Anomaly detection method, device, storage medium and product for SV protocol message

Abstract

This application discloses a method, apparatus, gateway, storage medium, and product for anomaly detection of SV protocol messages, relating to the field of substation automation technology. The method includes: acquiring SV protocol messages; extracting the pre-key fields and electrical signal dataset fields of each sampled data unit in the SV protocol message; verifying the legality of the pre-key fields of each sampled data unit; inputting the electrical signal dataset fields into an SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message. If the legality verification determines that the SV protocol message includes illegal pre-key fields, or if the anomaly degree is greater than or equal to a preset anomaly threshold, the SV protocol message is determined to be anomaly. This scheme can detect whether there are anomalies in the temporal changes of electrical signal data in multiple datasets within an SV protocol message, thereby improving the accuracy of SV protocol message anomaly detection.

Description

Technical Field

[0001] This application relates to the field of substation automation technology, and specifically to an anomaly detection method, device, gateway, storage medium, and product for SV protocol messages. Background Technology

[0002] In modern power systems, the Sampled Value (SV) protocol is a key communication protocol in smart substations and power automation systems. The SV protocol is used to transmit critical parameters such as current and voltage between intelligent electronic devices (IEDs), ensuring real-time monitoring and control of the system. By rapidly transmitting high-frequency sampled data, the SV protocol supports efficient operation and precise control of the power system. However, as an open industrial protocol, the SV protocol presents potential security risks. Because the data transmitted at the application layer includes critical operational information of the power system, any anomalies in this information could lead to system malfunctions or failures, potentially causing serious power safety accidents. Existing technologies for detecting SV protocol messages lack effective methods for anomaly detection based on the characteristics of the dataset within the messages. Therefore, there is a need to design a method to identify whether there are anomalies in the electrical signal dataset within SV protocol messages. Summary of the Invention

[0003] The purpose of this application is to provide an anomaly detection method, apparatus, gateway, storage medium, and product for SV protocol messages, in order to solve the problem of how to identify dataset anomalies in SV protocol messages in the prior art.

[0004] To achieve the above objectives, the first aspect of this application provides an anomaly detection method for SV protocol messages, comprising:

[0005] Obtain SV protocol messages;

[0006] Extract the key fields and electrical signal dataset fields of each sampled value data unit in the SV protocol message;

[0007] Verify the validity of the pre-key fields of each sampled data unit;

[0008] The electrical signal dataset fields are input into the Transformer model for SV message timing anomaly detection to obtain the anomaly degree of the SV message;

[0009] If, after legality verification, it is determined that the SV protocol message contains an illegal pre-key field, or if the anomaly level is greater than or equal to a preset anomaly threshold, the SV protocol message is determined to be abnormal.

[0010] In this application embodiment, verifying the validity of the pre-key fields of each sampled value data unit includes: verifying the validity of each pre-key field through the Transformer model for detecting SV message timing anomalies.

[0011] In this embodiment of the application, the above method further includes: normalizing the extracted pre-key fields and electrical signal dataset fields to obtain normalized vectors for each pre-key field and each electrical signal dataset field; verifying the legality of each pre-key field through the SV message timing anomaly detection Transformer model, including: inputting the normalized vectors of each pre-key field into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message; wherein, if the SV message timing anomaly detection Transformer model detects that the SV message includes an invalid pre-key field, the anomaly degree of the SV message exceeds a preset anomaly threshold.

[0012] In this embodiment, the SV message timing anomaly detection Transformer model is trained through the following steps: acquiring multiple anomaly-free SV protocol messages as a training set; normalizing the pre-key fields and electrical signal dataset fields in each anomaly-free SV protocol message to obtain normalized vectors for each anomaly-free SV protocol message; matrix-processing each normalized vector to obtain a training data matrix; and training a preset Transformer model based on the training data matrix to obtain the SV message timing anomaly detection Transformer model.

[0013] In this embodiment of the application, a preset Transformer model is trained based on the training data matrix to obtain an SV message timing anomaly detection Transformer model, including: setting a weighted matrix of the preceding key fields based on the position of the preceding key fields in the normalized vector; and training the preset Transformer model based on the training data matrix and the weighted matrix of the preceding key fields to obtain an SV message timing anomaly detection Transformer model.

[0014] In this embodiment of the application, the pre-key fields include: SV unique identifier, sampling counter field, configuration version number field, and synchronization bit field.

[0015] In this embodiment, the multiple anomaly-free SV protocol messages included in the training set are generated by the same device, the number of training sets is multiple, and the devices that generate the anomaly-free SV protocol messages in the multiple training sets are different; training a preset Transformer model based on the training data matrix to obtain the SV message timing anomaly detection Transformer model also includes: using transfer learning to train a preset Transformer model based on the training data matrix of each training set to obtain the SV message timing anomaly detection Transformer model.

[0016] In this embodiment of the application, if the preceding key fields of the SV protocol message are valid and the anomaly degree is lower than the preset anomaly threshold, the SV protocol message is determined to be a normal message. The above method also includes: saving the selected normal messages; obtaining an updated training set based on multiple normal messages saved within a preset time interval; preprocessing multiple normal messages in the updated training set to obtain an updated data matrix; and training an SV message temporal anomaly detection Transformer model based on the updated data matrix to obtain the updated SV message temporal anomaly detection Transformer model.

[0017] In this embodiment of the application, the above method is applied to a firewall, and the method further includes: blocking the SV protocol message when it is determined to be abnormal, and reporting the SV protocol message to the abnormal log system; and determining that the SV protocol message is normal and allowing the SV protocol message to pass when all the preceding key fields of the SV protocol message are valid and the abnormality is less than the preset abnormal threshold.

[0018] A second aspect of this application provides an anomaly detection apparatus for SV protocol messages, comprising: a memory configured to store instructions; and a processor configured to retrieve instructions from the memory and, when executing the instructions, to implement the anomaly detection method for SV protocol messages provided according to the above embodiments.

[0019] A third aspect of this application provides a gateway, comprising: an anomaly detection device for SV protocol messages provided in the above embodiments; a first network interface card (NIC) configured to connect the anomaly detection device and a first industrial device; and a second NIC configured to connect the anomaly detection device and a second industrial device.

[0020] A fourth aspect of this application provides a machine-readable storage medium storing instructions for causing a machine to execute an anomaly detection method for SV protocol messages according to the above embodiments.

[0021] The fifth aspect of this application provides a computer program product, which, when executed by a processor, implements the anomaly detection method for SV protocol messages provided in the above embodiments.

[0022] Through the above technical solution, the anomaly detection method for SV protocol messages provided in this application embodiment can detect whether there are any anomalies in the temporal changes of electrical signal data of multiple datasets in SV protocol messages, thereby improving the accuracy of SV protocol message anomaly detection.

[0023] Other features and advantages of the embodiments of this application will be described in detail in the following detailed description section. Attached Figure Description

[0024] The accompanying drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the following detailed description to explain the embodiments of this application, but do not constitute a limitation on the embodiments of this application. In the drawings:

[0025] Figure 1 The illustration shows a flowchart of an anomaly detection method for SV protocol messages according to an embodiment of this application;

[0026] Figure 2 The illustration shows a flowchart of another anomaly detection method for SV protocol messages according to an embodiment of this application;

[0027] Figure 3 A schematic block diagram of a gateway according to an embodiment of this application is shown. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for illustration and explanation of the embodiments of this application and are not intended to limit the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0029] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with the relevant provisions of national laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0030] If the embodiments of this application involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. If the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed in this application.

[0031] Traditional security measures for anomaly detection in SV protocol messages primarily rely on the item-by-item parsing of individual SV protocol message fields. Therefore, they do not adequately consider the time-series changes and correlations between various electrical signals within the message's data set. This can lead to the misclassification of abnormal SV protocol messages as normal ones, posing a threat to smart substations and power automation systems. Therefore, to effectively identify abnormal changes in the time-series data set of SV protocol messages, this application provides an anomaly detection method for SV protocol messages.

[0032] Figure 1 The illustration shows a schematic flowchart of an anomaly detection method for SV protocol messages according to an embodiment of this application. Figure 1 As shown in the figure, this application provides an anomaly detection method for SV protocol messages, which may include the following steps:

[0033] S102, Obtain SV protocol message;

[0034] S104. Extract the key fields and electrical signal dataset fields of each sampled value data unit in the SV protocol message;

[0035] S106. Verify the validity of the preceding key fields of each sampled value data unit;

[0036] S108. Input the electrical signal dataset fields into the SV message timing anomaly detection Transformer model to obtain the anomaly degree of the SV message;

[0037] S110. If, after legality verification, it is determined that the SV protocol message includes an illegal pre-key field, or that the abnormality level is greater than or equal to the preset abnormality threshold, the SV protocol message is determined to be abnormal.

[0038] The anomaly detection method for SV protocol messages provided in this application, while determining the validity of the pre-key fields of the SV protocol message, uses an SV message temporal anomaly detection Transformer model to detect whether there are anomalies in the electrical signal dataset fields of the SV protocol message. The SV protocol message may include multiple electrical signal dataset fields, and the electrical signals in these dataset fields may have temporal correlations. The SV message temporal anomaly detection Transformer model can progressively read the electrical signal data at each time point based on its LSTM / GRU layer, thereby capturing the characteristics of each electrical signal data in the time series, determining the temporal change pattern of the SV protocol message, and thus determining the anomaly degree of the SV protocol message. Therefore, the anomaly detection method for SV protocol messages provided in this application can detect whether there are anomalies in the temporal changes of electrical signal data in multiple datasets within the SV protocol message, thereby improving the accuracy of SV protocol message anomaly detection.

[0039] Understandably, the SV protocol implements communication functions based on the ISO / IEC 8802-3 framework. Its basic frame structure can be divided into two parts: First, SMAC, DMAC, TPID, and TYPD represent the source MAC address, destination MAC address, priority flag, and Ethernet type (0x88ba), respectively. Next is the SV protocol header, which may include APPID, Length, and APDU. The first four bytes can be of fixed size. The APDU portion of the SV protocol message contains the specific sampled value data, where the noASDU field indicates the number of ASDUs (the aforementioned sampled value data units). Each ASDU contains multiple fields, each recording specific sampling information. For each ASDU, the following key fields are extracted and decoded: svID (SV unique identifier, marked 80H), smpCnt (sampling counter, marked 81H), confRef (configuration version number, marked 83H), smpSynch (synchronization bit, marked 85H), and seqDate (dataset, marked 87H). These fields identify the unique ID of the SV, the number of data samples, the configuration version, the synchronization status, and the contents of the electrical signal dataset field. The seqDate field contains the specific sampled values, such as channel 1, channel 2 to channel n, which represent the actual three-phase current, voltage, and other physical quantities.

[0040] In some embodiments of this application, the pre-key fields in step S104 may include: SV unique identifier, sampling counter field, configuration version number field, and synchronization bit field.

[0041] Specifically, in step S106, the validity verification of the pre-key field can be based on different detection standards according to the content included in the pre-key field, and if the content included in the pre-key field does not meet the corresponding standard, the SV protocol message is determined to be invalid.

[0042] For example, in step S106, the validity verification of the preceding key fields may include: checking the unique SV identifier in the SV protocol message to ensure the uniqueness of each sampled value data unit; detecting the increment pattern of the sampling counter field. If the value of the sampling counter field jumps, repeats, or is missing, it may mean that the sampled value data unit is corrupted or lost, so the SV protocol message can be judged to be invalid.

[0043] In some embodiments of this application, step S106 can also be detected by a Transformer model, and the timing anomaly detection of the electrical signal dataset field in the SV protocol message and the validity detection of the pre-key fields can both be performed by the SV message timing anomaly detection Transformer model. Therefore, step S106 may include: verifying the validity of each of the pre-key fields through the SV message timing anomaly detection Transformer model.

[0044] Generally, the validity check of pre-key fields is performed item by item. If the complexity of the SV protocol message is high, such as a large number of pre-key fields and a large amount of data in each field, the validity check time for a single SV protocol message will increase linearly or exponentially. The anomaly detection method for SV protocol messages provided in this application uses the SV message timing anomaly detection Transformer model to detect the validity of pre-key fields and timing anomalies in electrical signal dataset fields. Compared with the existing item-by-item detection method, it can reduce the anomaly detection time of SV protocol messages, thereby improving the efficiency of SV protocol message detection, and can also reduce the situation where SV protocol messages to be detected accumulate in a short period of time due to frequent generation of SV protocol messages.

[0045] Understandably, the detection capabilities of the SV message timing anomaly detection Transformer model will vary depending on the training set. If the training set includes the pre-password key field and the electrical signal dataset field of a normal SV message, then the SV message timing anomaly detection Transformer model trained on this training set can detect both the validity of the pre-password key field and the timing anomalies in the electrical signal dataset field.

[0046] Specifically, the anomaly detection method for SV protocol messages provided in this application embodiment may further include: normalizing the extracted pre-key fields and electrical signal dataset fields to obtain normalized vectors for the pre-key fields and electrical signal dataset fields.

[0047] Verifying the validity of each of the aforementioned pre-key fields using the Transformer model for detecting timing anomalies in SV messages may include:

[0048] The normalized vectors of each of the aforementioned key preceding fields are input into the Transformer model for detecting temporal anomalies in SV messages to obtain the anomaly degree of the SV message.

[0049] Specifically, if the Transformer model for detecting temporal anomalies in SV messages detects that the SV message includes an invalid preceding key field, the anomaly degree of the SV message exceeds a preset anomaly threshold.

[0050] Understandably, when the training set includes the pre-key fields of normal SV messages and the electrical signal dataset fields, and these fields are integrated into the same input for the SV message timing anomaly detection Transformer model, the normalized vectors of the aforementioned pre-key fields and the normalized vectors of the aforementioned electrical signal dataset fields are different parts of the same normalized vector. See also Figure 2 In steps S206 to S210, under these circumstances, the anomaly degree of the SV protocol message output by the Transformer model represents both the timing anomaly degree of the electrical signal dataset field of the SV protocol message and the validity of the preceding key fields of the SV protocol message. If the anomaly degree of the SV protocol message is lower than the preset anomaly threshold, then the electrical signal dataset field of the SV protocol message has no timing anomaly, and its preceding key fields are all valid; otherwise, it indicates that the SV protocol message has invalid preceding key fields, and / or the electrical signal dataset field has timing anomalies.

[0051] In some embodiments of this application, to enable the SV message timing anomaly detection Transformer model to detect the validity of pre-key fields and timing anomalies in electrical signal dataset fields, the SV message timing anomaly detection Transformer model can be trained through the following steps:

[0052] Obtain multiple anomaly-free SV protocol messages as a training set;

[0053] The pre-key field and the electrical signal dataset field in each of the abnormal SV protocol messages are normalized to obtain the normalized vector of each of the abnormal SV protocol messages.

[0054] The normalized vectors are matrix-processed to obtain the training data matrix;

[0055] A preset Transformer model is trained based on the training data matrix to obtain the Transformer model for detecting SV message timing anomalies.

[0056] Specifically, the normalization processing of the pre-key fields and the electrical signal dataset fields may include:

[0057] The data is mapped to the [0,1] interval by using the min-max normalization method on the pre-key fields and the fields of the electrical signal dataset. Data with different units and dimensions are normalized into a unified form, generating a normalized vector. After normalization, the value of each field will form a unified feature array.

[0058] In some embodiments of this application, the process of training a preset Transformer model for cooking porridge may further include:

[0059] Based on the position of the preceding key field in the normalized vector, set the weighting matrix of the preceding key field;

[0060] Based on the training data matrix, the preset Transformer model is trained in conjunction with the weighted matrix of the pre-key fields to obtain the SV message timing anomaly detection Transformer model.

[0061] By setting a weighted matrix for the pre-key fields, the final SV message timing anomaly detection Transformer model can have stronger sensitivity and recognition capabilities for the pre-key fields, thereby enabling the SV message timing anomaly detection Transformer model to better detect the legitimacy of the pre-key fields in SV protocol messages.

[0062] In some embodiments of this application, the anomaly detection method for SV protocol messages may need to detect SV protocol messages generated by different devices. The rules of the pre-key fields and the timing patterns of electrical signals in the electrical signal dataset fields of protocol messages generated by different devices may differ. Therefore, the number of training sets used to train the preset Transformer model can be multiple, and the multiple anomaly-free SV protocol messages included in the training set are generated by the same device, and the generating devices of the anomaly-free SV protocol messages in the multiple training sets are different.

[0063] The step of training a preset Transformer model based on the training data matrix to obtain the SV message timing anomaly detection Transformer model further includes:

[0064] The preset Transformer model is trained using transfer learning based on the training data matrix of each training set to obtain the SV message timing anomaly detection Transformer model.

[0065] The SV message timing anomaly detection Transformer model trained in this way can detect the validity of the pre-key fields of SV protocol messages generated by different devices and whether there are timing anomalies in the electrical signal dataset fields.

[0066] In some embodiments of this application, the anomaly detection method for SV protocol messages may further include: determining that the SV protocol message is a normal message when all the aforementioned key fields of the SV protocol message are valid and the anomaly degree is lower than the preset anomaly threshold.

[0067] If the SV protocol message is a normal message, save the selected normal message;

[0068] The training set is updated based on multiple normal messages saved within a preset time interval;

[0069] Preprocess multiple normal messages in the updated training set to obtain an updated data matrix;

[0070] The SV message timing anomaly detection Transformer model is trained based on the updated data matrix to obtain the updated SV message timing anomaly detection Transformer model.

[0071] Therefore, the Transformer model for detecting timing anomalies in SV messages can be updated based on the newly acquired SV protocol messages.

[0072] Understandably, the preset time interval can be determined based on the number of selected normal messages saved per unit time, so that the update of the SV message timing anomaly detection Transformer model can detect the anomalies in the current SV protocol messages in a timely and accurate manner.

[0073] In some embodiments of this application, the SV protocol messages may originate from different devices;

[0074] The step of updating the training set based on multiple normal messages stored within a preset time interval includes:

[0075] The source of the normal message is determined based on the Ethernet frame header of the normal message;

[0076] Multiple normal packets are divided according to their source to obtain multiple updated training sets.

[0077] Dividing multiple normal packets into multiple updated training sets based on the Ethernet frame header, and updating the SV packet timing anomaly detection Transformer model based on multiple updated training sets, allows the model to better record the current rules of the pre-key fields of SV packets generated by different devices and the current timing patterns of the electrical signal dataset fields, thereby better detecting whether there are anomalies in the current SV protocol packets.

[0078] Understandably, the Ethernet frame header may include the source MAC address, which can be used to determine the origin of the SV protocol message.

[0079] In some embodiments of this application, to maintain the detection accuracy of the Transformer model for detecting SV message timing anomalies, it is necessary to further filter the normal messages used to update the model. Therefore, saving the selected normal messages may include:

[0080] If the abnormality of the normal message is less than or equal to a preset abnormality filtering threshold, the normal message is saved, wherein the preset abnormality filtering threshold is less than the preset abnormality threshold.

[0081] If the preset anomaly screening threshold is less than the preset anomaly threshold, the temporal variation pattern of the electrical signal dataset field of the filtered normal message can have a small deviation from the temporal variation pattern of the existing electrical signal dataset field, thereby reducing the problem that updating the SV message temporal anomaly detection Transformer model may cause a decrease in model detection accuracy.

[0082] Understandably, the anomaly score can be between 0 and 1, for example, the preset anomaly threshold can be 0.6, for example, and the preset anomaly screening threshold can be 0.3.

[0083] In some embodiments of this application, the anomaly detection method for SV protocol messages can be applied to a firewall, and the method may further include:

[0084] If the SV protocol message is determined to be abnormal, the SV protocol message is blocked, and the SV protocol message is reported to the abnormal log system;

[0085] If all the aforementioned key fields of the SV protocol message are valid and the anomaly degree is less than the preset anomaly threshold, the SV protocol message is determined to be normal and the SV protocol message is allowed to pass.

[0086] The following is a specific example illustrating the anomaly detection method for SV protocol messages provided in this application:

[0087] In industrial network environments, multiple devices, such as smart sensors and monitoring units, continuously send real-time data to the main control system via the SV protocol. These SV protocol messages contain device status information and sensor sampling data. First, these SV protocol messages are captured in real-time using a network packet capture tool. Then, the captured raw data is preliminarily parsed, including:

[0088] Extract the basic frame structure of the SV message and analyze the Ethernet frame header, including the source MAC address, destination MAC address, priority flag, and Ethernet frame type.

[0089] The payload of the SV protocol is further decomposed into the APPID, Length, and APDU fields. APPID identifies the application type, Length indicates the data length, and APDU carries the actual sampled data.

[0090] The key fields of the APDU section are extracted one by one, including svID (unique identifier of sampled value), smpCnt (sample counter), confRef (configuration version number), smpSynch (synchronization bit), and seqDate (dataset content). These fields are used for subsequent data processing and feature extraction.

[0091] The message fields are used as features for extraction. To facilitate model learning, these features are normalized to ensure that different features fall within the same numerical range. Key feature fields such as svID, smpCnt, and confRef are selected, and the min-max normalization method is used to map the data to the [0,1] interval, normalizing data with different units and dimensions into a unified form, generating a feature vector. After normalization, the values ​​of each field form a unified feature array. After processing, multiple SV message data are finally combined into a matrix with (N,D) dimensions, where N is the number of samples and D is the feature dimension.

[0092] The processed dataset is trained using a pre-defined Transformer model. An attention mechanism is used in the model design to weight important feature fields, thereby improving the model's sensitivity and recognition ability to key data. An LSTM / GRU layer is introduced to read the data at each time point step by step, calculate the hidden state at each time step, and pass it to the next time step to capture the dynamic features in the time series.

[0093] After model training is complete, the system saves the trained model to a file for subsequent real-time inference. During system operation, whenever a new SV message is received, the system loads the model in real time to perform anomaly detection.

[0094] The Transformer model generates an anomaly score based on message characteristics. If the score exceeds a preset threshold, the system classifies the message as an anomaly, records detailed information about the anomaly message, including message field values ​​and anomaly score. For messages classified as normal, the system further performs policy matching. If the message meets all conditions, the system allows it to be transmitted normally and records the transmission log; if it does not meet the conditions, the system blocks the message and saves relevant information for subsequent review.

[0095] This application also provides an anomaly detection apparatus for SV protocol messages, including a memory and a processor. The memory is configured to store instructions; and the processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the anomaly detection method for SV protocol messages provided according to any of the foregoing embodiments.

[0096] See Figure 3 This application embodiment also provides a gateway, including the anomaly detection device 310 for SV protocol messages provided in the above embodiments, a first network interface card (NIC) 320, and a second NIC 340. The first NIC 320 is configured to connect the anomaly detection device 310 and a first industrial device 330; the second NIC 340 is configured to connect the anomaly detection device 310 and the second industrial device 350.

[0097] This application also provides a machine-readable storage medium storing instructions that cause a machine to execute the above-described anomaly detection method for SV protocol messages.

[0098] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the anomaly detection method for SV protocol messages provided according to any of the above embodiments.

[0099] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0100] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0101] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0102] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0103] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0104] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0105] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0106] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0107] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for anomaly detection in SV protocol messages, characterized in that, include: Obtain SV protocol messages; Extract the key fields and electrical signal dataset fields of each sampled value data unit in the SV protocol message; Verify the validity of the preceding key fields of each sampled value data unit; The electrical signal dataset fields are input into the Transformer model for SV message timing anomaly detection to obtain the anomaly degree of the SV message; If, after legality verification, it is determined that the SV protocol message includes an illegal pre-key field, or if the anomaly level is greater than or equal to a preset anomaly threshold, the SV protocol message is determined to be abnormal.

2. The method according to claim 1, characterized in that, The verification of the validity of the pre-key fields of each sampled data unit includes: The validity of each of the aforementioned key fields is verified using the Transformer model for detecting timing anomalies in SV messages.

3. The method according to claim 2, characterized in that, The method further includes: The extracted pre-key fields and electrical signal dataset fields are normalized to obtain normalized vectors for each pre-key field and electrical signal dataset field. The verification of the validity of each of the aforementioned key fields using the Transformer model for detecting timing anomalies in SV messages includes: The normalized vectors of each of the aforementioned key preceding fields are input into the Transformer model for detecting temporal anomalies in SV messages to obtain the anomaly degree of the SV message. Specifically, if the Transformer model for detecting temporal anomalies in SV messages detects that the SV message includes an invalid preceding key field, the anomaly degree of the SV message exceeds a preset anomaly threshold.

4. The method according to claim 2, characterized in that, The Transformer model for detecting SV message timing anomalies is trained through the following steps: Obtain multiple anomaly-free SV protocol messages as a training set; The pre-key field and the electrical signal dataset field in each of the abnormal SV protocol messages are normalized to obtain the normalized vector of each of the abnormal SV protocol messages. The normalized vectors are matrix-processed to obtain the training data matrix; A preset Transformer model is trained based on the training data matrix to obtain the Transformer model for detecting SV message timing anomalies.

5. The method according to claim 4, characterized in that, Train a preset Transformer model based on the training data matrix to obtain the SV message timing anomaly detection Transformer model, including: Based on the position of the preceding key field in the normalized vector, set the weighting matrix of the preceding key field; Based on the training data matrix, the preset Transformer model is trained in conjunction with the weighted matrix of the pre-key fields to obtain the SV message timing anomaly detection Transformer model.

6. The method according to any one of claims 1-5, characterized in that, The aforementioned key fields include: SV unique identifier, sampling counter field, configuration version number field, and synchronization bit field.

7. The method according to claim 4, characterized in that, The multiple abnormal SV protocol messages included in the training set are generated by the same device. There are multiple training sets, and the generating devices of the abnormal SV protocol messages in the multiple training sets are different. The step of training a preset Transformer model based on the training data matrix to obtain the SV message timing anomaly detection Transformer model further includes: The preset Transformer model is trained using transfer learning based on the training data matrix of each training set to obtain the SV message timing anomaly detection Transformer model.

8. The method according to claim 1, characterized in that, If each of the aforementioned key fields in the SV protocol message is valid and the anomaly level is lower than the preset anomaly threshold, then the SV protocol message is determined to be a normal message. The method further includes: Save the selected normal messages; The training set is updated based on multiple normal messages saved within a preset time interval; Preprocess multiple normal messages in the updated training set to obtain an updated data matrix; The SV message timing anomaly detection Transformer model is trained based on the updated data matrix to obtain the updated SV message timing anomaly detection Transformer model.

9. The method according to claim 1, characterized in that, The method is applied to a firewall, and the method further includes: If the SV protocol message is determined to be abnormal, the SV protocol message is blocked, and the SV protocol message is reported to the abnormal log system; If all the aforementioned key fields of the SV protocol message are valid and the anomaly degree is less than the preset anomaly threshold, the SV protocol message is determined to be normal and the SV protocol message is allowed to pass.

10. An anomaly detection device for SV protocol messages, characterized in that, include: The memory is configured to store instructions; as well as A processor is configured to retrieve the instructions from the memory and, when executing the instructions, to implement the anomaly detection method for SV protocol messages according to any one of claims 1 to 9.

11. A gateway, characterized in that, include: Anomaly detection device for SV protocol messages according to claim 10; The first network interface card is configured to connect the anomaly detection device and the first industrial equipment; The second network interface card is configured to connect to the anomaly detection device and the second industrial equipment.

12. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores instructions for causing the machine to perform an anomaly detection method for SV protocol messages according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the anomaly detection method for SV protocol messages according to any one of claims 1 to 9.

Images