Method for detecting network security behavior of power system based on deep learning dynamic graph neural network technology

Abstract

The invention discloses a method for detecting network security behaviors of a power system based on a deep learning dynamic graph neural network technology, and discloses a system for detecting the network security behaviors by establishing a deep learning dynamic graph neural network model and an auto-encoder model. According to a graph attention embedding module, a node dynamic information memory module, a node nearest neighbor relation module, a node behavior scoring module and other core modules, a DGNN model is constructed, and an auto-encoder model is set to detect node network behaviors. According to the method, historical communication pair data in a power system is collected and preprocessed, and equipment node characteristics and relation characteristics between equipment in each time period are extracted; data detection is carried out on the trained model, and network behaviors can be effectively detected.

Description

Technical Field

[0001] The present invention relates to the field of deep learning dynamic graph neural network application technology, and in particular to a method for detecting network security behavior of a power system based on deep learning dynamic graph neural network technology. Background Art

[0002] Network security behavior usually involves monitoring and analyzing data such as network traffic, user activities, and system logs. The amount of data is large, and traditional machine learning detection methods have high requirements for server resources. In addition, network behavior threats often evolve rapidly, and traditional analysis and detection methods have difficulty capturing rapidly changing patterns. Advanced Persistent Threats (APT) attacks usually go through multiple stages, and the behavior of each stage is relatively hidden and difficult to detect. In the power system network, due to the uninterrupted operation of the production system, network access between devices often has no time pattern, and access between some devices is very frequent, while access between some devices is very rare. These characteristics often make some traditional detection algorithms inefficient.

[0003] Traditional static graph neural networks assume that the graph structure is fixed during training and inference. This model has great limitations when faced with dynamic data or data that evolves over time, and cannot meet the needs of power system network security behavior detection.

[0004] Therefore, in view of the shortcomings of the existing technology, it is necessary to provide a method for detecting power system network security behavior based on deep learning dynamic graph neural network technology to overcome the shortcomings of the existing technology. Summary of the invention

[0005] The purpose of the present invention is to avoid the shortcomings of the prior art and provide a method for detecting the network security behavior of the power system based on deep learning dynamic graph neural network technology, which can effectively detect the network security behavior of the power system after model training.

[0006] The purpose of the present invention is achieved through the following technical measures.

[0007] A method for detecting network security behavior of power systems based on deep learning dynamic graph neural network technology is provided, which is carried out through the following steps: S1, construct dynamic graph model and autoencoder model; S2, construct pre-training data set and verification data set; S3, training model, including: First, use the edge relationship feature data between two device nodes to train the dynamic graph model; use the positive and negative sample comparison method to simulate negative samples, and use the binary classification algorithm to calculate the estimated value of each sample edge relationship feature; cache the estimated value result of the positive sample into memory; Based on all source device IPs within a time period, read the binary classification estimates of each source device IP for all global device nodes from the memory as training data to train the autoencoder model; S4, save the trained dynamic graph model and autoencoder model; S5, uses the dynamic graph model and the autoencoder model to detect real-time data, and uses the detection result of the autoencoder model as the detection result of the power system network security behavior.

[0008] Preferably, in the above-mentioned method for detecting network security behavior of power system based on deep learning dynamic graph neural network technology, the dynamic graph model constructed by S1 is provided with a graph attention embedding module, a node dynamic information memory module, a node nearest neighbor relationship module and a node behavior scoring module; The attention embedding module is a graph attention mechanism implemented by introducing the TransformerConv layer based on the Transformer architecture, which enables the dynamic graph model to adaptively focus on important neighbor nodes and edge information; and encodes the difference between the last update time of the node and the current interaction time, and combines it with the message features, so that the dynamic graph model can capture the time evolution pattern; The node dynamic information memory module is implemented by introducing the TGNMemory component to implement a dynamic memory mechanism to decide whether to retain or update the historical state of the node, so that the dynamic graph model can take into account long-term dependencies when making decisions; when the nodes in the dynamic graph interact (edges), messages are generated and historical messages are aggregated to update the memory state of the node; The node nearest neighbor relationship module is responsible for collecting and maintaining the connected neighbor nodes of each node and recording the time information when connected to provide more accurate context information; and for determining whether it is a negative sample based on the connection information when comparing positive and negative samples; The node behavior scoring module scores edge relationships using a binary classifier model based on training data to identify whether access between devices is abnormal access.

[0009] Preferably, the above-mentioned method for detecting power system network security behavior based on deep learning dynamic graph neural network technology, S2 includes: preprocessing historical data, summarizing commonly used service ports as global features of device nodes; and obtaining hourly segmented statistics based on historical data to obtain the access relationship between two device nodes in each time period.

[0010] Preferably, the method for detecting power system network security behavior based on deep learning dynamic graph neural network technology, S2 specifically includes the following steps: S21, collecting original communication pair data within a certain period of time as historical data, summarizing them by hour and port, and summarizing to obtain hourly port summary data, wherein the hourly port summary data is constructed in the format of hourly period, source device IP, target device IP, port, and number of accesses; S22, obtaining the global static features of all device nodes according to the hourly port summary data, and saving them as a node_feature.csv file; S23, in the hourly port summary data, the access situation between two device nodes is extracted by each hour as the edge relationship feature of the dynamic graph; S24, divide the processed node relationship feature files into training set, validation set and test set in chronological order, and store them in three directories: train, eval and test respectively.

[0011] Preferably, in the above-mentioned method for detecting power system network security behavior based on deep learning dynamic graph neural network technology, S22 specifically obtains the number of accessed devices and the number of accessed devices of all devices according to the hourly port summary data, as well as the characteristics of the commonly used ports, recognized ports, registered ports, dynamic or private ports in the entire power network system.

[0012] Preferably, the specific process of the S3 training model in the above method for detecting power system network security behavior based on deep learning dynamic graph neural network technology is as follows: S31, model initialization, including initializing the dynamic graph model and initializing the autoencoder model; Among them, initializing the dynamic graph model includes initializing the graph attention embedding module, initializing the node dynamic information memory module, initializing the node nearest neighbor relationship module, and setting the initialization dynamic graph model training parameters; Initialize the autoencoder model, including setting the encoder module, decoder module parameters, and setting the autoencoder model training parameters; S32, initializing global node feature data; S33, reading feature files according to time periods to train dynamic graph models, specifically including: S331, reading the node relationship feature file in chronological order, the read node relationship feature file is the batch of data; S332, calculating the time step value of the batch of data; S333, according to the nodes of the batch of data, read the nearest neighbor nodes from the node nearest neighbor relationship module, and the nodes that together constitute the batch of data are the local graph nodes; S334, reading the most recent node state from the node dynamic information memory module according to the local graph node and the time step value; S335, according to the local graph node, read the node static feature from the global node feature data cache, and merge the new node relationship combination information feature with the relationship feature between the current nodes; that is: Combined feature information = source device node static feature + target device node static feature + relationship feature between the two nodes; S336, updating the graph attention embedding layer according to the memory state of the local graph nodes and the node relationship combination information features; S337, use the positive and negative sample comparison method to calculate the loss rate; specific calculation method: Count all the nodes in a batch of data, and based on these nodes, obtain all the neighboring nodes of the batch of data and randomly generated negative sample nodes in the node nearest neighbor relationship module; for positive and negative samples, use the binary classifier model to predict the predicted value between 0 and 1, and then use the torch.nn.BCEWithLogitsLoss() loss function to count the loss of positive samples and the loss of negative samples respectively, and then add them together to get the loss of the sample; S338, updating the node dynamic information memory module according to the local graph node data; S339, updating the node nearest neighbor relationship module according to the local graph node data; S34, training the autoencoder model, specifically including: Get the source device nodes where the access event occurred in the current time step, get the binary classification prediction score data of the edge features of these nodes with all other nodes within a certain time step range, and train the autoencoder model; When using edge feature data to train a dynamic graph model, after each time step in the dynamic graph model training process is completed, the edge features contained in the time step are used to perform binary classification prediction scores using the dynamic graph model, and the results are updated to the cache; the source device node that has changed in the time step is obtained from the edge data, and the score data of the node for the global node set is read from the cache according to the changed source device node, and the feature data for training the autoencoder is constructed for training the autoencoder; the input feature data is compressed into a low-dimensional representation (encoding) by the encoder, and then the original input is reconstructed by the decoder; the torch.nn.MSELoss() mean square error loss function is used to calculate the reconstruction error between the original data and the reconstructed data; S35, cyclic training to generate the optimal model; Set the number of learning steps; after each step of training, use the validation data set to verify the average loss rate and average accuracy of the model for each node relationship feature data of the validation data; when the average loss rate is better than the original generated model, update and generate a new model file.

[0013] Preferably, the above method for detecting power system network security behavior based on deep learning dynamic graph neural network technology adds a cache of the global node set to each node, which is used to cache the node's binary classification prediction scores for the time steps and edge features of other nodes.

[0014] Preferably, the above-mentioned method for detecting power system network security behavior based on deep learning dynamic graph neural network technology also includes: online learning of node relationship changes and updating of models. Specifically, when the system determines that the access between network devices is relatively frequent and meets the normal access characteristics, this access relationship is updated to the model, the node dynamic information memory module and the node nearest neighbor relationship module are updated, and in subsequent detections, the access of this network device is identified as normal access.

[0015] Preferably, the above-mentioned method for detecting power system network security behavior based on deep learning dynamic graph neural network technology also includes: discovering node changes and retraining the model, specifically: when an increase in nodes occurs, re-aggregating data by hourly port, collecting data for the latest time period, retraining and generating a model file, and overwriting the original model file.

[0016] The method for detecting network security behavior of power system based on deep learning dynamic graph neural network technology of the present invention discloses a system for detecting network security behavior by establishing a deep learning dynamic graph neural network model and an autoencoder model, constructing a DGNN model according to core modules such as a graph attention embedding module, a node dynamic information memory module, a node nearest neighbor relationship module, and a node behavior scoring module, and setting an autoencoder model to detect node network behavior. By collecting historical communication data in the power system, preprocessing is performed to extract device node features and relationship features between devices in each time period. Data detection is performed on the trained model to effectively detect network behavior. The method of the present invention has fast training speed and low resource consumption; it can continuously monitor changes in device nodes and quickly update the model; the present invention is unsupervised learning and does not require manual labeling of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention is further described with reference to the accompanying drawings, but the contents in the accompanying drawings do not constitute any limitation to the present invention.

[0018] Figure 1 It is a schematic diagram of a method for detecting power system network security behavior based on deep learning dynamic graph neural network technology of the present invention.

[0019] Figure 2 This is an example of the "hourly port summary data" table in Example 1 of the present invention.

[0020] Figure 3It is a partial result of the “global static characteristics of all device nodes” result obtained in step S22 in Example 1 of the present invention.

[0021] Figure 4 It is the result of the edge relationship feature of the dynamic graph obtained in step S23 in Example 1 of the present invention.

[0022] Figure 5 It is a flow chart of the training model of the present invention.

[0023] Figure 6 This is the result of reading the node relationship feature file in chronological order in Embodiment 2 of the present invention.

[0024] Figure 7 It is the edge feature score result of one time step in Example 2 of the present invention.

[0025] Figure 8 It is the result of calculating the average loss rate of samples up to the previous period in Example 2 of the present invention.

[0026] Fig. 9 It is the result of the average accuracy of the statistical validation set data in Example 2 of the present invention.

[0027] Fig.10 The average accuracy result of each training is obtained after 20 rounds of cyclic training in Example 2 of the present invention.

[0028] Fig.11 This is the result of detecting abnormal node security behavior through the autoencoder model in Example 2 of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described with reference to the following examples.

[0030] Example 1 A method for detecting power system network security behavior based on deep learning dynamic graph neural network technology is carried out through the following steps: S1, construct dynamic graph model and autoencoder model; S2, construct pre-training data set and verification data set; S3, training model, including: First, use the edge relationship feature data between two device nodes to train the dynamic graph model; use the positive and negative sample comparison method to simulate negative samples, and use the binary classification algorithm to calculate the estimated value of each sample edge relationship feature; cache the estimated value result of the positive sample into memory; Based on all source device IPs within a time period, read the binary classification estimates of each source device IP for all global device nodes from the memory as training data to train the autoencoder model; S4, save the trained dynamic graph model and autoencoder model; S5, uses the dynamic graph model and the autoencoder model to detect real-time data, and uses the detection result of the autoencoder model as the detection result of the power system network security behavior.

[0031] Dynamic Graph Neural Networks (DGNN) is a technical direction in the field of deep learning, focusing on processing graph structure data that changes over time. It not only meets the needs of processing dynamic graph data in the real world, but also shows great potential in multiple fields. Autoencoder (AE) is a deep learning neural network, an unsupervised learning model that can identify potential anomalies by comparing the difference between input data and its reconstructed output.

[0032] Specifically, the dynamic graph model constructed by S1 is equipped with a graph attention embedding module, a node dynamic information memory module, a node nearest neighbor relationship module and a node behavior scoring module.

[0033] The attention embedding module is a graph attention mechanism implemented by introducing the TransformerConv layer based on the Transformer architecture, which enables the dynamic graph model to adaptively focus on important neighbor nodes and edge information; and encodes the difference between the last update time of the node and the current interaction time, and combines it with the message features, so that the dynamic graph model can capture the time evolution pattern.

[0034] The node dynamic information memory module implements a dynamic memory mechanism by introducing the TGNMemory component to decide whether to retain or update the historical state of the node, so that the dynamic graph model can take into account long-term dependencies when making decisions. When nodes in the dynamic graph interact (edges), messages are generated and historical messages are aggregated to update the memory state of the node.

[0035] The node nearest neighbor relationship module is responsible for collecting and maintaining the connected neighbor nodes of each node and recording the time information when connected to provide more accurate context information. When comparing positive and negative samples, it determines whether it is a negative sample based on the connection information.

[0036] The node behavior scoring module uses a binary classifier model to score edge relationships based on training data to identify whether access between devices is abnormal.

[0037] The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology of the present invention, S2 includes: preprocessing historical data, summarizing common service ports as global features of device nodes. According to the historical data, the access relationship between two device nodes in each time period (number of access ports, total number of accesses, two ports with the highest number of accesses, etc.) is obtained, that is, the (edge) relationship characteristics between dynamic graph nodes.

[0038] S2 specifically includes the following steps: S21, collects the original communication pair data within a certain period of time (such as 13 weeks, 3 months) as historical data. The data volume is relatively large, and is summarized by hour and port to obtain hourly port summary data. The data volume after summary is greatly reduced compared to the original data. "Hourly port summary data" is constructed in the format of hourly segment, source device IP, target device IP, port, and access times.

[0039] like Figure 2 The following is an example of "hourly port summary data". The first row of data indicates that in the one-hour period from 5:00:00 to 5:59:59 on that day, device A (source device IP=10.146.145.70) accessed the service port (8080) of device B (destination device IP=192.168.131.30) 80 times.

[0040] S22, obtaining global static features of all device nodes according to the hourly port summary data, and saving them as a node_feature.csv file.

[0041] S22 specifically obtains the number of devices accessed and the number of devices visited of all devices based on the hourly port summary data, as well as the characteristics of the commonly used ports, recognized ports, registered ports, dynamic or private ports in the entire power network system. These characteristics are the global static characteristics of all device nodes.

[0042] From the hourly port summary data, we can see: 1) A device node has visited multiple other target device nodes. For example, device A (source device IP = 10.146.145.70) has visited many target devices, and the device feature "number of devices visited" is obtained.

[0043] 2) How many other device nodes have visited a device node. For example, how many device nodes have visited device B (target device IP = 192.168.131.30) to obtain the device's feature "number of visited devices".

[0044] 3) The target device node provides several port services to the outside world, and it can be concluded that ports 80, 81, 161, 162, 443, 514, 1521, 3306, 6379, 8000, 8080, 8081, 8082, 8848, 8876, and 10081 are commonly used ports in the entire power network system. These commonly used ports are used as the characteristics of the device. 0 indicates that the port does not provide services, and 1 indicates that the port provides services. In addition to using commonly used ports as device characteristics, three characteristics are added, namely recognized ports (0 to 1023), registered ports (1024 to 49151), and dynamic or private ports (49152 to 65535). These three characteristics are represented by non-negative integers, indicating how many ports in the port segment provide external services.

[0045] According to the above method, the global static features of all device nodes are calculated and saved as node_feature.csv file.

[0046] like Figure 3 The first line of data shows that a device (IP=192.168.113.11) accesses 8 other device nodes and is accessed by 6 other device nodes. The public port segment exposes 1 port, the registered port segment exposes 4 ports, and the dynamic or private port segment exposes 2 ports. It also provides external services on ports 80, 443, 8000, 8080, 8081, and 8082.

[0047] S23, in the hourly port summary data, the access situation between two device nodes is extracted by each hour as the edge relationship feature of the dynamic graph. Figure 4 As shown in the first row of data, it means that during the one-hour period from 5:00:00 to 5:59:59 on that day, device A (source device IP=10.146.145.70) accessed device B (target device IP=192.168.131.30) a total of 104 times, with a total of 4 ports. The most visited port was 8080, with 80 visits, and the second most visited port was 8082, with 12 visits.

[0048] S24, divide the processed node relationship feature files into training set, validation set and test set in chronological order, and store them in three directories: train, eval and test respectively.

[0049] For example, the processed node relationship feature files can be divided into training set (10 weeks), validation set (2 weeks), and test set (1 week) in chronological order. They are stored in three directories: train, eval, and test. Under each data set directory, the date directory is divided according to the data of each day, such as the 20240801 directory. Each date directory has 24 hours of csv files. The structure is as follows: / dataset |--node_feature.csv (node ​​feature file) | / train | / 20240801 |--hour1.csv (node ​​relationship feature file for each hour) |-- ....... | / 20240802 | / eval ...... | / test ...... .

[0050] The method for detecting network security behavior of power system based on deep learning dynamic graph neural network technology of the present invention, the specific process of S3 training model is as follows Figure 5 As shown: S31, model initialization, including initializing the dynamic graph model and initializing the autoencoder model; Among them, initializing the dynamic graph model includes initializing the graph attention embedding module, initializing the node dynamic information memory module, initializing the node nearest neighbor relationship module, and setting the initialization dynamic graph model training parameters.

[0051] Initialize the autoencoder model, including setting the encoder module, decoder module parameters, and setting the autoencoder model training parameters.

[0052] S32, initialize global node feature data. Through data preprocessing, obtain global node feature data as global cache to facilitate subsequent program calls. Node features are mainly common port features, whether to use the common port to provide external services.

[0053] S33, reading feature files according to time periods to train dynamic graph models, specifically including: S331, read the node relationship feature file in chronological order, and the read node relationship feature file is the batch of data.

[0054] S332, calculate the time step value of the batch of data. Time step value calculation method: For example, set 0:00 on August 1, 2024 to 1, and increase the value by 1 every subsequent hour.

[0055] S333, according to the nodes of the batch of data, read their nearest neighbor nodes from the node nearest neighbor relationship module, and together constitute the nodes of the batch of data, namely the local graph nodes.

[0056] S334, read the most recent node status from the node dynamic information memory module according to the local graph node and time step value.

[0057] S335, according to the local graph node, read the node static feature from the global node feature data cache, and merge the new node relationship combination information feature with the relationship feature between the current nodes; that is: Combined feature information = source device node static feature + target device node static feature + relationship feature of the two nodes.

[0058] S336, update the graph attention embedding layer according to the memory status of the local graph nodes and the node relationship combination information features.

[0059] S337, use the positive and negative sample comparison method to calculate the loss rate; specific calculation method: Count all the nodes in a batch of data, and based on these nodes, obtain all the neighboring nodes of the batch of data and randomly generated negative sample nodes in the node nearest neighbor relationship module; for positive and negative samples, use the binary classifier model to predict the predicted values ​​between 0 and 1, and then use the torch.nn.BCEWithLogitsLoss() loss function to count the loss of positive samples and the loss of negative samples respectively, and then add them up to get the loss of the sample.

[0060] S338, based on the local graph node data, update the node dynamic information memory module.

[0061] S339, update the node nearest neighbor relationship module according to the local graph node data.

[0062] S34, training the autoencoder model, specifically including: Get the source device nodes where access events occurred in the current time step, obtain the binary classification prediction score data of the edge features of these nodes with all other nodes within a certain time step range, and train the autoencoder model.

[0063] To train the autoencoder model, it is necessary to obtain the source device nodes where the access event occurred in the current time step, and obtain the binary classification prediction score data of the edge features of these nodes with all other nodes within a certain time step range. For example, a 48-time step range is set (a different time step range can be set according to actual conditions). In the program, a cache of the global node set is added to each node to cache the time step and edge feature binary classification prediction scores of the node for other nodes.

[0064] When using edge feature data to train a dynamic graph model, after each time step in the dynamic graph model training process is completed, the edge features contained in the time step are used to perform binary classification prediction scores using the dynamic graph model, and the results are updated to the cache; the source device node that has changed at the time step is obtained from the edge data, and the score data of the node for the global node set is read from the cache based on the changed source device node, and the feature data for training the autoencoder is constructed for training the autoencoder; the input feature data is compressed into a low-dimensional representation (encoding) by the encoder, and then the original input is reconstructed by the decoder; the torch.nn.MSELoss() mean square error loss function is used to calculate the reconstruction error between the original data and the reconstructed data.

[0065] S35, cyclic training generates the optimal model.

[0066] Set the number of learning steps, such as 20 steps. After each step of training is completed, use the validation data set to verify the average loss rate and average accuracy of the model for each node relationship feature data of the validation data; when the average loss rate is better than the original generated model, update and generate a new model file.

[0067] The method for detecting network security behavior of power system based on deep learning dynamic graph neural network technology of the present invention discloses a system for detecting network security behavior by establishing a deep learning dynamic graph neural network model and an autoencoder model, constructing a DGNN model according to core modules such as a graph attention embedding module, a node dynamic information memory module, a node nearest neighbor relationship module, and a node behavior scoring module, and setting an autoencoder model to detect node network behavior. By collecting historical communication data in the power system, preprocessing is performed to extract device node features and relationship features between devices in each time period. Data detection is performed on the trained model to effectively detect network behavior. The method of the present invention has fast training speed and low resource consumption; it can continuously monitor changes in device nodes and quickly update the model; the present invention is unsupervised learning and does not require manual labeling of data.

[0068] Example 2 Taking a specific application example, the method for detecting power system network security behavior based on deep learning dynamic graph neural network technology in Example 1 is sampled to perform power system network security behavior detection.

[0069] In this example, data preprocessing is as follows: collect the original communication pair data, generate global static features of all 648 nodes by summarizing and extracting features, and generate relationship feature files between nodes, which are divided into training set, validation set, and test set in chronological order. They are stored in three directories: train, eval, and test. Under each data set directory, the date directory is divided according to the data of each day, and each date directory has 24 hours of csv files. The structure is as follows: / dataset |--node_feature.csv (node ​​feature file) | / train | / 20240801 |--hour1.csv (node ​​relationship feature file for each hour) |-- ....... | / 20240802 | / eval ...... | / test ...... .

[0070] In this embodiment, the training model is specifically: 1) Read the node relationship feature file in chronological order.

[0071] Read the file for each hour segment and calculate the time step value according to the time corresponding to the file. The result is as follows Figure 6 shown.

[0072] 2) After all feature files are trained (i.e. after each time step), the binary classification prediction score of each edge feature is calculated. Figure 7 As shown (this figure is only used to show the edge feature scores at this time step).

[0073] Update the score of the source device node that changes at this time step to the cache, and obtain the score data of itself and all node sets from the cache according to the change of the source device node to train the autoencoder model.

[0074] 3) After each feature file is trained, the current sample loss is counted and summarized into the total loss, and the average loss rate of the previous samples is counted. The results are as follows Figure 8 shown.

[0075] 4) After all feature files are trained, the validation set data is used for testing and the average accuracy of the validation set data is calculated. The results are as follows: Fig. 9 shown.

[0076] After 20 cycles of training, the average accuracy of each training is obtained, such as Fig.10 shown.

[0077] After the model is trained, the autoencoder model is used to detect real-time data, and the results of model detection are used as the detection results of power system network security behavior.

[0078] Using a sliding time window, the raw data between nodes in the past 48 hours is preprocessed to obtain edge feature data, which is then scored by binary classification using a dynamic graph model and placed in the node's memory cache of the global node set. The data of each source node is constructed through the cache, and abnormal node security behavior is detected through the autoencoder model. Fig.11 As shown in the figure, the threshold is set to 0.01, and nodes above the threshold are considered to have abnormal network behavior.

[0079] The present invention can effectively detect network behavior by performing data detection through a trained model. The method of the present invention has a fast training speed and consumes less resources; it can continuously monitor changes in device nodes and quickly update the model; the present invention is unsupervised learning and does not require manual labeling of data.

[0080] Example 3 The method of detecting power system network security behavior based on deep learning dynamic graph neural network technology in this embodiment has other features that are the same as those of embodiment 1 or 2, except that it also includes: online learning of node relationship changes and updating of models. Specifically, when the system determines that the access between network devices is relatively frequent and meets the normal access characteristics, this access relationship is updated to the model, the node dynamic information memory module is updated, and the node nearest neighbor relationship module is updated. In subsequent detections, the access of this network device is identified as normal access.

[0081] The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology also includes: discovering node changes and retraining the model. Specifically, when an increase in nodes occurs, re-aggregating data by hourly port, collecting data for the latest time period, retraining and generating a model file, and overwriting the original model file.

[0082] The method of detecting power system network security behavior based on deep learning dynamic graph neural network technology in this embodiment can adjust and update the model in time according to the changes of actual nodes in the power system.

[0083] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit the scope of protection of the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the essence and scope of the technical solution of the present invention.

Claims

1. A method for detecting power system network security behavior based on deep learning dynamic graph neural network technology, characterized in that: Proceed as follows: S1, construct dynamic graph model and autoencoder model; S2, construct pre-training data set and verification data set; S3, training model, including: First, use the edge relationship feature data between two device nodes to train the dynamic graph model; use the positive and negative sample comparison method to simulate negative samples, and use the binary classification algorithm to calculate the estimated value of each sample edge relationship feature; cache the estimated value result of the positive sample into memory; Based on all source device IPs within a time period, read the binary classification estimates of each source device IP for all global device nodes from the memory as training data to train the autoencoder model; S4, save the trained dynamic graph model and autoencoder model; S5, uses the dynamic graph model and the autoencoder model to detect real-time data, and uses the detection result of the autoencoder model as the detection result of the power system network security behavior.

2. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 1 is characterized in that: The dynamic graph model constructed by S1 is equipped with a graph attention embedding module, a node dynamic information memory module, a node nearest neighbor relationship module, and a node behavior scoring module; The attention embedding module is a graph attention mechanism implemented by introducing the TransformerConv layer based on the Transformer architecture, which enables the dynamic graph model to adaptively focus on important neighbor nodes and edge information; and encodes the difference between the last update time of the node and the current interaction time, and combines it with the message features, so that the dynamic graph model can capture the time evolution pattern; The node dynamic information memory module is implemented by introducing the TGNMemory component to implement a dynamic memory mechanism to decide whether to retain or update the historical state of the node, so that the dynamic graph model can take into account long-term dependencies when making decisions; when the nodes in the dynamic graph interact, messages are generated and historical messages are aggregated to update the memory state of the node; The node nearest neighbor relationship module is responsible for collecting and maintaining the connected neighbor nodes of each node and recording the time information when connected to provide more accurate context information; When comparing positive and negative samples, determine whether it is a negative sample based on the connected information; The node behavior scoring module scores edge relationships using a binary classifier model based on training data to identify whether access between devices is abnormal access.

3. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 2 is characterized in that S2 include: Preprocess historical data and summarize common service ports as global features of device nodes; According to the historical data, the access relationship between the two device nodes in each time period is obtained by performing hourly segment statistics.

4. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 3 is characterized in that: S2 specifically includes the following steps: S21, collecting original communication pair data within a certain period of time as historical data, summarizing them by hour and port, and summarizing to obtain hourly port summary data, wherein the hourly port summary data is constructed in the format of hourly period, source device IP, target device IP, port, and number of accesses; S22, obtaining the global static features of all device nodes according to the hourly port summary data, and saving them as a node_feature.csv file; S23, in the hourly port summary data, the access situation between two device nodes is extracted by each hour as the edge relationship feature of the dynamic graph; S24, divide the processed node relationship feature files into training set, validation set and test set in chronological order, and store them in three directories: train, eval and test respectively.

5. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 4 is characterized in that: S22 specifically obtains the number of devices accessed and the number of devices accessed by all devices based on the hourly port summary data, as well as the characteristics of the commonly used ports, recognized ports, registered ports, dynamic or private ports in the entire power network system.

6. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to any one of claims 1 to 5, characterized in that: The specific process of S3 training model is as follows: S31, model initialization, including initializing the dynamic graph model and initializing the autoencoder model; Among them, initializing the dynamic graph model includes initializing the graph attention embedding module, initializing the node dynamic information memory module, initializing the node nearest neighbor relationship module, and setting the initialization dynamic graph model training parameters; Initialize the autoencoder model, including setting the encoder module, decoder module parameters, and setting the autoencoder model training parameters; S32, initializing global node feature data; S33, reading feature files according to time periods to train dynamic graph models, specifically including: S331, reading the node relationship feature file in chronological order, the read node relationship feature file is the batch of data; S332, calculating the time step value of the batch of data; S333, according to the nodes of the batch of data, read the nearest neighbor nodes from the node nearest neighbor relationship module, and the nodes that together constitute the batch of data are the local graph nodes; S334, reading the most recent node state from the node dynamic information memory module according to the local graph node and the time step value; S335, according to the local graph node, read the node static feature from the global node feature data cache, and merge the new node relationship combination information feature with the relationship feature between the current nodes; that is: Combined feature information = source device node static feature + target device node static feature + relationship feature between the two nodes; S336, updating the graph attention embedding layer according to the memory state of the local graph nodes and the node relationship combination information features; S337, use the positive and negative sample comparison method to calculate the loss rate; specific calculation method: Count all the nodes in a batch of data, and based on these nodes, obtain all the neighboring nodes of the batch of data and randomly generated negative sample nodes in the node nearest neighbor relationship module; for positive and negative samples, use the binary classifier model to predict the predicted value between 0 and 1, and then use the torch.nn.BCEWithLogitsLoss() loss function to count the loss of positive samples and the loss of negative samples respectively, and then add them together to get the loss of the sample; S338, updating the node dynamic information memory module according to the local graph node data; S339, updating the node nearest neighbor relationship module according to the local graph node data; S34, training the autoencoder model, specifically including: Get the source device nodes where the access event occurred in the current time step, get the binary classification prediction score data of the edge features of these nodes with all other nodes within a certain time step range, and train the autoencoder model; When using edge feature data to train a dynamic graph model, after each time step in the dynamic graph model training process is completed, the edge features contained in the time step are used to perform binary classification prediction scores using the dynamic graph model, and the results are updated to the cache; the source device node that has changed in the time step is obtained from the edge data, and the score data of the node for the global node set is read from the cache according to the changed source device node, and the feature data for training the autoencoder is constructed for training the autoencoder; the input feature data is compressed into a low-dimensional representation by the encoder, and then the original input is reconstructed by the decoder; the torch.nn.MSELoss() mean square error loss function is used to calculate the reconstruction error between the original data and the reconstructed data; S35, cyclic training to generate the optimal model; Set the number of learning steps; after each step of training, use the validation data set to verify the average loss rate and average accuracy of the model for each node relationship feature data of the validation data; when the average loss rate is better than the original generated model, update and generate a new model file.

7. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 6 is characterized in that: A cache of the global node set is added to each node to cache the binary classification prediction scores of the time steps and edge features of other nodes.

8. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 6 is characterized in that: Also includes: Online learning of node relationship changes and updating of models. Specifically, when the system determines that the access between network devices is frequent and meets the normal access characteristics, this access relationship is updated to the model, the node dynamic information memory module and the node nearest neighbor relationship module are updated. In subsequent detections, the access of this network device is identified as normal access.

9. The method for detecting power system network security behavior based on deep learning dynamic graph neural network technology according to claim 6 is characterized in that: It also includes: discovering node changes and retraining the model. Specifically, when a node is added, the data is re-aggregated by hourly port, the data of the latest time period is collected, the model file is retrained and generated, and the original model file is overwritten.

Images