A goose protocol message anomaly detection method based on a generative adversarial network model

Abstract

The application discloses a GOOSE protocol message anomaly detection method based on a generative adversarial network model, and a model training method thereof comprises the following steps: S1, a large amount of power industrial control system network data messages are acquired, and data preprocessing is performed, including denoising and data cleaning; S2, GOOSE data are subjected to feature extraction, including protocol field values, source / destination addresses, time stamps, state numbers, sequence numbers, AppID application identifiers, TAG identifier values and data lengths, so that a suitable feature set is established; and S3, the GOOSE protocol data feature set is subjected to training through a generative adversarial network model. During detection, model parameters and training are continuously adjusted according to a training discrimination result, and abnormal GOOSE protocol messages are analyzed and detected. The application can effectively detect existing GOOSE protocol network attacks, and provides a safe operation guarantee for a power industrial control network system.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control systems, and in particular to a GOOSE protocol message anomaly detection method based on a generative adversarial network model. Background Art

[0002] With the continuous development and widespread application of industrial control systems, the security of critical infrastructure, such as power manufacturing, has become increasingly important. Modern industrial control networks increasingly employ network-based communication protocols for real-time monitoring and control. The GOOSE protocol, part of the IEC61850 standard, is widely used for fast event message transmission in power systems. However, due to its high real-time nature and widespread deployment, the GOOSE protocol has become a potential target for cyber attackers.

[0003] Therefore, anomaly detection methods for the GOOSE protocol are crucial to improve the anomaly detection of the GOOSE protocol, ensure the robustness of the power system, and prevent potential threats. Summary of the Invention

[0004] The present invention mainly solves the technical problem of the lack of a GOOSE protocol message detection method in the prior art, and provides a GOOSE protocol message anomaly detection method based on a generative adversarial network model with high accuracy and reliability.

[0005] The present invention solves the above technical problems mainly through the following technical solutions: a GOOSE protocol message anomaly detection method based on a generative adversarial network model, including a model training process and a detection process, wherein the model training process is specifically as follows:

[0006] S1. Obtain historical data messages from the power industrial control system network and pre-process the historical data messages to ensure that the collected data is GOOSE protocol communication data;

[0007] S2, extract features from the pre-processed historical data messages and establish a GOOSE protocol data feature set;

[0008] S3. Use the GOOSE protocol data feature set to train a generative adversarial network model. Both the generator and discriminator of the generative adversarial network model contain a temporal model gated recurrent unit. The processing process of the generator is as follows:

[0009] The random noise vector input to the generator input layer is mapped into a latent vector representation, and then converted into an initial hidden state through the embedding layer or the fully connected layer. The initial hidden vector and the time series of the GOOSE protocol data feature set are then input into the generator gated recurrent unit layer. The generator gated recurrent unit layer generates the message features of the next moment based on the hidden state of the previous moment and the current input time series data. The message features generated by the generator gated recurrent unit layer are generated through the generator output layer to generate features similar to the real GOOSE message, while ensuring that the generated message has time series features;

[0010] The discriminator's processing process is as follows: a GOOSE message sequence is input into the discriminator input layer. The output of the discriminator input layer enters the discriminator gated recurrent unit layer. The discriminator gated recurrent unit layer captures the change pattern of message features in the sequence through the hidden state of each time step, and finally outputs a scalar value through the discriminator output layer, which represents the probability that the input message sequence is true. The discriminator can capture the change pattern of message features through the hidden state of each time step. The last hidden state indicates that the capture of the current message feature change pattern is complete (end), and finally outputs a value.

[0011] The input to the discriminator consists of a set of collected, authentic GOOSE protocol data features and a sequence of fake messages generated by the generator. The discriminator distinguishes the fake messages generated by the generator from the real message set. Through adversarial training, the fake message sequences generated by the generator using the GRU become increasingly realistic, with their timing features gradually approaching those of real GOOSE messages. The discriminator, on the other hand, uses the GRU to improve its ability to analyze time series and gradually optimize its ability to detect anomalies. Through continuous iterative model training, the two models compete against each other, ultimately training the generator to produce realistic message sequences while the discriminator accurately identifies anomalous messages.

[0012] This solution improves the generator and discriminator in the generative adversarial network model. The generator improvements incorporate a temporal model, the Gated Recurrent Unit (GRU), to account for temporal correlations when generating GOOSE messages. The generator not only generates single messages but also simulates the temporal data streams found in real networks, resulting in more realistic and normal GOOSE messages. This allows the model to better simulate normal communication behavior during training, improving the generator's generation quality. The generator's output layer is either a fully connected layer or a deconvolutional layer.

[0013] The discriminator's improvements incorporate time series features, processing a series of GOOSE messages through a gated recurrent unit (GRU) structure and identifying anomalies based on the overall sequence. This allows the discriminator to identify anomalies not only based on the characteristics of a single message, but also based on the changing patterns of messages over a period of time. For example, when StNum (status number) or SqNum (sequence number) experience abnormal jumps, the discriminator can capture these abnormal patterns. Through this time-dependent discrimination mechanism, the discriminator can better identify messages that appear normal on the surface but exhibit abnormal behavior over a period of time, thereby improving the accuracy of identifying abnormal GOOSE messages.

[0014] The generator generates a single message and a sequential data stream. The discriminator of the generative adversarial network also includes a sequential model gated recurrent unit. The discriminator determines anomalies based on the characteristics of a single message and the message change model.

[0015] The detection process is as follows: after continuously training the generator and discriminator in the generative adversarial network model, the GOOSE protocol message to be detected is input into the discriminator of the trained generative adversarial network model to obtain anomaly detection results.

[0016] The discriminator trained by the generative adversarial network model can set a normal threshold to identify normal GOOSE protocol messages. If the discriminator judges that the authenticity of the communication message is lower than the normal threshold, the GOOSE protocol message is marked as abnormal. Finally, the GOOSE protocol message marked as abnormal is stored and recorded to realize GOOSE protocol anomaly detection and recording.

[0017] The generator of the Generative Adversarial Network model not only generates single messages, but also generates sequential data streams that simulate real-world networks, thereby generating more realistic and normal GOOSE messages. This allows the model to better simulate normal communication behavior during training, improving the generator's generation quality.

[0018] The discriminator not only identifies anomalies based on the characteristics of individual messages, but also on patterns of message changes over time. For example, when StNum (status number) or SqNum (sequence number) experience unusual jumps, the discriminator can detect these abnormal patterns. This time-dependent discrimination mechanism allows the discriminator to better identify messages that appear normal on the surface but exhibit abnormal behavior over a period of time, thereby improving the accuracy of identifying abnormal GOOSE messages.

[0019] Preferably, in step S3, the loss function of the generator is:

[0020] ,

[0021] Where w i is the weight of the i-th field; (G(z)) i is the output of a specific field in the generated GOOSE message, E is the expectation of random noise z, that is, the average over all noise samples; z is random noise; pz is the probability distribution of random noise, and D is the discriminator;

[0022] The loss function of the discriminator is:

[0023] ,

[0024] In the formula, x is the real data sample, p data This is the actual message data distribution.

[0025] During training, the loss functions of the generator and discriminator are optimized, with a weighting mechanism for specific protocol features incorporated. The discriminator's threshold for normality is adjusted and determined based on the results and distribution of the generative adversarial network model's training data. If the discriminator's judgment of the authenticity of a communication message falls below the threshold, the GOOSE protocol message is marked as abnormal.

[0026] Preferably, a weighting mechanism based on specific protocol features is added to the loss function. Specifically, changes in the status and sequence number fields are given a higher abnormal weight. For example, all fields are initially weighted 1, while the weights for the status and sequence numbers can be set in the range of 3-5. This enables the GAN to more sensitively identify abnormal behavior during training. By optimizing this loss function, the model can better adapt to the complexity of the GOOSE protocol.

[0027] Preferably, in step S1, preprocessing the historical data message includes data denoising and data cleaning:

[0028] Data denoising: Check and analyze pcap (Packet Capture, a file containing the contents of captured protocol communication packets) data communication messages, filter them based on the GOOSE protocol flag Type 0x88b8, and analyze the filtered messages to see if they contain GOOSE protocol key fields, such as AppID (application identifier), StNum (state number), SqNum (sequence number), etc. Messages without these key fields are removed.

[0029] Data cleaning: After removing duplicate GOOSE protocol message information, invalid messages, abnormal messages and other noise data, the normal GOOSE protocol message data is saved.

[0030] Preferably, step S2 is specifically as follows:

[0031] Several fields of information in the pre-processed historical data packets are extracted as features. The field information includes the protocol field value of the data packet, source MAC address, destination address (multicast address), timestamp, AppID (application identifier), TAG identification value, StNum (state number), SqNum (sequence number) and data length. In the process of information extraction, the timestamp of the GOOSE protocol message is combined as a feature set.

[0032] The extracted features are combined with the timestamp of the corresponding message to establish the GOOSE protocol data feature set.

[0033] Preferably, the source of the historical data message of the power industrial control system network in step S1 is:

[0034] Use the Wireshark network packet capture tool to capture a large amount (more than 10,000) of GOOSE protocol and other communication data in the power industrial control system. The communication data covers GOOSE messages in different devices, states, and operation scenarios in the power industrial control system.

[0035] The substantial effect brought about by the present invention is: the present invention can provide effective anomaly detection for the GOOSE protocol in the power industrial control system, by collecting a large number of normal GOOSE protocol messages and performing feature extraction on the data, by generating an adversarial network model training data feature set, analyzing and detecting abnormal GOOSE protocol messages, accurately distinguishing normal messages from potential abnormal messages, reducing false alarm rate and missed alarm rate, increasing the accuracy of anomaly detection, and ensuring that the power industrial control system has accuracy and reliability in detecting anomalies of the GOOSE protocol.

[0036] This invention leverages the adaptive nature of the generative adversarial network model to continuously learn new normal behavior patterns, ensuring that the GOOSE communication protocol anomaly detection dynamically adjusts to changes in the power industry control network environment. This not only provides a new technical approach for protecting power industry control networks, but also provides a strong guarantee for the security and reliability of critical infrastructure. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a training flowchart of a generative adversarial network model of the present invention. DETAILED DESCRIPTION

[0038] The technical solution of the present invention will be further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0039] Example: This embodiment is a GOOSE protocol message anomaly detection method based on a generative adversarial network model, including a model training process and a detection process. Figure 1 As shown in the figure, the model training process includes the following steps:

[0040] Step 1: Obtain a large number of network data packets from the power industrial control system and pre-process the data to ensure that the collected data is GOOSE protocol communication data;

[0041] This embodiment uses the Wireshark network packet capture tool to capture a large amount of GOOSE protocol and other communication data in the power industrial control system. This data should cover GOOSE messages in different devices, states, and operation scenarios in the power industrial control system.

[0042] Data preprocessing includes data denoising and data cleaning:

[0043] (1) Data denoising: Check and analyze the pcap data communication messages, filter them according to the GOOSE protocol flag Type 0x88b8, and analyze the GOOSE protocol key fields after filtering, such as AppID (application identifier), StNum (status number), SqNum (serial number), etc., to ensure that the collected data are GOOSE protocol communication messages.

[0044] (2) Data cleaning: After removing duplicate GOOSE protocol message information, invalid messages, abnormal messages and other noise data, the normal GOOSE protocol message data is saved.

[0045] Step 2: Extract features from GOOSE data, including protocol field value, source MAC address, destination address (multicast address), timestamp, AppID (application identifier), TAG identifier value, StNum (state number), SqNum (sequence number), and data length, to establish a suitable feature set;

[0046] Multiple fields of information from the filtered GOOSE protocol data are extracted as features. These fields include the packet's protocol field value, source MAC address, destination address (multicast address), AppID (application identifier), TAG identifier value, StNum (state number), SqNum (sequence number), and data length. GOOSE protocol messages are highly temporal, providing the generator and discriminator with richer protocol field and time series features. Incorporating the timestamps of GOOSE protocol messages as a feature set during information extraction allows the GAN model to better capture temporal patterns in normal communication messages, thereby improving the model's ability to identify abnormal behavior.

[0047] A normal feature set is established based on the features extracted from the GOOSE protocol field information.

[0048] Step 3: Train the GOOSE protocol data feature set through the generative adversarial network model;

[0049] A generative adversarial network (GAN) deep learning training model was selected, and the normal GOOSE protocol data feature set was put into the model for training. Through iterative training, the improved generator and discriminator in the model competed with each other. The messages generated by the generator became more and more like real GOOSE messages, while the discriminator became better at detecting abnormal GOOSE messages. The abnormal message information identified by the discriminator was recorded and stored.

[0050] This solution improves the generator and discriminator in the generative adversarial network model:

[0051] In the generator improvements, a timing model, the Gated Recurrent Unit (GRU), was introduced to the generator, allowing it to take into account temporal correlation when generating GOOSE messages. The generator not only generates single messages but also simulates the temporal data streams found in real networks, thereby generating more realistic and normal GOOSE messages. This enables the model to better simulate normal communication behavior during training, improving the generator's generation quality.

[0052] Input: The generator's input consists of a random noise vector and a time series of feature sets. This random noise is mapped into a latent vector representation. The randomness of the noise vector helps the generator generate different message sequences, but the GRU maintains continuity between messages in the time dimension, ensuring that the generated messages conform to the normal pattern of the GOOSE protocol.

[0053] Embedding layer or fully connected layer: The random noise vector is converted into an initial hidden state through the embedding layer or fully connected layer, which serves as the input of the GRU layer.

[0054] GRU layer: A GRU layer is added to the generator to process time series data. The GRU generates a series of time-dependent GOOSE message sequences based on the initial hidden state and time step of the input. Each GRU unit generates the message features for the next moment based on the hidden state at the previous moment and the current input time series data.

[0055] Output layer: The output of the GRU layer passes through a fully connected layer or a deconvolution layer to generate features similar to real GOOSE messages (such as AppID, SqNum, StNum, and other fields), while ensuring that the generated messages have time series characteristics.

[0056] Time series message generation: The generator generates GOOSE messages at multiple moments through GRU. The fields such as SqNum and StNum between messages will increase in order according to the change of time steps.

[0057] The input to the discriminator includes the collected real GOOSE protocol data feature set and the fake message sequence generated by the generator; the discriminator is used to distinguish the fake messages generated by the generator from the real feature set messages. Through continuous iterative model training, the generator and the discriminator compete with each other, ultimately ensuring that the discriminator can correctly identify normal GOOSE protocol message data.

[0058] The discriminator's improvements incorporate time series features, processing a series of GOOSE messages through a gated recurrent unit (GRU) structure and identifying anomalies based on the overall sequence. This allows the discriminator to identify anomalies not only based on the characteristics of a single message, but also based on the changing patterns of messages over a period of time. For example, when StNum (status number) or SqNum (sequence number) experience abnormal jumps, the discriminator can capture these abnormal patterns. Through this time-dependent discrimination mechanism, the discriminator can better identify messages that appear normal on the surface but exhibit abnormal behavior over a period of time, thereby improving the accuracy of identifying abnormal GOOSE messages.

[0059] Input: The discriminator receives a GOOSE message sequence as input. Each sequence contains message data of multiple time steps. Each message data includes multiple features, such as AppID, timestamp, SqNum, StNum, etc.

[0060] GRU layer: The GRU layer of the discriminator is responsible for processing the entire message sequence. Through the hidden state of each time step, it captures the changing pattern of message features in the sequence. For example, the GRU can capture the continuous increase of SqNum or the abnormal jump of StNum.

[0061] Output layer: The last hidden state of the GRU outputs a scalar value through the fully connected layer. This value represents the probability that the input message sequence is true. If this value is lower than the set threshold, the message sequence is considered abnormal.

[0062] The discriminator doesn't judge individual messages individually, but rather based its judgment on the message change patterns of the entire time series. For example, in the GOOSE protocol, if SqNum or StNum experience abnormal jumps, the discriminator's GRU layer will capture these abnormal time-related patterns. The GRU can learn normal timing features from normal message sequences, such as message sending intervals and the orderly increase of sequence numbers. Abnormal message sequences often exhibit anomalies in these features (such as discontinuous SqNum or inconsistent sending intervals), which are captured by the GRU and passed to the discriminator's output layer.

[0063] Step 4: Continuously adjust model parameters and training based on the training and discrimination results, and analyze and detect abnormal GOOSE protocol messages.

[0064] We optimized the loss functions of the generator and discriminator, incorporating a weighting mechanism for specific protocol features. For example, changes in the StNum (state number) and SqNum (sequence number) fields are given higher anomaly weights. This enables the GAN to more sensitively identify abnormal behavior during training. This optimized loss function allows the model to better adapt to the complexity of the GOOSE protocol.

[0065] In the loss function, a weighting mechanism can be introduced for specific protocol fields such as StNum (state number) and SqNum (sequence number), so that the generator pays more attention to the correctness of generating these fields, and the discriminator is also more sensitive to anomalies in these fields.

[0066] Define a weighted cross entropy loss, the improved generator loss function:

[0067] ,

[0068] where w i is the weight of the i-th field; (G(z)) i It is the output of a specific field in the generated GOOSE message.

[0069] Similarly, the loss function of the discriminator can also be weighted and optimized for specific fields, so that the discriminator pays more attention to key fields when judging whether the generated message is true. The improved discriminator loss function is:

[0070] ,

[0071] By assigning higher weights to key fields, the generator and discriminator can pay more attention to the temporal changes of fields such as SqNum and StNum in GOOSE messages, thereby generating and detecting anomalies more accurately.

[0072] During the detection process, the normal threshold of the discriminator is adjusted and determined based on the results and distribution of the generative adversarial network (GAN) model training data. If the discriminator judges the authenticity of the communication message as lower than the normal threshold, the GOOSE protocol message is marked as abnormal.

[0073] The specific embodiments described herein are merely illustrative of the spirit of the present invention. Persons skilled in the art may make various modifications, additions, or substitutions to the described specific embodiments without departing from the spirit of the present invention or exceeding the scope of the appended claims.

[0074] Although this document frequently uses terms such as datagram and gated recurrent unit, the use of other terms is not excluded. These terms are used solely to more conveniently describe and explain the essence of the present invention; interpreting them as any additional limitations is contrary to the spirit of the present invention.

Claims

1. A GOOSE protocol message anomaly detection method based on a generative adversarial network model, characterized in that: It includes model training process and detection process. The model training process is specifically as follows: S1. Obtain historical data messages from the power industrial control system network and pre-process the historical data messages; S2, extract features from the pre-processed historical data messages and establish a GOOSE protocol data feature set; S3. Use the GOOSE protocol data feature set to train a generative adversarial network model. Both the generator and discriminator of the generative adversarial network model contain a temporal model gated recurrent unit. The processing process of the generator is as follows: The random noise vector input to the generator input layer is mapped into a latent vector representation, and then converted into an initial hidden state through the embedding layer or the fully connected layer. The initial hidden vector and the time series of the GOOSE protocol data feature set are then input into the generator gated recurrent unit layer. The generator gated recurrent unit layer generates the message features of the next moment based on the hidden state of the previous moment and the current input time series data. The message features generated by the generator gated recurrent unit layer are generated through the generator output layer to generate features similar to the real GOOSE message, while ensuring that the generated message has time series features; The discriminator's processing process is as follows: a GOOSE message sequence is input into the discriminator input layer. The output of the discriminator input layer enters the discriminator gated recurrent unit layer. The discriminator gated recurrent unit layer captures the changing pattern of message features in the sequence through the hidden state of each time step, and finally outputs a scalar value through the discriminator output layer. The scalar value output by the discriminator output layer represents the probability that the input message sequence is true; The input to the discriminator includes the collected real GOOSE protocol data feature set and the fake message sequence generated by the generator; The detection process is as follows: after continuously training the generator and discriminator in the generative adversarial network model, the GOOSE protocol message to be detected is input into the discriminator of the trained generative adversarial network model to obtain anomaly detection results.

2. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1, characterized in that: In step S3, the loss function of the generator is: ， Where w i is the weight of the i-th field; (G(z)) i is the output of a specific field in the generated GOOSE message, E is the expectation of random noise z, that is, the average over all noise samples; z is random noise; p z is the probability distribution of random noise, D is the discriminator; The loss function of the discriminator is: ， In the formula, x is the real data sample, p data This is the actual message data distribution.

3. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1 or 2, characterized in that, In step S1, the historical data messages are preprocessed including data denoising and data cleaning: Data denoising: Check and analyze pcap data communication messages, filter them based on the GOOSE protocol flag Type 0x88b8, and analyze the filtered messages to see if they contain GOOSE protocol key fields. Messages without key fields will be removed. Data cleaning: Remove duplicate GOOSE protocol message information, invalid messages, and abnormal messages, and save normal GOOSE protocol message data.

4. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1, characterized in that: Step S2 is specifically as follows: Extract several fields of information from the pre-processed historical data packets as features, including the protocol field value, source MAC address, destination address, timestamp, application identifier, TAG identifier value, status number, sequence number, and data length of the data packet; in the process of information extraction, combine the timestamp of the GOOSE protocol packet as a feature set, The extracted features are combined with the timestamp of the corresponding message to establish the GOOSE protocol data feature set.

5. A GOOSE protocol message anomaly detection method based on a generative adversarial network model according to claim 1, characterized in that: The source of the historical data message of the power industrial control system network in step S1 is: Using the Wireshark network packet capture tool, we captured more than 10,000 GOOSE protocol and other communication data in the power industrial control system. The communication data covers GOOSE messages in different devices, states, and operating scenarios in the power industrial control system.

Images