New energy station network intrusion intelligent detection and active defense system

Abstract

The invention provides a new energy station network intrusion intelligent detection and active defense system, and relates to the field, and the system comprises an operation parameter obtaining unit which is used for collecting the parameter information of new energy station equipment, and constructing a digital twin model of a new energy station; acquiring operation data of new energy station equipment through the digital twinborn model of the new energy station; the inversion model construction unit is used for extracting characteristic parameters based on a clustering algorithm and a contour coefficient method and constructing a parameter inversion model of the new energy station; the intrusion detection and defense unit is used for acquiring real-time operation parameters of the new energy station equipment, identifying abnormal modes in the operation parameters and detecting network intrusion behaviors; and simulating the defense strategy through the digital twin model, and determining and executing a final defense strategy according to a simulation result. Simulation verification is carried out through the digital twin model, the effectiveness and feasibility of the selected strategy are ensured, and the response speed and defense capability of the system are greatly improved.

Description

Technical Field

[0001] The present invention relates to the field of network security for new energy stations, and in particular to an intelligent detection and active defense system for network intrusion in new energy stations. Background Art

[0002] As the large-scale development and grid-connected utilization of new energy sources such as photovoltaics and wind power become a trend, it is particularly important to build new energy control centers to achieve remote monitoring and regional management. However, these control centers usually adopt unattended mode, and new energy stations are mostly located in remote areas. Outdoor protection equipment is scattered and has limited protection capabilities, which makes the network security of the power grid face severe challenges. During the operation of new energy stations, it is necessary not only to monitor the operating status of the equipment in real time, but also to respond quickly and protect against possible network intrusions, but the existing technology still has obvious deficiencies in this area.

[0003] The current network intrusion detection system is often independent of the equipment operation monitoring system and fails to achieve deep integration with the equipment operation data, resulting in low detection accuracy and poor abnormal pattern recognition, making it difficult to provide timely warnings and protection against complex network attacks. At the same time, traditional defense strategies mainly rely on experience judgment and lack scientific evaluation and optimization mechanisms. This approach is not only difficult to predict the defense effect, but may also lead to unreasonable resource allocation and low protection efficiency.

[0004] Currently, no effective solution has been proposed for the problems in the related technologies. Summary of the invention

[0005] In view of this, the present invention provides a new energy station network intrusion intelligent detection and active defense system to solve the above-mentioned problems.

[0006] In order to solve the above problems, the specific technical solutions adopted by the present invention are as follows:

[0007] A new energy station network intrusion intelligent detection and active defense system, the system comprises: an operation parameter acquisition unit, an inversion model construction unit and an intrusion detection and defense unit;

[0008] An operating parameter acquisition unit is used to collect parameter information of new energy station equipment, build a digital twin model of the new energy station using digital twin technology, and obtain operating data of the new energy station equipment through the digital twin model of the new energy station;

[0009] An inversion model building unit is used to extract characteristic parameters from the operating data of new energy station equipment based on clustering algorithm and silhouette coefficient method, and to build a parameter inversion model of the new energy station by optimizing the neural network structure through random search;

[0010] The intrusion detection and defense unit is used to obtain the real-time operating parameters of new energy station equipment, use the parameter inversion model to identify abnormal patterns in the operating parameters and detect network intrusion behavior; determine the defense strategy based on the detection results, simulate the defense strategy through the digital twin model, and determine and execute the final defense strategy based on the simulation results.

[0011] Preferably, the operating parameter acquisition unit includes: an attribute data acquisition module, a digital twin model construction module and an operating data acquisition module;

[0012] The attribute data acquisition module is used to obtain the physical layer data, network layer data and environmental data of the new energy station equipment; and determine the relationship between each device and its function based on the physical layer data, network layer data and environmental data;

[0013] The digital twin model building module is used to build a digital twin model of a new energy station based on the relationship between various devices and their functions, using 3D modeling tools and digital twin technology;

[0014] The operation data acquisition module is used to input the physical layer data, network layer data and environmental data of the new energy station equipment into the digital twin model, dynamically update the digital twin model through real-time data synchronization technology; and use the updated digital twin model to obtain the operation data of the new energy station equipment.

[0015] Preferably, the inversion model construction unit includes: a similarity matrix construction module, a characteristic parameter extraction module and a network structure construction optimization module;

[0016] The similarity matrix construction module is used to normalize the operation data of the new energy station equipment, calculate the similarity between the operation data using the Gaussian kernel function, and construct the similarity matrix based on the similarity calculation results;

[0017] The feature parameter extraction module is used to construct a standardized Laplace matrix based on the similarity matrix; select the number of clusters through the spectral clustering method and the silhouette coefficient method to extract the feature parameters of the operating data of the new energy station equipment;

[0018] The network structure construction optimization module is used to construct a fully connected neural network structure based on the extracted characteristic parameters, and use the random search method to optimize the neural network structure to obtain the parameter inversion model of the new energy station.

[0019] Preferably, the operation data of the new energy station equipment is normalized, and the similarity between the operation data is calculated using a Gaussian kernel function, and a similarity matrix is ​​constructed according to the similarity calculation results, including:

[0020] The operation data of the new energy station equipment is normalized by using the normalization method, and the mean value of the distance between each operation data and other operation data is calculated based on the normalized operation data of the new energy station equipment;

[0021] The coefficient of variation between the running data is calculated according to the mean of the distance between each running data and other running data, and the inverse of the coefficient of variation is used as the scale parameter of the Gaussian kernel function;

[0022] According to the scale parameter of the Gaussian kernel function, the Gaussian kernel function is used to calculate the similarity between the running data, and a similarity matrix is ​​constructed based on the similarity calculation results.

[0023] Preferably, the calculation formula for calculating the coefficient of variation between the running data according to the mean of the distance between each running data and other running data is:

[0024]

[0025] In the formula, G i represents the coefficient of variation between the i-th running data;

[0026] m i Represents the mean distance from the i-th running data to other running data;

[0027] n represents the number of running data;

[0028] x i Represents the normalized value of the i-th running data;

[0029] x j Represents the normalized value of the j-th running data;

[0030] d(x i ,x j ) represents the Euclidean distance from the i-th running data to the j-th running data.

[0031] Preferably, based on the similarity matrix, a standardized Laplace matrix is ​​constructed; the number of clusters is selected by spectral clustering method and silhouette coefficient method, and the characteristic parameters of the operation data of the new energy station equipment are extracted, including:

[0032] The degree matrix is ​​calculated through the similarity matrix, and the standardized Laplace matrix is ​​constructed by using the degree matrix and the similarity matrix, and the eigenvalues ​​and eigenvectors of the Laplace matrix are calculated;

[0033] Select the eigenvectors corresponding to the minimum eigenvalues ​​of the normalized Laplace matrix, and use the spectral clustering method to cluster the eigenvectors to obtain preliminary clustering results;

[0034] The silhouette coefficient method is used to evaluate the clustering effects of different cluster numbers, and the cluster number with the largest silhouette coefficient is selected as the optimal cluster number;

[0035] According to the clustering results of the optimal number of clusters, the samples closest to each cluster center are extracted as feature parameters to form the feature set of new energy station equipment operation data.

[0036] Preferably, a fully connected neural network structure is constructed based on the extracted characteristic parameters, and the neural network structure is optimized by a random search method to obtain a parameter inversion model of a new energy station, including:

[0037] Based on the feature set of the new energy station equipment operation data, the number of input layer nodes of the neural network is determined, and the number of hidden layers and the number of nodes in each layer of the neural network are preliminarily set to obtain a fully connected neural network structure;

[0038] According to the preset hyperparameter search space, the random search method is used to optimize the number of hidden layers, the number of nodes in each layer, and the learning rate;

[0039] The extracted feature parameters are divided into a training set and a validation set. The fully connected neural network structure is trained using the training set, the mean square error is used as the loss function, and the network weights are adjusted using the stochastic gradient descent algorithm.

[0040] The validation set is used to verify the performance of the trained fully connected neural network structure. The fully connected neural network structure with the best performance is selected according to the performance verification results, and the optimal fully connected neural network structure is used as the parameter inversion model of the new energy station.

[0041] Preferably, the intrusion detection and defense unit includes: an abnormal pattern recognition module, a network intrusion detection module, a defense strategy selection module and a defense strategy implementation module;

[0042] The abnormal pattern recognition module is used to input the acquired real-time operating parameters of the new energy station equipment into the parameter inversion model to generate the inversion results of the operating status of the new energy station equipment; and identify the abnormal patterns in the operating parameters according to the inversion results;

[0043] The network intrusion detection module is used to perform intrusion detection on the network traffic data of the new energy station based on abnormal patterns in the operating parameters and identify network intrusion behaviors;

[0044] A defense strategy selection module is used to select a preliminary defense strategy set from a pre-set defense strategy library based on the abnormal mode of operating parameters and the network intrusion detection results;

[0045] The defense strategy implementation module is used to use the digital twin model to simulate and test each defense strategy in the preliminary defense strategy set, evaluate the defense effect of each defense strategy on the operation of new energy stations, select the optimal defense strategy based on the evaluation results, and implement it in the new energy station.

[0046] Preferably, the real-time operating parameters of the acquired new energy station equipment are input into a parameter inversion model to generate an inversion result of the operating status of the new energy station equipment; and identifying abnormal modes in the operating parameters according to the inversion result includes:

[0047] Collect historical operating data of new energy station equipment, and use tangent angle theory to calculate the normal operating status benchmark range of new energy station equipment;

[0048] Input the acquired real-time operating parameters of the new energy station equipment into the parameter inversion model to generate the inversion results of the operating status, and calculate the deviation value of each operating parameter from the normal operating status benchmark range according to the inversion results;

[0049] According to the deviation values ​​of various operating parameters from the normal operating state benchmark, the deviation analysis method is used to identify abnormal patterns in the inversion results.

[0050] Preferably, the historical operation data of the new energy station equipment is collected, and the normal operation state benchmark range of the new energy station equipment is calculated using the tangent angle theory, including:

[0051] Normalize the historical operation data of the new energy station equipment and determine the timestamp information corresponding to the historical operation data;

[0052] Based on the normalized historical operation data, identify the constant speed operation stage of the new energy station equipment, calculate the average change rate of the constant speed operation stage, and mark the time period corresponding to the constant speed operation stage;

[0053] According to the average rate of change in the constant speed operation stage, the equipment operation data is converted into the time dimension, a time conversion curve is constructed, and the tangent angle of the time conversion curve is calculated to obtain the tangent angle time series;

[0054] The calculation formula for the tangent angle of the time conversion curve is:

[0055]

[0056] In the formula, α r represents the tangent angle;

[0057] t r Represents the timestamp of the current time point r;

[0058] t r-1 Indicates the timestamp of the current time point r-1;

[0059] T(r) represents the ordinate value of the time conversion curve at time point r;

[0060] T(r-1) represents the ordinate value of the time conversion curve at time point r-1;

[0061] According to the tangent angle time series, the distribution characteristics of the tangent angle are analyzed, and the reference range of normal operating status is calculated using statistical analysis methods.

[0062] The beneficial effects of the present invention are:

[0063] 1. The present invention uses digital twin technology to construct a digital model that is highly consistent with the physical station, which can grasp the operating status of the station equipment in real time and accurately, providing a solid foundation for subsequent analysis and decision-making. Through clustering algorithm and silhouette coefficient method, key feature parameters are extracted from massive operating data, and then the neural network structure is optimized by random search to construct an efficient and accurate parameter inversion model, which not only improves the accuracy and efficiency of data analysis, but also enables the system to more accurately identify abnormal status of equipment and network intrusion behavior, and quickly identify abnormal patterns through parameter inversion model, so as to timely discover network intrusion behavior, and intelligently determine defense strategies according to detection results, and perform simulation verification through digital twin model to ensure the effectiveness and feasibility of the selected strategy, greatly enhancing the response speed and defense capability of the system.

[0064] 2. The present invention obtains an accurate similarity matrix by normalizing the operating data and calculating the Gaussian kernel function, which provides a reliable basis for subsequent clustering analysis and feature extraction. The optimal number of clusters is selected by using the spectral clustering method and the silhouette coefficient method, and the characteristic parameters of the operating data are extracted, thereby improving the efficiency and accuracy of data analysis. The clustering effects of different numbers of clusters are evaluated by the silhouette coefficient method, and the number of clusters with the largest silhouette coefficient is selected as the optimal number of clusters, thereby improving the accuracy and stability of clustering analysis. The number of hidden layers, the number of nodes in each layer, and the learning rate of the neural network are optimized by the random search method, thereby obtaining a neural network structure with optimal performance, thereby improving the accuracy and generalization ability of the parameter inversion model.

[0065] 3. The present invention inverts the real-time operating parameters through the parameter inversion model, can accurately generate the inversion results of the equipment operating status, and then identify the abnormal patterns in the operating parameters. Based on the abnormal patterns in the operating parameters, intrusion detection is performed on the network traffic data, which can accurately identify network intrusion behaviors, help to timely discover and respond to network attacks, and ensure the network security of new energy sites. The digital twin model is used to simulate and test the preliminary defense strategy, evaluate its defense effect, and select the optimal defense strategy for implementation based on the evaluation results, ensuring the feasibility and effectiveness of the defense strategy in practical applications and reducing misoperation and risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0067] Figure 1 It is a principle block diagram of a new energy station network intrusion intelligent detection and active defense system according to an embodiment of the present invention.

[0068] In the figure:

[0069] 1. Operation parameter acquisition unit; 2. Inversion model construction unit; 3. Intrusion detection and defense unit. DETAILED DESCRIPTION

[0070] In order to enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0071] According to an embodiment of the present invention, a new energy station network intrusion intelligent detection and active defense system is provided.

[0072] The present invention is further described with reference to the accompanying drawings and specific embodiments. Figure 1 - As shown, according to the new energy station network intrusion intelligent detection and active defense system of the embodiment of the present invention, the system includes: an operation parameter acquisition unit 1, an inversion model construction unit 2 and an intrusion detection and defense unit 3;

[0073] An operating parameter acquisition unit 1 is used to collect parameter information of new energy station equipment, build a digital twin model of the new energy station using digital twin technology, and obtain operating data of the new energy station equipment through the digital twin model of the new energy station;

[0074] As a preferred embodiment, the operation parameter acquisition unit 1 includes: an attribute data acquisition module, a digital twin model construction module and an operation data acquisition module;

[0075] The attribute data acquisition module is used to obtain the physical layer data, network layer data and environmental data of the new energy station equipment; and determine the relationship between each device and its function based on the physical layer data, network layer data and environmental data;

[0076] It should be noted that the physical layer data mainly involves the actual operating status of new energy station equipment, such as the speed, temperature, power output of the generator, the charging and discharging status of the energy storage equipment, and the electrical parameters of equipment such as transformers and switches. These data are usually collected in real time through sensors, instruments or monitoring systems, and may include both analog and digital types.

[0077] Network layer data involves all aspects of internal network communications within the site, including network traffic, packet type, source address, destination address, communication protocol, etc. These data are crucial for detecting network anomalies and identifying potential network attacks because they can reveal communication patterns and potential security vulnerabilities between devices.

[0078] Environmental data includes the natural environmental conditions of the site, such as temperature, humidity, wind speed, wind direction, solar radiation intensity, etc., as well as external factors that may affect equipment operation, such as lightning activity, earthquakes, etc. These data are of great significance for evaluating the safety of the equipment operating environment and predicting the risk of equipment failure.

[0079] Among them, based on the physical layer data, the physical connection relationship of the equipment is determined (such as the connection relationship between the wind turbine and the inverter, and the transformer and the power grid).

[0080] Based on the network layer data, a device communication relationship diagram is constructed (such as the transmission path between nodes and the communication delay relationship).

[0081] Based on environmental data, analyze the correlation between the equipment operating status and the external environment (such as the relationship between wind speed and fan output power).

[0082] Specifically, the functional role of the device is defined through device attribute information and topological relationships:

[0083] For example: the wind turbine is responsible for wind energy conversion, the inverter is responsible for DC to AC conversion, and the transformer is responsible for voltage regulation.

[0084] Based on the network layer data, define the communication function of the device:

[0085] For example: a controller is responsible for coordinating the operation of a fan group, and a switch is responsible for data forwarding.

[0086] Based on the environment data, determine whether the device operating environment supports or limits its functions:

[0087] For example: The power generation capacity of photovoltaic panels is affected by the intensity of light.

[0088] The digital twin model building module is used to build a digital twin model of a new energy station based on the relationship between various devices and their functions, using 3D modeling tools and digital twin technology;

[0089] Specifically, the 3D modeling tools suitable for new energy sites include:

[0090] Autodesk Revit: Supports the creation of architectural, electrical, and environmental models.

[0091] Unity or Unreal Engine: used to create 3D scenes with real-time interactivity.

[0092] MATLAB Simulink+Simscape: used to simulate physical models of new energy systems.

[0093] Among them, the three-dimensional coordinates and spatial layout of the equipment are determined according to the geographic information of the site.

[0094] For example: the arrangement of photovoltaic panels and the distribution of wind towers.

[0095] Assign physical attributes (e.g., size, capacity, efficiency) and functional attributes (e.g., input and output power, operating mode) to each device.

[0096] Build a 3D model of the site based on the physical relationship and layout between devices:

[0097] Wind tower: Draw the tower structure and the rotation characteristics of the wind turbine blades.

[0098] Photovoltaic modules: simulate the angle and arrangement of photovoltaic panels.

[0099] Electrical system: connecting inverters, transformers and distribution networks.

[0100] The operation data acquisition module is used to input the physical layer data, network layer data and environmental data of the new energy station equipment into the digital twin model, dynamically update the digital twin model through real-time data synchronization technology; and use the updated digital twin model to obtain the operation data of the new energy station equipment.

[0101] Specifically, dynamically updating the model using real-time data synchronization technology includes the following steps:

[0102] Real-time data synchronization technology is used to dynamically adjust the operating status and parameters in the digital twin model. For example, when the wind speed increases, the power generation of the wind turbine in the digital twin model changes in real time.

[0103] Simulate the operating status, equipment failure or abnormal conditions of the equipment under different environmental conditions;

[0104] For example: the output power of a wind turbine at different wind speeds, or the power generation of a photovoltaic module at different light intensities; the impact of an inverter failure on the overall output.

[0105] Real-time data and simulation results are visualized through three-dimensional models. For example, the operating status of the equipment (such as current, voltage, and power) can be dynamically displayed to show the overall power generation and operating efficiency of the site.

[0106] By inputting physical layer, network layer and environmental data into the digital twin model and dynamically updating the model status using real-time data synchronization technology, the real-time operation of new energy station equipment can be accurately reflected. The digital twin model can not only monitor the equipment status in real time, but also be used for trend prediction, fault diagnosis and optimization control, providing strong technical support for the efficient and safe operation of the station.

[0107] The inversion model building unit 2 is used to extract characteristic parameters from the operation data of the new energy station equipment based on the clustering algorithm and the silhouette coefficient method, and to build a parameter inversion model of the new energy station by optimizing the neural network structure through random search;

[0108] As a preferred embodiment, the inversion model construction unit 2 includes: a similarity matrix construction module, a characteristic parameter extraction module and a network structure construction optimization module;

[0109] The similarity matrix construction module is used to normalize the operation data of the new energy station equipment, calculate the similarity between the operation data using the Gaussian kernel function, and construct the similarity matrix based on the similarity calculation results;

[0110] As a preferred implementation, the operation data of the new energy station equipment is normalized, and the similarity between the operation data is calculated using a Gaussian kernel function. The similarity matrix is ​​constructed according to the similarity calculation results, including:

[0111] The operation data of the new energy station equipment is normalized by using the normalization method, and the mean value of the distance between each operation data and other operation data is calculated based on the normalized operation data of the new energy station equipment;

[0112] Specifically, normalization can eliminate the scale differences between data of different dimensions, so that the data can be compared on the same scale, which helps to improve the accuracy and efficiency of subsequent calculations. The commonly used normalization method is Min-Max normalization.

[0113] Among them, calculating the mean of the distance from each data point to other data points includes:

[0114] Assume there are n data points, denoted as x1, x2, …, x n .

[0115] For each data point x i , calculate its Euclidean distance d(x i ,x j ).

[0116] Calculate for each data point x i The mean distance to other data points is calculated as:

[0117]

[0118] The coefficient of variation between the running data is calculated according to the mean of the distance between each running data and other running data, and the inverse of the coefficient of variation is used as the scale parameter of the Gaussian kernel function;

[0119] As a preferred implementation, the formula for calculating the coefficient of variation between the operating data according to the mean of the distance between each operating data and other operating data is:

[0120]

[0121] In the formula, G i represents the coefficient of variation between the i-th running data; m i represents the mean distance from the ith running data to other running data; n represents the number of running data; x i represents the normalized value of the i-th running data; x j represents the normalized value of the jth running data; d(x i ,x j ) represents the Euclidean distance from the i-th running data to the j-th running data.

[0122] According to the scale parameter of the Gaussian kernel function, the Gaussian kernel function is used to calculate the similarity between the running data, and a similarity matrix is ​​constructed based on the similarity calculation results.

[0123] Specifically, the formula for calculating the similarity between running data using the Gaussian kernel function is:

[0124]

[0125] In the formula, A ij represents the similarity between the i-th running data and the j-th running data, h i represents the scale parameter of the Gaussian kernel function of the ith running data, h j represents the scale parameter of the Gaussian kernel function for the jth run data.

[0126] The feature parameter extraction module is used to construct a standardized Laplace matrix based on the similarity matrix; select the number of clusters through the spectral clustering method and the silhouette coefficient method to extract the feature parameters of the operating data of the new energy station equipment;

[0127] As a preferred implementation, based on the similarity matrix, a standardized Laplace matrix is ​​constructed; the number of clusters is selected by the spectral clustering method and the silhouette coefficient method, and the characteristic parameters of the operation data of the new energy station equipment are extracted, including:

[0128] The degree matrix is ​​calculated through the similarity matrix, and the standardized Laplace matrix is ​​constructed by using the degree matrix and the similarity matrix, and the eigenvalues ​​and eigenvectors of the Laplace matrix are calculated;

[0129] It should be noted that the degree matrix D is a diagonal matrix, and its diagonal elements represent the degree of each node (i.e., the sum of similarities with other nodes).

[0130] The definition of the unnormalized Laplace matrix L is: L=DA, where A represents the similarity matrix.

[0131] Normalized Laplace matrix L norm The definition of L is: norm =D -1 / 2 AD -1 / 2 .

[0132] For the normalized Laplace matrix L norm , whose eigenvalues ​​and eigenvectors satisfy:

[0133] L norm v=λv

[0134] Among them, λ represents the eigenvalue and v represents the corresponding eigenvector.

[0135] Select the eigenvectors corresponding to the minimum eigenvalues ​​of the normalized Laplace matrix, and use the spectral clustering method to cluster the eigenvectors to obtain preliminary clustering results;

[0136] Specifically, when calculating the normalized Laplace matrix L normAfter finding the eigenvalues ​​and eigenvectors, we usually focus on the smallest k eigenvalues ​​(excluding the first eigenvalue because it usually corresponds to a global constant vector, that is, a vector with all elements the same, and this eigenvalue does not provide useful information for clustering).

[0137] Let λ1,λ2,...,λ k YesL norm The smallest k eigenvalues ​​(arranged in ascending order), e1,e 2, ...,e k are the corresponding eigenvectors. These eigenvectors constitute the representation of the data in a low-dimensional space, and they can capture the similarity structure between the data.

[0138] Combine these eigenvectors into an eigenvector matrix, where each column is an eigenvector. Perform clustering on the eigenvector matrix. Common clustering algorithms include k-means, k-medoids, hierarchical clustering, etc. In spectral clustering, k-means is one of the most commonly used clustering algorithms.

[0139] Each row of the eigenvector matrix (i.e., the eigenvector of each node) is used as input to the k-means algorithm, and the number of clusters k to be clustered is specified (this k is usually the same as the number of eigenvectors selected previously). The k-means algorithm divides these eigenvectors into k clusters, each with a center point (or centroid), and the sum of the distances from the eigenvectors within the cluster to the center point is minimized.

[0140] For example, suppose there are 6 data points and a normalized Laplace matrix L is constructed based on similarity norm . The following eigenvalues ​​and corresponding eigenvectors are obtained through eigenvalue decomposition:

[0141] Eigenvalues ​​(in ascending order): λ1=0, λ2=0.3, λ3=0.5, λ4=1.2, λ5=2.0, λ6=3.0.

[0142] Corresponding eigenvectors: e1 = [1,1,1,1,1,1], e2 = [0.8,0.8,0.7,-0.6,-0.7,-0.8], e3 = [0.5,0.4,0.3,-0.4,-0.5,-0.6], … .

[0143] Ignore the eigenvector e1 corresponding to λ1=0, because it represents a global constant and cannot provide useful clustering information;

[0144] Select the eigenvectors e2 and e3 corresponding to the smallest k=2 non-zero eigenvalues. Combine e2 and e3 into an eigenvector matrix; use each row of the eigenvector matrix (representing the eigenvector of each node) as the input of the clustering algorithm. Apply the k-means clustering algorithm and specify the number of clusters k=2.

[0145] Randomly choose two initial centroids: for example [0.7, 0.4] and [-0.7, -0.5].

[0146] Calculate the Euclidean distance of each point to the two centroids and assign it to the cluster with the closest distance.

[0147] The preliminary allocation results are:

[0148] Cluster 1: (0.8, 0.5), (0.8, 0.4), (0.7, 0.3);

[0149] Cluster 2: (-0.6, -0.4), (-0.7, -0.5), (-0.8, -0.6);

[0150] Update the centroid and recalculate the centroid (the mean of the points within the cluster) for each cluster:

[0151] Cluster 1 new centroid: [0.7667, 0.4];

[0152] Cluster 2 new centroid: [-0.7,-0.5];

[0153] Repeat assigning clusters and updating centroids until the centroids no longer change.

[0154] The final clustering result is:

[0155] Cluster 1: data points 1, 2, 3 ([0.8, 0.5], [0.8, 0.4], [0.7, 0.3]).

[0156] Cluster 2: data points 4, 5, 6 ([-0.6, -0.4], [-0.7, -0.5], [-0.8, -0.6]).

[0157] The silhouette coefficient method is used to evaluate the clustering effects of different cluster numbers, and the cluster number with the largest silhouette coefficient is selected as the optimal cluster number;

[0158] Specifically, the silhouette coefficient is an indicator to measure the clustering effect, and its value range is [-1,1]. A value close to 1 indicates that the clustering effect is good, and the data point is closer to other points in the same cluster and farther away from points in other clusters. A value close to 0 indicates that the data point is at the cluster boundary and may belong to other clusters. A value less than 0 indicates that the data point may be incorrectly clustered.

[0159] For each cluster number k, a clustering algorithm (such as k-means) is used to cluster the data, and then the silhouette coefficient of each data point is calculated. The calculation formula of the silhouette coefficient is:

[0160] S(i)=(b(i)-a(i)) / (max{a(i),b(i)})

[0161] Where S(i) represents the silhouette coefficient of the i-th data point, a(i) is the average distance between data point i and other points in its cluster, and b(i) is the average distance between data point i and the nearest points in other clusters.

[0162] For each cluster number k, calculate the average of the silhouette coefficients of all data points to obtain the average silhouette coefficient under this cluster number, compare the average silhouette coefficients under different cluster numbers, and select the cluster number with the largest average silhouette coefficient as the optimal cluster number.

[0163] According to the clustering results of the optimal number of clusters, the samples closest to each cluster center are extracted as feature parameters to form the feature set of new energy station equipment operation data.

[0164] The network structure construction optimization module is used to construct a fully connected neural network structure based on the extracted characteristic parameters, and use the random search method to optimize the neural network structure to obtain the parameter inversion model of the new energy station.

[0165] As a preferred implementation, a fully connected neural network structure is constructed based on the extracted characteristic parameters, and the neural network structure is optimized using a random search method to obtain a parameter inversion model of a new energy station, including:

[0166] Based on the feature set of the new energy station equipment operation data, the number of input layer nodes of the neural network is determined, and the number of hidden layers and the number of nodes in each layer of the neural network are preliminarily set to obtain a fully connected neural network structure;

[0167] It should be noted that the number of nodes in the input layer depends on the number of feature parameters, that is, the dimension of the feature set. Assuming that q feature parameters (such as wind speed, temperature, output power, etc.) are extracted from the operation data of new energy station equipment, the number of nodes in the input layer is q.

[0168] Hidden layers are used to extract high-order relationships of input features. The number of layers and nodes affects the network's expressiveness and generalization capabilities. According to the complexity of the data, 1 to 3 hidden layers are selected as the initial configuration. When the data complexity is low, 1 hidden layer can be selected; when the complexity is high, 2-3 hidden layers can be selected.

[0169] The principle for selecting the number of nodes is:

[0170] Usually the number of nodes is chosen to decrease layer by layer, changing from high to low.

[0171] The number of nodes in each layer can be selected to be twice the number of input nodes, the same, or gradually reduced.

[0172] Initial selection range: 32, 64, 128, 256, etc.

[0173] The activation function of each hidden layer can be ReLU (rectified linear unit), because it converges quickly and can alleviate the gradient vanishing problem. The activation function formula is:

[0174] ReLU(u)=max(0,u)

[0175] Determine the number of output nodes according to the dimension of the inversion target:

[0176] Single objective parameter (such as power prediction): the number of output nodes is 1.

[0177] Multiple objective parameters (e.g., power, efficiency): The number of output nodes is equal to the number of objective parameters.

[0178] Specifically, if the inversion target is the output power of a new energy station, the number of output layer nodes is 1.

[0179] If power and efficiency are inverted simultaneously, the number of output layer nodes is 2.

[0180] According to the preset hyperparameter search space, the random search method is used to optimize the number of hidden layers, the number of nodes in each layer, and the learning rate;

[0181] Specifically, random search is a commonly used hyperparameter optimization method that finds the optimal hyperparameter combination by randomly sampling in a given hyperparameter space. Unlike grid search, random search does not need to traverse all possible combinations, but sets a certain number of iterations and randomly selects a set of hyperparameters from the hyperparameter space for evaluation in each iteration;

[0182] It is necessary to set a reasonable search range for the number of hidden layers, the number of nodes in each layer, and the learning rate. For example:

[0183] Number of hidden layers: [1,2,3,4,5];

[0184] Number of nodes in each layer: For each layer, you can set a range, such as [10, 20, 50, 100, 200] (indicating that the number of nodes in each layer can be one of these values);

[0185] Learning rate: [0.0001, 0.001, 0.01, 0.1] (candidate values ​​of learning rate);

[0186] Set the number of random search iterations. For each iteration, perform the random search as follows:

[0187] Randomly select a value from the search range for the number of hidden layers, randomly select a number of nodes for each layer from the search range for the number of nodes per layer, and randomly select a value from the search range for the learning rate.

[0188] Construct a new fully connected neural network with the selected hyperparameters.

[0189] The extracted feature parameters are divided into a training set and a validation set. The fully connected neural network structure is trained using the training set, the mean square error is used as the loss function, and the network weights are adjusted using the stochastic gradient descent algorithm.

[0190] It should be noted that feature parameters are extracted from the operating data of new energy station equipment. These features will be used as the input of the neural network, and the extracted feature parameters are randomly divided into training set and validation set. Usually, the training set is used to train the model, while the validation set is used to evaluate the performance of the model. The division ratio can be determined according to the amount of data and actual needs. The common ratio is 70% training set and 30% validation set.

[0191] According to the best hyperparameters (number of hidden layers, number of nodes in each layer, etc.) obtained by the previous random search method, a fully connected neural network structure is constructed, and random initialization or specific initialization methods (such as He initialization, Xavier initialization, etc.) are used to initialize the weights and biases of the neural network.

[0192] For regression problems, the mean squared error (MSE) is usually used as the loss function. The mean squared error calculates the average of the squares of the difference between the predicted value and the true value. Stochastic Gradient Descent (SGD) or its variants (such as Adam, RMSprop, etc.) are selected as the optimizer. The optimizer is responsible for updating the weights of the network according to the gradient of the loss function.

[0193] The training of a neural network consists of the following steps:

[0194] Input training data: Input the characteristic parameters of the training set into the neural network.

[0195] Forward propagation: Calculate the output of the neural network, that is, the predicted value.

[0196] Calculate the loss: Use the mean squared error loss function to calculate the loss between the predicted value and the true value.

[0197] Backpropagation: Calculate the gradient of the loss function with respect to the network weights.

[0198] Update weights: Use an optimizer (such as stochastic gradient descent) to update the weights of the network according to the gradient to minimize the loss function.

[0199] Iterative training: Repeat the above process until a predetermined number of training rounds is reached or the loss converges below a certain threshold.

[0200] The validation set is used to verify the performance of the trained fully connected neural network structure. The fully connected neural network structure with the best performance is selected according to the performance verification results, and the optimal fully connected neural network structure is used as the parameter inversion model of the new energy station.

[0201] It should be noted that the feature parameters of the validation set are input into the trained fully connected neural network, and the neural network will output predicted values. These predicted values ​​should correspond to the true values ​​in the validation set, and the performance indicators on the validation set are calculated and recorded. For regression problems, commonly used performance indicators include mean square error (MSE), root mean square error (RMSE), R 2 Scores, etc.

[0202] The intrusion detection and defense unit 3 is used to obtain the real-time operating parameters of the new energy station equipment, use the parameter inversion model to identify abnormal patterns in the operating parameters and detect network intrusion behavior; determine the defense strategy based on the detection results, simulate the defense strategy through the digital twin model, and determine and execute the final defense strategy based on the simulation results.

[0203] As a preferred embodiment, the intrusion detection and defense unit 3 includes: an abnormal pattern recognition module, a network intrusion detection module, a defense strategy selection module and a defense strategy implementation module;

[0204] The abnormal pattern recognition module is used to input the acquired real-time operating parameters of the new energy station equipment into the parameter inversion model to generate the inversion results of the operating status of the new energy station equipment; and identify the abnormal patterns in the operating parameters according to the inversion results;

[0205] As a preferred implementation, the real-time operating parameters of the new energy station equipment are input into the parameter inversion model to generate the inversion results of the operating status of the new energy station equipment; and the abnormal mode in the operating parameters is identified according to the inversion results, including:

[0206] Collect historical operating data of new energy station equipment, and use tangent angle theory to calculate the normal operating status benchmark range of new energy station equipment;

[0207] As a preferred implementation, historical operation data of new energy station equipment is collected, and the normal operating state benchmark range of new energy station equipment is calculated using the tangent angle theory, including:

[0208] Normalize the historical operation data of the new energy station equipment and determine the timestamp information corresponding to the historical operation data;

[0209] Specifically, timestamps are information that records the time when an event occurs, which is crucial for time series analysis. In the historical operation data of new energy station equipment, timestamps are usually associated with each data point, indicating the collection time of the data point.

[0210] Based on the normalized historical operation data, identify the constant speed operation stage of the new energy station equipment, calculate the average change rate of the constant speed operation stage, and mark the time period corresponding to the constant speed operation stage;

[0211] It should be noted that, for the normalized data, the rate of change between adjacent data points is calculated by finding the difference between adjacent points and dividing by the time interval.

[0212] In order to identify the isospeed operation phase, a threshold range of the rate of change needs to be set. This range needs to be small enough to ensure that the identified phase is indeed isospeed, and the choice of the threshold needs to be determined based on the specific operating characteristics of the equipment and experience.

[0213] Then traverse the data to find those continuous data point sequences whose change rates are within the set threshold range. These sequences are the constant speed operation stages.

[0214] For each identified isospeed running stage, the average value of all change rates in the stage is calculated. This average value is the average change rate of the isospeed running stage. For each isospeed running stage, its start and end timestamps are recorded.

[0215] According to the average rate of change in the constant speed operation stage, the equipment operation data is converted into the time dimension, a time conversion curve is constructed, and the tangent angle of the time conversion curve is calculated to obtain the tangent angle time series;

[0216] It should be noted that, for each constant speed operation stage, its start and end timestamps, as well as the average rate of change of the stage are determined.

[0217] For each data point, according to the isochronous operation phase to which it belongs and the average rate of change of that phase, its equipment operation value (such as temperature, pressure, etc.) is converted to the time dimension relative to the reference point. This can be achieved by dividing the equipment operation value by the average rate of change and adding the time difference from the reference point to the current data point, and plotting the time conversion curve with the converted time dimension value as the ordinate and the original timestamp (or the time difference relative to the reference point) as the abscissa.

[0218] The calculation formula for the tangent angle of the time conversion curve is:

[0219]

[0220] In the formula, α r represents the tangent angle; tr Indicates the timestamp of the current time point r; t r-1 Indicates the timestamp of the current time point r-1; T(r) indicates the ordinate value of the time conversion curve at the time point r; T(r-1) indicates the ordinate value of the time conversion curve at the time point r-1;

[0221] According to the tangent angle time series, the distribution characteristics of the tangent angle are analyzed, and the reference range of normal operating status is calculated using statistical analysis methods.

[0222] It should be noted that, according to the tangent angle time series, analyzing the distribution characteristics of the tangent angle, and using the statistical analysis method to calculate the reference range of the normal operating state include the following steps:

[0223] Conduct preliminary visual analysis on the tangent angle time series, such as drawing a histogram or time series graph to observe its distribution characteristics and trends;

[0224] Calculate the basic statistics of the tangent angle time series, such as the mean, standard deviation, maximum, minimum, and median, and determine whether the distribution of the tangent angle is close to the normal distribution or other known distributions by observing the histogram or using statistical test methods (such as normality test);

[0225] According to actual needs, a confidence level (such as 95% or 99%) is set to determine the reliability of the benchmark range. If the distribution of the tangent angle is close to the normal distribution, the properties of the normal distribution can be used to combine the mean and standard deviation to calculate the confidence interval at a given confidence level. If the distribution of the tangent angle is not close to the normal distribution, non-parametric statistical methods (such as the percentile method) can be considered to estimate the confidence interval.

[0226] The calculated confidence interval is used as the benchmark range for normal operating conditions. Within this range, changes in the tangent angle are considered normal; if it exceeds this range, it may indicate that the equipment operating status is abnormal.

[0227] Input the acquired real-time operating parameters of the new energy station equipment into the parameter inversion model to generate the inversion results of the operating status, and calculate the deviation value of each operating parameter from the normal operating status benchmark range according to the inversion results;

[0228] It should be noted that the real-time acquired operating parameters are input into the parameter inversion model, and the model is run to generate the inversion results of the equipment's operating status, which may include estimates of the equipment's health status, work efficiency, remaining life, and other information.

[0229] Based on the normal operating status benchmark range obtained from the previous analysis (which may be based on the tangent angle time series or other methods), the benchmark range of each operating parameter is determined. For each real-time operating parameter, its deviation value from the corresponding benchmark range is calculated. This can be achieved through simple subtraction (real-time value - median of the benchmark range) or more complex statistical methods (such as standard deviation multiples). Based on the deviation value of each operating parameter from the normal operating status benchmark, the deviation analysis method is used to identify abnormal patterns in the inversion results, analyze the deviation value, and determine which parameters have deviated from the normal operating state and the degree of deviation.

[0230] The network intrusion detection module is used to perform intrusion detection on the network traffic data of the new energy station based on abnormal patterns in the operating parameters and identify network intrusion behaviors;

[0231] It should be noted that an in-depth analysis is conducted on the network traffic data within the time period when the abnormal pattern is identified, including traffic statistics analysis, protocol analysis, behavioral analysis and other aspects. Features related to intrusion behavior are extracted from the network traffic data, such as abnormal connection attempts, high-load data transmission, use of unknown protocols, etc. The extracted features are matched with known intrusion patterns or rules to identify potential intrusion behaviors, which involves multiple methods such as signature detection and anomaly detection.

[0232] By combining other data sources (such as system logs, security logs, etc.) to verify the authenticity of the intrusion behavior, further analyze the identified intrusion behavior to understand its attack method, target, scope of impact, etc., and take appropriate response measures based on the severity and scope of the intrusion behavior. This may include isolating infected devices, blocking the source of the attack, and recording logs for subsequent investigation.

[0233] A defense strategy selection module is used to select a preliminary defense strategy set from a pre-set defense strategy library based on the abnormal mode of operating parameters and the network intrusion detection results;

[0234] It should be noted that, according to the abnormal mode of operating parameters and the network intrusion detection results, before selecting the preliminary defense strategy set from the pre-set defense strategy library, it is necessary to build a defense strategy library, including the following steps:

[0235] Classify defense strategies according to different dimensions, such as attack type (such as DDoS attack, SQL injection, etc.), defense means (such as firewall rules, intrusion detection system configuration, etc.), and application scenarios (such as servers, network devices, applications, etc.);

[0236] Develop corresponding defense strategies for each attack type or abnormal pattern. These strategies should cover multiple aspects such as prevention measures, detection measures, and response measures.

[0237] Regularly update the defense strategy library to adapt to new network threats and attack methods. This includes adding new strategies, updating the parameters or rules of existing strategies, etc.

[0238] In addition, according to the abnormal patterns of operating parameters and network intrusion detection results, a matching preliminary defense strategy set is selected from the defense strategy library, which can be achieved through methods such as keyword matching and pattern recognition;

[0239] The defense strategy implementation module is used to use the digital twin model to simulate and test each defense strategy in the preliminary defense strategy set, evaluate the defense effect of each defense strategy on the operation of new energy stations, select the optimal defense strategy based on the evaluation results, and implement it in the new energy station.

[0240] It should be noted that each defense strategy in the preliminary defense strategy set is input into the digital twin model, in which the operation of the new energy station is simulated and the corresponding defense strategy is applied. By adjusting the parameters and input conditions of the model, simulating different attack scenarios and abnormal modes, observing and recording the operation of the station during the simulation test, and evaluating the impact of each defense strategy on the defense effect of the station operation. This can include multiple aspects such as system stability, security, and response time.

[0241] Compare the performance of different defense strategies in simulation tests, analyze their advantages and disadvantages and applicable scenarios, and conduct a comprehensive evaluation of each defense strategy in the preliminary defense strategy set based on the results of simulation tests. Consider factors such as the effectiveness, feasibility, and impact on system performance of the strategy, and select the optimal defense strategy based on the evaluation results. This strategy should be the one that has the least impact on system performance while ensuring system security and stability.

[0242] Deploy the selected optimal defense strategy in the new energy station to ensure that it can operate normally and play a role, continuously monitor the implementation effect of the defense strategy, and adjust and optimize the strategy according to the actual situation. This may include adjusting the parameters of the strategy, combining multiple strategies to improve the defense effect, etc.

[0243] In summary, with the help of the above-mentioned technical scheme of the present invention, the present invention uses digital twin technology to construct a digital model that is highly consistent with the physical station, which can grasp the operating status of the station equipment in real time and accurately, and provides a solid foundation for subsequent analysis and decision-making. Through clustering algorithm and silhouette coefficient method, key feature parameters are extracted from massive operating data, and then the neural network structure is optimized by random search to construct an efficient and accurate parameter inversion model, which not only improves the accuracy and efficiency of data analysis, but also enables the system to more accurately identify abnormal states of equipment and network intrusion behaviors, and quickly identify abnormal patterns through parameter inversion models, so as to timely discover network intrusion behaviors, and can also intelligently determine defense strategies based on detection results, and perform simulation verification through digital twin models to ensure the effectiveness and feasibility of the selected strategies, greatly enhancing the response speed and defense capabilities of the system. The present invention obtains an accurate similarity matrix by normalizing the operating data and calculating the Gaussian kernel function, which provides a reliable basis for subsequent clustering analysis and feature extraction. The optimal number of clusters is selected by using the spectral clustering method and the silhouette coefficient method, and the characteristic parameters of the operating data are extracted, thereby improving the efficiency and accuracy of data analysis. The clustering effects of different numbers of clusters are evaluated by the silhouette coefficient method, and the number of clusters with the largest silhouette coefficient is selected as the optimal number of clusters, thereby improving the accuracy and stability of cluster analysis. The number of hidden layers, the number of nodes in each layer and the learning rate of the neural network are optimized by using the random search method, thereby obtaining a neural network structure with optimal performance, thereby improving the accuracy and generalization ability of the parameter inversion model. The present invention inverts the real-time operating parameters through the parameter inversion model, can accurately generate the inversion results of the equipment operating status, and then identify the abnormal patterns in the operating parameters. Based on the abnormal patterns in the operating parameters, the network traffic data is subjected to intrusion detection, which can accurately identify network intrusion behaviors, help to timely discover and respond to network attacks, and ensure the network security of new energy sites. The digital twin model is used to simulate and test the preliminary defense strategy, evaluate its defense effect, and select the optimal defense strategy for implementation based on the evaluation results, thereby ensuring the feasibility and effectiveness of the defense strategy in practical applications and reducing misoperation and risks.

[0244] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program code.

[0245] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A new energy station network intrusion intelligent detection and active defense system, characterized in that: The system includes: an operation parameter acquisition unit, an inversion model building unit and an intrusion detection and defense unit; The operating parameter acquisition unit is used to collect parameter information of the new energy station equipment, build a digital twin model of the new energy station using the digital twin technology; and obtain the operating data of the new energy station equipment through the digital twin model of the new energy station; The inversion model construction unit is used to extract characteristic parameters from the operation data of the new energy station equipment based on the clustering algorithm and the silhouette coefficient method, and to construct a parameter inversion model of the new energy station by optimizing the neural network structure through random search; The intrusion detection and defense unit is used to obtain the real-time operating parameters of the new energy station equipment, use the parameter inversion model to identify abnormal patterns in the operating parameters and detect network intrusion behavior; determine the defense strategy based on the detection results, simulate the defense strategy through the digital twin model, and determine and execute the final defense strategy based on the simulation results.

2. According to claim 1, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The operating parameter acquisition unit includes: an attribute data acquisition module, a digital twin model construction module and an operating data acquisition module; The attribute data acquisition module is used to acquire the physical layer data, network layer data and environmental data of the new energy station equipment; and determine the relationship between each device and its function based on the physical layer data, network layer data and environmental data; The digital twin model building module is used to build a digital twin model of a new energy station based on the relationship between various devices and their functions, based on a three-dimensional modeling tool, and through digital twin technology; The operation data acquisition module is used to input the physical layer data, network layer data and environmental data of the new energy station equipment into the digital twin model, dynamically update the digital twin model through real-time data synchronization technology; and use the updated digital twin model to obtain the operation data of the new energy station equipment.

3. According to claim 1, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The inversion model construction unit includes: a similarity matrix construction module, a characteristic parameter extraction module and a network structure construction optimization module; The similarity matrix construction module is used to normalize the operation data of the new energy station equipment, calculate the similarity between the operation data using the Gaussian kernel function, and construct a similarity matrix according to the similarity calculation results; The characteristic parameter extraction module is used to construct a standardized Laplace matrix based on the similarity matrix; select the number of clusters through the spectral clustering method and the silhouette coefficient method to extract the characteristic parameters of the operation data of the new energy station equipment; The network structure construction optimization module is used to construct a fully connected neural network structure based on the extracted characteristic parameters, and optimize the neural network structure using a random search method to obtain a parameter inversion model of a new energy station.

4. According to claim 3, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The normalization of the operation data of the new energy station equipment and the use of the Gaussian kernel function to calculate the similarity between the operation data and the construction of the similarity matrix according to the similarity calculation results include: The operation data of the new energy station equipment is normalized by using the normalization method, and the mean value of the distance between each operation data and other operation data is calculated based on the normalized operation data of the new energy station equipment; The coefficient of variation between the running data is calculated according to the mean of the distance between each running data and other running data, and the inverse of the coefficient of variation is used as the scale parameter of the Gaussian kernel function; According to the scale parameter of the Gaussian kernel function, the Gaussian kernel function is used to calculate the similarity between the running data, and a similarity matrix is ​​constructed based on the similarity calculation results.

5. According to claim 4, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The calculation formula for calculating the coefficient of variation between the running data according to the mean of the distance between each running data and other running data is: In the formula, G i represents the coefficient of variation between the i-th running data; m i Represents the mean distance from the i-th running data to other running data; n represents the number of running data; x i Represents the normalized value of the i-th running data; x j Represents the normalized value of the j-th running data; d(x i ,x j ) represents the Euclidean distance from the i-th running data to the j-th running data.

6. According to claim 3, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The method comprises constructing a standardized Laplace matrix based on the similarity matrix; The number of clusters is selected by using the spectral clustering method and the silhouette coefficient method, and the characteristic parameters of the operating data of the new energy station equipment are extracted, including: The degree matrix is ​​calculated through the similarity matrix, and the standardized Laplace matrix is ​​constructed by using the degree matrix and the similarity matrix, and the eigenvalues ​​and eigenvectors of the Laplace matrix are calculated; Select the eigenvectors corresponding to the minimum eigenvalues ​​of the normalized Laplace matrix, and use the spectral clustering method to cluster the eigenvectors to obtain preliminary clustering results; The silhouette coefficient method is used to evaluate the clustering effects of different cluster numbers, and the cluster number with the largest silhouette coefficient is selected as the optimal cluster number; According to the clustering results of the optimal number of clusters, the samples closest to each cluster center are extracted as feature parameters to form the feature set of new energy station equipment operation data.

7. According to claim 3, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The fully connected neural network structure is constructed based on the extracted characteristic parameters, and the neural network structure is optimized by random search method to obtain the parameter inversion model of the new energy station, including: Based on the feature set of the new energy station equipment operation data, the number of input layer nodes of the neural network is determined, and the number of hidden layers and the number of nodes in each layer of the neural network are preliminarily set to obtain a fully connected neural network structure; According to the preset hyperparameter search space, the random search method is used to optimize the number of hidden layers, the number of nodes in each layer, and the learning rate; The extracted feature parameters are divided into a training set and a validation set. The fully connected neural network structure is trained using the training set, the mean square error is used as the loss function, and the network weights are adjusted using the stochastic gradient descent algorithm. The validation set is used to verify the performance of the trained fully connected neural network structure. The fully connected neural network structure with the best performance is selected according to the performance verification results, and the optimal fully connected neural network structure is used as the parameter inversion model of the new energy station.

8. According to claim 1, a new energy station network intrusion intelligent detection and active defense system is characterized in that: The intrusion detection and defense unit includes: an abnormal pattern recognition module, a network intrusion detection module, a defense strategy selection module and a defense strategy implementation module; The abnormal pattern recognition module is used to input the acquired real-time operating parameters of the new energy station equipment into the parameter inversion model to generate an inversion result of the operating status of the new energy station equipment; and identify the abnormal pattern in the operating parameters according to the inversion result; The network intrusion detection module is used to perform intrusion detection on the network traffic data of the new energy station based on the abnormal pattern in the operating parameters and identify the network intrusion behavior; The defense strategy selection module is used to select a preliminary defense strategy set from a preset defense strategy library according to the abnormal operation parameter mode and the network intrusion detection result; The defense strategy implementation module is used to use the digital twin model to simulate and test each defense strategy in the preliminary defense strategy set, evaluate the defense effect of each defense strategy on the operation of the new energy station, select the optimal defense strategy based on the evaluation results, and implement it in the new energy station.

9. The new energy station network intrusion intelligent detection and active defense system according to claim 8 is characterized in that: The real-time operating parameters of the new energy station equipment are input into the parameter inversion model to generate an inversion result of the operating status of the new energy station equipment; Identifying anomalous patterns in operating parameters based on inversion results includes: Collect historical operating data of new energy station equipment, and use tangent angle theory to calculate the normal operating status benchmark range of new energy station equipment; Input the acquired real-time operating parameters of the new energy station equipment into the parameter inversion model to generate the inversion results of the operating status, and calculate the deviation value of each operating parameter from the normal operating status benchmark range according to the inversion results; According to the deviation values ​​of various operating parameters from the normal operating state benchmark, the deviation analysis method is used to identify abnormal patterns in the inversion results.

10. The new energy station network intrusion intelligent detection and active defense system according to claim 8 is characterized in that: The above-mentioned collection of historical operation data of new energy station equipment and calculation of the normal operating status benchmark range of new energy station equipment using tangent angle theory includes: Normalize the historical operation data of the new energy station equipment and determine the timestamp information corresponding to the historical operation data; Based on the normalized historical operation data, identify the constant speed operation stage of the new energy station equipment, calculate the average change rate of the constant speed operation stage, and mark the time period corresponding to the constant speed operation stage; According to the average rate of change in the constant speed operation stage, the equipment operation data is converted into the time dimension, a time conversion curve is constructed, and the tangent angle of the time conversion curve is calculated to obtain the tangent angle time series; The calculation formula of the tangent angle of the calculation time conversion curve is: In the formula, α r represents the tangent angle; t r Represents the timestamp of the current time point r; t r-1 Indicates the timestamp of the current time point r-1; T(r) represents the ordinate value of the time conversion curve at time point r; T(r-1) represents the ordinate value of the time conversion curve at time point r-1; According to the tangent angle time series, the distribution characteristics of the tangent angle are analyzed, and the reference range of normal operating status is calculated using statistical analysis methods.

Images