Power grid flow data anomaly detection method and device based on multi-mode self-supervised learning

Abstract

The embodiment of the invention provides a power grid flow data anomaly detection method and device based on multi-mode self-supervised learning, and the method comprises the steps: determining a first flow feature representation vector of each training power grid flow data included in a training data set based on a first network model which is trained in advance, the first network model is a model obtained by training based on a label-free power grid flow data set; inputting the first traffic feature representation vector into an initial multi-layer perceptron and an output layer to obtain a second traffic feature representation vector; determining a first loss value based on the second traffic feature representation vector and the tag information; iteratively updating the model parameters of the initial multilayer perceptron based on the first loss value to obtain an updated multilayer perceptron; and under the condition that the first loss value meets a first preset condition, determining a network model sequentially comprising the first network model, the updated multi-layer perceptron and the output layer as an abnormal flow detection model. The problem of low abnormal flow detection accuracy is solved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of information security, and more specifically, to a method and device for detecting anomalies in power grid flow data based on multimodal self-supervised learning, and a computer program product. Background Art

[0002] As the power industry enters a new era of informatization and intelligence, the seamless integration and large-scale interconnection of power facilities and equipment through the network has become a prominent feature of the modern power grid. In this context, the importance of anomaly detection and identification of power grid network traffic data has become increasingly prominent. It not only plays a decisive role in maintaining the efficient and stable operation of the power system, but also serves as the cornerstone for ensuring the safety and reliability of the entire power infrastructure. However, the complex operating conditions and diverse and unpredictable anomaly types in the actual operating environment pose severe challenges to traditional supervised learning methods that rely on labels. In the application process of such methods, due to the tedious and time-consuming data labeling work, the high cost, and the difficulty in obtaining anomaly samples on a large scale, the model cannot fully utilize sufficient labeled data during training.

[0003] In related technologies, supervised machine learning algorithms rely heavily on a large number of accurately labeled abnormal and normal traffic samples during their construction and optimization. However, in real-world scenarios, abnormal traffic events in real-world power grids occur relatively infrequently, making data collection and labeling challenging. This results in a significant shortage of abnormal traffic samples compared to normal traffic samples, and in some cases, even a significant sample imbalance. In this case, the model tends to focus on common normal traffic patterns during training, while its generalization ability to rare, unseen abnormal traffic types is significantly reduced, affecting the accuracy and coverage of anomaly detection.

[0004] It can be seen from this that the related technology has the problem of low accuracy in detecting abnormal traffic.

[0005] Currently, no effective solution has been proposed to the above-mentioned problems existing in the related technologies. Summary of the Invention

[0006] The embodiments of the present invention provide a method and apparatus for detecting anomalies in power grid flow data based on multimodal self-supervised learning, and a computer program product, to at least solve the problem of low accuracy in detecting abnormal flow in related technologies.

[0007] According to one embodiment of the present invention, a method for detecting anomalies in power grid flow data is provided, comprising: determining a first flow feature representation vector for each training power grid flow data included in a training data set based on a pre-trained first network model, wherein the training data set includes a plurality of the training power grid flow data and label information of the training power grid flow data, and the first network model is a model trained based on an unlabeled power grid flow data set; inputting the first flow feature representation vector into an initial multi-layer perceptron and an output layer to obtain a second flow feature representation vector; determining a first loss value based on the second flow feature representation vector and the label information; iteratively updating the model parameters of the initial multi-layer perceptron based on the first loss value to obtain an updated multi-layer perceptron; and determining, when the first loss value satisfies a first predetermined condition, a network model sequentially including the first network model, the updated multi-layer perceptron and the output layer as an abnormal flow detection model.

[0008] According to another embodiment of the present invention, a power grid flow data anomaly detection device is provided, comprising: a first determination module for determining a first flow feature representation vector of each training power grid flow data included in a training data set based on a pre-trained first network model, wherein the training data set includes a plurality of the training power grid flow data and label information of the training power grid flow data, and the first network model is a model trained based on an unlabeled power grid flow data set; an input module for inputting the first flow feature representation vector into an initial multi-layer perceptron and an output layer to obtain a second flow feature representation vector; a second determination module for determining a first loss value based on the second flow feature representation vector and the label information; an update module for iteratively updating the model parameters of the initial multi-layer perceptron based on the first loss value to obtain an updated multi-layer perceptron; and a third determination module for determining a network model including the first network model, the updated multi-layer perceptron and the output layer in sequence as an abnormal flow detection model when the first loss value satisfies a first predetermined condition.

[0009] According to yet another embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when run.

[0010] According to another embodiment of the present invention, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any one of the above method embodiments.

[0011] According to yet another embodiment of the present invention, a computer program product is provided, including a computer program, which implements the steps of the method described in each embodiment of the present application when executed by a processor.

[0012] Through the present invention, a first network model can be obtained by training an unlabeled power grid flow data set. The first network model is used to determine the first flow feature representation of each training power grid flow data in the training data set. The first flow feature representation vector is input into the initial multi-layer perceptron and the output layer to obtain a second flow feature representation vector. A first loss value is determined based on the second flow feature representation vector and label information. The model parameters of the initial multi-layer perceptron are iteratively updated based on the first loss value to obtain an updated multi-layer perceptron. When the first loss value meets a first predetermined condition, training is exited, and the network model including the first network model, the updated multi-layer perceptron, and the output layer is determined as the abnormal flow detection model. Since the first network model is obtained by training an unlabeled power grid flow data set, that is, the first network model is obtained through self-supervised learning, the subtle differences between normal flow and potential abnormal flow can be discovered and learned by self-supervised learning. Therefore, an accurate first flow feature representation vector can be obtained through the first network model, laying the foundation for subsequent abnormality detection work. The first traffic feature representation vector is used to train the initial multi-layer perceptron and the output layer, and the resulting updated multi-layer perceptron, when the determined first loss value satisfies the first predetermined condition, determines the network model including the first network model, the updated multi-layer perceptron, and the output layer in sequence as the abnormal traffic detection model. Since the abnormal traffic detection model is trained using the first traffic feature representation vector input by the first network model, it can better understand the essential characteristics of the data, helping to improve the generalization ability of the model and the accuracy of detection. Therefore, the problem of low accuracy in detecting abnormal traffic in related technologies can be solved, achieving the effect of improving the accuracy of detecting abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a hardware structure block diagram of a mobile terminal for detecting abnormality in power grid flow data according to an embodiment of the present invention;

[0014] Figure 2 is a flow chart of a method for detecting abnormality in power grid flow data according to an embodiment of the present invention;

[0015] Figure 3 is a flow chart of a method for detecting abnormality in power grid flow data according to a specific embodiment of the present invention;

[0016] Figure 4 is a flow chart of detecting abnormal traffic using an abnormal traffic detection model according to a specific embodiment of the present invention;

[0017] Figure 5 4 is a structural block diagram of a training device for an abnormal traffic detection model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and in combination with embodiments.

[0019] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0020] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for detecting abnormality in power grid flow data according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input and output device 108 for communication functions. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0021] Memory 104 can be used to store computer programs, such as software programs and modules of application software, such as the computer program corresponding to the power grid flow data anomaly detection method in the embodiment of the present invention. Processor 102 executes the computer program stored in memory 104 to perform various functional applications and data processing, thereby implementing the above-mentioned method. Memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, memory 104 may further include memory remotely located relative to processor 102, and such remote memory may be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0022] The transmission device 106 is used to receive or send data via a network. A specific example of the aforementioned network may include a wireless network provided by the mobile terminal's communications provider. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In one embodiment, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0023] In this embodiment, a method for detecting abnormality in power grid flow data is provided. Figure 2 FIG. 1 is a flow chart of a method for detecting abnormality in power grid flow data according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0024] Step S202: determining a first flow feature representation vector for each training power grid flow data included in a training data set based on a pre-trained first network model, wherein the training data set includes a plurality of the training power grid flow data and label information of the training power grid flow data, and the first network model is a model trained based on an unlabeled power grid flow data set;

[0025] Step S204: input the first traffic feature representation vector into the initial multi-layer perceptron and the output layer to obtain a second traffic feature representation vector;

[0026] Step S206: determining a first loss value based on the second traffic feature representation vector and the label information;

[0027] Step S208, iteratively updating the model parameters of the initial multilayer perceptron based on the first loss value to obtain an updated multilayer perceptron;

[0028] Step S210: When the first loss value satisfies a first predetermined condition, the network model including the first network model, the updated multi-layer perceptron, and the output layer in sequence is determined as an abnormal traffic detection model.

[0029] In the above embodiment, the first network model can be a multimodal encoder, and traffic representation can be learned by constructing a multimodal encoder. For example, the multimodal encoder can learn more comprehensive and richer features of power grid traffic data by combining a recurrent neural network and a convolutional neural network. The recurrent neural network takes the packet length sequence of the power grid traffic as input, and the convolutional neural network takes the payload bytes of the power grid traffic as input. The output representations of the LSTM and CNN are combined through a feature fusion layer to form a joint feature. This joint feature is then fed into the FC layer to obtain the final traffic feature representation vector. Specifically, the training power grid traffic data can be input into the first network model, which can include a recurrent neural network and a convolutional neural network. The packet length sequence of the training power grid traffic data is used as input to the recurrent neural network, and the payload bytes of the training power grid traffic data are used as input to the convolutional neural network. The output representations of the LSTM and CNN are combined through a feature fusion layer to form a joint feature. This joint feature is then fed into the FC layer to obtain the first traffic feature representation vector.

[0030] In the above embodiment, after obtaining the first network model, the first network model obtained by self-supervised contrastive learning pre-training, such as the model parameters of the multimodal feature encoder and , can be migrated to the downstream flow anomaly detection task in the power grid flow anomaly detection stage, the parameters of the multimodal feature encoder are frozen, and a multi-layer perceptron is added, namely the initial multi-layer perceptron and the softmax layer, namely the output layer is after the multimodal feature encoder, to construct a new model for flow anomaly detection. Since the first network model has been pre-trained and has good feature extraction capabilities, in order to keep its learned general feature representation unchanged, it is usually chosen to freeze all its parameters. This means that in the subsequent downstream task training process, the weights of the feature encoder will no longer be updated and will remain in the state during pre-training. The parameters of the MLP are to be trained, and its purpose is to learn a finer decision boundary for a specific flow anomaly detection task.

[0031] In the above embodiment, the first traffic feature representation vector can be input into the initial multi-layer perceptron and the output layer, and obtaining the second traffic feature representation vector can include inputting the first traffic feature representation vector into the initial multi-layer perceptron to obtain the first vector, and then inputting the first vector into the output layer to obtain the second traffic feature representation vector.

[0032] In the above embodiment, the traffic anomaly detection model can be trained by the cross entropy loss function, and the loss function can be expressed as That is, the first loss value can be Calculate. Where C is the number of power grid flow categories, y c is the true label value of category c, that is, label information, pc The loss function is used to optimize the model parameters of the multilayer perceptron in the classification model to determine the probability of belonging to category c. If the first loss value does not meet the first predetermined condition, the initial multilayer perceptron can be trained again to obtain the first loss value until the first loss value meets the first predetermined condition, at which point training is terminated. The first predetermined condition can include the first loss value being less than a predetermined threshold or the number of training cycles exceeding a preset number.

[0033] In the above embodiment, a trained updated multi-layer perceptron and an output layer can be connected to the first network model to obtain an abnormal flow detection model. Once the abnormal flow detection model is obtained, the abnormal flow detection model can be used to detect traffic on the power grid and determine abnormal traffic included in the grid traffic. Before inputting the grid traffic into the abnormal flow detection model, the grid traffic can be preprocessed and then input into the abnormal flow detection model to detect abnormal traffic.

[0034] Through the present invention, a first network model can be obtained by training an unlabeled power grid flow data set. The first network model is used to determine the first flow feature representation of each training power grid flow data in the training data set. The first flow feature representation vector is input into the initial multi-layer perceptron and the output layer to obtain a second flow feature representation vector. A first loss value is determined based on the second flow feature representation vector and label information. The model parameters of the initial multi-layer perceptron are iteratively updated based on the first loss value to obtain an updated multi-layer perceptron. When the first loss value meets a first predetermined condition, training is exited, and the network model including the first network model, the updated multi-layer perceptron, and the output layer is determined as the abnormal flow detection model. Since the first network model is obtained by training an unlabeled power grid flow data set, that is, the first network model is obtained through self-supervised learning, the subtle differences between normal flow and potential abnormal flow can be discovered and learned by self-supervised learning. Therefore, an accurate first flow feature representation vector can be obtained through the first network model, laying the foundation for subsequent abnormality detection work. The first traffic feature representation vector is used to train the initial multi-layer perceptron and the output layer, and the resulting updated multi-layer perceptron, when the determined first loss value satisfies the first predetermined condition, determines the network model including the first network model, the updated multi-layer perceptron, and the output layer in sequence as the abnormal traffic detection model. Since the abnormal traffic detection model is trained using the first traffic feature representation vector input by the first network model, it can better understand the essential characteristics of the data, helping to improve the generalization ability of the model and the accuracy of detection. Therefore, the problem of low accuracy in detecting abnormal traffic in related technologies can be solved, achieving the effect of improving the accuracy of detecting abnormal traffic.

[0035] Optionally, the execution entity of the above steps can be a background processor, or other devices with similar processing capabilities, or a machine that at least integrates a data processing device, where the data processing device can include terminals such as computers and mobile phones, but is not limited to this.

[0036] In an exemplary embodiment, before determining a first traffic feature representation vector for each training power flow data included in a training dataset based on a pre-trained first network model, the method further includes: performing an augmentation operation on the acquired unlabeled power flow dataset to obtain a first power flow and a second power flow; determining a first packet length sequence and a first payload byte of the first power flow, and determining a second packet length sequence and a second payload byte of the second power flow; inputting the first packet length sequence and the first payload byte into a second network model to obtain a first representation vector, and inputting the second packet length sequence and the second payload byte into a third network model to obtain a second representation vector, wherein the model structure of the third network model is the same as that of the second network model; determining a second loss value based on the first representation vector and the second representation vector; iteratively updating model parameters of the first network model and the second network model based on the second loss value to obtain a fourth network model; and determining the fourth network model as the first network model when the second loss value satisfies a second predetermined condition. In this embodiment, the augmentation operation may include a random masking operation, a data mixing operation, a data resampling operation, etc. For example, performing an enhancement operation on the acquired unlabeled power grid flow dataset may include performing two random masking operations on each data point in the unlabeled power grid flow dataset, determining the data obtained by the first random masking operation as the first power grid flow rate, and determining the data obtained by the second random masking operation as the second power grid flow rate. Alternatively, performing two data blending operations on each data point in the unlabeled power grid flow dataset, determining the data obtained by the first data blending operation as the first power grid flow rate, and determining the data obtained by the second data blending operation as the second power grid flow rate.

[0037] In the above embodiment, a multimodal contrastive learning method can be used for self-supervised pre-training to mine the association information of positive sample pairs and learn a high-quality representation that can distinguish the semantic differences between different traffic samples from unlabeled traffic data. Specifically, an initial first network model can be constructed. For example, the initial first network model can include a twin neural network with two branches, each branch containing a multimodal encoder f and a multilayer perceptron mapper h of the same structure, that is, the second network model includes a multimodal encoder f and a multilayer perceptron mapper h, and the third network model includes a multimodal encoder f and a multilayer perceptron mapper h, and the two have the same structure.

[0038] In the above embodiment, for the unlabeled power grid traffic data set x, an enhanced sample pair of the first power grid traffic x1 and the second power grid traffic x2 can be obtained by random mask processing, and x1 and x2 are respectively used as the inputs of the two branches of the twin neural network. First, they are encoded through a multimodal encoder to obtain two representation vectors: the first representation vector z1 = f(x1), and the second representation vector z2 = f(x2). z1 is mapped through an MLP to obtain p1 = h(z1), and the similarity between p1 and z2 is calculated as the objective function for learning. The objective function in the constructed contrastive learning framework is a symmetric function, that is, the similarity between p1 and z2 (p2 = h(z2)) also needs to be calculated. Because x1 and x2 are enhanced samples obtained from the same traffic sample, these two inputs are regarded as positive sample pairs. Then, the second loss value is determined based on the first representation vector and the second representation vector, wherein the second loss value can be determined based on the similarity between the first representation vector and the second representation vector. The second loss value can also be determined based on the entropy loss function. After obtaining the second loss value, the model parameters of the first network model and the second network model can be iteratively updated using the second loss value to obtain a fourth network model. If the second loss value satisfies a second predetermined condition, the fourth network model is determined to be the first network model. If the second loss value does not satisfy the second predetermined condition, the initial first network model is continuously trained through the above steps to obtain a second loss value. The second predetermined condition may include the second loss value being less than a predetermined threshold or the number of training times exceeding a preset number.

[0039] In an exemplary embodiment, determining the second loss value based on the first representation vector and the second representation vector includes: inputting the first representation vector into a first multilayer perceptron to obtain a third representation vector; inputting the second representation vector into a second multilayer perceptron to obtain a fourth representation vector; determining a first similarity between the first representation vector and the fourth representation vector, and determining a second similarity between the second representation vector and the third representation vector; and determining a weighted sum of the first similarity and the second similarity as the second loss value. In this embodiment, a first multilayer perceptron can be added after the second network model, and a second multilayer perceptron can be added after the third network model. The first representation vector can be input into the first multilayer perceptron to obtain a third representation vector, that is, the first representation vector z1 is mapped through an MLP (first multilayer perceptron) to obtain a third representation vector p1=h(z1). The second representation vector z2 is mapped through an MLP (second multilayer perceptron) to obtain a fourth representation vector p2=h(z1).

[0040] In the above embodiment, the second similarity between p1 and z2 is calculated as the objective function for learning. The objective function in the constructed contrastive learning framework is a symmetric function, which means that the first similarity between p2 and z1 (p2 = h(z2)) also needs to be calculated. Because x1 and x2 are enhanced samples obtained from the same traffic sample, these two inputs are regarded as positive sample pairs, and the similarity between them needs to be maximized. The final loss function is as follows: in, Cosine similarity can be used to calculate the similarity between the feature representations of two traffic samples.

[0041] It should be noted that, in determining the weighted sum of the first similarity and the second similarity as the second loss value, the weights of the first similarity and the second similarity may be the same or different. When the weights are the same, the weights may be half; when the weights are different, the sum of the weights is 1.

[0042] In an exemplary embodiment, determining the first similarity between the first characterization vector and the fourth characterization vector includes: determining the fourth characterization vector as a first constant; determining the similarity between the first constant and the first characterization vector as the first similarity; determining the second similarity between the second characterization vector and the third characterization vector includes: determining the third characterization vector as a second constant; determining the similarity between the second constant and the second characterization vector as the second similarity. In this embodiment, in order to prevent the model from collapsing and making the learned traffic representation too simple, a stop gradient propagation mechanism (SG) is used to prevent a large number of different traffic samples from being mapped to the same point in the feature space, and the second loss value can be expressed as Among them, D(p1,sg(z2)) means that z2 is a constant, and D(p2,sg(z1)) means that z1 is a constant. The stopped gradient propagation mechanism is used to dynamically select some fixed parameters as constants, and iteratively update to obtain the optimal values ​​of the model parameters, thereby obtaining high-quality power grid flow feature representation.

[0043] In the above embodiment, the stop gradient propagation mechanism controls the output of only one of the two branches to participate in the gradient back propagation, thereby affecting the update of the model parameters. The network architecture has two branches, one branch directly receives the input traffic sample and forward propagates through the network, and its gradient will be updated during the back propagation process. The other branch receives the branch output z that has undergone a stop gradient operation, that is, z is regarded as a non-differentiable constant in this branch (that is, regarded as a constant). Sg can be a pseudo-operator, which actually ensures that there is no effect on z during back propagation. Only the output of one branch in the framework directly participates in the gradient descent process, driving the update of the model parameters. The other branch is more like a fixed reference point, used to guide the first branch to learn how to generate matching features, rather than updating itself through back propagation. This design helps the model learn more stable and discriminative features while avoiding the "collapse" of the feature space.

[0044] In an exemplary embodiment, performing an enhancement operation on the acquired unlabeled power grid traffic dataset to obtain the first power grid traffic and the second power grid traffic includes: performing a random mask operation on each data packet sequence included in the unlabeled power grid traffic dataset to obtain the first power grid traffic of the data packet sequence; performing the random mask operation on the data packet sequence to obtain the second power grid traffic of the data packet sequence. In this embodiment, the traffic samples can be randomly masked to generate enhanced samples with similar semantics to the original samples to construct positive sample pairs. For example, enhanced traffic samples with similar semantics can be generated by random masking. For a given power grid data packet sequence, the data flow flow = [f1, f2, ? , f m ], define the k random mask operation as follows:

[0045]

[0046] Among them, mask1, mask2, ..., mask m Containing zeros in k random positions, where k is the number of packets masked, the samples after the masking operation, i.e., the first grid traffic and the second grid traffic, can be written as:

[0047] flow masked =flow·mask.

[0048] Among them, flow masked It is an enhanced sample of the original data stream flow.

[0049] After the mask operation on the unlabeled traffic data, the generated enhanced samples are combined with the original samples to form a positive sample pair, thereby constructing a comparison task.

[0050] In an exemplary embodiment, before performing an enhancement operation on the acquired unlabeled grid flow data set, the method further includes: grouping the acquired grid flow data into network packets to obtain multiple grid flow data sets; performing the following operations for each target grid flow data set included in the multiple grid flow data sets to obtain a two-dimensional tensor of the target grid flow data set; truncating according to a predetermined rule to obtain multiple grid flow sub-data; padding the first sub-data included in the multiple grid flow sub-data whose length is less than a predetermined length to obtain second sub-data; performing numerical conversion on the third sub-data and the second sub-data included in the multiple grid flow sub-data except the first sub-data to obtain multiple conversion data; obtaining a target number of target conversion data included in the multiple conversion data; converting the target conversion data based on the target properties of the network flow to obtain the two-dimensional tensor; and determining the two-dimensional tensor and the grid flow data as the unlabeled grid flow data set. In this embodiment, the acquired grid flow data can be preprocessed to obtain the unlabeled grid flow data set. That is, a large amount of unlabeled power grid flow data can be preprocessed to remove unnecessary redundant information, effectively maintain the temporal and spatial structure of network flow, and obtain an unlabeled power grid flow data set, which can be used as the input of the anomaly detection system.

[0051] Specifically, network packets with the same five-tuple (source IP, destination IP, source port, destination port, protocol) can be grouped to obtain multiple groups of power grid flow data groups. The data stream in each group of power grid data groups is truncated according to predetermined rules to achieve flow reconstruction. Among them, the predetermined rules include: active timeout: if a network flow lasts for more than 15 minutes, the system will truncate it. This rule ensures that even in the face of long-running flows, the detector can obtain relevant information in a timely manner. Inactive timeout: if there is an idle time of more than 30 seconds (this value is only an exemplary description, and the present invention is not limited to this) in the session (i.e. no data packet transmission), the flow is considered to have ended and truncated. This is based on the assumption that a long period of no data packet observation means that the flow has terminated naturally. Protocol-specific event triggering: Identify TCP FIN / RST and industrial protocol-specific end and error indication flags as the basis for truncation.

[0052] In the above embodiment, after truncating the data stream to obtain multiple power flow sub-data, data padding can be performed on the power flow sub-data whose length is less than a preset length, such as the truncation value (i.e., the first sub-data). All flows are then normalized. If the length of a data stream or packet is less than the truncation value, the remaining bytes are padded with zeros, and all data is converted to integers in the range [0, 255] to obtain multiple converted data for use as input for subsequent deep learning.

[0053] In the above embodiment, obtaining a target number of target conversion data included in the plurality of conversion data may include representing the target conversion data as an array consisting of the first m packets, each packet represented by the first n payload bytes, thereby compressing the traffic data and effectively preserving the temporal and spatial structure of the power grid traffic. It should be noted that when processing network traffic data, truncation may result in a data stream containing multiple packets. To facilitate analysis and model processing, a subset of packets is typically selected to represent the entire data stream. Feature Richness: Initially transmitted packets often contain more behavioral features and patterns, which are more sensitive to distinguishing normal traffic from malicious traffic. Consistency and Feasibility: Selecting a fixed number of packets (e.g., the first m) as representatives helps maintain consistency in data processing and simplifies model design and training. Furthermore, considering computational resources and time efficiency, selecting a limited number of packets for analysis is a necessary compromise in practical applications to ensure that the model can process large amounts of network traffic within a reasonable timeframe. Connection Establishment Process: Typically, the first few packets of a data stream contain key information during the connection establishment phase. Selecting the first m packets ensures that these initial interactions are captured, helping the model accurately understand the initial state and intent of the data stream. The payload bytes refer to the actual data content of a packet, excluding the header information. This refers to the substantive information that the user wants to send or receive. When performing truncation and padding operations, the payload bytes refer to the number of bytes that the packet originally contained before any padding was applied.

[0054] In the above embodiment, the traffic data packet sequence and payload of the power grid are converted according to the spatial-temporal properties of the network traffic to create a two-dimensional tensor representation. The two-dimensional tensor and the power grid traffic data are then determined as an unlabeled power grid traffic dataset, which serves as the final traffic input to the multimodal encoder.

[0055] In an exemplary embodiment, after determining the network model comprising, in sequence, the first network model, the updated multi-layer perceptron, and the output layer as the abnormal flow detection model, the method further includes: inputting the target power grid's flow data to be detected into the abnormal flow detection model, and determining abnormal flow data included in the flow data to be detected. In this embodiment, the flow data to be detected may be preprocessed data. Preprocessing can include grouping network packets with the same five-tuple (source IP, destination IP, source port, destination port, protocol) and truncating the power grid data stream according to the rules to achieve stream reconstruction; padding and standardizing the power grid traffic data. If the length of the data stream or packet is less than the truncation value, the remaining bytes are filled with zeros, and all data are converted to the integer range [0,255] to serve as input for subsequent deep learning; representing the power grid traffic data stream as an array consisting of the first m data packets, each data packet is represented by the first n payload bytes, thereby compressing the traffic data and effectively maintaining the temporal and spatial structure of the power grid traffic; converting the traffic packet sequence and payload of the power grid according to the spatial-temporal properties of the network traffic to create a two-dimensional tensor representation as the final traffic form of the input multimodal encoder.

[0056] In the aforementioned embodiments, by constructing a series of contrastive learning tasks and a multimodal encoder, this method can extract high-quality feature representations containing traffic temporal features, local detail features, and latent semantic structures from massive amounts of unlabeled power grid traffic data, thereby laying a solid foundation for subsequent anomaly detection. To address the widespread problem of sparse anomaly samples in reality, methods based on multimodal self-supervised learning no longer rely solely on limited and precious anomaly traffic samples, but instead focus on and fully utilize the implicit knowledge in large amounts of unlabeled data. Through self-supervised learning, subtle differences between normal and potentially abnormal traffic, and even new, previously unobserved anomaly patterns, can be discovered and learned independently, significantly improving the generalization capability and discrimination accuracy of anomaly detection tasks. The multimodal encoder model employed can simultaneously utilize two different data sources: the packet length of the power grid traffic sequence and the payload bytes of the initial packet, thereby extracting richer features. Multimodality helps improve the accuracy of the model's anomaly detection. Even if the data quality of one modality is poor, it can be compensated by data from other modalities. By jointly learning data from different modalities and capturing the interdependencies between them, we can better understand the essential characteristics of the data, which helps improve the model's generalization capabilities and enable it to better handle unseen data. This solves the time-consuming and costly manual labeling of power grid flow data, as well as the data imbalance caused by the relatively scarce number of abnormal power flow samples. The system is also committed to improving the generalization capabilities of anomaly detection models for unseen flow data.

[0057] The following describes a method for detecting abnormalities in power grid flow data in conjunction with specific implementation methods:

[0058] Figure 3 FIG. 1 is a flow chart of a method for detecting abnormality in power grid flow data according to a specific embodiment of the present invention. Figure 3 As shown, the process includes:

[0059] Step S302: Obtain an unlabeled traffic dataset X.

[0060] Step S304: traffic preprocessing and random mask enhancement.

[0061] In step S306, the data packet length sequence (corresponding to the first data packet length sequence) and the payload byte (corresponding to the first payload byte) in the data enhancement sample X1 (corresponding to the first grid traffic) are input into the multimodal encoder (corresponding to the second network model).

[0062] In step S308 , the multilayer perceptron (corresponding to the first multilayer perceptron) outputs a mapping value (corresponding to the third representation vector).

[0063] In step S310, the packet length sequence (corresponding to the second packet length sequence) and the payload bytes (corresponding to the second payload bytes) in the data enhancement sample X2 (corresponding to the second grid traffic) are input into the multimodal encoder (corresponding to the third network model).

[0064] In step S312, the multilayer perceptron (corresponding to the second multilayer perceptron) outputs a mapping value (corresponding to the fourth representation vector).

[0065] Step S314: Maximize the similarity between positive sample pairs by combining the stop gradient propagation mechanism.

[0066] Figure 4 FIG. 1 is a flow chart of detecting abnormal traffic using an abnormal traffic detection model according to a specific embodiment of the present invention. Figure 4 As shown, the process includes:

[0067] Step S402: Acquire an unlabeled power grid flow data set.

[0068] Step S404, data preprocessing: performing data preprocessing on the unlabeled power grid flow data set.

[0069] Step S406: self-supervised pre-training is performed using a multimodal contrastive learning method.

[0070] Step S408: Transfer learning: The model parameters of the multimodal feature encoder and obtained by pre-training through self-supervised contrastive learning are transferred to the downstream traffic anomaly detection task.

[0071] Step S410: Freeze the self-supervised pre-trained multimodal encoder, freezing the parameters of the multimodal feature encoder.

[0072] Step S412: Add a multi-layer perceptron after the multimodal feature encoder.

[0073] In step S414, a softmax layer is added after the multi-layer perceptron to construct a new model for traffic anomaly detection.

[0074] Step S416: Acquire a power grid flow data set (corresponding to the above-mentioned flow data to be detected).

[0075] Step S418: preprocess the data and input the preprocessed data into the frozen self-supervised pre-trained multimodal encoder, i.e., execute step S410.

[0076] Step S420: Traffic anomaly detection.

[0077] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0078] In this embodiment, a frozen self-supervised pre-trained multimodal encoder device is also provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and will not be repeated here. As used below, the term "module" can implement a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation by hardware, or a combination of software and hardware, is also possible and contemplated.

[0079] Figure 5 is a structural block diagram of a training device for an abnormal flow detection model according to an embodiment of the present invention, such as Figure 5 As shown, the device includes:

[0080] A first determining module 502 is configured to determine a first flow feature representation vector for each training power grid flow data included in a training data set based on a pre-trained first network model, wherein the training data set includes a plurality of the training power grid flow data and label information of the training power grid flow data, and the first network model is a model trained based on an unlabeled power grid flow data set;

[0081] An input module 504 is configured to input the first traffic feature representation vector into an initial multi-layer perceptron and an output layer to obtain a second traffic feature representation vector;

[0082] A second determining module 506 is configured to determine a first loss value based on the second traffic feature representation vector and the label information;

[0083] An updating module 508 is configured to iteratively update the model parameters of the initial multilayer perceptron based on the first loss value to obtain an updated multilayer perceptron;

[0084] The third determination module 510 is used to determine the network model including the first network model, the updated multi-layer perceptron and the output layer in sequence as an abnormal traffic detection model when the first loss value meets a first predetermined condition.

[0085] In an exemplary embodiment, the device can also be used to perform an enhancement operation on the acquired unlabeled power grid traffic data set before determining the first traffic feature representation vector of each training power grid traffic data included in the training data set based on the pre-trained first network model to obtain a first power grid traffic and a second power grid traffic; determine a first packet length sequence and a first payload byte of the first power grid traffic, and determine a second packet length sequence and a second payload byte of the second power grid traffic; input the first packet length sequence and the first payload byte into the second network model to obtain a first representation vector, and input the second packet length sequence and the second payload byte into the third network model to obtain a second representation vector, wherein the model structure of the third network model is the same as the model structure of the second network model; determine a second loss value based on the first representation vector and the second representation vector; iteratively update the model parameters of the first network model and the second network model based on the second loss value to obtain a fourth network model; and determine the fourth network model as the first network model when the second loss value meets the second predetermined condition.

[0086] In an exemplary embodiment, the device can determine the second loss value based on the first representation vector and the second representation vector in the following manner: input the first representation vector into a first multi-layer perceptron to obtain a third representation vector; input the second representation vector into a second multi-layer perceptron to obtain a fourth representation vector; determine a first similarity between the first representation vector and the fourth representation vector, and determine a second similarity between the second representation vector and the third representation vector; and determine the weighted sum of the first similarity and the second similarity as the second loss value.

[0087] In an exemplary embodiment, the device may determine the first similarity between the first characterization vector and the fourth characterization vector in the following manner: determine the fourth characterization vector as a first constant; determine the similarity between the first constant and the first characterization vector as the first similarity; the device may determine the second similarity between the second characterization vector and the third characterization vector in the following manner: determine the third characterization vector as a second constant; determine the similarity between the second constant and the second characterization vector as the second similarity.

[0088] In an exemplary embodiment, the device can perform an enhancement operation on the acquired unlabeled power grid traffic data set to obtain a first power grid traffic and a second power grid traffic in the following manner: perform a random mask operation on each data packet sequence included in the unlabeled power grid traffic data set to obtain the first power grid traffic of the data packet sequence; perform the random mask operation on the data packet sequence to obtain the second power grid traffic of the data packet sequence.

[0089] In an exemplary embodiment, the device can also be used to, before performing enhancement operations on the acquired unlabeled power grid flow data set: group the acquired power grid flow data into network packets to obtain multiple groups of power grid flow data groups; perform the following operations for each group of target power grid flow data groups included in the multiple power grid flow data groups to obtain a two-dimensional tensor of the target power grid flow data groups; truncate according to predetermined rules to obtain multiple power grid flow sub-data, fill the first sub-data included in the multiple power grid flow sub-data whose length is less than the predetermined length to obtain the second sub-data, perform numerical conversion on the third sub-data and the second sub-data included in the multiple power grid flow sub-data except the first sub-data to obtain multiple conversion data, obtain a target number of target conversion data included in the multiple conversion data, convert the target conversion data based on the target properties of the network flow to obtain the two-dimensional tensor; determine the two-dimensional tensor and the power grid flow data as the unlabeled power grid flow data set.

[0090] In an exemplary embodiment, the device can also be used to input the flow data to be detected of the target power grid into the abnormal flow detection model after determining the network model that sequentially includes the first network model, the updated multi-layer perceptron and the output layer as the abnormal flow detection model, and determine the abnormal flow data included in the flow to be detected.

[0091] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0092] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any one of the above method embodiments when running.

[0093] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0094] An embodiment of the present invention further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0095] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0096] An embodiment of the present invention further provides a computer program product, including a computer program, which implements the steps of the method in each embodiment of the present application when the computer program is executed by a processor.

[0097] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0098] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing device, can be centralized on a single computing device, or can be distributed across a network of multiple computing devices. They can be implemented using program code executable by the computing device, and thus, can be stored in a storage device and executed by the computing device. In some cases, the steps shown or described herein can be performed in a different order than that shown, or can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0099] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A method for detecting abnormality in power grid flow data, characterized in that: include: Determine a first flow feature representation vector for each training power grid flow data included in a training data set based on a pre-trained first network model, wherein the training data set includes a plurality of the training power grid flow data and label information of the training power grid flow data, and the first network model is a model trained based on an unlabeled power grid flow data set; Inputting the first traffic feature representation vector into an initial multi-layer perceptron and an output layer to obtain a second traffic feature representation vector; Determine a first loss value based on the second traffic feature representation vector and the label information; Iteratively updating the model parameters of the initial multilayer perceptron based on the first loss value to obtain an updated multilayer perceptron; When the first loss value satisfies a first predetermined condition, a network model including the first network model, the updated multi-layer perceptron, and the output layer in sequence is determined as an abnormal traffic detection model.

2. The method according to claim 1, characterized in that Before determining the first flow feature representation vector of each training power grid flow data included in the training data set based on the pre-trained first network model, the method further includes: Performing an enhancement operation on the acquired unlabeled power grid flow data set to obtain a first power grid flow and a second power grid flow; determining a first sequence of packet lengths and a first payload byte for the first power grid traffic, and determining a second sequence of packet lengths and a second payload byte for the second power grid traffic; Inputting the first data packet length sequence and the first payload byte into a second network model to obtain a first characterization vector, and inputting the second data packet length sequence and the second payload byte into a third network model to obtain a second characterization vector, wherein the model structure of the third network model is the same as the model structure of the second network model; Determine a second loss value based on the first characterization vector and the second characterization vector; Iteratively update the model parameters of the first network model and the second network model based on the second loss value to obtain a fourth network model; When the second loss value satisfies a second predetermined condition, the fourth network model is determined as the first network model.

3. The method according to claim 2, characterized in that Determining a second loss value based on the first characterization vector and the second characterization vector includes: Inputting the first representation vector into a first multi-layer perceptron to obtain a third representation vector; Inputting the second representation vector into a second multi-layer perceptron to obtain a fourth representation vector; Determining a first similarity between the first characterization vector and the fourth characterization vector, and determining a second similarity between the second characterization vector and the third characterization vector; A weighted sum of the first similarity and the second similarity is determined as the second loss value.

4. The method according to claim 3, characterized in that: Determining a first similarity between the first characterization vector and the fourth characterization vector includes: Determining the fourth characterization vector as a first constant; Determine the similarity between the first constant and the first characterization vector as the first similarity; Determining a second similarity between the second characterization vector and the third characterization vector includes: Determining the third characterization vector as a second constant; The similarity between the second constant and the second characterization vector is determined as the second similarity.

5. The method according to claim 2, characterized in that: Performing an enhancement operation on the acquired unlabeled power grid flow data set to obtain the first power grid flow and the second power grid flow includes: Performing a random mask operation on each data packet sequence included in the unlabeled power grid flow data set to obtain the first power grid flow of the data packet sequence; The random mask operation is performed on the data packet sequence to obtain the second power grid flow of the data packet sequence.

6. The method according to claim 2, characterized in that Before performing an enhancement operation on the acquired unlabeled power grid flow data set, the method further includes: The acquired power grid flow data is grouped into network packets to obtain multiple groups of power grid flow data groups; The following operations are performed for each target power grid flow data group included in the plurality of power grid flow data groups to obtain a two-dimensional tensor of the target power grid flow data group; Truncating according to a predetermined rule to obtain a plurality of power grid flow sub-data, padding the first sub-data included in the plurality of power grid flow sub-data whose length is less than a predetermined length to obtain the second sub-data, numerically converting the third sub-data and the second sub-data included in the plurality of power grid flow sub-data except the first sub-data to obtain a plurality of conversion data, acquiring a target number of target conversion data included in the plurality of conversion data, converting the target conversion data based on the target property of the network flow to obtain the two-dimensional tensor; The two-dimensional tensor and the power grid flow data are determined as the unlabeled power grid flow data set.

7. The method according to claim 1, characterized in that After determining the network model including the first network model, the updated multi-layer perceptron, and the output layer in sequence as the abnormal traffic detection model, the method further includes: The flow data to be detected of the target power grid is input into the abnormal flow detection model to determine the abnormal flow data included in the flow to be detected.

8. A power grid flow data anomaly detection device, characterized in that: include: A first determination module is used to determine a first flow feature representation vector of each training power grid flow data included in a training data set based on a pre-trained first network model, wherein the training data set includes a plurality of the training power grid flow data and label information of the training power grid flow data, and the first network model is a model trained based on an unlabeled power grid flow data set; An input module, used for inputting the first traffic feature representation vector into an initial multi-layer perceptron and an output layer to obtain a second traffic feature representation vector; A second determination module, configured to determine a first loss value based on the second traffic feature representation vector and the label information; An updating module, configured to iteratively update the model parameters of the initial multilayer perceptron based on the first loss value to obtain an updated multilayer perceptron; The third determination module is used to determine the network model including the first network model, the updated multi-layer perceptron and the output layer in sequence as an abnormal traffic detection model when the first loss value satisfies a first predetermined condition.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 7 when executed.

10. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

Images