A method, device and medium for detecting abnormal access in a power network system

Abstract

This invention relates to a method, device, and medium for detecting abnormal access in power network systems, comprising the following steps: acquiring power network system data, inputting it into a vertical classification model for detecting abnormal access in power network systems, and outputting abnormal access detection results; the vertical classification model for detecting abnormal access in power network systems is obtained through the following steps: S1, acquiring and preprocessing power network security corpus data to construct a pre-training dataset; S2, pre-training a large language foundation model to obtain a large language model for power network security; S3, performing secondary screening on the pre-training dataset based on the power network system abnormal access detection task, and constructing a supervised fine-tuning dataset by combining expert opinion data; S4, fine-tuning the large language model for power network security to obtain the vertical classification model for detecting abnormal access in power network systems. Compared with existing technologies, this invention can improve the ability to accurately detect various abnormal access behaviors in novel network systems with large amounts of multimodal data.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method, device and medium for detecting abnormal access to a power network system. Background Technology

[0002] Effective detection of abnormal access behavior is a key component of improving the security performance of network systems. According to the current research status at home and abroad, existing abnormal access detection methods have many problems. On the one hand, rule-based detection systems can only detect known attack patterns and are powerless against new or unknown attacks. On the other hand, as the heterogeneity and complexity of data in new network systems increase, the difficulty of updating manually designed features and rules will also increase. These problems will make it difficult for models to cope with the rapidly changing security threats in new network systems.

[0003] Specifically, in the process of detecting abnormal access to network systems, traditional mathematical models or machine learning methods are often based on known attack patterns and are severely inadequate in dealing with new types of attacks, such as zero-day attacks. This leads to problems such as insufficient coverage and performance bottlenecks in existing abnormal behavior detection models, increasing the security risks of network systems. Chinese patent application 201911349630.9 proposes a modeling method and defect detection method for website application security defects. It obtains a security defect sample set by using access log samples and alarm log samples obtained from pre-set access information flow samples, and then trains a security defect detection model using a deep learning algorithm. During detection, access information flow data and access log information are input, and the model's output determines whether the current access behavior triggers an abnormal access behavior that indicates a security defect. This exposes unknown security defects that cannot be detected through source code comparison, solving the technical problem that existing network security defect detection methods can only detect known security defects. However, with the development of smart grids and the energy internet, existing methods still struggle to process and analyze large-scale heterogeneous multimodal data such as operation logs and sensor data (e.g., equipment operation data and grid status data) for new network systems such as power grid systems. Therefore, it is necessary to design an abnormal access detection method for power network systems to further improve the ability to accurately detect various complex abnormal access behaviors in new network systems with a large amount of multimodal data. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art by providing a method, device, and medium for detecting abnormal access in power network systems, thereby further improving the ability to accurately detect various complex abnormal access behaviors in new power network systems with a large amount of multimodal data.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] This invention provides a method for detecting abnormal access in a power network system, comprising the following steps:

[0007] Data from the power network system, including network traffic information, log information, and user behavior information, is acquired, input into a vertical model for detecting abnormal access to the power network system, and the results of abnormal access to the power network system are output. The vertical model for detecting abnormal access to the power network system is obtained through the following steps:

[0008] S1. Obtain and preprocess power network security corpus data to construct a pre-training dataset;

[0009] S2. Using the pre-trained dataset, pre-train the large language base model in the pre-training framework to obtain a large language model for power network security.

[0010] S3. Based on the abnormal access detection task of the power network system, the pre-trained dataset is screened again, input into the closed-source large language model for corpus learning, and a supervised fine-tuning dataset is constructed by combining expert opinion data.

[0011] S4. Based on the supervised fine-tuning dataset, further fine-tune the large language model for power network security to obtain a vertical model for abnormal access detection in power network systems.

[0012] Furthermore, in step S1, the specific preprocessing procedure is as follows:

[0013] The topic keywords were extracted from the power network security corpus data using the TF-IDF method, and their cosine similarity with the power network security field was calculated. Data with a cosine similarity lower than a first set threshold were deleted to perform the first screening of the power network security corpus data.

[0014] Use regular expressions to further remove corrupt, erroneous, and duplicate data.

[0015] Furthermore, in step S2, the large language base model is the InternLM2.5-7B model, and the pre-training framework is the XTuner pre-training framework.

[0016] Furthermore, in step S2, the power network security big language model obtained through pre-training is converted from the PTH model format to the Hugging Face model format.

[0017] Furthermore, the specific process of step S3 is as follows:

[0018] The topic keywords are extracted from the pre-training dataset using the TF-IDF method, and their cosine similarity with the abnormal access behavior detection field of the power network system is calculated. Data with a cosine similarity lower than a second set threshold are deleted, and the pre-training dataset is screened a second time.

[0019] The data after secondary screening is input into the ERNIE4.0 large language model for corpus learning to generate abnormal access detection questions and answers for power network systems. The cosine similarity between the questions and answers is calculated and the cosine similarity is retained if it is greater than a third set threshold, thus constructing a supervised fine-tuning dataset.

[0020] Furthermore, in step S3, general capability question-and-answer data is added to the supervised fine-tuning dataset.

[0021] Furthermore, during pre-training and fine-tuning, deepspeed mixed-precision training is used, and flash_attention is used to optimize memory access and computation order.

[0022] Furthermore, during pre-training and fine-tuning, the model parameters are adjusted based on a comprehensive index, which is constructed based on cross-entropy loss and question-answering evaluation scores.

[0023] The present invention also provides an electronic device, including a memory, a processor, and a program stored in the memory, wherein the processor executes the program to implement the above-described method.

[0024] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. This invention proposes a method for detecting abnormal access in power network systems, implemented through a vertical model for detecting abnormal access in power network systems. This model is obtained as follows: First, the power network security corpus data is preprocessed to construct a pre-training dataset. A large language foundation model is then pre-trained within this pre-training framework to obtain a large language model for power network security. This large language foundation model possesses powerful capabilities for handling massive and diverse data, detecting complex attack patterns, and fusing multimodal data. These steps effectively capture latent or progressive attacks as well as unknown attacks, improving the model's adaptability and generalization ability. Then, based on the power network system abnormal access detection task, the pre-training dataset is further filtered and input into the closed-source large language model for corpus learning. A supervised fine-tuning dataset is constructed by combining expert opinion data, and the power network security large language model is fine-tuned to obtain a vertical model for detecting abnormal access in power network systems. These steps further enhance the effectiveness and relevance of the data, deeply explore the potential correlations of abnormal access behaviors, and enable the model to have higher sensitivity and accuracy when handling the specific task of detecting abnormal access in power network systems.

[0027] 2. In this invention, the network security big language model obtained through pre-training is converted from PTH model format to Hugging Face model format, which facilitates the subsequent deployment and inference of the model using various inference frameworks. At the same time, it can realize the efficient storage and sharing of the model.

[0028] 3. In this invention, deepspeed mixed precision training is used during pre-training and fine-tuning to accelerate computation, and flash_attention is used to optimize memory access and computation order to improve the efficiency of self-attention computation. The above settings can further solve the efficiency and memory usage problems in the training of large language models. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the training process for a vertical model for detecting abnormal access in a power network system. Detailed Implementation

[0030] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. These embodiments are based on the technical solution of the present invention and provide detailed implementation methods and specific operating procedures. However, the scope of protection of the present invention is not limited to the following embodiments.

[0031] Example 1

[0032] This embodiment provides a method for detecting abnormal access in a power network system, including the following steps:

[0033] Acquire data from the power network system, including network traffic information, log information (such as network device logs, security detection device logs, and business system logs), and user behavior information (such as user login behavior information and electricity purchase payment behavior information). Input these data into the power network system abnormal access detection vertical model and output the power network system abnormal access detection results.

[0034] like Figure 1 As shown, the vertical model for abnormal access detection in power network systems is obtained through the following steps:

[0035] S1. Obtain and preprocess power network security corpus data to construct a pre-training dataset.

[0036] First, power network security corpus data is collected from multiple sources, including but not limited to security books, security knowledge bases, security papers, security encyclopedias, code, CVE data, vulnerability databases, and community articles in the power field. In this embodiment, the distribution of power network security corpus data sources is shown in Table 1.

[0037] Table 1. Distribution of Data Sources for Power Network Security Corpus

[0038]

[0039] The specific preprocessing process is as follows:

[0040] S101. Using the TF-IDF method, extract the top ten weighted word segments from the power network security corpus data as the subject keywords of the corpus data, such as power network, network security, abnormal access, etc. Calculate the cosine similarity between the subject keywords and the "power network security" field, delete data with a cosine similarity lower than the first set threshold, and perform the first screening of the power network security corpus data.

[0041] S102. Use regular expressions to further remove corrupt, erroneous, and duplicate data.

[0042] Subsequently, a pre-training dataset was constructed according to the alpaca format requirements. In this embodiment, the pre-training dataset contains approximately 430,000 pieces of power network security content, totaling approximately 500 million tokens.

[0043] S2. Using the pre-trained dataset, pre-train the large language base model in the pre-training framework to obtain the large language model for power network security.

[0044] Large language models possess powerful capabilities for processing massive and diverse data, detecting complex attack patterns, and fusing multimodal data. They can effectively compensate for the shortcomings of traditional network anomaly detection algorithms and exhibit strong adaptability and generalization ability. In this embodiment, the InternLM2.5-7B model is selected as the large language base model, which has advantages such as good Chinese support and low GPU memory consumption. Among the pre-training frameworks adapted to the InternLM series models, this embodiment selects XTuner as the pre-training framework.

[0045] First, the InternLM2.5-7B pre-training config template supported by XTuner was selected, and some contents in the config were modified, including the model and dataset addresses, training mode (full, LoRA, or QLoRA), and key training parameters. Pre-training continued based on the computing power configuration and the pre-training dataset. DeepSpeed ​​mixed-precision training was used to accelerate computation, and Flash Attention was used to optimize memory access and computation order to improve the efficiency of self-attention computation, thereby further addressing the efficiency and memory consumption issues in the training of large language models. During pre-training, model parameters were adjusted based on comprehensive metrics, which were constructed based on cross-entropy loss and question-answering evaluation scores. The optimal hyperparameter combination for pre-training is shown in Table 2.

[0046] Table 2 Optimal Hyperparameter Combinations for Pre-training

[0047]

[0048] As a preferred implementation, the PTH model, which is automatically saved after pre-training, is converted into the HuggingFace model format so that it can be used with inference frameworks such as Xinference to support the deployment and inference of the large language model.

[0049] S3. Based on the abnormal access detection task of the power network system, the pre-trained dataset is further filtered and input into the closed-source large language model for corpus learning. A supervised fine-tuning dataset is constructed by combining expert opinion data. The specific process is as follows:

[0050] S301. Similar to the pre-training process, the top ten weighted word segments are extracted from the pre-training dataset using the TF-IDF method as topic keywords. The cosine similarity between these keywords and the "detection of abnormal access behavior in power grid systems" field is calculated. Data with a cosine similarity lower than the second set threshold is deleted, and the pre-training dataset is screened a second time.

[0051] S302. Input the data after secondary screening into the ERNIE4.0 large language model for corpus learning, generate power network system abnormal access detection questions and answers, calculate the cosine similarity between the questions and answers and the expert opinion data, retain the questions and answers with a cosine similarity greater than the third set threshold, and construct a supervised fine-tuning dataset in alpaca format.

[0052] The ERNIE 4.0 large language model is required to organize the learning results related to the detection of abnormal access behavior in power grid systems in the form of questions and answers. To ensure the correctness of the learning results, this embodiment uses expert opinions to manually annotate the questions and answers, and further improves the quality of the dataset by using the method of "closed-source model learning + manual answer annotation".

[0053] In a preferred embodiment, some general ability question-and-answer data, such as self-awareness data and common sense knowledge, are added to the supervised fine-tuning dataset. This measure can effectively prevent overfitting during training.

[0054] S4. Based on the supervised fine-tuning dataset, further fine-tune the large language model for power network security to obtain a vertical model for abnormal access detection in power network systems.

[0055] Similar to the pre-training process, the model parameters are adjusted based on comprehensive metrics during fine-tuning. DeepSpeed ​​mixed-precision training is used, and Flash Attention is used to optimize memory access and computation order. The specific details of supervised fine-tuning of the optimal hyperparameters are shown in Table 3.

[0056] Table 3 Optimal Hyperparameter Combinations for Monitored Fine-Tuning

[0057]

[0058] After obtaining the vertical model for detecting abnormal access in power network systems, it is deployed using the Xinference inference framework for rapid inference, thereby effectively detecting abnormal access behavior in power network systems. The model receives network traffic information, log data, and user behavior information from the power network system as input, relying on its powerful context understanding and logical reasoning capabilities to effectively analyze whether subtle abnormal access behavior patterns are hidden within the information. Furthermore, explicit instructions can be given to the model to output the detection results of abnormal access behavior in a formatted manner; if abnormal access behavior is found, appropriate countermeasures will be output.

[0059] For the task of detecting abnormal access behavior in power grid systems, this embodiment prepared a test question-and-answer dataset of 300 lines to evaluate the performance of the fine-tuned large model. Considering that the large model not only needs to accurately identify abnormal access behavior in the abnormal access behavior detection task, but also needs to propose reasonable countermeasures for abnormal access behavior, accuracy and cosine similarity were used as evaluation indicators. The results are shown in Table 4:

[0060] Table 4 Evaluation of Power Network Abnormal Access Behavior Detection Task

[0061]

[0062]

[0063] As can be seen from Table 4, the ability of the power network system abnormal access detection vertical model obtained by the method of the present invention, namely through pre-training and fine-tuning, to detect various complex abnormal access behaviors in new network systems with a large amount of multimodal data has been significantly improved.

[0064] Example 2

[0065] This embodiment provides an electronic device, including a memory and a processor. The processor executes a program stored in the memory, the program including several instructions that can perform all or part of the steps of the method described in Embodiment 1. The memory includes a computer-readable storage medium, specifically a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, or any other medium capable of storing program code.

[0066] The above description of the embodiments is provided to enable those skilled in the art to understand and use the invention. It will be apparent to those skilled in the art that various modifications can be made to these embodiments, and the general principles described herein can be applied to other embodiments without inventive effort. Therefore, the present invention is not limited to the above embodiments, and any improvements and modifications made by those skilled in the art based on the disclosure of the present invention without departing from the scope of the invention should be within the protection scope of the present invention.

Claims

1. A method for detecting abnormal access in a power network system, characterized in that, Includes the following steps: Data from the power network system, including network traffic information, log information, and user behavior information, is acquired, input into a vertical model for detecting abnormal access to the power network system, and the results of abnormal access to the power network system are output. The vertical model for detecting abnormal access to the power network system is obtained through the following steps: S1. Obtain and preprocess power network security corpus data to construct a pre-training dataset. The specific preprocessing process is as follows: The topic keywords were extracted from the power network security corpus data using the TF-IDF method, and their cosine similarity with the power network security field was calculated. Data with a cosine similarity lower than a first set threshold were deleted to perform the first screening of the power network security corpus data. Use regular expressions to further remove corrupt, erroneous, and duplicate data; S2. Using the pre-trained dataset, pre-train the large language base model in the pre-training framework to obtain a large language model for power network security. S3. Based on the abnormal access detection task of the power network system, the pre-trained dataset is further filtered, input into the closed-source large language model for corpus learning, and a supervised fine-tuning dataset is constructed by combining expert opinion data. The specific process is as follows: The topic keywords are extracted from the pre-training dataset using the TF-IDF method, and their cosine similarity with the abnormal access behavior detection field of the power network system is calculated. Data with a cosine similarity lower than a second set threshold are deleted, and the pre-training dataset is screened a second time. The data after secondary screening is input into the ERNIE4.0 large language model for corpus learning, generating questions and answers for abnormal access detection in power grid systems. The cosine similarity between the questions and answers and the expert opinion data is calculated. Questions and answers with a cosine similarity greater than a third set threshold are retained to construct a supervised fine-tuning dataset. S4. Based on the supervised fine-tuning dataset, further fine-tune the large language model for power network security to obtain a vertical model for abnormal access detection in power network systems.

2. The method for detecting abnormal access in a power network system according to claim 1, characterized in that, In step S2, the large language base model is the InternLM2.5-7B model, and the pre-training framework is the XTuner pre-training framework.

3. The method for detecting abnormal access in a power network system according to claim 1, characterized in that, In step S2, the power network security big language model obtained through pre-training is converted from PTH model format to Hugging Face model format.

4. The method for detecting abnormal access in a power network system according to claim 1, characterized in that, In step S3, general capability question-and-answer data is added to the supervised fine-tuning dataset.

5. The method for detecting abnormal access in a power network system according to claim 1, characterized in that, During pre-training and fine-tuning, Deepspeed mixed-precision training is used, and Flash Attention is used to optimize memory access and computation order.

6. The method for detecting abnormal access in a power network system according to claim 1, characterized in that, During pre-training and fine-tuning, the model parameters are adjusted based on a comprehensive metric constructed from cross-entropy loss and question-answering evaluation scores.

7. An electronic device comprising a memory, a processor, and a program stored in the memory, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1-6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-6.

Images