Monitoring system remote regulation signal locking and unlocking method based on user behavior analysis

Abstract

The invention provides a monitoring system remote regulation signal locking and unlocking method based on user behavior analysis, and the unlocking method comprises the steps: carrying out the real-time analysis of a user operation behavior through employing a long and short-term memory network algorithm; processing is carried out through the processes of user behavior data collection, data preprocessing, LSM model training, fuzzy logic classification, signal locking and unlocking, model updating and the like, the operation authority of a remote regulation signal is dynamically judged, user operation behaviors are automatically recognized and judged, locking and unlocking of the remote regulation signal are controlled, unauthorized remote regulation signal operation is effectively avoided, and the operation efficiency is improved. The system is prevented from being influenced by hostile attacks or operations, and meanwhile, when abnormal conditions are detected, automatic unlocking can be carried out after secondary verification, so that the influence caused by misoperation is reduced; the system continuously learns user behaviors, optimizes the model and adapts to different operation habits during operation, and the automatic locking and unlocking mechanism reduces human intervention, improves the operation efficiency of the system and guarantees the operation safety of the transformer substation.

Description

Technical Field

[0001] The present invention relates to the technical field of power system monitoring and control, and in particular to a monitoring system remote control signal locking and unlocking method based on user behavior analysis. Background Art

[0002] In modern power systems, remote control signals are the core part of achieving system control and remote management. With the development of intelligent power systems, remote operation is increasingly widely used in power systems. However, the frequent operation and remote control of remote control signals have brought new safety hazards, especially the user's misoperation or malicious behavior may cause system abnormalities. The existing technology mainly relies on fixed authority settings or static user verification methods, which is difficult to adapt to the ever-changing user behavior patterns, and the real-time monitoring and analysis capabilities of complex operating behaviors are insufficient, resulting in difficulty in effectively distinguishing normal from abnormal behaviors. For this reason, the applicant proposes a remote control signal locking and unlocking method for a monitoring system based on user behavior analysis according to the management needs of remote control signals of power systems, and conducts real-time analysis of user operating behaviors to determine whether the remote control signal should be locked or unlocked to ensure the safe and stable operation of the power system. Summary of the invention

[0003] To solve the above technical problems, the present invention proposes a remote control signal locking and unlocking method for a monitoring system based on user behavior analysis. The method uses a long short-term memory network algorithm to perform real-time analysis on user operation behaviors, collects user behavior data, and processes the data through data preprocessing, LSM model training, fuzzy logic classification, signal locking and unlocking, and model updating. The method dynamically determines the operation authority of the remote control signal, automatically identifies and determines the user's operation behavior, controls the locking and unlocking of the remote control signal, effectively avoids unauthorized remote control signal operations, prevents the system from being affected by malicious attacks or operations, improves the system operation efficiency, and ensures the safe operation of the substation.

[0004] To achieve the above object, the technical solution adopted by the present invention is:

[0005] A monitoring system remote control signal locking and unlocking method based on user behavior analysis, characterized in that: the monitoring system remote control signal locking and unlocking method based on user behavior analysis uses a long short-term memory network algorithm to perform real-time analysis on user operation behavior, dynamically judge the operation authority of the remote control signal, automatically identify and judge the user operation behavior, control the locking and unlocking of the remote control signal, effectively avoid unauthorized remote control signal operation, and prevent the system from being affected by malicious attacks or operations; the specific steps are:

[0006] Step 1: User behavior data collection: the system collects user operation behavior data in real time through input devices, including operation frequency, click path, command input and other information;

[0007] Step 2: Data preprocessing: normalize and reduce noise on the collected behavior data to ensure the stability and reliability of the input data;

[0008] Step 3: LSTM model training: Use the processed behavior data to train the LSTM model, learn the behavior pattern of each user, establish multiple user behavior models, and distinguish the behavior patterns of ordinary users and administrators.

[0009] Step 4: Fuzzy logic classification: The system classifies user operation behaviors into three categories: normal, abnormal, or critical. For abnormal signals between 0.3 and 0.7, the system uses fuzzy logic for further analysis, combining up and down behaviors and historical behaviors to determine whether to take blocking measures.

[0010] Step 5: Signal locking and unlocking: When abnormal user behavior is detected, the system automatically locks the remote control signal; after verification, if the user passes multi-factor verification, the system unlocks the signal and allows continued operation;

[0011] Step 6: Model update and optimization: Model update is the key to ensure the long-term effectiveness of the user behavior analysis system. Through real-time feedback and regular updates, the system enables the model to continuously adapt to changes in user operation behavior and achieve its optimization.

[0012] Furthermore, the LSTM model training in step 3 of the monitoring system remote control signal locking and unlocking method based on user behavior analysis is specifically as follows:

[0013] 1) LSTM structure: At time step t, input the user's behavior data X t and the hidden state H at the previous moment t-1 and memory unit C t-1 , update the current hidden state H through the LSTM unit t and memory unit C t ;

[0014] Forget Gate F t : Control to forget the information of the previous moment:

[0015] F t =σ(W f ·[H t-1 , X t ]+B f )

[0016] Input I t : Control the proportion of the current signal written into the memory unit:

[0017] I t =σ(W i·[H t-1 , X t ]+B i )

[0018] Candidate memory cells

[0019]

[0020] Memory unit update C t : Combine the forget gate and the input gate to update the memory:

[0021]

[0022] Output Gate O t : Control the output of the hidden state:

[0023] O t =σ(W o ·[H t-1 , X t ]+B t )

[0024] The final output hidden state H t :

[0025] H t =O t tanh(C t )

[0026] 2) Training process: The LSTM model is trained by back propagation and gradient descent, with the goal of minimizing the following loss function:

[0027]

[0028] Where: Y t a label indicating the actual behavior, normal or abnormal;

[0029] P t is the output probability of the model;

[0030] 3) Calculate the probability of abnormality; the trained LSTM model is used to monitor user behavior in real time. At each time step t, the system converts the current operation data X t Input into the LSTM model and output the abnormal score P of the current behavior t , and its calculation formula is:

[0031] P t =σ(W t ·H t +B p ).

[0032] Furthermore, in the step 4 of the fuzzy logic classification of the remote control signal locking and unlocking method of the monitoring system based on user behavior analysis, fuzzy processing is performed and the signal is classified into three categories: "low risk", "medium risk" and "high risk"; according to the fuzzy classification results, the system takes corresponding decisions; low-risk anomalies only issue warnings, and the system temporarily locks the signal in the case of medium-risk anomalies, and requires the user to pass further verification; high-risk anomalies immediately lock the signal to prevent any unauthorized operation; fuzzy logic converts uncertain abnormal signals into clear classifications and locking decisions through fuzzy input, fuzzy inference rules, and defuzzification operations, thereby providing flexible safety control and avoiding unnecessary operations due to misclassification.

[0033] The benefits of this application are:

[0034] 1. The remote control signal locking and unlocking method of the monitoring system based on user behavior analysis has good adaptability, can automatically optimize, continuously learn user behavior, optimize the model, and adapt to different operating habits;

[0035] 2. The manufacturing cost of the remote control signal locking and unlocking method of the monitoring system based on user behavior analysis is small and controllable;

[0036] 3. The remote control signal locking and unlocking method of the monitoring system based on user behavior analysis can reduce human intervention, improve system operation efficiency, and effectively reduce operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a schematic diagram of the working process of the present invention;

[0038] Figure 2 Schematic diagram of the electrical LSTM model of the present invention. DETAILED DESCRIPTION

[0039] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments:

[0040] like Figure 1-2 As shown, a monitoring system remote control signal locking and unlocking method based on user behavior analysis is shown. The monitoring system remote control signal locking and unlocking method based on user behavior analysis uses a long short-term memory network algorithm to analyze user operation behavior in real time, dynamically determine the operation authority of the remote control signal, automatically identify and determine the user operation behavior, control the locking and unlocking of the remote control signal, effectively avoid unauthorized remote control signal operation, and prevent the system from being affected by malicious attacks or operations; the specific steps are:

[0041] Step 1: User behavior data collection. The system collects user operation behavior data in real time through input devices, including operation frequency, click path, command input and other information; the operation frequency is the frequency of user clicks or input commands per second; the operation sequence is the sequence and path of user access to system functions; the command input is the specific command and parameter value entered by the user's keyboard. These data are precisely synchronized through the NTP server to ensure that the time point of each operation is accurately recorded, so that the subsequent algorithm can analyze the time dependency of the operation sequence;

[0042] Step 2: Data preprocessing: normalize and denoise the collected behavior data to ensure the stability and reliability of the input data. Normalization is to standardize data from different sources so that they fall into a unified interval (such as [0, 1]) to avoid interference of different dimensions on algorithm model training. Noise reduction is to remove noise data such as invalid clicks, repeated operations or erroneous operations of users, and retain effective operation behavior characteristics.

[0043] Step 3: LSTM model training: Use the processed behavior data to train the LSTM model, learn the behavior pattern of each user, establish multiple user behavior models, and distinguish the behavior patterns of ordinary users and administrators. The specific steps are as follows:

[0044] 1) LSTM structure: At time step t, input the user's behavior data X t and the hidden state H at the previous moment t-1 and memory unit C t-1 , update the current hidden state H through the LSTM unit t and memory unit C t ;

[0045] Forget Gate F t : Control to forget the information of the previous moment:

[0046] F t =σ(W f ·[H t-1 , X t ]+B f )

[0047] Input I t : Control the proportion of the current signal written into the memory unit:

[0048] I t =σ(W i ·[H t-1 , X t ]+B i )

[0049] Candidate memory cells

[0050]

[0051] Memory unit update C t : Combine the forget gate and the input gate to update the memory:

[0052]

[0053] Output Gate O t : Control the output of the hidden state:

[0054] O t =σ(W o ·[H t-1 , X t ]+B t )

[0055] The final output hidden state H t :

[0056] H t =O t tanh(C t )

[0057] 2) Training process: The LSTM model is trained by back propagation and gradient descent, with the goal of minimizing the following loss function:

[0058]

[0059] Where: Y t a label indicating the actual behavior, normal or abnormal;

[0060] P t is the output probability of the model;

[0061] 3) Calculate the probability of abnormality; the trained LSTM model is used to monitor user behavior in real time. At each time step t, the system converts the current operation data X t Input into the LSTM model and output the abnormal score P of the current behavior t , and its calculation formula is:

[0062] P t =σ(W t ·H t +B p )

[0063] Step 4: Fuzzy logic classification; the system divides user operation behaviors into three categories: normal, abnormal or critical. For abnormal signals between 0.3 and 0.7, the system uses fuzzy logic for further analysis, combining the upper and lower behaviors and historical behaviors to determine whether to take blocking measures; when fuzzification is performed in fuzzy logic classification, it is classified into three categories: "low risk", "medium risk" and "high risk"; according to the fuzzy classification results, the system takes corresponding decisions; low-risk anomalies only issue warnings, and the system temporarily blocks the signal for medium-risk anomalies and requires the user to pass further verification; high-risk anomalies immediately block the signal to prevent any unauthorized operations; fuzzy logic converts uncertain abnormal signals into clear classifications and blocking decisions through fuzzy input, fuzzy inference rules, and defuzzification operations, thereby providing flexible security control and avoiding unnecessary operations caused by misclassification;

[0064] Step 5: Signal locking and unlocking; when abnormal user behavior is detected, the system automatically locks the remote control signal; after verification, if the user passes multi-factor verification, the system unlocks the signal and allows continued operation; it is based on the system's real-time monitoring and classification decisions on abnormal user behavior. When abnormal behavior triggers medium- and high-risk locks, the system immediately locks the remote control signal to prevent potential threat operations; after locking, the system will record the abnormal behavior and the reason for the lock for subsequent review; to unlock the signal, the system passes multi-factor verification, including identity authentication, behavior history review, and external risk assessment; users need to pass additional verification, such as fingerprint recognition or two-factor authentication, and the system will compare the current operation with the historical behavior pattern to ensure security; through these steps, if the verification is successful, the system will automatically unlock and resume the signal operation, and record the unlocking process to improve security and reduce unnecessary manual intervention;

[0065] Step 6: Model update and optimization; Model update is the key link to ensure the long-term effectiveness of the user behavior analysis system; the system enables the model to continuously adapt to changes in user operation behavior through real-time feedback and regular updates; the update adopts a strategy that combines incremental learning and batch updates, which can not only adjust the weights in real time to maintain adaptability to the latest behavior, but also periodically collect large batches of data for training to ensure the global accuracy of the model; the update of the LSTM model is reflected in the weight adjustment of the forget gate and memory cells; the new input data is processed by the following formula:

[0066] F t =σ(W f ·[H t-1 , X t ]+B f )

[0067]

[0068] Where: W f is the forget gate weight;

[0069] C t is the updated memory state;

[0070] The system dynamically adapts to changes in user behavior by adjusting these parameters. At the same time, the system regularly performs accuracy tests and monitors behavior changes to ensure the long-term effectiveness of the model. This update mechanism improves the system's adaptability and accuracy, ensuring the safety and reliability of signal locking and unlocking operations.

[0071] The above description is only a preferred embodiment of the present invention and does not constitute any other form of limitation to the present invention. Any modification or equivalent change made based on the technical essence of the present invention still falls within the scope of protection required by the present invention.

Claims

1. A monitoring system remote control signal locking and unlocking method based on user behavior analysis, characterized in that: The monitoring system remote control signal locking and unlocking method based on user behavior analysis uses a long short-term memory network algorithm to analyze user operation behavior in real time, dynamically judge the operation authority of the remote control signal, automatically identify and judge the user operation behavior, control the locking and unlocking of the remote control signal, effectively avoid unauthorized remote control signal operation, and prevent the system from being affected by malicious attacks or operations; the specific steps are: Step 1: User behavior data collection: the system collects user operation behavior data in real time through input devices, including operation frequency, click path, command input and other information; Step 2: Data preprocessing; Normalize and reduce noise on the collected behavioral data to ensure the stability and reliability of the input data; Step 3: LSTM model training: Use the processed behavior data to train the LSTM model, learn the behavior pattern of each user, establish multiple user behavior models, and distinguish the behavior patterns of ordinary users and administrators. Step 4: Fuzzy logic classification: The system classifies user operation behaviors into three categories: normal, abnormal, or critical. For abnormal signals between 0.3 and 0.7, the system uses fuzzy logic for further analysis, combining up and down behaviors and historical behaviors to determine whether to take blocking measures. Step 5: Signal locking and unlocking: When abnormal user behavior is detected, the system automatically locks the remote control signal; after verification, if the user passes multi-factor verification, the system unlocks the signal and allows continued operation; Step 6: Model update and optimization: Model update is the key to ensure the long-term effectiveness of the user behavior analysis system. Through real-time feedback and regular updates, the system enables the model to continuously adapt to changes in user operation behavior and achieve its optimization.

2. According to claim 1, a monitoring system remote control signal locking and unlocking method based on user behavior analysis is characterized in that: The LSTM model training in step 3 of the monitoring system remote control signal locking and unlocking method based on user behavior analysis is specifically as follows: 1) LSTM structure: At time step t, input the user's behavior data X t and the hidden state h at the previous moment t-1 and memory unit C t-1 , update the current hidden state h through the LSTM unit t and memory unit C t ; Forget Gate F t : Control to forget the information of the previous moment: F t =σ(W f ·[h t-1 ,X t ]+B f ) Input I t : Control the proportion of the current signal written into the memory unit: I t =σ(W i ·[H t-1 ,X t ]+B i ) Candidate memory cells Memory unit update C t : Combine the forget gate and the input gate to update the memory: Output Gate O t : Control the output of the hidden state: The t =σ(W o ·[H t-1 ,X t ]+B t ) The final output hidden state H t : H t =O t ·tanh(C t ) 2) Training process: The LSTM model is trained by back propagation and gradient descent, with the goal of minimizing the following loss function: Where: Y t a label indicating the actual behavior, normal or abnormal; P t is the output probability of the model; 3) Calculate the probability of abnormality; the trained LSTM model is used to monitor user behavior in real time. At each time step t, the system converts the current operation data X t Input into the LSTM model and output the abnormal score P of the current behavior t , and its calculation formula is: P t =σ(W t ·H t +B p )。 3. The method for locking and unlocking remote control signals of a monitoring system based on user behavior analysis according to claim 1 is characterized in that: In the step 4 of the method for locking and unlocking remote control signals of a monitoring system based on user behavior analysis, when fuzzy processing is performed in the fuzzy logic classification, it is classified into three categories: "low risk", "medium risk" and "high risk"; according to the fuzzy classification results, the system takes corresponding decisions; low-risk anomalies only issue warnings, and the system temporarily locks the signal in the case of medium-risk anomalies, and requires the user to pass further verification; high-risk anomalies immediately lock the signal to prevent any unauthorized operation; fuzzy logic converts uncertain abnormal signals into clear classifications and locking decisions through fuzzy input, fuzzy inference rules, and defuzzification operations, thereby providing flexible safety control and avoiding unnecessary operations caused by misclassification.

Images