An attack early warning method and device for a power system, a terminal device, and a storage medium

Abstract

The application discloses an attack early warning method and device of a power system, a terminal equipment and a storage medium, can accurately predict the probability of attack type in the future time period based on the log data in the current time period through the attack probability prediction model, that is, the model can extract the time dependence corresponding to each attack type in the current time period, so as to learn the time distribution characteristics of the attack type, and finally predict the occurrence probability of the attack in the next time period based on the captured time dependence. Compared with the prior art, the application can capture the characteristics of the attack type in the time sequence through the attack probability prediction model, thereby accurately predicting the probability of the attack type in the future, and when it is determined that the target attack probability of a target attack type is greater than a preset probability threshold, the early warning information corresponding to the target attack type is generated, so that the accuracy of the early warning is improved through accurate probability prediction.

Description

Technical Field

[0001] This invention relates to the field of power system technology, and in particular to a method, apparatus, terminal equipment, and storage medium for early warning of attacks on power systems. Background Technology

[0002] Cyberattacks on power systems generally refer to actions that damage, steal data, or control system operations through network means, such as DDoS attacks and malware attacks. Identifying and issuing early warnings about these attacks can effectively reduce the risk of cyberattacks on power systems. Traditional early warning methods, when predicting or issuing warnings for attacks in the next cycle or time period, often rely on simple rule matching or statistical thresholds to process data from the previous cycle or time period. For example, signature-based detection (such as Intrusion Detection Systems (IDS)) performs simple checks on log data from previous periods to predict whether similar cyberattacks will occur in the future and the probability of such attacks, thus determining whether an early warning should be issued.

[0003] However, simple rule matching usually relies on a fixed set of rules, which may not cover all possible attack patterns. Statistical threshold judgments rely too heavily on statistical measures such as the average or standard deviation of historical data, ignoring the dynamic nature of attack behavior and its dependence on time series. Therefore, when traditional early warning methods predict whether a network attack will occur in the future based on log data within a certain period, they cannot obtain the characteristics of the attack type in the log data in the time series, making it difficult to capture the complexity and time dependence of attack behavior. Consequently, they cannot accurately predict the probability of an attack type occurring in the future, resulting in a low accuracy rate for early warnings. Summary of the Invention

[0004] This invention provides an attack early warning method, device, terminal equipment, and storage medium for power systems. It can capture the characteristics of attack types in a time series through an attack probability prediction model, thereby accurately predicting the probability of attack types occurring in the future. This effectively solves the problem that traditional early warning methods in the prior art are unable to capture the complexity and time dependence of attack behavior, thus failing to accurately predict the probability of attack types occurring in the future, resulting in low early warning accuracy.

[0005] An embodiment of the present invention provides an attack early warning method for power systems, comprising:

[0006] Obtain log event data for each power system event within the current time period; each log event data corresponds to an attack type.

[0007] Each log event data is input into the attack probability prediction model, so that the attack probability prediction model can extract the time dependency of each attack type in the current time period from each log event data, and generate the target attack probability corresponding to each attack type based on each time dependency; wherein, the target attack probability is used to characterize the probability of the attack type occurring in the next time period;

[0008] When any attack type is identified as a target attack type, a warning message containing the target attack type is generated; wherein, the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold.

[0009] The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, thereby generating the attack probability prediction model.

[0010] Preferably, the log event data are arranged in chronological order within the current time period; the time dependency includes: the attack periodicity of the attack type in the time series and the trend of the attack type in the time series;

[0011] The attack probability prediction model extracts the time dependency of each attack type in the current time period from various log event data, including:

[0012] For each attack type, the attack probability prediction model generates the attack periodicity of the attack type in the time series based on the timestamp of the attack type in each log event data and the time interval between the occurrence of the attack type.

[0013] For each attack type, the attack probability prediction model generates an initial probability of the attack type based on the number of times the attack type appears in each log event data, and then generates a probability distribution of the attack type over time based on the initial probability of the attack type and the time interval between the occurrence of the attack type in the time series; wherein, the initial probability is used to characterize the probability of the attack type occurring in the current time period.

[0014] Based on the probability distribution corresponding to each attack type, the attack trend of each attack type in the time series is generated.

[0015] Preferably, the generation of the attack type corresponding to each log event data includes:

[0016] For each log event data of the power system within the current time period, the log event data is segmented into words to generate a corresponding word list;

[0017] For all word lists of all log event data, generate target weight values ​​for different words based on the frequency of each word appearing in all word lists;

[0018] For each word list corresponding to each log event data, all words in the word list are concatenated to form a string, and a string list corresponding to the word list is generated based on the string. The word list, the string list, and the target weight values ​​corresponding to different words are input into the attack type prediction model, so that the attack type prediction model generates a weighted fused feature vector based on the word list, the string list, and the target weight values ​​corresponding to different words, and generates the attack type corresponding to the log event data based on the weighted fused feature vector.

[0019] Based on the attack type corresponding to each log event data, the attack type corresponding to each log event data of the power system in the current time period is determined;

[0020] The generation of the attack type prediction model includes:

[0021] The training samples are the word list corresponding to each log event data sample in the sample time period, the string list corresponding to each log event data sample, and the weight sample values ​​corresponding to different words of all log event data samples in the sample time period.

[0022] The attack type prediction model is iteratively trained using several training samples in the sample time period and the actual attack type of each training sample as input, and the predicted attack type of each training sample as output, until the attack type prediction model converges, thus generating the attack type prediction model.

[0023] Preferably, the attack type prediction model generates a weighted fused feature vector based on the word list, the string list, and the target weight values ​​corresponding to different words, including:

[0024] The attack type prediction model extracts the character feature vectors corresponding to the string list;

[0025] Extract several word feature vectors corresponding to the word list, and extract the semantic feature vectors corresponding to the word list;

[0026] Based on the character feature vector, semantic feature vector, feature vectors of each word, and target weight values ​​corresponding to different words, a weighted fused feature vector is generated.

[0027] Preferably, the attack type prediction model extracts the character feature vectors corresponding to the string list, including:

[0028] The attack type prediction model uses multiple convolutional kernels to slide across a list of strings to capture contextual information between characters. Then, it performs convolution and pooling operations on the contextual information to extract the character feature vectors corresponding to the list of strings.

[0029] Preferably, each word in the word list corresponds to a positional code; the attack type prediction model includes: an attention layer and several network layers; each network layer corresponds to an encoder;

[0030] The step of extracting the semantic feature vector corresponding to the word list includes:

[0031] The attack type prediction model aggregates each word in the word list and the position code corresponding to each word to generate an embedding vector for each word.

[0032] The embedding vector is input into each network layer so that the encoder in each network layer generates a hidden state sequence corresponding to each network layer based on the embedding vector and the hidden state sequence output by the previous network layer; wherein, the first network layer generates a corresponding hidden state sequence based on the embedding vector; each hidden state vector in the hidden state sequence corresponds to each word in the word list;

[0033] For the target hidden state sequence output by the last network layer, the attention weights corresponding to each hidden state vector in the target hidden state sequence are calculated through the attention mechanism of the attention layer. Then, the hidden state vectors in the target hidden state sequence are weighted and averaged according to each attention weight to generate the weighted average hidden state vector.

[0034] The weighted average hidden state vector is output as the semantic feature vector corresponding to the word list.

[0035] Preferably, generating target weight values ​​for different words based on their frequency of occurrence across all word lists includes:

[0036] Extract all distinct words from the list of words and generate a word set; wherein each word in the word set is unique.

[0037] Repeat the following weight update operation until it is determined that the entire word list for the current time period has been extracted. Use the updated weight values ​​of different words as the target weight values ​​for those words:

[0038] Remove the earliest stored word list within the preset time window, and store the word list that has not been extracted in the current time period into the preset time window; initially, extract the word list from the current time period according to the preset time window and store it into the preset time window; the total number of word lists in the preset time window is less than the total number of word lists in the current time period, and the total number of word lists in the preset time window remains unchanged;

[0039] Each distinct word in the word set is traversed one by one. Based on the number of word lists containing the word within a preset time window and the total number of word lists within the preset time window, the current inverse document frequency (CNV) of the word is generated. The CNV is used to measure the rarity of the word in all word lists.

[0040] Based on the current inverse document frequency of each different word and the current weight value corresponding to each different word, the updated weight values ​​of different words are generated; where, initially, the current weight value corresponding to each different word is a preset value;

[0041] If it is determined that the word list in the current time period has not been completely extracted, the updated weight values ​​of different words are used as the current weight values ​​of each different word in the next weight value update operation.

[0042] Based on the above method embodiments, the present invention provides corresponding apparatus embodiments.

[0043] One embodiment of the present invention provides an attack early warning device for a power system, comprising: a log event data acquisition module, an attack probability generation module, and an early warning module;

[0044] The log event data acquisition module is used to acquire log event data of the power system within the current time period; wherein, each log event data corresponds to an attack type;

[0045] The attack probability generation module is used to input various log event data into the attack probability prediction model, so that the attack probability prediction model can extract the time dependency of each attack type in the current time period from each log event data, and generate the target attack probability corresponding to each attack type based on each time dependency; wherein, the target attack probability is used to characterize the probability of the attack type occurring in the next time period.

[0046] The early warning module is used to generate early warning information containing the target attack type when it is determined that any attack type is marked as a target attack type; wherein, the target attack type is used to characterize the attack type whose target attack probability is greater than a preset probability threshold.

[0047] The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, thereby generating the attack probability prediction model.

[0048] Based on the above method embodiments, the present invention provides corresponding terminal device embodiments.

[0049] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the attack warning method for a power system described in the above-described embodiment of the invention.

[0050] Based on the above method embodiments, the present invention provides corresponding storage medium embodiments.

[0051] Another embodiment of the present invention provides a storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the attack warning method for a power system described in the above-described embodiment of the invention.

[0052] The following benefits can be obtained by implementing the present invention:

[0053] This invention provides an attack early warning method, device, terminal equipment, and storage medium for power systems. After acquiring log event data from the power system within the current time period, this invention inputs each log event data point and its corresponding attack type into an attack probability prediction model. The model can then accurately predict the probability of an attack type occurring in future time periods based on the log data within the current time period, assisting in the subsequent early warning process. Specifically, the attack probability prediction model can extract the time dependency of each attack type within the current time period, thereby learning the temporal distribution characteristics of attack types. Finally, based on the captured time dependency, it predicts the probability of an attack occurring in the next time period. Compared to existing technologies, this invention can capture the characteristics of attack types in a time series through the attack probability prediction model, thereby accurately predicting the probability of an attack type occurring in the future. Furthermore, when the target attack probability of a target attack type is determined to be greater than a preset probability threshold, an early warning message corresponding to that target attack type is generated. This accurate probability prediction improves the accuracy of early warnings. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating an attack warning method for a power system according to an embodiment of the present invention.

[0055] Figure 2 This is a flowchart of an early warning method provided in another embodiment of the present invention.

[0056] Figure 3 This is a schematic diagram of the structure of an attack early warning device for a power system provided in an embodiment of the present invention. Detailed Implementation

[0057] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] like Figure 1 The diagram shown is a flowchart illustrating an attack warning method for a power system according to an embodiment of the present invention. The attack warning method for a power system includes:

[0059] Step S1: Obtain log event data of the power system within the current time period; where each log event data corresponds to an attack type;

[0060] Step S2: Input each log event data into the attack probability prediction model so that the attack probability prediction model can extract the time dependency of each attack type in the current time period from each log event data, and generate the target attack probability corresponding to each attack type based on each time dependency; wherein, the target attack probability is used to characterize the probability of the attack type occurring in the next time period;

[0061] The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, thereby generating the attack probability prediction model.

[0062] Step S3: When any attack type is identified as a target attack type, generate warning information containing the target attack type; wherein, the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold.

[0063] Regarding step S1, in a preferred embodiment, when acquiring log event data of the power system within the current time period, the present invention can also identify and predict the attack type of each log event data, thus:

[0064] First, for each log event data of the power system within the current time period, each log event data is segmented into words to generate a corresponding word list;

[0065] Then, based on each word list, we can obtain the target weight value for different words, as well as the string list corresponding to each word list;

[0066] Specifically, for all word lists of all log event data, target weight values ​​are generated for different words based on the frequency of each word appearing in all word lists;

[0067] For each word list corresponding to each log event data, all words in the word list are concatenated to form a string, and then a string list corresponding to the word list is generated based on the string.

[0068] Then the word list, the string list, and the target weight values ​​corresponding to different words can be input into the attack type prediction model, so that the attack type prediction model generates a weighted fused feature vector based on the word list, the string list, and the target weight values ​​corresponding to different words, and generates the attack type corresponding to the log event data based on the weighted fused feature vector;

[0069] Based on the attack type corresponding to each log event data, the attack type corresponding to each log event data of the power system in the current time period is determined;

[0070] The generation of the attack type prediction model includes:

[0071] The training samples are the word list corresponding to each log event data sample in the sample time period, the string list corresponding to each log event data sample, and the weight sample values ​​corresponding to different words of all log event data samples in the sample time period.

[0072] The attack type prediction model is iteratively trained using several training samples in the sample time period and the actual attack type of each training sample as input, and the predicted attack type of each training sample as output, until the attack type prediction model converges, thus generating the attack type prediction model.

[0073] It is understood that, for each log event data, this invention predicts the attack type corresponding to the current time period, and then, based on the attack type corresponding to the current time period, predicts the probability of the attack type occurring in the next time period, so as to further realize whether to issue a corresponding early warning for the attack type.

[0074] When predicting the attack type corresponding to log event data in the current time period, this invention can identify and extract the character feature vector, word feature vector and semantic feature vector of log event data through the attack type prediction model, thereby realizing the extraction of multi-level features of character-level features, word-level features and deep semantic features, and performing feature fusion to obtain the feature vector of log event data, so as to achieve accurate attack type prediction.

[0075] Therefore, the attack type prediction model generates a weighted fused feature vector based on the word list, the string list, and the target weight values ​​corresponding to different words, including:

[0076] The attack type prediction model extracts the character feature vectors corresponding to the string list;

[0077] Extract several word feature vectors corresponding to the word list, and extract the semantic feature vectors corresponding to the word list;

[0078] Based on the character feature vector, semantic feature vector, feature vectors of each word, and target weight values ​​corresponding to different words, a weighted fused feature vector is generated.

[0079] To illustrate, character feature vectors provide basic language structure information, word feature vectors reflect lexical information, and semantic feature vectors capture deeper textual meaning. The fusion of multi-level features helps the model to more accurately understand the meaning and context of log event data, thereby improving the accuracy of attack type prediction.

[0080] Furthermore, different words may have varying importance in log event data. By assigning different weights to different words based on target weights, the model can focus more on words that are more critical to attack type prediction. This allows the model to more accurately focus on key information during the prediction process and reduce noise interference.

[0081] Specifically, when extracting the character feature vectors corresponding to the string list using the attack type prediction model, the process includes:

[0082] The attack type prediction model uses multiple convolutional kernels to slide across a list of strings to capture contextual information between characters. Then, it performs convolution and pooling operations on the contextual information to extract the character feature vectors corresponding to the list of strings.

[0083] In illustrative terms, this invention utilizes multiple convolutional kernels to extract diverse local features, enabling better adaptation to different types of log event data and improving prediction accuracy. Furthermore, through convolution and pooling operations, the model learns more abstract and high-level feature representations. These representations not only contain character-level information but also contextual information between characters and higher-level semantic information, further enhancing prediction accuracy and stability.

[0084] Furthermore, when extracting the semantic feature vector corresponding to the word list using the attack type prediction model, the specific steps include:

[0085] Each word in the word list corresponds to a positional code; the attack type prediction model includes: an attention layer and several network layers; each network layer corresponds to an encoder;

[0086] The attack type prediction model first aggregates each word in the word list and the position code corresponding to each word to generate an embedding vector for each word.

[0087] Next, the embedding vector is input into each network layer so that the encoder in each network layer generates a hidden state sequence corresponding to each network layer based on the embedding vector and the hidden state sequence output by the previous network layer; wherein, the first network layer generates a corresponding hidden state sequence based on the embedding vector; each hidden state vector in the hidden state sequence corresponds to each word in the word list.

[0088] Finally, for the target hidden state sequence output by the last network layer, the attention weights corresponding to each hidden state vector in the target hidden state sequence are calculated through the attention mechanism of the attention layer. Then, the hidden state vectors in the target hidden state sequence are weighted and averaged according to each attention weight to generate the weighted average hidden state vector.

[0089] The weighted average hidden state vector is output as the semantic feature vector corresponding to the word list.

[0090] Indicatively, this invention can use multiple network layers (each containing an encoder) to progressively extract deep features of words. Each encoder layer generates a new hidden state sequence based on the output (or embedding vector, for the first layer) of the previous layer and the current input. Thus, by extracting features layer by layer, this invention can learn more complex and abstract feature representations, thereby improving the performance and accuracy of the attack type prediction model in extracting semantic feature vectors, and providing more reliable and effective support for attack early warning in power systems.

[0091] Furthermore, when generating target weight values ​​for different words based on their frequency of occurrence across all word lists, the specific steps include:

[0092] Extract all distinct words from the list of words and generate a word set; wherein each word in the word set is unique.

[0093] Repeat the following weight update operation until it is determined that the entire word list for the current time period has been extracted. Use the updated weight values ​​of different words as the target weight values ​​for those words:

[0094] Remove the earliest stored word list within the preset time window, and store the word list that has not been extracted in the current time period into the preset time window; initially, extract the word list from the current time period according to the preset time window and store it into the preset time window; the total number of word lists in the preset time window is less than the total number of word lists in the current time period, and the total number of word lists in the preset time window remains unchanged;

[0095] Each distinct word in the word set is traversed one by one. Based on the number of word lists containing the word within a preset time window and the total number of word lists within the preset time window, the current inverse document frequency (CNV) of the word is generated. The CNV is used to measure the rarity of the word in all word lists.

[0096] Based on the current inverse document frequency of each different word and the current weight value corresponding to each different word, the updated weight values ​​of different words are generated; where, initially, the current weight value corresponding to each different word is a preset value;

[0097] If it is determined that the word list in the current time period has not been completely extracted, the updated weight values ​​of different words are used as the current weight values ​​of each different word in the next weight value update operation.

[0098] Understandably, the above process, by introducing a time window and a dynamic update mechanism, enables the weight value of a word to reflect its rarity and importance in the latest data, thereby improving the timeliness and accuracy of the weight value.

[0099] Specifically, the process of dynamically updating word weight values ​​described above can be as follows:

[0100] First, extract all the distinct words from the list of all words to generate a word set that does not contain duplicate words.

[0101] Set a preset time window whose size (i.e., the number of word lists it contains) is smaller than the total number of word lists in the current time period, and this size remains constant throughout the process. Initially, several word lists are randomly selected from the current time period or selected according to a certain rule and stored in the time window.

[0102] Assign an initial weight value to each different word. This initial value can be a preset numerical value, such as 0 or a decimal.

[0103] In each update cycle, the oldest list of words stored within the time window (i.e., the oldest data) is removed, and a list of new words that have not yet been extracted in the current time cycle is stored in the time window. This ensures that the time window always keeps abreast of the latest data within the current time cycle.

[0104] Each word in the word set is traversed, and its frequency of occurrence in the word list included within the current time window is calculated. This leads to the calculation of the word's current inverse document frequency (IDF). The inverse document frequency is an indicator of how rare a word is across all documents. In this embodiment, it can be calculated using the total number of documents (i.e., the word list) within the time window and the number of documents containing the word.

[0105] The weight value of each word is updated based on its current inverse document frequency and its current weight value. This can be illustrated by using weighted summation, product, or other calculation methods that reflect the rarity and importance of words.

[0106] Repeat the weight value update operation until all word lists in the current time period have been extracted and used to update the weight values.

[0107] Finally, the updated weight values ​​of different words are output as their target weight values.

[0108] Therefore, by continuously updating the weight values, the calculation of word weights can be adapted to noise and outliers in the data, reducing their impact on the weight calculation results. Furthermore, by limiting the size of the time window, the amount of data that needs to be processed can be reduced, thereby lowering computational costs.

[0109] Therefore, by comprehensively considering features at three levels—characters, words, and semantics—and combining them with weight optimization, the embodiments of the present invention enable the attack type prediction model to more accurately predict the attack type corresponding to log event data.

[0110] For step S2, in a preferred embodiment, log event data that has been classified into attack types is collected and organized into a time series format. After forming log event data arranged in chronological order within the current time period, each log event data is input into the attack probability prediction model, which enables the model to obtain the time dependence of the attack type in the current time period. The time dependence includes the attack periodicity of the attack type in the time series and the trend of the attack type in the time series.

[0111] Therefore, the attack probability prediction model extracts the time dependency of each attack type in the current time period from various log event data. The specific process is as follows:

[0112] For each attack type, the attack probability prediction model generates the attack periodicity of the attack type in the time series based on the timestamp of the attack type in each log event data and the time interval between the occurrence of the attack type.

[0113] For each attack type, the attack probability prediction model generates an initial probability of the attack type based on the number of times the attack type appears in each log event data, and then generates a probability distribution of the attack type over time based on the initial probability of the attack type and the time interval between the occurrence of the attack type in the time series; wherein, the initial probability is used to characterize the probability of the attack type occurring in the current time period.

[0114] Based on the probability distribution corresponding to each attack type, the attack trend of each attack type in the time series is generated.

[0115] It is understood that, for each attack type, the attack probability prediction model in this embodiment of the invention first predicts the attack periodicity of the attack type based on its timestamp and the time interval between occurrences in each log event data, so as to identify whether the attack type exhibits a specific repetitive pattern or periodicity.

[0116] Next, the attack probability prediction model calculates the initial probability of an attack type based on the number of times it appears in each log event data. The initial probability reflects the relative frequency or probability of occurrence of the attack type relative to other attack types within the current time period.

[0117] Based on the initial probabilities, the model further considers the time intervals at which attack types appear in the time series to generate a probability distribution of attack types over time. Understandably, this probability distribution not only reflects the probability of an attack type occurring but also reveals its trend and dynamic behavior over time.

[0118] Finally, attack trends can be generated based on the probability distribution corresponding to each attack type, such as whether the attack type shows an upward, downward, or stable trend within the current time period.

[0119] The attack probability prediction model of this invention, by considering the time dependence of attack types (such as periodicity and trend), can more accurately predict the probability and trend of future attack types, so as to achieve early warning and reduce potential security risks.

[0120] Therefore, this invention can input log text from a power system subjected to multiple cyberattacks within a short period into an attack probability prediction model. The model then uses timestamps and attack type information to extract time-dependent features such as attack periodicity and trends, and predicts the probability of each attack type occurring in the next time period based on these extracted features. When the predicted probability of a certain attack type exceeds a preset warning value, a corresponding warning message can be generated to alert the user to take appropriate defensive measures.

[0121] In a preferred embodiment, for step S3, after obtaining the probability of occurrence of each attack type in the next time period, an early warning can be issued regarding whether an attack will occur in the next time period based on a pre-set risk level and a threshold for triggering an early warning. For attacks marked as target attack types, corresponding early warning information can be generated, which may include the name of the attack type, the predicted probability, the possible scope of impact, and suggested defensive measures.

[0122] In a preferred embodiment, the current time period is set to 10 minutes, and the warning threshold is 0.7. Then, within the time period from 06:25:00 to 06:35:00 on 2024-04-02, the following log events can be collected: 2024-04-02 06:25:30 - SQL injection attack, 2024-04-02 06:27:15 - SQL injection attack, 2024-04-02 06:28:42 - Session hijacking attack, 2024-04-02 06:30:18 - SQL injection attack, 2024-04-02 06:32:05 - SQL injection attack, 2024-04-02 06:33:50 - SQL injection attack.

[0123] The attack probability prediction model receives this data as input and, based on the frequency of various attacks within a 10-minute period, predicts the probability of each type of attack occurring in the next time period (e.g., from 06:35:00 on April 2, 2024 to 06:45:00 on April 2, 2024). When the result shows a probability of SQL injection attack of 0.85, it is determined to exceed the preset threshold of 0.7. Therefore, it can generate early warning information and countermeasure suggestions containing SQL injection attack information.

[0124] like Figure 2 As shown, in another preferred embodiment, the present invention may include the following steps:

[0125] First, the log data of the power grid system is cleaned and filtered, and the Drai'n algorithm is used to parse each log. Then, preprocessing is performed on the log events, including word segmentation and stop word removal.

[0126] In the feature extraction stage, multi-level feature extraction is employed to enhance data representation. This includes using a character-level CNN to extract character-level feature vectors, applying a FastText model to extract word-level features, and utilizing a Transformer model to extract deep semantic features. After obtaining the word vectors, the BM25 weights are dynamically calculated using a sliding window method, and the multi-level features are integrated into a single vector representation.

[0127] Furthermore, a classification model is constructed using a multi-layer fully connected network, and time series analysis is performed on the log data based on the classification results to obtain the attack types of the log data.

[0128] Finally, a predictive model is constructed. Based on the probability prediction of the attack occurring in the next time period from the log data and the predefined early warning threshold, an early warning information containing the anomaly type and countermeasure suggestions can be automatically generated when the probability prediction exceeds the set threshold, thereby realizing intelligent security early warning for the power grid system.

[0129] like Figure 3 As shown, based on the embodiments of the various attack warning methods for power systems described above, the present invention provides corresponding device embodiments;

[0130] One embodiment of the present invention provides an attack early warning device for a power system, comprising: a log event data acquisition module, an attack probability generation module, and an early warning module;

[0131] The log event data acquisition module is used to acquire log event data of the power system within the current time period; wherein, each log event data corresponds to an attack type;

[0132] The attack probability generation module is used to input various log event data into the attack probability prediction model, so that the attack probability prediction model can extract the time dependency of each attack type in the current time period from each log event data, and generate the target attack probability corresponding to each attack type based on each time dependency; wherein, the target attack probability is used to characterize the probability of the attack type occurring in the next time period.

[0133] The early warning module is used to generate early warning information containing the target attack type when it is determined that any attack type is marked as a target attack type; wherein, the target attack type is used to characterize the attack type whose target attack probability is greater than a preset probability threshold.

[0134] The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, thereby generating the attack probability prediction model.

[0135] It should be noted that the device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0136] Those skilled in the art will clearly understand that, for convenience and simplicity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0137] Based on the embodiments of the various attack warning methods for power systems described above, the present invention provides corresponding embodiments for terminal devices.

[0138] One embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements an attack warning method for a power system as described in any embodiment of the present invention.

[0139] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0140] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0141] The memory can be used to store the computer program. The processor implements various functions of the terminal device by running or executing the computer program stored in the memory and calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart memory card (SMC), secure digital card (SD), flash memory card, at least one disk storage device, flash memory device or other volatile solid-state storage device.

[0142] Based on the embodiments of attack warning methods for various power systems described above, the present invention provides corresponding embodiments for storage media.

[0143] One embodiment of the present invention provides a storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute an attack early warning method for a power system as described in any embodiment of the present invention.

[0144] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When executed by a processor, the computer program can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drive, portable hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium does not include electrical carrier signals and telecommunication signals.

[0145] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for early warning of attacks on a power system, characterized in that, include: Obtain log event data for each power system event within the current time period; each log event data corresponds to an attack type. Each log event data point is input into an attack probability prediction model, which extracts the time dependency of each attack type within the current time period from the log event data. Based on this time dependency, the model generates a target attack probability for each attack type. The target attack probability characterizes the probability of an attack type occurring in the next time period. For each attack type, the model generates an attack periodicity in the time series based on the timestamps of the attack type in each log event data point and the time interval between its occurrences. For each attack type, the model generates an initial probability based on the number of times the attack type appears in each log event data point, and then generates a probability distribution of the attack type over time based on the initial probability and the time interval between its occurrences in the time series. The initial probability characterizes the probability of an attack type occurring within the current time period. Based on the probability distribution corresponding to each attack type, the model generates an attack trend for each attack type in the time series. When any attack type is identified as a target attack type, a warning message containing the target attack type is generated; wherein, the target attack type is used to characterize an attack type whose target attack probability is greater than a preset probability threshold; The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, thereby generating the attack probability prediction model.

2. The attack early warning method for a power system as described in claim 1, characterized in that, The log event data is arranged in chronological order within the current time period; The time dependence includes: the attack periodicity of the attack type in the time series and the trend of the attack type in the time series.

3. The attack early warning method for a power system as described in claim 1, characterized in that, The generation of the attack type corresponding to each log event data includes: For each log event data of the power system within the current time period, the log event data is segmented into words to generate a corresponding word list; For all word lists of all log event data, generate target weight values ​​for different words based on the frequency of each word appearing in all word lists; For each word list corresponding to each log event data, all words in the word list are concatenated to form a string, and a string list corresponding to the word list is generated based on the string. The word list, the string list, and the target weight values ​​corresponding to different words are input into the attack type prediction model, so that the attack type prediction model generates a weighted fused feature vector based on the word list, the string list, and the target weight values ​​corresponding to different words, and generates the attack type corresponding to the log event data based on the weighted fused feature vector. Based on the attack type corresponding to each log event data, the attack type corresponding to each log event data of the power system in the current time period is determined; The generation of the attack type prediction model includes: The training samples are the word list corresponding to each log event data sample in the sample time period, the string list corresponding to each log event data sample, and the weight sample values ​​corresponding to different words of all log event data samples in the sample time period. The attack type prediction model is iteratively trained using several training samples in the sample time period and the actual attack type of each training sample as input, and the predicted attack type of each training sample as output, until the attack type prediction model converges, thus generating the attack type prediction model.

4. The attack early warning method for a power system as described in claim 3, characterized in that, The attack type prediction model generates a weighted fused feature vector based on the word list, the string list, and the target weight values ​​corresponding to different words, including: The attack type prediction model extracts the character feature vectors corresponding to the string list; Extract several word feature vectors corresponding to the word list, and extract the semantic feature vectors corresponding to the word list; Based on the character feature vector, semantic feature vector, feature vectors of each word, and target weight values ​​corresponding to different words, a weighted fused feature vector is generated.

5. The attack early warning method for a power system as described in claim 4, characterized in that, The attack type prediction model extracts the character feature vectors corresponding to the string list, including: The attack type prediction model uses multiple convolutional kernels to slide across a list of strings to capture contextual information between characters. Then, it performs convolution and pooling operations on the contextual information to extract the character feature vectors corresponding to the list of strings.

6. The attack early warning method for a power system as described in claim 5, characterized in that, Each word in the word list corresponds to a positional code; The attack type prediction model includes: an attention layer and several network layers; each network layer corresponds to an encoder; The step of extracting the semantic feature vector corresponding to the word list includes: The attack type prediction model aggregates each word in the word list and the position code corresponding to each word to generate an embedding vector for each word. The embedding vector is input into each network layer so that the encoder in each network layer generates a hidden state sequence corresponding to each network layer based on the embedding vector and the hidden state sequence output by the previous network layer; wherein, the first network layer generates a corresponding hidden state sequence based on the embedding vector; each hidden state vector in the hidden state sequence corresponds to each word in the word list; For the target hidden state sequence output by the last network layer, the attention weights corresponding to each hidden state vector in the target hidden state sequence are calculated through the attention mechanism of the attention layer. Then, the hidden state vectors in the target hidden state sequence are weighted and averaged according to each attention weight to generate the weighted average hidden state vector. The weighted average hidden state vector is output as the semantic feature vector corresponding to the word list.

7. The attack early warning method for a power system as described in claim 3, characterized in that, The process of generating target weight values ​​for different words based on their frequency of occurrence across all word lists includes: Extract all distinct words from the list of words and generate a word set; wherein each word in the word set is unique. Repeat the following weight update operation until it is determined that the entire word list for the current time period has been extracted. Use the updated weight values ​​of different words as the target weight values ​​for those words: Remove the earliest stored word list within the preset time window, and store the word list that has not been extracted in the current time period into the preset time window; initially, extract the word list from the current time period according to the preset time window and store it into the preset time window; the total number of word lists in the preset time window is less than the total number of word lists in the current time period, and the total number of word lists in the preset time window remains unchanged; Each distinct word in the word set is traversed one by one. Based on the number of word lists containing the word within a preset time window and the total number of word lists within the preset time window, the current inverse document frequency (CNV) of the word is generated. The CNV is used to measure the rarity of the word in all word lists. Based on the current inverse document frequency of each different word and the current weight value corresponding to each different word, the updated weight values ​​of different words are generated; where, initially, the current weight value corresponding to each different word is a preset value; If it is determined that the word list in the current time period has not been completely extracted, the updated weight values ​​of different words are used as the current weight values ​​of each different word in the next weight value update operation.

8. An attack early warning device for a power system, characterized in that, include: Log event data acquisition module, attack probability generation module, and early warning module; The log event data acquisition module is used to acquire log event data of the power system within the current time period; wherein, each log event data corresponds to an attack type; The attack probability generation module is used to input various log event data into the attack probability prediction model, so that the attack probability prediction model extracts the time dependency of each attack type in the current time period from each log event data, and generates the target attack probability corresponding to each attack type based on each time dependency; wherein, the target attack probability is used to characterize the probability of the attack type occurring in the next time period; wherein, for each attack type, the attack probability prediction model generates the attack periodicity of the attack type in the time series based on the timestamp of the attack type in each log event data and the time interval of the attack type's occurrence; wherein, for each attack type, the attack probability prediction model generates the initial probability of the attack type based on the number of times the attack type occurs in each log event data, and then generates the probability distribution of the attack type changing over time based on the initial probability of the attack type and the time interval of the attack type's occurrence in the time series; wherein, the initial probability is used to characterize the probability of the attack type occurring in the current time period; and based on the probability distribution corresponding to each attack type, the attack trend of each attack type in the time series is generated. The early warning module is used to generate early warning information containing the target attack type when it is determined that any attack type is marked as a target attack type; wherein, the target attack type is used to characterize the attack type whose target attack probability is greater than a preset probability threshold. The training of the attack probability prediction model includes: taking a number of log event data samples and the actual attack probability of each attack type sample in each log event data sample as input, and taking the predicted attack probability of each attack type sample in each log event data sample as output, iteratively training the attack probability prediction model until the attack probability prediction model converges, thereby generating the attack probability prediction model.

9. A terminal device, characterized in that, The system includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements an attack warning method for a power system as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the storage medium is located to perform an attack warning method for a power system as described in any one of claims 1 to 7.

Images