Network traffic anomaly detection method based on deep feature extraction and multi-class anomaly recognition

Abstract

The invention discloses an electric power information network flow anomaly detection method based on deep feature extraction and multi-class anomaly identification. The technology can accurately identify various types of flow anomalies in an electric power information network. The method comprises the following steps: firstly, acquiring network flow data from a network node, and preprocessing the data; then, analyzing the traffic data by using a unique feature extraction mechanism, combining the characteristics of the traffic data of the power information network, connecting a multi-layer feature encoder and a feature mapping layer, and learning and extracting the deep features of the data; and finally, in combination with a SoftMax classification model, the extracted features are classified, and accurate anomaly identification and classification of the network traffic anomaly are realized. A cross entropy loss function is used as a model optimization target, and an efficient gradient descent optimization algorithm is adopted to update model parameters, so that the generalization ability and robustness of the model are effectively improved, the method can adapt to a complex and changeable electric power information network environment, and safe and reliable operation of an electric power information system is effectively guaranteed.

Description

Technical Field

[0001] The present invention relates to the field of power information network security, and in particular to a method for detecting power information network flow anomalies based on deep feature extraction and multi-category anomaly recognition. The method can identify and classify network flow anomalies in a data-driven manner. The present invention is applicable to the power communication network of State Grid Corporation of China. Background Art

[0002] Network traffic anomaly detection refers to the discovery and identification of various abnormal phenomena in the network, such as attacks, failures, congestion, etc., by analyzing the characteristics and behaviors of network traffic, so as to ensure the security and stable operation of the network. Network traffic anomaly detection is an important research direction in the field of network security and a key requirement of power information network, because the power information network carries various business systems of smart grids, such as power dispatching, power market, power monitoring, etc. The anomaly of its network traffic may cause failures or even accidents in the power system, causing serious economic losses and social impacts.

[0003] At present, the methods of network traffic anomaly detection are mainly divided into statistical learning-based methods and machine learning-based methods. The statistical learning-based method refers to the method of determining whether the network traffic deviates from the normal range by establishing a statistical model of network traffic, such as a time series model, a probability distribution model, etc., so as to identify anomalies. The advantages of this type of method are that it is simple and easy to implement and does not require a large amount of training data, but the disadvantage is that it has strong assumptions on the statistical characteristics of network traffic, such as stationarity and independence, while the actual network traffic is often non-stationary, nonlinear, and has autocorrelation, so the detection effect of this type of method is limited. The machine learning-based method refers to the method of extracting features from network traffic by using machine learning algorithms, such as clustering algorithms, classification algorithms, neural network algorithms, etc., and judging whether the network traffic belongs to the normal or abnormal category based on the features, so as to identify anomalies. The advantages of this type of method are that it can adapt to the complexity and dynamics of network traffic and does not require too many assumptions on the statistical characteristics of network traffic, but the disadvantage is that it requires a large amount of labeled data to train the model, and has high requirements for the selection and extraction of features, otherwise it will affect the accuracy and efficiency of detection.

[0004] In recent years, with the development of deep learning technology, some network traffic anomaly detection methods based on deep learning have also been proposed. Deep learning is a multi-level machine learning method that can automatically learn abstract and high-level features from raw data, thereby improving the performance of network traffic anomaly detection. A commonly used model of deep learning is the autoencoder, which is an unsupervised neural network model that can compress and reconstruct data by learning the low-dimensional representation of the input data, thereby achieving the purpose of feature extraction and dimensionality reduction.

[0005] The present invention proposes a network traffic anomaly detection technology based on deep feature extraction and multi-category anomaly recognition. It utilizes a multi-layer feature encoder and a data correlation analysis module to extract deep features of traffic data, effectively recognizes different types of network traffic anomalies, and improves the recognition accuracy of traffic data.

[0006] In addition, the technology uses a feature mapping layer to convert the feature vector output by the encoder into a form suitable for classifier input, avoiding the information loss problem caused by directly inputting the feature vector into the classifier in the traditional model. At the same time, the technology can perform multi-category anomaly recognition on network traffic data, covering different types of network traffic anomalies, meeting the diverse needs of power information network security protection, and improving the accuracy of identifying network traffic anomalies. Summary of the invention

[0007] The present invention proposes a network traffic anomaly detection technology based on deep feature extraction and multi-category anomaly recognition:

[0008] Step (1): Obtain network traffic data from network nodes deployed in the power information network and temporarily store it in a database.

[0009] Step (2): Obtain traffic data from the database for data preprocessing, encapsulate the data into a data set and preprocess the data set, clean the original data, including removing invalid data and standardizing the data format; perform feature conversion on numerical data, including standardization or normalization. Perform feature encoding on non-numerical data, including one-hot encoding.

[0010] Step (3): Pre-set the abnormal traffic classification standard and initialize the relevant parameters of the model: encoding method of non-numeric data, conversion method of numerical data, data cleaning processing method, number of feature encoder layers L, hidden layer dimension d, activation function f, number of classifier categories N, learning rate α, and number of iterations t.

[0011] Step (4): Input data X into the feature encoding layer. Each layer includes a data association analysis module and a feedforward network module. The input data X is processed by each layer of feature encoder to obtain output data Z. i , where i is the coding layer number.

[0012] Step (5): The data correlation analysis module is used to identify the flow data Z i The important temporal information, spatial relationship and semantic information in Z i Converted into output data A after data association analysis module i .

[0013] Step (6): The feedforward network processes the output data A of the data association analysis module. i Perform further nonlinear transformation to improve the feature expression ability and obtain the output data F after the feedforward network i .

[0014] Step (7): The data receives the feature vector F output by the last layer of feature encoder n (n is the total number of coding layers). Feature vector F n The dimension is reduced through the feature mapping layer and mapped to the sample label space. Finally, the mapped feature vector H is obtained.

[0015] Step (8): The output H of the feature mapping layer is converted into a probability distribution using the Softmax classifier. The network traffic is multi-classified to detect and identify different types of network traffic anomalies.

[0016] Step (9): The output Y of the SoftMax classifier uses the cross entropy loss function to measure its difference from the true label and calculate the value of the cross entropy loss function CE(Y,T).

[0017] Step (10): Use efficient gradient descent optimization to calculate the gradient of the cross entropy loss function with respect to the model parameters Use the cross entropy loss function as the optimization target of the model, update the model parameters through the efficient gradient descent optimization algorithm, and improve the generalization ability and robustness of the model. Use the value of the gradient descent cross entropy loss function CE(Y,T) to minimize its value.

[0018] Compared with the prior art, the technical solution of the present invention has the following features:

[0019] The present invention provides a network traffic anomaly detection technology based on deep feature extraction and multi-category anomaly recognition. It uses a multi-layer feature encoder to extract deep information, and uses a multi-layer feature encoder and a data correlation analysis module to effectively capture the temporal features, spatial features and semantic features in the network traffic data, thereby improving the recognition accuracy of the traffic data. The feature mapping layer is used to convert the feature vector output by the encoder into a form suitable for classifier input. This avoids the information loss problem caused by the direct input of the feature vector into the classifier in the traditional model. It can perform multi-category anomaly recognition on the network traffic data, covering different types of network traffic anomalies, meeting the diverse needs of power information network security protection, and improving the recognition accuracy of network traffic anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the specific implementation of the present invention and the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific implementation or the description of the prior art.

[0021] Figure 1 It is a flow chart of the overall solution of the present invention.

[0022] Figure 2 Schematic diagram of the feature encoding layer.

[0023] Figure 3 This is a schematic diagram of the deployment model in the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0025] like Figure 1 As shown, the present invention provides an abnormal flow detection technology for power information network based on deep reinforcement learning, which includes 10 steps.

[0026] Step (1): Obtain network traffic data, and use traffic collection devices deployed on switches or routers in the power information network to batch collect power network traffic data from smart meters, phasor measurement units, and various sensor devices in the power network, and temporarily store them in the database. These network traffic data include data packets of various network protocols, and the fields contained in the data packets include source IP address, destination IP address, source port, destination port, protocol type, data packet length, etc.

[0027] Step (2): Obtain traffic data from the database for preprocessing, encapsulate the data into a data set and preprocess the data set, specifically including the following steps:

[0028] 1. Data cleaning: remove invalid data, such as empty data, duplicate data, missing data, etc., standardize the data format, and convert all data into a unified format.

[0029] 2. Feature transformation: Standardize or normalize numerical data to make it meet the requirements of model input. For numerical data, such as flow rate, duration, etc., use standardization to transform them into a uniform distribution; check and process missing values, duplicate values, outliers, etc. in the data during data cleaning. Use the mean, median, and mode to delete, interpolate, and replace. Standardization can be done using the formula:

[0030]

[0031] Among them, x is the original data, μ is the mean, and σ is the standard deviation. The normalization process can be performed using the formula:

[0032]

[0033] 3. Feature encoding: Feature encoding of non-numeric data, including one-hot encoding.

[0034] Step (3): Initialize the model parameters. Before model training, pre-set the abnormal traffic classification standard and initialize the relevant parameters of the model, including: Encoding method of non-numeric data: one-hot encoding. Conversion method of numerical data: standardization or normalization. Data cleaning processing method: remove invalid data and standardize data format. The number of feature encoder layers L is set to 3 layers, for example. The hidden layer dimension d is set to 128 dimensions per layer, for example. The activation function f uses the ReLU function, and the formula is:

[0035] f(x)=max(0,x)

[0036] The number of categories N of the classifier is determined according to the type of abnormal traffic. The learning rate α is set to 0.001, for example. The number of iterations t is set to 30, for example.

[0037] Step (4): Feature encoding layer processing, the preprocessed data X is input into the feature encoding layer. Each layer includes a data association analysis module and a feedforward network module. The input data X is processed by each layer of feature encoder to obtain the output data Z i , where i is the coding layer number. The processing process is as follows:

[0038] Z i =f(W i ·X+b i )

[0039] Among them, W i is the weight matrix, b i is the bias vector, and f is the activation function ReLU.

[0040] Step (5): The data correlation analysis module is used to identify the flow data Z i The important temporal information, spatial relationship and semantic information in Z i Converted into output data A after data association analysis module i .

[0041] Step (6): Feedforward network processing: the feedforward network processes the output data A of the data association analysis module. i Perform further nonlinear transformation to improve the feature expression ability and obtain the output data F after the feedforward network iThe nonlinear transformation of the feedforward network can be expressed as:

[0042] F i =f(W′ i ·A i +b′ i )

[0043] Among them, W′ i is the weight matrix, b′ i is the bias vector, and f is the activation function ReLU.

[0044] Step (7): Feature mapping layer processing, the data passes through the feature vector F output by the last layer of feature encoder n (n is the total number of coding layers). Feature vector F n The feature mapping layer is used to reduce the dimension and map it to the sample label space. Finally, the mapped feature vector H is obtained. The processing formula of the feature mapping layer is:

[0045] H=W max ·F n +b max

[0046] Among them, W max is the weight matrix of the feature mapping layer, b max is the bias vector.

[0047] Step (8): Classification and anomaly detection, the output H of the feature mapping layer is converted into a probability distribution using the Softmax classifier. The output of the Softmax classifier is:

[0048]

[0049] Among them, H j is the feature vector of the jth class, and N is the number of classes of the classifier. Multi-classification of network traffic is performed to detect and identify different types of network traffic anomalies.

[0050] Step (9): Loss function calculation. The output Y of the Softmax classifier uses the cross entropy loss function to measure its difference from the true label. The formula of the cross entropy loss function is:

[0051]

[0052] Among them, T is the one-hot encoding of the true label, and Y is the output of the Softmax classifier.

[0053] Step (10): Model optimization, using efficient gradient descent optimization to calculate the gradient of the cross entropy loss function with respect to the model parameters The update formula of the gradient descent algorithm is:

[0054]

[0055] Among them, θ is the model parameter and α is the learning rate. Through continuous iteration, the value of the cross entropy loss function is minimized to improve the generalization ability and robustness of the model.

[0056] In summary, the present invention obtains network traffic data from multiple network nodes and performs comprehensive data preprocessing, adopts a deep learning model, processes the data through a feature encoding layer, a data correlation analysis module, and a feedforward network module, and maps high-dimensional feature vectors to a classification space through a combination of a feature mapping layer and a Softmax classifier, thereby achieving accurate classification and detection of different types of network traffic anomalies. The application of the cross entropy loss function and the gradient descent optimization algorithm further optimizes the model parameters, improves the generalization ability and robustness of the model, and thus ensures the accuracy and stability of the detection results. The present invention provides an effective method for anomaly detection of power information network traffic, which has high practical value and application prospects.

[0057] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. A network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition, characterized in that: The following steps are involved: Step (1): obtaining network traffic data from multiple network nodes deployed in the power information network and storing the data in a database; Step (2): preprocessing the traffic data obtained from the database, including data cleaning, standardization or normalization of numerical data, and one-hot encoding of non-numerical data; Step (3): pre-set the abnormal traffic classification standard and initialize the relevant parameters of the model, including the number of feature encoder layers, hidden layer dimension, activation function, number of classifier categories, learning rate and number of iterations; Step (4): input the preprocessed data into the feature encoding layer. Each layer of feature encoder includes a data association analysis module and a feedforward network module to process the input data and generate output data. Step (5): The data correlation analysis module identifies the temporal information, spatial relationship and semantic information in the traffic data and generates analyzed output data; Step (6): The feedforward network performs nonlinear transformation on the output data of the data correlation analysis module to improve the feature expression capability and generate output data processed by the feedforward network; Step (7): The feature vector output by the last layer of feature encoder is reduced in dimension through the feature mapping layer and mapped to the sample label space to generate a mapped feature vector; Step (8): Use the Softmax classifier to convert the feature vector into a probability distribution, perform multi-classification on the network traffic, and detect different types of network traffic anomalies; Step (9): Calculate the cross entropy loss function between the Softmax classifier output and the true label; Step (10): Use the gradient descent algorithm to optimize the model parameters and improve the generalization ability and robustness of the model by minimizing the value of the cross entropy loss function.

2. According to claim 1, a network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition is characterized in that: The data cleaning step includes removing invalid data and standardizing data formats.

3. According to claim 1, a network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition is characterized in that: The standardization processing formula for the numerical data is: Among them, x is the original data, μ is the mean, and σ is the standard deviation.

4. According to claim 1, a network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition is characterized in that: The normalization formula for the numerical data is:

5. According to claim 1, a network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition is characterized in that: The activation function of the feature encoding layer is ReLU, and the formula is: f(x)=max(0,x).

6. According to claim 1, a network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition is characterized in that: The dimension reduction processing formula of the feature mapping layer is: H=W max ·F n +b max Among them, W max is the weight matrix of the feature mapping layer, b max is the bias vector.

7. The network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition according to claim 1 is characterized in that: The output of the Softmax classifier is: Among them, H j is the feature vector of the jth class, and N is the number of classes of the classifier.

8. The network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition according to claim 1 is characterized in that: The formula of the cross entropy loss function is: Among them, T is the one-hot encoding of the true label, and Y is the output of the Softmax classifier.

9. The network traffic anomaly detection method based on deep feature extraction and multi-category anomaly recognition according to claim 1 is characterized in that: The parameter update formula of the gradient descent algorithm is: Among them, θ is the model parameter and α is the learning rate.

Images