Network security detection method and device, electronic equipment, product and storage medium

Abstract

The invention provides a network security detection method and device, electronic equipment, a product and a storage medium, and relates to the technical field of wireless communication. The method comprises the following steps: acquiring to-be-detected data in the power wireless sensor network; inputting the to-be-detected data into a network security detection model to obtain a network security detection result output by the network security detection model; wherein the network security detection model is obtained by training sample detection data and a sample network security detection result label corresponding to the sample detection data, and target model parameters of the network security detection model are obtained by optimizing a chaos elite energy valley algorithm. According to the method, the defects that in the prior art, for unknown or complex and changeable attack types, false alarm and missing alarm are likely to occur, then attacks are not detected in time or normal behaviors are misjudged to be abnormal, and power grid operation is abnormal can be overcome.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication technology, and in particular to a network security detection method, device, electronic equipment, product and storage medium. Background Art

[0002] With the widespread application of Electric Wireless Sensor Network (EWSN) in smart distribution networks, this technology has become the key to data perception and transmission in smart distribution networks. However, due to the complex operating environment of EWSN and its vulnerability to attacks, data transmission failures and node paralysis often occur, seriously affecting the security and stability of the power grid. Statistics show that distribution network failures account for more than 90% of power grid accidents, so it is crucial to improve the security and service quality of EWSN.

[0003] Existing smart distribution network wireless sensor network security detection methods mainly include rule-based detection methods and statistics-based detection methods. However, rule-based detection methods match abnormal behaviors through predefined rules and are suitable for known attack scenarios; statistics-based detection methods use data statistical features to analyze abnormal patterns. These traditional methods have certain advantages in dealing with simple attacks, but when faced with unknown or complex and changeable attack types, they are prone to false positives and false negatives, which in turn leads to attacks not being detected in time or normal behaviors being misjudged as abnormal, resulting in abnormal grid operation. Summary of the invention

[0004] The present invention provides a network security detection method, device, electronic device, product and storage medium to solve the defects of the prior art that false alarms and missed alarms are prone to occur when facing unknown or complex and changeable attack types, which may lead to attacks not being detected in time or normal behaviors being misjudged as abnormal, resulting in abnormal operation of the power grid.

[0005] The present invention provides a network security detection method, comprising: Acquire the data to be detected in the power wireless sensor network; Inputting the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; The network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm.

[0006] According to a network security detection method provided by the present invention, the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley Algorithm based on the following method: Updating the position vector of each particle in the particle matrix to determine an initial particle set, wherein the position vector of each particle in the initial particle set represents each group of model parameters to be optimized; determining a neutron-rich particle set and a neutron-poor particle set from the initial particle set based on the energy of each particle in the initial particle set; Based on the stability level of each particle in the neutron-rich particle set, the neutron-rich particle set is iterated at least once until a tuning particle that meets preset requirements is obtained, and the position vector of the tuning particle is determined as a target model parameter.

[0007] According to a network security detection method provided by the present invention, any one iteration of the at least one iteration includes: Determining a decay particle set and elite particles from the neutron-rich particle set based on the stability level of each particle in the neutron-rich particle set; Determining an updated stability level of each particle in the decay particle set based on a comparison result between the stability level of each particle in the decay particle set and a preset stability bound; Based on the updated stability level of each particle in the decay particle set and the stability level of the elite particle, a tuning particle is determined.

[0008] According to a network security detection method provided by the present invention, the method of determining a decay particle set and elite particles from the neutron-rich particle set based on the stability level of each particle in the neutron-rich particle set includes: sorting the stability levels of the particles in the neutron-rich particle set, and determining the particle with the largest stability level in the neutron-rich particle set as an elite particle; A decay particle set is determined based on all particles in the neutron-rich particle set except the elite particles.

[0009] According to a network security detection method provided by the present invention, the updated stability level of each particle in the decay particle set is determined based on the comparison result between the stability level of each particle in the decay particle set and a preset stability boundary, including: Determining the decay type of each particle in the decay particle set based on a comparison result of the stability level of each particle in the decay particle set and a preset stability bound; Based on the decay type of each particle in the decay particle set, each particle in the decay particle set is decayed, and a stable level of each particle in the decay particle set after decay is determined as an updated stable level of each particle.

[0010] According to a network security detection method provided by the present invention, the determining of a neutron-rich particle set and a neutron-poor particle set from the initial particle set based on the energy of each particle in the initial particle set comprises: determining the energy of each particle in the initial particle set; Determining the neutron-rich particle set and the neutron-poor particle set based on a comparison result between the energy of each particle in the initial particle set and a preset particle enrichment boundary; Among them, the energy of each neutron-rich particle in the neutron-rich particle set is lower than the energy of each neutron-poor particle in the neutron-poor particle set, and the energy of each of the particles is proportional to the size of the loss function value corresponding to the model obtained by training each set of model parameters to be optimized.

[0011] The present invention also provides a network security detection device, comprising: An acquisition module, which is used to acquire the data to be detected in the power wireless sensor network; A detection module, which is used to input the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; The network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the network security detection methods described above is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the network security detection method as described above is implemented.

[0014] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the network security detection method as described above is implemented.

[0015] The network security detection method, device, electronic device, product and storage medium provided by the present invention obtain the data to be detected in the power wireless sensor network; input the data to be detected into the network security detection model to obtain the network security detection result output by the network security detection model; wherein the network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the chaos elite energy valley algorithm; through the global search and local fine optimization capabilities of the chaos elite energy valley algorithm, the network security detection model trained by the present invention can more accurately capture the characteristics of attack behavior, improve the reliability of network security detection results, reduce unnecessary intervention caused by false alarms and missed alarms, and avoid equipment damage and resource waste caused by attacks not being detected in time. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flow chart of the network security detection method provided by the present invention.

[0018] Figure 2 It is a structural schematic diagram of the network security detection device provided by the present invention.

[0019] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] With the rapid development of smart distribution networks, the security and stability of power wireless sensor networks (EWSNs) as an important infrastructure for data collection and transmission are directly related to the efficient and reliable operation of distribution networks. However, the applicant found in the study that EWSN nodes are vulnerable to various network threats (such as black hole attacks, tampering attacks and replay attacks) due to their limited energy, vulnerability to attacks and difficult maintenance, which leads to data transmission failures and node paralysis, seriously affecting the operating efficiency and power supply quality of the distribution network. Especially in the complex and changeable power environment, the existing security detection methods are difficult to meet the high security and high reliability requirements of smart distribution networks.

[0022] Further research found that existing technologies mainly use rule-based and statistical methods to detect network attacks, but these methods have obvious shortcomings when dealing with unknown attacks and complex and changing attack patterns. Specifically, rule-based methods rely on predefined rules and are difficult to adapt to dynamically changing attack scenarios; although statistical methods can analyze data features, they have limited detection capabilities for new or hidden attacks, which can easily lead to high false alarm rates and high missed alarm rates. In addition, these methods lack intelligent optimization capabilities and are difficult to adapt to dynamic changes in complex environments.

[0023] In view of the above problems, the present invention proposes the following embodiments.

[0024] Figure 1 is a flow chart of the network security detection method provided by the present invention, such as Figure 1 As shown, the method includes the following: Step 110: Acquire the data to be detected in the power wireless sensor network.

[0025] Here, the data to be detected refers to the information related to the operating status and environmental conditions of the power grid collected by the power wireless sensor nodes. These data reflect the real-time status of the power grid at different locations and times, and are the basis for power grid monitoring, analysis and management.

[0026] Step 120: input the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model.

[0027] The network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm.

[0028] Here, the network security detection model is a model built based on deep learning algorithms to identify and detect network security threats.

[0029] Here, the Chaos Elite Energy Valley Algorithm combines the advantages of chaos theory and the Elite Energy Valley Algorithm. Chaos theory has good ergodicity and randomness, which can help the algorithm jump out of the local optimal solution and explore more areas of the solution space. The Elite Energy Valley Algorithm quickly converges to the bottom of the energy valley, that is, to the area with the minimum objective function value, by simulating the movement of particles in the energy field. The combination of the two makes it possible to find the global optimal solution more effectively during the optimization process, thereby finding the optimal parameter combination for the network security detection model and improving the prediction accuracy and performance of the model.

[0030] For example, the network security detection model can be an ECEVO-BiLSTM-Attention model, that is, a model based on the Elite Chaos Evolutionary Optimization (ECEVO) algorithm, a bidirectional long short-term memory network (BiLSTM) and an attention mechanism (Attention), the purpose of which is to better learn time series features and more accurately detect network intrusion behaviors, thereby improving the network security protection capabilities of the power system. The ECEVO-BiLSTM-Attention model needs to be trained first, which can be obtained by the following training methods: first, a large amount of network intrusion data is collected, and high-quality data is obtained by mixing large model annotations and manual screening annotations. The data is divided into a training set, a detection set, and a validation set, and the training set is input into the model until the optimal network security detection model is obtained.

[0031] Among them, during the training process, the ECEVO-BiLSTM-Attention model needs to optimize parameters through the Chaos Elite Energy Valley algorithm to obtain the optimal initial learning rate, number of hidden layer neurons, batch size and number of training iterations.

[0032] The network security detection method provided by the embodiment of the present invention, through the global search and local fine optimization capabilities of the chaos elite energy valley algorithm, the trained network security detection model can more accurately capture the characteristics of attack behavior, improve the reliability of network security detection results, reduce unnecessary intervention caused by false alarms and missed alarms, and avoid equipment damage and resource waste caused by untimely detection of attacks.

[0033] Based on any of the above embodiments, in this method, the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm in the following manner: Updating the position vector of each particle in the particle matrix to determine an initial particle set, wherein the position vector of each particle in the initial particle set represents each group of model parameters to be optimized; determining a neutron-rich particle set and a neutron-poor particle set from the initial particle set based on the energy of each particle in the initial particle set; Based on the stability level of each particle in the neutron-rich particle set, the neutron-rich particle set is iterated at least once until a tuning particle that meets preset requirements is obtained, and the position vector of the tuning particle is determined as a target model parameter.

[0034] It should be noted that the particle matrix is ​​used to represent a set of model parameter combinations to be optimized. Each particle represents a set of parameters. The number of rows in the particle matrix represents the number of particles, and the number of columns represents the dimension of the model parameters. The position vector of the particle represents the position of the particle in the solution space, that is, a set of specific model parameter values. The energy of the particle represents the loss function value of the model obtained by training the model parameters corresponding to the particle. The lower the energy, the better the model parameters. A tuned particle refers to a particle that meets the preset requirements after iterative optimization. The position vector of the tuned particle is determined as the target model parameter.

[0035] For example, each particle in the initial particle set can be Encode, composed of Particle Dimensional Matrix ; Furthermore, a new particle swarm is generated using chaotic mapping, where the chaotic parameter value Set it to 0.45, as shown in the following formula: ; Specifically, the neutron-rich particle set contains particles with lower energies, that is, model parameter combinations with smaller corresponding loss function values. The energy of each particle is proportional to the loss function value of each set of model parameters represented by each particle. In the optimization problem, the energy of the particle is used to characterize the loss function value. Therefore, the lower the energy of the particle, the smaller the loss function value of the corresponding model parameter combination on the trained network security detection model, that is, the better the prediction performance of the network security detection model. Conversely, the higher the energy of the particle, the larger the loss function value of the corresponding model parameter combination on the trained network security detection model, that is, the worse the prediction performance of the network security detection model.

[0036] Exemplarily, the neutron enrichment level of each particle may be determined based on the following formula: ; Among them, EB represents the preset particle enrichment boundary, represents the neutron enrichment level of the ith particle, and n is the total number of particles.

[0037] Exemplarily, the stability level of each particle in the neutron-rich particle set is determined based on the following formula: ; in, It means The stable level of particles, is the particle with the best stability level, that is, the minimum value of the loss function. It is the particle with the worst stability level, that is, the maximum value of the loss function.

[0038] The iterative process for the neutron-rich particle set may be referred to the following embodiments, which will not be elaborated herein.

[0039] Furthermore, the stability level of each particle is inversely proportional to the energy of each particle. In the energy valley optimization algorithm, the stability level of the particle is calculated based on the neutron enrichment level and enrichment limit of the particle. A particle with a higher stability level indicates that the particle has a lower energy, that is, the corresponding model parameter combination has a smaller loss function value on the trained model, and the model's prediction performance is better. Conversely, a particle with a lower stability level indicates that the particle has a higher energy, that is, the corresponding model parameter combination has a larger loss function value on the trained model, and the model's prediction performance is poor.

[0040] The network security detection method provided by the embodiment of the present invention determines the initial particle set by updating the position vector of each particle in the particle matrix, so that the initial position of each particle represents the model parameter configuration to be optimized. Through the evaluation based on particle energy, the neutron-rich particle set and the neutron-poor particle set are identified to ensure that the optimization process starts with particles with better performance. Further through iterative optimization, the stability of the particles in the neutron-rich particle set is updated until the tuning particles that meet the preset requirements are obtained, and the target model parameters are finally determined. This process can effectively improve the search efficiency and optimization accuracy of the model parameters through intelligent particle swarm optimization, and realize high-quality model parameter tuning through step-by-step iterative optimization, thereby significantly improving the accuracy and robustness of the network security detection model, while avoiding the overfitting or false alarm problems in traditional methods, and improving security and performance.

[0041] Based on any of the foregoing embodiments, in the method, any one of the at least one iteration includes: Determining a decay particle set and elite particles from the neutron-rich particle set based on the stability level of each particle in the neutron-rich particle set; Determining an updated stability level of each particle in the decay particle set based on a comparison result between the stability level of each particle in the decay particle set and a preset stability bound; Based on the updated stability level of each particle in the decay particle set and the stability level of the elite particle, a tuning particle is determined.

[0042] Here, the preset stability bound is a threshold used to determine which particles have reached a sufficiently high level of stability. Elite particles are the best performing particles in the neutron-rich particle set, with the highest stability and the smallest loss function value. Compared with elite particles, particles in the decay particle set have poorer stability and lower performance. Updating the stability of these particles can help them obtain better solutions. Tuning particles refer to new particles with higher stability after iterative optimization. The generation of tuning particles is based on the stability level of decay particles and elite particles, and is a key step in the particle swarm optimization process.

[0043] In one embodiment, particles in the neutron-poor particle set are directly updated to new particles, and based on the stability level of each particle in the neutron-rich particle set, a decay particle set and elite particles are determined from the neutron-rich particle set.

[0044] For details on how to determine the decay particle set and elite particles in the neutron-rich particle set, please refer to the following embodiments, which will not be elaborated here.

[0045] It should be noted that the particles in the neutron-poor particle set refer to particles with lower energy, that is, particles with larger loss function values. The model configuration corresponding to these particles has poor performance, so their stability level is low. Due to the low stability and poor performance of these particles, the neutron-poor particles are chosen not to decay in this method. Instead, they are directly replaced by new particles. This strategy is to enable the particle swarm to avoid local optimality in the poor solution space and directly explore other possible solutions.

[0046] Furthermore, particles in the neutron-rich particle concentration represent particles with higher energy, that is, lower loss functions and higher stability levels. These particles have better performance and are therefore more likely to become candidates for the optimal solution. However, not all neutron-rich particles can be retained directly. During the optimization process, except for elite particles, other particles will undergo decay. The stability level of decaying particles is poor, and their stability needs to be further improved by adjusting their positions or optimizing strategies.

[0047] The network security detection method provided by the embodiment of the present invention ensures the stability and efficiency of the optimization process by dividing the particles in the neutron-rich particle set into elite particles and decay particle sets according to their stability levels. Elite particles represent the current optimal solution and have the strongest stability, so they are directly retained without decaying; while the decay particle set is a particle with poor performance and low stability. By comparing with the preset stability boundary, its stability level is updated to improve its performance. Through this strategy, the particle group can be effectively guided to converge to the global optimal solution, while avoiding the problem of local optimal solutions, and enhancing the global search capability of the algorithm. The combination of the update of decay particles and the guidance of elite particles ensures the accuracy and robustness of the optimization process, improves the efficiency of the algorithm and the performance of the final model, and thus achieves more efficient and accurate optimization of the objective function.

[0048] Based on any of the above embodiments, in the method, determining the decay particle set and elite particles from the neutron-rich particle set based on the stability level of each particle in the neutron-rich particle set includes: sorting the stability levels of the particles in the neutron-rich particle set, and determining the particle with the largest stability level in the neutron-rich particle set as an elite particle; A decay particle set is determined based on all particles in the neutron-rich particle set except the elite particles.

[0049] In one embodiment, through sorting, particles with the highest stability level are defined as elite particles, representing the best solution in the current optimization; all particles except the elite particles in the neutron-rich particle set are classified into the decay particle set.

[0050] Specifically, elite particles have the highest stability level, indicating that they are close to the optimal solution, so no further adjustment or optimization is required, but they are directly retained as a reference for other particles to learn. The particles in the decay particle set have a lower stability level, indicating that they perform poorly in their current state and need to be adjusted through the "decay" mechanism to explore potential better solutions.

[0051] Regarding how to decay the particles in the decay particle set, please refer to the following embodiments, which will not be elaborated again.

[0052] The network security detection method provided by the embodiment of the present invention sorts the particles in the neutron-rich particle set according to the stability level, determines the particles with the highest stability level as elite particles, and directly retains their optimal solution characteristics to ensure the stability and accuracy of the optimization process. At the same time, the remaining particles are divided into decay particle sets, focusing on adjusting and optimizing these particles with weaker performance to enhance the ability to explore the solution space. This strategy of combining elite retention with decay optimization not only avoids the risk of destroying the current optimal solution, but also improves the optimization potential of low-performance particles, thereby effectively balancing the needs of local search and global search, and improving the efficiency of model parameter optimization and the ability to obtain the global optimal solution.

[0053] Based on any of the above embodiments, in the method, determining the updated stability level of each particle in the decay particle set based on a comparison result of the stability level of each particle in the decay particle set with a preset stability bound includes: Determining the decay type of each particle in the decay particle set based on a comparison result of the stability level of each particle in the decay particle set and a preset stability bound; Based on the decay type of each particle in the decay particle set, each particle in the decay particle set is decayed, and a stable level of each particle in the decay particle set after decay is determined as an updated stable level of each particle.

[0054] Here, the preset stability limit is a threshold used to determine whether the stability level of the particle reaches an acceptable standard. The comparison result of the particle stability level and the preset stability limit determines what type of decay the particle needs to undergo. For example, if the stability level is lower than the preset limit, a larger adjustment is made, which may change its position vector significantly to jump out of the local optimum. If the stability level is close to or higher than the preset limit, a small range of fine-tuning is performed to retain its excellent characteristics and further optimize it.

[0055] Here, decaying particles means updating their stable level by adjusting their states. The decayed particles may explore new solution spaces, thereby improving the optimization results.

[0056] For example, the decay type may be decay, Decay and decay; a random number can be generated between them as the preset stability limit. If the stability level of the particle is higher than the stability limit, that is, SL>SB, then it is considered that or decay, otherwise decay. occurs or The decay process can be expressed by the following formula: ; in, is the newly generated particle, is the first The current position vector of the particle, is the current position vector of the particle with the best stability level, It is decision variables, Represents a randomly generated index that specifies which decision variables will be selected when updating the particle position vector.

[0057] Furthermore, the total distance between a particle and other particles is calculated, and the nearest particle is used to achieve the goal, which can be expressed by the following formula: ; Among them, here, It is Particles and The total distance between adjacent particles, and Represents the coordinates in the search space.

[0058] Furthermore, the position update process of the second particle generated at this stage is as follows: ; Among them, here, is the newly generated particle, is the first The current position vector of the particle, It is The position vectors of the neighboring particles around a particle, It is decision variables, Represents a randomly generated index that specifies which decision variables will be updated during the decay process.

[0059] If the stability level of a particle is below the stability limit , then it is considered to occur The decay is expressed as follows: ; ; Among them, here, is the position vector of the newly generated particle, is the first The current position vector of a particle, is the position vector of the particle with the best stability level, is the position vector of the particle center, It is The stable level of particles, and There are two A random number in range that determines how much the particle moves.

[0060] In order to improve the level of algorithm development and exploration, the use of The decaying particles undergo another position update process: ; If the neutron enrichment level of a particle is below the enrichment boundary, the particle is assumed to have a smaller , so the particle tends to undergo electron capture or positron emission to move towards the stable band. In this regard, taking into account such motion, the random motion in the search space is determined as follows: ; in, is the position vector of the newly generated particle, is the first The current position vector of the particle, is a A random number in the range that determines how much the particle moves. At the end of the main loop, when the particle enrichment level is higher than the preset particle enrichment limit, each particle has only two newly generated position vectors, which are and , and when the particle enrichment level is lower than the preset particle enrichment limit, each particle has only As the newly generated position vector. In each state, the newly generated vector is merged with the current population, and the optimal particle participates in the subsequent search cycle of the algorithm. For decision variables that exceed the predefined upper and lower bounds, a boundary violation flag is determined, and the maximum number of objective function evaluations or the maximum number of iterations can be used as the termination criterion.

[0061] For example, after decay, the fitness of the worst particle is compared with that of the best particle. If the fitness of the worst particle is higher than that of the best particle before decay, it means that the particle group is gradually optimizing with continuous decay. The best particle after reaching the threshold is the global best particle.

[0062] The network security detection method provided by the embodiment of the present invention determines the decay type of each particle by comparing the stability level of each particle in the decay particle set with a preset stability boundary, and performs corresponding decay operations on the particles based on the decay type, thereby updating the stability level of each particle. Specifically, by distinguishing the decay types of particles, targeted optimization can be performed according to the characteristics of different particles, avoiding the inefficiency and performance loss that may be caused by unified processing. Through the decay operation, particles with low stability levels can be improved to make them closer to the optimal solution in the search space, thereby improving the overall stability level of the particles and the efficiency of model optimization. At the same time, this process provides better initial conditions for subsequent optimization steps by dynamically adjusting the stability level of particles, which helps to improve the global optimization capability and the accuracy of the optimization results.

[0063] Based on any of the above embodiments, in the method, determining a neutron-rich particle set and a neutron-poor particle set from the initial particle set based on the energy of each particle in the initial particle set includes: determining the energy of each particle in the initial particle set; Determining the neutron-rich particle set and the neutron-poor particle set based on a comparison result between the energy of each particle in the initial particle set and a preset particle enrichment boundary; Among them, the energy of each neutron-rich particle in the neutron-rich particle set is lower than the energy of each neutron-poor particle in the neutron-poor particle set, and the energy of each of the particles is proportional to the size of the loss function value corresponding to the model obtained by training each set of model parameters to be optimized.

[0064] Here, the preset particle enrichment boundary is a set threshold used to distinguish high-energy particles from low-energy particles; by comparing with the preset particle enrichment boundary, the particles can be divided into neutron-rich particles and neutron-poor particles.

[0065] In one embodiment, according to the comparison result between the particle energy and the preset particle enrichment boundary, particles with energy below the threshold are classified into the neutron-rich particle set, and particles with energy above the threshold are classified into the neutron-poor particle set.

[0066] The network security detection method provided by the embodiment of the present invention optimizes the efficiency of model parameter search by comparing the energy of each particle in the initial particle set, dividing the particles into a neutron-rich particle set and a neutron-poor particle set. The energy of a particle is proportional to the value of its corresponding model loss function. The lower the energy, the better the parameter optimization effect. By setting a preset particle enrichment boundary, particles with energy below the threshold are classified as neutron-rich particle sets, representing the current better solution area, and are given priority for further optimization; while particles with higher energy are classified as neutron-poor particle sets, retaining the possibility of exploring new solution space. This division method effectively distinguishes the pros and cons of particles, avoids invalid calculations in the global search process, and maintains the diversity and balance of the algorithm. Ultimately, the process significantly improves the optimization efficiency, accelerates the convergence speed of model parameters, and enhances the ability of global search.

[0067] The network security detection device provided by the present invention is described below. The network security detection device described below and the network security detection method described above can be referenced to each other.

[0068] FIG2 is a schematic diagram of the structure of a network security detection device provided by the present invention. As shown in FIG2 , the network security detection device includes: An acquisition module 210, which is used to acquire the data to be detected in the power wireless sensor network; A detection module 220, which is used to input the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; The network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm.

[0069] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3As shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communications interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the network security detection method, which includes: obtaining the data to be detected in the power wireless sensor network; inputting the data to be detected into the network security detection model to obtain the network security detection result output by the network security detection model; wherein the network security detection model is trained by the sample detection data and the sample network security detection result label corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the chaos elite energy valley algorithm.

[0070] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0071] On the other hand, the present invention also provides a computer program product, which includes a computer program, and the computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network security detection method provided by the above-mentioned methods, and the method includes: obtaining data to be detected in the power wireless sensor network; inputting the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; wherein the network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the chaos elite energy valley algorithm.

[0072] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the network security detection method provided by the above-mentioned methods, the method comprising: obtaining data to be detected in a power wireless sensor network; inputting the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; wherein the network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by a chaos elite energy valley algorithm.

[0073] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0074] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0075] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security detection method, characterized in that: include: Acquire the data to be detected in the power wireless sensor network; Inputting the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; The network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm.

2. The network security detection method according to claim 1, characterized in that: The target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm based on the following method: Updating the position vector of each particle in the particle matrix to determine an initial particle set, wherein the position vector of each particle in the initial particle set represents each group of model parameters to be optimized; determining a neutron-rich particle set and a neutron-poor particle set from the initial particle set based on the energy of each particle in the initial particle set; Based on the stability level of each particle in the neutron-rich particle set, the neutron-rich particle set is iterated at least once until a tuning particle that meets preset requirements is obtained, and the position vector of the tuning particle is determined as a target model parameter.

3. The network security detection method according to claim 2, characterized in that: Any one of the at least one iteration includes: Determining a decay particle set and elite particles from the neutron-rich particle set based on the stability level of each particle in the neutron-rich particle set; Determining an updated stability level of each particle in the decay particle set based on a comparison result between the stability level of each particle in the decay particle set and a preset stability bound; Based on the updated stability level of each particle in the decay particle set and the stability level of the elite particle, a tuning particle is determined.

4. The network security detection method according to claim 3, characterized in that: The step of determining a decay particle set and elite particles from the neutron-rich particle set based on the stability level of each particle in the neutron-rich particle set comprises: sorting the stability levels of the particles in the neutron-rich particle set, and determining the particle with the largest stability level in the neutron-rich particle set as an elite particle; A decay particle set is determined based on all particles in the neutron-rich particle set except the elite particles.

5. The network security detection method according to claim 3, characterized in that: The step of determining the updated stability level of each particle in the decay particle set based on a comparison result between the stability level of each particle in the decay particle set and a preset stability bound comprises: Determining the decay type of each particle in the decay particle set based on a comparison result of the stability level of each particle in the decay particle set and a preset stability bound; Based on the decay type of each particle in the decay particle set, each particle in the decay particle set is decayed, and a stable level of each particle in the decay particle set after decay is determined as an updated stable level of each particle.

6. The network security detection method according to claim 2, characterized in that: The step of determining a neutron-rich particle set and a neutron-poor particle set from the initial particle set based on the energy of each particle in the initial particle set comprises: determining the energy of each particle in the initial particle set; Determining the neutron-rich particle set and the neutron-poor particle set based on a comparison result between the energy of each particle in the initial particle set and a preset particle enrichment boundary; Among them, the energy of each neutron-rich particle in the neutron-rich particle set is lower than the energy of each neutron-poor particle in the neutron-poor particle set, and the energy of each of the particles is proportional to the size of the loss function value corresponding to the model obtained by training each set of model parameters to be optimized.

7. A network security detection device, characterized in that: include: An acquisition module, which is used to acquire the data to be detected in the power wireless sensor network; A detection module, which is used to input the data to be detected into a network security detection model to obtain a network security detection result output by the network security detection model; The network security detection model is trained by sample detection data and sample network security detection result labels corresponding to the sample detection data, and the target model parameters of the network security detection model are optimized by the Chaos Elite Energy Valley algorithm.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the network security detection method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security detection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the network security detection method according to any one of claims 1 to 6 is implemented.

Images