Malicious traffic identification method in power monitoring system and related device

Abstract

The invention provides a malicious traffic identification method in a power monitoring system and a related device, and the method comprises the steps: determining the initial bandwidth of a protection path corresponding to a first type of network service when the first type of network service is determined to have a fault; determining whether a target network bandwidth corresponding to the first type of network services is greater than the initial bandwidth; in response to determining that the target network bandwidth is greater than the initial bandwidth, adjusting the initial bandwidth, so that the adjusted initial bandwidth is greater than or equal to the target network bandwidth; and recovering the first type of network services based on the protection path after the initial bandwidth is adjusted, so that the protection path only reserves a small amount of initial bandwidth when the first type of network services do not fail, and when the first type of network services fail and the target network bandwidth required by the first type of network services is greater than the initial bandwidth, the protection path only reserves a small amount of initial bandwidth. The service recovery function of the protection path is met by adjusting the initial bandwidth, and the malicious traffic identification efficiency in the power monitoring system is improved.

Description

Technical Field

[0001] The present application relates to the technical field of malicious traffic identification in a power monitoring system, and in particular to a malicious traffic identification method and related devices in a power monitoring system. Background Art

[0002] The power system involves many dedicated power communication networks, which are the hubs for intelligent transmission and reasonable allocation of power resources. Therefore, network security in the power system is the key to enhancing the reliability of the power system and ensuring the safety of electricity use. With the development of society, the demand for electricity is increasing, and the business scope of the power system is constantly expanding, which makes the structure of the communication network in the power system increasingly complex. In this context, the number of malicious traffic in the power system network is increasing, which brings severe challenges to the network security of the power system. Malicious traffic may not only carry malicious programs such as viruses and Trojans to undermine the security of the power system, but also be used for illegal activities such as network attacks and stealing sensitive information. In extreme cases, it may even cause disorder in the power monitoring system and paralyze the power grid system. However, the detection of malicious traffic in the current related technologies is mostly based on a single machine learning model, and the classifier has technical problems such as poor generalization, low detection accuracy, and poor stability. Summary of the invention

[0003] In view of this, the purpose of this application is to propose a malicious traffic identification method and related devices in an electric power monitoring system to solve or partially solve the above-mentioned technical problems.

[0004] Based on the above objectives, the present application provides a method for identifying malicious traffic in an electric power monitoring system, comprising:

[0005] Obtain target traffic data to be detected;

[0006] Inputting the target flow data into a plurality of initial recognition models obtained through training respectively to obtain a plurality of preliminary recognition features;

[0007] The multiple preliminary identification features are input into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data.

[0008] Based on the same concept, the present application also proposes a malicious traffic identification device in a power monitoring system, comprising:

[0009] An acquisition module is used to acquire target flow data to be detected;

[0010] A first recognition module, inputting the target flow data into a plurality of trained initial recognition models respectively to obtain a plurality of preliminary recognition features;

[0011] The second identification module inputs the multiple preliminary identification features into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data.

[0012] Based on the same concept, the present application also proposes an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the malicious traffic identification method in the power monitoring system as described above is implemented.

[0013] Based on the same concept, the present application also proposes a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the malicious traffic identification method in the power monitoring system as described above.

[0014] Based on the same concept, the present application also proposes a computer program product, which includes a computer program, and the computer program is executed by one or more processors so that the processors execute the malicious traffic identification method in the power monitoring system as described above.

[0015] From the above, it can be seen that the malicious traffic identification method and related devices in the power monitoring system provided by the present application obtain target traffic data to be detected; input the target traffic data into multiple trained initial recognition models respectively to obtain multiple preliminary recognition features; input the multiple preliminary recognition features into the trained malicious traffic recognition model to obtain the malicious traffic recognition results corresponding to the target traffic data. The target traffic data is initially recognized by multiple initial recognition models, which not only effectively disperses the deviations that may be generated by a single learner, but also realizes more accurate learning and prediction of complex data through the complementarity between multiple recognition models. Finally, through the malicious traffic recognition model, the preliminary recognition features output by multiple initial recognition models are fused and recognized, which solves the problems of low model generalization and insufficient detection accuracy in single-model malicious traffic detection in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A schematic diagram of an application scenario of an embodiment of the present application;

[0018] Figure 2A schematic diagram of a flow chart of a method for identifying malicious traffic in a power monitoring system according to an embodiment of the present application;

[0019] Figure 3 A schematic diagram of a process for preprocessing target flow data according to an embodiment of the present application;

[0020] Figure 4 A flowchart of another method for identifying malicious traffic in a power monitoring system according to an embodiment of the present application;

[0021] Figure 5 A flowchart of a method for training an initial recognition model and a malicious traffic recognition model according to an embodiment of the present application;

[0022] Figure 6 A schematic diagram of the structure of a malicious traffic identification device in a power monitoring system according to an embodiment of the present application;

[0023] Figure 7 A schematic diagram of a specific electronic device hardware structure of an embodiment of the present application. DETAILED DESCRIPTION

[0024] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0025] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with general skills in the field to which the present application belongs. The "first", "second" and similar words used in the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connecting" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, which can be direct connections, indirect connections, wired connections, and wireless connections. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly. In addition, in the description of the present application, unless otherwise specified, the term "multiple" refers to two or more. The term "and / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects are in an "or" relationship.

[0026] The principles and spirit of the present application will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement the present application, and are not intended to limit the scope of the present application in any way. On the contrary, these embodiments are provided to make the present application more thorough and complete, and to fully convey the scope of the present application to those skilled in the art.

[0027] It is understandable that before using the technical solutions of each embodiment of the present application, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0028] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to the electronic device, application, server, storage medium or other software or hardware that performs the operation of the technical solution of the present application according to the prompt message.

[0029] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0030] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation method of this application. Other methods that meet relevant laws and regulations may also be applied to the implementation method of this application.

[0031] It should be understood herein that any number of elements in the drawings is for illustration rather than limitation, and any naming is only for distinction rather than having any limiting meaning.

[0032] As mentioned in the background technology section, in order to distinguish malicious traffic from numerous network traffic, some machine learning models that have good effects in the traditional classification field have been introduced into the field of traffic detection in the current related technologies. However, due to the diversity and complexity of malicious traffic, a single machine learning model often fails to achieve ideal results. In the face of increasingly diverse network attack methods, single model detection methods have technical problems such as poor generalization, low accuracy, high false alarm rate, and poor applicability to multi-granularity features.

[0033] In summary, in order to solve the above problems, that is, to significantly improve the generalization performance of the learner, it is necessary to overcome the common challenges of a single learner: underfitting and overfitting problems. The embodiment of the present application proposes a method for identifying malicious traffic in a power monitoring system, including:

[0034] Obtain the target traffic data to be detected; input the target traffic data into multiple trained initial recognition models respectively to obtain multiple preliminary recognition features; input the multiple preliminary recognition features into the trained malicious traffic recognition model to obtain the malicious traffic recognition result corresponding to the target traffic data. Performing initial recognition on the target traffic data through multiple initial recognition models not only effectively disperses the deviation that may be generated by a single learner, but also achieves more accurate learning and prediction of complex data through the complementarity between multiple recognition models. Finally, through the malicious traffic recognition model, the preliminary recognition features output by multiple initial recognition models are fused and recognized, solving the problem of low model generalization and insufficient detection accuracy in single-model malicious traffic detection in related technologies. This method integrates multiple independent individual learners into a strong learner with superior performance by training them and combining them with a certain fusion strategy.

[0035] In some specific application scenarios, the malicious traffic identification method in the power monitoring system of the present application can be applied to various platforms or systems involving power monitoring. As an example, the application scenario includes at least one server and at least one terminal. Figure 1 , which is a schematic diagram of an application scenario of a malicious traffic identification method in an electric power monitoring system provided by an exemplary embodiment of the present disclosure. The application scenario includes a terminal device 101, a server 102, and a data storage system 103. Among them, the terminal device 101, the server 102 and the data storage system 103 can be connected through a wired or wireless communication network. The terminal device includes but is not limited to a desktop computer, a mobile phone, a mobile computer, a tablet computer, a media player, a smart wearable device, a personal digital assistant (PDA) or other electronic devices capable of realizing the above functions. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The server and the terminal can communicate through the network to realize data transmission. Among them, the network can be a wired network or a wireless network, which is not specifically limited in this application.

[0036] The server may be a server that provides various services. Specifically, the server may be used to provide background services for applications running on the terminal. Optionally, in some implementations, the malicious traffic identification method in the power monitoring system provided in the embodiment of the present application may be executed by the server. Optionally, in some implementations, the malicious traffic identification method in the power monitoring system provided in the embodiment of the present application may be directly executed by the terminal device.

[0037] Optionally, the server can be hardware or software. When the server is hardware, it can be implemented as a distributed server cluster consisting of multiple servers, or it can be implemented as a single server. When the server is software, it can be implemented as multiple software or software modules (for example, software or software modules for providing distributed services), or it can be implemented as a single software or software module. This embodiment of the application does not specifically limit this.

[0038] Optionally, the wireless network or wired network uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including hypertext mark-up language (HTML), extensible markup language (XML), etc. In addition, conventional encryption technologies such as secure socket layer (SSL), transport layer security (TLS), virtual private network (VPN), and Internet protocol security (IPsec) can be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0039] The data storage system stores a large amount of data. Optionally, the data storage system can partition the data according to different uses and data types. The source of the data includes but is not limited to an existing database, data crawled from the Internet, or data uploaded by the user when using the client.

[0040] The following describes the malicious traffic identification method in the power monitoring system according to the exemplary embodiment of the present application in combination with a specific application scenario. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principle of the present application, and the implementation of the present application is not limited in this regard. On the contrary, the implementation of the present application can be applied to any applicable scenario.

[0041] refer to Figure 2 , is a flow chart of a method for identifying malicious traffic in a power monitoring system according to an embodiment of the present application, the method comprising the following steps:

[0042] S101, obtaining target flow data to be detected.

[0043] In a specific implementation, the target flow data is the flow data that is currently to be subjected to malicious flow identification. Optionally, the target flow data can be obtained from the power system, that is, the target flow data can be any network flow data in the power system.

[0044] S102, inputting the target flow data into a plurality of initial recognition models obtained through training respectively to obtain a plurality of preliminary recognition features.

[0045] In a specific implementation, after obtaining the target traffic data, the target traffic data is respectively input into a plurality of initial recognition models obtained through training to obtain a plurality of preliminary recognition features. Optionally, the plurality of initial recognition models obtained through training are different from each other, and the number of specific initial recognition models can be set as required, and there is no limitation on this. Optionally, in some embodiments, the process of training the initial recognition model can refer to the training process of the network model in the related art, and no further description is given for this.

[0046] In some embodiments, before inputting the target traffic data into a plurality of trained initial recognition models respectively, the method further includes:

[0047] Digitally encoding the target flow data to obtain the encoded target flow data;

[0048] The encoded target flow data is normalized.

[0049] In specific implementation, in order to facilitate the model to accurately identify the target flow data, before inputting the target flow data into each initial recognition model, the target flow data can be digitally encoded to obtain the encoded target flow data. Optionally, the data encoding is generally mainly aimed at the character features in the target flow data, that is, the character features in the flow data are converted into numerical features that are convenient for model learning. Then, after obtaining the encoded target flow data, the encoded target flow data is further normalized so that the normalized target flow data is between 0 and 1. Optionally, the normalization can be performed using the following formula:

[0050]

[0051] Among them, x represents the original numerical feature, x ′ Represents the normalized numerical features.

[0052] In some embodiments, reference Figure 3 ,The preprocessing of the target flow data includes: first ,converting the target flow data to numerical values ​​to obtain the numerical ,target flow data, then normalizing the numerical target flow data to obtain the normalized ,target flow data, and finally, classifying the normalized target flow data to obtain the ,quantity type corresponding to the target flow data.

[0053] In order to accurately digitally encode the target flow data, in some embodiments, digitally encoding the target flow data specifically includes:

[0054] The target flow data is digitally encoded using a one-hot encoding technique.

[0055] In specific implementation, the one-hot encoding technology is also called one-bit effective encoding. The method is to use an N-bit state register to encode N states. Each state has its own independent register bit, and at any time, only one of them is valid. For example, there are three character-type discrete features in a certain traffic data: "protocol_type", "service" and "flag", where the feature "protocol_type" has three attributes: "TCP", "UDP" and "ICMP", which are converted into three vectors (1,0,0), (0,1,0) and (0,0,1) respectively using one-hot encoding. Similarly, "service" has 70 attributes and "flag" has 11 attributes that need to be one-hot encoded.

[0056] In order to improve the recognition accuracy of the initial recognition model, in some embodiments, the target traffic data is respectively input into a plurality of trained initial recognition models, specifically including:

[0057] Extracting multiple flow characteristics of the target flow data;

[0058] Determining a target flow characteristic from a plurality of flow characteristics based on a preset characteristic type;

[0059] The target flow characteristics are input into the multiple initial recognition models respectively.

[0060] During specific implementation, it is considered that the target traffic data may include multiple traffic features, some of which are features that are convenient for identifying the nature of the traffic and play a major role in the identification of preliminary identification features, while some features are not only unable to identify the characteristics of the traffic nature, but also affect the identification of the preliminary identification features. Therefore, in this embodiment, after extracting multiple traffic features of the target traffic data, the target traffic feature is first determined from the multiple traffic features according to the preset feature type, and then the target traffic feature is directly input into the multiple initial identification models respectively. It should be noted that the type of the target traffic feature is the preset feature type, and the preset feature type can be obtained through experiments when training the initial identification model, that is, when training the initial identification model, it can be obtained through testing which types of traffic features are features that are convenient for identifying the nature of the traffic.

[0061] S103, inputting the multiple preliminary identification features into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data.

[0062] During specific implementation, after the target traffic data is input into multiple trained initial recognition models respectively, each initial recognition model will output a preliminary recognition feature, and then these preliminary recognition features are input into the trained malicious traffic recognition model, and multiple preliminary recognition features are fused and recognized by the malicious traffic recognition model to obtain the malicious traffic recognition result corresponding to the target traffic data. Optionally, the malicious traffic recognition result corresponding to the target traffic data can be whether the target traffic data belongs to malicious traffic or not, or it can be the probability that the target traffic data belongs to malicious traffic, and there is no limitation on this. Optionally, the specific process of training the malicious traffic recognition model can refer to the training process of the network model in the relevant technology, and will not be elaborated on this.

[0063] In some embodiments, reference Figure 4, is a flow chart of another method for identifying malicious traffic in a power monitoring system according to an embodiment of the present application, wherein the data set includes a data set of target traffic data. After obtaining the target traffic data to be processed in the data set, data preprocessing is performed first. The specific preprocessing process can refer to the above Figure 3 The corresponding embodiments are not elaborated here. Then, based on the preset feature type, feature selection is performed on the target traffic data to obtain the target traffic feature, and the target traffic feature is input into three first-level learners (initial recognition models) respectively. Then, the output results of the three first-level learners are input into the meta-learner (malicious traffic recognition model). Finally, the meta-learner outputs the results of malicious traffic recognition.

[0064] In some embodiments, reference Figure 5 , which is a flow chart of a method for training an initial recognition model and a malicious traffic recognition model in an embodiment of the present application; after obtaining the sample data, the sample data can be first divided into a training set and a test set, and then the first-level learner (initial recognition model) and the meta-learner (malicious traffic recognition model) are trained using the training set, that is, each sample data in the training set is first input into each first-level learner, and then the output results of all the first-level learners are input into the meta-learner, and the meta-learner outputs the recognition result, and then the recognition result is compared with the traffic label corresponding to the sample data, and the parameters of the first-level learner and the meta-learner are adjusted through the function loss, so that the recognition result output by the meta-learner is close to the traffic label corresponding to the sample data. After completing the model training, the training results are verified through the test set, that is, each sample data in the test set is first input into each first-level learner, and then the output results of all the first-level learners are input into the meta-learner, and the meta-learner outputs the recognition result, and finally the recognition result is compared with the traffic label to determine whether the recognition accuracy meets the requirements.

[0065] In order to improve the accuracy of malicious traffic identification, in some embodiments, the initial identification models obtained by the multiple trainings include XGBoost model (an optimized gradient boosting decision tree algorithm model), RF model (random forest algorithm model) and LightGBM model (a machine learning algorithm model based on a gradient boosting framework). It should be noted that the inventors of the present application have found through research that the combination of these three models has significant advantages in the field of malicious traffic identification, wherein the XGBoost model can effectively prevent the problem of model overfitting caused by a large amount of noise or complex patterns in the traffic data by introducing regularization terms (L1, L2). At the same time, XGBoost has a built-in sparse perception algorithm, which can achieve better results when processing sparse traffic data and prevent false positives and negatives caused by sparse data. For example, in the detection of hybrid attacks (such as hybrid use of DDoS and malware propagation), there are many network traffic features and there may be noise in the data. XGBoost can efficiently detect them through the processing and robustness of multidimensional features; the RF model has a strong high-dimensional feature processing capability, and can better handle the complex traffic features (such as IP addresses, ports, protocol types, etc.) that may appear. For example, for advanced persistent threat (APT) attacks and distributed denial of service (DDoS), RF can effectively detect such malicious traffic by capturing subtle differences between features at different stages; LightGBM natively supports category-type features, can process discrete features in network traffic more efficiently, can complement RF well, and has advantages in detecting discrete malicious attack traffic (such as segmented connections, multi-hop paths). Considering model performance and recognition efficiency, the present disclosure defaults to the above three models to build a basic fusion model. In some embodiments, the malicious traffic identification model is an LR model (logistic regression model). Optionally, in some embodiments, the malicious traffic identification model can also select a gradient boosting tree model, which is not limited. Taking into account that different types of initial recognition models have different recognition focuses, therefore, in order to further improve the accuracy of malicious traffic identification, in some embodiments, the multiple preliminary recognition features are input into the trained malicious traffic identification model to obtain the malicious traffic identification results corresponding to the target traffic data, specifically including:

[0066] Determining a target data type of the target traffic data;

[0067] Adding a weight value to the preliminary recognition feature output by each of the initial recognition models based on the target data type;

[0068] The preliminary identification features after adding the weight value are input into the malicious traffic identification model to obtain the malicious traffic identification result corresponding to the target traffic data.

[0069] In the specific implementation, in order to further improve the accuracy of malicious traffic identification, in this embodiment, the target data type of the target traffic data is first determined, and then the identification focus of each of the initial identification models is determined according to the target traffic data of different data types, that is, different from assigning the same weight to the output results of all initial identification models, in the embodiment of the present application, different weights are assigned to the preliminary identification features output by each initial identification model according to different data types, so that those initial identification models that are more suitable for identifying the data type can play a more important role in the final identification result. It should be noted that in some embodiments, the weight values ​​of the output results of each initial identification model corresponding to different data types can be determined in the model training stage. Optionally, the weights of the output results of different initial identification models can be assigned in a performance-based weight allocation method. For example, the performance of each initial identification model can be evaluated using the accuracy rate, that is, for each data type, the accuracy rate of the output results corresponding to each initial identification model is determined, and then the accuracy rate is used as the basis for allocating weights, and the sum of all weights is made 1. In general, the higher the recognition accuracy of a certain initial model for the current data type, the higher the weight assigned to the corresponding output result. Optionally, in some embodiments, in addition to using the model recognition accuracy to judge the performance of the model, the performance evaluation index of the initial recognition module used can be the F1 score, and other performance indicators such as AUC (area under the ROC curve) can also be used, without limitation. The malicious traffic identification method in the power monitoring system provided by the present application obtains the target traffic data to be detected; the target traffic data is respectively input into multiple initial recognition models obtained through training to obtain multiple preliminary recognition features; the multiple preliminary recognition features are input into the malicious traffic recognition model obtained through training to obtain the malicious traffic recognition result corresponding to the target traffic data, and the target traffic data is initially identified by multiple initial recognition models, which not only effectively disperses the deviation that may be generated by a single learner, but also realizes more accurate learning and prediction of complex data through the complementarity between multiple recognition models. Finally, through the malicious traffic recognition model, the preliminary recognition features output by multiple initial recognition models are fused and recognized, which solves the problem of low model generalization and insufficient detection accuracy in single model malicious traffic detection in related technologies.

[0070] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a malicious traffic identification device in a power monitoring system.

[0071] refer to Figure 6 , the malicious traffic identification device in the power monitoring system comprises:

[0072] An acquisition module 201 is used to acquire target flow data to be detected;

[0073] The first recognition module 202 inputs the target flow data into a plurality of trained initial recognition models to obtain a plurality of preliminary recognition features;

[0074] The second identification module 203 inputs the multiple preliminary identification features into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data.

[0075] In some embodiments, the multiple initial recognition models obtained through training include an XGBoost model, an RF model, and a LightGBM model.

[0076] In some embodiments, the second identification module is specifically used to:

[0077] Determining a target data type of the target traffic data;

[0078] Adding a weight value to the preliminary recognition feature output by each of the initial recognition models based on the target data type;

[0079] The preliminary identification features after adding the weight value are input into the malicious traffic identification model to obtain the malicious traffic identification result corresponding to the target traffic data.

[0080] In some embodiments, the malicious traffic identification model is an LR model.

[0081] In some embodiments, the device further comprises a pre-processing module for:

[0082] Digitally encoding the target flow data to obtain the encoded target flow data;

[0083] The encoded target flow data is normalized.

[0084] In some embodiments, the preprocessing module is specifically used to:

[0085] The target flow data is digitally encoded using a one-hot encoding technique.

[0086] In some embodiments, the first identification module is specifically used to:

[0087] Extracting multiple flow characteristics of the target flow data;

[0088] Determining a target flow characteristic from a plurality of flow characteristics based on a preset characteristic type;

[0089] The target flow characteristics are input into the multiple initial recognition models respectively.

[0090] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0091] The malicious traffic identification device in the power monitoring system of the above-mentioned embodiment is used to implement the malicious traffic identification method in the corresponding power monitoring system in any of the above-mentioned embodiments, and has the beneficial effects of the corresponding malicious traffic identification method embodiment in the power monitoring system, which will not be repeated here.

[0092] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for identifying malicious traffic in the power monitoring system described in any of the above embodiments is implemented.

[0093] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0094] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0095] Figure 7 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other in communication within the device through the bus 1050.

[0096] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0097] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0098] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0099] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and the power equipment. The communication module can realize communication through a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WIFI, Bluetooth, etc.).

[0100] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0101] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0102] The electronic device of the above embodiment is used to implement the malicious traffic identification method in the corresponding power monitoring system in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0103] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the malicious traffic identification method in the power monitoring system as described in any of the above embodiments.

[0104] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0105] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the malicious traffic identification method in the power monitoring system as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0106] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments, the present application also provides a computer program product, which includes a computer program. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the malicious traffic identification method in the power monitoring system described in the above-mentioned embodiments. Corresponding to the execution subject corresponding to each step in each embodiment of the malicious traffic identification method in the power monitoring system, the processor that executes the corresponding step may belong to the corresponding execution subject.

[0107] To simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power supply / ground connection with the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the following fact, that is, the details of the implementation of these block diagram devices are highly dependent on the platform to be implemented in the embodiments of the present application (that is, these details should be fully within the scope of understanding of those skilled in the art). In the case of elaborating specific details (e.g., circuit) to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or when these specific details are changed. Therefore, these descriptions should be considered to be illustrative rather than restrictive.

[0108] Although the present application has been described in conjunction with specific embodiments of the present application, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0109] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present application as described above, which are not provided in detail for the sake of simplicity.

[0110] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for identifying malicious traffic in an electric power monitoring system, characterized in that: include: Obtain target traffic data to be detected; Inputting the target flow data into a plurality of initial recognition models obtained through training respectively to obtain a plurality of preliminary recognition features; The multiple preliminary identification features are input into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data.

2. The method according to claim 1, characterized in that: The multiple initial recognition models obtained through training include an XGBoost model, an RF model, and a LightGBM model.

3. The method according to claim 1, characterized in that Inputting the multiple preliminary identification features into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data specifically includes: Determining a target data type of the target traffic data; Adding a weight value to the preliminary recognition feature output by each of the initial recognition models based on the target data type; The preliminary identification features after adding the weight value are input into the malicious traffic identification model to obtain the malicious traffic identification result corresponding to the target traffic data.

4. The method according to claim 1, characterized in that The malicious traffic identification model is an LR model.

5. The method according to claim 1, characterized in that Before respectively inputting the target flow data into a plurality of initial recognition models obtained through training, the method further includes: Digitally encoding the target flow data to obtain the encoded target flow data; The encoded target flow data is normalized.

6. The method according to claim 5, characterized in that The target flow data is digitally encoded, specifically including: The target flow data is digitally encoded using a one-hot encoding technique.

7. The method according to claim 1, characterized in that The target traffic data is input into a plurality of initial recognition models obtained through training, specifically including: Extracting multiple flow characteristics of the target flow data; Determining a target flow characteristic from a plurality of flow characteristics based on a preset characteristic type; The target flow characteristics are input into the multiple initial recognition models respectively.

8. A malicious traffic identification device in an electric power monitoring system, characterized in that: include: An acquisition module is used to acquire target flow data to be detected; A first recognition module, inputting the target flow data into a plurality of trained initial recognition models respectively to obtain a plurality of preliminary recognition features; The second identification module inputs the multiple preliminary identification features into the trained malicious traffic identification model to obtain a malicious traffic identification result corresponding to the target traffic data.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium, characterized in that: The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images