Intelligent power grid adaptive defense and flow dynamic optimization method and system

Abstract

The invention relates to the technical field of network security, and provides a smart power grid adaptive defense and flow dynamic optimization method and system, and the method comprises the following steps: obtaining the real-time network flow of a smart power grid; detecting the obtained real-time network flow based on a machine learning algorithm, and judging whether the real-time network flow is subjected to DoS attack or not; for the detected attack traffic, a DoS attack defense response measure is automatically executed; and for the detected normal flow, optimizing through network load balancing and priority queue management based on kernel density estimation, and carrying out network flow dynamic management on the network flow. According to the invention, denial of service (DoS) attacks in the smart power grid can be identified and coped with in time, and meanwhile, the overall network performance is improved and the operation stability of a power system is improved through dynamic optimization management of traffic and optimization of distribution of network resources.

Description

Technical Field

[0001] The present disclosure relates to the technical field related to network security, and in particular to a method and system for smart grid adaptive defense and traffic dynamic optimization. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] With the rapid development of smart grid technology, the digitalization and networking of power systems are increasing, which has promoted the intelligent management of power production, transmission, distribution and consumption, not only improving the efficiency and reliability of power systems, but also promoting the deep integration of renewable energy and the efficient use of power resources. However, as these advantages continue to emerge, smart grids are also facing increasingly severe network security challenges.

[0004] Among network security challenges, DoS attacks have become a major hidden danger threatening the security of smart grids. DoS attacks send a large number of false requests, occupy a large amount of network resources, and hinder the normal service access of legitimate users. Such attacks are diverse. Attackers consume bandwidth, occupy system resources, and even cause server crashes, seriously interfering with the normal operation of the network. Its impact may not only cause the interruption of power system functions, but also trigger a series of chain reactions, endangering the stability and reliability of power supply. In extreme cases, DoS attacks may even cause partial or complete paralysis of the power system, causing huge economic losses and social security risks.

[0005] Different types of data traffic in the power system have different requirements for network resources. Critical task traffic such as control commands and status monitoring needs to be prioritized, while non-critical task traffic such as data acquisition or background management has relatively low requirements for bandwidth and latency. The control and dispatch of power systems rely on communication networks with strong real-time performance and high reliability. Especially when processing critical tasks such as automation control, protection commands, and status monitoring, delays or data loss may cause serious system failures. However, existing DoS defense technologies often consume a lot of computing resources and bandwidth when detecting and preventing attacks, resulting in delayed system response time and affecting the transmission of critical business traffic. This defense method is difficult to ensure low-latency transmission requirements for high-priority data streams when dealing with complex and diverse DoS attacks, which in turn affects the stable operation of the power system.

[0006] It can be seen that the existing DoS attack defense methods mainly focus on detecting and blocking attack traffic, and the configuration of the DoS attack defense function occupies a large amount of computing resources of the system, which affects the stable operation of the power system. The existing defense technology may restrict or block all traffic in a one-size-fits-all manner, so that the normal traffic of the power system cannot be reasonably distributed, thereby causing key traffic to be obstructed and affecting the stability of the system. Summary of the invention

[0007] In order to solve the above problems, the present disclosure proposes a smart grid adaptive defense and traffic dynamic optimization method and system, which can timely identify and respond to denial of service (DoS) attacks in the smart grid. At the same time, through dynamic traffic optimization management, when the defense against DoS attacks occupies a large amount of system resources, it can ensure the coordination and balance of different traffic flows, optimize the allocation of network resources, improve the overall network performance, enable the power system to operate normally, and improve the stability of the power system operation after the (DoS) attack defense system is configured.

[0008] In order to achieve the above objectives, the present disclosure adopts the following technical solutions:

[0009] One or more embodiments provide a method for adaptive defense and dynamic traffic optimization of a smart grid, including the following steps:

[0010] Obtain real-time network traffic for smart grids;

[0011] Use machine learning algorithms to detect the acquired real-time network traffic to determine whether it is under DoS attack;

[0012] Automatically execute DoS attack defense response measures for detected attack traffic;

[0013] For the detected normal traffic, network load balancing and priority queue management based on kernel density estimation are optimized to dynamically manage the network traffic.

[0014] One or more embodiments provide a smart grid adaptive defense and traffic dynamic optimization system, including:

[0015] Acquisition module: configured to acquire real-time network traffic of the smart grid;

[0016] Classification module: configured to detect the acquired real-time network traffic using a machine learning algorithm to determine whether it is under DoS attack;

[0017] Response module: configured to automatically execute DoS attack defense response measures for detected attack traffic;

[0018] Traffic dynamic management module: It is configured to optimize the detected normal traffic through network load balancing and priority queue management based on kernel density estimation, so as to dynamically manage the network traffic.

[0019] One or more embodiments provide an electronic device including a memory and a processor and computer instructions stored in the memory and executed on the processor, wherein when the computer instructions are executed by the processor, the steps in the above-mentioned smart grid adaptive defense and traffic dynamic optimization method are completed.

[0020] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the steps in the above-mentioned smart grid adaptive defense and traffic dynamic optimization method are completed.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] In this embodiment, a rapid response is made after a DoS attack is detected, and the allocation of network resources is optimized to achieve dynamic adaptive management of traffic flow to ensure the continuous and stable operation of key services. This method continuously monitors network traffic and takes effective measures immediately when an attack is detected. At the same time, based on the kernel density method, the priority of traffic can be adaptively determined, and the priority queue management method is improved. In combination with the optimal allocation of network resources and load balancing technology, user traffic is managed, the overall performance and reliability of the smart grid are improved, and network resources are ensured to be used reasonably and efficiently.

[0023] The advantages of the present disclosure and the advantages of additional aspects will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The exemplary embodiments of the present disclosure and the description thereof are used to explain the present disclosure but do not constitute a limitation of the present disclosure.

[0025] Figure 1 is a flow chart of a dynamic optimization method according to Embodiment 1 of the present disclosure;

[0026] Figure 2 is a flow duration comparison diagram under different conditions in the experiment of Example 1 of the present disclosure;

[0027] Figure 3 is a comparison chart of bandwidth utilization under different conditions in the experiment of Example 1 of the present disclosure;

[0028] Figure 4 is a CPU load comparison diagram under different conditions in the experiment of Example 1 of the present disclosure;

[0029] Figure 5is a memory comparison diagram under different conditions in the experiment of Example 1 of the present disclosure;

[0030] Figure 6 This is a comparison chart of the total time consumption and average response time analysis under different conditions in the experiment of Example 1 of the present disclosure. DETAILED DESCRIPTION

[0031] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0032] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0033] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof. It should be noted that, in the absence of conflict, the various embodiments in the present disclosure and the features in the embodiments can be combined with each other. The embodiments will be described in detail below in conjunction with the accompanying drawings.

[0034] Example 1

[0035] In the technical solutions disclosed in one or more embodiments, Figures 1 to 6 As shown, a smart grid adaptive defense and flow dynamic optimization method includes the following steps:

[0036] Step 1: Obtain real-time network traffic of the smart grid;

[0037] Step 2: Use machine learning algorithms to detect the acquired real-time network traffic to determine whether it is under DoS attack;

[0038] Step 3: Automatically execute DoS attack defense response measures for the detected attack traffic;

[0039] Step 4: For the detected normal traffic, optimize it through network load balancing and improved priority queue management, and dynamically manage the network traffic.

[0040] In this embodiment, a rapid response is made after a DoS attack is detected, and the allocation of network resources is optimized to achieve dynamic adaptive management of traffic flow, so as to ensure the continuous and stable operation of key services. This method continuously monitors network traffic and immediately takes effective measures when an attack is detected. At the same time, combined with the optimization allocation of network resources and load balancing technology, user traffic is managed, the overall performance and reliability of the smart grid are improved, and network resources are ensured to be used reasonably and efficiently.

[0041] In this embodiment, controlling the flow refers to: managing and regulating the flow of data in the network. Specifically, in this embodiment, the flow refers to data packets transmitted in the network, including normal user communication data packets and possible attack data packets.

[0042] In step 1, network traffic data is continuously collected and analyzed, which may include characteristic data such as packet size, transmission rate, source and destination IP addresses;

[0043] In step 2, any machine learning algorithm such as a random forest classifier and a support vector machine can be used based on the machine learning algorithm;

[0044] In this embodiment, a random forest classifier based on machine learning is used to learn the characteristic differences between normal traffic and attack traffic.

[0045] Specifically, the training process of the random forest classifier includes:

[0046] Step 21: construct a historical traffic data set, including normal traffic data and abnormal traffic data, and mark the data into normal traffic mode and abnormal traffic mode; the abnormal traffic mode includes DoS attack mode;

[0047] Step 22: Using the historical traffic data set, taking the features extracted from the traffic data as input and the labels of the traffic patterns as output, the random forest classifier is trained to obtain a trained classification model;

[0048] The trained classification model can identify the patterns of normal traffic and detect abnormal behaviors that deviate from these patterns. Once the traffic is found to match the known DoS attack pattern, an alarm will be immediately issued and the abnormal traffic will be marked, providing a reliable basis for subsequent response measures.

[0049] In step 3, for the detected attack traffic, DoS attack defense response measures are automatically executed, including executing the following processes in sequence:

[0050] Step 31: Block the attack source IP address and add the attack source IP address to the blacklist to prevent it from continuing to send data packets;

[0051] Specifically, define the attack source IPattr Collection as blacklist;

[0052] Attack source IP attr The collection is defined as follows:

[0053] B={IP attr |IP suffers DoS attack}

[0054] Among them, B represents the set of addresses that suffer from DoS attacks, IP attr Indicates the address that is subject to DoS attack; IP indicates Internet Protocol address.

[0055] According to the addresses in the blacklist, the attack source address is added to the blocking list, thereby preventing it from continuing to send data packets, effectively cutting off further interference from the attack source and alleviating the network load;

[0056]

[0057] Among them, ip represents the IP address to be identified; block() is used to block the attack source address.

[0058] When an IP address is attacked by DoS, abnormal traffic will be generated, which can be used as the attack source IP address. In this embodiment, the IP addresses attacked by DoS are placed in a set, which is equivalent to a blocking list, and the IPs in the blocking list are blocked.

[0059] The core goal of a DoS attack is to consume the target system's network bandwidth, computing resources or storage resources by sending a large number of false requests, making it impossible for normal users to obtain services. Attackers usually send a large number of requests, data packets, connection attempts, etc., which leads to the exhaustion of the target system's resources and ultimately denial of service. Unlike viruses or malware, the purpose of a DoS attack is not to modify data or steal information, but to temporarily prevent the target system from providing normal services. Attacks usually do not directly modify or destroy data, but may cause indirect losses such as system crashes or data loss by exhausting resources. In this embodiment, by identifying the attack traffic, the attacked IP address is added to the blacklist, and the attack source can be quickly cut off.

[0060] Step 32: Dynamically add static firewall rules to limit and block the transmission of attack traffic;

[0061] Specifically, use FirewallRule to configure static firewall rules on network devices to limit and reject traffic from attack sources:

[0062]

[0063] Among them, FirewallRule indicates that the firewall rules are configured according to whether the attack source address is blocked: if the IP address is blocked, it is configured to deny access, and the corresponding blocked address cannot send and receive information in the network; otherwise, it is configured to allow access.

[0064] Step 33: redirect the attack traffic to a secure isolation area for further analysis and processing;

[0065] In this step, the attack traffic is isolated to a safe area to ensure that the abnormal traffic does not continue to burden or interfere with the main network. Since the duration of the attack traffic in the main network is reduced, redirecting the attack traffic to the safe isolation area can effectively shorten the length of time the traffic flows, thereby reducing the network load and improving processing efficiency.

[0066] Use Redirect_Traffic to determine whether the current traffic T is under DoS attack. When the traffic is under DoS attack, the traffic will be redirected to the isolation area.

[0067]

[0068] T represents traffic, Isolate represents redirecting traffic to the isolation zone, and NormalPath represents that traffic continues along the normal path. Redirect_Traffic() represents redirecting attack traffic.

[0069] This embodiment uses IP addresses that block attack traffic, adds firewall rules, and adds static routing defense measures. The above measures are executed in sequence to effectively reduce the abnormality of key indicators such as Bwd Packet Length Mean, Flow Packets / s, and AvgBwd Segment Size, thereby effectively reducing the impact of DoS attacks on the network and reducing interference with normal services. The indicator judgment formula is expressed as follows:

[0070] I(t)={C bplm (t),C fp (t),C abss (t)}

[0071] Where t represents the current time; I(t) represents the size of the key indicators Bwd Packet Length Mean, FlowPackets / s, and Avg Bwd Segment Size after mitigating the DoS attack; C bplm (t) represents Bwd Packet Length Mean; C fp (t) represents Flow Packets / s; C abss(t) represents Avg Bwd Segment Size.

[0072] Among them, Bwd Packet Length Mean is interpreted as the average value of the reverse packet length. This indicator represents the average value of the length of the packet returned from the target end (receiver) of the communication session to the source end (sender). Simply put, this describes the average byte size of all packets returned from the receiver;

[0073] Flow Packets / s is interpreted as the amount of traffic packets transmitted per second. This indicator indicates the number of packets transmitted in the traffic per second. It describes the frequency of packets transmitted through the network per unit time (usually seconds) in a flow session;

[0074] Avg Bwd Segment Size is interpreted as the average size of the reverse segment. In the TCP protocol, data is usually divided into several segments for transmission. This indicator represents the average size of the reverse transmission data segment (TCP segment) in a TCP session, usually indicating the average number of bytes of the transmission unit sent from the target end back to the source end.

[0075] Further technical solutions, in order to evaluate the effectiveness of defense measures, calculate the utilization of network resources, focusing on the following key indicators: bandwidth utilization, CPU load capacity and memory usage to make judgments and output the results of defense effectiveness judgment;

[0076] Specifically, bandwidth utilization measures the actual use of network bandwidth and reflects the degree of network congestion or resource idleness. The calculation formula is as follows:

[0077]

[0078] Among them, U BW Indicates bandwidth utilization; L i represents the Bwd Packet Length Mean characteristic value of the i-th flow; V i represents the characteristic value of Flow Packets / s of the i-th flow; B total represents the total bandwidth; n represents the current node traffic quantity; i represents the current node traffic index.

[0079] CPU load capacity, specifically, the CPU load is estimated using the throughput of the data stream. The throughput represents the amount of data processed per unit time. The greater the throughput, the higher the CPU load capacity.

[0080] U CPU =V

[0081] Among them, U CPUIndicates the CPU load; V indicates the total value of the Flow Packets / s characteristic of all flows on the current node.

[0082] Specifically, memory usage measures the memory resources used to process network data packets. Excessive memory usage may cause the system to respond slowly or fail to process new data requests. The calculation formula is as follows:

[0083]

[0084] Among them, U Mem Indicates memory usage, A abss_i Indicates the Avg Bwd Segment Size characteristic value of the i-th flow;

[0085] By analyzing the above indicators, we can evaluate the effectiveness of defense measures in network traffic management and effectively mitigate the impact of DoS attacks on the network.

[0086] The sequential execution of the above strategies in step 3 of this embodiment can quickly and effectively reduce the impact of attacks on the network and ensure the stable operation of the smart grid.

[0087] This embodiment not only detects and responds to DoS attack traffic, but also implements comprehensive dynamic optimization management of normal user traffic. In order to optimize the processing of normal user traffic, the network load capacity is calculated and a network load balancing strategy is implemented, thus solving the problem of configuring a DoS attack defense system while ensuring the operating efficiency of the power system.

[0088] In step 4, for the detected normal traffic, this method optimizes through network load balancing and priority queue management based on kernel density estimation, specifically, including the following steps:

[0089] Step 41: Using a network load balancing method, calculate the network load capacity according to current traffic characteristics;

[0090] Step 42: When the network load is high, priority queue management is adopted to sort the normal traffic into queues according to traffic priority based on the kernel density estimation method;

[0091] In this embodiment, priority queue management is adopted to ensure that high priority traffic is processed in a timely manner, reduce delays, and improve the reliability of key services.

[0092] Step 43: distribute normal traffic to multiple network nodes according to the priority queue to avoid overload of a single node;

[0093] In this embodiment, priority queue management is used to improve the overall network utilization and performance. Through the above optimization measures, the method of this embodiment can significantly improve the overall performance and reliability of the smart grid and ensure that network resources are reasonably allocated and efficiently utilized.

[0094] Furthermore, in step 42, a threshold is set based on a kernel density estimation method to determine the priority of normal traffic, specifically:

[0095] Step 421, determining the index characteristics for kernel density estimation of normal traffic, the index characteristics including the mean of backward data packets and traffic intervals; calculating the median absolute deviation of the index characteristics of the normal traffic to be processed;

[0096] The kernel density estimation (KDE) method is used to estimate the probability density of the data.

[0097] Through kernel density estimation, a smooth estimate of data distribution is obtained, and thresholds can be calculated based on this. The backward data packet and traffic interval mean are used together to evaluate the network load capacity.

[0098] Backward packets provide feedback load information about network activity, while the traffic interval mean assesses the cadence and frequency of forward transmissions.

[0099] High backward packets and short flow intervals indicate that the network has frequent two-way communication, the communication packets are large, and the load is high. Low backward packets and long flow intervals indicate that the network is less active, the communication packets are small, and the load is light.

[0100] MAD θ =median(|x k -median(X k )|)

[0101] Among them, θ is an indicator variable used to distinguish the mean of the traffic interval and the length of the backward packet; MAD represents the median absolute deviation; x k Represents a single traffic feature value, which can be a backward data packet or a traffic interval mean; median(X k ) means all x k The median of the values, where X k is a vector containing all the feature values ​​of "backward data packets" or "flow interval mean"; k represents an index used to distinguish the two flow characteristics. When k = 1, it represents the backward data packet, and when k = 2, it represents the flow interval mean.

[0102] Step 422: Calculate the diffusion degree of the kernel function corresponding to the indicator feature θ according to the obtained median absolute deviation of the indicator feature of the normal traffic to be processed, where θ is an indicator variable used to distinguish the mean of the traffic interval and the length of the backward data packet; the diffusion degree calculation formula is as follows:

[0103]

[0104] in, It represents the diffusion degree of the kernel function used to determine the indicator feature θ; m represents the total number of flow feature values.

[0105] Step 423: According to the obtained diffusion degree, based on the kernel density calculation, the cumulative probability of multiple feature vectors corresponding to the corresponding indicator feature θ is obtained;

[0106]

[0107] in, When the feature type is θ, the kernel density estimation function is used; P represents the Gaussian kernel function, which is used to calculate the contribution of each traffic feature value to the estimated density; x represents the estimated traffic interval mean and the backward packet length traffic feature value (this feature can cover the entire traffic data range); x i represents the actual traffic interval mean and the backward data packet length traffic characteristic value; m represents the number of traffic characteristic values.

[0108] Specifically, based on the obtained cumulative probability, it is determined whether the cumulative probability of the flow characteristic value is within the threshold range p θ The judgment formula is:

[0109]

[0110] Among them, Y(x|θ) means judging whether the cumulative probability of the current traffic feature value x is greater than the threshold p according to the feature type θ θ ;p θ represents a predefined cumulative probability;

[0111] After detecting a DoS attack, the method implemented in this invention quickly takes countermeasures and optimizes the allocation of network resources to achieve dynamic optimization management of traffic and ensure the continuous and stable operation of key businesses.

[0112] In step 423, the indicator feature θ is used to distinguish the mean of the flow interval and the length of the backward data packet. The feature vector extracted based on the indicator feature θ includes: flow duration, flow byte rate, flow packet rate and total length of the forward data packet:

[0113] FD={FD 1 ,FD 2 ,…,FD q}

[0114] BR = {BR 1 ,BR 2 ,…,BR q}

[0115] PR = {PR 1 ,PR 2 ,…,PR q}

[0116] L={L 1 ,L 2 ,…,L q}

[0117] F=(FD,BR,PR,L)

[0118] Among them, F is the traffic feature vector, which includes the current node traffic duration vector FD, traffic byte rate vector BR, traffic packet rate vector PR and forward data packet total length vector L; q represents the current node traffic quantity;

[0119] Step 424: Obtain the cumulative probability of all traffic features of the current node according to the cumulative probability of the obtained single traffic feature vector;

[0120] The cumulative probability calculated according to the kernel density function is as follows:

[0121] TFKDA={Y FD ,Y BR ,Y PR ,Y L}

[0122] TFKDA represents the cumulative probability vector of the current node traffic characteristics; Y FD represents the cumulative probability vector of each FD; Y BR represents the cumulative probability vector of each BR; Y PR represents the cumulative probability vector of each PR; Y L represents the cumulative probability vector for each L.

[0123] Step 425: Calculate the mean value M of the cumulative probability of the current node traffic feature TFKDA and variance

[0124] M TFKDA ={M j ,j=1,2,3,4}

[0125] Among them, M TFKDA represents the TFKDA mean vector; M 1 Represents Y FD Mean; M 2 Represents YBR Mean; M 3 Represents Y PR Mean; M 4 Represents Y L mean; j represents the number of traffic features;

[0126]

[0127] in, represents the TFKDA variance vector; Represents Y FD variance; Represents Y BR variance;

[0128] Represents Y PR variance; Represents Y L variance.

[0129] Step 425, calculating the threshold of each type of traffic based on the mean and variance calculated from different traffic characteristics, and classifying the traffic;

[0130] Based on the above traffic characteristics, the traffic is classified into “real-time control instruction flow”, “status monitoring data flow”, “system log and maintenance flow” and “unknown flow”.

[0131] C(F)={C control ,C monitor ,C log ,C unkown}

[0132] C(F) represents the traffic classification function; C control Represents real-time control instruction flow; C monitor Indicates the status monitoring data flow; C log Indicates system log and maintenance traffic; C unkown Indicates unknown traffic.

[0133] Specifically, real-time control instruction flow usually requires continuous high bandwidth and low latency, so its traffic characteristics include longer traffic duration, higher traffic byte rate and higher traffic packet rate, which are set to the highest priority. The cumulative probability is calculated for each feature type as follows:

[0134]

[0135] Among them, k 1 represents the sensitivity of adjusting the threshold;

[0136] According to the cumulative probability p s ,Using the percentile method, the traffic characteristic threshold that satisfies the real-time control instruction flow is calculated. The calculation formula is:

[0137] Threshold ct ={p s1 (FD),p s2 (BR),p s3 (PR)}

[0138] Threshold ct represents the threshold vector for judging whether the current node traffic is a real-time control instruction flow; p s1 (FD) represents the longer flow duration threshold; p s2 (BR) represents the high traffic byte rate threshold; p s3 (PR) represents the high traffic packet rate threshold; p s Represents the cumulative probability vector of satisfying the highest priority.

[0139] The state monitoring data flow involves short connections and small data transmission volume, and its characteristics are short flow duration, low flow byte rate and low flow packet rate, which are set to high priority. The cumulative probability is calculated for each feature type as follows:

[0140]

[0141] Among them, k 2 Represents the sensitivity of adjusting the threshold.

[0142] According to the cumulative probability p h , using the percentile method, calculate the traffic characteristic threshold that satisfies the status monitoring data flow as follows:

[0143] Threshold mt ={p h1 (FD),p h2 (BR),p h3 (PR)}

[0144] Among them, Threshold mt represents the threshold vector for judging whether the traffic is a state monitoring data flow; p h1 (FD) represents the short flow duration threshold; p h2 (BR) represents the low traffic byte rate threshold; p h3 (PR) represents the low traffic packet rate threshold; p s Represents the cumulative probability vector of satisfying high priority.

[0145] System log and maintenance traffic involves large data transmission volume and long transmission time, and its characteristics include long traffic duration, high traffic byte rate and large total forward packet length. Therefore, status monitoring data flow and system log and maintenance traffic are assigned medium priority.

[0146] Threshold log ={p s1 (FD),p s2 (BR),p s4 (L)}

[0147] Among them, Threshold log represents the threshold vector for judging whether the traffic is system log or maintenance traffic; p s1 (FD) represents the longer flow duration threshold; p s2 (BR) represents the high traffic byte rate threshold; p s4 (L) represents the maximum total length threshold of the forward data packet.

[0148] Traffic that does not meet the above criteria is classified as "unknown traffic". Real-time unknown traffic is assigned a low priority. Priority queue management ensures that high-priority traffic can be given priority when network resources are limited, reducing delays and packet loss rates.

[0149] A further technical solution is to distribute traffic to multiple network nodes according to the priority queue management strategy to ensure that each node can handle the corresponding traffic load, effectively avoiding the overload of a single node due to processing too much traffic, thereby improving the stability and performance of the overall network.

[0150] A feasible technical solution is to allocate the highest priority traffic to nodes with sufficient resources through priority division, ensuring the real-time and reliability of key businesses, while allowing low-priority traffic to be properly processed, achieving efficient use and balanced allocation of network resources.

[0151] Allocate(T k ,n j )

[0152] Allocate means allocating high-priority traffic to other nodes first according to the priority level; T means traffic; k means the traffic index in the priority queue; n j Represents the node labeled j; j represents the node number.

[0153] Through the above steps, based on the kernel density estimation method, we can roughly build a priority queue. In the actual operation process, abnormal behaviors such as traffic queue cutting may occur;

[0154] Further technical solutions, in this embodiment, the process of dynamically adjusting the priority of normal traffic specifically includes:

[0155] 1) Perform multi-dimensional traffic feature analysis on normal traffic to determine whether there is abnormal traffic behavior. After identifying that log traffic is jamming, reduce the priority of the corresponding traffic or limit the bandwidth to ensure that high-priority traffic is processed first;

[0156] Optionally, a method for performing multi-dimensional traffic feature analysis to identify abnormal traffic includes the following steps:

[0157] 1.1) Monitor network traffic in real time and obtain the timestamp of each data packet passing through the network to determine the order in which each traffic packet is sent and received;

[0158] 1.2) According to the priority of each data packet determined by the kernel density analysis method, the timestamp and priority information of the data packet are compared. Early processing of low-priority traffic or a sudden increase in low-priority traffic is determined as queue-jumping behavior, as follows;

[0159] When low-priority traffic with a large timestamp is processed before high-priority traffic, queue jumping is considered to have occurred, which is considered abnormal traffic behavior;

[0160] When a sudden increase in the transmission traffic of low-priority data packets is detected, and the sudden increase in low-priority traffic affects the transmission of high-priority traffic, it is judged that queue cutting has occurred and it is judged as abnormal traffic behavior;

[0161] Specifically, queue jumping is mainly identified by two key signals:

[0162] Early processing of low priority traffic: Low priority packets are processed earlier than high priority packets.

[0163] Sudden increase in low-priority traffic: A substantial increase in low-priority traffic causes network congestion, affecting the transmission and processing of high-priority traffic.

[0164] 2) Predict possible queue-jumping behaviors based on historical traffic data and proactively reduce resource usage of low-priority traffic in advance to prevent high-priority traffic from being affected;

[0165] 3) Dynamically adjust priorities according to the physical state of the power grid to achieve flexible allocation of resources. Specifically:

[0166] 3.1) When the network load is low, even if the low-priority traffic increases, its priority will not be forcibly reduced. Instead, flexible resource allocation is used to ensure efficient processing of all traffic;

[0167] 3.2) When in extreme weather or when the power grid is under great pressure, it automatically prioritizes urgent real-time control instruction flows and temporarily reduces the priority of maintenance or log flows to ensure the smooth execution of critical tasks;

[0168] 3.3) Real-time perception of the physical state of the power grid, thereby dynamically adjusting traffic priorities to ensure safe and stable operation of the power grid;

[0169] Among them, the physical state of the power grid is perceived in real time, such as whether key equipment has failed; when a failure occurs, the priority of fault information transmission should be increased;

[0170] The goal of this method is to reduce the total load of the entire network, that is, to minimize the node load to achieve load balancing and avoid overloading of a single node, thereby improving the stability and performance of the network. The specific objective function is:

[0171]

[0172] Where Z represents the total load of the current node; L a Indicates the current traffic load; a indicates the subscript of the traffic; n indicates the total amount of current traffic.

[0173] In this embodiment, the smart grid DoS attack detection mechanism based on machine learning can timely identify potential DoS attacks, and quickly mitigate the impact of attacks on the network through an automated response mechanism, thereby ensuring the stable operation of the smart grid. In addition, the combination of network load balancing and priority queue management significantly improves network performance and resource utilization efficiency. Load balancing optimizes resource allocation and avoids node overload, while priority queue management ensures that high-priority traffic is processed first, reducing latency and packet loss. These comprehensive strategies enable the network to adjust dynamically, improve user experience and service reliability, and enhance the stability and flexibility of the network.

[0174] In order to illustrate the effect of the method in this embodiment, a simulation experiment was carried out, which is specifically described as follows:

[0175] Figure 2 The change of flow duration under normal flow (Normal), DoS attack flow (DoS) and flow after defense (Defend) is shown to help evaluate the impact of defense strategy on flow continuity. It can be seen from the figure that the flow duration after defense by the method of this embodiment presents the level of normal flow;

[0176] Figure 3 The bandwidth utilization under normal traffic, DoS attack traffic and traffic after defense is compared, showing the impact of DoS attack on network bandwidth and the effectiveness of defense measures. It can be seen from the figure that the impact on network bandwidth is significantly reduced after the defense method of this embodiment;

[0177] Figure 4The figure shows the impact of normal traffic, DoS attack traffic, and traffic after defense on CPU utilization, and explains the optimization effect of defense measures on system resources. It can be seen from the figure that the CPU utilization is reduced after the defense method of this embodiment;

[0178] Figure 5 The memory changes under normal traffic, DoS attack traffic and traffic after defense are compared to evaluate the management effect of defense measures on memory resources. As can be seen from the figure, the memory of DoS attack traffic and traffic after defense is compared. The use of defense strategy can alleviate DoS attack, but compared with normal situation, the memory increases a little because part of abnormal traffic is isolated to one area.

[0179] Figure 6 The comparison of total time consumption and average response time in load balancing (Load Balanced) and no load balancing (No Load Balanced) is shown, reflecting the advantages of load balancing strategy and priority queue in optimizing network performance. After adopting the method of this embodiment, load balancing is performed, which can reduce the total time consumption and average response time.

[0180] Example 2

[0181] Based on Example 1, this embodiment provides a smart grid adaptive defense and flow dynamic optimization system, including:

[0182] Acquisition module: configured to acquire real-time network traffic of the smart grid;

[0183] Classification module: configured to detect the acquired real-time network traffic using a machine learning algorithm to determine whether it is under DoS attack;

[0184] Response module: configured to automatically execute DoS attack defense response measures for detected attack traffic;

[0185] Traffic dynamic management module: It is configured to optimize the detected normal traffic through network load balancing and priority queue management based on kernel density estimation, so as to dynamically manage the network traffic.

[0186] It should be noted here that the various modules in this embodiment correspond one-to-one to the various steps in Example 1, and the specific implementation process is the same, which will not be repeated here.

[0187] Example 3

[0188] This embodiment provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are executed by the processor, the steps of a smart grid adaptive defense and traffic dynamic optimization method in embodiment 1 are completed.

[0189] Example 4

[0190] This embodiment provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the steps of a smart grid adaptive defense and traffic dynamic optimization method in embodiment 1 are completed.

[0191] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0192] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A smart grid adaptive defense and flow dynamic optimization method, characterized in that: The steps include: Obtain real-time network traffic for smart grids; Use machine learning algorithms to detect the acquired real-time network traffic to determine whether it is under DoS attack; Automatically execute DoS attack defense response measures for detected attack traffic; For the detected normal traffic, network load balancing and priority queue management based on kernel density estimation are optimized to dynamically manage the network traffic.

2. A smart grid adaptive defense and flow dynamic optimization method as claimed in claim 1, characterized in that: Based on machine learning algorithms, random forest classifier or support vector machine is used.

3. A smart grid adaptive defense and flow dynamic optimization method as claimed in claim 1, characterized in that: For the detected attack traffic, DoS attack defense response measures are automatically executed, including the following processes in sequence: Block the attack source IP address and add the attack source IP address to the blacklist; Dynamically add static firewall rules to limit and block the transmission of attack traffic; Redirect attack traffic to a secure isolation zone.

4. The method for adaptive defense and dynamic flow optimization of smart grid according to claim 1, characterized in that: Optimization is performed through network load balancing and priority queue management based on kernel density estimation, including the following steps: Use network load balancing methods to calculate network load capacity based on current traffic characteristics; When the network load is high, priority queue management is used to sort normal traffic into queues according to traffic priority based on the kernel density estimation method; Normal traffic is distributed to multiple network nodes according to priority queues to avoid overloading of a single node.

5. The method for adaptive defense and dynamic flow optimization of smart grid according to claim 1, characterized in that: The threshold is set based on the kernel density estimation method to determine the priority of normal traffic. Specifically: Determine the indicator characteristics of normal traffic for kernel density estimation; calculate the median absolute deviation of the indicator characteristics of the normal traffic to be processed; According to the obtained median absolute deviation of the indicator feature of the normal traffic to be processed, the diffusion degree of the kernel function of the corresponding indicator feature is calculated; According to the obtained diffusion degree, based on the kernel density calculation, the cumulative probability of multiple feature vectors corresponding to the corresponding indicator feature θ is obtained; the multiple feature vectors corresponding to the indicator feature θ include flow duration, flow byte rate, flow packet rate and total length of forward data packets: According to the cumulative probability of a single traffic feature vector, the cumulative probability of all traffic features of the current node is obtained; Calculate the mean and variance of the cumulative probability of the current node traffic characteristics; According to the mean and variance calculated from different traffic characteristics, the threshold of each type of traffic is calculated to classify the traffic.

6. The method for adaptive defense and dynamic flow optimization of smart grid according to claim 1, characterized in that: Classify traffic into real-time control instruction flow, status monitoring data flow, system log and maintenance traffic, and unknown traffic.

7. The method for adaptive defense and dynamic flow optimization of smart grid according to claim 1, characterized in that: Perform multi-dimensional traffic feature analysis on normal traffic to determine whether there is abnormal traffic behavior. After identifying that log traffic is queue jumping, reduce the priority or limit the bandwidth. The method for performing multi-dimensional traffic feature analysis to identify abnormal traffic includes the following steps: Monitor network traffic in real time and obtain the timestamp of each data packet passing through the network to determine the order in which each traffic packet is sent and received; According to the priority of each data packet determined by the kernel density analysis method, the timestamp and priority information of the data packet are compared. Early processing of low-priority traffic or a sudden increase in low-priority traffic is determined as queue-jumping behavior, as follows; When low-priority traffic with a large timestamp is processed before high-priority traffic, queue jumping is considered to have occurred, which is considered abnormal traffic behavior; When a sudden increase in the transmission traffic of low-priority data packets is detected, and the sudden increase in low-priority traffic affects the transmission of high-priority traffic, it is judged that queue cutting has occurred and it is judged as abnormal traffic behavior.

8. A smart grid adaptive defense and flow dynamic optimization system, characterized in that: include: Acquisition module: configured to acquire real-time network traffic of the smart grid; Classification module: configured to detect the acquired real-time network traffic using a machine learning algorithm to determine whether it is under DoS attack; Response module: configured to automatically execute DoS attack defense response measures for detected attack traffic; Traffic dynamic management module: It is configured to optimize the detected normal traffic through network load balancing and priority queue management based on kernel density estimation, so as to dynamically manage the network traffic.

9. An electronic device, characterized in that: The method comprises a memory and a processor and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the method for adaptive defense and dynamic optimization of traffic of a smart grid as described in any one of claims 1 to 7 are completed.

10. A computer-readable storage medium, characterized in that: Used to store computer instructions, which, when executed by a processor, complete the steps of a smart grid adaptive defense and traffic dynamic optimization method as described in any one of claims 1-7.

Images