Unknown attack-oriented power network abnormal behavior discrimination method

Abstract

The invention provides an unknown attack-oriented power network abnormal behavior discrimination method. The method comprises the following steps of 1, analyzing network behavior indexes of known attacks; step 2, screening attack high resolution indexes; and step 3, index calculation oriented to attack discrimination. By applying the technical scheme, redundant indexes can be effectively removed, and the detection rate of the system is improved.

Description

Technical Field

[0001] The invention relates to the technical field of power network abnormal behavior identification, in particular to a power network abnormal behavior identification method facing unknown attacks. Background Art

[0002] The identification of attack network traffic is usually based on attack data indicators. Currently, there are many technologies that can identify known attacks. However, although the identification of unknown attacks has begun to attract people's attention, it is difficult to answer what is an unknown attack and what are the indicators of unknown attacks.

[0003] Unknown attacks can be roughly divided into two categories: one is new attacks, and the other is variant attacks.

[0004] Variant attacks are generally aimed at the signature technology used by most current virus and Trojan scanning software, and evade scanning by simply removing the signature. To identify variant attacks, it is necessary to find some atypical features that can still identify the type of attack in the variant.

[0005] New attacks usually use newly discovered vulnerabilities or multiple old vulnerabilities and use new attack ideas to complete the attack. The attack library generally lacks typical features of such attacks. Therefore, to identify such attacks, it is also necessary to identify some atypical features from network traffic or its code for comprehensive judgment. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a method for identifying abnormal behavior of power networks facing unknown attacks, which effectively removes redundant indicators and improves the detection rate of the system.

[0007] To achieve the above object, the present invention adopts the following technical solution: a method for identifying abnormal behavior of power network facing unknown attacks, comprising the following steps:

[0008] Step 1: Analyze network behavior indicators of known attacks;

[0009] Step 2: Screen the attack high-resolution indicators;

[0010] Step 3: Calculate indicators for attack identification.

[0011] In a preferred embodiment, the attack network behavior datasets collected and organized in step 1 include KDD99, NSL-KDD, and UNSW-NB.

[0012] In a preferred embodiment, the step 2 includes screening of high-resolution attack indicators based on learning automata and classification verification of high-resolution network attack indicators.

[0013] In a preferred embodiment, in the screening of attack high-resolution indicators based on learning automata, the problem description of indicator selection is first given; secondly, the mapping of automata learning problems is introduced; and finally, the method of indicator selection and identification technology newly proposed by the project is presented.

[0014] In a preferred embodiment, the anomaly identification algorithm is analyzed and evaluated based on two different data sets in the classification verification of high-resolution indicators of network attacks, namely KDD99 and UNSW-NB15 data sets; in addition, the most important indicators selected from KDD99 are extended to the UNSW-NB15 data set to measure their efficiency and universality.

[0015] In a preferred embodiment, the step 3 specifically includes:

[0016] Step 31: Extraction and calculation of long-span sequence indicators;

[0017] Step 32: Extraction and calculation of combined sequence indicators;

[0018] Step 33: Identification of traffic anomalies based on SVM.

[0019] In a preferred embodiment, step 31 is specifically as follows: The calculation formula of [same_srv_rate] is as follows: Count all the connections in the past 2 seconds of the current connection, filter out the connections with the same target host as the current connection, and count the number of connections, recorded as N d ; Then filter out the connections with the same target host as the current connection and the connections with the same service as the current connection, and count the number of connections, recorded as N s ; The index value can be obtained using the following formula:

[0020]

[0021] In order to effectively apply the indicators in the KDD and UNSW-NB15 datasets to the actual environment of the power information network, the calculation formula of the indicators must be expanded: the statistical time can be extended from 2 seconds to a longer time; for the sake of flexibility, the specific time span for extracting long-span indicators should be set; therefore, a flexible time frame needs to be established in the design to support different time spans.

[0022] In a preferred embodiment, step 32 is specifically as follows: the indicator [dst_host_same_src_port_rate] refers to the percentage of connections with the same target host and source port as the current connection in the first 100 connections; the steps of correlation analysis of network messages are as follows: first, filter out the first 100 connection message records based on the current connection, and then count the number of connections with the same target host and source port as the current connection, recorded as Nds. The indicator value can be obtained by the following formula:

[0023]

[0024] By performing correlation analysis on the combined indicators of the network traffic packet data, the combined indicators [dst_host_count], [dst_host_srv_count], [dst_host_same_src_port_rate], and [dst_host_srv_diff_host_rate] can be easily extracted and integrated from the network traffic data packets.

[0025] In a preferred embodiment, the step 33 is specifically as follows:

[0026] First, the network traffic data packets are captured and the protocol is restored. By analyzing and cleaning the network traffic data packets, the network traffic index value of each data packet is extracted and stored in the index pool.

[0027] Secondly, the indicator calculation method introduced above is applied to perform statistics and calculation of high-resolution indicators for each original indicator and corresponding data value in the indicator pool;

[0028] Finally, these high-resolution indicators are input into the support vector machine (SVM) classifier. During the training process of the SVM classifier, the support vector machine trains the input data, iterates multiple times, selects several support vector particles, and thus performs multi-dimensional identification and classification of network traffic data, and finally outputs the identified type of each data packet. In the identification of network traffic anomalies, the traffic is classified in real time according to the traffic indicators, and abnormal traffic that may be caused by attacks is selected.

[0029] Compared with the prior art, the present invention has the following beneficial effects: The present invention uses the two most common attack data sets: the KDD data set and the UNSW-NB data set. First, an indicator screening experiment of known attacks is carried out, which effectively removes redundant indicators and improves the detection rate of the system. Then, the indicators screened out from the small network data set are used to verify the indicators of large networks or data sets, and classification experiments of unknown attacks are carried out to identify abnormal behaviors. Finally, the flow indicators screened out by the indicators are analyzed, and extraction analysis is performed. In combination with the big data platform, long-span indicators and combined indicators are extracted and calculated, and the identification of SVM-based flow anomalies is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of a technical route for research on abnormal behavior identification technology for unknown attacks according to a preferred embodiment of the present invention;

[0031] Figure 2 A structural diagram of a learning automaton according to a preferred embodiment of the present invention;

[0032] Figure 3 A flowchart of an attack high-resolution index screening algorithm according to a preferred embodiment of the present invention;

[0033] Figure 4 A schematic diagram of a design of an indicator calculation system for attack identification according to a preferred embodiment of the present invention;

[0034] Figure 5 This is a block diagram of identifying abnormal network traffic behavior according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0036] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0037] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0038] A method for identifying abnormal behavior of power networks facing unknown attacks, reference Figure 1-5, including the following steps: Step 1: Analyze the network behavior indicators of known attacks; Step 2: Screen the high-resolution indicators of attacks; Step 3: Calculate indicators for attack identification.

[0039] Specifically, in step 1: the attack data set that provides network data is usually collected by building a simulated network, that is, implementing a specific attack in the simulated network and recording the network behavior generated by the attack. In addition to the network behavior generated by the attack, data collection in the simulated network also needs to simulate normal network traffic and collect data from both positive and negative sample perspectives. The network types targeted by each data set are also different, some are for sensor networks, some are for backbone networks, and some are for local area networks.

[0040] The two most common attack network behavior datasets currently known to be collected and organized using the above method are KDD99, NSL-KDD, and UNSW-NB.

[0041] 1) Indicators used in the KDD series attack dataset

[0042] The KDD series of attack data sets has a total of 41 indicators used to express a connection. These indicators are screened and extracted from the traffic data and audit logs in the simulated network. For convenience, we divide these indicators into four categories: basic indicators (9), connection content indicators (13), time flow indicators (9) and host flow indicators (10), as shown in Table 1:

[0043] Table 1: Metrics of the KDD dataset

[0044]

[0045]

[0046]

[0047]

[0048]

[0049]

[0050] 2) Indicators used in the UNSW-NB15 dataset

[0051] The WNSW-NB15 dataset contains a total of 48 indicators, as shown in Table 2.

[0052] Table 2: Metrics of the NB15 dataset

[0053]

[0054]

[0055]

[0056] Based on the summary and analysis of network behavior indicators in existing data sets, they can be roughly divided into four categories: one is the basic indicators of data traffic, including time, length, protocol type, service type, number of error packets, etc.; the second is connection content indicators, including whether the connection involves super user login, or whether there is a login failure; the third is time traffic indicators, which extract some continuity relationships between connections on the timeline, including whether the connection is repeated within two seconds, whether there is an erroneous connection within two seconds, and changes in connection types, etc.; the fourth is host traffic indicators, which extract horizontal correlation relationships among the top 100 connections, such as the number of connections to the same host, the number of connections to the same service, the number of errors, etc.

[0057] Specifically, in step 2: for the identification of abnormal attacks on power information network traffic, the attack data is complex and multidimensional, and the indicator space of the attack data has high-dimensional and nonlinear characteristics. Network traffic packets are composed of massive traffic data, which records all activities and behaviors of the terminal. By analyzing and integrating these network traffic packets, indicators are extracted from them. Traditional neural network learning methods and most machine learning methods often have difficulties in dealing with this problem. For the network traffic anomaly identification system (NIDS), normal and abnormal behaviors can be detected by analyzing network traffic. However, the network traffic data packets contain a large number of indicators, which undoubtedly increases the difficulty of identification. These indicators contain many redundant indicators, which will greatly reduce the efficiency and accuracy of abnormal attack identification and increase the difficulty of indicator calculation. How to efficiently process these massive indicator data is a huge challenge. For various network traffic indicators, which indicators have the best discrimination and high resolution for attacks? High-resolution indicators can greatly improve the processing efficiency of the identification system. How to screen these high-resolution indicators in large data streams and use them for effective abnormal behavior identification. Learning automata (LA) is a reinforcement learning method that selects the optimal behavior given by the environment from a set of possible behaviors through a learning mechanism by interacting with a random stable or non-stationary environment. Learning automata can be applied to many types of problems such as game theory, pattern recognition, target classification, intrusion detection, etc., and its application range is very wide. To this end, the learning automata algorithm is used to optimize and screen network traffic indicators, and the optimal high-resolution indicators are selected, so that they can be used to identify abnormal network attack behaviors.

[0058] 1) Screening of high-resolution attack indicators based on learning automata

[0059] The indicator selection algorithm based on learning automata can be used to screen the most important and effective indicators in network traffic anomaly identification, so as to use these most effective indicators to identify and classify abnormal network attack behaviors. All indicators are modeled as a learning automaton. Through the interaction with the classifier and the evolution of the learning automaton, redundant and irrelevant indicators are removed one by one. When the learning automaton meets the convergence conditions, the most important and critical indicators are finally screened out to form the optimal indicator subset. The use of these screened indicators can effectively improve the efficiency of network traffic anomaly identification and can be applied to the network environment of power information systems.

[0060] The specific details of the method are as follows: first, the problem description of indicator selection is given; second, the mapping of automaton learning problems is introduced; finally, the method of indicator selection and identification technology newly proposed by the project is presented.

[0061] ① Problem description. The power information network consists of a large amount of traffic data, which reflects and records all activities of terminal devices. By analyzing and extracting the information of these network traffic data packets, indicators are extracted. Given an indicator set F = {f1, f2, …, f N}, where N represents the number of indicators of network traffic. Our goal is to remove redundant indicators and select the most important and effective indicators from the indicator set F through interaction with the classifier. This problem can be simplified to that we only need to remove those indicators whose removal will improve the detection accuracy.

[0062] In addition, we need to find a standard to measure the performance of the algorithm. By using a classic classification evaluation indicator, namely accuracy (Acc) and false alarm rate (FAR). The elements of the classification evaluation indicator are a four-tuple {TP, FP, TN, FN}, where TP (TruePositive) is the number of correctly classified normal network traffic records, FP (FalsePositive) is the number of incorrectly classified normal traffic records, TN (TrueNegative) is the number of correctly classified attack types, and FN (FalseNegative) is the number of incorrectly classified attack types. Accuracy is defined as the number of correctly classified records divided by the total number of network traffic records. The accuracy formula is as follows:

[0063]

[0064] The false alarm rate (FAR) is the average ratio of false alarms to classified traffic records. The formula is as follows:

[0065]

[0066] As we all know, the closer the accuracy is to 100% and the closer the false alarm rate is to 0%, the more reliable the identification technology is.

[0067] ② Construction of solution. The indicator selection problem can be mapped to the learning problem of automata. Figure 2 The learning process of a learning automaton consists of four main entities: the learning automaton, behavior, random environment, and feedback.

[0068] All network traffic indicators are modeled as a whole learning automaton, and the indicator set F = {f1,f2,…,f N} represents the set of optional behaviors of the learning automaton, and each indicator is an optional behavior. A classic learning automaton algorithm DL RI It is applied to the problem of selecting the optimal indicator subset from the entire indicator set. The random environment allows binary feedback, including rewards and penalties. The P model environment, and the update strategy is the RI (Reward-Inaction) strategy. Only when the selected indicator reduces the overall accuracy will the behavior be rewarded and the probability of selection of the behavior will be increased. The structure of the discrete linear learning automaton can be described as follows:

[0069] a) Behavior: α={α1,α2,…,α r The behavior set is defined as a set F of network traffic indicators. Each indicator is an optional behavior α i In each iteration, the automaton selects an action based on the action probabilities.

[0070] b) Feedback: β = {0,1} The feedback of the random environment is binary, where 0 and 1 represent reward and punishment respectively. The behavior probability P(t) will be updated only when the feedback is a reward. The feedback of the random environment corresponds to the classification result of the classifier.

[0071] c) Environment: The stochastic environment is responsible for responding to feedback about the selected behavior in each iteration. In addition, in the proposed learning automaton framework, the environment corresponds to the classification environment for network traffic anomaly identification.

[0072] ③Specific algorithm. Figure 3 The algorithm flow chart of the high-resolution index selection method for network traffic is given in . The following will introduce the process of the index selection method based on this framework.

[0073] Before the indicator selection process begins, some parameters need to be initialized and set. T1 is the accuracy threshold that determines whether the selected behavior is rewarded or not. T2 is the behavior probability threshold that determines whether the behavior should be removed. We assume that the input behavior set is α = {α1, α2, …, α r}, the behavior probability vector P should be initialized to 1 / r to ensure that each optional behavior can be selected with equal probability, and the minimum step size of the probability change is defined as Δ=1 / αr, where α is the resolution parameter and R is the set of remaining indicators by removing redundant indicators in each iteration. Initially, R contains all indicators.

[0074] In each iteration, the indicators in the remaining indicator set R in the training set are first retained, and a training subset is constructed. Then, according to the behavior probability vector, the learning automaton selects a behavior α(t) = α at time t. i In order to ensure the randomness of the reward, two small batch sets are selected from the training subset, namely the small batch training set Tr(t) and the verification set Va(t), which cannot be equal. According to the selected behavior, the i-th indicator f is temporarily removed from Tr(t) and Va(t) i The processed mini-batch training set is used to train the classifier and obtain a training model containing optimized parameters. The classifier then uses the mini-batch validation set to test the model and obtain the classification accuracy. If the classification accuracy is higher than the accuracy threshold T1, it means that the selected indicator f i Too redundant to improve classification accuracy, that is, detection accuracy. Then, the random environment will respond with a feedback β(t) = 0 and reward the selected behavior. Only when the feedback is a reward, the learning automaton will update the behavior probability vector P(t) with the following update formula:

[0075] p j (t+1)=max{p j (t)-Δ,0},

[0076] j≠i

[0077] p i (t+1)=min{1-Σ j≠i p j (t), 1}

[0078] In this way, the probability of the behavior of redundant indicators will continue to increase, and the others will decrease. If the updating process continues, the probability of these redundant indicators will grow faster and faster, and the probability of other indicators will gradually decrease to zero. Finally, the probability of the most redundant indicator selection will be much higher than the selection probability of other indicators.

[0079] Afterwards, when the maximum behavior probability increases to a level higher than the threshold T2, we find the behavior index m with the maximum behavior probability, which indicates that the mth indicator is one of the redundant indicators for identifying network traffic anomalies. Therefore, the remaining indicator set R

[0080] The mth indicator will be updated and deleted. Then, the behavior probability P and the behavior set α are reinitialized for the next iteration. Until the learning automaton meets the convergence condition, redundant and irrelevant indicators will be removed one by one from the remaining indicator set. Finally, the remaining indicator set is the final result of the network traffic intrusion detection indicator selection.

[0081] 2) Classification and verification of high-resolution indicators of cyber attacks

[0082] In order to verify the performance and effectiveness of the newly proposed anomaly identification technique, we conducted extensive analysis and evaluation of the anomaly identification algorithm based on two different datasets, namely KDD99 and UNSW-NB15 datasets. In addition, the most important indicators selected from KDD99 were extended to the UNSW-NB15 dataset to measure its efficiency and generality. This proves that our method can effectively handle the abnormal behavior identification of network traffic and can be generalized to the big data environment of larger networks. In the above network traffic anomaly identification technology method, we use the support vector machine (SVM) algorithm as the classifier.

[0083] The high-resolution indicators selected from the experimental results KDD are shown in Table 3, and the high-resolution indicators selected from UNSW_NB are shown in Table 4.

[0084] Table 3:

[0085]

[0086]

[0087] Table 4:

[0088]

[0089] Specifically, in step 3: for the eight high-resolution indicators selected above, the accuracy of identifying attacks in the KDD dataset is higher than 90%, the accuracy of identifying attacks in the NB dataset is higher than 60% overall, and the accuracy of identifying specific attacks is higher than 90%. Therefore, retrieving these indicators at the moment when abnormal behavior occurs can help identify the type of abnormality and whether it is related to an attack.

[0090] The first three indicators [protocol_type], [service] are basic indicators, which can be easily obtained directly from network traffic packets; [same_srv_rate] is a time traffic indicator, which defines the relationship between traffic packets in a longer span (time); [dst_host_count], [dst_host_srv_count], [dst_host_same_src_port_rate], [dst_host_srv_diff_host_rate] are host traffic indicators, that is, vertical statistics of hosts or specific services within a given connection range. This type of indicator defines the distribution of traffic packets in the entire network and can be understood as a combination of traffic packets. Indicator calculation systems used for attack identification such as Figure 4 As shown, the whole system consists of five parts: message parsing, connection analysis, long-span statistics, combined statistics, and indicator extraction.

[0091] Among them, connection analysis is performed after message parsing. Each connection has at least one message, usually many messages between the source address and the destination address. Connection analysis is to aggregate all messages belonging to the same connection to facilitate analysis of the connection in subsequent traffic analysis.

[0092] The long-span statistics module counts all connections within a specified time frame. The combined statistics module counts all connections that are adjacent to each other for a specified amount of time. Indicator extraction is based on the statistical data results.

[0093] 1) Extraction and calculation of long-span sequence indicators

[0094] Long-span network behavior refers to the statistics and extraction of the same network behavior over a period of time. Since network attack events are strongly correlated in time, statistics on certain connections between the current connection records and the connection records over a period of time can better reflect the relationship between the connections.

[0095] The calculation formula of [same_srv_rate] is as follows:

[0096] Count all connections within the past 2 seconds of the current connection, filter out connections with the same target host as the current connection, and count the number of connections, recorded as N d Then filter out the connections with the same target host as the current connection and the connections with the same service as the current connection, and count the number of connections, recorded as N s The index value can be obtained by the following formula:

[0097]

[0098] In order to effectively apply the indicators in the KDD and UNSW-NB15 datasets to the actual environment of the power information network, the calculation formula of the indicators must be expanded: the statistical time can be extended from 2 seconds to a longer time. For the sake of flexibility, the specific time span for extracting long-span indicators should be set. Therefore, a flexible time frame needs to be established in the design to support different time spans.

[0099] The time window method can be used to perform long-span data statistics. The unit time counting unit can be implemented using the time window method: that is, each counting unit is a time window. The time window can be of fixed size, that is, each counting unit counts a fixed time interval, that is, the time counted by each counting unit is consistent. The time window can also be of variable size. Generally, the latest counting unit is the smallest counting unit, and the older the counting unit, the larger the time span counted. Long-span indicators can be directly retrieved and calculated from the counting unit.

[0100] 2) Extraction and calculation of combined sequence indicators

[0101] The indicator [dst_host_count] refers to the number of connections with the same destination host as the current connection among the first 100 connections. If we want to extract this indicator from the massive network traffic packets, we need to perform correlation analysis on the massive network packets. First, filter out the first 100 connection packet records based on the current connection, and then count the number of connections with the same destination host as the current connection.

[0102] The indicator [dst_host_srv_count] refers to the number of connections with the same target host and the same service as the current connection among the first 100 connections. If we want to extract this indicator from the massive network traffic packets, we need to perform correlation analysis on the massive network packets. First, filter out the first 100 connection packet records based on the current connection, and then count the number of connections with the same target host and the same service as the current connection.

[0103] The metric [dst_host_same_src_port_rate] refers to the top 100 connections that have the same destination as the current connection.

[0104] The percentage of connections with the same source port on the host. The steps for correlation analysis of network messages are as follows: First, filter out the first 100 connection message records based on the current connection, and then count the number of connections with the same target host and the same source port as the current connection, recorded as N ds The index value can be calculated using the following formula:

[0105]

[0106] The indicator [dst_host_srv_diff_host_rate] refers to the percentage of connections with the same target host and the same service as the current connection among the first 100 connections that have different source hosts than the current connection. The steps for correlation analysis of network messages are as follows: First, filter out the first 100 connection message records based on the current connection. First, count all the connections in the past N seconds of the current connection, filter out the connections with the same target host and the same service as the current connection, and count the number of connections, recorded as N. ds Then filter out the connections with the same target host and the same service as the current connection, and count the number of connections, recorded as N s The index value can be calculated using the following formula:

[0107]

[0108] By performing correlation analysis on the combined indicators of network traffic message data, the combined indicators [dst_host_count], [dst_host_srv_count], [dst_host_same_src_port_rate], and [dst_host_srv_diff_host_rate] can be easily extracted and integrated from the network traffic data message, such as Figure 5 .

[0109] 3) Identification of traffic anomalies based on SVM

[0110] After the traffic passes through the network probe device, it is first processed to restore various protocols, and then the identification indicators are extracted. Two different detection methods, known threat detection and unknown attack detection, are used to detect known and unknown attacks respectively. The SVM-based classifier is used to identify and determine unknown attack behaviors, and finally the alarm information is warned. The specific process is as follows.

[0111] First, the network traffic data packets are captured and the protocol is restored. By analyzing and cleaning the network traffic data packets, the network traffic indicator values ​​of each data packet are extracted and stored in the indicator pool, such as protocol, service, flag, ttl and other indicators.

[0112] Secondly, the indicator calculation method introduced above is applied to perform statistics and calculation of high-resolution indicators for each original indicator and the corresponding data value in the indicator pool.

[0113] Finally, these high-resolution indicators are input into the support vector machine (SVM) classifier. During the training process of the classifier, the support vector machine trains the input data, iterates multiple times, selects several support vector particles, and then performs multi-dimensional identification and classification of network traffic data. Finally, the identified type of each data message is output, such as normal behavior, abnormal behavior, and more specifically, the specific type of abnormal attack can be identified, such as DoS attack, Worm attack, Probe attack, etc. In the identification of network traffic anomalies, the traffic is classified in real time according to the traffic indicators, and the abnormal traffic that may be caused by the attack is selected.

Claims

1. A method for identifying abnormal behavior of power network facing unknown attacks, characterized in that: The following steps are involved: Step 1: Analyze network behavior indicators of known attacks; Step 2: Screen the attack high-resolution indicators; Step 3: Calculate indicators for attack identification.

2. According to claim 1, a method for identifying abnormal behavior of a power network facing unknown attacks is characterized in that: The attack network behavior datasets collected and organized in step 1 include KDD99, NSL-KDD, and UNSW-NB.

3. The method for identifying abnormal behavior of a power network facing unknown attacks according to claim 1 is characterized in that: The step 2 includes the screening of high-resolution attack indicators based on learning automata and the classification verification of high-resolution network attack indicators.

4. A method for identifying abnormal behavior of a power network facing unknown attacks according to claim 3, characterized in that: In the screening of high-resolution attack indicators based on learning automata, we first give a description of the indicator selection problem; secondly, we introduce the mapping of automata learning problems; and finally, the project proposes new methods for indicator selection and identification techniques.

5. The method for identifying abnormal behavior of a power network facing unknown attacks according to claim 3 is characterized in that: In the classification validation of high-resolution indicators of cyber attacks, the anomaly identification algorithms are analyzed and evaluated based on two different datasets, namely KDD99 and UNSW-NB15 datasets; in addition, the most important indicators selected from KDD99 are extended to the UNSW-NB15 dataset to measure their efficiency and universality.

6. The method for identifying abnormal behavior of a power network facing unknown attacks according to claim 1 is characterized in that: The step 3 specifically includes: Step 31: Extraction and calculation of long-span sequence indicators; Step 32: Extraction and calculation of combined sequence indicators; Step 33: Identification of traffic anomalies based on SVM.

7. A method for identifying abnormal behavior of a power network facing unknown attacks according to claim 6, characterized in that: The step 31 is specifically as follows: the calculation formula of [same_srv_rate] is as follows: count all the connections within the past 2 seconds of the current connection, filter out the connections with the same target host as the current connection, and count the number of connections, recorded as Nd; then filter out the connections with the same target host as the current connection, and the connections with the same service as the current connection, and count the number of connections, recorded as Ns; the indicator value can be obtained by the following formula: In order to effectively apply the indicators in the KDD and UNSW-NB15 datasets to the actual environment of the power information network, the calculation formula of the indicators must be expanded: the statistical time can be extended from 2 seconds to a longer time; for the sake of flexibility, the specific time span for extracting long-span indicators should be set; therefore, a flexible time frame needs to be established in the design to support different time spans.

8. The method for identifying abnormal behavior of a power network facing unknown attacks according to claim 6 is characterized in that: The step 32 is specifically as follows: the indicator [dst_host_same_src_port_rate] refers to the percentage of connections with the same target host and source port as the current connection in the first 100 connections; the steps of correlation analysis of network messages are as follows: first, filter out the first 100 connection message records based on the current connection, and then count the number of connections with the same target host and source port as the current connection, recorded as Nds. The indicator value can be obtained by the following formula: By performing correlation analysis on the combined indicators of the network traffic packet data, the combined indicators [dst_host_count], [dst_host_srv_count], [dst_host_same_src_port_rate], and [dst_host_srv_diff_host_rate] can be easily extracted and integrated from the network traffic data packets.

9. The method for identifying abnormal behavior of a power network facing unknown attacks according to claim 6 is characterized in that: The step 33 is specifically as follows: First, the network traffic data packets are captured and the protocol is restored. By analyzing and cleaning the network traffic data packets, the network traffic index value of each data packet is extracted and stored in the index pool. Secondly, the indicator calculation method introduced above is applied to perform statistics and calculation of high-resolution indicators for each original indicator and corresponding data value in the indicator pool; Finally, these high-resolution indicators are input into the support vector machine (SVM) classifier. During the training process of the SVM classifier, the support vector machine trains the input data, iterates multiple times, selects several support vector particles, and thus performs multi-dimensional identification and classification of network traffic data, and finally outputs the identified type of each data packet. In the identification of network traffic anomalies, the traffic is classified in real time according to the traffic indicators, and abnormal traffic that may be caused by attacks is selected.

Images