Power system network security situation awareness method based on RBF neural network

Abstract

The invention discloses a power system network security situation awareness method based on an RBF neural network, and the method comprises the following steps: building a feature index system, and carrying out the quantification of a security situation value; sample data acquisition and processing: acquiring network communication message data in the electric power industrial control system, and analyzing the message data; carrying out LDA algorithm data preprocessing, and projecting a high-dimensional feature sample to an optimal discriminant vector space by using an optimized linear discriminant analysis algorithm; constructing an RBF neural network model, taking the data matrix subjected to LDA preprocessing as data input of the model, and taking a category or a safety index corresponding to the sample matrix as network output; training an RBF neural network model; testing and verifying the model, inputting test data, verifying whether a test result accords with an expected result, if so, ending training, and if not, continuing training; and model reasoning and result output: taking to-be-processed data as input, and obtaining a corresponding situation awareness result after the to-be-processed data passes through the projection matrix and the RBF neural network model. According to the scheme, a reference basis can be provided for power information network security monitoring.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to a method for realizing network security situation of a power system based on RBF neural network. Background Art

[0002] At present, the development and research of smart grids are becoming more and more intelligent. The open network architecture and diverse power demand make the power system more complex, bringing huge uncertainty to the construction and operation of the power system; at the same time, the security defects of various intelligent information devices in the system increase the operation risk of the power system. Because the network security issues of the information system may not be considered enough during the construction, commissioning and operation of the power grid, under the continuous interaction between information and physical systems, the threats at the information level will cause more serious accidents in the power system.

[0003] With the Internet of Things (IoT) in the construction of power information networks, business forms are becoming more and more complex, and traditional technologies to ensure the security of power information network boundaries can no longer accomplish the task well. Therefore, under the threat of network intrusion attacks, it is of great significance to improve the ability of power system information networks to respond to and defend against attacks. Summary of the invention

[0004] The present invention mainly solves the technical problem of the lack of a method for accurately judging the network security situation of a power system in the prior art, and provides a method for network security situation awareness of a power system based on an RBF neural network. The network security situation awareness is applied to the power information network, and the network raw data is collected and extracted by security equipment and the situation is perceived, which can provide a reference for the security monitoring of the power information network.

[0005] The present invention aims to solve the above technical problems mainly through the following technical solutions: a method for network security situation awareness of power system based on RBF neural network, comprising the following steps:

[0006] S1. Establish a characteristic indicator system to quantify the security situation level and network attack type threat, and evaluate the behavior and network characteristics of the power industrial control system;

[0007] S2. Sample data collection and processing: Collect network communication message data from the power industrial control system, parse and process the message data, and then divide the data into training data and test reasoning data by random sampling; the training data is used for model training, and the test data is used for model evaluation and verification;

[0008] S3, LDA algorithm data preprocessing: Use the optimized linear discriminant analysis (LDA) algorithm to project high-dimensional feature samples into the optimal discriminant vector space and obtain the sample matrix in the optimal projection space;

[0009] The best projection space refers to a low-dimensional space into which high-dimensional feature samples are projected through linear discriminant analysis. The selection of this space is mainly based on the ability to best preserve certain characteristics of the data; the best discriminant space is defined more from the perspective of distinguishing samples of different categories. It is a space in which the differences between different categories can be reflected to the greatest extent, so as to facilitate category distinction; the purpose of the linear discriminant analysis algorithm is to map high-dimensional data to a low-dimensional space while best preserving certain characteristics of the data, so as to better distinguish categories from the characteristics of the data;

[0010] S4, constructing an RBF network model, using the data matrix preprocessed by LDA as the data input of the model, and the category or security index corresponding to the sample matrix as the network output;

[0011] S5. Training the RBF network model: input training sample data. When a certain network error is met, the training ends, that is, the mapping relationship between the input data and the network security situation value is found;

[0012] S6, model testing and verification: according to the network security situation value mapping relationship obtained in the learning process of step S5 above, the test data is used as input, and the corresponding situation awareness result is obtained after the projection matrix and RBF neural network model; if the test result meets the requirements, the model training ends, otherwise the training continues;

[0013] S7, model reasoning and result output: The data to be analyzed is used as the input of the trained model, and after the projection matrix and RBF neural network model, the corresponding situation awareness results are obtained.

[0014] Preferably, in step S1, establishing a characteristic index system comprises the following steps:

[0015] S11. Constructing network security situation level: Based on the national standard GB / T20984-2007 and the national emergency plan for public emergencies, the overall network situation value is defined into five assessment categories, namely safe, mild risk, general risk, medium risk, and high risk, to quantify the security situation value and evaluate its system behavior and network characteristics;

[0016] S12. Quantification of threat values ​​of network attack types: Quantify the value of network attack type events according to the severity of the harm, such as common port monitoring and scanning, illegal attempts to log in to the host, denial of service attacks, illegal acquisition of host or administrator permissions, and conduct threat assessment and value quantification according to the network security situation level.

[0017] Preferably, in step S2, the sample data acquisition and processing includes the following steps:

[0018] S21. Acquisition of sample data: monitoring the power industry control system and capturing the communication message data of all elements in the network communication process of the power industry control system;

[0019] S22, sample data processing: parsing the collected original network communication message data, and obtaining characteristic information in the message data by parsing layer by layer from bottom to top according to the seven-layer OSI model of network communication;

[0020] The message data characteristic information includes timestamp, message length, source and destination addresses, source and destination ports, message version number, identifier, data offset, check code, sequence number, confirmation number, check code and protocol.

[0021] Subsequently, the collected network behavior data needs to be divided into training data and test data, and a random sampling method can be selected to distinguish the data.

[0022] Preferably, in step S3, the optimized LDA algorithm data preprocessing includes the following steps:

[0023] The total number of samples in the sample training set and the test set is n, the total number of features collected is d, and the sample matrix X∈R d×n There are c categories in , and the specific steps are as follows:

[0024] S31: Data preprocessing: Calculate the mean and standard deviation of each feature. For the jth feature, the mean is The standard deviation is where x ij is the i-th sample x i The jth feature of This makes the mean of each feature 0 and the standard deviation 1, which helps improve the stability and convergence speed of the algorithm;

[0025] S32. Calculate the intra-class scatter matrix S W and inter-class divergence S B :First, calculate the mean vector of the class. There are c categories in the data sample set, and its sample set is X k ={x i |y j =k},y j is the category label of the i-th sample, and calculates the mean vector of category k n k is the number of samples in category k; the intra-class scatter matrix measures the dispersion of data within each category, and the calculation formula is:

[0026]

[0027] Specifically, for each category k, calculate each sample x in that category i and the category mean μ k Then multiply these difference vectors by the transpose and sum them, and finally sum them over all categories to get S W ;

[0028] The inter-class divergence matrix S B It measures the degree of separation between different categories and is calculated as follows: is the mean vector of all samples;

[0029] That is, for each category k, calculate the category mean μ k The difference from the population mean μ, then multiply it by its own transpose, and then multiply it by the number of samples n in class k k , and finally sum all categories to get S B ;

[0030] S33. Find the optimal projection vector: The goal of linear discriminant analysis is to find an optimal discriminant projection vector W so that the objective function value is maximized. The main significance is to maximize the inter-class variance relative to the intra-class variance in the projected space to achieve the best classification effect. The traditional objective function is:

[0031]

[0032] The objective function of the regularized linear discriminant analysis method is optimized as:

[0033]

[0034] Where λ is the regularization parameter and W is the projection vector. When λ = 0, it degenerates into the traditional linear discriminant analysis. As λ increases, the complexity of the model is more restricted, which helps to prevent overfitting.

[0035] The principle of linear discriminant analysis (LDA) is to project high-dimensional feature samples into the optimal discriminant vector space to achieve the effect of extracting classification information and compressing the dimension of feature space. However, when the number of training samples in each category is small, the LDA method has a serious overfitting problem. Due to the large amount of power system network data and the many and complex features, this scheme designs a regularized linear discriminant analysis method based on mean and standard deviation. First, the data is preprocessed using the mean and standard deviation to improve the stability and convergence speed of the algorithm, and then the regularized linear discriminant analysis method is used for classification extraction and compression of feature space, which solves the overfitting problem of linear discriminant analysis.

[0036] Since the input layer and hidden layer of the RBF neural network are nonlinear activation functions, and the hidden layer to the output is linear, when designing the network structure, if the number of hidden nodes and basis functions can be properly set, the nonlinear problem can be converted into a linear problem for solution.

[0037] Preferably, in step S4, constructing the RBF network model includes the following steps:

[0038] There are p training sample sets X={X 1 ,X 2 ,...,X p}; Y p ={Y1,Y2,...,Y p} is the output layer training sample X p The corresponding expected output; is the basis function of the jth hidden node, c j ={c j1 ,c j2 ,...,c jm} T is the center vector of the jth hidden node basis function, y p ={y1,y2,...,y m} is the output value of the neural network, and the total error function J is expressed as:

[0039]

[0040] The RBF neural network consists of three layers: input layer, hidden layer, and output layer. Each layer has multiple nodes. j represents the jth hidden node; X = {X 1 ,X 2 ,...,X p} represents the sample data set, that is, the sample matrix, with p sample data, X 1 Represents the first sample data, and so on; Y p ={Y1,Y2,...,Y p} represents the expected output of the training sample in the output layer, Y1 represents the expected output of the first sample, and so on; the total error function mainly calculates the mean square error between the actual output value and the expected output value, and the purpose is to minimize this difference by adjusting the parameters of the network (such as the hidden layer center, width, output layer weight, etc.);

[0041] The RBF learning algorithm process is mainly divided into two steps: first, use the unsupervised learning algorithm to find the center vector of the hidden layer node, and then use the supervised learning algorithm to determine the weights and thresholds of each layer. The specific process is as follows: S41, cluster the collected data samples to find the center vector of the node function. The algorithm steps are as follows:

[0042] S411, determine the following parameters: the basis function center value c of the hidden layer node j (0), (j=1,2,...,k), function limit value ε and learning rate β(0);

[0043] c j (0) represents the initial cluster center. K nodes can be randomly selected from the sample as the center node, and k represents the number of hidden layer nodes.

[0044] The function limit value ε is a parameter that controls the convergence of cluster centers. It can be calculated by calculating the difference between the sum of the Euclidean distances of all center nodes in this iteration and the sum of the Euclidean distances of all center nodes in the previous iteration. When the difference is less than the limit value, the iteration is stopped.

[0045] The learning rate is used to calculate the cluster center nodes and plays a role in controlling the update step size, so as to avoid the cluster center failing to converge due to too large an update step size or converging too slowly due to too small an update step size.

[0046] S412, calculate the Euclidean distance d between each sample and all center points by the following formula i (t), find the point γ (1≤γ≤k) that is closest to the center point for each sample:

[0047] d i (t)=||x(t)-c i (t-1)||,(i=1,2,...,k),

[0048] d min (t) = min d i (t) = d γ (t),

[0049] x(t) represents the data sample, k represents the number of hidden layer nodes, and the above formula mainly calculates the Euclidean distance between each sample and the center point, and finds the nearest center point of each sample;

[0050] S413, use the following formula to find the cluster center again:

[0051] c i (t) = c i (t-1)+β(t)[x(t)]-c γ (t-1),

[0052] t represents the current iteration, and t-1 represents the previous iteration;

[0053] S414, using the sample to calculate at the nodes of the hidden layer, the learning rate is further corrected and the center of the sample is updated by the following formula:

[0054]

[0055] Where: β(t) (0≤β(t)≤1) is the learning rate, int(t / a) is the rounding function; the final ci(t) is the sample center c j , represents the sample center of the i-th hidden layer after the t-th iteration;

[0056] a is a constant that controls the change in learning rate, which usually changes according to the size of the dataset;

[0057] S42, supervised learning: train the cj obtained in the previous step, and change the network weights of the hidden layer and the output layer appropriately. The activation function of this layer is a linear function, so when adjusting, it is equivalent to linear optimization using the recursive least squares (RSL) algorithm to correct the weights. The specific steps are as follows:

[0058] S421, determine the objective function, the formula is as follows:

[0059]

[0060] Where: Λ(p) is the weighting factor matrix;

[0061] S422: Calculate the weight estimate using the following formula to minimize the value of J:

[0062]

[0063] S423, solve the weight, use RSL to perform weight recursion, the formula is as follows:

[0064]

[0065] Where: jk (t) is the connection weight between the hidden and output layers; is the hidden layer output vector; is the output value of the kth node; k(t) is the gain vector, which is used to adjust the weight estimation according to the sample information. Represents the input layer and implicit network weight values ​​of the last iteration.

[0066] Preferably, in step S5, training the RBF network model includes the following steps:

[0067] For the constructed RBF network model, input the training sample data, repeatedly execute the constructed RBF network model, update the weight value, and when the objective function value is less than the set threshold, the training ends, that is, the mapping relationship with the network situation value is found.

[0068] Preferably, in step S7, model reasoning and result output includes the following steps:

[0069] The data to be analyzed is taken as input, and after the projection matrix and RBF neural network model, the corresponding situation awareness result value is obtained. The current data network security level is determined according to the network security attack type, the quantitative value of the network security type threat event and the network security situation level.

[0070] The present invention performs network security situation awareness and intrusion attack security risk assessment while being familiar with the security configuration of the power system and the relationship between its internal network, models the intrusion path of network attacks and quantifies the impact of attacks on the power grid, and uses machine learning methods to classify and identify network security situations and quantitatively assess situation values, helping system staff to monitor the operation status of the power grid and perceive system network risks under the condition of information fusion, so as to ensure the safe and stable operation of the power grid.

[0071] The substantial effect brought by the present invention is that, in view of the current intelligent and open architecture environment of the power system, the traditional means of network attack detection can no longer meet the needs. The present invention proposes a power information network security situation awareness system framework. In the security situation module, the LDA-RBF algorithm is proposed, and the optimized LDA is used to optimize the characteristic indicators of the sample data to obtain the best projection, so that the sample has the best separability. Then the RBF neural network is used to obtain an accurate network security situation. Simulation verification and comparative experiments are carried out to prove the superiority of the method proposed in this article, which can realize network security situation awareness more efficiently and accurately, and effectively solve the problem of difficult network attack detection in the power system environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 It is a flow chart of a method for electric power system network security situation awareness based on RBF neural network of the present invention;

[0073] Figure 2 It is a RBF network model architecture diagram of the present invention;

[0074] Figure 3 It is a data collection deployment diagram of the present invention. DETAILED DESCRIPTION

[0075] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0076] Embodiment: A method for power system network security situation awareness based on RBF neural network, such as Figure 1 As shown, the specific process includes the following steps:

[0077] S1. Establish a characteristic indicator system to quantify the security situation level and network attack type threat, and evaluate its system behavior and network characteristics.

[0078] S2. Sample data collection and processing: collect network communication message data from the power industrial control system, parse and process the message data, and then divide the data into training data and test inference data by random sampling.

[0079] S3, LDA algorithm data preprocessing, use the optimized linear discriminant analysis (LDA) algorithm to project high-dimensional feature samples into the optimal discriminant vector space, and obtain the sample matrix in the optimal projection space.

[0080] S4. Construct an RBF network model, use the data matrix preprocessed by LDA as the data input of the model, and the category or security index corresponding to the sample matrix as the network output.

[0081] S5. Train the RBF network model and input the training sample data. When a certain network error is met, the training ends, that is, the mapping relationship with the network situation value is found.

[0082] S6. Model testing and verification: Based on the network security situation value mapping relationship obtained in the learning process of step S5 above, the test data is used as input, and the corresponding situation awareness result is obtained after the projection matrix and RBF neural network model; if the test result meets the requirements, the model training is terminated, otherwise the training continues.

[0083] S7, model reasoning and result output, according to the network security situation value mapping relationship found in the above step S5, then use the test data as input, and after the projection matrix and RBF neural network model, obtain the corresponding situation awareness result.

[0084] Step S1 is mainly divided into two steps: establishing a network security situation level and quantifying network attack type threat events. The quantification of network attack type threat events is mainly to quantify the threat of network attack types according to the severity of the network attack types. After quantification, the value can correspond to the network security situation level table.

[0085] Establish a network security situation level, and establish the network security situation level rules as follows: refer to the national standard GB / T20984-2007 and the national emergency plan for public emergencies. The present invention defines the overall network situation value into 5 evaluation categories, quantifies the security situation value, and evaluates its system behavior and network characteristics, as shown in the following table:

[0086]

[0087] Table 1 Network security situation level table

[0088] Building a reasonable and accurate security assessment indicator system is the basis for situation perception. Before conducting security situation perception, it is necessary to quantify the network security situation value to a certain extent.

[0089] According to the degree of verification of the network attack type, the threat value of the network attack event is quantified as follows:

[0090] The network behavior determines the type of attack it is subject to and the security level it is in. The greater the threat to the network, the higher the network security situation value.

[0091] The network attack types of this embodiment mainly include 4 categories, and threat values ​​are set for them. When this type of attack is detected, the attack threat of the network is assigned a value, as shown in the following table.

[0092] Threat Events Threat none 0 Port monitoring and scanning 0.2 Illegal attempt to log in to the host 0.4 Conduct a denial of service attack 0.6 Illegal access to host or administrator privileges 0.8

[0093] Table 2 Quantitative value of threat events

[0094] When conducting experimental training data, this scheme determines the network threat value based on the different types of attacks the network is subjected to and then makes a subjective assessment of network security to determine whether it exists in a certain network security level category.

[0095] In step S2, the sample data is collected by collecting message data during the communication process of the industrial control system.

[0096] Monitor the power industry control system and capture the full-factor protocol communication message data during the network communication of the power industry control system;

[0097] The present invention uses experimental data of the power information network environment provided by a domestic power company for experimental verification. There are 7 types of network behaviors collected, as shown in Table 3 below:

[0098]

[0099] Table 3 Power information network attack behavior categories

[0100] The processing of sample data is to parse and collect the original network communication protocol message data, analyze the communication protocol message data, and determine the power system related information corresponding to the protocol message.

[0101] According to the OSI seven-layer model of network communication, the characteristic information in the message data is obtained by parsing layer by layer from bottom to top.

[0102] The message data characteristic information includes timestamp, message length, source and destination addresses, source and destination ports, message version number, identifier, data offset, check code, sequence number, confirmation number, check code, protocol and other information.

[0103] There are numerical and non-numerical types in feature information, but this model can only process numerical types, so they need to be converted into numerical values. For example, the protocol attribute values ​​in the feature type include udp, tcp, and icmp, which are assigned values ​​of 1, 2, and 3 respectively.

[0104] At the same time, the 7 types of network behavior data collected need to be divided into training data and test data. This solution selects random sampling to distinguish the data.

[0105] In step S3, the LDA algorithm data preprocessing is to use the optimized linear discriminant analysis (LDA) algorithm to project the high-dimensional feature samples into the optimal discriminant vector space.

[0106] The principle of linear discriminant analysis (LDA) is to project high-dimensional feature samples into the optimal discriminant vector space to achieve the effect of extracting classification information and compressing the dimension of feature space. However, when the number of training samples in each category is small, the LDA method has a serious overfitting problem. Due to the large amount of power system network data and the many and complex features, this scheme designs a regularized linear discriminant analysis method based on mean and standard deviation. First, the data is preprocessed using the mean and standard deviation to improve the stability and convergence speed of the algorithm, and then the regularized linear discriminant analysis method is used for classification extraction and compression of feature space, which solves the overfitting problem of linear discriminant analysis.

[0107] Assume that the total number of samples in the sample training set and the test set is n, the total number of features collected is d, and the sample matrix X∈R d×n There are c categories in . The specific steps are as follows:

[0108] (1) Data preprocessing: Calculate the mean and standard deviation of each feature. For the jth feature, the mean is The standard deviation is where x ij is the jth feature of the i-th sample. Then each feature is normalized to This makes the mean of each feature 0 and the standard deviation 1, which helps improve the stability and convergence speed of the algorithm.

[0109] (2) Calculate the intra-class scatter matrix S W and inter-class divergence S B First, we need to calculate the mean vector of the class. There are c categories in the data sample set, and its sample set is X k ={x i |y j =k}, calculate the mean vector of category k The intra-class scatter matrix measures the dispersion of data within each class, and the calculation formula is:

[0110]

[0111] Specifically, for each category k, calculate each sample x in that category i and the category mean μ k Then multiply these difference vectors by the transpose and sum them, and finally sum them over all categories to get S W .

[0112] The inter-class scatter matrix S B It measures the degree of separation between different categories. First, the mean vector of all samples is calculated. Then calculate the intra-class divergence, the calculation formula is as follows:

[0113]

[0114] That is, for each category k, calculate the category mean μ k The difference from the population mean μ, then multiply it by its own transpose, and then multiply it by the number of samples n in class k k , and finally sum all categories to get S B .

[0115] (3) Finding the optimal projection vector. The goal of linear discriminant analysis is to find an optimal discriminant projection vector. The main significance is to maximize the inter-class variance relative to the intra-class variance in the projected space and achieve the best classification effect. The traditional objective function is:

[0116]

[0117] The objective function of the regularized linear discriminant analysis method can be optimized as:

[0118]

[0119] Where λ is the regularization parameter. When λ = 0, it degenerates into traditional linear discriminant analysis. As λ increases, the complexity of the model is more restricted, which helps to prevent overfitting.

[0120] In step S4, after the RBF network model is constructed, the data matrix preprocessed by LDA is used as the data input of the model, and the category or security index corresponding to the sample matrix is ​​used as the network output. The construction process is:

[0121] Since the input layer and hidden layer of the RBF neural network are nonlinear activation functions, and the hidden layer to the output is linear, when designing the network structure, if the number of hidden nodes and basis functions can be properly set, the nonlinear problem can be converted into a linear problem for solution.

[0122] Assume there are p training sample sets X = {X 1 ,X2 ,...,X p}:{Y1,Y2,...,Y n} is the output layer training sample X p The corresponding expected output φ j (||xc j ||) is the basis function of the jth hidden node: c j ={c j1 ,c j2 ,...,c jm} T is the center vector of the implicit node basis function: y p ={y1,y2,...,y m} is the output value. The total error function J is expressed as:

[0123]

[0124] The RBF learning algorithm process is mainly divided into two steps: first, use the unsupervised learning algorithm to find the center vector of the hidden layer node, and then use the supervised learning algorithm to determine the weights and thresholds of each layer. The specific process is as follows:

[0125] Step 1: Perform cluster analysis on the collected data samples to find the central vector of the node function. This article uses the most commonly used K-means algorithm. The algorithm steps are as follows:

[0126] (1) Determine the parameters: the basis function center value cj(0) of the hidden layer nodes, (j=1,2,...,k), the function limit value ε and the learning rate β(0);

[0127] (2) Calculate the Euclidean distance between the sample data and the center value using the following formula, and then find the nearest point γ (1≤γ≤k):

[0128] d i (t)=||x(t)-c i (t-1)||,(i=1,2,...,k),

[0129] d min (t) = min d i (t) = d γ (t),

[0130] (3) Use the following formula to calculate the cluster center again.

[0131] c i (t) = c i (t-1)+β(t)[x(t)]-c γ (t-1),

[0132] (4) Using the sample at the nodes of the hidden layer to perform calculations, the learning rate is further modified and the center of the sample is updated using the following formula:

[0133]

[0134] Where: β(t) (0≤β(t)≤1) is the learning rate, int(t / a) is the rounding function.

[0135] Step 2: Supervised learning. j Training is performed, and the network weights of the hidden layer and the output layer are appropriately changed. The activation function of this layer is a linear function, so when adjusting, it is equivalent to linear optimization using the recursive least squares (RSL) algorithm to modify the weights. The specific steps are as follows:

[0136] (1) Determine the objective function as follows:

[0137]

[0138] Where: Λ(p) is the weighting factor matrix.

[0139] (2) Use the following formula to calculate the estimated value of the weight, so that the value of J is minimized:

[0140]

[0141] (3) To solve the weight, use RSL to perform weight recursion, as follows:

[0142]

[0143]

[0144] Where: jk (t) is the connection weight between the hidden and output layers; is the hidden layer output vector; is the output value of the kth node.

[0145] In step S5, the RBF neural network model is trained as follows:

[0146] For the constructed RBF network model, input the training sample data, repeatedly execute the constructed RBF network model, update the weight value, and when a certain network error is met, the training ends, that is, the mapping relationship with the network situation value is found.

[0147] In step S6, model reasoning and result output are specifically as follows:

[0148] After taking the test data as input, the corresponding situation awareness result value is obtained after the projection matrix and RBF neural network model, and then the current data network security level is determined according to the network security attack type, the quantitative value of the network security type threat event, and the network security situation level.

[0149] At the same time, this embodiment also further evaluates the performance of the algorithm. This embodiment adopts the false negative rate and false positive rate calculation method. Assuming that the normal type of records are positive samples, other types are negative samples. The false negative rate (FNR) and false positive rate (FPR) can be used as the evaluation indicators of the algorithm performance. The formula is as follows:

[0150]

[0151] The false positive rate (FNR) and false positive rate (FPR) in the above formula as well as the recognition rates of each type are used as evaluation indicators of algorithm performance.

[0152] Table 4 shows the recognition accuracy and overall recognition rate of each network behavior. The overall recognition rate is 94%, and the recognition rates of each category are around 90%, achieving the expected results.

[0153]

[0154] Table 4 Recognition rate of various network behaviors

[0155] The following table compares the LDA-RBF algorithm of the present invention with the RBF neural network. It can be seen that compared with other algorithms, the method proposed in this paper has great advantages, especially in the first three types of samples. Since port scanning and the like have very little impact on network traffic before the next step of intrusion attack, they are generally difficult to identify. The method in this paper adds LDA to preprocess the sample data and effectively fuses feature indicators according to the sample category, so that the samples have the best separability.

[0156]

[0157] Table 5 Comparison of experimental results

[0158] like Figure 2 The figure shows the RBF network model architecture diagram of this embodiment.

[0159] RBF neural network belongs to feedforward neural network, which includes three layers: input, hidden and output. The input layer is used to obtain feature sample sets; the hidden layer trains the input feature samples and changes parameters according to the training error. The specific number of nodes needs to be determined by the actual problem requirements; the output layer is the output result corresponding to the solution of the input problem.

[0160] RBF neural network has strong nonlinear learning ability. Its input layer enters the hidden layer through nonlinear transformation, which can change some problems from linear inseparable to linear separable. Since RBF is a neural network that can respond locally, as long as there is data input, the hidden nodes will be activated. As long as enough neurons are set, any single-valued continuous function can be approximated with any accuracy.

[0161] In a specific environment, different network structures can be set according to the actual situation of the problem. Since RBF has strong adaptability, even with only a small number of neurons, it can achieve satisfactory approximation effects for discontinuous and continuous functions. Compared with BP neural network, RBF has a faster learning rate, more accurate approximation ability and better processing efficiency. Due to these advantages, it is widely used in image recognition, regression prediction, pattern recognition and other problems.

[0162] like Figure 3 Shown is a data collection deployment diagram of a power system network security situation awareness method based on RBF neural network in this embodiment.

[0163] This embodiment uses the power information network environment provided by a domestic power company for deployment and collection. The figure illustrates a method of deployment and collection based on switch mirroring. The switch mirroring collection method can achieve the characteristics of non-intrusion to the original power industrial control system. The mirror port of the switch has the characteristics of only output but no input and full replication. The collected data can fully reflect the business traffic characteristics in the power monitoring system.

[0164] The data flow after collection mainly includes two modules: data collector and situation awareness server. Their specific functions are as follows:

[0165] Data collector: This module is mainly used to collect network communication message flow data in the power industrial control system, and forward the mirrored data to the situation awareness server through the switch mirror port.

[0166] Situation awareness server: This module mainly receives network message data from the data collector and aggregator, and performs configuration analysis on the message data to parse out the relevant characteristic information of the power system in the message. The characteristic information mainly includes basic message data information, process parameter measurement data information, and process operation instruction information. Then, the LDA-RBF network model is tested and trained on the analyzed experimental sample data to obtain the corresponding situation awareness results, and the results are analyzed.

[0167] The specific embodiments described herein are merely examples of the spirit of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in similar ways, but they will not deviate from the spirit of the present invention or exceed the scope defined by the appended claims.

[0168] Although this article uses more terms such as characteristic index system and sample matrix, it does not exclude the possibility of using other terms. These terms are used only to more conveniently describe and explain the essence of the present invention; interpreting them as any additional restrictions is contrary to the spirit of the present invention.

Claims

1. A method for power system network security situation awareness based on RBF neural network, characterized in that: The following steps are involved: S1. Establish a characteristic indicator system to quantify the security situation level and network attack type threat, and evaluate the behavior and network characteristics of the power industrial control system; S2. Sample data collection and processing: Collect network communication message data in the power industrial control system, parse and process the message data, and then divide the data into training data and test inference data by random sampling; S3, LDA algorithm data preprocessing: Use the optimized linear discriminant analysis algorithm to project high-dimensional feature samples into the optimal discriminant vector space and obtain the sample matrix in the optimal projection space; S4, constructing an RBF network model, using the data matrix preprocessed by LDA as the data input of the model, and the category or security index corresponding to the sample matrix as the network output; S5. Training the RBF network model: input training sample data. When a certain network error is met, the training ends, that is, the mapping relationship between the input data and the network security situation value is found; S6, model testing and verification: according to the network security situation value mapping relationship obtained in the learning process of step S5 above, the test data is used as input, and the corresponding situation awareness result is obtained after the projection matrix and RBF neural network model; If the test results meet the requirements, the model training ends, otherwise the training continues; S7, model reasoning and result output: The data to be analyzed is used as the input of the trained model, and after the projection matrix and RBF neural network model, the corresponding situation awareness results are obtained.

2. A method for electric power system network security situation awareness based on RBF neural network according to claim 1, characterized in that: In step S1, establishing a characteristic index system includes the following steps: S11. Constructing network security situation level: Based on the national standard GB / T20984-2007 and the national emergency response plan for public emergencies, the overall network situation value is defined into five assessment categories, namely safe, mild risk, general risk, medium risk, and high risk; S12. Quantification of threat values ​​of network attack types: Quantify the types of network attack events according to the severity of the harm, and conduct threat assessment and quantification based on the network security situation level.

3. The method for power system network security situation awareness based on RBF neural network according to claim 1 is characterized in that: In step S2, sample data acquisition and processing includes the following steps: S21. Acquisition of sample data: monitoring the power industry control system and capturing the communication message data of all elements in the network communication process of the power industry control system; S22, sample data processing: parsing the collected original network communication message data, and obtaining characteristic information in the message data by parsing layer by layer from bottom to top according to the seven-layer OSI model of network communication; The message data characteristic information includes timestamp, message length, source and destination addresses, source and destination ports, message version number, identifier, data offset, check code, sequence number, confirmation number, check code and protocol.

4. The method for power system network security situation awareness based on RBF neural network according to claim 1 is characterized in that: In step S3, the optimized LDA algorithm data preprocessing includes the following steps: The total number of samples in the sample training set and the test set is n, the total number of features collected is d, and the sample matrix X∈R d×n There are c categories in , and the specific steps are as follows: S31: Data preprocessing: Calculate the mean and standard deviation of each feature. For the jth feature, the mean is The standard deviation is where x ij is the i-th sample x i The jth feature of S32. Calculate the intra-class scatter matrix S W and inter-class divergence S B :First, calculate the mean vector of the class. There are c categories in the data sample set, and its sample set is X k ={x i |y i =k},y i is the category label of the i-th sample, and calculates the mean vector of category k n k is the number of samples in category k; the intra-class scatter matrix calculation formula is: The inter-class scatter matrix S B The calculation formula is: is the mean vector of all samples; S33. Find the optimal projection vector: The objective function of the regularized linear discriminant analysis method is: Where λ is the regularization parameter and W is the projection vector.

5. A method for electric power system network security situation awareness based on RBF neural network according to claim 4, characterized in that: In step S4, constructing the RBF network model includes the following steps: There are p training sample sets X={X 1 ,X 2 ,…,X p }; Y p ={Y1,Y2,…,Y p } is the output layer training sample X p The corresponding expected output; is the basis function of the jth hidden node; c j ={c j1 ,c j2 ,…,c jm } T is the center vector of the jth hidden node basis function; y p ={y1,y2,…,y m } is the output value of the neural network; the total error function J is expressed as: The RBF learning algorithm process is mainly divided into two steps: first, use the unsupervised learning algorithm to find the central vector of the hidden layer node, and then use the supervised learning algorithm to determine the weights and thresholds of each layer. The specific process is as follows: S41, cluster the collected data samples to find the central vector of the node function. The algorithm steps are as follows: S411, determine the following parameters: the basis function center value c of the hidden layer node j (0), (j=1,2,…,k), function limit value ε and learning rate β(0); S412. Calculate the Euclidean distance between each sample and all center points by the following formula, and find the point γ (1≤γ≤k) that is closest to each sample and the center point: d i (t)=||x(t)-c i (t)||,(i=1,2,...,k), d min (t)=mind i (t)=dγ(t), x(t) represents the data sample, k represents the number of hidden layer nodes; S413, use the following formula to find the cluster center again: c i (t)=c i (t-1)+β(t)[x(t)]-cγ(t-1), t represents the current iteration, and t-1 represents the previous iteration; S414, using the sample to calculate at the nodes of the hidden layer, the learning rate is further corrected and the center of the sample is updated by the following formula: Where: β(t) (0≤β(t)≤1) is the learning rate, int(t / a) is the rounding function; a is a constant that controls the change of the learning rate; the final c i (t) is the sample center c j ; S42, supervised learning: c obtained in the previous step j Conduct training and appropriately change the network weights of the hidden layer and output layer. The specific steps are as follows: S421, determine the objective function, the formula is as follows: Where: Λ(p) is the weighting factor matrix; S422: Calculate the weight estimate using the following formula to minimize the value of J: S423, solve the weight, use RSL to perform weight recursion, the formula is as follows: Where: v jk (t) is the connection weight between the hidden and output layers; is the hidden layer output vector; is the output value of the kth node; k(t) is the gain vector, Represents the input layer and implicit network weight values ​​of the last iteration.

6. A method for electric power system network security situation awareness based on RBF neural network according to claim 1 or 5, characterized in that: In step S5, training the RBF network model includes the following steps: inputting training sample data for the constructed RBF network model, repeatedly executing the constructed RBF network model, updating the weight value, and ending the training when the objective function value is less than the set threshold, that is, finding the mapping relationship with the network situation value.

7. The method for power system network security situation awareness based on RBF neural network according to claim 1 is characterized in that: In step S6, model reasoning and result output includes the following steps: The data to be analyzed is taken as input, and after the projection matrix and RBF neural network model, the corresponding situation awareness result value is obtained. The current data network security level is determined according to the network security attack type, the quantitative value of the network security type threat event and the network security situation level.

Images