Power grid abnormal flow detection and identification method based on multi-mode machine learning algorithm

Abstract

The invention discloses a power grid abnormal flow detection and identification method based on a multi-mode machine learning algorithm. The method comprises the following steps: step 1, acquiring industrial control protocol message data: capturing a communication message of network flow of an electric power industrial control system through a data collector; step 2, training a multi-modal auto-encoder: training the auto-encoder based on the network traffic characteristics of the normal service; 3, abnormal traffic monitoring: detecting and collecting abnormal traffic by taking the decoding reduction degree under the normal service as a baseline; step 4, abnormal data analysis modeling: training a multi-modal neural network model in combination with the abnormal traffic and the coding result of the baseline model for classifying the abnormal traffic; according to the method, some abnormal traffic existing in the network traffic of the power industrial control system can be detected, and the abnormal traffic in the industrial control system is classified by analyzing the data features and the service scenes of the abnormal traffic.

Description

Technical Field

[0001] The present invention relates to the field of power industrial control technology, and in particular to a method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm. Background Art

[0002] It is crucial to effectively identify and detect network anomalies and attacks in power industrial control systems. Traditional methods usually rely on expert experience or pattern matching technology to detect network anomalies, but this method that relies on human experience is often difficult to cope with the complex and changing real network environment. When faced with unknown abnormal attack types, these methods often fail to provide timely warnings. Therefore, with the advancement of technology, detection methods based on expert experience can no longer meet the ever-changing network security needs. Summary of the invention

[0003] The present invention mainly solves the technical problem that the prior art cannot detect and warn abnormal traffic, especially unknown attacks, in a timely and accurate manner, and provides a power grid abnormal traffic detection and identification method based on a multimodal machine learning algorithm. It can target network security issues in power industrial control systems, train data-driven models by collecting normal traffic data, identify abnormal traffic data, analyze and model it, and classify it according to features to ensure the reliability and accuracy of the system in practical applications.

[0004] The present invention aims to solve the above technical problems mainly through the following technical solutions: a method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm, comprising the following steps:

[0005] Step 1: Obtain industrial control protocol message data (mainly messages, including IP address, MAC address, port number, protocol type, protocol instructions, load data and other information): Install data collectors at key network nodes of the power industrial control system to capture communication messages of the power industrial control system network traffic, and store the collected message data in a stable data storage system for subsequent analysis and processing;

[0006] Step 2: Train the multimodal detection network: Use normal business traffic data to train the multimodal detection network, which contains several encoders and a decoder that are fused through weights, until the multimodal detection network can effectively perform decoding and restoration; and use another batch of normal business messages to verify the decoding restoration degree of the autoencoder to ensure the accuracy of the model;

[0007] Step 3: Abnormal traffic monitoring: A baseline threshold is set according to the decoding restoration degree under normal business to judge normal traffic and abnormal traffic. When the decoding restoration degree of the monitored traffic is lower than the baseline threshold after passing through the multimodal detection network, the traffic is marked as abnormal traffic and recorded and stored;

[0008] Step 4: Abnormal data analysis modeling: Extract features from detected abnormal traffic and generate feature vectors from raw data; assign corresponding classification labels to the extracted feature vectors according to known abnormal traffic types, and use the feature vectors with classification labels for supervised learning of multimodal neural networks; evaluate the multimodal neural network (i.e., classification model) through cross-validation and test set validation, and continuously optimize parameters to improve the classification accuracy of the classification model;

[0009] Step 5: Use the final multimodal detection network and multimodal neural network to identify abnormal traffic in the power industrial control system network: Capture the messages in the power industrial control system network according to the method in step 1 and pass the detection network model. If the decoding restoration degree is lower than the baseline threshold, it is marked as abnormal traffic and input into the multimodal neural network to obtain the identification result.

[0010] Preferably, in step 1, the data collector is provided with a filtering configuration rule for capturing only communication messages related to the industrial control protocol.

[0011] Preferably, the training process of the multimodal detection network in step 2 is specifically as follows:

[0012] Step 201: Normalize the features of different dimensions. The formula is as follows:

[0013]

[0014] where x i_o is the original data of the i-th variable, x min is the minimum value in the original data of the variable, x max is the maximum value in the original data of the variable, x i is the normalized value;

[0015] Step 202: Determine the number of messages n that make up each set of feature sequences, where n=k+1. Here, using historical data can enhance the dynamics of the features. All training data are divided into several sequences according to feature types and the time sequence relationship is ensured (i.e., the order of the features is still maintained in the original time sequence). Then, the autocorrelation of each feature is calculated. The formula is as follows:

[0016]

[0017] where x i is the numerical value of the feature, is all x iThe mean of ; N is the number of all training samples; k is the time lag constant, which indicates the number of historical data to be used for each set of feature sequences, that is, the number of elements in each set of feature sequences is k+1; the trial and error method is used to select k, ranging from 1 to 30, and the value corresponding to the maximum average correlation of all features is selected as k, that is, k is set to values ​​from 1 to 30 one by one, and the average value of the autocorrelation of all features corresponding to each k is calculated. When the average value of the autocorrelation of all features is the largest, the corresponding k value is determined as the final k;

[0018] Step 203: Input the feature sequence into a multimodal detection network for training. The multimodal detection network includes several encoders and a decoder. The structure of a single encoder is as follows:

[0019] Given input as sequence d of the mth feature m , 1≤m≤s, s is the total number of feature types, d m contains n normalized feature values ​​that maintain time series, and the hidden layer variable h is calculated as:

[0020] h m =f(W m d m +b m ),

[0021] W m and b m are the encoding weight matrix and encoding bias of the mth feature respectively, and f(·) is a nonlinear activation function, which is expressed as:

[0022]

[0023] The x in the above formula only represents the input variable used to express the form of the nonlinear activation function and has nothing to do with the feature value;

[0024] Each feature type corresponds to an autoencoder;

[0025] The output of the autoencoder is multiplied by the weights and then concatenated:

[0026]

[0027] h m represents the encoding of the mth feature, α m represents the combined weight of the mth feature, β m is the stitching bias of the mth feature;

[0028] The combined h is input to the decoder for decoding. During decoding, the input is reconstructed into the hidden layer output variable

[0029]

[0030] Where W' and b' are the decoding weight matrix and decoding bias respectively;

[0031] The encoding weight matrix, encoding bias, decoding weight matrix, decoding bias, splicing weight and splicing bias are all randomly initialized and determined through subsequent training;

[0032] The loss function during training is the root mean square error (MSE), and the specific situation can be seen below.

[0033] The advantage of this structure is that when encoding, the focus is on the local features of the overall data (because each feature has its own encoder and will not be confused with other features); when decoding, the focus is on the global features. Since the local features are extracted, during training, the model will comprehensively consider the importance of the features, assign reasonable weights, and achieve better feature fusion.

[0034] Preferably, in step 3, the threshold is set based on the root mean square error MSE (i.e., the root mean square error after training), which is calculated as follows:

[0035]

[0036] Where N is the number of samples, y i is the input multimodal detection network data, is the output data of the multimodal detection network, that is, the restored data, corresponding to the above The baseline threshold is 1.3*MSE.

[0037] Preferably, in step 4, the statistical features are extracted as follows:

[0038] Step 401: Read data packets from the collected power grid traffic file (such as a PCAP file), and extract the source IP, destination IP, source port, destination port and protocol from each data, which information has been previously used to construct the identification of each bidirectional data flow;

[0039] Step 402: determine whether the bidirectional data stream pointed to by the identifier has ended. The identifier of the unended bidirectional data stream will be stored in a container. If it has ended, create a new bidirectional data stream identifier for the current data; if it has not ended, add the current data to the data stream pointed to by the identifier;

[0040] Step 403: Continue to determine whether the existence time of the current data stream has exceeded the preset time limit, or whether the current data carries a FIN flag. If so, it indicates that the current data stream has ended, and it is necessary to output statistics of all the data in the data stream and write them into a file as the characteristics of the data stream for storage; if the current data stream has not ended, continue to read the next data of the PCAP file until all the data in the file has been read;

[0041] Step 404: After all the data in the PCAP file has been read, check the container storing the data flow identifier and determine if there are any data flows that have not yet ended and the number of data is greater than 1. Perform statistical output on them, write them into a file and save them, and complete the traffic feature extraction of the entire PCAP file.

[0042] Preferably, in step 4, the time feature is extracted as follows:

[0043] Step 411: Count the time intervals between adjacent data arrivals in each flow, and calculate statistical features such as the average value, standard deviation, maximum value, and minimum value of all time intervals to analyze the stability and burstiness of the traffic;

[0044] Step 412: For each flow record, calculate the difference between the first data arrival time and the last data arrival time, that is, the duration of the flow;

[0045] Step 413: Record the arrival timestamp of each data, count the number of packets arriving in a unit time, calculate the variance of a fixed time interval, and count the number of data in each time period.

[0046] Preferably, in step 4, the neural network is trained as follows:

[0047] Step 421: using the method of step 202 to obtain the number n of historical data to be used, that is, obtaining the time lag constant by calculating the autocorrelation;

[0048] Step 422: For a single neural network model, given input a = [a1, a2, ..., a n ] is the original data, and the first hidden layer variable L1 is calculated as

[0049] L1=f(p1a+q1),

[0050] p1 and q1 are the weight matrix and bias respectively, and f(·) is the nonlinear activation function;

[0051] Step 423: Then, the second hidden layer variable L2 is obtained by the same calculation method, and so on, until the last hidden layer variable L is obtained. n ; For Ln , specify its output size (dimension, i.e. number of nodes) as the number of abnormal types (the number of outputs is determined by the size of the weight matrix);

[0052] The output of each neural network is multiplied by the fusion weight and concatenated, and then passed through a layer of optimizable network to obtain a total L; the optimizable network is a fully connected layer with randomly initialized weights. Through this fully connected layer, features can be fused and dimensionality can be reduced;

[0053] Step 424: Use the Softmax function to calculate based on L and get the output The meaning of each element in is the probability of the abnormal type of the corresponding abnormal power grid flow; the calculation of the Softmax function is as follows

[0054]

[0055] Where C is the number of labels; Using the true label t, calculate the cross entropy loss Loss:

[0056]

[0057] Where C is the number of labels, and t consists of all labels in the specified order;

[0058] The goal of model optimization is to minimize the loss, using gradient descent or other optimization algorithms for back propagation to optimize the parameters and make the loss smaller and smaller.

[0059] By multiplying the weight corresponding to the feature, the effect of the features with strong correlation is strengthened, and the effect of the features with weak correlation is weakened.

[0060] Finally, the anomaly type predicted by the network for the input data (the feature vector of the abnormal traffic) is: The label represented by the position of the element with the largest value in the training set is used (for example, if the value of the second element is the largest, the predicted label is 1 (labels start from 0)), and then the final result is output according to the abnormality type corresponding to the label. The same is true for the result of inference after training.

[0061] As a preferred method, the fusion weight is obtained as follows:

[0062] Calculate the correlation coefficient between input X and output Y, where X is the original feature, such as a quintuple, which refers to the source / destination IP address, source / destination port, and transport layer protocol, and Y is the label. The calculation formula is:

[0063]

[0064] Where σ(X) and σ(Y) are standard deviations, calculated as:

[0065]

[0066] N is the number of elements, and is the mean;

[0067] Cov(X,Y) is the covariance, calculated as:

[0068]

[0069] X, Y, x, y and their variations in the standard deviation formula and the covariance formula are only used to represent the specific forms of the two formulas and do not refer to the characteristic values ​​or other variables in the present invention;

[0070] If the number of features is s, then a total of s correlation coefficients [r1, r2, ..., r s ];

[0071] Finally, we get the fusion weight that each feature needs to be multiplied by:

[0072]

[0073] This means that the greater the correlation between a feature and a label, the greater the weight assigned to it, and the more the role of the feature is highlighted.

[0074] The obtained fusion feature is v = [G1v1, G2v2, ..., G s v s ], where v i It is a high-level representation of the i-th feature, that is, a layer of the neural network; v is passed through a fully connected layer, the dimension is reduced to a node with an output dimension of C, and the last layer of the network is obtained through Softmax, and then the parameters are optimized to complete the training of the entire network.

[0075] This solution is a data-driven anomaly detection and identification method that is more adaptable to complex and changing network environments and has the characteristics of self-learning and self-adaptation. Therefore, when the system is upgraded or new situations arise, it only needs to update the model parameters through new data to achieve fast and efficient upgrades and iterations. This not only meets the needs of real-time and accurate detection, but also effectively detects unknown anomalies.

[0076] The substantial effects brought by the present invention are:

[0077] 1. The present invention can solve the network security problem in the power industrial control system by collecting normal flow data to train the data-driven model, identify abnormal flow data and analyze and model it, and classify it according to the characteristics to ensure the reliability and accuracy of the system in practical applications;

[0078] 2. The present invention can provide early warning in the first time, help operation and maintenance personnel take countermeasures in time, ensure system security, and has strong real-time performance; through fine-grained feature extraction of network traffic, including the number, size, time interval, etc. of data packets, it can more accurately reflect the actual situation of the network and has high accuracy; through comprehensive analysis of multiple network traffic characteristics, it can more comprehensively monitor and identify abnormal behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 It is a flow chart of a method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm of the present invention;

[0080] Figure 2 It is a schematic diagram of a system architecture of the present invention that runs a method for detecting and identifying abnormal flow in a power grid. DETAILED DESCRIPTION

[0081] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0082] Embodiment: A method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm, such as Figure 1 As shown, the following steps are included:

[0083] Step 1: Obtain industrial control protocol message data (mainly messages, including IP address, MAC address, port number, protocol type, protocol instructions, load data and other information): Install data collectors at key network nodes of the power industrial control system to capture communication messages of the power industrial control system network traffic, and store the collected message data in a stable data storage system for subsequent analysis and processing;

[0084] Step 2: Train the multimodal detection network: Use normal business traffic data (extract features such as IP address, MAC address, port number, protocol type, protocol instruction, load data, etc. from multiple messages (the best number of selected messages can be obtained by calculating the autocorrelation of all features and then taking the average value), group them by feature type, and use them as inputs for individual models) to train the multimodal detection network, which contains several encoders and a decoder that are fused by weights until the multimodal detection network can effectively perform decoding and restoration; and use another batch of normal business messages to verify the decoding restoration degree of the autoencoder to ensure the accuracy of the model;

[0085] Step 3: Abnormal traffic monitoring: A baseline threshold is set according to the decoding restoration degree under normal business to judge normal traffic and abnormal traffic. When the decoding restoration degree of the monitored traffic is lower than the baseline threshold after passing through the multimodal detection network, the traffic is marked as abnormal traffic and recorded and stored;

[0086] Step 4: Abnormal data analysis modeling: Extract features of the detected abnormal traffic (as described in step 2), and generate feature vectors from the original data; assign corresponding classification labels to the extracted feature vectors according to known abnormal traffic types (such as load abnormality, current abnormality, voltage abnormality, etc.), and use the feature vectors with classification labels for supervised learning of multimodal neural networks; evaluate the multimodal neural network (i.e., classification model) through cross-validation and test set validation, and continuously optimize parameters to improve the classification accuracy of the classification model;

[0087] Step 5: Use the final multimodal detection network and multimodal neural network to identify abnormal traffic in the power industrial control system network: Capture the messages in the power industrial control system network according to the method in step 1 and pass the detection network model. If the decoding restoration degree is lower than the baseline threshold, it is marked as abnormal traffic and input into the multimodal neural network to obtain the identification result.

[0088] In step 1, the data collector is provided with a filtering configuration rule for capturing only the communication messages related to the industrial control protocol, and only captures the communication messages related to the industrial control protocol (IEC 60870-5-104, MMS, GOOSE, etc.), thereby reducing the interference of irrelevant data.

[0089] In step 2, the message covers different time periods and business scenarios to ensure that the generalization ability of the model is improved during model training. Before training the model, the features of different dimensions are normalized to be within the same dimension range to reduce the impact of feature value differences on model training; a multi-modal network structure is used to reduce the learning difficulty of each feature.

[0090] The training process of the multimodal detection network in step 2 is specifically as follows:

[0091] Step 201: Normalize the features of different dimensions. The formula is as follows:

[0092]

[0093] where x i_o is the original data of the i-th variable, x min is the minimum value in the original data of the variable, x max is the maximum value in the original data of the variable, x iis the normalized value; after normalization, the values ​​of all data are in the range of [0,1];

[0094] Step 202: Determine the number of messages n that make up each set of feature sequences, where n=k+1. Here, using historical data can enhance the dynamics of the features. All training data are divided into several sequences according to feature types and the time sequence relationship is ensured (i.e., the order of the features is still maintained in the original time sequence). Then, the autocorrelation of each feature is calculated. The formula is as follows:

[0095]

[0096] where x i is the numerical value of the feature, is all x i The mean of ; N is the number of all training samples; k is the time lag constant, which indicates the number of historical data to be used for each set of feature sequences, that is, the number of elements in each set of feature sequences is k+1; the trial and error method is used to select k, ranging from 1 to 30, and the value corresponding to the maximum average correlation of all features is selected as k, that is, k is set to values ​​from 1 to 30 one by one, and the average value of the autocorrelation of all features corresponding to each k is calculated. When the average value of the autocorrelation of all features is the largest, the corresponding k value is determined as the final k;

[0097] Step 203: Input the feature sequence into a multimodal detection network for training. The multimodal detection network includes several encoders and a decoder. The structure of a single encoder is as follows:

[0098] Given input as sequence d of the mth feature m , 1≤m≤s, s is the total number of feature types, d m contains n normalized feature values ​​that maintain time series, and the hidden layer variable h is calculated as:

[0099] h m =f(W m d m +b m ),

[0100] W m and b m are the encoding weight matrix and encoding bias of the mth feature respectively, and f(·) is a nonlinear activation function, which is expressed as:

[0101]

[0102] The x in the above formula only represents the input variable used to express the form of the nonlinear activation function and has nothing to do with the feature value;

[0103] Each feature type corresponds to an autoencoder;

[0104] The output of the autoencoder is multiplied by the weights and then concatenated:

[0105]

[0106] h m represents the encoding of the mth feature, α m represents the combined weight of the mth feature, β m is the stitching bias of the mth feature;

[0107] The combined h is input to the decoder for decoding. During decoding, the input is reconstructed into the hidden layer output variable

[0108]

[0109] Where W' and b' are the decoding weight matrix and decoding bias respectively;

[0110] The encoding weight matrix, encoding bias, decoding weight matrix, decoding bias, splicing weight and splicing bias are all randomly initialized and determined through subsequent training;

[0111] The loss function during training is the root mean square error (MSE), and the specific situation can be seen below.

[0112] The advantage of this structure is that when encoding, the focus is on the local features of the overall data (because each feature has its own encoder and will not be confused with other features); when decoding, the focus is on the global features. Since the local features are extracted, during training, the model will comprehensively consider the importance of the features, assign reasonable weights, and achieve better feature fusion.

[0113] In step 3, the threshold is set based on the root mean square error (MSE) (i.e., the root mean square error after training), which is calculated as follows:

[0114]

[0115] Where N is the number of samples, y i is the input multimodal detection network data, is the output data of the multimodal detection network, that is, the restored data, corresponding to the above The benchmark threshold is 1.3*MSE. This MSE is the average MSE of multiple traffic segments obtained through testing, which means that if the MSE of the real-time monitored traffic calculated by the model (this MSE is calculated in real time) is greater than the benchmark threshold, it can be judged as abnormal traffic.

[0116] In step 3, the baseline threshold is optimized and adjusted in real time during the experiment (adjusted based on the results of multiple tests), which can effectively identify abnormal traffic characteristics and reduce false alarm rates in actual applications.

[0117] In step 4, the traffic characteristics include traffic statistical characteristics (such as packet length, packet interval time, etc.), protocol characteristics (such as protocol type, function code, etc.) and time characteristics (such as timestamp, frequency, etc.).

[0118] In step 4, the statistical features are extracted as follows:

[0119] Step 401: Read data packets from the collected power grid traffic file (such as a PCAP file), and extract the source IP, destination IP, source port, destination port and protocol from each data, which information has been previously used to construct the identification of each bidirectional data flow;

[0120] Step 402: determine whether the bidirectional data stream pointed to by the identifier has ended. The identifier of the unended bidirectional data stream will be stored in a container. If it has ended, create a new bidirectional data stream identifier for the current data; if it has not ended, add the current data to the data stream pointed to by the identifier;

[0121] Step 403: Continue to determine whether the existence time of the current data stream has exceeded the preset time limit, or whether the current data carries a FIN flag. If so, it indicates that the current data stream has ended, and it is necessary to output statistics of all the data in the data stream and write them into a file as the characteristics of the data stream for storage; if the current data stream has not ended, continue to read the next data of the PCAP file until all the data in the file has been read;

[0122] Step 404: After all the data in the PCAP file has been read, check the container storing the data flow identifier and determine if there are any data flows that have not yet ended and the number of data is greater than 1. Perform statistical output on them, write them into a file and save them, and complete the traffic feature extraction of the entire PCAP file.

[0123] In step 4, the time feature is extracted as follows:

[0124] Step 411: Count the time intervals between adjacent data arrivals in each flow, and calculate statistical features such as the average value, standard deviation, maximum value, and minimum value of all time intervals to analyze the stability and burstiness of the traffic;

[0125] If the average value and standard deviation are large, and the difference between the maximum and minimum values ​​is small, it means that the flow is relatively stable; if the ratio of the maximum value to the average value and the standard deviation are significantly too large, and there are sudden and large changes in the time interval sequence, it means that the flow is relatively sudden.

[0126] Methods for judging the stability and suddenness of traffic: 1. Based on the coefficient of variation (ratio of standard deviation to mean), if the coefficient of variation is between 0.1 and 0.5, the traffic can be considered stable. If it is higher than 0.5, it indicates that the traffic has strong suddenness; 2. Based on z-score ((time interval - mean value) / standard deviation): If the absolute value of the z-score of the time interval exceeds 2, the abnormal fluctuation is large and the suddenness is strong;

[0127] Step 412: For each flow record, calculate the difference between the first data arrival time and the last data arrival time, that is, the duration of the flow;

[0128] Step 413: Record the arrival timestamp of each data, count the number of packets arriving in a unit time, calculate the variance of a fixed time interval, and count the number of data in each time period.

[0129] The multimodal neural network used in step 4 has the following advantages:

[0130] (1) Use a multimodal network structure to reduce the learning difficulty of each feature and assign weights according to the importance of the feature criteria when merging.

[0131] (2) Multimodal learning can obtain more comprehensive information by integrating the characteristics of multiple data sources, thereby improving prediction accuracy.

[0132] The neural network is trained as follows:

[0133] Step 421: using the method of step 202 to obtain the number n of historical data to be used, that is, obtaining the time lag constant by calculating the autocorrelation;

[0134] Step 422: For a single neural network model, given input a = [a1, a2, ..., a n ] is the original data, and the first hidden layer variable L1 is calculated as

[0135] L1=f(p1a+q1),

[0136] p1 and q1 are the weight matrix and bias respectively, and f(·) is the nonlinear activation function;

[0137] Step 423: Then, the second hidden layer variable L2 is obtained by the same calculation method, and so on, until the last hidden layer variable L is obtained. n ; For Ln , specify its output size (dimension, i.e. number of nodes) as the number of abnormal types (the number of outputs is determined by the size of the weight matrix);

[0138] The output of each neural network is multiplied by the fusion weight and concatenated, and then passed through a layer of optimizable network to obtain a total L; the optimizable network is a fully connected layer with randomly initialized weights. Through this fully connected layer, features can be fused and dimensionality can be reduced;

[0139] Step 424: Use the Softmax function to calculate based on L and get the output The meaning of each element in is the probability of the abnormal type of the corresponding abnormal power grid flow; the calculation of the Softmax function is as follows

[0140]

[0141] Where C is the number of labels; Using the true label t, calculate the cross entropy loss Loss:

[0142]

[0143] Where C is the number of labels, and t consists of all labels in the specified order;

[0144] The goal of model optimization is to minimize the loss, using gradient descent or other optimization algorithms for back propagation to optimize the parameters and make the loss smaller and smaller.

[0145] By multiplying the weight corresponding to the feature, the effect of the features with strong correlation is strengthened, and the effect of the features with weak correlation is weakened.

[0146] Finally, the anomaly type predicted by the network for the input data (the feature vector of the abnormal traffic) is: The label represented by the position of the element with the largest value in the training set is used (for example, if the value of the second element is the largest, the predicted label is 1 (labels start from 0)), and then the final result is output according to the abnormality type corresponding to the label. The same is true for the result of inference after training.

[0147] The fusion weight is obtained as follows:

[0148] Calculate the correlation coefficient between input X and output Y, where X is the original feature, such as a quintuple, which refers to the source / destination IP address, source / destination port, and transport layer protocol, and Y is the label. The calculation formula is:

[0149]

[0150] Where σ(X) and σ(Y) are standard deviations, calculated as:

[0151]

[0152] N is the number of elements, and is the mean;

[0153] Cov(X,Y) is the covariance, calculated as:

[0154]

[0155] X, Y, x, y and their variations in the standard deviation formula and the covariance formula are only used to represent the specific forms of the two formulas and do not refer to the characteristic values ​​or other variables in the present invention;

[0156] If the number of features is s, then a total of s correlation coefficients [r1, r2, ..., r s ];

[0157] Finally, we get the fusion weight that each feature needs to be multiplied by:

[0158]

[0159] This means that the greater the correlation between a feature and a label, the greater the weight assigned to it, and the more the role of the feature is highlighted.

[0160] The obtained fusion feature is v = [G1v1, G2v2, ..., G s v s ], where v i It is a high-level representation of the i-th feature, that is, a layer of the neural network; v is passed through a fully connected layer, the dimension is reduced to a node with an output dimension of C, and the last layer of the network is obtained through Softmax, and then the parameters are optimized to complete the training of the entire network.

[0161] Figure 2 The system architecture of the abnormal flow detection and identification method of the power grid based on the multimodal machine learning algorithm of the present invention is shown, and the system includes:

[0162] Data collector, the data collector can be used to collect real-time flow data in industrial control systems. The data collector can be connected to the control system by using the switch mirror port access method, and at the same time it can achieve non-intrusion and non-interference to the control system.

[0163] Identification and early warning system, the identification and early warning system can analyze the collected traffic information, identify the characteristics of the traffic such as statistical characteristics (such as packet length, packet interval, etc.), protocol characteristics (such as protocol type, function code, etc.) and time characteristics (such as timestamp, frequency, etc.). At the same time, it can also judge and classify abnormal instructions.

[0164] Database server: Database server is mainly used for data storage services. The stored information mainly includes original network traffic and extracted traffic characteristics, abnormal traffic data, etc.

[0165] Display: The display mainly plays a visual role, and identification information can be displayed on the display interface.

[0166] The specific embodiments described herein are merely examples of the spirit of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in similar ways, but they will not deviate from the spirit of the present invention or exceed the scope defined by the appended claims.

[0167] Although the terms such as multimodal detection network, multimodal neural network, encoder, etc. are used more frequently in this article, the possibility of using other terms is not excluded. These terms are used only to more conveniently describe and explain the essence of the present invention; interpreting them as any additional limitation is contrary to the spirit of the present invention.

Claims

1. A method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm, characterized in that: The following steps are involved: Step 1: Obtain industrial control protocol message data: Install data collectors at key network nodes of the power industrial control system to capture communication messages of the power industrial control system network traffic, and store the collected message data in a stable data storage system for subsequent analysis and processing; Step 2: Train the multimodal detection network: Use normal business traffic data to train the multimodal detection network, which contains several encoders and a decoder that are fused by weights until the multimodal detection network can effectively perform decoding and restoration; Step 3: Abnormal traffic monitoring: A baseline threshold is set according to the decoding restoration degree under normal business to judge normal traffic and abnormal traffic. When the decoding restoration degree of the monitored traffic is lower than the baseline threshold after passing through the multimodal detection network, the traffic is marked as abnormal traffic and recorded and stored; Step 4: Abnormal data analysis modeling: Extract features from detected abnormal traffic and generate feature vectors from raw data; assign corresponding classification labels to the extracted feature vectors according to known abnormal traffic types, and use the feature vectors with classification labels for supervised learning of multimodal neural networks; evaluate the multimodal neural network through cross-validation and test set validation, and continuously optimize parameters to improve the classification accuracy of the classification model; Step 5: Use the final multimodal detection network and multimodal neural network to identify abnormal traffic in the power industrial control system network: Capture the messages in the power industrial control system network according to the method in step 1 and pass the detection network model. If the decoding restoration degree is lower than the baseline threshold, it is marked as abnormal traffic and input into the multimodal neural network to obtain the identification result.

2. The method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm according to claim 1, characterized in that: In step 1, the data collector is provided with a filtering configuration rule for capturing only the communication messages related to the industrial control protocol.

3. A method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm according to claim 1 or 2, characterized in that: The training process of the multimodal detection network in step 2 is specifically as follows: Step 201: Normalize the features of different dimensions. The formula is as follows: where x i_o is the original data of the i-th variable, x min is the minimum value in the original data of the variable, x max is the maximum value in the original data of the variable, x i is the normalized value; Step 202: Determine the number of messages n that make up each set of feature sequences, where n=k+1, divide all training data into several sequences according to feature types and ensure the time series relationship, and then calculate the autocorrelation of each feature, the formula is as follows: where x i is the numerical value of the feature, is all x i The mean of ; N is the number of all training samples; k is the time lag constant, which indicates the number of historical data to be used for each set of feature sequences, that is, the number of elements in each set of feature sequences is k+1; k is selected by trial and error, ranging from 1 to 30, and the value corresponding to the maximum average correlation of all features is selected as k; Step 203: Input the feature sequence into a multimodal detection network for training. The multimodal detection network includes several encoders and a decoder. The structure of a single encoder is as follows: Given input as sequence d of the mth feature m , 1≤m≤s, s is the total number of feature types, d m contains n normalized feature values ​​that maintain time series, and the hidden layer variable h is calculated as: h m =f(W m d m +b m ), W m and b m are the encoding weight matrix and encoding bias of the mth feature respectively, and f(·) is a nonlinear activation function, which is expressed as: The x in the above formula only represents the input variable used to express the form of the nonlinear activation function and has nothing to do with the feature value; Each feature type corresponds to an autoencoder; The output of the autoencoder is multiplied by the weights and then concatenated: h m represents the encoding of the mth feature, α m represents the combined weight of the mth feature, β m is the stitching bias of the mth feature; The combined h is input to the decoder for decoding. During decoding, the input is reconstructed into the hidden layer output variable Where W' and b' are the decoding weight matrix and decoding bias respectively; The encoding weight matrix, encoding bias, decoding weight matrix, decoding bias, splicing weight and splicing bias are all randomly initialized and determined through subsequent training; The loss function during training is the root mean square error (MSE).

4. The method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm according to claim 3 is characterized in that: In step 3, the threshold is set based on the root mean square error (MSE), which is calculated as follows: Where N is the number of samples, y i is the input multimodal detection network data, It is the output data of the multimodal detection network, that is, the restored data; the benchmark threshold is 1.3*MSE.

5. The method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm according to claim 1, characterized in that: In step 4, the statistical features are extracted as follows: Step 401: Read data packets from the collected power grid traffic file, and extract source IP, destination IP, source port, destination port and protocol from each data; Step 402: determine whether the bidirectional data stream pointed to by the identifier has ended. If it has ended, create a new bidirectional data stream identifier for the current data; if it has not ended, add the current data to the data stream pointed to by the identifier; Step 403: Continue to determine whether the existence time of the current data stream has exceeded the preset time limit, or whether the current data carries a FIN flag. If so, it indicates that the current data stream has ended, and it is necessary to output statistics of all the data in the data stream and write them into a file as the characteristics of the data stream for storage; if the current data stream has not ended, continue to read the next data of the PCAP file until all the data in the file has been read; Step 404: After all the data in the PCAP file is read, check the container storing the data flow identifier and determine if there are any data flows that have not yet ended and the number of data is greater than 1. Perform statistical output on them, write them into a file and save them, and complete the traffic feature extraction of the entire PCAP file.

6. The method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm according to claim 5, characterized in that: In step 4, the time feature is extracted as follows: Step 411: Count the time intervals between adjacent data arrivals in each stream, and calculate the average value, standard deviation, maximum value, and minimum value of all time intervals; Step 412: For each flow record, calculate the difference between the first data arrival time and the last data arrival time, that is, the duration of the flow; Step 413: Record the arrival timestamp of each data, count the number of packets arriving in a unit time, calculate the variance of a fixed time interval, and count the number of data in each time period.

7. A method for detecting and identifying abnormal power flow in a power grid based on a multimodal machine learning algorithm according to claim 5 or 6, characterized in that: In step 4, the neural network is trained as follows: Step 421: using the method of step 202 to obtain the number n of historical data to be used; Step 422: For a single neural network model, given input a = [a1, a2, ..., a n ] is the original data, and the first hidden layer variable L1 is calculated as L1=f(p1a+q1), p1 and q1 are the weight matrix and bias respectively, and f(·) is the nonlinear activation function; Step 423: Then, the second hidden layer variable L2 is obtained by the same calculation method, and so on, until the last hidden layer variable L is obtained. n ; For L n , specify its output size as the number of anomaly types; The output of each neural network is multiplied by the fusion weight and concatenated, and then passed through a layer of optimizable network to obtain a total L; Step 424: Use the Softmax function to calculate based on L and get the output The meaning of each element in is the probability of the abnormal type of the corresponding abnormal power grid flow; the calculation of the Softmax function is as follows Where C is the number of labels; Using the true label t, calculate the cross entropy loss Loss: t consists of all the tags, arranged in the specified order; The goal of model optimization is to minimize the loss and use the gradient descent method for back propagation to optimize the parameters and make the loss smaller and smaller.

8. The method for detecting and identifying abnormal flow in a power grid based on a multimodal machine learning algorithm according to claim 7, characterized in that: The fusion weight is obtained as follows: Calculate the correlation coefficient between input X and output Y, where X is the original feature and Y is the label. The calculation formula is: Where σ(X) and σ(Y) are standard deviations, calculated as: N is the number of elements, and is the mean; Cov(X,Y) is the covariance, calculated as: X, Y, x, y and their variations in the standard deviation formula and the covariance formula are only used to represent the specific forms of the two formulas and do not refer to the characteristic values ​​or other variables in the present invention; If the number of features is s, then a total of s correlation coefficients [r1, r2, ..., r s ]; Finally, we get the fusion weight that each feature needs to be multiplied by: The obtained fusion feature is v = [G1v1, G2v2, ..., G s v s ], where v i It is a high-level representation of the i-th feature; v is passed through a fully connected layer, the dimension is reduced to the node of output dimension C, and the last layer of the network is obtained through Softmax, and then the parameters are optimized to complete the training of the entire network.

Images