Attack trace identification analysis method based on deep learning

Abstract

The invention discloses an attack trace identification analysis method based on deep learning, and relates to the related technical field of power grids, and the method comprises the steps: extracting a first power grid record at a first time based on a power grid log of a power grid; the activation record decoder sequentially decodes and analyzes the first power grid operation information and the first user behavior information; determining a first mark of first time; when the first mark is an abnormal mark, matching a first category predictor; performing prediction analysis on the first attack trace feature of the power grid; and starting the first attack processing plan to carry out targeted emergency processing. The technical problems that in the prior art, for complex and changeable network attacks, attack traces are difficult to identify and predict accurately in real time, so that emergency processing cannot be responded accurately and rapidly, the power grid anomaly detection efficiency and accuracy are low, and the security risk is high are solved. The technical effects of improving the power grid anomaly detection efficiency and accuracy and reducing the safety risk are achieved.

Description

Technical Field

[0001] The present application relates to the technical field related to electric power grids, and in particular to an attack trace identification and analysis method based on deep learning. Background Art

[0002] With the rapid development of information technology, the power grid, as the infrastructure of modern society, has a vital impact on social life and public safety in terms of security and stability. However, in the process of digitalization and intelligence, the power grid is also facing various security threats from cyberspace. These threats may not only come from external hacker attacks, malware, etc., but also from internal misoperation, poor management and other factors. Therefore, how to effectively identify and analyze attack traces in the power grid and take emergency measures in time has become an important issue to ensure the security of the power grid. Traditional power grid security protection methods mainly rely on static defense measures such as firewalls and intrusion detection systems (IDS). These traditional methods often have problems such as low detection efficiency and high false alarm rate when facing complex and changeable network attacks, resulting in the inability to identify and predict attack traces in real time and accurately, making it impossible to respond quickly to emergency treatment after the attack occurs, increasing the security risk of the power grid.

[0003] At present, there are technical problems in the technologies related to power grid security protection, such as difficulty in real-time and accurate identification and prediction of attack traces in the face of complex and changeable network attacks, which leads to the inability to respond accurately and quickly to emergency situations, resulting in low efficiency and accuracy of power grid anomaly detection and high security risks. Summary of the invention

[0004] This application provides a deep learning-based attack trace identification and analysis method to solve the technical problems in the prior art that it is difficult to identify and predict attack traces in real time and accurately in the face of complex and changeable network attacks, which in turn leads to the inability to respond accurately and quickly to emergency situations, resulting in low efficiency and accuracy in power grid anomaly detection and high security risks. This application achieves the technical effect of improving the efficiency and accuracy of power grid anomaly detection and reducing security risks.

[0005] The present application provides an attack trace identification and analysis method based on deep learning, including: extracting a first grid record at a first time based on a grid log of an electric power grid, the first grid record including first grid operation information and first user behavior information; activating a record decoder to decode and analyze the first grid operation information and the first user behavior information in turn, and obtain a first comprehensive operation index and a first behavior abnormality index, respectively; determining a first mark at the first time according to a first weighted result obtained by weighting the first comprehensive operation index and the first behavior abnormality index; when the first mark is an abnormal mark, introducing an abnormal identification mechanism to determine a first abnormal category at the first time, and matching a first category predictor; predicting and analyzing the first attack trace features of the electric power grid collected in multiple dimensions through the first category predictor, and obtaining a first predicted attack type; and initiating a first attack processing plan of the first predicted attack type to perform targeted emergency processing on the electric power grid.

[0006] In a possible implementation, the deep learning-based attack trace identification and analysis method further performs the following processing: extracting predetermined power grid operation characteristics in the record decoder; traversing and screening the first power grid operation information based on the predetermined power grid operation characteristics to obtain first screening feature parameters; normalizing and weighting the first screening feature parameters to obtain the first comprehensive operation index; wherein the predetermined power grid operation characteristics include power grid flow, response efficiency and operation stability.

[0007] In a possible implementation, the attack trace identification and analysis method based on deep learning also performs the following processing: extracting the predetermined user behavior information under a unit power consumption cycle in the record decoder; comparing the predetermined user behavior information with the analysis of the first user behavior information to obtain a first behavior deviation; determining the first behavior abnormality index based on the first behavior deviation; wherein, before comparing the predetermined user behavior information with the analysis of the first user behavior information, it also includes: performing feature analysis on the predetermined user behavior time series corresponding to the predetermined user behavior information to obtain a predetermined user behavior feature vector; comparing the predetermined user behavior feature vector with the first user behavior feature vector obtained by analyzing the first user behavior information to obtain the first behavior deviation.

[0008] In a possible implementation, the attack trace identification and analysis method based on deep learning also performs the following processing: obtaining a scheduled power usage cycle corresponding to the scheduled user behavior information; dividing the first user behavior information based on the scheduled power usage cycle to obtain a first behavior division result, wherein the first behavior division result includes a first cycle behavior under a first cycle; generating a first power usage behavior time series according to the correspondence between the first cycle and the first cycle behavior; performing feature fusion on the first behavior time domain characteristics and the first behavior frequency domain characteristics to obtain the first user behavior feature vector; wherein, it includes: collecting time domain characteristics of the first power usage behavior time series to obtain the first behavior time domain characteristics; collecting frequency domain characteristics of the first power usage behavior spectrum obtained by fast Fourier transforming the first power usage behavior time series to obtain the first behavior frequency domain characteristics; performing feature fusion on the first behavior time domain characteristics and the first behavior frequency domain characteristics based on the feature fusion principle to obtain the first user behavior feature vector.

[0009] In a possible implementation, the abnormal identification mechanism is embedded with a power grid operation threshold and a user behavior threshold. When the first mark is an abnormal mark, the abnormal identification mechanism is introduced to determine the first abnormal category at the first time, and the following processing is also performed: Step a: Determine whether the first comprehensive operation index meets the power grid operation threshold; Step b1: If it does not meet the requirements, determine that the power grid is a power grid operation abnormality, and match the power grid operation abnormality category set corresponding to the power grid operation abnormality in the power grid attack database; Step c1: Add the power grid operation abnormality category set to the first abnormal category.

[0010] In a possible implementation, the determination of whether the first comprehensive operation index meets the power grid operation threshold also performs the following processing: Step b2: If it does, determine whether the first behavior anomaly index meets the user behavior threshold; Step c2: If it does not, determine that the power grid has user behavior anomalies, and match the user behavior anomaly category set corresponding to the user behavior anomaly in the power grid attack database; Step d2: Add the user behavior anomaly category set to the first anomaly category.

[0011] In a possible implementation, the attack trace identification and analysis method based on deep learning also performs the following processing: obtaining the historical power grid log of the power grid; extracting the first historical power grid record in the historical power grid log; analyzing the first historical power grid operation information and the first historical user behavior information in the first historical power grid record in sequence through the record decoder, and obtaining the first historical comprehensive operation index and the first historical behavior abnormality index respectively; the first historical power grid record also has an identifier of the first historical power grid attack type, and has a first mapping relationship with the first historical comprehensive operation index and the first historical behavior abnormality index; and constructing the power grid attack database based on the first mapping relationship.

[0012] In a possible implementation, the attack trace identification and analysis method based on deep learning further performs the following processing: performing database enhancement processing on the power grid attack database based on the SMOTE algorithm principle.

[0013] Through the attack trace identification and analysis method based on deep learning proposed in this application, the first power grid record at the first time is extracted based on the power grid log of the power grid; the record decoder is activated to decode and analyze the first power grid operation information and the first user behavior information in turn; the first mark at the first time is determined; when the first mark is an abnormal mark, the first category predictor is matched; the first attack trace feature of the power grid is predicted and analyzed; the first attack processing plan is initiated for targeted emergency processing. It solves the technical problem that it is difficult to identify and predict attack traces in real time and accurately in the face of complex and changeable network attacks in the prior art, which leads to the inability to accurately and quickly respond to emergency processing, resulting in low efficiency and accuracy of power grid anomaly detection and high security risks, and achieves the technical effect of improving the efficiency and accuracy of power grid anomaly detection and reducing security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solution of the embodiment of the present invention, the accompanying drawings of the embodiment of the present invention will be briefly introduced below. A flow chart is used in the present application to illustrate the operations performed by the system according to the embodiment of the present application. It should be understood that the preceding or following operations are not necessarily performed accurately in order. On the contrary, various steps can be processed in reverse order or simultaneously as needed. At the same time, other operations can also be added to these processes, or one or more operations can be removed from these processes.

[0015] Figure 1 A flowchart of an attack trace identification and analysis method based on deep learning provided in an embodiment of the present application;

[0016] Figure 2 A schematic diagram of a process for obtaining a first comprehensive operation index in the deep learning-based attack trace identification and analysis method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.

[0018] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0019] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments, but it is understood that "some embodiments" may be the same subset or different subsets of all possible embodiments, and may be combined with each other without conflict, and the terms "first\second" involved are merely to distinguish similar objects and do not represent a specific ordering of objects. The terms "including" and "having" and any variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of this application. The terms used herein are for the purpose of describing the embodiments of the present application only.

[0020] The present application embodiment provides an attack trace identification and analysis method based on deep learning, such as Figure 1 As shown, the method includes:

[0021] Step S100: extracting a first grid record at a first time based on a grid log of the electric power grid, wherein the first grid record includes first grid operation information and first user behavior information.

[0022] Preferably, during the operation of the electric power grid, detailed operation status data and user behavior operation data about the grid at a specific time point (i.e., the first time) are captured and recorded in real time through the grid log, that is, the first grid record at the first time is extracted, including the first grid operation information and the first user behavior information. Specifically, the first grid operation information mainly refers to the operation status and data of the grid at a specific time point (i.e., the first time), including but not limited to voltage and current data, recording the voltage and current values ​​of each circuit, as well as the voltage, current, active and reactive power of the power supply circuit, etc., reflecting the load situation and operation status of the grid; power factor, load rate, calculated and recorded daily average power factor, average load, maximum load, and load rate data, which are helpful to evaluate the energy efficiency and stability of the grid; equipment status, including the operating status of the equipment, the handling of abnormal status, and power outage and power supply time, etc., these data are crucial for monitoring the health of the equipment and taking maintenance measures in a timely manner; grid event records, such as fault events, protection action conditions, etc., these event records are helpful to analyze the failure mode and cause of the grid.

[0023] Preferably, the first user behavior information mainly refers to user operation and behavior data related to the operation of the power grid, which may include user electricity consumption behavior, such as the user's electricity consumption, electricity consumption period, electricity consumption mode, etc., which are helpful to understand the user's electricity demand and habits; user operation records, user operation records in the power grid system, such as switch operation, parameter setting, etc., which can reflect the user's use of the power grid system and possible problems; user feedback and complaints, user feedback and complaint information on power grid services. By extracting and analyzing the first power grid operation information and the first user behavior information at the first time, it is possible to achieve real-time monitoring and evaluation of the power grid status, timely discover and solve potential safety problems, and improve the stability and safety of the power grid.

[0024] Step S200: activating the record decoder to decode and analyze the first power grid operation information and the first user behavior information in sequence, and obtaining a first comprehensive operation index and a first behavior abnormality index respectively.

[0025] Preferably, the activated record decoder decodes and analyzes the first power grid operation information and the first user behavior information in turn, wherein the record decoder is a component for decoding and analyzing record data, and is usually used to decode the input raw data to extract useful features and information. In the field of electric power grids, the record decoder receives raw record data from power grid logs or other data sources, preprocesses the input data (such as denoising, normalization, etc.), uses a deep learning model to decode the preprocessed data, extracts useful features and information, and then extracts key features from the decoded data, such as power grid operation parameters, user behavior patterns, etc. Finally, the extracted features are analyzed, which can timely discover safety hazards and abnormal behaviors in the power grid, generate evaluation indicators such as comprehensive operation index and behavior abnormality index, and use them for further decision-making or prediction.

[0026] Preferably, for the first power grid operation information, the record decoder will perform detailed decoding and analysis on it, usually including parsing various operation parameters of the power grid (such as voltage, current, power factor, etc.), equipment status (such as switch status, transformer temperature, etc.) and power grid events (such as faults, protection actions, etc.). By analyzing this information, the decoder generates a first comprehensive operation index. This index is an indicator for comprehensively evaluating the operation status of the power grid. It takes into account various operation parameters and events of the power grid and can reflect the overall health and stability of the power grid. For the first user behavior information, the record decoder also performs decoding and analysis, including parsing the user's electricity consumption behavior (such as electricity consumption, electricity consumption time period, etc.), operation records (such as switch operation, parameter setting, etc.) and possible user feedback or complaints. By analyzing this information, the decoder generates a first behavior anomaly index. This index is used to evaluate whether there is an abnormality in user behavior, such as abnormal electricity consumption mode, frequent operation errors or improper parameter settings. Abnormal user behavior may indicate potential safety risks or power grid management problems.

[0027] In one possible implementation, Figure 2 As shown, step S200 further includes step S210, extracting the predetermined power grid operation characteristics in the record decoder; step S220, traversing and screening the first power grid operation information based on the predetermined power grid operation characteristics to obtain a first screening characteristic parameter; step S230, normalizing and weighting the first screening characteristic parameter to obtain the first comprehensive operation index; step S240, wherein the predetermined power grid operation characteristics include power grid flow, response efficiency and operation stability.

[0028] Preferably, predetermined grid operation characteristics are extracted from the record decoder. The predetermined grid operation characteristics refer to key indicators that are predetermined and used to evaluate the grid status during the grid operation data analysis process, including grid flow, response efficiency and operation stability. These characteristics can reflect the operation performance of the grid in different aspects. Among them, grid flow refers to the amount of current or electric energy transmitted in the grid, reflecting the load condition and transmission capacity of the grid. Excessive grid flow may cause equipment overload, line heating and other problems, and then cause failures; response efficiency refers to the response speed of the grid to external disturbances or instructions, reflecting the flexibility and control ability of the grid. Fast and accurate response can ensure that the grid can quickly recover to a stable state when a failure occurs or adjustment is required, thereby reducing losses; operation stability refers to the stability of the grid during long-term operation, reflecting the reliability and durability of the grid. Stable grid operation can ensure the continuity and quality of power supply and meet the electricity needs of users.

[0029] Preferably, after extracting the predetermined power grid operation characteristics, the first power grid operation information is traversed and screened to obtain first screening characteristic parameters related to these characteristics, which can more specifically reflect the operation status of the power grid in different aspects. The first screening characteristic parameters are then normalized and weighted to obtain a first comprehensive operation index, that is, the first screening characteristic parameters are normalized to eliminate dimensional differences; and then weighted according to the importance of each parameter to obtain a first comprehensive operation index. This index can provide an important reference for the operation, maintenance and management of the power grid.

[0030] In a possible implementation, step S200 further includes step S240, extracting the predetermined user behavior information under a unit power consumption cycle in the recorded decoder; step S250, comparing the predetermined user behavior information with the analysis of the first user behavior information to obtain a first behavior deviation; step S260, determining the first behavior abnormality index based on the first behavior deviation; wherein, before comparing the predetermined user behavior information with the analysis of the first user behavior information, it also includes: step A100, performing feature analysis on the predetermined user behavior time series corresponding to the predetermined user behavior information to obtain a predetermined user behavior feature vector; step A200, comparing the predetermined user behavior feature vector with the first user behavior feature vector obtained by analyzing the first user behavior information to obtain the first behavior deviation.

[0031] Preferably, the user behavior information in the record decoder is extracted, and the predetermined user behavior information is compared with the actual user behavior information to detect behavior deviations, so as to evaluate the normality of the user's electricity consumption behavior. Specifically, the predetermined user behavior information under the unit electricity consumption cycle in the record decoder is extracted, that is, the expected electricity consumption behavior information preset for the user within a specific time period (such as one day, one week or one month) based on historical data or standard electricity consumption patterns, which may include electricity consumption time period, electricity consumption, electricity load changes, etc.; then, data analysis technology (such as time series analysis, machine learning algorithms, etc.) is used to conduct in-depth analysis of the predetermined user behavior time series, extract key features that can represent the user's electricity consumption behavior, and form predetermined user behavior feature vectors. These feature vectors may include the average value, standard deviation, peak value, valley value, etc. of electricity consumption. values, changing trends, etc.; extracting current or recent user electricity usage behavior information, i.e., first user behavior information, from real-time or historical data, and also using feature analysis technology to extract first user behavior feature vectors; comparing predetermined user behavior information with analyzing the first user behavior information, i.e., comparing the extracted predetermined user behavior feature vectors with the first user behavior feature vectors, and calculating the difference between the two (such as Euclidean distance, cosine similarity, etc.) to obtain a first behavior deviation, which reflects the degree of difference between the actual electricity usage behavior of the user and the expected electricity usage behavior; and determining a first behavior anomaly index according to the size of the first behavior deviation, which is used to evaluate the degree of abnormality of the user's electricity usage behavior. If the first behavior anomaly index exceeds a set threshold, it may indicate that the user's electricity usage behavior is abnormal, and further investigation or measures need to be taken.

[0032] In a possible implementation, step A200 further includes step A210, obtaining a scheduled power usage cycle corresponding to the scheduled user behavior information; step A220, dividing the first user behavior information based on the scheduled power usage cycle to obtain a first behavior division result, wherein the first behavior division result includes a first cycle behavior under a first cycle; step A230, generating a first power usage behavior time series according to the correspondence between the first cycle and the first cycle behavior; step A240, performing feature fusion on the first behavior time domain feature and the first behavior frequency domain feature to obtain the first user behavior feature vector; wherein A240 includes step A241, performing time domain feature collection on the first power usage behavior time series to obtain the first behavior time domain feature; step A242, performing frequency domain feature collection on the first power usage behavior spectrum obtained by fast Fourier transforming the first power usage behavior time series to obtain the first behavior frequency domain feature; step A243, performing feature fusion on the first behavior time domain feature and the first behavior frequency domain feature based on the feature fusion principle to obtain the first user behavior feature vector.

[0033] Preferably, the predetermined user behavior information is extracted from the record decoder or database, and the corresponding predetermined power usage cycle is determined. The predetermined user behavior information is the expected power usage behavior information preset for the user based on historical data or standard power usage patterns. The predetermined power usage cycle is a time period associated with the predetermined user behavior information, which is usually determined based on the user's power usage habits and patterns. Then, the first user behavior information is divided according to the predetermined power usage cycle. The first user behavior information is the current or recent user power usage behavior data. According to the predetermined power usage cycle, the first user behavior information is divided into different time periods or cycles. The power usage behavior data in each time period or cycle constitutes a periodic behavior, i.e., the first behavior division result is obtained; then, each periodic behavior is associated with its corresponding cycle (i.e., time period), a corresponding relationship between the first cycle and the first periodic behavior is established, and each periodic behavior is arranged in chronological order to obtain a first power usage behavior time series; finally, the time domain features of the first behavior and the frequency domain features of the first behavior are feature fused to obtain a first user behavior feature vector.

[0034] Preferably, the time domain feature of the first behavior is a feature obtained by performing time domain analysis on the first power consumption behavior time series, such as average value, standard deviation, peak value, valley value, change trend, etc., which can reflect the overall trend and fluctuation of the user's power consumption behavior and describe the characteristics of the signal changing over time; the frequency domain feature of the first behavior is a spectrum feature obtained by performing fast Fourier transform (FFT) on the first power consumption behavior time series, such as spectrum components, spectrum energy distribution, etc., which reflects the distribution and change of the user's power consumption behavior at different frequencies, wherein the fast Fourier transform (FFT) is an algorithm that converts time domain signals into frequency domain signals, which can convert complex The time domain signal is decomposed into a series of sinusoidal wave components of different frequencies. Specifically, by performing FFT transform on the first power usage behavior time series, its representation in the frequency domain, i.e., the first power usage behavior spectrum, can be obtained. The spectrum shows the energy distribution of the signal at different frequencies. The frequency domain feature is the feature obtained by analyzing the signal in the frequency domain, which describes the characteristics of the signal at different frequencies. Then, based on the feature fusion principle, the time domain feature of the first behavior and the frequency domain feature of the first behavior are fused to obtain the first user behavior feature vector, which contains the comprehensive information of the user's power usage behavior in the time domain and frequency domain, and can more comprehensively describe the user's power usage behavior characteristics.

[0035] Step S300: determining a first marker for the first time according to a first weighted result obtained by weighting the first comprehensive operation index and the first abnormal behavior index.

[0036] Preferably, the first comprehensive operation index and the first behavior abnormality index are weighted to obtain a first weighted result, wherein the weighted processing can assign different weights to different factors according to their importance and influence, so as to obtain a comprehensive evaluation result, and then determine the first mark at the first time according to the first weighted result. Specifically, weighted processing is performed according to the importance and influence of the first comprehensive operation index and the first behavior abnormality index, such as assigning different weight coefficients to the two indexes, and then performing operations such as weighted summation or weighted averaging, wherein the allocation of weights is usually based on historical data, expert experience or the needs of specific application scenarios. The weighted processing obtains a first weighted result, which can be a comprehensive score or index used to reflect the overall state and degree of abnormality of the power grid at the first time point. Finally, a first mark is determined according to the weighted result, and this mark may be a classification label (such as "normal", "abnormal", etc.).

[0037] Step S400: when the first mark is an abnormal mark, an abnormality identification mechanism is introduced to determine a first abnormality category at the first time, and a first category predictor is matched.

[0038] Preferably, when the first mark is an abnormal mark, it means that an abnormal situation has occurred in the operating state or user behavior of the power grid at the first time, and then an abnormal identification mechanism is introduced to determine the specific first abnormal category at the first time, so as to accurately identify the abnormality and take corresponding countermeasures, and match the first category predictor. Specifically, the abnormal identification mechanism is a mechanism for detecting and classifying abnormal situations in the power grid, which can analyze the operating information and user behavior information of the power grid, and determine the specific category of the abnormality based on this information, such as through machine learning and pattern recognition. In the abnormal identification mechanism, multiple abnormal categories are usually defined, such as equipment failure, load abnormality, user behavior abnormality, etc., and each category corresponds to a set of specific features. and patterns. When an abnormal situation is detected, these features are matched with predefined abnormal categories to determine the most likely abnormal category. After determining the first abnormal category, the corresponding first category predictor is matched. The first category predictor is a prediction model used to analyze and predict the characteristics of attack traces in the power grid. It can identify and classify different types of attack features, thereby predicting possible attack types, that is, it can predict the development trend, possible impact, and potential countermeasures of the abnormality based on the operation information of the power grid and the user behavior information. For example, the first category predictor may be constructed based on time series analysis, regression analysis, neural networks, etc., and can extract key features from power grid data and predict future abnormal situations based on these features. By matching the first category predictor, the nature and impact of the abnormality can be understood more accurately, so as to formulate more effective abnormal countermeasures.

[0039] In a possible implementation, step S400 further includes the abnormal identification mechanism being embedded with a power grid operation threshold and a user behavior threshold; step a: determining whether the first comprehensive operation index meets the power grid operation threshold; step b1: if not, determining that the power grid is a power grid operation abnormality, and matching the power grid operation abnormality category set corresponding to the power grid operation abnormality in the power grid attack database; step c1: adding the power grid operation abnormality category set to the first abnormality category.

[0040] Preferably, the abnormal identification mechanism is embedded with two key thresholds, namely, the power grid operation threshold and the user behavior threshold, wherein the power grid operation threshold is the limit of the normal range set for the power grid operation, which is used to evaluate the overall operation state of the power grid, and the user behavior threshold is the limit of the normal range set for the user behavior, which is used to evaluate whether the user's electricity consumption behavior meets expectations. Specifically, it is determined whether the first comprehensive operation index meets the power grid operation threshold, that is, the first comprehensive operation index is evaluated to determine whether it is within the normal range set by the power grid operation threshold. If the first comprehensive operation index does not meet the power grid operation threshold, that is, it exceeds the normal range, then it is determined that the power grid has an abnormal operation, and in the power grid attack database, according to the characteristics of the power grid operation abnormality, the power grid operation abnormality category set corresponding to the matching power grid operation abnormality is searched, wherein the power grid attack database is a database that stores various types of attacks that the power grid may suffer and their corresponding abnormal characteristics. Finally, the power grid operation abnormality category set matched from the power grid attack database is added to the first abnormal category, and the first abnormal category is a set for recording the currently identified power grid operation abnormality category.

[0041] In a possible implementation, step a further includes step b2: if it does, determine whether the first behavior anomaly index meets the user behavior threshold; step c2: if it does not meet, determine that the power grid has user behavior anomaly, and match the user behavior anomaly category set corresponding to the user behavior anomaly in the power grid attack database; step d2: add the user behavior anomaly category set to the first anomaly category.

[0042] Preferably, if the first comprehensive operation index meets the power grid operation threshold, that is, the power grid operation is in a normal state, then it is determined whether the first behavior abnormality index meets the user behavior threshold, that is, the first behavior abnormality index is evaluated to determine whether it is within the normal range set by the user behavior threshold. If the first behavior abnormality index does not meet the user behavior threshold, that is, it exceeds the normal range, then it is determined that user behavior abnormality has occurred in the power grid. The "power grid" here actually refers to the electricity consumption behavior of users in the power grid, because the user's abnormal electricity consumption behavior may affect the stable operation of the power grid, and the power grid attack database is searched for a user behavior abnormality category set corresponding to the current user behavior abnormality. Finally, the user behavior abnormality category set matched from the power grid attack database is added to the first abnormal category. The first abnormal category includes all identified abnormal categories in the current power grid operation and user behavior, which helps to timely identify and handle abnormal situations in user behavior, thereby ensuring the safe and stable operation of the power grid.

[0043] In a possible implementation, step S400 further includes step S410, obtaining a historical power grid log of the power grid; step S420, extracting a first historical power grid record in the historical power grid log; step S430, analyzing the first historical power grid operation information and the first historical user behavior information in the first historical power grid record in sequence through the record decoder to obtain a first historical comprehensive operation index and a first historical behavior abnormality index respectively; step S440, the first historical power grid record also has an identifier of a first historical power grid attack type, and has a first mapping relationship with the first historical comprehensive operation index and the first historical behavior abnormality index; step S450, constructing the power grid attack database based on the first mapping relationship.

[0044] Preferably, historical power grid logs are obtained from the power grid database, that is, detailed records of power grid operation and management over a period of time in the past are obtained, including information such as various states of the power grid, events, and user behaviors, and then a record is randomly extracted from the historical power grid log as a first historical power grid record, including first historical power grid operation information (such as voltage, current, frequency, etc.) and first historical user behavior information (such as power consumption, power consumption time, power consumption mode, etc.), and then the first historical power grid operation information and the first historical user behavior information are analyzed using a record decoder to obtain a first historical comprehensive operation index and a first historical behavior abnormality index, wherein the first historical comprehensive operation index is a comprehensive indicator calculated based on the first historical power grid operation information, which is used to evaluate the operation state of the power grid at a certain point in the past, and the first historical behavior abnormality index is an indicator calculated based on the first historical user behavior information, which is used to evaluate whether the user's power consumption behavior at a certain point in the past is abnormal.

[0045] Preferably, the first historical power grid record also has an identifier of the power grid attack type associated with the first historical power grid record, such as obtaining this identifier from the log record, and there is a mapping relationship between the identifier of the first historical power grid attack type and the first historical comprehensive operation index and the first historical behavior abnormality index, that is, the first mapping relationship. Finally, based on this mapping relationship, a power grid attack database is established to store various attack types that the power grid may suffer and their corresponding abnormal characteristics. Specifically, the identifier of each attack type, the corresponding abnormal characteristics (such as the threshold range of the comprehensive operation index and the behavior abnormality index) and related power grid operation and user behavior information are stored in the database, and have a mapping relationship, which helps to establish the association between power grid attacks and power grid operations and user behaviors, and provide strong support for subsequent abnormality detection and response.

[0046] In a possible implementation, step S450 further includes performing database enhancement processing on the power grid attack database based on the SMOTE algorithm principle.

[0047] Preferably, enhancing the power grid attack database based on the principle of the SMOTE algorithm refers to using the SMOTE algorithm to balance the number of samples of different categories in the database, especially increasing the number of samples of the minority class (i.e., rare or abnormal power grid attack types), thereby improving the representativeness of the database and the generalization ability of the model, wherein the basic idea of ​​the SMOTE (Synthetic Minority Over-sampling Technique) algorithm is to generate new synthetic samples by interpolation in the feature space, thereby balancing the number of samples of different categories. For minority class samples in the power grid attack database, the SMOTE algorithm will find the nearest neighbors of these samples (i.e., samples similar to them), then randomly select a sample from these nearest neighbors, and calculate the difference between them, then multiply this difference by a random number (between 0 and 1) and add it to the original sample to generate a new synthetic sample, and repeat until a sufficient number of synthetic samples are generated to achieve the purpose of database balance.

[0048] Preferably, the step of performing database enhancement processing on the power grid attack database based on the SMOTE algorithm principle specifically includes: preprocessing the power grid attack database, including data cleaning, feature selection, etc., to ensure the quality and availability of the data; determining which categories belong to minority class samples according to the number of samples in the power grid attack database, and then applying the SMOTE algorithm to the minority class samples by using the SMOTE implementation in the machine learning library (such as the imbalanced-learn module in Scikit-learn) to generate new synthetic samples, evaluating the enhanced database to check whether the expected balance effect is achieved, and verifying the quality and effectiveness of the synthetic samples, and finally adding the generated synthetic samples to the power grid attack database to update and enhance the database, improve the representativeness of the database and the generalization ability of the model, thereby improving the detection and prediction model of the power grid attack, and improving the accuracy and reliability of the model.

[0049] Step S500: performing predictive analysis on the multi-dimensionally collected first attack trace features of the electric power grid through the first category predictor to obtain a first predicted attack type.

[0050] Preferably, the first attack trace feature of the multi-dimensionally collected power grid is predicted and analyzed by the first category predictor. Specifically, in the power grid, the attack trace feature may come from multiple dimensions, including but not limited to power grid operation data, user behavior data, network traffic data, security logs, etc. These features may be manifested as abnormal voltage fluctuations, current changes, sudden changes in user power consumption patterns, abnormal increases or decreases in network traffic, warning information in security logs, etc. Through multi-dimensional data collection, the traces of the attack can be captured more comprehensively. First, the attack trace features collected in multiple dimensions are preprocessed, including data cleaning, denoising, normalization and other operations to improve the quality of the data and the accuracy of the prediction, and then the key feature information is extracted from the preprocessed data, and the extracted feature information is input into the first category predictor, and the features are analyzed and predicted by the predictor to obtain the first predicted attack type. The first predicted attack type is a prediction and judgment of potential attacks in the power grid. By predicting the attack type, the security status of the power grid can be timely understood, and corresponding protective measures can be taken to deal with possible attacks, which helps to reduce the impact of attacks on the operation of the power grid and ensure the safe and stable operation of the power grid. In practical applications, the first category predictor can be combined with the security protection system of the power grid to form a complete security protection system. When the predictor predicts a possible attack, the security protection system can immediately initiate corresponding protection measures, such as cutting off the attack path, isolating the affected area, etc., thereby effectively preventing the attack from damaging the power grid.

[0051] Step S600: Initiate a first attack processing plan for the first predicted attack type to perform targeted emergency processing on the power grid.

[0052] Preferably, when a possible attack type (i.e., a first predicted attack type) is predicted by the first category predictor, an emergency response plan corresponding to the attack type is immediately initiated to quickly and effectively respond to and deal with the attack, thereby ensuring the safe and stable operation of the power grid. Specifically, the specific type of attack is confirmed according to the prediction result of the first category predictor. After confirming the attack type, the emergency response plan corresponding to the attack type is immediately initiated, i.e., the first attack response plan, which includes emergency measures and disposal procedures for various possible attack types. Under the guidance of the emergency response plan, corresponding emergency measures are quickly implemented, such as cutting off the attack path, isolating the affected area, starting the backup power supply, adjusting the power grid operation mode, etc., so as to minimize the impact of the attack on the power grid. While executing the emergency measures, the operation status of the power grid is continuously monitored and evaluated, which helps to timely understand the scope and extent of the impact of the attack and the effectiveness of the emergency measures. According to the monitoring and evaluation results, the emergency measures can be adjusted in time to better respond to the attack. When the attack is effectively controlled, the normal operation of the power grid will be gradually restored. At the same time, the entire emergency response process will be summarized and evaluated, and the effectiveness and shortcomings of the emergency measures will be analyzed so that they can be improved and perfected in future security protection work to ensure the safe and stable operation of the power grid.

[0053] The above specific implementation manner does not constitute a limitation to the protection scope of the present application. It should be understood by those skilled in the art that various modifications, combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application. In some cases, the actions or steps recorded in the present application can be performed in an order different from that in the embodiment and can still achieve the desired results. In addition, the process depicted in the accompanying drawings does not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. The attack trace identification and analysis method based on deep learning is characterized by: include: Extracting a first grid record at a first time based on a grid log of the electric power grid, wherein the first grid record includes first grid operation information and first user behavior information; Activate the record decoder to decode and analyze the first power grid operation information and the first user behavior information in sequence to obtain a first comprehensive operation index and a first behavior abnormality index respectively; determining a first marker of the first time according to a first weighted result obtained by weighting the first comprehensive operation index and the first abnormal behavior index; When the first mark is an abnormal mark, an abnormality identification mechanism is introduced to determine a first abnormality category at the first time, and a first category predictor is matched; Performing a predictive analysis on the multi-dimensionally collected first attack trace features of the power grid by using the first category predictor to obtain a first predicted attack type; A first attack handling plan for the first predicted attack type is initiated to perform targeted emergency handling on the power grid.

2. The attack trace identification and analysis method based on deep learning according to claim 1 is characterized in that: include: extracting predetermined power grid operation characteristics in the record decoder; Based on the predetermined power grid operation characteristic, the first power grid operation information is traversed and screened to obtain a first screening characteristic parameter; Normalizing and weighting the first screening feature parameter to obtain the first comprehensive operation index; The predetermined grid operation characteristics include grid flow, response efficiency and operation stability.

3. The attack trace identification and analysis method based on deep learning according to claim 2 is characterized in that: include: Extracting predetermined user behavior information under a unit power usage cycle in the recorded decoder; Comparing the predetermined user behavior information with analyzing the first user behavior information to obtain a first behavior deviation; determining the first behavior abnormality index according to the first behavior deviation; Before comparing the predetermined user behavior information with the analysis of the first user behavior information, the method further includes: Performing feature analysis on the predetermined user behavior time sequence corresponding to the predetermined user behavior information to obtain a predetermined user behavior feature vector; The predetermined user behavior feature vector is compared with a first user behavior feature vector obtained by analyzing the first user behavior information to obtain the first behavior deviation.

4. The attack trace identification and analysis method based on deep learning according to claim 3 is characterized in that: include: Acquire a scheduled power usage cycle corresponding to the scheduled user behavior information; Dividing the first user behavior information based on the predetermined power usage cycle to obtain a first behavior division result, wherein the first behavior division result includes a first cycle behavior in a first cycle; generating a first power usage behavior time sequence according to a correspondence between the first cycle and the first cycle behavior; Performing feature fusion on the first behavior time domain feature and the first behavior frequency domain feature to obtain the first user behavior feature vector; Among them, include: Collecting time domain features of the first electricity usage behavior time series to obtain the time domain features of the first behavior; Collect frequency domain features of a first power usage behavior spectrum obtained by fast Fourier transforming the first power usage behavior time series to obtain frequency domain features of the first behavior; Based on the feature fusion principle, the first behavior time domain feature and the first behavior frequency domain feature are fused to obtain the first user behavior feature vector.

5. The attack trace identification and analysis method based on deep learning according to claim 1 is characterized in that: The abnormality identification mechanism is embedded with a power grid operation threshold and a user behavior threshold. When the first mark is an abnormal mark, the abnormality identification mechanism is introduced to determine the first abnormality category at the first time, including: Step a: determining whether the first comprehensive operation index meets the power grid operation threshold; Step b1: if it does not meet the requirements, the power grid is determined to be abnormal in grid operation, and a grid operation abnormality category set corresponding to the grid operation abnormality is matched in a grid attack database; Step c1: adding the power grid operation abnormality category set to the first abnormality category.

6. The attack trace identification and analysis method based on deep learning according to claim 5 is characterized in that: After step a, the method further comprises: Step b2: If yes, determine whether the first behavior abnormality index meets the user behavior threshold; Step c2: If it does not meet the requirements, the power grid is determined to have abnormal user behavior, and a user behavior abnormality category set corresponding to the abnormal user behavior is matched in the power grid attack database; Step d2: Add the user behavior abnormal category set to the first abnormal category.

7. The attack trace identification and analysis method based on deep learning according to claim 1 is characterized in that: include: Obtaining historical grid logs of the electric power grid; Extracting a first historical power grid record from the historical power grid log; By using the record decoder, the first historical power grid operation information and the first historical user behavior information in the first historical power grid record are analyzed in sequence to obtain a first historical comprehensive operation index and a first historical behavior abnormality index respectively; The first historical power grid record also has an identifier of a first historical power grid attack type, and has a first mapping relationship with the first historical comprehensive operation index and the first historical behavior abnormality index; The power grid attack database is constructed based on the first mapping relationship.

8. The attack trace identification and analysis method based on deep learning according to claim 7 is characterized in that: It also includes performing database enhancement processing on the power grid attack database based on the SMOTE algorithm principle.

Images