Malicious encrypted traffic detection method and system for digital power grid

Abstract

The invention discloses a malicious encrypted traffic detection method and system for a digital power grid, and relates to the field of digital power grid traffic detection, and the method comprises the steps: obtaining encrypted traffic through the analysis of a network architecture, the deployment of a probe and the use of a network monitoring technology; based on the obtained encrypted traffic, decrypting the traffic according to a corresponding encryption protocol and key information to obtain plaintext data; selecting key features based on the plaintext data in combination with flow features in the digital power grid, and extracting and processing the key features to obtain a feature data set; constructing a malicious encrypted traffic detection model based on the feature data set; detecting malicious encrypted traffic by using a malicious encrypted traffic detection model; according to the method, the capability of identifying and analyzing the malicious traffic and the normal traffic in the encrypted traffic of the digital power grid is improved, and meanwhile, the problem of user data privacy protection is effectively solved.

Description

Technical Field

[0001] The present invention relates to the field of digital power grid flow detection, and in particular to a method and system for detecting malicious encrypted flow in a digital power grid. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent. In particular, the popularization of encryption technology, while protecting user privacy and data security, also provides convenience for malware to hide. Malicious actors use encryption technology to hide their illegal activities, making it difficult for traditional network security detection methods to effectively identify and defend against these threats. According to statistics, a large amount of network traffic is currently transmitted in an encrypted manner, which not only increases the anonymity of network traffic, but also brings new challenges to network security protection. Digital grid is a modern power grid system that integrates advanced information and communication technology, automation control technology and intelligent metering technology, aiming to improve the operation efficiency, reliability and intelligence level of the power grid. The traffic of digital grid refers to the data transmitted and exchanged in the digital grid system, which has the characteristics of diversity, large scale, real-time, high reliability requirements, etc. Therefore, how to efficiently analyze and detect the traffic of digital grid to improve the stability and security of traffic has become a current research hotspot.

[0003] Digital power grid traffic has its own unique characteristics and patterns, which are significantly different from ordinary Internet traffic. Similar products lack optimization for the specificity of power grid traffic, and the extracted features are few in number and lack domain specificity; similar products only use a single direct decryption detection technology or indirectly detect through feature extraction modeling, failing to efficiently balance detection accuracy and privacy protection; similar products only propose theoretical methods and fail to build them into a systematic product, which cannot effectively improve the work efficiency of digital power grid-related staff in terms of security protection. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: how to build a malicious encrypted traffic detection system for digital power grids to improve the detection efficiency of malicious encrypted traffic in the digital power grid field to ensure the safe operation of the digital power grid.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for detecting malicious encrypted traffic for a digital power grid, including:

[0008] Obtain encrypted traffic by analyzing network architecture, deploying probes, and using network monitoring technology;

[0009] Based on the obtained encrypted traffic, the traffic is decrypted according to the corresponding encryption protocol and key information to obtain the plaintext data;

[0010] Based on the plaintext data and combined with the traffic characteristics in the digital power grid, key features are selected, extracted and processed to obtain a feature data set;

[0011] Build a malicious encrypted traffic detection model based on feature data sets;

[0012] Detect malicious encrypted traffic using the malicious encrypted traffic detection model.

[0013] As a preferred solution for the malicious encrypted traffic detection method for the digital power grid, wherein:

[0014] The analysis network architecture includes:

[0015] The network architecture of the digital power grid is analyzed to identify key nodes, which are bottlenecks or critical paths for data transmission.

[0016] As a preferred solution for the malicious encrypted traffic detection method for the digital power grid, wherein:

[0017] The deploying of probes includes deploying flow probes at key nodes; and the using of network monitoring technology includes:

[0018] Use port mirroring technology to copy traffic from one or more network interfaces to one or more analysis platforms to obtain a complete copy of the traffic.

[0019] As a preferred solution for the malicious encrypted traffic detection method for the digital power grid, wherein:

[0020] Decrypting the traffic includes:

[0021] Use the standard symmetric encryption algorithm for decryption. The traffic encryption process generates and securely distributes a strong random symmetric key. This key is combined with an efficient symmetric encryption algorithm to encrypt the transmitted data. After the detection system obtains the encrypted traffic, it uses the same key to decrypt the received ciphertext and restore the original data.

[0022] As a preferred solution for the malicious encrypted traffic detection method for the digital power grid, wherein:

[0023] The selected key features include:

[0024] Statistical characteristics: including packet size and transmission rate;

[0025] Time characteristics: including the active time period of traffic and session duration;

[0026] Traffic direction characteristics: analyze data flow direction;

[0027] Protocol characteristics: Identify the communication protocol used;

[0028] Port usage characteristics;

[0029] Behavioral characteristics: analyzing the behavior patterns of network entities;

[0030] Source and destination address characteristics: Analyze the IP addresses of both communicating parties.

[0031] As a preferred solution for the malicious encrypted traffic detection method for the digital power grid, wherein:

[0032] The construction of the malicious encrypted traffic detection model includes:

[0033] Use the random forest algorithm to build a malicious encrypted traffic detection model;

[0034] The feature data set D:Set{d1,…·,d n} Randomly divided into training set DS training and the test set DS test , using random forest algorithm to build a multi-classifier malicious encrypted traffic identification model C multi_classifier .

[0035] As a preferred solution for the malicious encrypted traffic detection method for the digital power grid, wherein:

[0036] The use of the malicious encrypted traffic detection model to detect malicious encrypted traffic includes:

[0037] The constructed model is used to analyze network traffic in real time and identify possible malicious encrypted traffic; the detection results are deeply analyzed to confirm their accuracy and take corresponding security measures.

[0038] In a second aspect, an embodiment of the present invention provides a malicious encrypted traffic detection system for a digital power grid, including:

[0039] Encrypted traffic acquisition module, used to acquire encrypted traffic by analyzing network architecture, deploying probes, and using network monitoring technology;

[0040] A plaintext data acquisition module is used to decrypt the traffic based on the acquired encrypted traffic and according to the corresponding encryption protocol and key information to obtain the plaintext data;

[0041] The feature data set acquisition module is used to select key features based on plain text data and combined with the traffic characteristics in the digital power grid, extract and process the key features, and obtain a feature data set;

[0042] The detection model building module is used to build a malicious encrypted traffic detection model based on the feature data set;

[0043] A detection module is used to detect malicious encrypted traffic using a malicious encrypted traffic detection model.

[0044] In a third aspect, an embodiment of the present invention provides a computing device, including:

[0045] Memory and processor;

[0046] The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the one or more programs are executed by the one or more processors, the one or more processors implement the malicious encrypted traffic detection method for the digital power grid as described in any embodiment of the present invention.

[0047] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method for detecting malicious encrypted traffic for a digital power grid.

[0048] Beneficial effects of the invention: The purpose of the invention is to build a malicious encrypted traffic detection system for digital power grids. For encrypted traffic in digital power grids, the invention retains the traditional direct decryption detection technology, and innovatively models key features such as handshake information and timing relationships of encrypted traffic for indirect detection. The ability to identify and analyze malicious traffic and normal traffic in digital power grid encrypted traffic is improved, and the problem of user data privacy protection is also effectively solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0050] Figure 1 It is an overall flow chart of the malicious encrypted traffic detection method for digital power grid described in the first embodiment of the present invention;

[0051] Figure 2 It is a schematic diagram of the system framework of the malicious encrypted traffic detection method for the digital power grid according to the first embodiment of the present invention;

[0052] Figure 3 It is a schematic diagram of the encryption and decryption process of the symmetric encryption algorithm of the malicious encrypted traffic detection method for the digital power grid described in the first embodiment of the present invention;

[0053] Figure 4 It is a decision tree diagram of the malicious encrypted traffic detection method for the digital power grid described in the first embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0055] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0056] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0057] Example 1

[0058] Reference Figure 1-Figure 4 Tables 1 and 2 are the first embodiment of the present invention, which provides a method for detecting malicious encrypted traffic for a digital power grid, including:

[0059] S1: Obtain encrypted traffic by analyzing network architecture, deploying probes, and using network monitoring technology;

[0060] S2: Based on the obtained encrypted traffic, decrypt the traffic according to the corresponding encryption protocol and key information to obtain the plaintext data;

[0061] S3: Based on the plaintext data and combined with the traffic characteristics in the digital power grid, key features are selected, extracted and processed to obtain a feature data set;

[0062] S4: Build a malicious encrypted traffic detection model based on the feature dataset;

[0063] S5: Detect malicious encrypted traffic using the malicious encrypted traffic detection model.

[0064] In the embodiment of the present application, analyzing the network architecture in the above step S1 includes:

[0065] Conduct a comprehensive analysis of the network architecture of the digital power grid to identify key nodes, which are bottlenecks or critical paths for data transmission.

[0066] It should be noted that traffic analysis of key nodes can provide important information for the security of the entire system.

[0067] In the embodiment of the present application, deploying the probe in the above step S1 includes:

[0068] Deploy traffic probes at key nodes;

[0069] It should be noted that a traffic probe is a hardware or software device that can capture data packets passing through in real time. These probes have high-performance processing capabilities to cope with real-time analysis of large amounts of data.

[0070] In the embodiment of the present application, the network monitoring technology used in the above step S1 includes:

[0071] Use port mirroring technology to copy traffic from one or more network interfaces to one or more analysis platforms to obtain a complete copy of the traffic.

[0072] It should be noted that port mirroring is a network monitoring technology that allows the traffic of one or more network interfaces to be copied to one or more analysis platforms. In this way, even if the original traffic is encrypted, a complete copy of the traffic can be obtained through port mirroring technology.

[0073] In another possible implementation, the same technical effect can be achieved by using optical splitting technology, which physically copies part of the network traffic to the monitoring device without modifying the network configuration or interrupting the service, and can also achieve the purpose of obtaining a complete traffic copy in real time.

[0074] It should be noted that in the digital power grid, encrypted traffic acquisition is a comprehensive process that involves deploying traffic probes at key nodes of the network architecture. These probes can capture passing data packets in real time. Through port mirroring technology, the traffic of the network interface is copied to the analysis platform to ensure the integrity and accuracy of the traffic data. Obtaining comprehensive and real-time data is the basis for building a malicious encrypted traffic detection model.

[0075] In the embodiment of the present application, decrypting the traffic in the above step S2 includes:

[0076] like Figure 3As shown, a standard symmetric encryption algorithm is used for decryption. The traffic encryption process generates and securely distributes a strong random symmetric key, which is used in combination with an efficient symmetric encryption algorithm to encrypt the transmitted data. After the detection system obtains the encrypted traffic, it uses the same key to decrypt the received ciphertext and restore the original data.

[0077] The efficient symmetric encryption algorithm used in the embodiments of the present application is the AES algorithm. AES (Advanced Encryption Standard) is a symmetric encryption algorithm that is widely used to protect the confidentiality of sensitive data, such as in Internet communications, file storage, and many other applications. AES is widely recognized and used because of its high security, high computational efficiency, and can be effectively implemented on various hardware and software platforms.

[0078] In another possible implementation, 3DES (Triple Data Encryption Standard) may also be used: an enhanced version of the DES encryption algorithm that improves security through three encryption processes (encryption-decryption-encryption), and is suitable for scenarios that require a higher level of security.

[0079] In another possible implementation, Blowfish can also be used: a fast and secure symmetric encryption algorithm suitable for encryption requirements that require fast response.

[0080] In another possible implementation, Camellia may also be used: Similar to AES, Camellia is also a high-strength symmetric encryption algorithm with high efficiency and security characteristics, suitable for different types of data encryption requirements.

[0081] It should be noted that after the detection system obtains the encrypted traffic, it uses the same key to decrypt the received ciphertext and restore the original data. It then determines whether the traffic is malicious based on the plaintext content. In this process, the key is updated regularly to enhance security, and the message authentication mechanism is combined to ensure data integrity and authentication. The entire encryption mechanism meets performance requirements and complies with laws and regulations.

[0082] In the embodiment of the present application, the key features selected in the above step S3 include:

[0083] Statistical characteristics: including packet size and transmission rate;

[0084] It should be noted that these characteristics reflect the basic measurements of traffic, and abnormal statistical characteristics may indicate malicious data transmission or attack behavior, such as DDoS attacks.

[0085] Time characteristics: including the active time period of traffic and session duration;

[0086] It should be noted that power grid operations have temporal regularities, and abnormal temporal patterns may indicate unauthorized access or the execution of automated malicious scripts.

[0087] Traffic direction characteristics: analyze data flow direction;

[0088] It should be noted that control instructions are usually issued from the control center. Abnormal flows may indicate illegal access to the internal network or data leakage attempts.

[0089] Protocol characteristics: Identify the communication protocol used;

[0090] It should be noted that there are strict regulations on protocols in the power grid, and the use of abnormal protocols may be caused by incompatible devices or malicious software.

[0091] Port usage characteristics;

[0092] It should be noted that ports are the entry points for network communications, and abnormal port activity may indicate scanning, probing, or attack behavior.

[0093] Behavioral characteristics: analyzing the behavior patterns of network entities;

[0094] It should be noted that the behavior patterns of network entities such as access frequency and path are analyzed. Patterns that differ significantly from normal behavior may indicate malicious activity.

[0095] Source and destination address characteristics: Analyze the IP addresses of both communicating parties;

[0096] It should be noted that an abnormal source address or destination address may indicate an external attack or an internal data leak.

[0097] In the embodiment of the present application, the extraction and processing of key features in the above step S3 includes:

[0098] Select the obtained n communication encrypted data flow packets;

[0099] Specifically, n communication encrypted data flow packets are represented as pkt_sequence = {p1, p2, p3, ..., p n},

[0100] The flow data format used in this embodiment is the original pcap file, and relevant features are extracted from the pcap file as shown in Table 1:

[0101] Table 1 Feature types and corresponding feature transformation methods

[0102]

[0103]

[0104] The features extracted from each package are composed into a vector, represented as p i ={f 1,i ,f 2,i ,f 3,i ,…,f n,i},i∈{1,…,n};

[0105] Since the features extracted this time are packet header information, this method can be used to encrypt traffic. First, the existence of the protocol is modeled as 0,1, so that each protocol eventually forms a one-dimensional feature vector protocol = {f1,f2,…,f n},f i ∈{0,1};

[0106] For the port address number, the port interval modeling method is used; the IP address is divided into the source IP address and the destination IP address, and the IP address is converted from dotted decimal form to an integer; for the processing of packet length, the packet byte size is counted as a feature; the packet length is modeled as follows:

[0107]

[0108] By transforming the packet length, a feature vector pkt_len={f1,f2,…,f n},f i ∈{0,8};

[0109] After the above steps, the original pcap file is finally converted into a feature data set in csv format.

[0110] In the embodiment of the present application, constructing a malicious encrypted traffic detection model in the above step S4 includes:

[0111] Use the random forest algorithm to build a malicious encrypted traffic detection model;

[0112] It should be noted that if Figure 4As shown in the figure, the random forest algorithm is an ensemble learning method for classification, regression and other tasks. It works by building multiple decision trees and outputting the category mode (classification) or average prediction (regression) of these trees. Decision trees are a decision analysis method that uses decision trees to obtain the probability that the expected value of the net present value is greater than or equal to zero, evaluate project risks, and judge its feasibility based on the known probabilities of various situations. It is a graphical method for intuitively applying probability analysis. The key feature of the random forest algorithm is that the random forest consists of multiple decision trees, each of which is independently built and introduces randomness during the training process. Each decision tree is trained on a different random subsample of the data set, which is obtained by bootstrap sampling, which means that the same data point may appear multiple times in one subsample and not in another subsample. The main advantage of the random forest algorithm is that it can handle large data sets and is highly robust to noise and outliers in the training data.

[0113] At the same time, in the process of building decision trees, random forests do not consider all features at each split point, but randomly select a portion of features. This increases the diversity between trees and helps improve the generalization ability of the model.

[0114] Based on the idea of ​​selecting random attributes, an ensemble learning classifier composed of multiple decision tree classifiers. k )} is an independent and identically distributed random vector, which represents the number of decision tree classifiers. A single decision tree classifier generates a classification result based on the input test sample set x, and finally determines the test sample category by voting.

[0115] The feature data set D:Set{d1,…,d n} Randomly divided into training set DS training and the test set DS test Then, the random forest algorithm is used to build a multi-classifier malicious encrypted traffic identification model C multi_classifier ;

[0116] The structural parameters and training parameters of the random forest model used are shown in Table 2:

[0117] Table 2 Random forest model parameters

[0118]

[0119] In the embodiment of the present application, the above step S5 uses the malicious encrypted traffic detection model to detect malicious encrypted traffic, including:

[0120] The constructed model is used to analyze network traffic in real time and identify possible malicious encrypted traffic; the detection results are deeply analyzed to confirm their accuracy so that appropriate security measures can be taken.

[0121] It should be noted that if Figure 2 As shown, this system is a multi-layered architecture design, covering multiple aspects such as the front-end user interface, business logic layer, data access layer, and operating environment. The following is a description of the system implementation and functions:

[0122] (1) Front-end UI implementation

[0123] The system front end uses HTML and CSS to build the basic user interface structure and style, and uses the VUE2.0 framework to provide dynamic interactive functions to enhance user experience. jQuery and Bootstrap libraries are used to simplify front-end development, improve development efficiency and interface responsiveness. The system also uses Ajax technology for asynchronous data interaction, supports Post and Get requests, and ensures the smoothness of user operations and dynamic updates of pages.

[0124] (2) Business module functions

[0125] The business layer consists of multiple modules, including key components such as feature processing, risk discovery, risk management, and permission control. These modules work together to import, manage, and generate statistical reports for encrypted traffic data. The feature processing module is responsible for feature extraction and feedback of relevant feature information of the data; the risk discovery and risk management modules are used to identify and respond to potential security risks, and carry out subsequent protection work accordingly. Permission control ensures the security of the system and provides corresponding access levels according to the permissions of different users.

[0126] (3) System management and services

[0127] The system also includes basic components such as organization services, menu management, and system management, which support the daily operation and management of the system. Logging and log services provide system monitoring and problem diagnosis capabilities. The scheduled task function allows the system to automatically execute scheduled tasks and improve operation and maintenance efficiency.

[0128] (4) Data Layer

[0129] As the data support of the system, the data center optimizes data access speed and efficiency through technologies such as stored procedures and data caching. The system supports a variety of database technologies, including MySQL, NoSQL and Oracle, to meet different data storage requirements.

[0130] (5) Operating environment

[0131] The system can be deployed in a variety of operating environments, including Alibaba Cloud hosts, standalone servers, and third-party virtual machines, providing deployment flexibility and scalability.

[0132] The above is a schematic scheme of the malicious encrypted traffic detection method for digital power grid in this embodiment. It should be noted that the technical scheme of the malicious encrypted traffic detection system for digital power grid and the technical scheme of the malicious encrypted traffic detection method for digital power grid are of the same concept. For details not described in detail in the technical scheme of the malicious encrypted traffic detection system for digital power grid in this embodiment, please refer to the description of the technical scheme of the malicious encrypted traffic detection method for digital power grid.

[0133] The malicious encrypted traffic detection system for the digital power grid in this embodiment includes:

[0134] Encrypted traffic acquisition module, used to acquire encrypted traffic by analyzing network architecture, deploying probes, and using network monitoring technology;

[0135] A plaintext data acquisition module is used to decrypt the traffic based on the acquired encrypted traffic and according to the corresponding encryption protocol and key information to obtain the plaintext data;

[0136] The feature data set acquisition module is used to select key features based on plain text data and combined with the traffic characteristics in the digital power grid, extract and process the key features, and obtain a feature data set;

[0137] The detection model building module is used to build a malicious encrypted traffic detection model based on the feature data set;

[0138] A detection module is used to detect malicious encrypted traffic using a malicious encrypted traffic detection model.

[0139] This embodiment also provides a computing device, which is applicable to the case of a malicious encrypted traffic detection method for a digital power grid, including:

[0140] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the malicious encrypted traffic detection method for the digital power grid as proposed in the above embodiment.

[0141] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for detecting malicious encrypted traffic for a digital power grid as proposed in the above embodiment is implemented.

[0142] The storage medium proposed in this embodiment and the malicious encrypted traffic detection method for the digital power grid proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0143] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting malicious encrypted traffic in a digital power grid, characterized in that: include: Obtain encrypted traffic by analyzing network architecture, deploying probes, and using network monitoring technology; Based on the obtained encrypted traffic, the traffic is decrypted according to the corresponding encryption protocol and key information to obtain the plaintext data; Based on the plaintext data and combined with the traffic characteristics in the digital power grid, key features are selected, extracted and processed to obtain a feature data set; Build a malicious encrypted traffic detection model based on feature data sets; Detect malicious encrypted traffic using the malicious encrypted traffic detection model.

2. The method for detecting malicious encrypted traffic in a digital power grid according to claim 1, characterized in that: The analysis network architecture includes: The network architecture of the digital power grid is analyzed to identify key nodes, which are bottlenecks or critical paths for data transmission.

3. The method for detecting malicious encrypted traffic in a digital power grid according to claim 2, characterized in that: The deploying probes includes deploying flow probes at key nodes; The use of network monitoring technology includes: Use port mirroring technology to copy traffic from one or more network interfaces to one or more analysis platforms to obtain a complete copy of the traffic.

4. The method for detecting malicious encrypted traffic in a digital power grid according to claim 3, characterized in that: Decrypting the traffic includes: Use the standard symmetric encryption algorithm for decryption. The traffic encryption process generates and securely distributes a strong random symmetric key. This key is combined with an efficient symmetric encryption algorithm to encrypt the transmitted data. After the detection system obtains the encrypted traffic, it uses the same key to decrypt the received ciphertext and restore the original data.

5. The method for detecting malicious encrypted traffic in a digital power grid according to claim 4, characterized in that: The selected key features include: Statistical characteristics: including packet size and transmission rate; Time characteristics: including the active time period of traffic and session duration; Traffic direction characteristics: analyze data flow direction; Protocol characteristics: Identify the communication protocol used; Port usage characteristics; Behavioral characteristics: analyzing the behavior patterns of network entities; Source and destination address characteristics: Analyze the IP addresses of both communicating parties.

6. The method for detecting malicious encrypted traffic in a digital power grid according to claim 5, characterized in that: The construction of the malicious encrypted traffic detection model includes: Use the random forest algorithm to build a malicious encrypted traffic detection model; The feature data set D:Set{d1,…,d n } Randomly divided into training set DS training and the test set DS test , using random forest algorithm to build a multi-classifier malicious encrypted traffic identification model C multi_classifier .

7. The method for detecting malicious encrypted traffic in a digital power grid according to claim 6, characterized in that: The use of the malicious encrypted traffic detection model to detect malicious encrypted traffic includes: The constructed model is used to analyze network traffic in real time and identify possible malicious encrypted traffic; the detection results are deeply analyzed to confirm their accuracy and take corresponding security measures.

8. A system using the method for detecting malicious encrypted traffic for a digital power grid as claimed in any one of claims 1 to 7, characterized in that: include: Encrypted traffic acquisition module, used to acquire encrypted traffic by analyzing network architecture, deploying probes, and using network monitoring technology; A plaintext data acquisition module is used to decrypt the traffic based on the acquired encrypted traffic and according to the corresponding encryption protocol and key information to obtain the plaintext data; The feature data set acquisition module is used to select key features based on plain text data and combined with the traffic characteristics in the digital power grid, extract and process the key features, and obtain a feature data set; The detection model building module is used to build a malicious encrypted traffic detection model based on the feature data set; A detection module is used to detect malicious encrypted traffic using a malicious encrypted traffic detection model.

9. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the malicious encrypted traffic detection method for the digital power grid as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the method for detecting malicious encrypted traffic for a digital power grid as described in any one of claims 1 to 7.

Images