Abnormal file attack behavior classification method based on Transform
By applying the Transformer-based classification method for abnormal file attack behavior in the power grid system, the problem of insufficient response capabilities of malicious file detection to unknown threats in the prior art is solved, and higher detection accuracy and adaptability are achieved, ensuring the safety and stability of the power grid system.
Patent Information
- Application Number
- CN202411664954.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-04-29
AI Technical Summary
Malicious file detection technology in existing power grid systems has limited ability to respond to unknown threats, and rule-based detection methods are insufficient in flexibility and adaptability when facing complex and dynamically changing power threat environments, making it difficult to deal with emerging malware and attack technologies.
The abnormal file attack behavior classification method based on Transformer is adopted. By converting the audit log of the power system into a data source graph, the global and local associations of the behavior are used to calculate the behavior, the loss function is constructed and the attack behavior is identified through the clustering algorithm.
It significantly improves the accuracy and adaptability of the classification of attack behaviors of abnormal files in the power system, can dig out deep-seated correlations that are difficult to capture by traditional methods, enhances the ability to identify attack behaviors, and ensures that the power grid can maintain efficient detection performance in the face of evolving attack methods.
Smart Images
Figure CN119903387A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of power grid attack detection, and in particular relates to the design of a Transformer-based abnormal file attack behavior classification method. Background Art
[0002] In the current power grid system, malicious file detection technology mainly relies on feature matching and signature detection. These methods identify potential malicious behaviors that may harm the operation of the power grid by comparing with known malicious samples. For example, malicious files may attempt to invade key parts of the power grid such as the monitoring system and dispatching system to interfere with the normal supply of electricity or obtain sensitive information. However, with the continuous evolution of cyber attack methods in the power field, especially the increasingly complex evasion strategies for traditional detection technologies, relying solely on feature matching and signature detection has become inadequate. This method has extremely limited ability to respond to unknown threats, because new attacks on the power grid may not be registered in the feature library, resulting in the inability of the detection system to detect and defend in time, which may cause serious consequences such as power grid failures and power outages. In addition, signature detection is susceptible to disguised and variant attacks. Attackers can bypass the detection mechanism by slightly modifying malicious files, and then sneak into the power grid system, threatening power safety.
[0003] Rule-based detection methods also have significant deficiencies in power grid security protection. Although rules can effectively identify attacks of specific patterns, such as some known attack patterns against power network communication protocols, their flexibility and adaptability are obviously insufficient when facing a complex and dynamically changing power threat environment. The network environment in the power system is complex and diverse, involving a large number of devices and communication links. With the development of smart grids, new technologies and applications continue to emerge. This static rule system is difficult to cope with emerging malware and attack technologies, and often requires frequent updates and maintenance, which increases operation and maintenance costs and system complexity. If the rules are not updated in a timely manner, attackers may take advantage of the opportunity and endanger the stable operation of the power grid.
[0004] Although some machine learning-based methods have been applied to malicious file detection in power systems in recent years, these methods have improved the accuracy and intelligence of detection to a certain extent, but they still face challenges in processing complex power file features and dynamic behavior analysis. Files in power systems involve operating data, control instructions, etc. of various devices, which are highly complex and professional. Traditional machine learning models usually rely on manual feature engineering, which makes it difficult to fully capture the deep correlation of file features and may miss some key security risks. In addition, these models often lack a global perspective on the detection of abnormal behavior, easily ignore potential attack patterns, and cannot fully protect the power grid from malicious files. Therefore, the malicious file detection technology in the existing power system urgently needs to be innovated to improve the adaptability and detection accuracy of new attack methods, ensure the effectiveness and reliability of power grid security protection, and ensure the stable supply of electricity and the normal operation of society. Summary of the invention
[0005] The purpose of the present invention is to solve the problems of insufficient flexibility and low accuracy in the detection of malicious files in power systems in the prior art, and proposes a Transformer-based abnormal file attack behavior classification method.
[0006] The technical solution of the present invention is: a Transformer-based abnormal file attack behavior classification method, comprising the following steps:
[0007] S1. Convert the audit log of the power system into a data source graph. The nodes in the data source graph represent the entities in the power system, and the edges between the nodes represent the behaviors between the entities.
[0008] S2. Annotate the behavior of the data source graph and extract the behavior path.
[0009] S3. Analyze the behavior path, obtain the global association of the behavior based on Transformer, and obtain the local association of the behavior by setting the time window.
[0010] S4. Obtain behavior prediction values based on global associations.
[0011] S5. Calculate the correlation difference between the global correlation and the local correlation, and construct a loss function based on the correlation difference and the behavior prediction value.
[0012] S6. Obtain the corresponding optimal behavior prediction value with the goal of minimizing the loss function.
[0013] S7. Calculate the anomaly score between the best behavior prediction value and the behavior true value.
[0014] S8. The behaviors with abnormal scores higher than the preset threshold are regarded as attack behaviors, and the attack behaviors are clustered by clustering algorithms, and the specific attack categories are determined by sampling.
[0015] Furthermore, the Transformer in step S3 is composed of alternately stacked abnormal attention layers and feedforward layers, and the update formula of the Transformer layer l stacking structure is:
[0016] Z l =LayerNorm(Attention(χ l-1 )+χ l-1 )
[0017] χ l =LayerNorm(FeedForward(Z l )+Z l )
[0018] in represents the hidden state of the l-th layer stacking structure, R represents a real number set, N represents the number of behaviors in the time window, LayerNorm(·) represents the current layer parameter, Attention(·) represents the associated difference value, χ l-1 Represents the output of the l-1th layer stacking structure, represents the output of the l-th layer stacking structure, FeedForward(·) represents the feedforward propagation behavior, l∈{1, 2, ..., L}, L represents the number of layers of the Transformer stacking structure, and d model Represents the dimension of the multi-head self-attention mechanism in Transformer.
[0019] Furthermore, the global association of the behaviors in step S3 is expressed as:
[0020]
[0021] Among them, Global l represents the global association of the behaviors in the l-th layer stacking structure, Softmax(·) represents the activation function for finding the maximum value, Q represents the query vector of the multi-head self-attention mechanism in Transformer, K represents the key vector of the multi-head self-attention mechanism in Transformer, and the superscript T represents transpose.
[0022] Furthermore, the local association of the behavior in step S3 is expressed as:
[0023]
[0024] Among them, Local lrepresents the local correlation of the behavior in the l-th layer stacking structure, Rescale(·) represents the Gaussian kernel function, σ i The Gaussian kernel function corresponding to the i-th behavior in the time window can learn the scale parameter, i, j represent the i-th behavior and j-th behavior in the time window respectively, and exp(·) represents the natural exponential function.
[0025] Furthermore, the calculation formula of the behavior prediction value in step S5 is:
[0026]
[0027] in Represents the predicted value of the l-th layer stacking structure, and V represents the value vector of the multi-head self-attention mechanism in Transformer.
[0028] Furthermore, the calculation formula for the correlation difference between the global correlation and the local correlation in step S5 is:
[0029]
[0030] Where Dis(G, L) represents the difference between global correlation and local correlation, KL(·) represents KL divergence, represents the global association of the ith behavior in the lth layer stacking structure, Represents the local association of the i-th behavior in the l-th layer stacking structure.
[0031] Furthermore, the loss function constructed in step S5 is:
[0032]
[0033] in represents the loss function, χ represents the true value of the behavior, and λ represents the balancing hyperparameter.
[0034] Furthermore, the calculation formula of the anomaly score in step S7 is:
[0035]
[0036] Where score represents the anomaly score between the best behavior prediction value and the true behavior value, p i represents the probability that the ith behavior is predicted to be malicious, γ represents the hyperparameter used to adjust the weight, χ represents the true value of the behavior, represents the best behavior prediction value.
[0037] Furthermore, the distance formula of the clustering algorithm in step S8 is:
[0038]
[0039] Where d(a, b) represents the distance between the feature vector a of the current behavior and the cluster center vector b, ||·|| 1 represents the L1 distance, m represents the dimension of the vector, a k The kth attribute of the feature vector a representing the current behavior, b k Represents the kth attribute of the cluster center vector b.
[0040] The beneficial effects of the present invention are: the present invention significantly improves the accuracy and adaptability of the classification of abnormal file attack behaviors in the power system through Transformer and efficient feature extraction, can dig out deep-level associations that are difficult to capture with traditional methods, and greatly enhances the ability to identify attack behaviors. Compared with traditional feature matching and signature detection methods, the present invention has the ability to quickly respond to new threats, can promptly identify and process new forms of attacks against the power system, so that the power system can still maintain efficient detection performance in the face of evolving attack methods, ensure the normal operation of the power grid, and ensure the reliable supply of electricity, providing more powerful technical support for the security protection of the power network, effectively reducing the risks of power outages and equipment damage that may be caused by malicious attacks, and maintaining the stability of the power system and the normal operation order of society. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] Figure 1 The figure is a flow chart of a method for classifying abnormal file attack behaviors based on Transformer provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0042] Now, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the accompanying drawings are only exemplary and are intended to explain the principles and spirit of the present invention, rather than to limit the scope of the present invention.
[0043] The embodiment of the present invention provides a Transformer-based abnormal file attack behavior classification method, such as Figure 1 As shown, the following steps S1 to S8 are included:
[0044] S1. Convert the audit log of the power system into a data source graph. The nodes in the data source graph represent the entities in the power system, and the edges between the nodes represent the behaviors between the entities.
[0045] In the embodiment of the present invention, the audit log of the power system is converted into a data source graph using a data source graph technology.
[0046] S2. Annotate the behavior of the data source graph and extract the behavior path.
[0047] Since attack behaviors are more latent than normal behaviors, directly analyzing the data source graph will lead to the problem of path explosion. Therefore, in the embodiment of the present invention, the behavior path is obtained by calculating the path rarity and extracting it for subsequent analysis.
[0048] S3. Analyze the behavior path, obtain the global association of the behavior based on Transformer, and obtain the local association of the behavior by setting the time window.
[0049] In the embodiment of the present invention, the attention mechanism in the Transformer is used to calculate the weight distribution of each behavior at all time points, and a more informative description can be provided for the context according to the association distribution to obtain global association. At the same time, considering that the attack behavior will be concentrated in adjacent time points during the execution process, and more similar attack behaviors will be included in the execution window, local association can be obtained by analyzing the behavior in the window.
[0050] In the embodiment of the present invention, the Transformer is composed of an abnormal attention layer and a feedforward layer stacked alternately. This stacking structure helps to learn the underlying associations from deep multi-level features. The update formula of the Transformer layer l stacking structure is:
[0051] Z l =LayerNorm(Attention(χ l-1 )+χ l-1 )
[0052] χ l =LayerNorm(FeedForward(Z l )+Z l )
[0053] in represents the hidden state of the l-th layer stacking structure, R represents a real number set, N represents the number of behaviors in the time window, LayerNorm(·) represents the current layer parameter, Attention(·) represents the associated difference value, χ l-1 Represents the output of the l-1th layer stacking structure, represents the output of the layer stacking structure, FeedForward(·) represents the feedforward propagation behavior, l∈{1, 2, ..., L}, L represents the number of layers of the Transformer stacking structure, and d mode l represents the dimension of the multi-head self-attention mechanism in Transformer.
[0054] In the embodiment of the present invention, for local association, a learnable Gaussian kernel function is used to calculate the prior relative to the relative time distance. The Gaussian kernel can essentially pay more attention to the adjacent horizon and has a better learning ability for the neighboring behavior within the window. The global association branch learns the association from the original sequence, thereby adaptively finding the most effective association.
[0055] In the embodiment of the present invention, in order to calculate the global association and the local association, it is necessary to initialize the query vector Q, the key vector K, the value vector V in the multi-head self-attention and the learnable scale parameter σ in the Gaussian kernel function:
[0056]
[0057] in They represent the query matrix, key matrix, value matrix and scale parameter matrix of the lth layer stacking structure respectively.
[0058] The global association of behaviors is expressed as:
[0059]
[0060] Among them, Global l represents the global association of the behaviors in the l-th layer stacking structure, Softmax(·) represents the activation function for finding the maximum value, Q represents the query vector of the multi-head self-attention mechanism in Transformer, K represents the key vector of the multi-head self-attention mechanism in Transformer, and the superscript T represents transpose.
[0061] The local association of behaviors is expressed as:
[0062]
[0063] Among them, Local l represents the local correlation of the behavior in the l-th layer stacking structure, Rescale(·) represents the Gaussian kernel function, σ i The Gaussian kernel function corresponding to the i-th behavior in the time window can learn the scale parameter, i, j represent the i-th behavior and j-th behavior in the time window respectively, and exp(·) represents the natural exponential function.
[0064] S4. Get the behavior prediction value based on the global association:
[0065]
[0066] in Represents the predicted value of the l-th layer stacking structure, and V represents the value vector of the multi-head self-attention mechanism in Transformer.
[0067] S5. Calculate the correlation difference between the global correlation and the local correlation, and construct a loss function based on the correlation difference and the behavior prediction value.
[0068] In the embodiment of the present invention, the calculation of the association difference uses KL divergence. KL divergence is a statistical distance that measures the difference between a probability distribution and a reference probability distribution. By formalizing the difference value as a symmetric KL divergence between the local association and the global association, it represents the information gain between the two distributions, and the calculation formula is:
[0069]
[0070] Where Dis(G, L) represents the difference between global correlation and local correlation, KL(·) represents KL divergence, represents the global association of the ith behavior in the lth layer stacking structure, Represents the local association of the i-th behavior in the l-th layer stacking structure.
[0071] In order to introduce the association difference value into the subsequent parameter update process, the embodiment of the present invention uses reconstruction loss to achieve model optimization. The reconstruction loss will guide the global association to find the association with the largest amount of information. In order to further amplify the difference between normal and abnormal behavior, an additional loss term is used to amplify the association difference. Due to the unimodal characteristics of local associations, the difference loss will guide the sequence association to pay more attention to non-adjacent regions. The loss function is formalized as:
[0072]
[0073] in represents the loss function, χ represents the true value of the behavior, and λ represents the balancing hyperparameter.
[0074] S6. Obtain the corresponding optimal behavior prediction value with the goal of minimizing the loss function.
[0075] S7. Calculate the anomaly score between the best behavior prediction value and the behavior true value:
[0076]
[0077] Where score represents the anomaly score between the best behavior prediction value and the true behavior value, p i represents the probability that the ith behavior is predicted to be malicious, γ represents the hyperparameter used to adjust the weight, χ represents the true value of the behavior, represents the best behavior prediction value.
[0078] S8. The behaviors with abnormal scores higher than the preset threshold are regarded as attack behaviors, and the attack behaviors are clustered by clustering algorithms, and the specific attack categories are determined by sampling.
[0079] In the embodiment of the present invention, the DBSCAN clustering algorithm is used to cluster the attack behaviors, and its distance formula is:
[0080]
[0081] Where d(a, b) represents the distance between the feature vector a of the current behavior and the cluster center vector b, ||·|| 1 represents the L1 distance, which captures more subtle differences in high-dimensional data. m represents the dimension of the vector, which is used to reflect the number of attributes describing the behavior characteristics. k The kth attribute of the feature vector a representing the current behavior, b k Represents the kth attribute of the cluster center vector b.
[0082] In the embodiment of the present invention, when an attack behavior is detected, the neighboring behaviors in the window are output as semantic environments, and the attention vectors are combined with their corresponding events to model each sequence, and the sequence behaviors with similar vectors are compared and grouped into a cluster to indicate that they have the same behavioral purpose. If the distance function d(a, b) is less than or equal to the threshold τ, then the two vectors are considered similar. After clustering by the clustering algorithm, all behaviors in the cluster have the same behavioral purpose, and analyzing a single behavior is sufficient to determine whether the remaining behaviors are normal or malicious.
[0083] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.
Claims
1. A Transformer-based abnormal file attack behavior classification method, characterized by: The following steps are involved: S1. Convert the audit log of the power system into a data source graph, use the nodes in the data source graph to represent the entities in the power system, and use the edges between the nodes to represent the behaviors between the entities; S2. Annotate the data source graph with behaviors and extract the behavior paths; S3, analyze the behavior path, obtain the global association of the behavior based on Transformer, and obtain the local association of the behavior by setting the time window; S4, obtaining a behavior prediction value based on the global association; S5, calculating the correlation difference between the global correlation and the local correlation, and constructing a loss function according to the correlation difference and the behavior prediction value; S6, taking the minimum loss function as the goal to obtain the corresponding optimal behavior prediction value; S7, calculating the anomaly score between the best behavior prediction value and the behavior true value; S8. The behaviors with abnormal scores higher than the preset threshold are regarded as attack behaviors, and the attack behaviors are clustered by clustering algorithms, and the specific attack categories are determined by sampling.
2. According to the Transformer-based abnormal file attack behavior classification method of claim 1, it is characterized in that: The Transformer in step S3 is composed of alternately stacked abnormal attention layers and feedforward layers. The update formula of the Transformer layer l stacking structure is: Z l =LayerNorm(Attention(x l-1 )+x l-1 ) χ l =LayerNorm(FeedForward(From l )+Z l ) in represents the hidden state of the l-th layer stacking structure, R represents a real number set, N represents the number of behaviors in the time window, LayerNorm(·) represents the current layer parameter, Attention(·) represents the associated difference value, χ l-1 Represents the output of the l-1th layer stacking structure, represents the output of the l-th layer stacking structure, FeedForward(·) represents the feedforward propagation behavior, l∈{1,2,…,L}, L represents the number of layers of the Transformer stacking structure, and d model Represents the dimension of the multi-head self-attention mechanism in Transformer.
3. The Transformer-based abnormal file attack behavior classification method according to claim 2 is characterized in that: The global association of the behaviors in step S3 is expressed as: Among them, Global l represents the global association of behaviors in the l-th layer stacking structure, Softmax(·) represents the activation function for finding the maximum value, represents the query vector of the multi-head self-attention mechanism in Transformer, K represents the key vector of the multi-head self-attention mechanism in Transformer, and the superscript T represents transpose.
4. The Transformer-based abnormal file attack behavior classification method according to claim 2 is characterized in that: The local association of the behaviors in step S3 is expressed as: Among them, Local l represents the local correlation of the behavior in the l-th layer stacking structure, Rescale(·) represents the Gaussian kernel function, σ i The Gaussian kernel function corresponding to the i-th behavior in the time window can learn the scale parameter, i, j represent the i-th behavior and j-th behavior in the time window respectively, and exp(·) represents the natural exponential function.
5. The Transformer-based abnormal file attack behavior classification method according to claim 3 is characterized in that: The calculation formula of the behavior prediction value in step S5 is: in Represents the predicted value of the l-th layer stacking structure, and V represents the value vector of the multi-head self-attention mechanism in Transformer.
6. The Transformer-based abnormal file attack behavior classification method according to claim 5 is characterized in that: The calculation formula of the correlation difference between the global correlation and the local correlation in step S5 is: Where Dis(G,L) represents the difference between global correlation and local correlation, KL(·) represents KL divergence, represents the global association of the ith behavior in the lth layer stacking structure, Represents the local association of the i-th behavior in the l-th layer stacking structure.
7. The Transformer-based abnormal file attack behavior classification method according to claim 6 is characterized in that: The loss function constructed in step S5 is: in represents the loss function, χ represents the true value of the behavior, and λ represents the balancing hyperparameter.
8. The Transformer-based abnormal file attack behavior classification method according to claim 1 is characterized in that: The calculation formula of the abnormal score in step S7 is: Where score represents the anomaly score between the best behavior prediction value and the true behavior value, p i represents the probability that the ith behavior is predicted to be malicious, γ represents the hyperparameter used to adjust the weight, χ represents the true value of the behavior, represents the best behavior prediction value.
9. The Transformer-based abnormal file attack behavior classification method according to claim 1 is characterized in that: The distance formula of the clustering algorithm in step S8 is: Where d(a,b) represents the distance between the feature vector a of the current behavior and the cluster center vector b, ∥·∥1 represents the L1 distance, m represents the dimension of the vector, and a k The kth attribute of the feature vector a representing the current behavior, b k Represents the kth attribute of the cluster center vector b.