Power network system abnormal access detection method, equipment and medium

Abstract

The invention relates to a power network system abnormal access detection method and device and a medium, and the method comprises the following steps: obtaining power network system data, inputting a power network system abnormal access detection vertical model, and outputting an abnormal access detection result; the power network system abnormal access detection vertical class model is obtained through the following steps that S1, power network security corpus data are obtained and preprocessed, and a pre-training data set is constructed; s2, pre-training the big language base model to obtain a power network security big language model; s3, performing secondary screening on the pre-training data set based on an abnormal access detection task of the power network system, and constructing a supervision fine tuning data set in combination with expert opinion data; and S4, performing fine tuning on the power network security big language model to obtain a power network system abnormal access detection vertical class model. Compared with the prior art, the capability of accurately detecting various abnormal access behaviors in a novel network system with a large amount of multi-modal data can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method, a device and a medium for detecting abnormal access to a power network system. Background Art

[0002] Effective detection of abnormal access behavior is a key component to improving the security performance of network systems. According to the current research status at home and abroad, there are many problems with the existing abnormal access detection methods. On the one hand, rule-based detection systems can only detect known attack patterns and are powerless against new or unknown attacks; on the other hand, with the increasing heterogeneity and complexity of data in new network systems, the difficulty of updating manually designed features and rules will also increase. These problems will make it difficult for the model to cope with the rapidly changing security threats in new network systems.

[0003] Specifically, in the process of abnormal access detection for network systems, traditional mathematical models or machine learning methods are often based on known attack patterns, and their ability to deal with new attacks such as zero-day attacks is seriously insufficient, resulting in the existing abnormal behavior detection models with insufficient coverage, performance bottlenecks and other problems, which increases the security risk of network systems. Chinese patent application 201911349630.9 proposes a modeling method for website application security defect detection model and a defect detection method, which obtains access log samples and alarm log samples by using preset access information flow samples to obtain access security defect sample sets, and then obtains a security defect detection model through deep learning algorithm training. During detection, the access information flow data and access log information are input, and according to the output results of the security defect detection model, it is judged whether the current access behavior triggers abnormal access behavior of security defects, so as to expose unknown security defects that cannot be detected by source code comparison, and solve the technical problem that the existing network security defect detection method can only detect known security defects. However, with the development of smart grids and energy Internet, for new network systems such as power network systems, existing methods still have difficulty in processing and analyzing large-scale heterogeneous multimodal data such as operation logs and sensor data (such as equipment operation data and grid status data). Therefore, it is necessary to design an abnormal access detection method for power network systems to further improve the ability to accurately detect various complex abnormal access behaviors in new network systems with large amounts of multimodal data. Summary of the invention

[0004] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and to provide a method, device and medium for detecting abnormal access to an electric power network system, so as to further enhance the ability to accurately detect various complex abnormal access behaviors in a new electric power network system with a large amount of multimodal data.

[0005] The purpose of the present invention can be achieved by the following technical solutions:

[0006] The present invention provides a method for detecting abnormal access to a power network system, comprising the following steps:

[0007] Acquire power network system data, including network traffic information, log information and user behavior information, input the power network system abnormal access detection vertical model, and output the power network system abnormal access detection result; wherein, the power network system abnormal access detection vertical model is obtained by the following steps:

[0008] S1. Obtain and preprocess the power network security corpus data to build a pre-training data set;

[0009] S2. Pre-training the large language base model in a pre-training framework using the pre-training data set to obtain a large language model for power network security;

[0010] S3. Perform secondary screening on the pre-trained data set based on the power network system abnormal access detection task, input the closed-source large language model for corpus learning, and construct a supervised fine-tuning data set in combination with expert opinion data;

[0011] S4. Further fine-tune the large language model for power network security based on the supervised fine-tuning dataset to obtain a vertical model for abnormal access detection in the power network system.

[0012] Furthermore, in step S1, the specific process of preprocessing is as follows:

[0013] The TF-IDF method is used to extract topic keywords from the power network security corpus data, and the cosine similarity between the keywords and the power network security field is calculated. The data with a cosine similarity lower than the first set threshold are deleted, and the power network security corpus data is screened for the first time.

[0014] Regular expression methods are used to further remove corrupted, erroneous, and duplicate data.

[0015] Furthermore, in step S2, the large language base model is the InternLM2.5-7B model, and the pre-training framework is the XTuner pre-training framework.

[0016] Furthermore, in step S2, the power network security large language model obtained through pre-training is converted from the PTH model format to the Hugging Face model format.

[0017] Furthermore, the specific process of step S3 is as follows:

[0018] Extracting topic keywords from the pre-training data set using the TF-IDF method, calculating the cosine similarity between the topic keywords and the abnormal access behavior detection field of the power network system, deleting data with a cosine similarity lower than a second set threshold, and performing a secondary screening on the pre-training data set;

[0019] The data after secondary screening is input into the ERNIE4.0 large language model for corpus learning to generate questions and answers for abnormal access detection of power network system. The cosine similarity between the questions and answers and the expert opinion data is calculated, and the questions and answers with cosine similarity greater than the third set threshold are retained to construct a supervised fine-tuning dataset.

[0020] Furthermore, in step S3, general capability question-answering data is added to the supervised fine-tuning dataset.

[0021] Furthermore, deepspeed mixed precision training is used during pre-training and fine-tuning, and flash_attention is used to optimize memory access and calculation order.

[0022] Furthermore, during pre-training and fine-tuning, model parameters are adjusted based on a comprehensive metric constructed based on the cross entropy loss and the question-answering evaluation score.

[0023] The present invention also provides an electronic device, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the above method when executing the program.

[0024] The present invention also provides a computer-readable storage medium on which a computer program is stored, and the program implements the above method when executed by a processor.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The present invention proposes a method for detecting abnormal access to an electric power network system, which is implemented by a vertical model for detecting abnormal access to an electric power network system. The model is obtained in the following manner: first, the electric power network security corpus data is preprocessed to construct a pre-training data set, and the large language base model is pre-trained in the pre-training framework to obtain a large language model for power network security. The large language base model has a powerful ability to process massive and diversified data, detect complex attack patterns, and integrate multimodal data. The above steps can effectively capture latent or progressive attacks and unknown attacks, and improve the adaptability and generalization ability of the model; then, based on the task of detecting abnormal access to an electric power network system, the pre-training data set is secondary screened, a closed-source large language model is input for corpus learning, a supervised fine-tuning data set is constructed in combination with expert opinion data, and the large language model for power network security is fine-tuned to obtain a vertical model for detecting abnormal access to an electric power network system. The above steps can further improve the effectiveness and pertinence of the data, deeply explore the potential correlation of abnormal access behaviors, and enable the model to have higher sensitivity and accuracy when dealing with the specific task of detecting abnormal access to an electric power network system.

[0027] 2. In the present invention, the network security large language model obtained through pre-training is converted from the PTH model format to the Hugging Face model format, which facilitates the subsequent deployment and reasoning of the model using a variety of reasoning frameworks. At the same time, efficient storage and sharing of the model can be achieved.

[0028] 3. In the present invention, deepspeed mixed precision training is used during pre-training and fine-tuning to accelerate calculations, and flash_attention is used to optimize memory access and calculation order to improve the efficiency of self-attention calculations. The above settings can further solve the efficiency and memory usage problems in the training process of large language models. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Schematic diagram of the training process of the vertical classification model for abnormal access detection in power network systems. DETAILED DESCRIPTION

[0030] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0031] Example 1

[0032] This embodiment provides a method for detecting abnormal access to a power network system, comprising the following steps:

[0033] Acquire power network system data, including network traffic information, log information (such as network equipment logs, security detection equipment logs, business system logs) and user behavior information (such as user login behavior information, electricity purchase payment behavior information), input it into the power network system abnormal access detection vertical model, and output the power network system abnormal access detection results.

[0034] like Figure 1 As shown in the figure, the vertical classification model of abnormal access detection of power network system is obtained through the following steps:

[0035] S1. Obtain and preprocess the power network security corpus data to build a pre-training data set.

[0036] First, the power network security corpus data is collected from multiple sources, including but not limited to security books, security knowledge bases, security papers, security encyclopedias, codes, CVE data, vulnerability libraries, and community articles in the power field. In this embodiment, the distribution of the power network security corpus data sources is shown in Table 1.

[0037] Table 1 Distribution of power network security corpus data sources

[0038]

[0039] The specific process of preprocessing is as follows:

[0040] S101. Use the TF-IDF method to extract the top ten weighted words from the power network security corpus data as the subject keywords of the corpus data, such as power network, network security, abnormal access, etc., calculate the cosine similarity between the subject keywords and the "power network security" field, delete the data with a cosine similarity lower than a first set threshold, and perform a first screening of the power network security corpus data.

[0041] S102, using a regular expression method to further delete damaged, erroneous and duplicate data.

[0042] Subsequently, a pre-training data set is constructed according to the Alpaca format requirements. The pre-training data set constructed in this embodiment contains about 430,000 pieces of power network security content, totaling about 500 million tokens.

[0043] S2. Use the pre-training data set to pre-train the large language base model in the pre-training framework to obtain the power network security large language model.

[0044] The large language model has the powerful ability to process massive and diverse data, detect complex attack patterns, and integrate multimodal data. It can effectively make up for the shortcomings of traditional network abnormal access detection algorithms and has strong adaptability and generalization capabilities. In this embodiment, the InternLM2.5-7B model is selected as the large language base model, which has the advantages of good Chinese support and small memory resource usage; in the pre-training framework adapted to the InternLM series model, this embodiment selects XTuner as the pre-training framework.

[0045] First, select the InternLM2.5-7B supported by XTuner to perform pre-training config template, and modify some contents in the config, including model and dataset addresses, training methods (full, LoRA or QLoRA), and key training parameters. Continue pre-training based on the computing power configuration and pre-training dataset, use DeepSpeed ​​mixed precision training to accelerate calculations, and use Flash Attention to optimize memory access and calculation order to improve the efficiency of self-attention calculations, thereby further solving the efficiency and memory usage problems in the training process of large language models. During the pre-training process, adjust the model parameters based on comprehensive indicators. The comprehensive indicators are constructed based on cross entropy loss and question-answering evaluation scores. The best pre-training hyperparameter combination is shown in Table 2.

[0046] Table 2 Best hyperparameter combination for pre-training

[0047]

[0048] As a preferred implementation, the PTH model automatically saved after pre-training is completed is converted into the HuggingFace model format, so that the deployment and reasoning of the large language model can be supported by the subsequent use of reasoning frameworks such as Xinference.

[0049] S3. Based on the abnormal access detection task of the power network system, the pre-trained data set is screened again, the closed-source large language model is input for corpus learning, and the supervised fine-tuning data set is constructed in combination with the expert opinion data. The specific process is as follows:

[0050] S301. Similar to the pre-training process, the TF-IDF method is used to extract the top ten weighted words from the pre-training data set as topic keywords, and the cosine similarity between them and the field of "abnormal access behavior detection of power network system" is calculated. The data with cosine similarity lower than the second set threshold is deleted, and the pre-training data set is screened for the second time.

[0051] S302. Input the data after secondary screening into the ERNIE4.0 large language model for corpus learning, generate questions and answers for abnormal access detection of power network system, calculate its cosine similarity with the expert opinion data, retain the questions and answers with cosine similarity greater than the third set threshold, and construct a supervised fine-tuning dataset in alpaca format.

[0052] The ERNIE4.0 large language model is required to organize the learning results related to the detection of abnormal access behavior in the power network system in the form of questions and answers. To ensure the correctness of the learning results, this embodiment manually annotates the questions and answers through expert opinions, and further improves the quality of the data set through the method of "closed-source model learning + manual answer annotation".

[0053] In a preferred embodiment, some general ability question-answering data, such as self-cognition data and common sense knowledge data, are added to the supervised fine-tuning dataset. This measure can effectively prevent the occurrence of overfitting during training.

[0054] S4. Based on the supervised fine-tuning dataset, the large language model for power network security is further fine-tuned to obtain a vertical model for abnormal access detection in the power network system.

[0055] Similar to the pre-training process, the fine-tuning process adjusts the model parameters based on comprehensive indicators, uses DeepSpeed ​​mixed precision training, and uses Flash Attention to optimize memory access and calculation order. The optimal hyperparameters for supervised fine-tuning are shown in Table 3.

[0056] Table 3 Best hyperparameter combinations for supervised fine-tuning

[0057]

[0058] After obtaining the vertical model of abnormal access detection in the power network system, the Xinference reasoning framework is used to deploy it for fast reasoning, thereby effectively detecting abnormal access behavior in the power network system. The model can receive network traffic information, log data information, and user behavior information from the power network system as input, and rely on its powerful context understanding and logical reasoning capabilities to effectively analyze whether there are subtle abnormal access behavior patterns hidden in the information. In addition, the model can be required to format the detection results of abnormal access behavior through clear instructions, and further output reasonable countermeasures if abnormal access behavior exists.

[0059] For the abnormal access behavior detection task of the power network system, this embodiment prepared a 300-question test question and answer data set to evaluate the effect of the fine-tuned large model. Considering that the large model must not only accurately identify abnormal access behaviors in the abnormal access behavior detection task, but also propose reasonable countermeasures for abnormal access behaviors, accuracy and cosine similarity are used as indicators for evaluation. The results are shown in Table 4:

[0060] Table 4 Evaluation of power network abnormal access behavior detection task

[0061]

[0062]

[0063] It can be seen from Table 4 that the ability of the abnormal access detection vertical model of the power network system obtained by pre-training and fine-tuning using the method of the present invention to detect various complex abnormal access behaviors in a new network system with a large amount of multimodal data has been significantly improved.

[0064] Example 2

[0065] This embodiment provides an electronic device, including a memory and a processor, wherein the processor is used to execute a program stored in the memory, wherein the program includes a number of instructions and can execute all or part of the steps of the method described in Example 1. The memory includes a computer-readable storage medium, which can be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0066] The above description of the embodiments is to facilitate the understanding and use of the invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to these embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments, and improvements and modifications made by those skilled in the art based on the disclosure of the present invention without departing from the scope of the present invention should be within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal access to a power network system, characterized in that: The following steps are involved: Acquire power network system data, including network traffic information, log information and user behavior information, input the power network system abnormal access detection vertical model, and output the power network system abnormal access detection result; wherein, the power network system abnormal access detection vertical model is obtained by the following steps: S1. Obtain and preprocess the power network security corpus data to build a pre-training data set; S2. Pre-training the large language base model in a pre-training framework using the pre-training data set to obtain a large language model for power network security; S3. Perform secondary screening on the pre-trained data set based on the power network system abnormal access detection task, input the closed-source large language model for corpus learning, and construct a supervised fine-tuning data set in combination with expert opinion data; S4. Further fine-tune the large language model for power network security based on the supervised fine-tuning dataset to obtain a vertical model for abnormal access detection in the power network system.

2. A method for detecting abnormal access to a power network system according to claim 1, characterized in that: In step S1, the specific process of preprocessing is as follows: The TF-IDF method is used to extract topic keywords from the power network security corpus data, calculate their cosine similarity with the power network security field, delete the data with cosine similarity lower than the first set threshold, and perform the first screening of the power network security corpus data; Regular expression methods are used to further remove corrupted, erroneous, and duplicate data.

3. A method for detecting abnormal access to a power network system according to claim 1, characterized in that: In step S2, the large language base model is the InternLM2.5-7B model, and the pre-training framework is the XTuner pre-training framework.

4. A method for detecting abnormal access to a power network system according to claim 1, characterized in that: In step S2, the power network security large language model obtained through pre-training is converted from the PTH model format to the Hugging Face model format.

5. The method for detecting abnormal access to a power network system according to claim 1, characterized in that: The specific process of step S3 is as follows: Extracting topic keywords from the pre-training data set using the TF-IDF method, calculating the cosine similarity between the topic keywords and the abnormal access behavior detection field of the power network system, deleting data with a cosine similarity lower than a second set threshold, and performing a secondary screening on the pre-training data set; The data after secondary screening is input into the ERNIE4.0 large language model for corpus learning to generate questions and answers for abnormal access detection of power network system. The cosine similarity between the questions and answers and the expert opinion data is calculated, and the questions and answers with cosine similarity greater than the third set threshold are retained to construct a supervised fine-tuning dataset.

6. A method for detecting abnormal access to a power network system according to claim 1, characterized in that: In step S3, general capability question-answering data is added to the supervised fine-tuning dataset.

7. The method for detecting abnormal access to a power network system according to claim 1, characterized in that: During pre-training and fine-tuning, deepspeed mixed precision training is used, and flash_attention is used to optimize memory access and calculation order.

8. A method for detecting abnormal access to a power network system according to claim 1, characterized in that: During pre-training and fine-tuning, model parameters are adjusted based on a comprehensive metric constructed based on the cross-entropy loss and the question-answering evaluation score.

9. An electronic device comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images