes, each of which represents a complete neural network. When generating the number of population individuals, it is necessary to weigh the complexity of the problem and the limitations of computing resources. Generally speaking, a larger number of population individuals can increase the search space and improve the potential for optimization, but it will also increase the computational cost. Through genetic algorithms or other optimization methods, population individuals can be crossover, mutated, and selected to evolve the population generation by generation to find the optimal convolutional neural network structure and parameter configuration. This process is repeated until the set termination condition is reached, such as reaching the maximum number of iterations or reaching a certain performance indicator.

[0096] C3: Using the training data set to train the second convolutional neural network to obtain a score value of the original convolutional neural network.

[0097] After the second convolutional neural network, the intrusion detection model construction system can use the training data set to train the second convolutional neural network to obtain the score value of the original convolutional neural network.

[0098] The original convolutional neural network is trained using the training data set, the classification error and the network structure complexity of the original convolutional neural network are calculated respectively, and the score value of each original convolutional neural network is calculated according to the classification error and the structure complexity.

[0099] In some possible implementations, the using the training data set to train the second convolutional neural network to obtain a score value of the original convolutional neural network includes:

[0100] The original convolutional neural network is trained using the training data set to obtain the classification error and network structure complexity of the original convolutional neural network, and the score value of each original convolutional neural network is calculated based on the classification error and structure complexity.

[0101] In some possible implementations, the score value of the original convolutional neural network may be calculated using the following formula:

[0102]

[0103] Among them, S is the score value; F is the classification error; C is the structural complexity of the original convolutional neural network; α and β are the weight values ​​of the classification error and structural complexity respectively.

[0104] Among them, the classification error of a convolutional neural network refers to the difference between the network output and the actual label when performing a classification task. The classification error is usually measured using a loss function, such as the cross entropy loss function. The lower the classification error, the better the network's performance on the classification task.

[0105] The complexity of a network structure refers to the number of parameters and computational complexity in the network. The increase in the complexity of a network structure is often associated with an increase in the network's expressiveness and fitting capabilities, but it may also lead to overfitting problems. The following are some of the factors that affect the complexity of a network structure:

[0106] 1. Number of parameters: The more trainable parameters there are in the network, the more complex the network structure becomes. The number of parameters depends on the number of layers in the network, the width of each layer, and the connection method.

[0107] 2. Number of layers and width: The number of layers in the network and the width of each layer will affect the complexity of the network structure. Deeper networks and wider layers can provide higher nonlinear representation capabilities, but may also increase the risk of overfitting.

[0108] 3. Connection method: Different connection methods have an impact on the complexity of the network structure. For example, residual connections help gradient propagation and model convergence in deep networks, but they also increase the number of network parameters and computational complexity.

[0109] C4: Using a genetic algorithm to perform N genetic iterations on the individuals of the population to obtain multiple genetic neural networks, and calculating the genetic generation number, where N is a positive integer greater than or equal to 1.

[0110] After obtaining the score value of the original convolutional neural network, the intrusion detection model construction system also needs to use the genetic algorithm to perform N genetic iterations on the population individuals to obtain multiple genetic neural networks and calculate the genetic generation, where N is a positive integer greater than or equal to 1. This step is to use the genetic algorithm to perform optimization search and prepare for finding the optimal convolutional neural network model that meets the power Internet of Things intrusion detection task.

[0111] Among them, the genetic algorithm is an optimization algorithm based on natural selection and genetic mechanisms. In this step, the genetic algorithm continuously optimizes the structure and parameters of the original convolutional neural network through genetic iteration to find the optimal solution. Each generation includes genetic operations such as selection, crossover, and mutation to generate new network structures and parameter combinations, and evaluate their performance based on the score value.

[0112] C5: When the genetic generation satisfies a preset genetic generation and the score value satisfies a preset score value, a genetic neural network that meets preset conditions among the multiple genetic neural networks is selected as the third convolutional neural network.

[0113] When the genetic generation number meets the preset genetic generation number and the score value meets the preset score value, it means that the genetic algorithm has converged to a certain extent, the network structure and parameters have become relatively stable, and there is no obvious performance improvement. At this time, stopping the iteration can save computing resources and avoid overfitting or long-term calculation.

[0114] In some possible implementations, the preset genetic generation and the preset score value can be set according to actual conditions, and this application does not specifically limit the preset genetic generation and the preset score value.

[0115] In some possible implementations, the genetic neural network that meets the preset conditions refers to the genetic neural network with the highest score.

[0116] C6: Use the validation data set and the test data set to perform hyperparameter tuning and testing on the third convolutional neural network to obtain the adaptive neural network model.

[0117] After obtaining the third convolutional neural network, the validation data set can be used to tune the hyperparameters of the third convolutional neural network, and the test data set can be used to test the tuned third convolutional neural network.

[0118] Use the test set to conduct a final test on the tuned third convolutional neural network. Calculate the performance indicators of the model on the test set, such as precision and recall, to evaluate the generalization ability and actual effect of the model. Evaluate the performance of the tuned third convolutional neural network based on the performance indicators on the test set and compare it with other models. Further optimization measures can be taken as needed, such as adjusting the network structure and increasing the amount of data.

[0119] S103: Allocate active and passive combined network detection and data perception tasks to the target node, so as to obtain context perception data of all devices in the power Internet of Things.

[0120] The purpose of assigning active and passive combined network detection and data perception tasks to computing nodes is to make full use of different types of detection methods to improve the accuracy and comprehensiveness of intrusion detection. By combining the two detection methods, factors such as context-aware data can be comprehensively considered to improve the comprehensiveness and accuracy of intrusion detection.

[0121] Among them, the active and passive combined network detection task refers to the strategy of using both active and passive methods to perform network detection in network security monitoring and intrusion detection.

[0122] Active detection refers to actively scanning, detecting and identifying potential threats in the network. It can include operations such as port scanning, vulnerability scanning, malware detection, etc. to discover possible vulnerabilities, weaknesses or malicious activities. Active detection can help discover risks in advance and take timely measures to deal with them.

[0123] Passive detection refers to passively detecting and identifying abnormal activities and potential threats in the network by monitoring network traffic, logging and abnormal behavior analysis. Passive detection does not actively intervene in network traffic, but passively monitors and analyzes traffic and events. It can detect intrusions or potential security threats by identifying abnormal traffic patterns, abnormal access behaviors or unauthorized operations.

[0124] The active and passive combined network detection task combines these two methods to comprehensively improve network security protection capabilities. Active detection can proactively discover known vulnerabilities and threats and take security measures in advance; while passive detection can discover and analyze unknown threats by monitoring network traffic and abnormal behavior. By combining the two methods, a relatively complete network security monitoring system can be formed to improve the detection capability and response speed of different types of threats.

[0125] In some possible implementations, context-aware data includes device status data, environmental parameter data, location information data, user behavior data, and real-time data streams, specifically:

[0126] Equipment status data: including the operating status, power consumption, temperature, current and other information of the power equipment, which is used to monitor the normal working status of the equipment and detect abnormal conditions.

[0127] Environmental parameter data: includes monitoring data of environmental parameters such as temperature, humidity, and air quality, which are used to evaluate the performance and reliability of equipment under different environmental conditions.

[0128] Location information data: includes information such as the device’s geographic location and installation location, which is used to locate the device and associate it with events related to other devices or geographic locations.

[0129] User behavior data: including data such as user operation behavior, usage habits, and permission management of power equipment, which is used to identify normal and abnormal behaviors of users for security detection and access control.

[0130] Real-time data stream: including real-time power data stream, communication data stream, etc., used to monitor and analyze the communication and data transmission between devices, and identify potential security threats and intrusion behaviors.

[0131] In some possible implementations, the target node is assigned a combined active and passive network detection and data perception task, thereby obtaining context perception data of all devices in the power Internet of Things, including D1-D4:

[0132] D1: Configure passive detection tasks, active detection tasks and allocate data perception tasks to the target node, wherein the active detection task has set the detection strategy and detection cycle.

[0133] In order to obtain the context-aware data of all devices in the power Internet of Things, the construction system of the intrusion detection model first needs to configure passive detection tasks, active detection tasks and assign data perception tasks to the target nodes. Among them, the active detection task has set the detection strategy and detection cycle.

[0134] In some possible implementations, if the model does not identify obvious abnormal behavior or malicious attacks, passive detection tasks are still required to maintain the security of the network. Passive detection tasks can include continuous collection and analysis of network traffic, event logs and other information to monitor potential risks and the emergence of abnormal behavior. If the model identifies the existence of abnormal behavior or malicious attacks, active detection tasks can be triggered. Active detection tasks refer to active scanning, detection or response measures for specific threats. For example, deep scanning, vulnerability detection, malware removal, tracking the source of attacks, etc.

[0135] In some possible implementations, the detection strategy may include port scanning, vulnerability scanning, malware detection, etc. The detection cycle may be flexibly set according to actual conditions, such as performing active detection once a day, a week, or a month.

[0136] In some possible implementations, configuring a passive detection task, an active detection task, and allocating a data sensing task to the target node includes E1-E2:

[0137] E1: Obtain the network topology of the power Internet of Things area monitored by the target node.

[0138] Specifically, use network scanning tools such as Nmap, Zenmap, Angry IP Scanner, etc. to scan the power Internet of Things area and detect the devices on the network and their connection relationships. These tools can identify devices and open ports in the network and provide topology maps or network maps to show the connection relationships between devices.

[0139] E2: Configure a detection path for the target node according to the network topology structure, and use the heartbeat mechanism to perform activity scanning on the power Internet of Things, use activity scanning as a detection strategy and set a detection cycle.

[0140] In this step, the detection path is configured for the computing node according to the network topology, and the devices and communication paths to be monitored are selected. Then, the activity scan of the power Internet of Things is performed through the heartbeat mechanism. According to the results of the activity scan, the activity status and abnormal conditions of the devices in the power Internet of Things can be determined. If some devices do not respond to the heartbeat signal or the heartbeat signal is abnormal, it may mean that there is potential abnormal behavior. These abnormal behaviors may be caused by equipment failure, network congestion, attacks, etc. These abnormal behaviors are calibrated for further intrusion detection.

[0141] Among them, the heartbeat mechanism is a method for detecting whether a device is active. It sends heartbeat signals periodically and then confirms the activity status of the device when the computing node receives the response. Using activity scanning as a detection strategy means that by monitoring the heartbeat signal of the device, the status and activity of the device can be understood in real time. The detection period can be set according to the actual situation to balance the detection frequency and computing load.

[0142] D2: Perform real-time intrusion detection on the monitoring process of the target node to obtain a detection result.

[0143] After configuring passive detection tasks, active detection tasks and allocating data perception tasks to the target node, the intrusion detection model construction system can perform real-time intrusion detection on the monitoring process of the target node to obtain detection results.

[0144] Among them, the monitoring process is the network process of the power Internet of Things area monitored by the target node.

[0145] In some possible implementations, the real-time intrusion detection is performed on the monitoring process of the target node to obtain a detection result, including F1-F2:

[0146] F1: Use the adaptive neural network model to monitor the flow of the monitoring process of the target node to obtain real-time flow data.

[0147] The adaptive neural network model built previously is used to analyze and process the real-time traffic data in real time. The adaptive neural network model has been trained and optimized in the previous steps, and has high accuracy and performance. Through the analysis and processing of the neural network model, intrusion detection can be performed on the real-time traffic data and potential intrusion behaviors can be identified.

[0148] Among them, real-time traffic data refers to network data traffic collected and processed in real time. In the intrusion detection of the power Internet of Things, real-time traffic data usually refers to network data packets transmitted from various devices and nodes in the power Internet of Things. These data packets contain communication information between devices, data content, and other network interaction information.

[0149] The acquisition and processing of real-time traffic data is a key step in achieving intrusion detection. By collecting and analyzing traffic data in real time, the communication behavior of the power Internet of Things can be monitored in a timely manner, and possible abnormalities or intrusion behaviors can be identified. The processing of real-time traffic data requires efficient data collection, processing, and analysis capabilities. Since the power Internet of Things usually has large-scale, high-density devices and nodes, the amount of real-time traffic data may be very large. Therefore, for the intrusion detection system, it is necessary to ensure real-time processing and efficient analysis of data to ensure timely detection and response to potential security threats.

[0150] F2: Performing flow analysis on the real-time flow data to obtain the detection result.

[0151] After acquiring the real-time traffic data, the intrusion detection model construction system can perform traffic analysis on the real-time traffic data to obtain the detection result.

[0152] In some possible implementations, traffic analysis may include detecting abnormal traffic patterns, identifying potential intrusion behaviors, discovering malicious code propagation, etc. Traffic analysis may be performed using rule-based methods, machine learning algorithms, or behavioral analysis techniques to promptly discover and respond to potential security threats.

[0153] D3: Allocate the passive detection task and the active detection task to the target node according to the detection result.

[0154] After obtaining the detection results of real-time intrusion detection, the intrusion detection model construction system also needs to allocate passive detection tasks and active detection tasks to the target node based on the detection results.

[0155] In some possible implementations, allocating the passive detection task and the active detection task to the target node according to the detection result includes G1-G2:

[0156] G1: When the detection result is that potential intrusion behavior is identified and discovered within the current detection cycle, an active detection task is assigned to the target node in advance to perform active detection on the power Internet of Things, and the detection cycle is reset after the active detection is completed.

[0157] If the detection result is that potential intrusion behavior is found in the current detection cycle, an active detection task is immediately assigned to the computing node. The active detection task includes detailed scanning and monitoring of specific devices or communication paths to further confirm and locate the intrusion behavior. After the active detection task is completed, the detection cycle needs to be reset so that real-time traffic analysis and active detection task allocation can be performed again in the next cycle.

[0158] G2: When the detection result is that no potential intrusion behavior is found within the detection cycle, a passive detection task is assigned to the target node to perform passive detection on the power Internet of Things according to the detection cycle.

[0159] If the detection result is that no potential intrusion behavior is found in the current detection cycle, then according to the set detection cycle, periodic passive detection of the power Internet of Things will be carried out in the next cycle. Periodic passive detection can help detect intrusion behavior in a timely manner and maintain continuous monitoring of the security of the power Internet of Things.

[0160] D4: In the process of allocating the passive detection task and the active detection task to the target node according to the detection result, the context perception data of all devices in the power Internet of Things is obtained.

[0161] In the process of assigning passive detection tasks and active detection tasks to target nodes based on the detection results, the intrusion detection model construction system also needs to obtain context-aware data of all devices in the power Internet of Things.

[0162] S104: Inputting the context-aware data into the adaptive neural network model to obtain an intrusion detection model.

[0163] After obtaining the context-aware data of all devices in the power Internet of Things, the intrusion detection model construction system can input the context-aware data into the adaptive neural network model to obtain the intrusion detection model.

[0164] In some possible implementations, the inputting the context-aware data into the adaptive neural network model to obtain an intrusion detection model includes H1-H3:

[0165] H1: Preprocessing the context-aware data to obtain preprocessed data, and converting the preprocessed data into two-dimensional image data.

[0166] In order to obtain the intrusion detection model, the intrusion detection model construction system first needs to preprocess the context-aware data to obtain preprocessed data, and then convert the preprocessed data into two-dimensional image data.

[0167] In some possible implementations, preprocessing includes operations such as data cleaning, feature extraction, and data conversion to facilitate subsequent intrusion detection analysis. Feature extraction: Convert the preprocessed data into a feature representation acceptable to the model so that it can be input into the intrusion detection model for analysis.

[0168] H2: Extract features from the two-dimensional image data to obtain a valid feature set.

[0169] After obtaining the two-dimensional image data, the intrusion detection model construction system can extract features from the two-dimensional image data to obtain an effective feature set.

[0170] In some possible implementations, the method further includes: aggregating all the valid feature sets to a power computing center. The advantage of a distributed architecture is that multiple computing nodes perform parallel computing, but as a manager, it is impossible to browse the tasks and results of all computing nodes. By aggregating all valid feature sets to a power computing center, a centralized management method is used to facilitate unified management by managers.

[0171] H3: Input the effective feature set into the adaptive neural network model to obtain the intrusion detection model.

[0172] After obtaining the effective feature set, the intrusion detection model construction system can input the effective feature set into the adaptive neural network model to obtain the intrusion detection model.

[0173] In some possible implementations, the method further includes I1-I2:

[0174] I1: Use the intrusion detection model to perform intrusion analysis on IoT data to obtain analysis results.

[0175] In some possible implementations, the intrusion analysis may be, but is not limited to, streaming processing and real-time analysis.

[0176] I2: Based on the analysis results, locate the intrusion behavior and conduct security response.

[0177] The intrusion detection model construction system can make judgments based on the output results of the intrusion detection model. If abnormal behavior or potential intrusion behavior is detected, the corresponding alarm mechanism is triggered to notify relevant personnel or systems to respond to security. The intrusion detection model construction system can locate, optimize and adjust the intrusion detection model based on the actual analysis results to improve the accuracy and performance of the model.

[0178] Based on the contents of S101-S104, it can be known that a distributed architecture that can realize parallel computing of intrusion detection tasks in the power Internet of Things is first established. Then, an adaptive neural network model is constructed, and the adaptive neural network model is deployed to the computing nodes of the distributed architecture to obtain the target node. Active and passive combined network detection and data perception tasks are assigned to the target node to obtain context-aware data of all devices in the power Internet of Things. Finally, the context-aware data is input into the adaptive neural network model to obtain an intrusion detection model. This application constructs a distributed architecture, makes full use of the computing resources of multiple computing nodes, realizes parallel computing of tasks, and then constructs an adaptive neural network model, combines active detection and passive detection, and can comprehensively monitor and perceive network activities and data traffic in the power Internet of Things, including host activity, network traffic characteristics, etc., to improve the coverage and accuracy of intrusion detection. At the same time, combining context-aware data with a neural network model can make full use of context information to enhance the intrusion detection capability of the model and improve the model's ability to identify complex intrusion behaviors. In addition, by building a combined active and passive power Internet of Things detection system, giving priority to passive detection, and calling active detection tasks after detecting potential intrusion behavior, the network traffic and device behavior in the power Internet of Things can be continuously monitored to detect abnormal activities and potential intrusion behaviors.

[0179] The above are some specific implementations of the method for constructing an intrusion detection model provided in the embodiments of the present application. Based on this, the present application also provides a corresponding device for constructing an intrusion detection model. The device provided in the embodiments of the present application will be introduced below from the perspective of functional modularization.

[0180] See also Figure 2 , which is a schematic diagram of the structure of an intrusion detection model construction device provided in an embodiment of the present application. Figure 2 As shown, the construction device of the intrusion detection model includes:

[0181] The building unit 201 is used to build a distributed architecture, wherein the distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks of the power Internet of Things.

[0182] Among them, the distributed architecture can realize the parallel computing of the power Internet of Things intrusion detection task. The distributed architecture is an architectural pattern for designing and deploying computer systems, in which tasks and data are divided into multiple subtasks and data blocks, and these subtasks and data blocks are processed simultaneously on multiple computing devices (nodes). These computing devices can exchange data and coordinate tasks through network communication. The goal of the distributed architecture is to improve the performance, reliability and scalability of the system.

[0183] The deployment unit 202 is constructed to construct an adaptive neural network model and deploy the adaptive neural network model to the computing nodes of the distributed architecture to obtain target nodes.

[0184] The first allocation unit 203 is used to allocate active and passive combined network detection and data perception tasks to the target node, so as to obtain context perception data of all devices in the power Internet of Things.

[0185] Among them, the active and passive combined network detection task refers to the strategy of using both active and passive methods to perform network detection in network security monitoring and intrusion detection.

[0186] Active detection refers to actively scanning, detecting and identifying potential threats in the network. It can include operations such as port scanning, vulnerability scanning, malware detection, etc. to discover possible vulnerabilities, weaknesses or malicious activities. Active detection can help discover risks in advance and take timely measures to deal with them.

[0187] Passive detection refers to passively detecting and identifying abnormal activities and potential threats in the network by monitoring network traffic, logging and abnormal behavior analysis. Passive detection does not actively intervene in network traffic, but passively monitors and analyzes traffic and events. It can detect intrusions or potential security threats by identifying abnormal traffic patterns, abnormal access behaviors or unauthorized operations.

[0188] The active and passive combined network detection task combines these two methods to comprehensively improve network security protection capabilities. Active detection can proactively discover known vulnerabilities and threats and take security measures in advance; while passive detection can discover and analyze unknown threats by monitoring network traffic and abnormal behavior. By combining the two methods, a relatively complete network security monitoring system can be formed to improve the detection capability and response speed of different types of threats.

[0189] In some possible implementations, context-aware data includes device status data, environmental parameter data, location information data, user behavior data, and real-time data streams, specifically:

[0190] Equipment status data: including the operating status, power consumption, temperature, current and other information of the power equipment, which is used to monitor the normal working status of the equipment and detect abnormal conditions.

[0191] Environmental parameter data: includes monitoring data of environmental parameters such as temperature, humidity, and air quality, which are used to evaluate the performance and reliability of equipment under different environmental conditions.

[0192] Location information data: includes information such as the device’s geographic location and installation location, which is used to locate the device and associate it with events related to other devices or geographic locations.

[0193] User behavior data: including data such as user operation behavior, usage habits, and permission management of power equipment, which is used to identify normal and abnormal behaviors of users for security detection and access control.

[0194] Real-time data stream: including real-time power data stream, communication data stream, etc., used to monitor and analyze the communication and data transmission between devices, and identify potential security threats and intrusion behaviors.

[0195] The first input unit 204 is used to input the context-aware data into the adaptive neural network model to obtain an intrusion detection model.

[0196] In some possible implementations, the device further includes:

[0197] The first acquisition unit is used to acquire historical flow data in historical intrusion detection of the power Internet of Things, and divide the historical flow data into a training data set, a test data set and a verification data set.

[0198] In order to build an adaptive neural network model, the intrusion detection model construction system first needs to obtain the historical traffic data in the historical intrusion detection of the power Internet of Things, and divide the historical traffic data into training data set, test data set and verification data set.

[0199] In some possible implementations, the historical traffic data may include, but is not limited to, network packet information, traffic statistics data, connection logs, etc.

[0200] In some possible implementations, the device further includes:

[0201] The first preprocessing unit is used to preprocess the historical traffic data and divide the preprocessed historical traffic data into the training data set, the test data set and the verification data set.

[0202] In some possible implementations, preprocessing the historical traffic data may include, but is not limited to, data cleaning, feature extraction, feature conversion, sample balancing, etc. of the collected historical traffic data to ensure the quality and applicability of the data.

[0203] The network optimization unit is used to optimize the pre-built original convolutional neural network using the training data set, the test data set, the verification data set and a genetic algorithm to obtain the adaptive neural network model.

[0204] In some possible implementations, the device further includes:

[0205] The building unit is used to build a basic neural network, and the basic neural network has a seven-layer structure.

[0206] In some possible implementations, the seven-layer structure is respectively a primary convolution layer, a maximum pooling layer, a secondary convolution layer, a primary average pooling layer, a secondary average pooling layer, a fully connected layer, and a classification layer.

[0207] Specifically, the effects and purposes of each layer are as follows:

[0208] First-level convolution layer and maximum pooling layer: Through convolution and maximum pooling operations, the network can extract local features of the input data while reducing the dimension of the data and retaining important information.

[0209] Secondary convolution layer and primary average pooling layer: Through further convolution and average pooling, the network can further extract higher-level features and enhance the network's ability to abstract input data.

[0210] Secondary average pooling layer: further reduces the dimension of feature mapping and reduces computational complexity.

[0211] Fully connected layer: Linearly combines feature maps to extract high-level features and learn complex patterns.

[0212] Classification layer: maps the output of the network to different categories to complete the classification task.

[0213] In this application, the constructed seven-layer convolutional neural network has stronger feature abstraction ability, complex pattern learning ability and computational efficiency than traditional neural networks, and is suitable for processing complex tasks and large-scale data.

[0214] The random mutation unit is used to randomly perform layer mutation and parameter mutation on the layer structure in the basic convolutional neural network.

[0215] The adaptive adjustment unit is used to adaptively adjust the layer structure of the basic convolutional neural network that undergoes the layer variation and the parameter variation to obtain the original convolutional neural network.

[0216] In some possible implementations, adaptive adjustment based on the layer structure of the variant layer means that if the variant layer is a convolution layer, the number of feature maps of the convolution layer is halved and copied and placed behind the convolution layer; if the variant layer is a pooling layer, the pooling layer is replaced by a convolution layer with a step size of 2.

[0217] In some possible implementations, adaptive adjustment based on the layer structure with parameter variation means that if a parameter variation occurs in the convolution layer, the number of feature maps of the convolution layer is doubled, if a parameter variation occurs in the pooling layer, the pooling method is changed, and if a parameter variation occurs in the fully connected layer, the number of neurons in the fully connected layer is halved.

[0218] In some possible implementations, the device further includes:

[0219] An initialization unit is used to initialize the original convolutional neural network to obtain a first convolutional neural network.

[0220] The encoding generation unit is used to perform chromosome encoding on the first convolutional neural network to obtain a second convolutional neural network, and generate population individuals corresponding to the second convolutional neural network.

[0221] In some possible implementations, when generating population individuals, initial chromosomes can be generated by random generation or other heuristic methods. Population individuals refer to a set of chromosomes, each of which represents a complete neural network. When generating the number of population individuals, it is necessary to weigh the complexity of the problem and the limitations of computing resources. Generally speaking, a larger number of population individuals can increase the search space and improve the potential for optimization, but it will also increase the computational cost. Through genetic algorithms or other optimization methods, population individuals can be crossover, mutated, and selected to evolve the population generation by generation to find the optimal convolutional neural network structure and parameter configuration. This process is repeated until the set termination condition is reached, such as reaching the maximum number of iterations or reaching a certain performance indicator.

[0222] A training unit is used to train the second convolutional neural network using the training data set to obtain a score value of the original convolutional neural network.

[0223] In some possible implementations, the using the training data set to train the second convolutional neural network to obtain a score value of the original convolutional neural network includes:

[0224] The original convolutional neural network is trained using the training data set to obtain the classification error and network structure complexity of the original convolutional neural network, and the score value of each original convolutional neural network is calculated based on the classification error and structure complexity.

[0225] In some possible implementations, the score value of the original convolutional neural network may be calculated using the following formula:

[0226]

[0227] Among them, S is the score value; F is the classification error; C is the structural complexity of the original convolutional neural network; α and β are the weight values ​​of the classification error and structural complexity respectively.

[0228] Among them, the classification error of a convolutional neural network refers to the difference between the network output and the actual label when performing a classification task. The classification error is usually measured using a loss function, such as the cross entropy loss function. The lower the classification error, the better the network's performance on the classification task.

[0229] The complexity of a network structure refers to the number of parameters and computational complexity in the network. The increase in the complexity of a network structure is often associated with an increase in the network's expressiveness and fitting capabilities, but it may also lead to overfitting problems. The following are some of the factors that affect the complexity of a network structure:

[0230] 1. Number of parameters: The more trainable parameters there are in the network, the more complex the network structure becomes. The number of parameters depends on the number of layers in the network, the width of each layer, and the connection method.

[0231] 2. Number of layers and width: The number of layers in the network and the width of each layer will affect the complexity of the network structure. Deeper networks and wider layers can provide higher nonlinear representation capabilities, but may also increase the risk of overfitting.

[0232] 3. Connection method: Different connection methods have an impact on the complexity of the network structure. For example, residual connections help gradient propagation and model convergence in deep networks, but they also increase the number of network parameters and computational complexity.

[0233] The iterative calculation unit is used to use a genetic algorithm to perform N genetic iterations on the individuals of the population to obtain multiple genetic neural networks and calculate the genetic generation number, wherein N is a positive integer greater than or equal to 1.

[0234] Among them, the genetic algorithm is an optimization algorithm based on natural selection and genetic mechanisms. In this step, the genetic algorithm continuously optimizes the structure and parameters of the original convolutional neural network through genetic iteration to find the optimal solution. Each generation includes genetic operations such as selection, crossover, and mutation to generate new network structures and parameter combinations, and evaluate their performance based on the score value.

[0235] A selection unit is used to select a genetic neural network that meets preset conditions from among the multiple genetic neural networks as a third convolutional neural network when the genetic generation meets a preset genetic generation and the score value meets a preset score value.

[0236] In some possible implementations, the preset genetic generation and the preset score value can be set according to actual conditions, and this application does not specifically limit the preset genetic generation and the preset score value.

[0237] In some possible implementations, the genetic neural network that meets the preset conditions refers to the genetic neural network with the highest score.

[0238] A tuning and testing unit is used to use the verification data set and the test data set to perform hyperparameter tuning and testing on the third convolutional neural network to obtain the adaptive neural network model.

[0239] In some possible implementations, the device further includes:

[0240] The first configuration unit is used to configure passive detection tasks, active detection tasks and allocate data perception tasks to the target node, wherein the active detection task has set the detection strategy and detection cycle.

[0241] In some possible implementations, if the model does not identify obvious abnormal behavior or malicious attacks, passive detection tasks are still required to maintain the security of the network. Passive detection tasks can include continuous collection and analysis of network traffic, event logs and other information to monitor potential risks and the emergence of abnormal behavior. If the model identifies the existence of abnormal behavior or malicious attacks, active detection tasks can be triggered. Active detection tasks refer to active scanning, detection or response measures for specific threats. For example, deep scanning, vulnerability detection, malware removal, tracking the source of attacks, etc.

[0242] In some possible implementations, the detection strategy may include port scanning, vulnerability scanning, malware detection, etc. The detection cycle may be flexibly set according to actual conditions, such as performing active detection once a day, a week, or a month.

[0243] The intrusion detection unit is used to perform real-time intrusion detection on the monitoring process of the target node to obtain a detection result.

[0244] Among them, the monitoring process is the network process of the power Internet of Things area monitored by the target node.

[0245] The second allocation unit is used to allocate the passive detection task and the active detection task to the target node according to the detection result.

[0246] The second acquisition unit is used to acquire the context perception data of all devices in the power Internet of Things during the process of allocating the passive detection task and the active detection task to the target node according to the detection result.

[0247] In some possible implementations, the device further includes:

[0248] The third acquisition unit is used to acquire the network topology structure of the power Internet of Things area monitored by the target node.

[0249] Specifically, use network scanning tools such as Nmap, Zenmap, Angry IP Scanner, etc. to scan the power Internet of Things area and detect the devices on the network and their connection relationships. These tools can identify devices and open ports in the network and provide topology maps or network maps to show the connection relationships between devices.

[0250] The second configuration unit is used to configure a detection path for the target node according to the network topology structure, and use the heartbeat mechanism to perform activity scanning on the power Internet of Things, use the activity scanning as a detection strategy and set a detection cycle.

[0251] Among them, the heartbeat mechanism is a method for detecting whether a device is active. It sends heartbeat signals periodically and then confirms the activity status of the device when the computing node receives the response. Using activity scanning as a detection strategy means that by monitoring the heartbeat signal of the device, the status and activity of the device can be understood in real time. The detection period can be set according to the actual situation to balance the detection frequency and computing load.

[0252] In some possible implementations, the device further includes:

[0253] The flow monitoring unit is used to use the adaptive neural network model to perform flow monitoring on the monitoring process of the target node to obtain real-time flow data.

[0254] Among them, real-time traffic data refers to network data traffic collected and processed in real time. In the intrusion detection of the power Internet of Things, real-time traffic data usually refers to network data packets transmitted from various devices and nodes in the power Internet of Things. These data packets contain communication information between devices, data content, and other network interaction information.

[0255] The acquisition and processing of real-time traffic data is a key step in achieving intrusion detection. By collecting and analyzing traffic data in real time, the communication behavior of the power Internet of Things can be monitored in a timely manner, and possible abnormalities or intrusion behaviors can be identified. The processing of real-time traffic data requires efficient data collection, processing, and analysis capabilities. Since the power Internet of Things usually has large-scale, high-density devices and nodes, the amount of real-time traffic data may be very large. Therefore, for the intrusion detection system, it is necessary to ensure real-time processing and efficient analysis of data to ensure timely detection and response to potential security threats.

[0256] The flow analysis unit is used to perform flow analysis on the real-time flow data to obtain the detection result.

[0257] In some possible implementations, traffic analysis may include detecting abnormal traffic patterns, identifying potential intrusion behaviors, discovering malicious code propagation, etc. Traffic analysis may be performed using rule-based methods, machine learning algorithms, or behavioral analysis techniques to promptly discover and respond to potential security threats.

[0258] In some possible implementations, the device further includes:

[0259] An allocation setting unit is used to allocate an active detection task to the target node in advance to perform active detection on the power Internet of Things when the detection result is that potential intrusion behavior is identified and discovered within the current detection cycle, and reset the detection cycle after the active detection is completed.

[0260] The third allocation unit is used to allocate a passive detection task to the target node to perform passive detection on the power Internet of Things according to the detection cycle when the detection result is that no potential intrusion behavior is found within the detection cycle.

[0261] In some possible implementations, the device further includes:

[0262] The second preprocessing unit is used to preprocess the context-aware data to obtain preprocessed data, and convert the preprocessed data into two-dimensional image data.

[0263] In some possible implementations, preprocessing includes operations such as data cleaning, feature extraction, and data conversion to facilitate subsequent intrusion detection analysis. Feature extraction: Convert the preprocessed data into a feature representation acceptable to the model so that it can be input into the intrusion detection model for analysis.

[0264] The feature extraction unit is used to extract features from the two-dimensional image data to obtain a valid feature set.

[0265] The second input unit is used to input the effective feature set into the adaptive neural network model to obtain the intrusion detection model.

[0266] In some possible implementations, the device further includes:

[0267] The collection unit is used to collect all the valid feature sets to the power calculation center.

[0268] The advantage of a distributed architecture is that multiple computing nodes perform parallel computing. However, as a manager, it is impossible to browse the tasks and results of all computing nodes. The centralized management method of gathering all valid feature sets in the power computing center makes it easier for managers to perform unified management.

[0269] In some possible implementations, the device further includes:

[0270] The intrusion analysis unit is used to use the intrusion detection model to perform intrusion analysis on the Internet of Things data to obtain analysis results.

[0271] In some possible implementations, the intrusion analysis may be, but is not limited to, streaming processing and real-time analysis.

[0272] The positioning response unit is used to perform positioning warning and security response to the intrusion behavior based on the analysis results.

[0273] In addition, an embodiment of the present application also provides a device for constructing an intrusion detection model, the device including a memory and a processor, the memory being used to store programs or codes, and the processor being used to run the programs or codes stored in the memory to implement the above-mentioned method for constructing an intrusion detection model.

[0274] In addition, an embodiment of the present application further provides a computer-readable storage medium, characterized in that a code is stored in the computer-readable storage medium, and when the code is executed, the device executing the code implements the above-mentioned intrusion detection model construction method.

[0275] The embodiment of the present application provides a device for constructing an intrusion detection model. First, a distributed architecture is constructed by using a construction unit 201, wherein the distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks in the power Internet of Things, and an adaptive neural network model is constructed by using a construction and deployment unit 202, and the adaptive neural network model is deployed to the computing node of the distributed architecture to obtain a target node. The first allocation unit 203 allocates active and passive combined network detection and data perception tasks to the target node, thereby obtaining context perception data of all devices in the power Internet of Things. Then the first input unit 204 inputs the context perception data into the adaptive neural network model to obtain an intrusion detection model. The present application constructs a distributed architecture, makes full use of the computing resources of multiple computing nodes, realizes parallel computing of tasks, and then constructs an adaptive neural network model, combines active detection and passive detection, and can comprehensively monitor and perceive network activities and data traffic in the power Internet of Things, including host activity, network traffic characteristics, etc., to improve the coverage and accuracy of intrusion detection. At the same time, combining context perception data with a neural network model can make full use of context information to enhance the intrusion detection capability of the model and improve the model's recognition capability of complex intrusion behaviors. In addition, by building a combined active and passive power Internet of Things detection system, giving priority to passive detection, and calling active detection tasks after detecting potential intrusion behavior, the network traffic and device behavior in the power Internet of Things can be continuously monitored to detect abnormal activities and potential intrusion behaviors.

[0276] The above is a detailed introduction to the construction method, system, device and storage medium of an intrusion detection model provided by the present application. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referenced to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0277] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0278] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0279] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0280] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for constructing an intrusion detection model, characterized in that: The method comprises: Establishing a distributed architecture, wherein the distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks of the power Internet of Things; Constructing an adaptive neural network model, and deploying the adaptive neural network model to a computing node of the distributed architecture to obtain a target node; Assigning active and passive combined network detection and data perception tasks to the target node, thereby obtaining context perception data of all devices in the power Internet of Things; The context-aware data is input into the adaptive neural network model to obtain an intrusion detection model.

2. The method according to claim 1, characterized in that: The process of constructing the adaptive neural network model includes: Obtain historical traffic data in historical intrusion detection of the power Internet of Things, and divide the historical traffic data into a training data set, a test data set, and a verification data set; The pre-built original convolutional neural network is optimized using the training data set, the test data set, the verification data set and a genetic algorithm to obtain the adaptive neural network model.

3. The method according to claim 2, characterized in that: The construction process of the original convolutional neural network includes: Constructing a basic neural network, wherein the basic neural network has a seven-layer structure; Randomly performing layer mutation and parameter mutation on the layer structure in the basic convolutional neural network; The original convolutional neural network is obtained by adaptively adjusting the layer structure of the basic convolutional neural network that undergoes the layer variation and the parameter variation.

4. The method according to claim 2, characterized in that: The method of optimizing the pre-built original convolutional neural network using a training data set, a test data set, a validation data set and a genetic algorithm to obtain the adaptive neural network model includes: Initializing the original convolutional neural network to obtain a first convolutional neural network; Performing chromosome encoding on the first convolutional neural network to obtain a second convolutional neural network, and generating population individuals corresponding to the second convolutional neural network; Using the training data set to train the second convolutional neural network to obtain a score value of the original convolutional neural network; Using a genetic algorithm to perform N genetic iterations on the individuals of the population to obtain multiple genetic neural networks, and calculating the genetic generation number, where N is a positive integer greater than or equal to 1; When the genetic generation satisfies a preset genetic generation and the score value satisfies a preset score value, selecting a genetic neural network that satisfies a preset condition from among the multiple genetic neural networks as a third convolutional neural network; The validation data set and the test data set are used to perform hyperparameter tuning and testing on the third convolutional neural network to obtain the adaptive neural network model.

5. The method according to claim 1, characterized in that: The assigning of active and passive combined network detection and data perception tasks to the target node, thereby obtaining context perception data of all devices in the power Internet of Things, includes: Configure a passive detection task, an active detection task and allocate a data sensing task to the target node, wherein the active detection task has set a detection strategy and a detection cycle; Performing real-time intrusion detection on the monitoring process of the target node to obtain a detection result; Allocating the passive detection task and the active detection task to the target node according to the detection result; In the process of allocating the passive detection task and the active detection task to the target node according to the detection result, contextual perception data of all devices in the power Internet of Things is obtained.

6. The method according to claim 5, characterized in that: The allocating the passive detection task and the active detection task to the target node according to the detection result includes: When the detection result is that a potential intrusion behavior is identified and discovered within the current detection cycle, an active detection task is assigned to the target node in advance to perform active detection on the power Internet of Things, and the detection cycle is reset after the active detection is completed; When the detection result is that no potential intrusion behavior is found within the detection cycle, a passive detection task is assigned to the target node to perform passive detection on the power Internet of Things according to the detection cycle.

7. The method according to claim 1, characterized in that: The step of inputting the context-aware data into the adaptive neural network model to obtain an intrusion detection model comprises: Preprocessing the context-aware data to obtain preprocessed data, and converting the preprocessed data into two-dimensional image data; Extracting features from the two-dimensional image data to obtain a valid feature set; The effective feature set is input into the adaptive neural network model to obtain the intrusion detection model.

8. A device for constructing an intrusion detection model, characterized in that: The device comprises: A building unit, used for building a distributed architecture, wherein the distributed architecture is a distributed architecture for realizing parallel computing of intrusion detection tasks of the power Internet of Things; Constructing a deployment unit, which is used to construct an adaptive neural network model, and deploying the adaptive neural network model to a computing node of the distributed architecture to obtain a target node; A first allocation unit is used to allocate active and passive combined network detection and data perception tasks to the target node, so as to obtain context perception data of all devices in the power Internet of Things; The first input unit is used to input the context-aware data into the adaptive neural network model to obtain an intrusion detection model.

9. A device for constructing an intrusion detection model, characterized in that: The device includes a memory and a processor, the memory is used to store programs or codes, and the processor is used to run the programs or codes stored in the memory to implement the method for constructing an intrusion detection model as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores codes, and when the codes are executed, a device executing the codes implements the method for constructing an intrusion detection model according to any one of claims 1 to 7.

Images