Attack early warning method and device of power system, terminal equipment and storage medium

Abstract

The invention discloses an attack early warning method and device for a power system, terminal equipment and a storage medium, and can accurately predict the probability of an attack type occurring in a future time period through an attack probability prediction model based on log data in a current time period. That is, the model can extract the time dependence corresponding to each attack type in the current time period, so that the time distribution characteristics of the attack types can be learned, and finally, the occurrence probability of the attack in the next time period is predicted based on the captured time dependence. Compared with the prior art, the method has the advantages that the characteristics of the attack types in the time sequence can be captured through the attack probability prediction model, so that the probability of the attack types occurring in the future can be accurately predicted, and when the target attack probability of one target attack type is judged to be greater than the preset probability threshold value, the target attack type can be accurately predicted. And if yes, generating early warning information corresponding to the target attack type, so that the early warning accuracy can be improved through accurate probability prediction.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and in particular to an attack warning method, device, terminal equipment and storage medium for a power system. Background Art

[0002] The cyber attacks on the power system generally refer to the acts of destroying the power system, stealing data or controlling the operation of the system through network means, such as DDOS attacks and malware attacks. Identifying and warning the attacks on the power system can effectively reduce the risk of the power system being attacked by cyber attacks. When predicting or warning the attacks in the next cycle or the next time period, the traditional warning methods often process the data of the previous cycle or time period based on simple rule matching or statistical thresholds. For example, signature-based detection (such as intrusion detection system IDS) performs simple detection on the log data of the previous time period, so as to predict whether there will be similar cyber attacks in the future time period and the probability of similar cyber attacks, so as to determine whether a warning should be issued.

[0003] However, simple rule matching usually relies on fixed rule sets, which may not cover all possible attack modes, while statistical threshold judgment relies too much on statistics such as the mean or standard deviation of historical data, and ignores the dynamic nature of attack behavior and its dependence on time series. Therefore, when traditional early warning methods predict whether network attacks will occur in the future based on log data within a period of time, they cannot obtain the characteristics of the attack types in the log data in the time series, and it is difficult to capture the complexity and time dependence of attack behaviors, so it is impossible to accurately predict the probability of attack types occurring in the future, resulting in low accuracy of early warnings. Summary of the invention

[0004] The embodiments of the present invention provide an attack warning method, apparatus, terminal device and storage medium for an electric power system, which can capture the characteristics of the attack type in the time series through an attack probability prediction model, thereby accurately predicting the probability of the attack type occurring in the future. This can effectively solve the problem that the traditional warning method in the prior art is difficult to capture the complexity and time dependence of the attack behavior, and cannot accurately predict the probability of the attack type occurring in the future, thereby resulting in a low accuracy rate of the warning.

[0005] An embodiment of the present invention provides an attack warning method for a power system, comprising:

[0006] Obtaining various log event data of the power system in the current time period; wherein each log event data corresponds to an attack type;

[0007] Input each log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, and generates a target attack probability corresponding to each attack type according to each time dependency; wherein the target attack probability is used to characterize the probability of occurrence of the attack type in the next time period;

[0008] When it is determined that any attack type is marked as a target attack type, early warning information including the target attack type is generated; wherein the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold;

[0009] Among them, the training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges to generate an attack probability prediction model.

[0010] Preferably, each log event data is arranged in chronological order within the current time period; the time dependency includes: the attack periodicity of the attack type in the time series and the trend of the attack type in the time series;

[0011] The attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, including:

[0012] For each attack type, the attack probability prediction model generates the attack periodicity of the attack type in the time series according to the timestamp of the attack type in each log event data and the time interval between the occurrence of the attack type;

[0013] For each attack type, the attack probability prediction model generates an initial probability of the attack type according to the number of times the attack type appears in each log event data, and then generates a probability distribution of the attack type over time according to the initial probability of the attack type and the time interval of the attack type in the time series; wherein the initial probability is used to characterize the probability of occurrence of the attack type in the current time period;

[0014] According to the probability distribution corresponding to each attack type, the attack trend of each attack type in the time series is generated.

[0015] Preferably, the generation of the attack type corresponding to each log event data includes:

[0016] For each log event data of the power system in the current time period, the log event data is segmented and a corresponding word list is generated;

[0017] For all word lists of all log event data, generate target weight values ​​corresponding to different words according to the frequency of occurrence of different words in all word lists;

[0018] For each word list corresponding to each log event data, after connecting all the words in the word list to form a string, generate a string list corresponding to the word list according to the string; input the word list, the string list and the target weight values ​​corresponding to different words into the attack type prediction model, so that the attack type prediction model generates a weighted fused feature vector according to the word list, the string list and the target weight values ​​corresponding to different words, and generates the attack type corresponding to the log event data according to the weighted fused feature vector;

[0019] According to the attack type corresponding to each log event data, determine the attack type corresponding to each log event data of the power system in the current time period;

[0020] The generation of the attack type prediction model includes:

[0021] A word list corresponding to each log event data sample in a sample time period, a character string list corresponding to each log event data sample, and weighted sample values ​​corresponding to different words of all log event data samples in the sample time period are used as training samples;

[0022] Taking several training samples in the sample time period and the actual attack type of each training sample as input and the predicted attack type of each training sample as output, the attack type prediction model is iteratively trained until the attack type prediction model converges to generate an attack type prediction model.

[0023] Preferably, the attack type prediction model generates a weighted fused feature vector according to the word list, the character string list and target weight values ​​corresponding to different words, including:

[0024] The attack type prediction model extracts a character feature vector corresponding to the string list;

[0025] Extracting a plurality of word feature vectors corresponding to the word list, and extracting a semantic feature vector corresponding to the word list;

[0026] A weighted fused feature vector is generated according to the character feature vector, the semantic feature vector, the feature vectors of each word and the target weight values ​​corresponding to different words.

[0027] Preferably, the attack type prediction model extracts the character feature vector corresponding to the string list, including:

[0028] The attack type prediction model slides on the string list through multiple convolution kernels to capture the context information between characters, and then performs convolution operations and pooling operations on the context information to extract the character feature vector corresponding to the string list.

[0029] Preferably, each word in the word list corresponds to a position code; the attack type prediction model includes: an attention layer and a plurality of network layers; each network layer corresponds to an encoder;

[0030] The step of extracting the semantic feature vector corresponding to the word list includes:

[0031] The attack type prediction model aggregates each word in the word list and the position code corresponding to each word to generate an embedding vector corresponding to each word;

[0032] Input the embedding vector into each network layer, so that the encoder in each network layer generates a hidden state sequence corresponding to each network layer according to the embedding vector and the hidden state sequence output by the previous network layer; wherein the first network layer generates a corresponding hidden state sequence according to the embedding vector; each hidden state vector in the hidden state sequence corresponds to each word in the word list;

[0033] For the target hidden state sequence output by the network layer belonging to the last layer, the attention weights corresponding to each hidden state vector in the target hidden state sequence are calculated through the attention mechanism of the attention layer, and then the hidden state vectors in the target hidden state sequence are weighted averaged according to each attention weight to generate a weighted average hidden state vector;

[0034] The weighted average hidden state vector is output as the semantic feature vector corresponding to the word list.

[0035] Preferably, generating target weight values ​​corresponding to different words according to the frequencies of occurrence of different words in all word lists includes:

[0036] Extracting different words from all word lists and generating a word set; wherein each word in the word set is different;

[0037] Repeat the following weight value update operation until it is determined that all word lists in the current time period have been extracted, and use the updated weight values ​​of different words as the target weight values ​​corresponding to different words:

[0038] The earliest stored word lists in the preset time window are removed, and the word lists that have not been extracted in the current time period are stored in the preset time window; wherein, initially, the word lists are extracted from the current time period according to the preset time window and stored in the preset time window; the total number of word lists in the preset time window is less than the total number of word lists in the current time period, and the total number of word lists in the preset time window remains unchanged;

[0039] Each different word in the word set is traversed one by one, and a current inverse document frequency corresponding to the word is generated according to the number of word lists containing the word within a preset time window and the total number of all word lists within the preset time window; wherein the current inverse document frequency is used to measure the rarity of the word in all word lists;

[0040] Generate updated weight values ​​of different words according to the current inverse document frequency of each different word and the current weight value corresponding to each different word; wherein the current weight value corresponding to each different word is initially a preset value;

[0041] When it is determined that the word list in the current time period has not been completely extracted, the updated weight values ​​of different words are used as the current weight values ​​corresponding to each different word in the next weight value update operation.

[0042] Based on the above method embodiments, the present invention provides corresponding device embodiments.

[0043] An embodiment of the present invention provides an attack warning device for a power system, comprising: a log event data acquisition module, an attack probability generation module and a warning module;

[0044] The log event data acquisition module is used to acquire various log event data of the power system in the current time period; wherein each log event data corresponds to an attack type;

[0045] The attack probability generation module is used to input each log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, and generates the target attack probability corresponding to each attack type according to each time dependency; wherein the target attack probability is used to characterize the probability of occurrence of the attack type in the next time period;

[0046] The early warning module is used to generate early warning information containing the target attack type when determining that any attack type is marked as a target attack type; wherein the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold;

[0047] Among them, the training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges to generate an attack probability prediction model.

[0048] Based on the above method embodiments, the present invention provides corresponding terminal device embodiments.

[0049] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, an attack warning method for a power system described in the above-mentioned embodiment of the invention is implemented.

[0050] Based on the above method embodiments, the present invention provides corresponding storage medium item embodiments.

[0051] Another embodiment of the present invention provides a storage medium, wherein the computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute an attack warning method for a power system described in the above-mentioned embodiment of the invention.

[0052] The following beneficial effects are achieved by implementing the present invention:

[0053] The embodiment of the present invention provides an attack warning method, device, terminal device and storage medium for an electric power system. After acquiring each log event data of the electric power system in the current time period, the present invention can input each log event data and an attack type corresponding to each log event data in the current time period into an attack probability prediction model, so that the probability of the attack type occurring in the future time period can be accurately predicted based on the log data in the current time period through the model, so as to assist the subsequent warning process; specifically, the attack probability prediction model can extract the time dependency corresponding to each attack type in the current time period, so as to learn the time distribution characteristics of the attack type, and finally predict the probability of the attack occurring in the next time period based on the captured time dependency. Compared with the prior art, the present invention can capture the characteristics of the attack type in the time series through the attack probability prediction model, so as to accurately predict the probability of the attack type occurring in the future, and can generate warning information corresponding to the target attack type when it is determined that the target attack probability of a target attack type is greater than a preset probability threshold, so as to improve the accuracy of the warning through accurate probability prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 The present invention is a flowchart of an attack warning method for a power system provided by an embodiment of the present invention.

[0055] Figure 2 It is a flow chart of an early warning method provided by another embodiment of the present invention.

[0056] Figure 3 It is a structural diagram of an attack warning device for a power system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] like Figure 1 FIG. 1 is a flow chart of an attack warning method for a power system provided by an embodiment of the present invention. The attack warning method for a power system includes:

[0059] Step S1: Acquire various log event data of the power system in the current time period; wherein each log event data corresponds to an attack type;

[0060] Step S2: Input each log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, and generates a target attack probability corresponding to each attack type according to each time dependency; wherein the target attack probability is used to characterize the probability of occurrence of the attack type in the next time period;

[0061] The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, and generating an attack probability prediction model;

[0062] Step S3: when it is determined that any attack type is marked as a target attack type, early warning information including the target attack type is generated; wherein the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold.

[0063] For step S1, in a preferred embodiment, when acquiring each log event data of the power system in the current time period, the present invention can also identify and predict the attack type of each log event data, then:

[0064] First, for each log event data of the power system in the current time period, each log event data is segmented and a corresponding word list is generated;

[0065] Then, based on each word list, the target weight values ​​of different words and the string list corresponding to each word list can be obtained;

[0066] Specifically, for all word lists of all log event data, target weight values ​​corresponding to different words are generated according to the frequencies of occurrence of different words in all word lists;

[0067] For each word list corresponding to each log event data, after connecting all words in the word list to form a string, a string list corresponding to the word list is generated according to the string;

[0068] Then, the word list, the string list, and the target weight values ​​corresponding to different words can be input into the attack type prediction model, so that the attack type prediction model generates a weighted fused feature vector according to the word list, the string list, and the target weight values ​​corresponding to different words, and generates the attack type corresponding to the log event data according to the weighted fused feature vector;

[0069] According to the attack type corresponding to each log event data, determine the attack type corresponding to each log event data of the power system in the current time period;

[0070] The generation of the attack type prediction model includes:

[0071] A word list corresponding to each log event data sample in a sample time period, a character string list corresponding to each log event data sample, and weighted sample values ​​corresponding to different words of all log event data samples in the sample time period are used as training samples;

[0072] Taking several training samples in the sample time period and the actual attack type of each training sample as input and the predicted attack type of each training sample as output, the attack type prediction model is iteratively trained until the attack type prediction model converges to generate an attack type prediction model.

[0073] It can be understood that the present invention predicts the corresponding attack type in the current time period for each log event data, and then based on the corresponding attack type in the current time period, realizes the probability prediction of the attack type in the next time period, so as to further realize whether to issue a corresponding warning of the attack type.

[0074] When predicting the attack type corresponding to the log event data in the current time period, the present invention can identify and extract the character feature vector, word feature vector and semantic feature vector of the log event data through the attack type prediction model, thereby realizing the extraction of multi-level features of character-level features, word-level features and deep semantic features, and performing feature fusion to obtain the feature vector of the log event data, so as to achieve accurate attack type prediction.

[0075] Then, the attack type prediction model generates a weighted fused feature vector according to the word list, the string list and the target weight values ​​corresponding to different words, including:

[0076] The attack type prediction model extracts a character feature vector corresponding to the string list;

[0077] Extracting a plurality of word feature vectors corresponding to the word list, and extracting a semantic feature vector corresponding to the word list;

[0078] A weighted fused feature vector is generated according to the character feature vector, the semantic feature vector, the feature vectors of each word and the target weight values ​​corresponding to different words.

[0079] Schematically, the character feature vector provides basic language structure information, the word feature vector reflects the information at the vocabulary level, and the semantic feature vector captures the deeper meaning of the text. The fusion of multi-level features helps the model to more accurately understand the meaning and context of log event data, thereby improving the accuracy of attack type prediction.

[0080] Furthermore, different words may have different importance in log event data. By assigning different weights to different words through target weight values, the model can pay more attention to those words that are more critical to the attack type prediction, that is, the model can focus on key information more accurately during the prediction process and reduce noise interference.

[0081] Specifically, when extracting the character feature vector corresponding to the string list through the attack type prediction model, it specifically includes:

[0082] The attack type prediction model slides on the string list through multiple convolution kernels to capture the context information between characters, and then performs convolution operations and pooling operations on the context information to extract the character feature vector corresponding to the string list.

[0083] Schematically, the present invention can extract a variety of different local features by using multiple convolution kernels, which can better adapt to different types of log event data and improve the accuracy of prediction. And through convolution and pooling operations, the model can learn more abstract and advanced feature representations, and these feature representations not only contain character-level information, but also contain contextual information between characters and higher-level semantic information, which further improves the accuracy and stability of the prediction.

[0084] Furthermore, when the semantic feature vector corresponding to the word list is extracted through the attack type prediction model, it specifically includes:

[0085] Each word in the word list corresponds to a position code; the attack type prediction model includes: an attention layer and a plurality of network layers; each network layer corresponds to an encoder;

[0086] The attack type prediction model first aggregates each word in the word list and the position code corresponding to each word to generate an embedding vector corresponding to each word;

[0087] Next, the embedding vector is input into each network layer, so that the encoder in each network layer generates a hidden state sequence corresponding to each network layer according to the embedding vector and the hidden state sequence output by the previous network layer; wherein the first network layer generates a corresponding hidden state sequence according to the embedding vector; each hidden state vector in the hidden state sequence corresponds to each word in the word list;

[0088] Finally, for the target hidden state sequence output by the network layer belonging to the last layer, the attention weights corresponding to each hidden state vector in the target hidden state sequence are calculated through the attention mechanism of the attention layer, and then the hidden state vectors in the target hidden state sequence are weighted averaged according to each attention weight to generate a weighted average hidden state vector;

[0089] The weighted average hidden state vector is output as the semantic feature vector corresponding to the word list.

[0090] Schematically, the present invention can use multiple network layers (each network layer includes an encoder) to gradually extract the deep features of words. Each layer of encoder will generate a new hidden state sequence based on the output of the previous layer (or embedded vector, for the first layer) and the current input. The present invention can learn more complex and abstract feature representations by extracting features layer by layer, thereby improving the performance and accuracy of the attack type prediction model in extracting semantic feature vectors, and providing more reliable and effective support for attack warnings of power systems.

[0091] Furthermore, when generating target weight values ​​corresponding to different words according to the frequencies of occurrence of different words in all word lists, it specifically includes:

[0092] Extracting different words from all word lists and generating a word set; wherein each word in the word set is different;

[0093] Repeat the following weight value update operation until it is determined that all word lists in the current time period have been extracted, and use the updated weight values ​​of different words as the target weight values ​​corresponding to different words:

[0094] The earliest stored word lists in the preset time window are removed, and the word lists that have not been extracted in the current time period are stored in the preset time window; wherein, initially, the word lists are extracted from the current time period according to the preset time window and stored in the preset time window; the total number of word lists in the preset time window is less than the total number of word lists in the current time period, and the total number of word lists in the preset time window remains unchanged;

[0095] Each different word in the word set is traversed one by one, and a current inverse document frequency corresponding to the word is generated according to the number of word lists containing the word within a preset time window and the total number of all word lists within the preset time window; wherein the current inverse document frequency is used to measure the rarity of the word in all word lists;

[0096] Generate updated weight values ​​of different words according to the current inverse document frequency of each different word and the current weight value corresponding to each different word; wherein the current weight value corresponding to each different word is initially a preset value;

[0097] When it is determined that the word list in the current time period has not been completely extracted, the updated weight values ​​of different words are used as the current weight values ​​corresponding to each different word in the next weight value update operation.

[0098] It can be understood that the above process introduces a time window and a dynamic update mechanism so that the weight value of a word can reflect its rarity and importance in the latest data, thereby improving the timeliness and accuracy of the weight value.

[0099] Specifically, the process of dynamically updating the word weight value may be as follows:

[0100] First, extract each different word from all word lists to generate a word set that does not contain repeated words.

[0101] A preset time window is set, whose size (i.e., the number of word lists contained) is smaller than the total number of word lists in the current time period, and this size remains unchanged throughout the process. Initially, a number of word lists are randomly or according to a certain rule selected from the current time period and stored in the time window.

[0102] An initial weight value is assigned to each different word, and this initial value can be a preset value, such as 0 or a decimal.

[0103] In each update cycle, the earliest stored word lists in the time window (i.e., the oldest data) are removed, and the new word lists that have not been extracted in the current time cycle are stored in the time window. In this way, the time window can always keep its focus on the latest data in the current time cycle.

[0104] Each word in the word set is traversed, and its frequency of occurrence in the word list contained in the current time window is calculated, and then the current inverse document frequency (IDF) of the word is calculated. The inverse document frequency is an indicator to measure the rarity of a word in all documents. In this embodiment of the present invention, the total number of documents (i.e., word lists) in the time window and the number of documents containing the word can be used for calculation.

[0105] The weight value of each word is updated according to its current inverse document frequency and its current weight value. Indicatively, a weighted sum, product or other calculation method that can reflect the rarity and importance of a word can be adopted.

[0106] The weight value updating operation is repeated until all word lists in the current time period are extracted and used to update the weight values.

[0107] Finally, the updated weight values ​​of different words are output as their target weight values.

[0108] Therefore, by continuously updating the weight values, the noise and outliers in the data can be adapted when calculating the weight values ​​of the words, reducing their impact on the weight value calculation results. And by limiting the size of the time window, the amount of data that needs to be processed can be reduced, thereby reducing the computational overhead.

[0109] Therefore, the embodiment of the present invention comprehensively considers the features at the three levels of characters, words and semantics, and combines weight optimization, so that the attack type prediction model can more accurately predict the attack type corresponding to the log event data.

[0110] For step S2, in a preferred embodiment, log event data that has been classified into attack types are collected and sorted, organized into a time series format, and each log event data is formed and arranged in chronological order within the current time period. Then, each log event data is input into an attack probability prediction model, so that the model can obtain the time dependency corresponding to the attack type in the current time period; wherein, the time dependency includes: the attack periodicity of the attack type in the time series and the trend of the attack type in the time series.

[0111] Then, the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data. The specific process is:

[0112] For each attack type, the attack probability prediction model generates the attack periodicity of the attack type in the time series according to the timestamp of the attack type in each log event data and the time interval between the occurrence of the attack type;

[0113] For each attack type, the attack probability prediction model generates an initial probability of the attack type according to the number of times the attack type appears in each log event data, and then generates a probability distribution of the attack type over time according to the initial probability of the attack type and the time interval of the attack type in the time series; wherein the initial probability is used to characterize the probability of occurrence of the attack type in the current time period;

[0114] According to the probability distribution corresponding to each attack type, the attack trend of each attack type in the time series is generated.

[0115] It can be understood that for each attack type, the attack probability prediction model in the embodiment of the present invention first predicts the attack periodicity of the attack type based on its timestamp and time interval of occurrence in each log event data to identify whether the attack type presents a specific repetitive pattern or periodicity.

[0116] Next, the attack probability prediction model calculates the initial probability of the attack type based on the number of times it appears in each log event data, and the initial probability reflects the relative frequency or occurrence probability of the attack type relative to other attack types in the current time period.

[0117] Based on the initial probability, the model further considers the time interval of the attack type in the time series to generate the probability distribution of the attack type over time. It can be understood that the probability distribution not only reflects the probability of the attack type, but also reveals its trend and dynamic behavior over time.

[0118] Finally, the attack trend can be generated based on the probability distribution corresponding to each attack type, such as whether the attack type shows an upward, downward or stable trend in the current time period.

[0119] The attack probability prediction model of the present invention can more accurately predict the probability and trend of future attack types by considering the time dependence of attack types (such as periodicity and trend), so as to achieve early warning and reduce potential security risks.

[0120] Therefore, the present invention can input the log text of the power system when it suffers multiple network attacks in a short period of time into the attack probability prediction model, so that the model can use the timestamp and attack type information therein to extract time-dependent features such as attack periodicity and trend, and predict the probability of occurrence of each attack type in the next time period based on the extracted time-dependent features. When the predicted probability of a certain attack type exceeds the preset warning value, the corresponding warning information can be generated to remind the corresponding defense measures to be taken.

[0121] For step S3, in a preferred embodiment, after obtaining the probability of occurrence of each attack type in the next time period, a warning may be issued based on the pre-set risk level and the threshold for triggering the warning to determine whether an attack will occur in the next time period. For attacks marked as target attack types, corresponding warning information may be generated, and the warning information may include the name of the attack type, the predicted probability, the possible impact range, and the recommended defense measures.

[0122] In a preferred embodiment, the current time period is set to 10 minutes and the warning threshold is 0.7. Then, the following log events can be collected during the time period from 2024-04-02 06:25:00 to 2024-04-02 06:35:00: 2024-04-02 06:25:30-SQL injection attack, 2024-04-02 06:27:15-SQL injection attack, 2024-04-02 06:28:42-session hijacking attack, 2024-04-02 06:30:18-SQL injection attack, 2024-04-02 06:32:05-SQL injection attack, 2024-04-02 06:33:50-SQL injection attack.

[0123] The attack probability prediction model receives this data as input and predicts the probability of each type of attack occurring in the next time period (for example, 2024-04-02 06:35:00 to 2024-04-02 06:45:00) based on the frequency of each type of attack within 10 minutes. When the result is that the probability of SQL injection attack is 0.85, it is determined that it exceeds the preset threshold of 0.7, so it can generate warning information and countermeasures including SQL injection attack.

[0124] like Figure 2 As shown, in another preferred embodiment, the embodiment of the present invention may include the following steps:

[0125] First, the log data of the power grid system is cleaned and filtered, and the Drain algorithm is used to parse each log. Then, the log events are preprocessed by word segmentation and stop word removal.

[0126] In the feature extraction stage, multi-level feature extraction is used to enhance data representation, including using character-level CNN to extract character-level feature vectors, applying the FastText model to extract word-level features, and using the Transformer model to extract deep semantic features. After obtaining the word vector, the BM25 weight is dynamically calculated through the sliding window method, and the multi-level features are integrated into a single vector representation.

[0127] Furthermore, a multi-layer fully connected network is used to build a classification model, and based on the classification results, a time series analysis is performed on the log data to obtain the attack type of the log data.

[0128] Finally, a prediction model is built to predict the probability of an attack occurring in the next time period based on log data and the predefined warning threshold. When the probability prediction result exceeds the set threshold, warning information containing the abnormality type and response measures can be automatically generated, thereby realizing intelligent safety warning of the power grid system.

[0129] like Figure 3 As shown, based on the above-mentioned various embodiments of the attack warning method for the power system, the present invention provides a corresponding device embodiment;

[0130] An embodiment of the present invention provides an attack warning device for a power system, comprising: a log event data acquisition module, an attack probability generation module and a warning module;

[0131] The log event data acquisition module is used to acquire various log event data of the power system in the current time period; wherein each log event data corresponds to an attack type;

[0132] The attack probability generation module is used to input each log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, and generates the target attack probability corresponding to each attack type according to each time dependency; wherein the target attack probability is used to characterize the probability of occurrence of the attack type in the next time period;

[0133] The early warning module is used to generate early warning information containing the target attack type when determining that any attack type is marked as a target attack type; wherein the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold;

[0134] Among them, the training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges to generate an attack probability prediction model.

[0135] It should be noted that the device embodiments described above are merely schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, and may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. Those of ordinary skill in the art can understand and implement it without paying creative labor.

[0136] Those skilled in the art can clearly understand that, for the sake of convenience and simplicity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0137] Based on the above-mentioned various embodiments of the attack warning method for the power system, the present invention provides corresponding embodiments of the terminal equipment item.

[0138] An embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, an attack warning method for an electric power system described in any method embodiment of the present invention is implemented.

[0139] The terminal device may be a computing terminal device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0140] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, and uses various interfaces and lines to connect various parts of the entire terminal device.

[0141] The memory can be used to store the computer program, and the processor realizes various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Med i aCard, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device or other volatile solid-state storage device.

[0142] Based on the above-mentioned various embodiments of the attack warning method for the power system, the present invention provides a corresponding storage medium item embodiment.

[0143] An embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute an attack warning method for an electric power system described in any method embodiment of the present invention.

[0144] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0145] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A power system attack warning method, characterized in that: include: Obtaining various log event data of the power system in the current time period; wherein each log event data corresponds to an attack type; Input each log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, and generates a target attack probability corresponding to each attack type according to each time dependency; wherein the target attack probability is used to characterize the probability of occurrence of the attack type in the next time period; When it is determined that any attack type is marked as a target attack type, early warning information including the target attack type is generated; wherein the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold; Among them, the training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges to generate an attack probability prediction model.

2. The attack warning method for a power system according to claim 1, characterized in that: Each log event data is arranged in chronological order within the current time period; The time dependency includes: the attack periodicity of the attack type in the time series and the trend of the attack type in the time series; The attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, including: For each attack type, the attack probability prediction model generates the attack periodicity of the attack type in the time series according to the timestamp of the attack type in each log event data and the time interval between the occurrence of the attack type; For each attack type, the attack probability prediction model generates an initial probability of the attack type according to the number of times the attack type appears in each log event data, and then generates a probability distribution of the attack type over time according to the initial probability of the attack type and the time interval of the attack type in the time series; wherein the initial probability is used to characterize the probability of occurrence of the attack type in the current time period; According to the probability distribution corresponding to each attack type, the attack trend of each attack type in the time series is generated.

3. The attack warning method for a power system as claimed in claim 2, characterized in that: Generation of attack types corresponding to each log event data, including: For each log event data of the power system in the current time period, the log event data is segmented and a corresponding word list is generated; For all word lists of all log event data, generate target weight values ​​corresponding to different words according to the frequency of occurrence of different words in all word lists; For each word list corresponding to each log event data, after connecting all the words in the word list to form a string, generate a string list corresponding to the word list according to the string; input the word list, the string list and the target weight values ​​corresponding to different words into the attack type prediction model, so that the attack type prediction model generates a weighted fused feature vector according to the word list, the string list and the target weight values ​​corresponding to different words, and generates the attack type corresponding to the log event data according to the weighted fused feature vector; According to the attack type corresponding to each log event data, determine the attack type corresponding to each log event data of the power system in the current time period; The generation of the attack type prediction model includes: A word list corresponding to each log event data sample in a sample time period, a character string list corresponding to each log event data sample, and weighted sample values ​​corresponding to different words of all log event data samples in the sample time period are used as training samples; Taking several training samples in the sample time period and the actual attack type of each training sample as input and the predicted attack type of each training sample as output, the attack type prediction model is iteratively trained until the attack type prediction model converges to generate an attack type prediction model.

4. The attack warning method for a power system as claimed in claim 3, characterized in that: The attack type prediction model generates a weighted fused feature vector according to the word list, the character string list and target weight values ​​corresponding to different words, including: The attack type prediction model extracts a character feature vector corresponding to the string list; Extracting a plurality of word feature vectors corresponding to the word list, and extracting a semantic feature vector corresponding to the word list; A weighted fused feature vector is generated according to the character feature vector, the semantic feature vector, the feature vectors of each word and the target weight values ​​corresponding to different words.

5. The attack warning method for a power system as claimed in claim 4, characterized in that: The attack type prediction model extracts the character feature vector corresponding to the string list, including: The attack type prediction model slides on the string list through multiple convolution kernels to capture the context information between characters, and then performs convolution operations and pooling operations on the context information to extract the character feature vector corresponding to the string list.

6. The attack warning method for a power system according to claim 5, characterized in that: Each word in the word list corresponds to a position code; The attack type prediction model includes: an attention layer and a plurality of network layers; each network layer corresponds to an encoder; The step of extracting the semantic feature vector corresponding to the word list includes: The attack type prediction model aggregates each word in the word list and the position code corresponding to each word to generate an embedding vector corresponding to each word; Input the embedding vector into each network layer, so that the encoder in each network layer generates a hidden state sequence corresponding to each network layer according to the embedding vector and the hidden state sequence output by the previous network layer; wherein the first network layer generates a corresponding hidden state sequence according to the embedding vector; each hidden state vector in the hidden state sequence corresponds to each word in the word list; For the target hidden state sequence output by the network layer belonging to the last layer, the attention weights corresponding to each hidden state vector in the target hidden state sequence are calculated through the attention mechanism of the attention layer, and then the hidden state vectors in the target hidden state sequence are weighted averaged according to each attention weight to generate a weighted average hidden state vector; The weighted average hidden state vector is output as the semantic feature vector corresponding to the word list.

7. The attack warning method for a power system as claimed in claim 3, characterized in that: The method of generating target weight values ​​corresponding to different words according to the frequencies of occurrence of different words in all word lists includes: Extracting different words from all word lists and generating a word set; wherein each word in the word set is different; Repeat the following weight value update operation until it is determined that all word lists in the current time period have been extracted, and use the updated weight values ​​of different words as the target weight values ​​corresponding to different words: The earliest stored word lists in the preset time window are removed, and the word lists that have not been extracted in the current time period are stored in the preset time window; wherein, initially, the word lists are extracted from the current time period according to the preset time window and stored in the preset time window; the total number of word lists in the preset time window is less than the total number of word lists in the current time period, and the total number of word lists in the preset time window remains unchanged; Each different word in the word set is traversed one by one, and a current inverse document frequency corresponding to the word is generated according to the number of word lists containing the word within a preset time window and the total number of all word lists within the preset time window; wherein the current inverse document frequency is used to measure the rarity of the word in all word lists; Generate updated weight values ​​of different words according to the current inverse document frequency of each different word and the current weight value corresponding to each different word; wherein the current weight value corresponding to each different word is initially a preset value; When it is determined that the word list in the current time period has not been completely extracted, the updated weight values ​​of different words are used as the current weight values ​​corresponding to each different word in the next weight value update operation.

8. An attack warning device for a power system, characterized in that: include: Log event data acquisition module, attack probability generation module and early warning module; The log event data acquisition module is used to acquire various log event data of the power system in the current time period; wherein each log event data corresponds to an attack type; The attack probability generation module is used to input each log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency corresponding to each attack type in the current time period from each log event data, and generates the target attack probability corresponding to each attack type according to each time dependency; wherein the target attack probability is used to characterize the probability of occurrence of the attack type in the next time period; The early warning module is used to generate early warning information containing the target attack type when determining that any attack type is marked as a target attack type; wherein the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold; Among them, the training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges to generate an attack probability prediction model.

9. A terminal device, characterized in that: The invention comprises a processor, a memory and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, an attack warning method for a power system as described in any one of claims 1 to 7 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is executed, the device where the storage medium is located is controlled to execute an attack warning method for a power system as described in any one of claims 1 to 7.

Images