Electric power 5G network traffic attack prediction method, system, device and medium

Abstract

The invention discloses an electric power 5G network traffic attack prediction method, system and device and a medium, and the method comprises the steps: obtaining multi-dimensional traffic data of an electric power 5G network, and carrying out the standardization processing of the multi-dimensional traffic data through weighting One-hot coding, and obtaining a standardized traffic matrix; performing feature extraction on the standardized traffic matrix based on a multi-scale convolutional neural network model and a long-short-term memory network model introducing an attention mechanism to obtain comprehensive traffic features; processing the comprehensive traffic features according to an improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network fusing a residual network and adaptive dynamic Dropout; and carrying out probability mapping on the high-dimensional traffic characteristics through an activation function to obtain a traffic attack prediction result of the power 5G network, so as to effectively predict a network traffic attack situation and provide more efficient and more accurate security guarantee for the power 5G communication network.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method, system, device and medium for predicting power 5G network traffic attacks. Background Art

[0002] At present, 5G networks have been widely used in the power industry due to their technical advantages such as high bandwidth and low latency. However, they face multiple security risks due to their channel openness and user diversity. Therefore, the prediction of 5G network anomalies is becoming increasingly important.

[0003] In the existing technology, deep learning network models are usually used to predict 5G network anomalies. However, the model construction process of this method is complicated and has high requirements for computing resources, which limits its practical application and leads to low prediction accuracy.

[0004] It can be seen that how to improve the prediction accuracy of attacks on power 5G network traffic has become a technical problem that technical personnel in this field need to solve urgently. Summary of the invention

[0005] The present invention provides a method, system, device and medium for predicting attacks on power 5G network traffic, which solve the problem of how to improve the prediction accuracy of attacks on power 5G network traffic.

[0006] In order to solve the above technical problems, the first aspect of the present invention provides a method for predicting power 5G network traffic attacks, comprising: Acquire multidimensional traffic data of the electric power 5G network, and standardize the multidimensional traffic data through weighted one-hot coding to obtain a standardized traffic matrix; Based on a multi-scale convolutional neural network model and a long short-term memory network model with an attention mechanism, feature extraction is performed on the standardized traffic matrix to obtain comprehensive traffic features; The comprehensive traffic features are processed according to the improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network that integrates residual network and adaptive dynamic Dropout; The high-dimensional traffic features are probability mapped through an activation function to obtain a traffic attack prediction result for the power 5G network.

[0007] As one of the preferred solutions, the multi-dimensional traffic data is standardized by weighted One-hot encoding to obtain a standardized traffic matrix, including: The multidimensional traffic data is coded to obtain a coded traffic matrix, and the coded traffic matrix is ​​standardized by using a standardization model based on mean absolute deviation to obtain a standard coded traffic matrix; The standard coded traffic matrix is ​​encoded by the weighted one-hot encoding to obtain a standardized traffic matrix.

[0008] As one preferred embodiment, the standardized model is represented by the following formula: In the formula, , are the values ​​of the i-th feature in the j-th record in the standard coded traffic matrix before and after normalization, respectively; is the mean of the i-th feature; is the mean absolute deviation of the i-th feature; n is the total number of features; The weighted One-hot encoding is expressed by the following formula: Where Y is the weighted One-hot encoding matrix; is the weight corresponding to the i-th attack type; , is the weight adjustment factor; is the frequency of the i-th attack type in the historical multi-dimensional traffic data; , are the new and old severity of the i-th attack type, respectively; is the learning rate; is the real-time impact assessment value of the i-th attack type.

[0009] As one of the preferred solutions, the multi-scale convolutional neural network model and the long short-term memory network model with the attention mechanism are used to extract features from the standardized traffic matrix to obtain comprehensive traffic features, including: Extracting features from the standardized traffic matrix through the convolution kernel of the multi-scale convolutional neural network model to obtain key features, and processing the key features through an activation function to reduce the dimension of the processing results by using a global average pooling operation to generate a preliminary feature matrix; Using a long short-term memory network model that introduces attention weights to perform time series modeling on the preliminary feature matrix to obtain a time series feature matrix; The preliminary feature matrix and the time series feature matrix are concatenated and fused to obtain comprehensive traffic features.

[0010] As one of the preferred solutions, the improved deep neural network model includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a residual layer, a first hidden layer, a second hidden layer and a third hidden layer; wherein, The comprehensive traffic features are processed according to the improved deep neural network model to obtain high-dimensional traffic features, including: Taking the comprehensive flow feature as an input feature, after connection through the residual layer, performing weighted calculation and mapping processing on the comprehensive flow feature through the first fully connected layer, obtaining a first layer feature to apply adaptive dynamic Dropout, generating a first flow feature and outputting it through the first hidden layer; Taking the first flow feature as an input feature, after being connected through the residual layer, performing weighted calculation and mapping processing on the first flow feature through the second fully connected layer to obtain a second layer feature to apply adaptive dynamic Dropout, generate a second flow feature and output it through the second hidden layer; The second flow feature is taken as the input feature, and after being connected through the residual layer, the second flow feature is weighted calculated and mapped through the third fully connected layer to obtain the third layer feature to apply adaptive dynamic Dropout, generate high-dimensional flow features and output through the third hidden layer.

[0011] As one of the preferred solutions, the output results of each hidden layer are expressed by the following formula: In the formula, is the output feature of the uth hidden layer; is a random mask matrix; is the u-th layer feature; is the output probability of the uth fully connected layer; a1 and a2 are hyperparameters; , are the anti-fitting feature probability and anti-sparse feature probability of the u-th fully connected layer respectively; is the weight gradient of the u-th fully connected layer; Var() is the variance of the gradient change; Mean() is the gradient mean; is the smoothing factor; is the i-th feature of the u-th fully connected layer; is the indicator function; N is the total number of features.

[0012] As one of the preferred solutions, the probability mapping of the high-dimensional traffic features by an activation function to obtain the traffic attack prediction result of the power 5G network includes: The Softmax function is used to perform probability mapping on the high-dimensional traffic features to obtain classification probability; Compare the classification probability with a preset classification threshold, and determine a prediction result of a traffic attack on the electric power 5G network according to the comparison result; The preset classification threshold is expressed by the following formula: In the formula, K is the preset classification threshold; E is the classification weight factor; Precision and Recall are the first and second prediction accuracy rates respectively.

[0013] A second aspect of the present invention provides a power 5G network traffic attack prediction system, comprising: A data preprocessing module is used to obtain multi-dimensional flow data of the power 5G network, and standardize the multi-dimensional flow data through weighted one-hot coding to obtain a standardized flow matrix; A feature extraction module, used for extracting features from the standardized traffic matrix based on a multi-scale convolutional neural network model and a long short-term memory network model introducing an attention mechanism, to obtain comprehensive traffic features; A feature processing module, used for processing the comprehensive traffic features according to an improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network that integrates a residual network and an adaptive dynamic Dropout; The classification prediction module is used to perform probability mapping on the high-dimensional traffic features through an activation function to obtain a traffic attack prediction result for the power 5G network.

[0014] A third aspect of the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor implements the power 5G network traffic attack prediction method as described above when executing the computer program.

[0015] The fourth aspect of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the power 5G network traffic attack prediction method as described above is implemented.

[0016] Compared with the prior art, the embodiments of the present invention have the following advantages: (1) Through the full collection of multi-dimensional traffic data of the power 5G network, the data preprocessing technology based on standardization and normalization is adopted to improve the quality and consistency of the original data. At the same time, the weighted one-hot encoding technology is combined to convert the various types of network attack behaviors in the original data into vector expressions, which improves the model's attention to different types of attacks and avoids rare attacks from being ignored, providing efficient data support for subsequent feature extraction and classification models; (2) The multi-scale convolutional neural network model and the long short-term memory network model with the attention mechanism are used to jointly extract features, which improves the model's recognition accuracy for complex network attack behaviors and its generalization ability and robustness in time series scenarios. (3) The extracted feature data is modeled at a high level through a deep neural network that combines a residual network with an adaptive dynamic Dropout. The multi-layer structure is used to gradually capture the complex relationships in the data. An adaptive dynamic Dropout mechanism is introduced between each hidden layer to randomly shield some neurons, reduce the model's excessive reliance on a single feature, and thus reduce the risk of overfitting. Combined with the activation function, the data distribution is smoothed, the classification capability of multiple types of attack behaviors is optimized, and the generalization effect of unknown attacks is improved. (4) Through the classification mechanism of the activation function, high-dimensional features are mapped into classification probabilities, thereby improving the accurate prediction of power 5G network traffic attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the implementation mode will be briefly introduced below. Obviously, the drawings described below are only some implementation modes of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a flow chart of a method for predicting power 5G network traffic attack provided by a certain embodiment of the present invention; Figure 2 is a feature extraction flow chart in step S2 provided in an embodiment of the present invention; Figure 3 is a feature processing flow chart in step S3 provided in an embodiment of the present invention; Figure 4 This is a structural diagram of a power 5G network traffic attack prediction system provided by a certain embodiment of the present invention; Figure 5 It is a structural diagram of an electronic device provided by a certain embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings and embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] In the description of this application, the terms "first", "second", "third", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the feature. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0021] In the description of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two components. The terms "vertical", "horizontal", "left", "right", "upper", "lower" and similar expressions used herein are for illustrative purposes only, and do not indicate or imply that the system or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0022] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present invention have the same meaning as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. For those of ordinary skill in the art, the specific meanings of the above terms in this application can be understood by specific circumstances.

[0023] In one embodiment, if Figure 1 As shown, the first aspect of the present invention provides a method for predicting a 5G network traffic attack on a power grid, comprising: S1. Obtain multidimensional traffic data of the power 5G network, and standardize the multidimensional traffic data through weighted One-hot coding to obtain a standardized traffic matrix; S2. Extracting features from the standardized traffic matrix based on a multi-scale convolutional neural network model and a long short-term memory network model with an attention mechanism to obtain comprehensive traffic features; S3. Processing the comprehensive traffic features according to the improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network that integrates a residual network and an adaptive dynamic Dropout; S4. Probability mapping is performed on the high-dimensional traffic features through an activation function to obtain a traffic attack prediction result on the power 5G network.

[0024] The present invention collects multi-dimensional traffic data in real time from various base stations, user devices and other sources of the power 5G network, such as traffic size and direction, timestamp and time interval, location information, user identity, service type and quality, network load and quality, security events and traffic characteristics, etc., to comprehensively reflect the network traffic situation, and cleans and converts these multi-dimensional traffic data, removes duplicate and invalid data items, standardizes data formats and data item definitions, and uses weighted One-hot coding to standardize the multi-dimensional traffic data; wherein, weighted One-hot coding is based on traditional One-hot coding, and different weights are assigned according to the severity and real-time impact assessment caused by attack data of each dimension, so as to obtain a standardized traffic matrix, so as to solve the problem that the traditional collection method has significant deficiencies in data consistency and analysis performance due to the diverse and non-uniform formats of the original data, and contains noisy data and unrecognizable fields.

[0025] Then, based on the multi-scale convolutional neural network model (MSCNN), multiple parallel convolution paths are constructed. Each path adopts different convolution kernel sizes and step sizes to capture feature information of different scales that can reflect the details and global characteristics of the traffic data. It is combined with the long short-term memory network model (Attention-LSTM) that introduces the attention mechanism through its internal gate mechanism and state update mechanism. It can process long sequence data and capture the time characteristics obtained by the long-distance dependencies therein to obtain comprehensive traffic characteristics to comprehensively reflect the traffic situation of the power 5G network, provide strong support for subsequent attack predictions, and thus solve the problem that traditional feature extraction methods are difficult to capture the nonlinear characteristics in complex network attack patterns.

[0026] Then, a deep neural network model that combines the residual network (ResNet) and adaptive dynamic Dropout (ADD) is used to process the comprehensive traffic features extracted by MSCNN. Among them, the residual network helps to alleviate the gradient vanishing problem in the deep neural network by introducing jump connections. The adaptive dynamic Dropout can dynamically adjust the Dropout rate according to the data distribution and training process to reduce overfitting. The comprehensive traffic features are input into the improved deep neural network model, and through multi-layer nonlinear transformation and feature extraction, high-dimensional traffic features are obtained to more deeply reflect the inherent laws and potential risks of traffic data, thereby solving the problems that traditional prediction methods rely on rule bases, fixed thresholds or dynamic models, are difficult to adapt to new attacks, are prone to false positives and false negatives, have high computational complexity, and have limited effects.

[0027] Finally, a suitable activation function (such as Softmax function or Swish function) is selected to perform probability mapping on high-dimensional traffic features to obtain the traffic attack prediction results of the power 5G network. These results can be presented in the form of probability distribution to facilitate subsequent security protection and decision support.

[0028] In one embodiment, the multi-dimensional traffic data is normalized by weighted one-hot encoding to obtain a normalized traffic matrix, including: The multidimensional traffic data is coded to obtain a coded traffic matrix, and the coded traffic matrix is ​​standardized by using a standardization model based on mean absolute deviation to obtain a standard coded traffic matrix; The standard coded traffic matrix is ​​encoded by the weighted one-hot encoding to obtain a standardized traffic matrix.

[0029] Specifically, since the prediction of network attacks requires observation of characteristic information such as the type, quantity, and dimension of network attacks, the present invention uses a data collector in the power monitoring network to clean and normalize the collected raw network traffic data, eliminate noise data and invalid fields, and output high-quality standardized input data.

[0030] In the data preprocessing stage, non-numeric information needs to be replaced with numerical index values ​​for analysis. After the index value is encoded, each attack type will be represented by an integer value to facilitate subsequent calculation and classification. The encoded traffic matrix is ​​defined as ,in Indicates the encoding result of the i-th record, thus completing the data formatting. Next, the encoded data is processed using a standardized model based on the mean and mean absolute deviation to eliminate the dimensional influence between different features and ensure the robustness of the algorithm on the input data, thereby improving the stability of data analysis and the training effect of the model. The standardized model is expressed by the following formula: In the formula, , are the values ​​of the i-th feature in the j-th record in the standard coded traffic matrix before and after normalization, respectively; is the mean of the i-th feature; is the mean absolute deviation of the i-th feature; n is the total number of features; Compared with standardization based on standard deviation, the standardization model based on mean absolute deviation is more robust to outliers. At the same time, the standard deviation will be significantly amplified by a few extreme values, while the mean absolute deviation is less affected by extreme values. Therefore, it is more suitable for processing abnormal data that may exist in network traffic.

[0031] After completing the normalization process, the attack type needs to be encoded. For the encoding of the attack type, the present invention adopts weighted One-hot encoding, wherein the weighted One-hot encoding is expressed by the following formula: Where Y is the weighted One-hot encoding matrix; is the weight corresponding to the i-th attack type, and its value can be dynamically generated according to the characteristics of the attack; n is the vector dimension; , is the weight adjustment factor, which is used to control the impact ratio of frequency and severity; is the frequency of the i-th attack type in the historical multi-dimensional traffic data; , are the new and old severity of the ith attack type (such as business interruption impact, economic loss, etc.); is the learning rate; is the real-time impact assessment value of the i-th attack type.

[0032] The weighted One-hot encoding model can be trained based on historical traffic data. At the same time, when the model is running, the weights will be updated according to the actual impact of the attack (such as user feedback, economic losses, etc.). In the data preprocessing stage, the present invention not only completes the standardization of the data, but also embeds the importance of the attack type into the feature vector matrix through dynamic weighted One-hot encoding. In order to enhance the consistency and analyzability of the data, the standardization operation is completed using the mean and absolute difference, solving the problem that the original data may not be recognized or processed, and providing more accurate input for subsequent feature extraction and classification modeling.

[0033] In one embodiment, step S2 includes: Extracting features from the standardized traffic matrix through the convolution kernel of the multi-scale convolutional neural network model to obtain key features, and processing the key features through an activation function to reduce the dimension of the processing results by using a global average pooling operation to generate a preliminary feature matrix; Using a long short-term memory network model that introduces attention weights to perform time series modeling on the preliminary feature matrix to obtain a time series feature matrix; The preliminary feature matrix and the time series feature matrix are concatenated and fused to obtain comprehensive traffic features.

[0034] Specifically, the deficiency of traditional CNN is that its convolution kernel has a fixed size, which results in it only being able to capture features of a single scale and making it difficult to take into account both local and global information. In addition, it is usually limited to shallow feature extraction and lacks the ability to model complex patterns or nonlinear relationships in high-dimensional data. It is easy to miss potentially important features and lacks the ability to model contextual correlations and global dependencies between features. It is highly sensitive to noise and redundant information in high-dimensional data, resulting in reduced model performance and poor robustness to interference data. Based on this, the present invention uses a multi-scale convolutional neural network to extract features from preprocessed data during the feature extraction stage. By introducing convolution kernels of various sizes, multi-scale feature extraction is achieved, which can capture local and global information at the same time and improve the adaptability to complex patterns. At the same time, combined with the global average pooling operation, Attention-LSTM is proposed to further enhance MSCNN's ability to extract time series network traffic features, effectively reduce interference in the data, and improve the model's robustness to interference data. The specific feature extraction process is as follows: Figure 2 shown.

[0035] The input of the multi-scale convolutional neural network is a set of continuous sliding window representations, so that the standardized flow matrix is ​​input into the sliding window. In order to extract the local features in the sliding window, the convolution kernel is used to transform the input features. Among them, convolution kernels of various sizes are used to extract local features of different scales. Let the convolution kernel be J c, the formula for the convolution operation is: In the formula, is the key feature extracted by the cth convolution kernel; is the Sigmoid activation function; w is the window size; t is the time; is the bias term of the cth channel, which is used to enhance the nonlinear expression ability of the feature; The output of the convolution operation is transformed nonlinearly through the Sigmoid activation function to effectively enhance the network's ability to express complex features while avoiding feature loss. All convolution results are concatenated and fused to form a higher-dimensional feature matrix. .

[0036] Finally, the global average pooling method is used on the fused feature matrix F to further extract the most significant features, thereby achieving feature dimensionality reduction and spatial invariance; the formula for global average pooling is: In the formula, is the global average pooling result of the cth channel; is the i-th value of the c-th channel of the fused feature moment, and n is the total number of elements of the feature in this channel.

[0037] The pooling operation selects the maximum value within the local window, retains the most important features, and reduces data complexity. It solves the problem of maximum pooling's over-reliance on local maximum values, and enhances information retention, model stability, and spatial invariance.

[0038] After convolution and pooling operations, the initial feature matrix P is obtained. Based on the MSCNN architecture, the present invention proposes an Attention-LSTM unit to perform time series modeling on the initial feature matrix after pooling, so as to further enhance the ability to capture contextual relevance and nonlinear relationships in dynamic network traffic features. The input of the traditional LSTM is P, and the output is the feature representation after time series modeling. : In the formula, , , They are input gate, forget gate and output gate respectively; It is a memory unit; is the hidden state of LSTM (the final output feature - time series feature matrix); W and U are network weights, which can be obtained through historical data training and can also be updated in real time according to the data effect when processing real-time data; tanh is the hyperbolic tangent activation function.

[0039] However, in the traditional LSTM, the memory gate, input gate and output gate are calculated by static weight matrix and bias parameters, and the weight of each time step cannot be adjusted dynamically according to the global context information of the sequence. Based on this, the present invention adopts the attention mechanism to dynamically optimize the gate calculation process inside the LSTM, so that the gate control unit can explicitly perceive the global context features and improve the ability of dynamic weight allocation. The introduction of the attention mechanism enables the gate control unit to better capture the complex nonlinear characteristics of the time series, that is, on the basis of the traditional memory gate formula, the attention weight is added so that the memory gate can dynamically perceive the global context information, as shown below: By introducing attention weights , adjust the dynamic proportion of past information retained by the memory gate, so that the memory of past time steps can be dynamically adjusted in combination with the current context. Similarly, the attention mechanism is also introduced in the input gate , so that the input update of the current time step can be combined with the global context, as follows: For the update of candidate memory cells, the input ratio is dynamically adjusted based on the context features: The output gate controls the update of the hidden state and also needs to increase the dynamic attention weight : The final hidden state update is combined with the gating result of attention optimization: in, It is a memory update with attention mechanism.

[0040] Finally, the output features of Attention-LSTM are concatenated with the feature matrix extracted by MSCNN to form a comprehensive traffic feature. , where Represents feature concatenation operation. The final comprehensive traffic features include both static features extracted by multi-scale convolution and dynamic time series features modeled by LSTM, providing richer input information for the subsequent classification stage. The feature extraction results provide high-quality feature representation for the subsequent deep neural network input.

[0041] In the feature extraction stage, the present invention adopts a multi-scale convolutional neural network to extract features from the standardized data. The MSCNN scans the local area of ​​the data through the convolution kernel, extracts key features and generates a feature map. In order to enhance the nonlinear expression ability of the model, the Sigmoid activation function is used to process the result after the convolution operation. The last step of feature extraction is to extract the most significant eigenvalues ​​through the global average pooling operation, thereby effectively reducing the redundant information of the data, while retaining the spatial invariance and importance of the feature data. The Attention-LSTM unit is used to perform sequence modeling on the features extracted by the MSCNN to capture the contextual relevance between different time steps. At the same time, the features extracted by the MSCNN and the Attention-LSTM are fused to generate a comprehensive feature matrix, thereby significantly improving the model's recognition ability for complex network attack behaviors, especially the generalization ability and robustness in the time series scenario, effectively extracting the key patterns in the data, reducing the interference of redundant information, and providing a basis for subsequent feature processing and classification.

[0042] In one embodiment, the improved deep neural network model includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a residual layer, a first hidden layer, a second hidden layer and a third hidden layer; wherein step S3 includes: Taking the comprehensive flow feature as an input feature, after connection through the residual layer, weighted calculation and mapping processing are performed on the comprehensive flow feature through the first fully connected layer to obtain a first layer feature to apply adaptive dynamic Dropout, generate a first flow feature and output it through the first hidden layer; Taking the first flow feature as an input feature, after being connected through the residual layer, performing weighted calculation and mapping processing on the first flow feature through the second fully connected layer, obtaining a second layer feature to apply adaptive dynamic Dropout, generating a second flow feature and outputting it through the second hidden layer; The second flow feature is taken as an input feature, and after being connected through the residual layer, the second flow feature is weighted calculated and mapped through the third fully connected layer to obtain a third layer feature to apply adaptive dynamic Dropout, generate a high-dimensional flow feature and output it through the third hidden layer.

[0043] Specifically, the feature processing flow is as follows: Figure 3As shown, at this stage, the present invention further processes the high-dimensional feature data generated in the feature extraction stage based on the DNN that integrates ResNet and adaptive dynamic Dropout. The improved deep neural network model DNN extracts high-order features layer by layer and learns the complex relationship between features through its multi-layer structure; wherein, DNN includes three hidden layers, each of which performs nonlinear mapping on the input features through weights, biases and activation functions, and directly adds the input features to the output features through residual connections, allowing information to jump along the network level. It can retain low-order features in each layer, while enhancing the learning ability of the deep network for high-order features, alleviating the gradient disappearance problem in the deep model, and retaining low-order and high-order features in each layer, while introducing adaptive dynamic Dropout between each hidden layer, randomly shielding some neurons, reducing the model's excessive dependence on a single feature, thereby reducing the risk of overfitting. At this stage, the present invention uses the Sigmoid activation function to enhance the nonlinear modeling ability of the model, ensuring that the model can accurately capture the potential features in the data; finally, DNN generates a deep feature representation, providing a clear feature basis for the classification stage. In addition, it should be noted that the parameters in the model used in the solution can be obtained through historical data training and summary, and then the trained model is used to process real-time data.

[0044] The improved deep neural network model takes the comprehensive traffic features as input, and after the residual layer connection, uses the fully connected layer and hidden layer to process and extract high-order features layer by layer; the calculation formula of each fully connected layer is: In the formula, , are the input and output of the u-th fully connected layer respectively; Sigmoid activation function is selected as a nonlinear transformation, which can effectively handle the nonlinear relationship between complex features and provide a stronger expression ability for the model; is the weight matrix of the u-th fully connected layer; is the bias vector of the uth fully connected layer. In this formula, if u=1, the input and output of the first fully connected layer are the comprehensive flow features and the first layer features respectively; if u=2, the input and output of the second fully connected layer are the first layer features and the second layer features respectively; then when u=3, the input and output of the third fully connected layer are the second layer features and the third layer features respectively.

[0045] After being processed by the fully connected layer, each level of features obtained must apply adaptive dynamic Dropout, that is, the activation value of the neuron is mapped to the relative linear range of a function (such as the sigmoid function) for probability calculation, and then the inactivation probability of each neuron is calculated based on the mapped activation value or other related indicators. This probability can be dynamic, that is, it changes according to the current state of the neuron or the characteristics of the input data, and in each forward propagation, some neurons are randomly inactivated according to the calculated inactivation probability. At the same time, in the backward propagation process, the parameters are updated according to the network structure after inactivation to randomly shield some neurons, reduce the model's excessive dependence on a single feature, thereby reducing the risk of overfitting, and combining the activation function to smooth the data distribution, optimize the classification ability of multiple types of attack behaviors, and improve the generalization effect of unknown attacks.

[0046] After applying adaptive dynamic Dropout to the hierarchical features, the flow features are generated to be output through the hidden layer. Then the output results of each hidden layer are expressed by the following formula: In the formula, is the output feature of the uth hidden layer; is a random mask matrix; is the u-th layer feature; is the output probability of the uth fully connected layer; a1 and a2 are hyperparameters used to adjust the weight of the influence of gradient change and feature sparsity on the Dropout probability; , are the anti-fitting feature probability and anti-sparse feature probability of the u-th fully connected layer respectively; the anti-fitting feature probability is used to characterize the sensitivity of gradient changes: if the gradient change of a certain layer is large, the Dropout probability should be low to avoid excessive weakening of feature learning; if the gradient change is small, the Dropout probability can be high to increase randomness to prevent overfitting; the anti-sparse feature probability is used to characterize the sensitivity of feature sparsity: if the feature sparsity is high, it means that the feature representation ability of this layer is weak, and the Dropout probability needs to be reduced to retain more neurons; if the feature sparsity is low, the Dropout probability can be increased to enhance the regularization effect; is the weight gradient of the u-th fully connected layer; Var() is the variance of the gradient change; Mean() is the gradient mean; is the smoothing factor; is the i-th feature of the u-th fully connected layer; is the indicator function; N is the total number of features. In this formula, if u=1, the output of the first hidden layer is the first flow feature; if u=2, the output of the second hidden layer is the first flow feature; then when u=3, the output of the third hidden layer is the high-dimensional flow feature. The high-dimensional flow feature generated after multi-layer mapping represents the high-order modeling result of the improved deep neural network on the feature data, which not only contains the local feature information of the original input, but also captures the complex relationship between features through nonlinear mapping.

[0047] In the feature processing stage, the present invention further performs high-order feature modeling and semantic representation on the feature data extracted from MSCNN by integrating the residual network and the adaptive dynamic Dropout DNN, so that the residual connection allows information to jump along the network level by adding the input directly to the output, and can retain low-order features in each layer, while enhancing the learning ability of the deep network for high-order features, alleviating the gradient vanishing problem, reducing information loss, so as to capture the complex relationship between features, and generate high-dimensional semantic features through multi-layer nonlinear mapping, providing more discriminative input for classification. And ADD regularization is introduced between each hidden layer to avoid the problem of excessive information loss or insufficient feature learning during the training process caused by the fixed Dropout probability, improve the training robustness and generalization ability of the deep neural network, so that the model can better adapt to the complex network attack mode, reduce the excessive dependence between neurons, and effectively alleviate the overfitting of the model. The present invention uses the improved deep neural network to abstract and optimize the input features layer by layer, and converts the original local features into high-dimensional feature vectors with global semantic information as the input of the next classification stage, providing support for the accurate identification of network attacks.

[0048] In one embodiment, step S4 includes: The Softmax function is used to perform probability mapping on the high-dimensional traffic features to obtain classification probability; Compare the classification probability with a preset classification threshold, and determine a prediction result of a traffic attack on the electric power 5G network according to the comparison result; The preset classification threshold is expressed by the following formula: Where K is the preset classification threshold; E is the classification weight factor, which determines the relative importance of Precision and Recall (usually E=1, i.e., F1 score); Precision and Recall are the first and second prediction accuracy rates, respectively, that is, the proportion of predictions classified as attacks that are actually attacks, and the proportion of data that are successfully predicted as attacks in the actual attack data.

[0049] Specifically, the present invention uses the Softmax function to map high-dimensional traffic features into category probabilities, and completes classification decisions based on a preset classification threshold: first, the high-dimensional traffic features are normalized using the Softmax function to convert the output of the model into a probability value in the range of [0,1], and to ensure that the sum of all category probabilities is 1, thereby facilitating threshold judgment; then, based on the probability value output by Softmax, it is determined whether there is abnormal behavior or attack. If the output result exceeds the preset classification threshold, it is determined that the original input data contains attack behavior of this category; otherwise, it is determined that there is no abnormal behavior.

[0050] The present invention maps deep features into probability distribution by introducing the Softmax function and combines it with threshold judgment to achieve accurate classification and prediction of network attack behaviors, ensuring the efficiency and reliability of the model in complex network environments, and meeting the needs of efficient and accurate network attack prediction in complex dynamic environments.

[0051] In the embodiment of the present application, based on the problem of how to improve the prediction accuracy of 5G network traffic attacks on electric power, a 5G network traffic attack prediction method is designed. The method converts the network attack type into a high-quality vector representation through standardization processing combined with dynamic weighted One-hot encoding technology, significantly improving the model's ability to focus on different types of attack behaviors, avoiding the neglect of rare attack behaviors, and providing more accurate input data for subsequent feature extraction and classification; a multi-scale convolutional neural network is used to extract local and global features, and an attention-optimized LSTM model is proposed to capture contextual associations and dynamic nonlinear features in time series, which greatly improves the feature modeling ability and recognition accuracy of complex network traffic data; in the feature processing stage, a deep neural network integrating residual network and adaptive dynamic Dropout mechanism is proposed, which reduces the risk of overfitting by optimizing the high-order feature modeling process, and enhances the classification and generalization ability of new network attack behaviors; combined with the Softmax classification mechanism and the dynamic threshold adjustment strategy, the present invention realizes the probability distribution mapping and real-time classification judgment of network attack behaviors, meeting the needs of efficient and accurate network attack prediction in complex dynamic environments.

[0052] It should be noted that although the steps in the above flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders.

[0053] In another embodiment, if Figure 4 As shown, the second aspect of the present invention provides a power 5G network traffic attack prediction system, comprising: The data preprocessing module 10 is used to obtain multi-dimensional flow data of the power 5G network, and standardize the multi-dimensional flow data through weighted one-hot coding to obtain a standardized flow matrix; A feature extraction module 20 is used to extract features from the standardized traffic matrix based on a multi-scale convolutional neural network model and a long short-term memory network model that introduces an attention mechanism to obtain comprehensive traffic features; The feature processing module 30 is used to process the comprehensive traffic features according to the improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network that integrates a residual network and an adaptive dynamic Dropout; The classification prediction module 40 is used to perform probability mapping on the high-dimensional traffic features through an activation function to obtain a traffic attack prediction result for the power 5G network.

[0054] It should be noted that each module in the above-mentioned power 5G network traffic attack prediction system can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. For the specific definition of a power 5G network traffic attack prediction system, please refer to the definition of a power 5G network traffic attack prediction method above. The two have the same functions and effects, which will not be repeated here.

[0055] A third aspect of the present invention provides an electronic device, the electronic device comprising: processor, memory, and bus; The bus is used to connect the processor and the memory; The memory is used to store operation instructions; The processor is used to call the operation instruction, and the executable instruction enables the processor to perform operations corresponding to a method for predicting electric power 5G network traffic attack as shown in the first aspect of the present application.

[0056] In an alternative embodiment, an electronic device is provided, such as Figure 5 As shown, Figure 5 The electronic device 5000 shown includes: a processor 5001 and a memory 5003. The processor 5001 and the memory 5003 are connected, such as through a bus 5002. Optionally, the electronic device 5000 may also include a transceiver 5004. It should be noted that in actual applications, the transceiver 5004 is not limited to one, and the structure of the electronic device 5000 does not constitute a limitation on the embodiments of the present application.

[0057] Processor 5001 may be a CPU, a general-purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 5001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0058] The bus 5002 may include a path to transmit information between the above components. The bus 5002 may be a PCI bus or an EISA bus, etc. The bus 5002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0059] The memory 5003 may be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compressed optical disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0060] The memory 5003 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 5001. The processor 5001 is used to execute the application code stored in the memory 5003 to implement the content shown in any of the above method embodiments.

[0061] Among them, electronic devices include but are not limited to: mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc.

[0062] The fourth aspect of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, a method for predicting electric power 5G network traffic attacks shown in the first aspect of the present application is implemented.

[0063] Another embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0064] In addition, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the above method are implemented.

[0065] In summary, the present invention relates to the field of information technology, and discloses a method, system, device and medium for predicting traffic attacks on a power 5G network. The method includes obtaining multidimensional traffic data of the power 5G network, and standardizing the multidimensional traffic data through weighted One-hot encoding to obtain a standardized traffic matrix; extracting features from the standardized traffic matrix based on a multi-scale convolutional neural network model and a long short-term memory network model that introduces an attention mechanism to obtain comprehensive traffic features; processing the comprehensive traffic features according to an improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network that integrates a residual network and an adaptive dynamic Dropout; probability mapping of the high-dimensional traffic features is performed through an activation function to obtain a traffic attack prediction result for the power 5G network, so as to effectively predict the network traffic attack situation and provide more efficient and accurate security protection for the power 5G communication network.

[0066] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0067] The above-mentioned embodiments only express several preferred implementation modes of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in the technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention, and these improvements and substitutions should also be regarded as the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be based on the protection scope of the claims.

Claims

1. A method for predicting power 5G network traffic attacks, characterized in that: include: Acquire multidimensional traffic data of the electric power 5G network, and standardize the multidimensional traffic data through weighted one-hot coding to obtain a standardized traffic matrix; Based on a multi-scale convolutional neural network model and a long short-term memory network model with an attention mechanism, feature extraction is performed on the standardized traffic matrix to obtain comprehensive traffic features; The comprehensive traffic features are processed according to the improved deep neural network model to obtain high-dimensional traffic features; The improved deep neural network model is a deep neural network that integrates residual network and adaptive dynamic Dropout; The high-dimensional traffic features are probability mapped through an activation function to obtain a traffic attack prediction result for the power 5G network.

2. A method for predicting power 5G network traffic attacks according to claim 1, characterized in that: The multi-dimensional traffic data is standardized by weighted One-hot encoding to obtain a standardized traffic matrix, including: The multidimensional traffic data is coded to obtain a coded traffic matrix, and the coded traffic matrix is ​​standardized by using a standardization model based on mean absolute deviation to obtain a standard coded traffic matrix; The standard coded traffic matrix is ​​encoded by the weighted one-hot encoding to obtain a standardized traffic matrix.

3. A method for predicting power 5G network traffic attacks according to claim 2, characterized in that: The standardized model is expressed by the following formula: In the formula, , are the values ​​of the i-th feature in the j-th record in the standard coded traffic matrix before and after normalization, respectively; is the mean of the i-th feature; is the mean absolute deviation of the i-th feature; n is the total number of features; The weighted One-hot encoding is expressed by the following formula: Where Y is the weighted One-hot encoding matrix; is the weight corresponding to the i-th attack type; , is the weight adjustment factor; is the frequency of the i-th attack type in the historical multi-dimensional traffic data; , are the new and old severity of the i-th attack type, respectively; is the learning rate; is the real-time impact assessment value of the i-th attack type.

4. A method for predicting electric power 5G network traffic attack according to claim 1, characterized in that: The multi-scale convolutional neural network model and the long short-term memory network model with the attention mechanism are used to extract features from the standardized traffic matrix to obtain comprehensive traffic features, including: Extracting features from the standardized traffic matrix through the convolution kernel of the multi-scale convolutional neural network model to obtain key features, and processing the key features through an activation function to reduce the dimension of the processing results by using a global average pooling operation to generate a preliminary feature matrix; Using a long short-term memory network model that introduces attention weights to perform time series modeling on the preliminary feature matrix to obtain a time series feature matrix; The preliminary feature matrix and the time series feature matrix are concatenated and fused to obtain comprehensive traffic features.

5. A method for predicting electric power 5G network traffic attack according to claim 1, characterized in that: The improved deep neural network model includes a first fully connected layer, a second fully connected layer, a third fully connected layer, a residual layer, a first hidden layer, a second hidden layer and a third hidden layer; wherein, The comprehensive traffic features are processed according to the improved deep neural network model to obtain high-dimensional traffic features, including: Taking the comprehensive flow feature as an input feature, after connection through the residual layer, weighted calculation and mapping processing are performed on the comprehensive flow feature through the first fully connected layer to obtain a first layer feature to apply adaptive dynamic Dropout, generate a first flow feature and output it through the first hidden layer; Taking the first flow feature as an input feature, after being connected through the residual layer, performing weighted calculation and mapping processing on the first flow feature through the second fully connected layer, obtaining a second layer feature to apply adaptive dynamic Dropout, generating a second flow feature and outputting it through the second hidden layer; The second flow feature is taken as an input feature, and after being connected through the residual layer, the second flow feature is weighted calculated and mapped through the third fully connected layer to obtain a third layer feature to apply adaptive dynamic Dropout, generate a high-dimensional flow feature and output it through the third hidden layer.

6. A method for predicting electric power 5G network traffic attack according to claim 5, characterized in that: The output of each hidden layer is expressed as follows: In the formula, is the output feature of the uth hidden layer; is a random mask matrix; is the u-th layer feature; is the output probability of the uth fully connected layer; a1 and a2 are hyperparameters; , are the anti-fitting feature probability and anti-sparse feature probability of the u-th fully connected layer respectively; is the weight gradient of the u-th fully connected layer; Var() is the variance of the gradient change; Mean() is the gradient mean; is the smoothing factor; is the i-th feature of the u-th fully connected layer; is the indicator function; N is the total number of features.

7. A method for predicting electric power 5G network traffic attack according to claim 1, characterized in that: The probability mapping of the high-dimensional traffic features by the activation function to obtain the traffic attack prediction result of the power 5G network includes: The Softmax function is used to perform probability mapping on the high-dimensional traffic features to obtain classification probability; Compare the classification probability with a preset classification threshold, and determine a prediction result of a traffic attack on the electric power 5G network according to the comparison result; The preset classification threshold is expressed by the following formula: In the formula, K is the preset classification threshold; E is the classification weight factor; Precision and Recall are the first and second prediction accuracy rates respectively.

8. A power 5G network traffic attack prediction system, characterized in that: include: A data preprocessing module is used to obtain multi-dimensional flow data of the power 5G network, and standardize the multi-dimensional flow data through weighted one-hot coding to obtain a standardized flow matrix; A feature extraction module, used for extracting features from the standardized traffic matrix based on a multi-scale convolutional neural network model and a long short-term memory network model introducing an attention mechanism, to obtain comprehensive traffic features; A feature processing module, used for processing the comprehensive traffic features according to an improved deep neural network model to obtain high-dimensional traffic features; the improved deep neural network model is a deep neural network that integrates a residual network and an adaptive dynamic Dropout; The classification prediction module is used to perform probability mapping on the high-dimensional traffic features through an activation function to obtain a traffic attack prediction result for the power 5G network.

9. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the power 5G network traffic attack prediction method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the device where the computer-readable storage medium is located executes the computer program, the power 5G network traffic attack prediction method as described in any one of claims 1 to 7 is implemented.

Images