Abnormity detection method and device for SV protocol message, storage medium and product

Abstract

The embodiment of the invention discloses an anomaly detection method and device for an SV protocol message, a gateway, a storage medium and a product, and relates to the technical field of substation automation. The method comprises the following steps: acquiring an SV protocol message; extracting a front key field and an electric signal data set field of each sampling value data unit in the SV protocol message; verifying the legality of the preposed key field of each sampling value data unit; and inputting the electric signal data set field into an SV message time sequence anomaly detection Transformer model to obtain the anomaly degree of the SV message, and determining the SV protocol message to be abnormal under the condition that the SV protocol message is determined to comprise an illegal preposed key field through validity verification or the anomaly degree is greater than or equal to a preset anomaly threshold value. According to the scheme, whether the change of the electric signal data of the plurality of data sets in the SV protocol message in time is abnormal or not can be detected, and the accuracy of abnormality detection of the SV protocol message is improved accordingly.

Description

Technical Field

[0001] The present application relates to the field of substation automation technology, and specifically to an anomaly detection method, device, gateway, storage medium and product for SV protocol messages. Background Art

[0002] In modern power systems, the SV (Sampled Value) protocol is a key communication protocol in smart substations and power automation systems. The SV protocol is used to transmit key parameters such as current and voltage between intelligent electronic devices (IEDs) to ensure real-time monitoring and control of the system. By quickly transmitting high-frequency sampled data, the SV protocol can support the efficient operation and precise control of the power system. However, as an open industrial protocol, the SV protocol has potential security risks. Since the data transmitted by the SV protocol at the application layer includes key operating information of the power system, once there is an abnormality in this information, it may lead to system misoperation or failure, and then cause serious power safety accidents. The existing technical solutions for detecting SV protocol messages lack technical means that can effectively judge the abnormality of the characteristics of the data set in the message. Therefore, it is necessary to design a method that can identify whether there is an abnormality in the electrical signal data set in the SV protocol message. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method, device, gateway, storage medium and product for detecting anomalies in SV protocol messages, so as to solve the problem of how to identify data set anomalies in SV protocol messages in the prior art.

[0004] In order to achieve the above-mentioned object, the first aspect of the present application provides an abnormality detection method for SV protocol messages, comprising:

[0005] Get SV protocol message;

[0006] Extract the leading key field and the electric signal data set field of each sampling value data unit in the SV protocol message;

[0007] Verify the legitimacy of the leading key field of each sample value data unit;

[0008] Input the electrical signal dataset fields into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message;

[0009] When it is determined through legality verification that the SV protocol message includes an illegal leading key field, or the abnormality degree is greater than or equal to a preset abnormality threshold, the SV protocol message is determined to be abnormal.

[0010] In an embodiment of the present application, the legality of the leading key fields of each sampling value data unit is verified, including: verifying the legality of each leading key field through the SV message timing anomaly detection Transformer model.

[0011] In an embodiment of the present application, the above method also includes: normalizing the extracted leading key fields and the electrical signal data set fields to obtain normalized vectors of the leading key fields and the electrical signal data set fields; verifying the legitimacy of the leading key fields through the SV message timing anomaly detection Transformer model, including: inputting the normalized vectors of the leading key fields into the SV message timing anomaly detection Transformer model to obtain the abnormality of the SV message; wherein, the SV message timing anomaly detection Transformer model detects that the SV message includes illegal leading key fields, and the abnormality of the SV message exceeds a preset abnormality threshold.

[0012] In an embodiment of the present application, the SV message timing anomaly detection Transformer model is trained through the following steps: obtaining multiple non-abnormal SV protocol messages as a training set; normalizing the leading key fields and electrical signal data set fields in each non-abnormal SV protocol message to obtain a normalized vector of each non-abnormal SV protocol message; matrixing each normalized vector to obtain a training data matrix; training a preset Transformer model according to the training data matrix to obtain an SV message timing anomaly detection Transformer model.

[0013] In an embodiment of the present application, a preset Transformer model is trained according to a training data matrix to obtain a Transformer model for detecting timing anomalies of SV messages, including: setting a leading key field weighting matrix according to the position of the leading key field in the normalized vector; and training a preset Transformer model according to the training data matrix in combination with the leading key field weighting matrix to obtain a Transformer model for detecting timing anomalies of SV messages.

[0014] In an embodiment of the present application, the leading key fields include: SV unique identifier, sampling counter field, configuration version number field and synchronization bit field.

[0015] In an embodiment of the present application, multiple anomaly-free SV protocol messages included in the training set are generated by the same device, the number of training sets is multiple, and the generation devices of the anomaly-free SV protocol messages in the multiple training sets are different; a preset Transformer model is trained according to the training data matrix to obtain an SV message timing anomaly detection Transformer model, and also includes: adopting a transfer learning method to train a preset Transformer model according to the training data matrix of each training set to obtain an SV message timing anomaly detection Transformer model.

[0016] In an embodiment of the present application, when each leading key field of the SV protocol message is legal and the degree of abnormality is lower than a preset abnormal threshold, the SV protocol message is determined to be a normal message; the above method also includes: saving the selected normal message; obtaining an updated training set based on multiple normal messages saved within a preset time interval; preprocessing the multiple normal messages in the updated training set to obtain an updated data matrix; training the SV message timing anomaly detection Transformer model according to the updated data matrix to obtain an updated SV message timing anomaly detection Transformer model.

[0017] In an embodiment of the present application, the above method is applied to a firewall, and the above method also includes: when the SV protocol message is determined to be abnormal, blocking the SV protocol message, and reporting the SV protocol message to the abnormal log system; when each leading key field of the SV protocol message is legal and the abnormality degree is less than a preset abnormality threshold, determining that the SV protocol message is normal, and releasing the SV protocol message.

[0018] A second aspect of the present application provides an anomaly detection device for SV protocol messages, comprising: a memory configured to store instructions; and a processor configured to call instructions from the memory and to implement the anomaly detection method for SV protocol messages provided according to the above embodiment when executing the instructions.

[0019] The third aspect of the present application provides a gateway, including: an anomaly detection device for SV protocol messages provided according to the above-mentioned embodiment; a first network card, configured to connect the anomaly detection device and the first industrial equipment; a second network card, configured to connect the anomaly detection device and the second industrial equipment.

[0020] A fourth aspect of the present application provides a machine-readable storage medium having instructions stored thereon, the instructions being used to enable a machine to execute the anomaly detection method for SV protocol messages provided according to the above-mentioned embodiment.

[0021] A fifth aspect of the present application provides a computer program product, which, when executed by a processor, implements the anomaly detection method for SV protocol messages provided according to the above embodiment.

[0022] Through the above technical scheme, the anomaly detection method for SV protocol messages provided in the embodiment of the present application can detect whether there are anomalies in the temporal changes of the electrical signal data of multiple data sets in the SV protocol message, and thereby improve the accuracy of SV protocol message anomaly detection.

[0023] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0025] Figure 1 A schematic diagram of a process flow of an abnormality detection method for SV protocol messages according to an embodiment of the present application is shown;

[0026] Figure 2 A schematic diagram of a process flow of another method for detecting anomalies of SV protocol messages according to an embodiment of the present application is shown;

[0027] Figure 3 The structure block diagram of a gateway according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0029] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application are in compliance with the relevant provisions of national laws and regulations. In the embodiments of this application, some existing solutions in the industry such as certain software, components, and models may be mentioned, which should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or will necessarily use the solution.

[0030] If there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0031] Traditional security protection measures applied to anomaly detection of SV protocol messages are mainly based on the item-by-item analysis of a single SV protocol message field. Therefore, the changes and correlations between the electrical signals in the message data set in the time series are not fully considered, which will cause abnormal SV protocol messages to be misjudged as normal SV protocol messages, thereby posing a threat to smart substations and power automation systems. Therefore, in order to effectively identify abnormal changes in the time series of the data set of SV protocol messages, an embodiment of the present application provides an anomaly detection method for SV protocol messages.

[0032] Figure 1 The following schematically shows a flow chart of a method for detecting anomalies in SV protocol messages according to an embodiment of the present application. Figure 1 As shown, the embodiment of the present application provides a method for detecting anomalies of SV protocol messages, which may include the following steps:

[0033] S102, obtaining SV protocol message;

[0034] S104, extracting the leading key field and the electrical signal data set field of each sampling value data unit in the SV protocol message;

[0035] S106, verifying the legitimacy of the leading key field of each sample value data unit;

[0036] S108, inputting the electric signal data set field into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message;

[0037] S110: When it is determined through legality verification that the SV protocol message includes an illegal leading key field, or the abnormality degree is greater than or equal to a preset abnormality threshold, the SV protocol message is determined to be abnormal.

[0038] The anomaly detection method for SV protocol messages provided in the embodiment of the present application determines that the leading key fields of the SV protocol messages are legal, and detects whether there are anomalies in the electrical signal data set fields in the SV protocol messages through the SV message timing anomaly detection Transformer model. Among them, the SV protocol message may include multiple electrical signal data set fields, and the electrical signals in these electrical signal data set fields may have temporal correlations. The SV message timing anomaly detection Transformer model can gradually read the electrical signal data at each time point based on its LSTM / GRU layer to capture the characteristics of each electrical signal data in the time series, thereby determining the temporal change law of the SV protocol message, and thus determining the abnormality of the SV protocol message. Therefore, the anomaly detection method for SV protocol messages provided in the embodiment of the present application can detect whether there are abnormalities in the temporal changes of the electrical signal data of multiple data sets in the SV protocol message, and thereby improve the accuracy of SV protocol message anomaly detection.

[0039] It can be understood that the SV protocol implements communication functions based on the framework of ISO / IEC 8802-3, and its basic frame structure can be divided into two parts: first, SMAC, DMAC, TPID, and TYPD, which represent the source mac address, destination mac address, priority tag, and Ethernet type (0x88ba), respectively. Next is the SV protocol header part, which may include: APPID, Length, and APDU. The first 4 bytes can be of fixed size. The APDU part of the SV protocol message contains specific sampling value data, where the noASDU field indicates the number of ASDUs (the above-mentioned sampling value data units) included. Each ASDU contains multiple fields, each of which records specific sampling information. For each ASDU, extract and decode the key fields: svID (SV unique flag, marked as 80H), smpCnt (sampling counter, marked as 81H), confRef (configuration version number, marked as 83H), smpSynch (synchronization bit, marked as 85H), and seqDate (data set, marked as 87H). These fields respectively identify the unique ID of the SV, the number of data sampling, the configuration version, the synchronization status, and the content of the electrical signal data set field. The seqDate field contains specific sampling values, such as channel 1, channel 2 to channel n. These channel data represent actual physical quantities such as three-phase current and voltage.

[0040] In some embodiments of the present application, the leading key fields in step S104 may include: an SV unique identifier, a sampling counter field, a configuration version number field, and a synchronization bit field.

[0041] Specifically, in step S106, the legitimacy verification of the pre-key field may set different detection standards according to the content included in the pre-key field, and if the content included in the pre-key field does not meet the corresponding standard, the SV protocol message is judged to be illegal.

[0042] For example, in step S106, the legitimacy verification of the leading key field may include, for example: checking the SV unique identifier in the SV protocol message to ensure the uniqueness of each sampling value data unit; detecting the increment rule of the sampling counter field. If the value of the sampling counter field jumps, repeats, or is missing, it may mean that the sampling value data unit has data damage or loss, so the SV protocol message can be judged to be illegal.

[0043] In some embodiments of the present application, step S106 may also be detected by a Transformer model, and the timing anomaly detection of the electrical signal data set field and the legitimacy detection of the leading key field in the SV protocol message may be performed by the SV message timing anomaly detection Transformer model. Therefore, step S106 may include: verifying the legitimacy of each leading key field through the SV message timing anomaly detection Transformer model.

[0044] In general, the legitimacy check of the leading key fields is performed item by item. If the complexity of the SV protocol message is high, such as when there are many leading key fields and the amount of data in each field is large, the legitimacy check time of a single SV protocol message will increase linearly or exponentially. The anomaly detection method for SV protocol messages provided in the embodiment of the present application detects the legitimacy of leading key fields and the timing anomaly of the electrical signal data set field through the SV message timing anomaly detection Transformer model. Compared with the existing item-by-item detection method, it can reduce the anomaly detection time of SV protocol messages, thereby improving the efficiency of detecting SV protocol messages, and can reduce the accumulation of SV protocol messages to be detected in a short period of time due to the frequent generation of SV protocol messages.

[0045] Understandably, based on different training sets, the detection functions that can be realized by the SV message timing anomaly detection Transformer model are also different. If the training set includes the pre-key field and the electrical signal data set field of a normal SV message, the SV message timing anomaly detection Transformer model trained based on the training set can realize the two functions of detecting the legitimacy of the pre-key field and the timing anomaly of the electrical signal data set field.

[0046] Specifically, the anomaly detection method for SV protocol messages provided in the embodiment of the present application may also include: normalizing the extracted each of the preceding key fields and each of the electrical signal data set fields to obtain a normalized vector of each of the preceding key fields and a normalized vector of each of the electrical signal data set fields.

[0047] Verifying the legitimacy of each of the preceding key fields through the SV message timing anomaly detection Transformer model may include:

[0048] Inputting the normalized vector of each of the preceding key fields into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message;

[0049] Among them, the SV message timing anomaly detection Transformer model detects that the SV message includes the illegal leading key field, and the anomaly degree of the SV message exceeds a preset anomaly threshold.

[0050] It can be understood that when the training set includes the pre-key field and the electric signal data set field of the normal SV message, and the pre-key field and the electric signal data set field are integrated into the same input for the SV message timing anomaly detection Transformer model, the normalized vectors of the pre-key fields and the normalized vectors of the electric signal data set fields are different parts of the same normalized vector. Figure 2 Step S206 to step S210, in this case, the abnormality of the SV protocol message output by the SV message timing anomaly detection Transformer model represents both the abnormality of the timing of the electrical signal data set field of the SV protocol message and whether the leading key field of the SV protocol message is legal. If the abnormality of the SV protocol message is lower than the preset abnormality threshold, the electrical signal data set field of the SV protocol message has no abnormality in timing, and its leading key fields are all legal; otherwise, it means that the SV protocol message has an illegal leading key field, and / or the electrical signal data set field has a timing anomaly.

[0051] In some embodiments of the present application, in order to realize the function of the SV message timing anomaly detection Transformer model to detect the legitimacy of the preceding key field and the timing anomaly of the electrical signal data set field, the SV message timing anomaly detection Transformer model can be trained by the following steps:

[0052] Obtain multiple SV protocol messages without abnormalities as training sets;

[0053] Normalizing the leading key field and the electrical signal data set field in each of the non-abnormal SV protocol messages to obtain a normalized vector of each of the non-abnormal SV protocol messages;

[0054] Matrix-processing each of the normalized vectors to obtain a training data matrix;

[0055] The preset Transformer model is trained according to the training data matrix to obtain the SV message timing anomaly detection Transformer model.

[0056] Specifically, the normalization process of the leading key field and the electric signal data set field may include:

[0057] The minimum and maximum normalization method is used for the front key fields and the electrical signal data set fields to map the data to the [0,1] interval, normalize the data of different units and dimensions into a unified form, and generate a normalized vector. After the normalization, the value of each field will form a unified feature array.

[0058] In some embodiments of the present application, the method of training a preset Transformer model for making porridge may further include:

[0059] According to the position of the leading key field in the normalized vector, setting a leading key field weighting matrix;

[0060] According to the training data matrix, the preset Transformer model is trained in combination with the leading key field weighting matrix to obtain the SV message timing anomaly detection Transformer model.

[0061] By setting the leading key field weighted matrix, the final SV message timing anomaly detection Transformer model can have stronger sensitivity and recognition ability to the leading key field, so that the SV message timing anomaly detection Transformer model can better detect the legitimacy of the leading key field in the SV protocol message.

[0062] In some embodiments of the present application, the anomaly detection method for SV protocol messages may need to detect SV protocol messages generated by different devices. The rules of the leading key fields of the protocol messages generated by different devices and the timing rules of the electrical signals in the electrical signal data set fields may be different. Therefore, the number of training sets used to train the preset Transformer model may be multiple, and the multiple non-abnormal SV protocol messages included in the training set are generated by the same device, and the generation devices of the non-abnormal SV protocol messages in the multiple training sets are different;

[0063] The method of training a preset Transformer model according to the training data matrix to obtain the SV message timing anomaly detection Transformer model further includes:

[0064] The preset Transformer model is trained according to the training data matrix of each training set by adopting the transfer learning method to obtain the SV message timing anomaly detection Transformer model.

[0065] The SV message timing anomaly detection Transformer model trained in this way can detect the legitimacy of the leading key fields of the SV protocol messages generated by different devices and whether there are anomalies in the timing of the electrical signal data set fields.

[0066] In some embodiments of the present application, the anomaly detection method for SV protocol messages may further include: determining that the SV protocol message is a normal message when each of the leading key fields of the SV protocol message is legal and the degree of anomaly is lower than the preset anomaly threshold;

[0067] When the SV protocol message is a normal message, saving the selected normal message;

[0068] Obtaining an updated training set according to a plurality of normal messages stored within a preset time interval;

[0069] Preprocessing the plurality of normal messages in the update training set to obtain an update data matrix;

[0070] The SV message timing anomaly detection Transformer model is trained according to the updated data matrix to obtain an updated SV message timing anomaly detection Transformer model.

[0071] Therefore, the SV message timing anomaly detection Transformer model can be updated based on the newly acquired SV protocol message.

[0072] It can be understood that the preset time interval can be determined based on the number of selected normal messages saved per unit time, so that the update of the SV message timing anomaly detection Transformer model can timely and accurately detect the anomalies existing in the current SV protocol message.

[0073] In some embodiments of the present application, each of the SV protocol messages may come from different devices;

[0074] The updating of the training set according to the plurality of normal messages stored within a preset time interval comprises:

[0075] Determining the source of the normal message according to the Ethernet frame header of the normal message;

[0076] A plurality of the normal messages are divided according to the source to obtain a plurality of the updated training sets.

[0077] According to the Ethernet frame header, multiple normal messages are divided into multiple update training sets, and the SV message timing anomaly detection Transformer model is updated according to the multiple update training sets. This allows the model to better record the current rules of the leading key fields of the SV messages generated by different devices and the current timing rules of the electrical signal data set fields, thereby better detecting whether there are anomalies in the current SV protocol message.

[0078] It can be understood that the Ethernet frame header may include a source MAC address, and the source MAC address can be used to determine the source of the SV protocol message.

[0079] In some embodiments of the present application, in order to maintain the detection accuracy of the SV message timing anomaly detection Transformer model, it is necessary to further screen the normal messages used to update the model, so the saving of the selected normal messages may include:

[0080] In the case where the abnormality degree of the normal message is less than or equal to a preset abnormality degree screening threshold, the normal message is saved, wherein the preset abnormality degree screening threshold is less than the preset abnormality threshold.

[0081] The preset abnormality screening threshold is smaller than the preset abnormality threshold, so that there is a smaller deviation between the timing change law of the electrical signal data set field of the screened normal message and the timing change law of the existing electrical signal data set field, thereby reducing the problem of a decrease in model detection accuracy caused by updating the SV message timing anomaly detection Transformer model.

[0082] It can be understood that the value of the abnormality degree may be, for example, between 0 and 1, the preset abnormality threshold may be, for example, 0.6, and the preset abnormality degree screening threshold may be, for example, 0.3.

[0083] In some embodiments of the present application, the anomaly detection method for SV protocol messages may be applied to a firewall, and the method may further include:

[0084] When the SV protocol message is determined to be abnormal, the SV protocol message is blocked, and the SV protocol message is reported to an abnormal log system;

[0085] When each of the leading key fields of the SV protocol message is legal and the abnormality degree is less than the preset abnormality threshold, it is determined that the SV protocol message is normal and the SV protocol message is released.

[0086] A specific example is given below to describe the anomaly detection method for SV protocol messages provided in an embodiment of the present application:

[0087] In an industrial network environment, multiple devices such as smart sensors and monitoring units continuously send real-time data transmitted via the SV protocol to the main control system. These SV protocol messages contain the status information of the device and the sampling data of the sensor. First, these SV protocol messages are captured in real time using a network packet capture tool, and then the captured raw data is initially parsed, including:

[0088] Extract the basic frame structure of the SV message and analyze the Ethernet frame header, including the source MAC address, destination MAC address, priority tag, and Ethernet frame type.

[0089] The APPID, Length and APDU fields are further decomposed from the payload of the SV protocol. APPID identifies the application type, Length indicates the data length, and APDU carries the actual sampling data.

[0090] The key fields of the APDU part are extracted one by one, including svID (sampling value unique identifier), smpCnt (sampling counter), confRef (configuration version number), smpSynch (synchronization bit) and seqDate (data set content). These fields are used for subsequent data processing and feature extraction.

[0091] The message fields are extracted as features. In order to facilitate model learning, these features are normalized so that different features are in the same numerical range. Key feature fields such as svID, smpCnt, and confRef are selected. The minimum and maximum normalization method is used to map the data to the [0,1] interval, and the data of different units and dimensions are normalized into a unified form to generate a feature vector. After the value of each field is normalized, a unified feature array will be formed. After processing, multiple SV message data are finally combined into a matrix with (N, D) dimensions, where N is the number of samples and D is the feature dimension.

[0092] The processed data set is trained using the preset Transformer model. The attention mechanism is used in the model design to weight important feature fields to improve the model's sensitivity and recognition ability for key data. The LSTM / GRU layer is introduced to gradually read the data at each time point, calculate the hidden state of each time step, and pass it to the next time step to capture the dynamic features in the time series.

[0093] After the model training is completed, the system will save the trained model as a file for subsequent real-time reasoning. During the system operation, whenever a new SV message is received, the system will load the model in real time for anomaly detection.

[0094] The Transformer model generates anomaly scores based on message features. If the score exceeds the preset threshold, the system will determine the message as abnormal and record the details of the abnormal message, including the message field value and the anomaly score. For messages that are determined to be normal, the system will further perform policy matching. If the message meets all conditions, the system will allow it to be transmitted normally and record the transmission log; if it does not meet the conditions, the system will block the message and save the relevant information for subsequent review.

[0095] The embodiment of the present application also provides an abnormality detection device for SV protocol messages, comprising: a memory and a processor. The memory is configured to store instructions; and the processor is configured to call the instructions from the memory and implement the abnormality detection method for SV protocol messages provided according to any of the above embodiments when executing the instructions.

[0096] See also Figure 3 The embodiment of the present application further provides a gateway, including the anomaly detection device 310 for SV protocol messages provided in the above embodiment, a first network card 320 and a second network card 340. The first network card 320 is configured to connect the anomaly detection device 310 and the first industrial device 330; the second network card 340 is configured to connect the anomaly detection device 310 and the second industrial device 350.

[0097] An embodiment of the present application also provides a machine-readable storage medium, on which instructions are stored, and the instructions are used to enable a machine to execute the above-mentioned anomaly detection method for SV protocol messages.

[0098] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the anomaly detection method for SV protocol messages provided according to any of the above embodiments.

[0099] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0100] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0103] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0104] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0105] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0106] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0107] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for detecting anomalies in SV protocol messages, characterized in that: include: Get SV protocol message; Extracting the leading key field and the electrical signal data set field of each sampling value data unit in the SV protocol message; Verifying the legitimacy of the leading key field of each sample value data unit; Inputting the electrical signal data set field into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message; When it is determined through legality verification that the SV protocol message includes an illegal leading key field, or the abnormality degree is greater than or equal to a preset abnormality threshold, the SV protocol message is determined to be abnormal.

2. The method according to claim 1, characterized in that The verifying that the leading key field of each sample value data unit is legal includes: The legitimacy of each of the preceding key fields is verified through the SV message timing anomaly detection Transformer model.

3. The method according to claim 2, characterized in that The method further comprises: Normalizing the extracted leading key fields and the electrical signal data set fields to obtain normalized vectors of the leading key fields and the electrical signal data set fields; The verifying the legitimacy of each of the preceding key fields through the SV message timing anomaly detection Transformer model includes: Inputting the normalized vector of each of the preceding key fields into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message; Among them, the SV message timing anomaly detection Transformer model detects that the SV message includes the illegal leading key field, and the anomaly degree of the SV message exceeds a preset anomaly threshold.

4. The method according to claim 2, characterized in that: The SV message timing anomaly detection Transformer model is trained by the following steps: Obtain multiple SV protocol messages without abnormalities as training sets; Normalizing the leading key field and the electrical signal data set field in each of the non-abnormal SV protocol messages to obtain a normalized vector of each of the non-abnormal SV protocol messages; Matrix-processing each of the normalized vectors to obtain a training data matrix; The preset Transformer model is trained according to the training data matrix to obtain the SV message timing anomaly detection Transformer model.

5. The method according to claim 4, characterized in that Training a preset Transformer model according to the training data matrix to obtain the SV message timing anomaly detection Transformer model includes: According to the position of the leading key field in the normalized vector, setting a leading key field weighting matrix; According to the training data matrix, the preset Transformer model is trained in combination with the leading key field weighting matrix to obtain the SV message timing anomaly detection Transformer model.

6. The method according to any one of claims 1 to 5, characterized in that: The preceding key fields include: SV unique identifier, sampling counter field, configuration version number field and synchronization bit field.

7. The method according to claim 4, characterized in that The plurality of SV protocol messages without abnormality included in the training set are generated by the same device, the number of the training sets is multiple, and the generation devices of the SV protocol messages without abnormality in the multiple training sets are different; The method of training a preset Transformer model according to the training data matrix to obtain the SV message timing anomaly detection Transformer model further includes: The preset Transformer model is trained according to the training data matrix of each training set by adopting the transfer learning method to obtain the SV message timing anomaly detection Transformer model.

8. The method according to claim 1, characterized in that: When each of the preceding key fields of the SV protocol message is legal and the abnormality is lower than the preset abnormality threshold, determining that the SV protocol message is a normal message; The method further comprises: Save the selected normal message; Obtaining an updated training set according to a plurality of normal messages stored within a preset time interval; Preprocessing the plurality of normal messages in the update training set to obtain an update data matrix; The SV message timing anomaly detection Transformer model is trained according to the updated data matrix to obtain an updated SV message timing anomaly detection Transformer model.

9. The method according to claim 1, characterized in that: The method is applied to a firewall, and the method further comprises: When the SV protocol message is determined to be abnormal, the SV protocol message is blocked, and the SV protocol message is reported to an abnormal log system; When each of the leading key fields of the SV protocol message is legal and the abnormality degree is less than the preset abnormality threshold, it is determined that the SV protocol message is normal and the SV protocol message is released.

10. An abnormality detection device for SV protocol messages, characterized in that: include: a memory configured to store instructions; as well as A processor is configured to call the instruction from the memory and implement the anomaly detection method for SV protocol messages according to any one of claims 1 to 9 when executing the instruction.

11. A gateway, characterized in that: include: The anomaly detection device for SV protocol messages according to claim 10; a first network card configured to connect the anomaly detection device and a first industrial device; The second network card is configured to connect the abnormality detection device and the second industrial equipment.

12. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores instructions, which are used to enable a machine to execute the anomaly detection method for SV protocol messages according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the anomaly detection method for SV protocol messages according to any one of claims 1 to 9.

Images