New energy power station dynamic protection-oriented intrusion detection system model optimization method

Abstract

The invention discloses a new energy power station dynamic protection-oriented intrusion detection system model optimization method. The method comprises the following steps of: retrieving to-be-detected network equipment through a preset network interface; when the to-be-detected network equipment is opened, capturing the network traffic of the to-be-detected network equipment; detecting the network traffic by using a pre-constructed intrusion detection model, and outputting a classification label corresponding to the network traffic; verifying the classification label of the network flow, and outputting a verification result; and when the verification result is inconsistent with the classification label, performing distillation optimization fine tuning on the intrusion detection model according to the network flow and the verification result, and determining an optimized intrusion detection model.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to an intrusion detection system model optimization method for dynamic protection of new energy power stations. Background Art

[0002] As the global demand for renewable energy increases, the proportion of new energy power stations (such as wind and solar power stations) in electricity production continues to increase. These power stations are monitored and managed through complex network systems to ensure the efficient operation of power generation equipment and real-time transmission of data. However, with the increase in network interconnected devices, new energy power stations are also facing increasingly serious network security threats, such as malicious traffic attacks, data theft, and network interruptions. Therefore, the construction of a dynamic protection system for new energy power stations is an important security protection measure designed to address the ever-changing network threats. Through real-time monitoring and dynamic response mechanisms, it can quickly identify and respond to various attack behaviors. However, when facing the complex network environment of new energy power stations and dynamic protection systems, traditional intrusion detection systems (IDS) may have problems such as untimely detection and high false alarm rate, which cannot meet their high reliability and high security requirements.

[0003] With the rapid development of artificial neural networks and deep learning, researchers have also applied deep neural networks to the study of network intrusion detection. However, deep learning models are based on data-driven methods. Faced with the continuous evolution of network attack methods, new attacks (such as advanced persistent threats, zero-day attacks, etc.) emerge in an endless stream. Deep learning models must learn and identify these new threats through regular updates to maintain the effectiveness of their detection capabilities. In addition, network environments and system configurations change over time. Updating intrusion detection models enables them to adapt to new network architectures, protocols, and operating environments to ensure that they continue to work effectively. However, since traffic data is generated continuously and the storage space for storing past samples is limited, it is generally impossible to permanently store all traffic information, and too many historical samples will cause the model to retrain for a long time. Therefore, how to efficiently optimize and update deep learning-based intrusion detection models is one of the main challenges currently facing this field. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides an intrusion detection system model optimization method for dynamic protection of new energy power stations.

[0005] According to one aspect of the present invention, a method for optimizing an intrusion detection system model for dynamic protection of a new energy power station is provided, comprising:

[0006] Retrieve the network device to be detected through a pre-set network interface;

[0007] When the network device to be detected is turned on, the network traffic of the network device to be detected is captured;

[0008] Use the pre-built intrusion detection model to detect network traffic and output the classification label corresponding to the network traffic;

[0009] Verify the classification labels of network traffic and output the verification results;

[0010] When the verification result is inconsistent with the classification label, the intrusion detection model is distilled and optimized according to the network traffic and verification results to determine the optimized intrusion detection model.

[0011] Optionally, when the network device to be detected is turned on, network traffic of the network device to be detected is captured, including:

[0012] Identify the various traffic types of network traffic that need to be captured;

[0013] Write regular expression-based traffic filters based on multiple traffic types;

[0014] When the network device to be detected is turned on, the network traffic of the network device to be detected is captured according to the traffic filter.

[0015] Optionally, capture network traffic of the network device to be detected based on traffic filters, including:

[0016] Set the maximum number of packets to be captured;

[0017] The network traffic is determined by capturing the traffic of the network device to be detected according to the traffic filter until the maximum number of packets is reached.

[0018] Optionally, verify the classification label of the network traffic and output the verification result, including:

[0019] The event data determined according to the network traffic and classification labels are stored in a pre-set event database;

[0020] The event data in the event database is verified to determine the verification result of the event data.

[0021] Optionally, the method further includes: when the verification result shows that the classification result is accurate, deleting event data within a predetermined time before the classification result in the event database.

[0022] Optionally, the event data of the event database includes: a traffic information table, a feature summary table, a model input table, an abnormal event table, and a false alarm analysis table.

[0023] Optionally, the intrusion detection model is optimized and fine-tuned according to the network traffic and the verification result to determine the optimized intrusion detection model, including:

[0024] According to the network traffic and verification results, real-time event data of corresponding categories are added, and combined with the historical event data used to pre-build the intrusion detection model, the intrusion detection model is distilled and fine-tuned to optimize the intrusion detection model and determine the optimized intrusion detection model.

[0025] Optionally, real-time event data of corresponding categories are added according to network traffic and verification results, and the intrusion detection model is distilled and fine-tuned in combination with historical event data used to pre-build the intrusion detection model to optimize the intrusion detection model, and the optimized intrusion detection model is determined, including:

[0026] Read sample information of historical event data from the event database to determine historical traffic samples;

[0027] Extract features from network traffic of real-time event data and determine real-time traffic samples;

[0028] Use the intrusion detection model to be optimized to predict historical traffic samples and output logical values ​​as soft labels in the fine-tuning process;

[0029] Convert the real labels of real-time traffic samples into hard labels in one-hot encoding form;

[0030] The intrusion detection model is distilled, optimized and fine-tuned based on historical traffic samples and their soft labels, real-time traffic samples and their hard labels to determine the optimized intrusion detection model.

[0031] Optionally, the distillation loss function during fine-tuning is:

[0032]

[0033] Loss=Loss old +Loss new

[0034] Where c is the number of classification categories of the model, f(x) is the output of the historical intrusion detection model, g(x) is the output of the optimized intrusion detection model, and f y (x i ) represents the sample x i Output value on the historical model, g y (x i ) means that the sample x belongs to class y i Output value on the new model, Loss old is the loss term of historical traffic samples, Loss new is the loss term of the real-time traffic sample.

[0035] According to another aspect of the present invention, there is provided an intrusion detection system model optimization device for dynamic protection of new energy power stations, comprising:

[0036] A retrieval module, used to retrieve the network device to be detected through a preset network interface;

[0037] A capture module, used for capturing network traffic of the network device to be detected when the network device to be detected is turned on;

[0038] The detection module is used to detect network traffic using a pre-built intrusion detection model and output classification labels corresponding to the network traffic;

[0039] A verification module is used to verify the classification labels of network traffic and output the verification results;

[0040] The fine-tuning module is used to perform distillation optimization and fine-tuning on the intrusion detection model according to the network traffic and verification results when the verification results are inconsistent with the classification labels, so as to determine the optimized intrusion detection model.

[0041] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the storage medium stores a computer program, and the computer program is used to execute the method described in any one of the above aspects of the present invention.

[0042] According to another aspect of the present invention, an electronic device is provided, comprising: a processor; a memory for storing instructions executable by the processor; the processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of the above aspects of the present invention.

[0043] Therefore, the present invention uses a real-time traffic collection module and a designed event database to store the collected traffic information in the event database. During optimization, the information in the event database and the new traffic data that the model needs to adapt to are used to perform distillation and fine-tuning based on the intrusion detection model to be optimized to generate an optimized model. This enables the detection system to quickly adapt to new attacks and traffic patterns, significantly improving the network security and operating efficiency of new energy power stations and dynamic protection systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] A more complete understanding of exemplary embodiments of the present invention may be obtained by referring to the following drawings:

[0045] Figure 1 It is a flow chart of an intrusion detection system model optimization method for dynamic protection of new energy power stations provided by an exemplary embodiment of the present invention;

[0046] Figure 2 It is a schematic diagram of the architecture of an intrusion detection system model optimization method for dynamic protection of a new energy power station provided by an exemplary embodiment of the present invention;

[0047] Figure 3It is a structural schematic diagram of an intrusion detection system model optimization device for dynamic protection of a new energy power station provided by an exemplary embodiment of the present invention;

[0048] Figure 4 This is a structure of an electronic device provided by an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0049] Below, the exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments of the present invention, and it should be understood that the present invention is not limited to the exemplary embodiments described here.

[0050] It should be noted that the relative arrangement of components and steps, the numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present invention unless specifically stated otherwise.

[0051] Those skilled in the art can understand that the terms "first" and "second" in the embodiments of the present invention are only used to distinguish different steps, devices or modules, etc., and neither represent any specific technical meaning nor indicate the necessary logical order between them.

[0052] It should also be understood that, in the embodiments of the present invention, “plurality” may refer to two or more than two, and “at least one” may refer to one, two or more than two.

[0053] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more, unless explicitly limited or otherwise indicated in the context.

[0054] In addition, the term "and / or" in the present invention is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in the present invention generally indicates that the associated objects before and after are in an "or" relationship.

[0055] It should also be understood that the description of the various embodiments of the present invention focuses on the differences between the various embodiments, and the same or similar aspects thereof can be referenced to each other, and for the sake of brevity, they will not be described one by one.

[0056] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0057] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the invention, its application, or uses.

[0058] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered part of the specification.

[0059] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0060] Embodiments of the present invention can be applied to electronic devices such as terminal devices, computer systems, servers, etc., which can operate with many other general or special computing system environments or configurations. Examples of well-known terminal devices, computing systems, environments and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, servers, etc. include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, large computer systems, and distributed cloud computing technology environments including any of the above systems, etc.

[0061] Electronic devices such as terminal devices, computer systems, servers, etc. can be described in the general context of computer system executable instructions (such as program modules) executed by computer systems. Generally, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in a distributed cloud computing environment, where tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can be located on local or remote computing system storage media including storage devices.

[0062] Exemplary Methods

[0063] Figure 1 1 is a flow chart of an intrusion detection system model optimization method for dynamic protection of new energy power stations provided by an exemplary embodiment of the present invention. This embodiment can be applied to electronic devices, such as Figure 1 As shown, the intrusion detection system model optimization method 100 for dynamic protection of new energy power stations includes the following steps:

[0064] Step 101, searching for a network device to be detected through a preset network interface;

[0065] Step 102, when the network device to be detected is turned on, capturing the network traffic of the network device to be detected;

[0066] Step 103, using the pre-built intrusion detection model to detect the network traffic and output the classification label corresponding to the network traffic;

[0067] Step 104, verifying the classification label of the network traffic and outputting the verification result;

[0068] Step 105, when the verification result is inconsistent with the classification label, the intrusion detection model is distilled and optimized and fine-tuned according to the network traffic and the verification result to determine the optimized intrusion detection model.

[0069] Specifically, the present invention aims to provide an intrusion detection system model optimization method for dynamic protection of new energy power stations, so as to better monitor the network in new energy power stations and enhance the dynamic protection of traffic monitoring. The specific purposes are as follows:

[0070] Due to the limited storage space for storing past traffic samples, it is impossible to store all traffic information permanently. Existing methods generally use new traffic data and original training samples to retrain the model to update the model for the identification of new traffic data while maintaining the recognition accuracy of the original traffic type. However, due to limited storage space and the low efficiency of retraining the model with a large number of original training samples, it is difficult to solve the ever-changing network traffic type scenarios.

[0071] In response to the above problems, the present invention proposes an intrusion detection system model optimization method for dynamic protection of new energy power stations. It only needs to use new traffic data and partially saved historical data, and add distillation loss to the loss function, so as to learn real-time data knowledge while retaining historical model knowledge to the greatest extent, and optimize the model to adapt to new traffic monitoring scenarios.

[0072] The present invention provides an intrusion detection system optimization method for a dynamic protection system of a new energy power station, so as to be better applied to the scenario of network dynamic protection of the new energy power station.

[0073] The technical solution adopted by the method of the present invention is: an intrusion detection system model optimization method for dynamic protection of new energy power stations, using a real-time traffic collection module and a designed event database to store the collected traffic information in an event database, and during optimization, using the information in the event database and the new traffic data that the model needs to adapt to perform distillation and fine-tuning based on the intrusion detection model to be optimized to generate an optimized model. The overall architecture is shown in the attached figure. Figure 2 As shown in the figure, the implementation of the real-time traffic collection module depends on the integration of the libpcap library in the Python environment. The libpcap library was originally developed based on the C language. Through the Python encapsulation library, Python programs can directly call its API to capture, filter and process network traffic. In this technology, the following steps are followed to capture and analyze traffic using the libpcap library integrated with Python:

[0074] (1) Determine the sniffing target: First, determine the network interface that needs to be monitored based on actual needs. Using the relevant interfaces provided by the libpcap library, you can easily retrieve the network devices in the system. The network devices can be any networking devices in the new energy power station.

[0075] (2) Open the sniffing session: After selecting the network device, the program will open the device to start capturing the traffic inside and outside the power station. During this process, the maximum packet size of the capture can be set as needed. Once the device is successfully opened, a session dedicated to traffic capture will be established.

[0076] (3) Set up traffic filters: If you are only interested in a specific type of network traffic, where the specific type can be customized based on characteristics, such as the information in the characteristic summary table below, you can write a filter based on regular expressions. This filter can help accurately filter out network packets that match a specific pattern.

[0077] The intrusion detection model to be optimized can be a deep learning model of any architecture, and its output needs to be multi-classified, that is, including normal behavior and multiple attack behaviors, where the attack behaviors include DDoS, Bot, PortScan, DoSSlowloris, DoS Slowhttptest, DoS Hulk, DoS GoldenEye, Heartbleed, FTP-Patator, SSH-Patator, Web Attack-Brute Force, Web Attack-Sql Injection, WebAttack-XSS and Infiltration and other types of attack traffic.

[0078] (4) Packet capture. At this stage, each time a data packet is captured, a custom function will be automatically called. In this function, operations such as outputting the packet content can be performed. In our intrusion detection task, the data packet can be passed to the preprocessing module at this stage and then input into the intrusion detection model for detection.

[0079] The event database is used to store power station flow information within a period of time, processed sample feature information, etc. These data cover the real-time information captured during the detection process to the data points generated in the intermediate calculation stage. However, due to the limited storage resources, these data are not permanently retained. Once the confirmation is completed and the model judgment is correct, the system will automatically delete all samples of the attack behavior 1 minute ago, and delete the data of non-attack behavior regularly (such as 30 days). If the model is misjudged, the corresponding data is added when the model is updated to optimize the model. . It includes 5 tables for storing relevant information in the real-time flow detection process: flow information table, feature summary table, model input table, abnormal event table, and false alarm analysis table. Its implementation is as follows:

[0080] (1) Flow information table

[0081] This table records the network traffic data entering the power plant dynamic system within a specific period of time. Each record will first be reviewed by the intrusion detection model and then stored in the database for use by the subsequent false alarm analysis module. The table structure contains the traffic unique identifier (id), timestamp (time), data source IP (src_ip), destination IP (dst_ip), data source port (src_port), destination port (dst_port), communication protocol (protocol) and data packet details (packet). Considering performance and efficiency, the maximum length of the packet field is limited to 10,000 bytes. During the intrusion detection process, since the analysis does not deeply depend on the data load of the application layer, if the packet length exceeds the set limit, only part of the information is retained. The table is implemented as follows:

[0082]

[0083]

[0084] (2) Feature Summary Table

[0085] This table is used to store key feature information extracted from network traffic. Each record contains the traffic unique identifier (id), timestamp (time), data source IP (source_ip), destination IP (dst_ip), data source port (source_port), destination port (dst_port), communication protocol (protocol), and a series of interpretable feature values, such as the number of packets in 1 minute (packet_number_1) and the number of different ports accessed in 1 minute (port_number_1). These feature values ​​are differentiated according to different time windows and are represented in different fields in the table. The table is implemented as follows:

[0086]

[0087] (3) Model input table

[0088] This table stores normalized traffic feature data, which can be directly used as input for intrusion detection models after splicing. The table structure includes sample unique identifier (id), timestamp (time), data source IP (source_ip), destination IP (dst_ip), data source port (source_port), destination port (dst_port), communication protocol (protocol), and a series of interpretable feature fields that are the same as the feature summary table. Among them, the sample's unique identifier corresponds to the traffic unique identifier in the previous two tables, ensuring that each traffic and its processed sample can be uniquely identified. The table is implemented as follows:

[0089]

[0090] (4) Abnormal event table

[0091] This table is used to record the sample information that is judged as abnormal by the system, including the sample unique identifier (id), timestamp (time), attack type (attack_type), administrator confirmation status (is_checked), and model false alarm status (is_false_positive). Among them, the initial value of the is_checked field is "no", and when the administrator confirms the abnormal event, the value will be updated to "yes"; the initial value of the is_false_positive field is empty, and after the administrator confirms, it will be updated to "yes" or "no" depending on whether the event actually occurred. The implementation of this table is as follows:

[0092]

[0093] (5) False Alarm Analysis Table

[0094] This table is used to store detailed information about samples that administrators have confirmed as false positives, including the sample's unique identifier (id), true classification (real_class), model prediction classification (pred_class), and storage location (file_location) of false positive explanation results. This information is helpful for subsequent model tuning and false positive analysis. The table is implemented as follows:

[0095]

[0096] The distillation fine-tuning process based on the intrusion detection model to be optimized includes the following sub-steps:

[0097] (1) Sample information extraction and conversion from the event database: In order to train or evaluate the intrusion detection model, the stored sample information is first read from the event database. This sample information contains the original traffic data and its related feature data. Through the data preprocessing step, this sample information can be directly converted into a feature vector that the model can understand as the input of the model.

[0098] (2) Preprocessing real-time data: Perform operations such as feature extraction and normalization on the real-time data that will be used to optimize the intrusion detection model. This operation follows the original operation process of the intrusion detection model to be optimized.

[0099] (3) Use historical data and real-time data to fine-tune the model: When fine-tuning the intrusion detection model to be optimized, a method that combines historical data and real-time data is adopted. For the historical traffic samples stored in the event database, the model to be optimized is first used to make predictions and obtain its output logits (i.e., the model's prediction confidence for each category, and the confidence of each category represents the probability that the model infers that the traffic data corresponds to the category). These logits will be used as "soft labels" for historical data during the fine-tuning process because they contain the model's understanding of the current data. For real-time data, its true category label is directly used and converted into one-hot encoding form. Then, the real-time data and part of the historical data are used to fine-tune the model with the following distillation loss as the target to achieve the optimization purpose.

[0100] (4) The fine-tuning process designs the distillation loss as the optimization objective, and the loss function is as follows:

[0101]

[0102] Loss=Loss old +Loss new

[0103] In the formula, c is the number of classification categories of the model, f(x) is the output of the historical model, g(x) is the output of the new model, and f y (x i ) represents the sample x i The output value of the historical model, that is, the model believes that the sample x i The probability value of belonging to class y, g y (x i ) means that the sample x belongs to class y i The output value on the new model. When the true label of sample i is y, The value is 1, The value is 0; on the contrary, when the true label of sample i is not y, The value is 0, The value is 1. The final loss is the loss of historical data plus the loss of real-time data, that is, Loss old +Loss new .

[0104] (5) The fine-tuned model is the optimized model, which can be used in the dynamic network protection system of new energy power stations to predict traffic in new scenarios.

[0105] The present invention is applicable to various types of new energy power stations such as wind power and solar power, as well as various types of network systems that require dynamic protection. In an increasingly complex network environment, the intrusion detection model needs to be regularly updated and optimized to improve its protection effect on new traffic samples, and the old traffic data cannot be permanently stored due to limited storage space. The present invention does not need to use a large amount of original training data, but only needs to use part of the original training samples and the new traffic samples that need to be optimized to distill and fine-tune the intrusion detection model to be optimized, which greatly improves the efficiency of model optimization and optimizes the detection effect of the model in the face of new traffic. At the same time, it retains the original old model knowledge to the greatest extent, and realizes dynamic protection of network traffic monitoring in new energy power stations.

[0106] Therefore, the present invention designs a real-time traffic collection module and an event database to realize real-time traffic monitoring at the key network interface of the new energy power station and the dynamic protection system, and performs efficient traffic acquisition and processing, ensuring that the new energy power station and the dynamic protection system can timely monitor and analyze network traffic and discover potential security threats. During model optimization, only part of the old samples and new traffic samples stored in the event database are used, and the knowledge learned by the old model is extracted by knowledge distillation. The optimized new model is obtained by adding distillation loss to the loss function and then fine-tuning the old model. Since the distillation fine-tuning of the present invention only uses part of the old samples, compared with retraining with all the training samples, the present invention efficiently optimizes the performance of the new traffic scenario of the intrusion detection model while retaining the old model knowledge to the greatest extent. The present invention realizes dynamic protection of traffic monitoring of new energy power stations by efficiently optimizing the intrusion detection system, so that the detection system can quickly adapt to new attacks and traffic patterns, and significantly improves the network security and operation efficiency of new energy power stations and dynamic protection systems.

[0107] Exemplary Devices

[0108] Figure 3 FIG. 1 is a schematic diagram of a structure of an intrusion detection system model optimization device for dynamic protection of a new energy power station provided by an exemplary embodiment of the present invention. Figure 3 As shown, the device 300 includes:

[0109] A search module 310 is used to search for a network device to be detected through a preset network interface;

[0110] The capture module 320 is used to capture the network traffic of the network device to be detected when the network device to be detected is turned on;

[0111] The detection module 330 is used to detect network traffic using a pre-built intrusion detection model and output a classification label corresponding to the network traffic;

[0112] Verification module 340, used to verify the classification label of network traffic and output the verification result;

[0113] The fine-tuning module 350 is used to perform distillation optimization and fine-tuning on the intrusion detection model according to the network traffic and the verification result when the verification result is inconsistent with the classification label, so as to determine the optimized intrusion detection model.

[0114] Optionally, the capture module 320 includes:

[0115] A determination submodule, used to determine multiple traffic types of network traffic that need to be captured;

[0116] Writing submodules for writing regular expression based traffic filters based on multiple traffic types;

[0117] The capture submodule is used to capture the network traffic of the network device to be detected according to the traffic filter when the network device to be detected is turned on.

[0118] Optionally, capture submodules, including:

[0119] A setting unit is used to set the maximum number of packets to be captured;

[0120] The capture submodule is used to determine the network traffic volume when capturing the traffic of the network device to be detected according to the traffic filter until the maximum number of data packets is reached.

[0121] Optionally, the verification module 340 includes:

[0122] A storage submodule is used to store event data determined according to network traffic and classification labels into a pre-set event database;

[0123] The verification submodule is used to verify the event data in the event database and determine the verification result of the event data.

[0124] Optionally, the device 300 further includes: a deleting module, configured to delete event data within a predetermined time before the classification result in the event database when the verification result shows that the classification result is accurate.

[0125] Optionally, the event data of the event database includes: a traffic information table, a feature summary table, a model input table, an abnormal event table, and a false alarm analysis table.

[0126] Optionally, the fine-tuning module 350 includes:

[0127] The fine-tuning submodule is used to add real-time event data of corresponding categories according to network traffic and verification results, and to distill and fine-tune the intrusion detection model in combination with the historical event data used to pre-build the intrusion detection model to optimize the intrusion detection model and determine the optimized intrusion detection model.

[0128] Optionally, fine-tune submodules, including:

[0129] A reading unit, used to read sample information of historical event data from an event database to determine a historical traffic sample;

[0130] An extraction unit, used to extract features from network traffic of real-time event data and determine real-time traffic samples;

[0131] A prediction unit, used to predict historical traffic samples using the intrusion detection model to be optimized, and output logical values ​​as soft labels in the fine-tuning process;

[0132] A conversion unit, used to convert the real labels of real-time traffic samples into hard labels in one-hot encoding form;

[0133] The fine-tuning unit is used to perform distillation optimization and fine-tuning on the intrusion detection model according to historical traffic samples and their soft labels, real-time traffic samples and their hard labels, and determine the optimized intrusion detection model.

[0134] Optionally, the distillation loss function during fine-tuning is:

[0135]

[0136] Loss=Loss old +Loss new

[0137] Where c is the number of classification categories of the model, f(x) is the output of the historical intrusion detection model, g(x) is the output of the optimized intrusion detection model, and f y (x i ) represents the sample x i Output value on the historical model, g y (x i ) means that the sample x belongs to class y i Output value on the new model, Loss old is the loss term of historical traffic samples, Loss new is the loss term of the real-time traffic sample.

[0138] Exemplary Electronic Devices

[0139] Figure 4 This is a structure of an electronic device provided by an exemplary embodiment of the present invention. Figure 4 As shown, the electronic device 40 includes one or more processors 41 and a memory 42 .

[0140] The processor 41 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0141] The memory 42 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 41 may run the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above and / or other desired functions. In one example, the electronic device may also include: an input device 43 and an output device 44, which are interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0142] In addition, the input device 43 may also include, for example, a keyboard, a mouse, etc.

[0143] The output device 44 can output various information to the outside, and can include, for example, a display, a speaker, a printer, a communication network and a remote output device connected thereto.

[0144] Of course, to simplify, Figure 4 Only some of the components related to the present invention in the electronic device are shown, and components such as a bus, an input / output interface, etc. are omitted. In addition, the electronic device may further include any other appropriate components according to specific application conditions.

[0145] Exemplary computer program products and computer-readable storage media

[0146] In addition to the above-mentioned methods and devices, an embodiment of the present invention may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the method according to various embodiments of the present invention described in the above-mentioned "Exemplary Method" section of this specification.

[0147] The computer program product may be written in any combination of one or more programming languages ​​to write program code for performing the operations of the embodiments of the present invention, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0148] In addition, an embodiment of the present invention may also be a computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, enable the processor to execute the steps of the method according to various embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0149] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, system or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0150] The basic principle of the present invention is described above in conjunction with specific embodiments. However, it should be pointed out that the advantages, strengths, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present invention. In addition, the specific details disclosed above are only for the purpose of illustration and facilitation of understanding, rather than limitation, and the above details do not limit the present invention to being implemented by adopting the above specific details.

[0151] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0152] The block diagrams of the devices, systems, equipment, and systems involved in the present invention are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagram. As will be appreciated by those skilled in the art, these devices, systems, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, referring to "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The word "such as" used here refers to the phrase "such as but not limited to", and can be used interchangeably with it.

[0153] The method and system of the present invention may be implemented in many ways. For example, the method and system of the present invention may be implemented by software, hardware, firmware or any combination of software, hardware, firmware. The above order of steps for the method is only for illustration, and the steps of the method of the present invention are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present invention may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present invention. Thus, the present invention also covers a recording medium storing a program for executing the method according to the present invention.

[0154] It should also be noted that in the system, device and method of the present invention, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be regarded as equivalent schemes of the present invention. The above description of the disclosed aspects is provided to enable any technician in the field to make or use the present invention. Various modifications to these aspects are very obvious to those skilled in the art, and the general principles defined here can be applied to other aspects without departing from the scope of the present invention. Therefore, the present invention is not intended to be limited to the aspects shown here, but in accordance with the widest range consistent with the principles and novel features disclosed here.

[0155] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present invention to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A model optimization method for intrusion detection system for dynamic protection of new energy power stations, characterized in that: include: Retrieve the network device to be detected through a pre-set network interface; When the network device to be detected is turned on, capturing network traffic of the network device to be detected; Detect the network traffic using a pre-built intrusion detection model, and output a classification label corresponding to the network traffic; Verifying the classification label of the network traffic and outputting a verification result; When the verification result is inconsistent with the classification label, the intrusion detection model is distilled, optimized and fine-tuned according to the network traffic and the verification result to determine the optimized intrusion detection model.

2. The method according to claim 1, characterized in that When the network device to be detected is turned on, capturing network traffic of the network device to be detected includes: Identify the various traffic types of network traffic that need to be captured; Write regular expression-based traffic filters based on multiple traffic types; When the network device to be detected is turned on, the network traffic of the network device to be detected is captured according to the traffic filter.

3. The method according to claim 2, characterized in that Capturing the network traffic of the network device to be detected according to the traffic filter includes: Set the maximum number of packets to be captured; The network traffic is determined based on the traffic filter capturing the traffic of the network device to be detected until the maximum number of data packets is reached.

4. The method according to claim 1, characterized in that: Verifying the classification label of the network traffic and outputting a verification result includes: storing the event data determined according to the network traffic and the classification tags into a preset event database; The event data in the event database is verified to determine a verification result of the event data.

5. The method according to claim 4, characterized in that Also includes: When the verification result shows that the classification result is accurate, the event data within a predetermined time before the classification result in the event database is deleted.

6. The method according to claim 4, characterized in that The event data of the event database includes: a flow information table, a feature summary table, a model input table, an abnormal event table, and a false alarm analysis table.

7. The method according to claim 4, characterized in that Optimizing and fine-tuning the intrusion detection model according to the network traffic and the verification result to determine an optimized intrusion detection model includes: According to the network traffic and the verification results, real-time event data of corresponding categories are added, and combined with the historical event data used to pre-build the intrusion detection model, the intrusion detection model is distilled and fine-tuned to optimize the intrusion detection model and determine the optimized intrusion detection model.

8. The method according to claim 7, characterized in that According to the network traffic and the verification result, real-time event data of corresponding categories are added, and combined with the historical event data used to pre-build the intrusion detection model, the intrusion detection model is distilled and fine-tuned to optimize the intrusion detection model, and the optimized intrusion detection model is determined, including: Read sample information of historical event data from the event database to determine a historical traffic sample; Extracting features of network traffic of the real-time event data to determine a real-time traffic sample; Using the intrusion detection model to be optimized to predict the historical traffic samples, and outputting a logical value as a soft label in the fine-tuning process; Convert the real label of the real-time traffic sample into a hard label in one-hot encoding form; The intrusion detection model is distilled, optimized and fine-tuned according to the historical traffic samples and their soft labels, the real-time traffic samples and their hard labels, to determine the optimized intrusion detection model.

9. The method according to claim 8, characterized in that The distillation loss function during fine-tuning is: Loss=Loss old +Loss new Where c is the number of classification categories of the model, f(x) is the output of the historical intrusion detection model, g(x) is the output of the optimized intrusion detection model, and f y (x i ) represents the sample x i Output value on the historical model, g y (x i ) means that the sample x belongs to class y i Output value on the new model, Loss old is the loss term of historical traffic samples, Loss new is the loss term of the real-time traffic sample.

10. An intrusion detection system model optimization device for dynamic protection of new energy power stations, characterized in that: include: A retrieval module, used to retrieve the network device to be detected through a preset network interface; A capture module, used for capturing network traffic of the network device to be detected when the network device to be detected is turned on; A detection module, used to detect the network traffic using a pre-built intrusion detection model and output a classification label corresponding to the network traffic; A verification module, used to verify the classification label of the network traffic and output a verification result; A fine-tuning module is used to perform distillation optimization and fine-tuning on the intrusion detection model according to the network traffic and the verification result when the verification result is inconsistent with the classification label, so as to determine the optimized intrusion detection model.

11. The device according to claim 10, characterized in that In the capture module, include: A determination submodule, used to determine multiple traffic types of network traffic that need to be captured; Writing submodules for writing regular expression based traffic filters based on multiple traffic types; The capturing submodule is used to capture the network traffic of the network device to be detected according to the traffic filter when the network device to be detected is turned on.

12. The device according to claim 11, characterized in that Capture submodules, including: A setting unit is used to set the maximum number of packets to be captured; A determination unit is used to determine the network traffic when the traffic filter captures the traffic of the network device to be detected until the maximum number of data packets is reached.

13. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and the computer program is used to execute the method according to any one of claims 1 to 9.

14. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1 to 9.

Images