Abnormal detection model determination method and device, equipment and storage medium

Abstract

The invention discloses an anomaly detection model determination method and device, equipment and a storage medium. The method comprises the following steps: determining a protocol message data set according to protocol message data in a power system; determining a word frequency vector of each piece of message data in the protocol message data set based on the protocol message data set and a text representation method; training a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result; and when the training result meets a training termination condition, taking the RNN model as an anomaly detection model, otherwise, continuing to train the RNN model. According to the method, the word frequency vector of each piece of message data is determined in combination with a text representation method, then the RNN model is trained based on the word frequency vectors and the preset training parameters, the anomaly detection model meeting the requirements can be obtained, and therefore the abnormal protocol in the power system can be detected according to the anomaly detection model.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of industrial control systems, and in particular to a method, device, equipment and storage medium for determining an anomaly detection model. Background Art

[0002] The power protocol in industrial control systems refers to the communication protocol used to monitor, manage and control the power system. The power system is a large and complex system, including power production, transmission and distribution. In order to monitor and control the various components of the power system, specific communication protocols are required to ensure that information can be effectively exchanged between devices. However, with the continuous development of network technology, the power system is also facing new security challenges, such as cyber attacks, malware, etc.

[0003] At present, the commonly used power protocols in power systems include IEC61850, Modbus, DNP3, 104 protocols, etc. The correctness of these protocols is crucial to the normal operation of the power system. Therefore, it is very important to detect anomalies in the power protocols of the power system. How to ensure the correctness of the power protocols is a problem faced by existing technologies. Summary of the invention

[0004] The present invention provides a method, device, equipment and storage medium for determining an abnormality detection model to solve the problem in the prior art that protocol abnormalities occurring in a power system cannot be accurately detected.

[0005] According to one aspect of the present invention, a method for determining an anomaly detection model is provided, the method comprising:

[0006] Determine a protocol message data set according to protocol message data in the power system;

[0007] Based on the protocol message data set and the text representation method, determining a word frequency vector of each message data in the protocol message data set;

[0008] Training a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result;

[0009] When the training result meets the training termination condition, the RNN model is used as an anomaly detection model, otherwise the RNN model continues to be trained.

[0010] According to another aspect of the present invention, a device for determining an anomaly detection model is provided, the device comprising:

[0011] A first determination module, used to determine a protocol message data set according to protocol message data in the power system;

[0012] A second determination module, configured to determine a word frequency vector of each message data in the protocol message data set based on the protocol message data set and the text representation method;

[0013] A training module is used to train a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result;

[0014] The judgment module is used to use the RNN model as an abnormality detection model when the training result meets the training termination condition, otherwise continue to train the RNN model.

[0015] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising: at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for determining the anomaly detection model described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for determining an anomaly detection model described in any embodiment of the present invention when executed.

[0019] A method, device, equipment and storage medium for determining an abnormality detection model according to an embodiment of the present invention, the method comprises: determining a protocol message data set according to protocol message data in an electric power system; determining a word frequency vector of each message data in the protocol message data set based on the protocol message data set and a text representation method; training a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result; when the training result meets the training termination condition, using the RNN model as an abnormality detection model, otherwise continue to train the RNN model. The method combines a text representation method to determine the word frequency vector of each message data, and then trains the RNN model based on the word frequency vector and preset training parameters, so as to obtain an abnormality detection model that meets the requirements, so that abnormal protocols in the electric power system can be detected according to the abnormality detection model, solving the problem that the prior art cannot accurately detect protocol abnormalities in the electric power system.

[0020] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of a method for determining an anomaly detection model provided in Embodiment 1 of the present invention;

[0023] Figure 2 A schematic diagram of protocol message data provided by an embodiment of the present invention;

[0024] Figure 3 A schematic diagram of the structure of a device for determining an anomaly detection model provided in Embodiment 2 of the present invention;

[0025] Figure 4 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only an embodiment of a part of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should belong to the scope of protection of the present invention. It should be understood that the various steps recorded in the method implementation of the present invention can be performed in different orders and / or in parallel. In addition, the method implementation may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0027] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, any variations of the terms "including" and "having" are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the modifications of "one" and "plurality" mentioned in the present invention are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0030] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes, and are not used to limit the scope of these messages or information.

[0031] Embodiment 1

[0032] Figure 1 A flow chart of a method for determining an anomaly detection model provided in Embodiment 1 of the present invention is provided. The method can be applied to training an anomaly detection model to detect anomalies in a power protocol in a power system. The method can be executed by a device for determining an anomaly detection model, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device. In this embodiment, the electronic device includes but is not limited to: computers and other devices.

[0033] like Figure 1 As shown, a method for determining an anomaly detection model provided in Embodiment 1 of the present invention includes the following steps:

[0034] S110. Determine a protocol message data set according to protocol message data in the power system.

[0035] The power system may refer to a unified whole consisting of power generation, power supply (transmission, transformation, distribution), power consumption facilities, and secondary facilities such as regulation and control, relay protection and safety automatic devices, metering devices, dispatching automation, and power communication required to ensure its normal operation. Protocol message data may be data including protocol messages. The protocol message data set may include a protocol message training data set and a protocol message test data set, and the protocol message data set includes multiple labeled protocol messages.

[0036] In this embodiment, a protocol message data set may be constructed according to protocol message data in the power system.

[0037] In one embodiment, determining a protocol message data set based on protocol message data in the power system includes: collecting protocol message data in the power system; extracting key fields related to the 104 protocol in the protocol message data; converting the base number symbols corresponding to the key fields of each protocol message into a corresponding natural language to obtain multiple message data; and constructing a protocol message data set based on the message data.

[0038] Among them, the 104 protocol (IEC 60870-5-104) is a network communication protocol widely used in the field of power system automation. The 104 protocol is based on the IEC 60870-5-101 protocol. By introducing the Transmission Control Protocol / Internet Protocol (TCP / IP) network communication mechanism on its basis, the protocol can be used in a wider range of network environments, including local area networks and wide area networks. The key field can be the data included in the 104 protocol. The base number symbol can refer to a character represented in binary or hexadecimal. For example, in the protocol message data, the key field of the 104 protocol can be represented in hexadecimal. Natural language can refer to a language that naturally evolves with culture.

[0039] In this embodiment, protocol message data in the power system can be collected, key fields related to the 104 protocol in the protocol message data can be extracted, and then the representation of the key fields is converted from hexadecimal characters to natural language to obtain multiple message data of the 104 protocol, and then a protocol message data set is constructed based on the message data. Exemplary, Figure 2 A schematic diagram of a protocol message data provided by an embodiment of the present invention, such as Figure 2 As shown, the protocol message data collected in this embodiment is mainly 104 protocol message data. A 104 protocol message data contains four parts: Ethernet, IPv4, TCP and 104 protocol. The start character of the 104 protocol part starts with 0x68. Therefore, the key fields of the 104 protocol in the protocol message data can be extracted through the start character. After the key fields are extracted, a text description can be performed to convert the hexadecimal data in the protocol into a natural language description. For example:

[0040] The key fields entered are: 0x2d 0x06 0x0100 0x0f6000 0x01

[0041] The output natural language is: function code: single-point remote control, transmission reason: activation, ASDU public address: No. 1 measurement and control protection device, information object address: point 24591, switch: open.

[0042] S120. Determine a word frequency vector of each message data in the protocol message data set based on the protocol message data set and the text representation method.

[0043] The text representation method may refer to a method for converting text data into a representation that can be recognized by a computer. A word frequency vector may be a digital vector used to represent text content.

[0044] In this embodiment, each message data in the protocol message data set may be represented as a text to obtain a word frequency vector of each message data.

[0045] In one embodiment, the word frequency vector of each message data in the protocol message data set is determined based on the protocol message data set and the text representation method, including: constructing a vocabulary table based on different words in each message data in the protocol message data set; for each message data, generating a word frequency vector corresponding to the message data according to the words included in the message data and the vocabulary table.

[0046] In this embodiment, the word frequency vector can be determined by a text representation method such as a bag-of-words model. The bag-of-words model is a simple text representation method that regards each text as a collection of words and ignores the order and grammatical structure between words. The bag-of-words model constructs a vocabulary, maps each word to a fixed index, and then represents the text by counting the frequency of occurrence of each word in the text.

[0047] Exemplarily, a vocabulary is first constructed using the words included in each message data in the protocol message data set: all different words are extracted from all message data. For example, for the following message data: "Function code: single-point remote control, reason for transmission: activation, ASDU public address: measurement and control protection device No. 1, information object address: point 24591, switch: open", a vocabulary can be constructed: ["Function code", "single-point remote control", "reason for transmission", "activation", "ASDU public address", "measurement and control protection device No. 1", "information object address", "point 24591", "switch", "open"].

[0048] According to the vocabulary, generate the word frequency vector of the message data: for each message data, calculate the number of times each word in the vocabulary appears, then the word frequency vector corresponding to the message data can be expressed as: [1,1,1,1,1,1,1,1,1,1]. If there is a second message data: "Function code: single-point remote signal, transmission reason: activation, ASDU public address: No. 1 measurement and control protection device, information object address: point 24591, current value: 0.25", then the vocabulary is: ["Function code", "Single-point remote signal", "Transmission reason", "Activation", "ASDU public address", "No. 1 measurement and control protection device", "Information object address", "Point 24591", "Current value", "0.5"], combine the two vocabulary to get a new vocabulary ["Function code", "Single-point remote control", "Single-point remote signal", "Transmission reason", "Activation", "ASDU public address", "No. 1 measurement and control protection device", "Information object address", "Point 24591", "Switch", "Open", "Current value", "0.5"]

[0049] At this time, the word frequency vector of the first message data becomes [1,1,0,1,1,1,1,1,1,1,1,0,0] and the word frequency vector of the second message data is [1,0,1,1,1,1,1,1,1,0,0,1,1].

[0050] S130, training a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result.

[0051] The preset training parameters may include parameters such as batch size, sequence length, and feature size. A recurrent neural network (RNN) model may be a model constructed based on a neural network suitable for modeling sequence data, which can consider previously received information when processing current input information. The training result may be the accuracy of this training, which may be specifically represented by a loss function.

[0052] In this embodiment, the RNN model can be trained using word frequency vectors and preset training parameters to obtain prediction results for each message data, and the loss function is calculated based on the prediction results and the actual results of the message data to obtain training results.

[0053] S140. When the training result meets the training termination condition, the RNN model is used as an anomaly detection model; otherwise, the RNN model continues to be trained.

[0054] The training termination condition may be that the loss function meets a preset threshold or the number of training times reaches a preset number. The anomaly detection model may be a model for detecting whether a protocol message is abnormal.

[0055] In this embodiment, when the training result meets the training termination condition, the RNN model can be used as an anomaly detection model, otherwise the RNN model needs to be continuously trained until the training result meets the training termination condition.

[0056] A method for determining an abnormality detection model provided in a first embodiment of the present invention includes: determining a protocol message data set according to protocol message data in an electric power system; determining a word frequency vector of each message data in the protocol message data set based on the protocol message data set and a text representation method; training a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result; when the training result meets a training termination condition, using the RNN model as an abnormality detection model, otherwise continuing to train the RNN model. This method combines a text representation method to determine the word frequency vector of each message data, and then trains the RNN model based on the word frequency vector and preset training parameters, so as to obtain an abnormality detection model that meets the requirements, thereby being able to detect abnormal protocols in the electric power system according to the abnormality detection model, solving the problem that the prior art cannot accurately detect protocol abnormalities in the electric power system.

[0057] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0058] In one embodiment, the extracting of key fields related to the 104 protocol in the protocol message data includes: obtaining a 104 protocol partial field from the protocol message data according to a start character of the 104 protocol; and using a function code, a transmission reason, an application service data unit public address, an information object address, and an information element set in the 104 protocol partial field as key fields.

[0059] Among them, the start character can be the beginning part of the 104 protocol. The function code can be a key part for defining communication transaction processing, which determines the data type and operation exchanged between the master station and the slave station. The function code can be single-point telesignaling, single-point remote control, etc. The transmission reason can be an important field in the IEC104 protocol, which is used to describe the transmission purpose or triggering event of the message. The application service data unit (Application Service Data Unit, ASDU) public address can be an identifier used to specify the source or destination of information. The ASDU public address is part of the header of the data packet, which is usually used to identify the sender or receiver's device. The information object address can be an address used to identify a specific information object. The information object can be a measurement value, status, control command, etc. of a device. The information element set can refer to the specific data value or status in the information object. These data include real-time measurement, control signals, status feedback and other information of the device.

[0060] In this embodiment, the fields of the 104 part can be obtained from the protocol message data according to the start character of the 104 protocol, and the function code, transmission reason, application service data unit public address, information object address and information element set in the fields of the 104 protocol part are used as key fields. Exemplarily, the 104 protocol message can be collected in the power system, and the data in the 104 protocol can be extracted into key fields, such as "function code (single-point telesignaling, single-point remote control, etc.)", "transmission reason (activation, etc.)", "ASDU public address (device address)", "information object address (point position)", information element set (current, voltage, power, switch status, etc.), etc.

[0061] In one embodiment, the constructing of a protocol message data set based on the message data includes: constructing a standard data set including normal protocol messages according to normal data in the message data; simulating abnormal situations for the normal data in the message data to obtain an abnormal data set including abnormal protocol messages; constructing a protocol message data set based on the standard data set and the abnormal data set, the protocol message data set including a protocol message training data set and a protocol message test data set; wherein the abnormal situation simulation includes data packet format error simulation, illegal command simulation and data loss simulation.

[0062] Among them, a normal protocol message may be a protocol message without any abnormality, and a standard data set may be a data set including normal protocol messages. An abnormal protocol message may be a protocol message with an abnormality, and an abnormal data set may be a data set including abnormal data messages. A protocol message training data set may be a data set used to train a model, and a protocol message test data set may be a data set used to test a model. The simulation of data packet format error may include a simulation of an incomplete field or an incorrect function code, an illegal command simulation may include a simulation of a control command that does not conform to business logic, and a data loss simulation may refer to a simulation of partial data loss in a message.

[0063] In this embodiment, a standard data set can be constructed based on normal data in the message data, and then an abnormal data set can be obtained by simulating abnormal conditions on the normal data. The protocol message data set can be constructed by the standard data set and the abnormal data set. For example, if the normal data is "function code: single-point remote control, transmission reason: activation, ASDU public address: No. 1 measurement and control protection device, information object address: point 24591, switch: open", through abnormal situation simulation, abnormal data "function code: single-point remote control, transmission reason: activation, ASDU public address: No. 1 measurement and control protection device, information object address: point 24591, switch: 2 (non-Boolean)" can be simulated, where the switch is different from the original Boolean data and is abnormal.

[0064] In one embodiment, the recurrent neural network (RNN) model is trained based on the word frequency vector and preset training parameters to obtain training results, including: determining the preset training parameters based on the message data used this time; inputting the word frequency vector and the preset training parameters into the recurrent neural network (RNN) model to obtain prediction results of the RNN model; determining the training results based on the prediction results; wherein the preset training parameters include batch size, sequence length and feature size.

[0065] The preset training parameters may include batch size, sequence length and feature size. The prediction result is the normal or abnormal situation of the message data predicted by the RNN model.

[0066] In this embodiment, the preset training parameters can be determined through the message data used this time, and the word frequency vector and the preset training parameters can be input into the recurrent neural network RNN ​​model to obtain the prediction result of the RNN model, and the training result can be determined based on the prediction result and the actual result.

[0067] In one embodiment, the preset training parameters are determined based on the message data used this time, including: taking the number of message data used this time as the batch size; taking the length corresponding to the longest message data in the message data used this time as the sequence length; taking the feature dimension corresponding to the message data with the most fields in the message data used this time as the feature size.

[0068] In this embodiment, the batch size may be the number of message data used this time, the sequence length may be the length corresponding to the longest message data among the message data used this time, and the feature size may be the feature dimension corresponding to the message data with the most fields among the message data used this time. For example, take the following message data as an example:

[0069] The first message data: Function code: single-point remote control, Transmission reason: Activation, ASDU public address: No. 1 measurement and control protection device, Information object address: Point 24591, Switch: On. Length: 20 words (including punctuation marks).

[0070] The second message data: Function code: single-point telesignaling, transmission reason: activation, ASDU public address: No. 1 measurement and control protection device, information object address: point 24592, current value: 0.25. Length: 20 words (including punctuation marks).

[0071] The third message data: Function code: Single-point telesignaling with time, Transmission reason: Activation, ASDU public address: No. 1 measurement and control protection device, Information object address: Point 24593, Voltage value: 0.5, Time: 2024:12:20:8:30:20. Length: 23 words (including punctuation marks).

[0072] The fourth message data: Function code: single-point telesignaling, transmission reason: pending activation, ASDU public address: No. 2 measurement and control protection device, information object address: point 24597, current value: 0.5. Length: 20 words (including punctuation marks).

[0073] The input and output layers of the RNN model architecture are as follows:

[0074] Input layer: vector representation of 104 protocol message data (i.e., word frequency vector), (batch_size, sequence_length, feature_size).

[0075] Among them, batch size (batch_size) is the number of samples for one training. In this paper, it is set to 128 while fully utilizing GPU resources. Sequence length (sequence_length) is the length of the input sequence (i.e. the number of fields in the message data). It is generally set to the maximum length. Taking the above message as an example, this paper sets the sequence length to 23. Feature dimension (feature_size) is the feature dimension of each field. The field with the highest dimension is selected as feature_size, and the remaining fields are supplemented with 0. Because this paper uses the bag of words model, feature_size is set to 23 in this paper.

[0076] Output layer: The output layer is responsible for converting the output of the RNN model into the final prediction result. The output layer can be a fully connected layer, passing the last output of the hidden state (usually a summary of the entire sequence) to a sigmoid or softmax activation function. For binary classification problems (normal or abnormal), a sigmoid activation function can be used to compress the output value between 0 and 1. The output format can be: output 1 when normal, and output 0 when abnormal.

[0077] In this embodiment, when training the RNN model, the data set is divided into a training set and a test set. The training set is used for model training, and the test set is used to evaluate the performance of the model. The general ratio is 8:2. It is necessary to use a labeled training data set (including normal data and abnormal data) and define a loss function to optimize the model. For binary classification tasks, the commonly used loss function is binary cross-entropy, which can be used to measure the difference between the predicted value and the actual label. The formula of the loss function is as follows:

[0078] Loss=-(y·log(p)+(1-y)·log(1-p))

[0079] Among them, y is the actual label of the training sample, and p is the probability value predicted by the model.

[0080] This embodiment may use an Adaptive Moment Estimation (Adam) optimizer, which can adjust the learning rate according to the gradients of different parameters, thereby accelerating the training process.

[0081] In each batch of training, the model adjusts the network parameters through forward propagation and back propagation to minimize the loss function, which is set to 50 in this paper.

[0082] After the training of this embodiment is completed, the model needs to be evaluated to ensure that it can effectively detect anomalies in the 104 protocol. The accuracy and robustness of the performance evaluation model can ensure the effectiveness of the detection system. Specific evaluation indicators may include accuracy, precision, recall, and F1 score. Accuracy can measure the proportion of correct model predictions, and precision can measure the proportion of samples predicted to be abnormal that are actually abnormal. Recall can measure the proportion of samples correctly predicted to be abnormal in actual abnormal samples. The F1 score can combine precision and recall as a comprehensive indicator of model performance. The model can be tuned through evaluation indicators, and the model performance can be improved by adjusting the network structure (such as the number of layers, the number of units), the learning rate, the batch size and other hyperparameters. The cross-validation method can be used to ensure the robustness of the model.

[0083] Embodiment 2

[0084] Figure 3 A structural schematic diagram of a device for determining an anomaly detection model provided in Embodiment 2 of the present invention, wherein the device can be used to train an anomaly detection model to detect abnormal conditions of a power protocol in a power system, wherein the device can be implemented by software and / or hardware and is generally integrated on an electronic device.

[0085] like Figure 3 As shown, the device comprises:

[0086] A first determining module 210, configured to determine a protocol message data set according to protocol message data in the power system;

[0087] A second determination module 220, configured to determine a word frequency vector of each message data in the protocol message data set based on the protocol message data set and the text representation method;

[0088] A training module 230 is used to train a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result;

[0089] The judgment module 240 is used to use the RNN model as an abnormality detection model when the training result meets the training termination condition, otherwise continue to train the RNN model.

[0090] The present embodiment provides a device for determining an abnormality detection model, including: a first determination module, used to determine a protocol message data set according to protocol message data in the power system; a second determination module, used to determine the word frequency vector of each message data in the protocol message data set based on the protocol message data set and a text representation method; a training module, used to train a recurrent neural network RNN ​​model based on the word frequency vector and preset training parameters to obtain a training result; a judgment module, used to use the RNN model as an abnormality detection model when the training result meets the training termination condition, otherwise continue to train the RNN model. By combining the text representation method to determine the word frequency vector of each message data, and then training the RNN model based on the word frequency vector and preset training parameters, an abnormality detection model that meets the requirements can be obtained, so that the abnormal protocol in the power system can be detected according to the abnormality detection model, which solves the problem that the prior art cannot accurately detect the protocol abnormality in the power system.

[0091] Furthermore, the first determining module 210 is specifically configured to:

[0092] Collect protocol message data in the power system;

[0093] Extracting key fields related to the 104 protocol from the protocol message data;

[0094] Convert the binary digits corresponding to the key fields of each protocol message into corresponding natural language to obtain multiple message data;

[0095] A protocol message data set is constructed based on the message data.

[0096] Further, the extracting of key fields related to the 104 protocol in the protocol message data includes:

[0097] Acquire a 104 protocol partial field from the protocol message data according to the start character of the 104 protocol;

[0098] The function code, transmission reason, application service data unit public address, information object address and information element set in the 104 protocol part fields are used as key fields.

[0099] Further, constructing a protocol message data set based on the message data includes:

[0100] Constructing a standard data set including normal protocol messages according to normal data in the message data;

[0101] Performing abnormal situation simulation on normal data in the message data to obtain an abnormal data set including abnormal protocol messages;

[0102] Constructing a protocol message data set based on the standard data set and the abnormal data set, wherein the protocol message data set includes a protocol message training data set and a protocol message test data set;

[0103] The abnormal situation simulation includes data packet format error simulation, illegal command simulation and data loss simulation.

[0104] Furthermore, the second determining module 220 is specifically configured to:

[0105] Constructing a vocabulary table based on different words in each message data in the protocol message data set;

[0106] For each message data, a word frequency vector corresponding to the message data is generated according to the words included in the message data and the vocabulary table.

[0107] Furthermore, the training module 230 is specifically used for:

[0108] Determine the preset training parameters based on the message data used this time;

[0109] Inputting the word frequency vector and preset training parameters into a recurrent neural network (RNN) model to obtain a prediction result of the RNN model;

[0110] Determine a training result based on the prediction result;

[0111] The preset training parameters include batch size, sequence length and feature size.

[0112] Further, the determining the preset training parameters based on the message data used this time includes:

[0113] The number of message data used this time is taken as the batch size;

[0114] The length of the longest message data among the message data used this time is used as the sequence length;

[0115] The feature latitude corresponding to the message data with the most fields in the message data used this time is used as the feature size.

[0116] The above-mentioned device for determining anomaly detection model can execute the method for determining anomaly detection model provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0117] Embodiment 3

[0118] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0119] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0120] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0121] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a method for determining an anomaly detection model.

[0122] In some embodiments, the method for determining the anomaly detection model may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for determining the anomaly detection model described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the method for determining the anomaly detection model in any other appropriate manner (e.g., by means of firmware).

[0123] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0124] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0125] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0126] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0127] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0128] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0129] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0130] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for determining an anomaly detection model, characterized in that: The method comprises: Determine a protocol message data set according to protocol message data in the power system; Based on the protocol message data set and the text representation method, determining a word frequency vector of each message data in the protocol message data set; Training a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result; When the training result meets the training termination condition, the RNN model is used as an anomaly detection model, otherwise the RNN model continues to be trained.

2. The method according to claim 1, characterized in that The step of determining the protocol message data set according to the protocol message data in the power system includes: Collect protocol message data in the power system; Extracting key fields related to the 104 protocol from the protocol message data; Convert the binary digits corresponding to the key fields of each protocol message into corresponding natural language to obtain multiple message data; A protocol message data set is constructed based on the message data.

3. The method according to claim 2, characterized in that The extracting of key fields related to the 104 protocol in the protocol message data includes: Acquire a 104 protocol partial field from the protocol message data according to the start character of the 104 protocol; The function code, transmission reason, application service data unit public address, information object address and information element set in the 104 protocol part fields are used as key fields.

4. The method according to claim 2, characterized in that: The constructing a protocol message data set based on the message data includes: Constructing a standard data set including normal protocol messages according to normal data in the message data; Performing abnormal situation simulation on normal data in the message data to obtain an abnormal data set including abnormal protocol messages; Constructing a protocol message data set based on the standard data set and the abnormal data set, wherein the protocol message data set includes a protocol message training data set and a protocol message test data set; The abnormal situation simulation includes data packet format error simulation, illegal command simulation and data loss simulation.

5. The method according to claim 1, characterized in that The determining, based on the protocol message data set and the text representation method, a word frequency vector of each message data in the protocol message data set includes: Constructing a vocabulary table based on different words in each message data in the protocol message data set; For each message data, a word frequency vector corresponding to the message data is generated according to the words included in the message data and the vocabulary table.

6. The method according to claim 1, characterized in that The recurrent neural network (RNN) model is trained based on the word frequency vector and preset training parameters to obtain a training result, including: Determine the preset training parameters based on the message data used this time; Input the word frequency vector and preset training parameters into a recurrent neural network (RNN) model to obtain a prediction result of the RNN model; Determine a training result based on the prediction result; The preset training parameters include batch size, sequence length and feature size.

7. The method according to claim 6, characterized in that The determining the preset training parameters based on the message data used this time includes: The number of message data used this time is taken as the batch size; The length of the longest message data among the message data used this time is used as the sequence length; The feature latitude corresponding to the message data with the most fields in the message data used this time is used as the feature size.

8. A device for determining an anomaly detection model, characterized in that: The device comprises: A first determining module, used to determine a protocol message data set according to protocol message data in the power system; A second determination module, configured to determine a word frequency vector of each message data in the protocol message data set based on the protocol message data set and the text representation method; A training module, used to train a recurrent neural network (RNN) model based on the word frequency vector and preset training parameters to obtain a training result; The judgment module is used to use the RNN model as an abnormality detection model when the training result meets the training termination condition, otherwise continue to train the RNN model.

9. An electronic device, characterized in that: The device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method for determining an anomaly detection model according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for determining an anomaly detection model according to any one of claims 1 to 7 when executed.

Images