A malicious traffic detection method, system, device and storage medium for a distributed new energy station

Abstract

The application discloses a malicious traffic detection method, system and device for a distributed new energy station and a storage medium. The method comprises the following steps: acquiring network traffic data, marking part of the data as normal or malicious traffic, and identifying different sessions or flows through protocol analysis; based on the identified sessions or flows, extracting byte-level features and packet-level features based on a first time window, and extracting flow-level features based on a second time window; constructing a total feature sequence, each feature item in the sequence being randomly masked, pre-training a detection model by using an encoder module of a Transformer model, a mask reconstruction and malicious traffic prediction double-task training strategy, and deploying the fine-tuned detection model to the network of the distributed new energy station to detect malicious traffic in real time. The application can capture feature information in traffic at multiple levels and detect long-term network attacks or latent malicious activities.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of malicious traffic detection, in particular to a malicious traffic detection method, system and device for distributed new energy stations and a storage medium. BACKGROUND

[0002] With the rapid development of distributed new energy technology, more and more new energy stations and intelligent devices are connected through smart grids and Internet of Things worldwide, forming a complex distributed energy management network. Devices such as wind energy, solar energy and energy storage systems communicate through networks to achieve automated operation and energy scheduling. However, the surge in data traffic brought about by device networking also poses serious network security challenges to distributed new energy stations, especially the threat of malicious traffic attacks.

[0003] Devices in distributed new energy stations, such as sensors, inverters, and control terminals, transmit critical data such as device status and control instructions through networks. These devices, due to their dispersed locations and diverse types, become targets of network attacks such as data tampering, DDoS attacks, and traffic poisoning. If these malicious traffic is not effectively detected and handled, it may cause device failure, energy scheduling interruption, and even trigger large-scale energy crises.

[0004] In recent years, to address these threats, machine learning-based malicious traffic detection technology has been introduced into distributed new energy stations. These technologies can automatically analyze traffic characteristics and identify potential malicious traffic patterns. However, current data methods only focus on information in a single time series, missing overall state information, leading to increased false negatives and false positives, difficulty in identifying advanced persistent threats (APTs), and affecting risk assessment and early warning. SUMMARY

[0005] The purpose of this section is to summarize some aspects of the embodiments of the present application and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract and title of the specification to avoid obscuring the purpose of this section, abstract and title, and such simplifications or omissions cannot be used to limit the scope of the present application.

[0006] In view of the problems existing in the prior art, the present application is proposed. The present application provides a malicious traffic detection method, system, device and storage medium for distributed new energy stations, which combines features of different time scales and traffic levels to improve the effectiveness of malicious traffic detection.

[0007] To solve the above technical problems, the present application provides the following technical solutions:

[0008] In a first aspect, a malicious traffic detection method for distributed new energy stations is provided, the method comprising the following steps:

[0009] Obtain network traffic data of various devices in the distributed new energy station under the experimental environment, mark part of the data as normal traffic or malicious traffic according to the experimental environment, the rest of the data is not marked, and all the obtained network traffic data is protocol parsed, and different sessions or flows are identified according to the five-tuple information;

[0010] According to the identified session or flow, the byte-level feature and the packet-level feature are extracted based on the first time window, and the flow-level feature is extracted based on the second time window, wherein the second time window is greater than the first time window, a prefix token is added before the extracted features of each level, which is used to identify whether the feature source is byte-level, packet-level or flow-level, a suffix token is added at the end of the flow-level feature, which is used to represent the end of the feature sequence, and the features of each level are combined to form a total feature sequence;

[0011] According to the total feature sequence, a position code is added to each feature item, the total feature sequence and the position code are mapped to a high-dimensional vector space through an embedding layer, the mapped high-dimensional vector is input into the encoder module of the Transformer model, and the detection model is pre-trained through the mask reconstruction and malicious traffic prediction double-task training strategy;

[0012] The prediction result generated by the detection model on the unmarked data is used as a pseudo label, the pseudo label and the real labeled data are combined to form pseudo labeled data through an iterative method, the detection model pre-trained is fine-tuned using the pseudo labeled data, and the fine-tuned detection model is deployed in the network of the distributed new energy station to detect malicious traffic in real time.

[0013] According to some embodiments of the first aspect, the byte-level feature and the packet-level feature are extracted based on the first time window, and the flow-level feature is extracted based on the second time window, comprising:

[0014] In the first time window, the first N bytes of each data packet constituting the session or flow are extracted to form a byte-level feature, denoted as S byte =[byte1, byte2, …, byte i , …, byte N ], wherein byte i represents the first N bytes of the i-th data packet;

[0015] The average length avg_length, the maximum length max_length, the average time interval avg_interval1 between data packets, and the total number of data packets total_packets1 of the data packets constituting the session in the first time window are counted to form a packet-level feature, denoted as: S packet= [avg_length, max_length, avg_interval1, total_packets1] ;

[0016] In the second time window, the duration of the flow is obtained, and the total number of data packets total_packets2, the total number of bytes total_bytes, the average time interval between data packets avg_interval2, the average length of data packets avg_packet_length in the flow are counted, the transmission direction direction of the flow is obtained, and a flow-level feature sequence is formed, which is represented as:

[0017] S flow =

[0018] [duration, total_packets2, avg_interval2, total_bytes, avg_packet_length, direction].

[0019] According to some embodiments of the first aspect, the mask reconstruction and malicious traffic prediction dual-task training strategy is specifically as follows:

[0020] Let the reconstruction output of the detection model for the masked part be represented as , where f θ is the model with parameters θ, X masked is the masked feature, and the mean square error is used to measure the reconstruction quality L rec of the model in combination with the feature true value.

[0021] The labeled data set D labeled is used for malicious traffic prediction, and each sample x∈D labeled is labeled as y∈{0, 1}, where 1 represents malicious traffic and 0 represents normal traffic, and the output of the model is the prediction probability of malicious traffic where f θ (x) is the output of the model for the sample x, indicating the probability that the traffic is malicious, and the cross-entropy loss function is used to calculate the classification loss L pred of the malicious traffic prediction in combination with the true label of the sample.

[0022] The losses of the two tasks are combined to form the total loss function: L total = αL rec + βL pred , where α and β are weight coefficients for controlling the relative importance of the tasks, and the pre-training is continuously carried out based on the total loss function until the stop condition is met, and the pre-trained model is obtained.

[0023] According to certain embodiments of the first aspect, in the mask reconstruction task, each feature item in the input sequence is randomly masked, and the masking method is as follows:

[0024] Let X = [x1, x2,..., x i ,...,x n ] represent the total feature sequence, where x i is a byte-level, packet-level or flow-level feature, and a part of the features are randomly selected for masking, and the masked features are represented as: X masked =M(X), where M is a random mask matrix. According to certain embodiments of the first aspect, in the malicious traffic prediction task, the input features are encoded by a Transformer encoder, and then a fully connected layer and a Sigmoid activation function are used to generate the prediction probability of malicious traffic, and the output is the prediction probability of each sample

[0025] According to certain embodiments of the first aspect, the trained detection model is fine-tuned using pseudo-labeled data, including:

[0026] Let the unlabeled data set be D unlabeled , and use the pre-trained model to predict the unlabeled sample x l ∈D unlabeled , and generate the prediction probability where f θ represents the model with parameters θ;

[0027] Combined with the confidence threshold τ, the pseudo label is generated according to the prediction probability Combine the pseudo-labeled data with the labeled data D combined , and use the merged data set D combined to train the model again and optimize the model parameters: where after each round of training, the pseudo label is regenerated, the model is updated and the training is repeated.

[0028] According to certain embodiments of the first aspect, the fine-tuned detection model is deployed in the network of distributed new energy stations, including:

[0029] Deploy a lightweight model on the edge device of the station for real-time traffic detection, and upload the detection results or suspected malicious traffic data to the central control platform for comprehensive analysis; wherein,

[0030] Edge device deployment: use an edge device with AI inference capability to run a lightweight model inference service on the edge device, use Flask to provide an HTTP interface, and data streams are transmitted to the inference service in real time through the interface;

[0031] Central control platform deployment: edge device detection results are uploaded to the central control platform through a secure protocol, the platform aggregates data from multiple sites, conducts global analysis and alarm.

[0032] According to some embodiments of the first aspect, the method further comprises: collecting new traffic data periodically evaluating, updating and optimizing the deployed model, as follows:

[0033] By collecting new traffic data in real time and cleaning and labeling, periodically retraining or fine-tuning the model to adapt to the latest traffic characteristics;

[0034] Establish an automated update pipeline and rollback mechanism to quickly restore the old version when problems are found;

[0035] Evaluate in terms of inference speed, resource utilization and detection accuracy, focusing on false positive rate, false negative rate and data distribution drift, and adjust the model training strategy according to the evaluation results.

[0036] The second aspect provides a malicious traffic detection system for distributed new energy stations, comprising:

[0037] A data acquisition and preprocessing module is configured to obtain network traffic data of various devices in the distributed new energy station under experimental environment, mark part of the data as normal traffic or malicious traffic according to the experimental environment, and leave the rest of the data unmarked, and perform protocol analysis on all the obtained network traffic data, and identify different sessions or flows based on five-tuple information;

[0038] A traffic feature extraction module is configured to extract byte-level features and packet-level features based on a first time window according to the identified sessions or flows, extract flow-level features based on a second time window, wherein the second time window is larger than the first time window, add a prefix token in front of each level of features to identify whether the feature source is byte-level, packet-level or flow-level, add a suffix token at the end of the flow-level features to indicate the end of the feature sequence, and combine the features at each level to form a total feature sequence;

[0039] A detection model pre-training module is configured to add position encoding to each feature item based on the total feature sequence, map the total feature sequence and the position encoding to a high-dimensional vector space through an embedding layer, input the mapped high-dimensional vector to an encoder module of a Transformer model, and pre-train the detection model through a mask reconstruction and malicious traffic prediction dual-task training strategy.

[0040] The model fine-tuning and application module is used to use the prediction results generated by the detection model on unlabeled data as pseudo-labels. The pseudo-labels are combined with real labeled data through an iterative process to form pseudo-labeled data. The pre-trained detection model is fine-tuned using the pseudo-labeled data, and the fine-tuned detection model is deployed to the network of distributed new energy power stations to detect malicious traffic in real time.

[0041] According to certain implementations of the second aspect, byte-level features and group-level features are extracted based on a first time window, and stream-level features are extracted based on a second time window, including:

[0042] Within the first time window, extract the first N bytes of each data packet constituting the session or stream to form a byte-level feature, denoted as S. byte = [byte1, byte2, ..., byte] i ,...,byte N ], where byte i This represents the first N bytes of the i-th data group;

[0043] The average length (avg_length), maximum length (max_length), average time interval (avg_interval1) between data packets constituting the session within the first time window, and total number of data packets (total_packets1) are statistically analyzed to form a packet-level feature, denoted as: S packet =[avg_length,max_length,avg_interval1,total_packets1];

[0044] Within the second time window, the duration of the stream is obtained, and the total number of data packets (total_packets2), total number of bytes (total_bytes), average time interval between data packets (avg_interval2), and average length of data packets (avg_packet_length) are counted. The transmission direction of the stream is identified, forming a stream-level feature sequence, represented as follows:

[0045] S flow =

[0046] [duration,total_packets2,avg_interval2,total_bytes,avg_packet_length,direction].

[0047] According to certain implementations of the second aspect, each feature in the sequence is randomly masked, including:

[0048] Randomly select a feature item in the sequence at a specified probability, replace the selected feature item with a given mask at a specified probability, or replace it with other feature items, or keep it unchanged, and the mask operation is represented as follows:

[0049] Let X = [x1, x2,..., x i ,...,x n ] represent the total feature sequence, where x i is a byte-level, packet-level or flow-level feature, and randomly select part of the features for masking, and the masked features are represented as X masked = M(X), where M is a random mask matrix.

[0050] According to some embodiments of the second aspect, the mask reconstruction and malicious traffic prediction dual-task training strategy is specifically as follows:

[0051] Let represent the reconstruction output of the detection model for the masked part, where f θ is the model with parameters θ, X masked is the masked feature, and the reconstruction quality of the model is measured using the mean square error L rec combined with the true value of the feature.

[0052] Use the labeled data set D labeled to perform malicious traffic prediction, and each sample x ∈ D labeled is labeled as y ∈ {0, 1}, where 1 represents malicious traffic and 0 represents normal traffic, and the output of the model is the prediction probability of malicious traffic where f θ (x) is the output of the model for sample x, representing the probability that the traffic is malicious, and the classification loss L pred of malicious traffic prediction is calculated using the cross-entropy loss function combined with the original label.

[0053] Combine the losses of the two tasks to form the total loss function: L total = αL rec + βL pred , where α and β are weight coefficients for controlling the relative importance of the tasks, and the pre-training is continuously performed based on the total loss function until the stopping condition is met, and the pre-trained model is obtained.

[0054] According to some embodiments of the second aspect, the trained detection model is fine-tuned using pseudo-labeled data, including:

[0055] Let the unlabeled data set be D unlabeled , and use the pre-trained model to predict the unlabeled sample x i ∈ D unlabeled to generate the prediction probability where f θ represents a model with parameter θ;

[0056] In combination with the confidence threshold τ, pseudo labels are generated according to the prediction probability Combine pseudo label data with labeled data D combined , use the merged dataset D combined Train the model again, optimize the model parameters: where after each round of training, the pseudo labels are regenerated, the model is updated and the training is repeated.

[0057] According to some embodiments of the second aspect, the fine-tuned detection model is deployed to a network of distributed new energy stations, wherein the edge devices of the stations deploy lightweight models for real-time traffic detection, and the detection results or suspected malicious traffic data are uploaded to a central control platform for comprehensive analysis; the edge devices use edge devices with AI inference capabilities to run lightweight model inference services, and use Flask to provide HTTP interfaces, and data streams are transmitted to the inference services in real time through the interfaces; the detection results of the edge devices are uploaded to the central control platform through a secure protocol, and the platform aggregates data from multiple stations for global analysis and alarm.

[0058] According to some embodiments of the second aspect, the system further comprises a model maintenance module for collecting new traffic data to periodically evaluate, update and optimize the deployed model, specifically including:

[0059] A periodic update unit for periodically retraining or fine-tuning the model by collecting new traffic data in real time and cleaning and labeling it, so that it adapts to the latest traffic characteristics;

[0060] A rollback setting unit for establishing an automated update pipeline and rollback mechanism to quickly restore the old version when problems are found;

[0061] A performance evaluation unit for evaluating inference speed, resource utilization and detection accuracy, with a focus on false positive rate, false negative rate and data distribution drift, and adjusting the model training strategy according to the evaluation results.

[0062] In a third aspect, a computer device is provided, the device comprising one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs are executed by the processors to implement the steps of the malicious traffic detection method for distributed new energy stations as described in the first aspect of the application.

[0063] In a fourth aspect, a computer storage medium is provided, and the computer storage medium stores a computer program. When the computer program is executed by a processor, the steps of the malicious traffic detection method for a distributed new energy station are implemented.

[0064] Compared with the prior art, the present application has the following advantages:

[0065] (1) The present application uses multi-scale fusion technology to analyze the traffic characteristics at the byte level, packet level, and flow level in different time windows, which can accurately capture abnormal behavior from fine-grained to global traffic, thereby improving the accuracy and real-time performance of malicious traffic detection and adapting to diverse attack patterns.

[0066] (2) The present application is particularly suitable for the complex network environment of a distributed new energy station. It makes full use of the diverse traffic data in the station and combines multi-scale fusion technology for hierarchical analysis, which can effectively deal with various attacks from different devices and regions and ensure the stable operation of the new energy station.

[0067] (3) For the specific environment of a distributed new energy station, a suitable model deployment, maintenance, and upgrade scheme is proposed, which can maintain a high level of security protection capability for the distributed station in a changing network environment. BRIEF DESCRIPTION OF DRAWINGS

[0068] Figure 1 is a general flowchart of the method of the present application;

[0069] Figure 2 is a pre-trained model diagram in the method of the present application. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0071] Embodiment One

[0072] The present embodiment provides a malicious traffic detection method for a distributed new energy station, which is described with reference to Figure 1 The method mainly includes the following steps:

[0073] Step S1: Collect network traffic data from the measurement and control terminal, sensors, inverters, and other devices of the distributed new energy station. Since the types of devices in the distributed station are diverse, the traffic data covers different communication protocols and data formats. According to the source of the traffic, the function of the device, and its behavior, the data is labeled as "normal" or "malicious", providing labeled samples for subsequent model training.

[0074] In this embodiment, the following types of network traffic data are collected during the data collection process:

[0075] Normal traffic: Collect data of normal communication of devices, including sensor to control center, state synchronization between devices, data update and other traffic.

[0076] Malicious traffic: Through security testing or attack simulation (such as DoS attack, data tampering, etc.), capture network traffic under malicious behavior.

[0077] Unlabeled traffic: A large amount of normal traffic and potential malicious traffic is not labeled. This data will be used in self-supervised pre-training and pseudo-label iteration.

[0078] Data labeling, through known malicious traffic samples and attack simulation means to label these data. That is, part of the collected and captured data is labeled as normal traffic or malicious traffic, and the rest of the data is not labeled.

[0079] Step S2, data preprocessing: Preprocess the collected network traffic data, remove redundant data and parse protocols. Based on source IP, destination IP, port number and other information, divide the data into different sessions or flows, ensure the integrity and timing of the data. Ensure that the data structure processed by the model is reasonable and can reflect the actual traffic characteristics.

[0080] In this embodiment, the data preprocessing of step S2 is as follows:

[0081] Redundant data removal: Preliminary cleaning of the captured network traffic, removing invalid packets, duplicate packets and empty packets. By comparing the source IP, destination IP, port number, protocol type and timestamp of the data packet, identify and delete duplicate network packets, ensure that the data for subsequent processing is independent and valid network communication information.

[0082] Protocol analysis: Protocol analysis of the cleaned traffic data. According to different network transmission protocols (such as TCP, UDP, HTTP, etc.), parse the protocol header information and payload content of the data packet.

[0083] Data packets are the basic units of a session or flow, which is a logical unit that aggregates data packets together by certain rules (such as the five-tuple: source IP, destination IP, source port, destination port, protocol type). A session usually represents a complete process of bidirectional communication, while a flow usually represents a continuous data transmission in a single direction. Within a specified time window, data packets in the traffic are divided according to the rules of sessions or flows. Specifically, all data packet sets belonging to the same session or flow are determined based on five-tuple information. For the division of sessions and flows: first, the network traffic is divided based on the five-tuple (source IP, destination IP, source port, destination port, protocol type), and data packets in the same session have the same five-tuple information, ensuring that they belong to the same communication link. Second, the division is based on time: for long sessions, further division into multiple traffic segments is performed based on a given time window to capture changes in traffic in the time dimension.

[0084] Step S3, constructing a multi-level sequence: combining features of different levels to form a multi-level sequence. By combining byte-level (protocol header information, specific byte sequence), packet-level (also known as packet-level, which is the overall features of each data packet), and flow-level (global communication behavior) features, a comprehensive sequence representation is constructed. This multi-level structure can reflect the complex communication patterns of devices in distributed new energy stations and adapt to data transmission behavior in various network environments.

[0085] In this embodiment, the step S3 of constructing a multi-level sequence specifically includes:

[0086] Defining a time window:

[0087] First time window (applicable to byte-level and packet-level): usually used to capture bursty traffic characteristics in a short time, suitable for detecting short-term attack behavior such as rapid scanning, packet replay, etc., also known as a short time window, for example, 1 second or a few hundred milliseconds.

[0088] Second time window (applicable to flow-level): used to detect long-term, continuous traffic behavior such as DDoS attacks, continuous data leakage, etc., also known as a long time window, for example, 5 minutes, 10 minutes, or longer.

[0089] Byte-level feature extraction: within a set first time window (e.g., 1 second or a few hundred milliseconds), the first N bytes (e.g., the first 40 bytes) of each data packet are extracted, with N bytes extracted each time represented as byte, forming a byte-level feature sequence:

[0090] S byte = [byte1, byte2,..., byte i ,..., byte N ]

[0091] where byte i represents the first N bytes of the ith data packet, and subscript i denotes the ith data packet.

[0092] Packet-level feature extraction: Similarly in the first time window, packet-level features are extracted, and by extracting statistical quantities, the model can more efficiently handle traffic behavior in different time windows. In this embodiment, statistical information about the length, number, and interval of packets is extracted to form a packet-level feature sequence:

[0093] S packet = [avg_length, max_length, avg_interval1, total_packets1]

[0094] where avg_length denotes the average packet length in the time window. max_length denotes the maximum packet length in the time window. avg_interval1 denotes the average time interval between packets. total_packets1 denotes the total number of packets in the time window.

[0095] Flow-level data processing: In the second time window (e.g., 5 minutes, 10 minutes, or longer), flow-level features are extracted to describe the global communication pattern in a period of time. Flow-level features are used to capture long-term traffic behavior, such as persistent data leakage or botnet behavior.

[0096] In this embodiment, global features of each flow are extracted, such as flow duration, total packet number, total byte number, average packet interval, etc., to form a flow-level feature sequence:

[0097] S flow = [duration, total_packets2, avg_interval2, total_bytes, avg_packet_length, direction]

[0098] where duration represents the duration of the flow. total_packets2 represents the total number of packets in the flow. total_bytes represents the total number of bytes in the flow. avg_interval2 represents the average time interval between packets. direction represents the transmission direction of the flow (inbound or outbound). It should be understood that in the packet-level features, total_packets1 refers to the total number of packets within a certain time window. While in the flow-level features, total_packets2 represents the number of all packets within the flow. Their meanings are the same, but the granularity is different: packet-level features focus on the number of packets within a short time window, while flow-level features focus on the number of packets within the entire flow. Similarly, avg_interval1 represents the average time interval between packets within a short time window, and avg_interval2 represents the average time interval between packets within the flow.

[0099] As an example, assume there is a network traffic dataset containing multiple packets. Each packet has associated information such as timestamp, length, packet content, etc., as shown in Table 1.

[0100] Assume the time window is: short time window 1 second. Long time window 5 minutes.

[0101] Table 1 Network traffic packet information

[0102]

[0103] Extract the first 40 bytes from all packets within the 1st second. Assume the first 40 bytes of the first packet is Header_1, the first 40 bytes of the second packet is Header_2, and so on.

[0104] Within the 1-second time window, we extract statistical features of all packets. Calculate the average length of packets per second (avg_length), the maximum length (max_length), the average time interval between packets (avg_interval), and the total number of packets (total_packets). Assume within the 0.1-second to 1-second time window, the number of packets is 3.

[0105] avg_length = (1500 + 2000 + 1200) / 3 = 1666.67 bytes

[0106] max_length = max(1500, 2000, 1200) = 2000 bytes

[0107] avg_interval = (0.4 + 0.2) / 2 = 0.3 seconds

[0108] total_packets = 3 packets

[0109] In the 5-minute time window, we extract the global features of each flow. Assume that in the 5-minute time window, there is a flow containing packet 4 to packet 6. Calculate the total number of packets (total_packets), the total number of bytes (total_bytes), the duration of the flow (duration), the average interval between packets (avg_interval), and the direction of the flow (direction).

[0110] duration = 5 minutes = 300 seconds

[0111] total_packets = 3 packets (packet 4 to packet 6)

[0112] total_bytes = 1400 + 2200 + 1800 = 5400 bytes

[0113] avg_interval = (0.5 + 0.5) / 2 = 0.5 seconds

[0114] direction = inbound

[0115] Step S4, using a token embedding method, embedding byte-level, packet-level, and flow-level features into multi-level sequences, so that the Transformer model can process multiple granular network traffic features at the same time, enhancing its traffic analysis capabilities in complex environments of distributed new energy stations.

[0116] In this embodiment, the token embedding method in step S4 specifically includes:

[0117] (1) Design corresponding tokens for each level of features:

[0118] [BYTE]: represents the identifier of byte-level features.

[0119] [PACKET]: represents the identifier of packet-level features.

[0120] [FLOW]: represents the identifier of flow-level features.

[0121] Then add tokens to the features, add the corresponding tokens as prefixes before each level of feature vectors to identify the source of the features, and add the token [PAD] after the flow-level sequence to indicate the end of the entire sequence.

[0122] Byte-level sequence: [BYTE, byte1, byte2,..., byte N ]

[0123] Packet-level sequence: [PACKET, avg_length, max_length,, avg_interval, total_packets]

[0124] Flow-level sequence: [FLOW, duration, total_packets, total_bytes, avg_interval, direction, PAD]

[0125] Note that multiple feature sequences are generated within each time window, and the exact number depends on the number of packets processed and their duration within the time window.

[0126] (2) Embedding layer processing: Map discrete input features (e.g., [BYTE], [PACKET], [FLOW], and specific feature values) to a high-dimensional vector space. Mapping is done through an embedding matrix, generating an embedding vector for each input feature x i i corresponding to a high-dimensional vector. An embedding matrix of shape (N, D) is generated.

[0127]

[0128] Embedding vector for the i-th feature.

[0129] E: Embedding matrix, V is the size of the vocabulary, and D is the embedding dimension.

[0130] (3) Add positional encoding: Add positional encoding to each feature to preserve temporal information.

[0131] Introduce position information for each feature in the sequence, assigning an embedding vector to each position. Positional encoding is generated based on sine and cosine functions. Output a matrix of the same shape as the embedding matrix, providing position information.

[0132] 1. Learnable position embeddings:

[0133]

[0134] P: Learnable position embedding matrix.

[0135] 2. Fixed positional encoding (based on sine and cosine functions):

[0136]

[0137] pos: Sequence position.

[0138] i: Index of embedding dimension.

[0139] (4) Combine the feature values and position information to generate the final embedding representation. Element-wise add the feature embedding and the position encoding matrix. The shape of the resulting matrix is (N, D), which is used as input to the Transformer encoder. Add the token embedding z i and the position encoding p i to get the final embedding vector:

[0140]

[0141] h i : high-dimensional vector of the i-th feature, combining feature content and position information.

[0142] Combine the embedding vectors of all sequence positions into a matrix H:

[0143]

[0144] H: output of the embedding layer, representing the high-dimensional representation of the entire sequence.

[0145] The embedded feature sequence will be input into the Transformer encoder to generate the hidden representation.

[0146] Step S5, self-supervised pre-training: In order to enable the model to be effectively pre-trained on unlabeled data while enhancing its ability to identify malicious traffic, a dual-task training strategy is adopted. Referring to Figure 2 , Masked reconstruction task: randomly mask part of the traffic features, and the model reconstructs the masked data based on the unmasked part to learn the basic patterns of traffic. Malicious traffic prediction task: based on part of the labeled data, classify the traffic, train the model to distinguish between normal traffic and malicious traffic, and improve its ability to identify malicious traffic.

[0147] In this embodiment, the step S5 specifically includes:

[0148] (1) For the masked reconstruction task:

[0149] Randomly select 15% of the tokens from all tokens in the input sequence to be masked. As a selected token, replace it with [MASK] with an 80% chance, or replace it with a random token, or leave it unchanged with a 10% chance. Let the model predict the masked token through the context information, so as to learn the internal relationship of the sequence.

[0150] For the input traffic feature sequence X = [x1, x2,..., x n ], where x i may be byte-level, packet-level or flow-level features, randomly select part of the features to be masked. Let M represent the masking operation, then the masked input is: X masked= M(X), where M is a random mask matrix, replacing a portion of the input features with a mask symbol [MASK].

[0151] The model learns and reconstructs the masked part through the unmasked features. The reconstruction output of the model is: where f θ is the model with parameters θ, is the reconstruction output of the model for the masked part.

[0152] The mean square error (MSE) is used to measure the reconstruction quality of the model. The mean square error loss function is:

[0153]

[0154] where Ω is the set of indices of the masked features, is the reconstruction value of the model, x i is the true value.

[0155] (2) For the malicious traffic prediction task:

[0156] After passing through the Transformer encoder, a fully connected layer and a Sigmoid activation function are used to generate the prediction probability of malicious traffic, and the output is the prediction probability of each sample

[0157] Use the labeled data D labeled to predict malicious traffic. Each sample x∈D labeled is labeled as y∈{0,1}, where 1 represents malicious traffic and 0 represents normal traffic, and y is the true label of the sample. The output of the model is the prediction probability of malicious traffic where f θ (x) is the output of the model, representing the probability that the traffic is malicious.

[0158] The cross-entropy loss function is used to calculate the classification loss of malicious traffic prediction:

[0159]

[0160] This loss is used to optimize the classification ability of the model, so that it can better distinguish between malicious traffic and normal traffic.

[0161] In order to optimize the mask reconstruction ability and malicious traffic detection ability of the model at the same time, a joint loss function is adopted, which combines the losses of the mask reconstruction task and the malicious traffic prediction task.

[0162] The losses of the two tasks are combined to form a total loss function. The weight coefficients α and β are used to balance the losses of the two tasks:

[0163] Ltotal = aL rec + bL pred

[0164] where L rec is the loss of mask reconstruction, L pred is the loss of malicious traffic prediction. a and b are weight coefficients to control the relative importance of each task. The mask reconstruction task helps the model learn the internal relationship and global pattern of sequence features. The malicious traffic prediction task strengthens the classification ability of the model, focusing on distinguishing malicious and normal traffic. When the total loss converges or reaches the set training target, the pre-training phase ends, and a model with comprehensive ability is obtained, providing a foundation for subsequent tasks.

[0165] Step S6, fine-tuning: based on the pre-trained model, further training is performed on unlabelled data through a pseudo-label mechanism. The prediction results generated by the model on unlabelled data are used as pseudo-labels, and these pseudo-labels are combined with real labelled data to expand the data set. Through the introduction of a pseudo-label iteration mechanism, the model gradually generates more pseudo-labelled data, and these data are used to retrain the model at different stages, ensuring that it has good adaptability when facing unknown or new malicious traffic.

[0166] In this embodiment, the step S6 specifically includes:

[0167] In the fine-tuning phase, the pseudo-label mechanism and the classification model retraining mechanism are combined to use data that has not been labelled as malicious traffic to further enhance the generalization ability of the model, as follows:

[0168] The labelled data set is denoted as D labeled = {(x i , y i )}, where y i e {0, 1} indicates that the sample x i is malicious traffic (1). The unlabelled data set is denoted as D unlabeled = {x i}, which is used to generate pseudo-labels.

[0169] Load the model that has been pre-trained through self-supervised learning The model has mastered the representation ability of basic traffic patterns. Initialize the model parameters θ = θ pretrained , i.e. the weights obtained through self-supervised learning training.

[0170] Use the pre-trained model to predict the unlabelled data D unlabeled to generate pseudo-labels. Specifically, predict the unlabelled sample x i e D unlabeled to generate prediction probability

[0171] Then, based on the set confidence threshold τ, pseudo labels are generated according to the prediction probabilities

[0172] The pseudo label data is then combined with the labeled data to form a merged dataset (i.e., pseudo-labeled data):

[0173] The merged dataset D is used to fine-tune the model combined The model is again trained by passing the data into the model to optimize the model parameters:

[0174] Wherein after each round of training, the pseudo labels are regenerated, the model is updated and the training is repeated.

[0175] Further, for the classification model retraining: using the expanded dataset D combined The model is trained. For each sample (x i ,y i ), the classification loss of the model output is calculated.

[0176] The classification loss function (cross-entropy loss) is calculated: The model parameters θ are updated by backpropagation.

[0177] As the number of iterations increases, the model is trained using the updated pseudo label data until the model performance reaches the expected target. After each iteration, the model performance is evaluated using the validation set, and the pseudo label generation threshold τ and the number of iterations are dynamically adjusted.

[0178] After fine-tuning is complete, the final model is saved for use in production environments for malicious traffic detection.

[0179] Step S7, after sufficient self-supervised pre-training and fine-tuning of the model, the model is deployed in the network environment of the distributed new energy station for real-time malicious traffic detection. Using the fused multi-scale features, the model can quickly and accurately identify various network attacks, including DDoS attacks, data tampering, scanning and data leakage, etc., to ensure the safe operation of the distributed station network.

[0180] In this embodiment, the step S7 specifically comprises:

[0181] The trained model is deployed in the network of distributed new energy stations. Due to the characteristics of distributed stations, each station operates independently, stations are interconnected through the network, and stations may contain different types of network equipment and computing resources. It is necessary to monitor the traffic of each station and timely detect malicious behavior. Optimization is performed on the deployment of this scenario, using edge detection + center analysis architecture: lightweight models are deployed on edge devices (such as routers, firewalls or local servers) in the station to perform real-time traffic detection. The detection results or suspected malicious traffic data are uploaded to the central control platform (cloud or main station server) for comprehensive analysis.

[0182] Edge device deployment: Use edge devices with AI inference capabilities (such as NVIDIA Jetson, Intel NUC). Run lightweight model inference services on edge devices. Use Flask to provide HTTP interfaces, and data streams are transmitted to inference services in real time through interfaces.

[0183] Central control platform deployment: Edge device detection results are uploaded to the central control platform through a secure protocol (such as MQTT or HTTPS). The platform aggregates data from multiple stations for global analysis and alarm.

[0184] Step S8, in order to ensure the continuous effectiveness of the model, the model is evaluated on the validation set regularly to evaluate the detection accuracy, recall rate and false positive rate of the model. The performance of the model is judged through the results of the validation set, and retraining and updating are performed as necessary to ensure that the model can effectively cope with new malicious traffic threats in distributed new energy stations.

[0185] In this embodiment, the step S8 specifically includes:

[0186] In the distributed new energy station, the subsequent maintenance of the deployed malicious traffic detection model is the key to ensuring the long-term stability, accuracy and adaptability of the system. Regularly evaluate the model by collecting new data.

[0187] The main evaluation indicators include: accuracy: the correct rate of detecting malicious traffic. Recall rate: the ability to identify malicious traffic. F1 score: comprehensive evaluation of model accuracy and recall rate.

[0188] When the detection recall rate is low, more real malicious traffic samples or synthetic traffic samples are collected to expand the training data, and the robustness of the model to false negatives is improved. If the traffic environment of the distributed new energy station changes significantly (such as new device access or new traffic pattern), new data needs to be replaced or merged into the validation set to ensure the authenticity and representativeness of the evaluation results.

[0189] By collecting new traffic data in real time and cleaning and labeling, the model can be periodically retrained or fine-tuned to ensure its adaptation to the latest traffic characteristics. At the same time, an automatic update pipeline and rollback mechanism are established to quickly restore the old version when problems are found, and an integrated automation pipeline for data collection, cleaning, labeling, training and deployment is established, using the CI / CD (Continuous Integration / Continuous Delivery) mechanism to realize the rapid online of the model. Second, performance monitoring needs to cover inference speed (monitoring the real-time performance of the model processing traffic to ensure that the delay meets the system requirements), resource utilization and detection accuracy, focusing on false positive rate, false negative rate and data distribution drift, by monitoring the statistical characteristics (such as distribution, mean and variance) of the input data to determine whether the data deviates from the distribution during model training. In the face of sudden abnormal traffic or detection errors, the system should have the ability to respond and troubleshoot quickly.

[0190] In the environment of distributed new energy station, network traffic has a complex multi-level structure, from byte-level fine-grained information to packet-level transmission characteristics, to flow-level global communication mode. Traditional single feature analysis method often fails to capture these different levels of feature changes. The present application uses multi-scale fusion technology to extract features at different time windows and traffic levels, and combines these multi-dimensional features together, which can more comprehensively capture the abnormal behavior of traffic. Combining different time scales and traffic level features can improve the effect of malicious traffic detection, because it can fully capture complex attack patterns, reduce false positives and missed detections, and enhance the adaptability and robustness of the detection system.

[0191] Embodiment two

[0192] The present embodiment provides a malicious traffic detection system for distributed new energy stations, comprising:

[0193] A data acquisition and preprocessing module is used to acquire network traffic data of various devices in the distributed new energy station under the experimental environment, mark part of the data as normal traffic or malicious traffic according to the experimental environment, and the remaining data is not marked, and all the acquired network traffic data is protocol parsed, and different sessions or flows are identified according to the five-tuple information;

[0194] A traffic feature extraction module is used to extract byte-level features and packet-level features based on a first time window according to the identified sessions or flows, extract flow-level features based on a second time window, wherein the second time window is larger than the first time window, add a prefix token in front of each level of features to identify whether the feature source is byte-level, packet-level or flow-level, add a suffix token at the end of the flow-level features to indicate the end of the feature sequence, and combine each level of features to form a total feature sequence;

[0195] The detection model pre-training module is configured to add position encoding to each feature item according to the total feature sequence, map the total feature sequence and the position encoding to a high-dimensional vector space through an embedding layer, input the mapped high-dimensional vector to an encoder module of a Transformer model, and pre-train the detection model through a mask reconstruction and malicious traffic prediction double-task training strategy.

[0196] The model fine-tuning and application module is configured to use the prediction result generated by the detection model on unlabeled data as a pseudo label, combine the pseudo label with real labeled data to form pseudo labeled data through an iterative manner, fine-tune the pre-trained detection model using the pseudo labeled data, and deploy the fine-tuned detection model to the network of the distributed new energy station to detect malicious traffic in real time.

[0197] It should be understood that the malicious traffic detection system for the distributed new energy station in the embodiments of the present application can implement all the technical solutions in the above method embodiments, and the functions of each functional module can be specifically implemented according to the methods in the above method embodiments, and the related descriptions in the above embodiments can be referred to, which will not be repeated here.

[0198] Embodiment three

[0199] The present embodiment provides a computer device, which comprises one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs are executed by the processors to implement the steps of the malicious traffic detection method for the distributed new energy station as described above.

[0200] Embodiment four

[0201] The present embodiment provides a computer storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the steps of the malicious traffic detection method for the distributed new energy station as described above.

[0202] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device (system), computer device or computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0203] The application is described with reference to the Figures according to which methods in accordance with embodiments of the application are described. It will be understood that each flow of the flow diagram, and combinations of flows of the flow diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, create means for implementing the functions specified in the flow diagram Figure 1 flow or multiple flows.

[0204] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flow diagram Figure 1 flow or multiple flows.

[0205] These computer program instructions can also be loaded onto a computer or other programmable data processing device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer implemented process such that the instructions which execute on the computer or other programmable device provide steps for implementing the functions specified in the flow diagram Figure 1 flow or multiple flows.

Claims

1. A method for detecting malicious traffic at distributed renewable energy power stations, characterized in that, The method includes the following steps: Acquire network traffic data of various devices in a distributed new energy power station under experimental conditions. Based on the experimental environment, mark some data as normal traffic or malicious traffic, and leave the rest unmarked. Perform protocol parsing on all acquired network traffic data and identify different sessions or flows based on the five-tuple information. Based on the identified session or stream, byte-level features and group-level features are extracted based on a first time window, and stream-level features are extracted based on a second time window, wherein the second time window is larger than the first time window. A prefix token is added before each extracted feature level to identify whether the feature source is byte-level, group-level, or stream-level. A suffix token is added at the end of the stream-level feature to indicate the end of the feature sequence. The features at each level are combined to form a total feature sequence. Based on the total feature sequence, a positional encoding is added to each feature item. The total feature sequence and positional encoding are mapped to a high-dimensional vector space through an embedding layer. The mapped high-dimensional vector is input into the encoder module of the Transformer model. The detection model is pre-trained through a dual-task training strategy of mask reconstruction and malicious traffic prediction. The prediction results generated by the detection model on unlabeled data are used as pseudo-labels. The pseudo-labels are combined with real labeled data through an iterative process to form pseudo-labeled data. The pre-trained detection model is then fine-tuned using the pseudo-labeled data. The fine-tuned detection model is then deployed to the network of distributed new energy power stations to detect malicious traffic in real time.

2. The method according to claim 1, characterized in that, Byte-level and group-level features are extracted based on the first time window, and stream-level features are extracted based on the second time window, including: Within the first time window, extract the first N bytes of each data packet constituting the session or stream to form a byte-level feature, represented as... ,in This represents the first N bytes of the i-th data group; Statistical analysis of the average length of data packets constituting a session within the first time window. Maximum length Average time interval between data groups and the total number of data groups This forms group-level features, represented as: ； Within the second time window, obtain the duration of the stream. And count the total number of data groups in the stream. Total bytes Average time interval between data groups Average length of data groups Get the direction of stream transmission This forms a flow-level feature sequence, represented as: 。 3. The method according to claim 1, characterized in that, The specific training strategy for the dual tasks of mask reconstruction and malicious traffic prediction is as follows: by This represents the reconstruction output of the detection model for the masked portion. ,in It has parameters The model, These are the masked features, and the mean squared error is used to measure the reconstruction quality of the model in combination with the true feature values. ; Using a labeled dataset Perform malicious traffic prediction for each sample Marked as ,in Indicates malicious traffic. This represents normal traffic; the model's output is the predicted probability of malicious traffic. : ,in, It is the model on the sample The output represents the probability that the traffic is malicious. The cross-entropy loss function is used to calculate the classification loss for malicious traffic prediction, combined with the true labels of the samples. ; Combining the losses from both tasks, the total loss function is formed: ,in and These are weight coefficients used to control the relative importance of tasks. Pre-training is continuously performed based on the total loss function until the stopping condition is met, thus obtaining the pre-trained model.

4. The method according to claim 3, characterized in that, In the mask reconstruction task, each feature item in the input sequence is randomly masked, and the masking method is as follows: by Denotes the total characteristic sequence, where These are byte-level, packet-level, or stream-level features. A subset of features is randomly selected and masked. The masked features are represented as follows: ,in, It is a random mask matrix.

5. The method according to claim 4, characterized in that, In the malicious traffic prediction task, the input features are processed by a Transformer encoder, followed by a fully connected layer and a Sigmoid activation function to generate the predicted probability of malicious traffic. The output is the predicted probability for each sample. .

6. The method according to claim 3, characterized in that, Fine-tuning the trained detection model using pseudo-labeled data includes: Let the unlabeled dataset be denoted as Using a pre-trained model on unlabeled samples Make predictions and generate prediction probabilities. : ,in Indicates parameters The model; Combined with confidence threshold Generating pseudo-labels based on predicted probabilities : Combining pseudo-label data with labeled data Use merged datasets The model was trained again to optimize its parameters: In this process, after each round of training, pseudo-labels are regenerated, the model is updated, and training is repeated.

7. The method according to claim 1, characterized in that, The fine-tuned detection model will be deployed to the network of distributed renewable energy power stations, including: Lightweight models are deployed on edge devices at the site to perform real-time traffic detection. Detection results or suspected malicious traffic data are uploaded to the central control platform for comprehensive analysis. Edge device deployment: Use edge devices with AI inference capabilities to run lightweight model inference services on the edge devices, use Flask to provide an HTTP interface, and transmit data to the inference service in real time through the interface; Central control platform deployment: The detection results of edge devices are uploaded to the central control platform through a security protocol. The platform aggregates data from multiple sites for global analysis and alerts.

8. The method according to claim 1, characterized in that, Also includes: The following methods are used to regularly evaluate, update, and optimize the deployed model by collecting new traffic data: By collecting new traffic data in real time, cleaning and labeling it, and periodically retraining or fine-tuning the model to adapt it to the latest traffic characteristics; Establish automated update pipelines and rollback mechanisms to quickly restore older versions when problems are discovered; The evaluation focuses on inference speed, resource utilization, and detection accuracy, with particular attention to false positive rate, false negative rate, and data distribution drift. The model training strategy is then adjusted based on the evaluation results.

9. A malicious traffic detection system for distributed new energy power stations, characterized in that, The system includes: The data acquisition and preprocessing module is used to acquire network traffic data of various devices in the distributed new energy power station under experimental environment. Based on the experimental environment, some data is marked as normal traffic or malicious traffic, while the rest of the data is not marked. The module also performs protocol parsing on all acquired network traffic data and identifies different sessions or flows based on the five-tuple information. The traffic feature extraction module is used to extract byte-level features and group-level features based on a first time window and extract flow-level features based on a second time window, wherein the second time window is larger than the first time window. A prefix token is added before each level of extracted features to identify whether the feature source is byte-level, group-level or flow-level. A suffix token is added at the end of the flow-level features to indicate the end of the feature sequence. The features at each level are combined to form a total feature sequence. The detection model pre-training module is used to add positional encoding to each feature item based on the total feature sequence. The total feature sequence and positional encoding are mapped to a high-dimensional vector space through the embedding layer. The mapped high-dimensional vector is input into the encoder module of the Transformer model. The detection model is pre-trained through a dual-task training strategy of mask reconstruction and malicious traffic prediction. The model fine-tuning and application module is used to use the prediction results generated by the detection model on unlabeled data as pseudo-labels. The pseudo-labels are combined with real labeled data through an iterative process to form pseudo-labeled data. The pre-trained detection model is fine-tuned using the pseudo-labeled data, and the fine-tuned detection model is deployed to the network of distributed new energy power stations to detect malicious traffic in real time.

10. The system according to claim 9, characterized in that, Byte-level and group-level features are extracted based on the first time window, and stream-level features are extracted based on the second time window, including: Within the first time window, extract the first N bytes of each data packet constituting the session or stream to form a byte-level feature, represented as... ,in This represents the first N bytes of the i-th data group; Statistical analysis of the average length of data packets constituting a session within the first time window. Maximum length Average time interval between data groups and the total number of data groups This forms group-level features, represented as: ； Within the second time window, obtain the duration of the stream. And count the total number of data groups in the stream. Total bytes Average time interval between data groups Average length of data groups Get the direction of stream transmission This forms a flow-level feature sequence, represented as: 。 11. The system according to claim 9, characterized in that, The specific training strategy for the dual tasks of mask reconstruction and malicious traffic prediction is as follows: by This represents the reconstruction output of the detection model for the masked portion. ,in It has parameters The model, These are the masked features, and the mean squared error is used to measure the reconstruction quality of the model in combination with the true feature values. ; Using a labeled dataset Perform malicious traffic prediction for each sample Marked as ,in Indicates malicious traffic. This represents normal traffic; the model's output is the predicted probability of malicious traffic. : ,in, It is the model on the sample The output represents the probability that the traffic is malicious. The cross-entropy loss function is used in conjunction with the original labels to calculate the classification loss for malicious traffic prediction. ; Combining the losses from both tasks, the total loss function is formed: ,in and These are weight coefficients used to control the relative importance of tasks. Pre-training is continuously performed based on the total loss function until the stopping condition is met, thus obtaining the pre-trained model.

12. The system according to claim 11, characterized in that, In the mask reconstruction task, each feature item in the input sequence is randomly masked, and the masking method is as follows: by Denotes the total characteristic sequence, where If the features are at the byte, packet, or stream level, and a subset of features are randomly selected for masking, then the masked features are represented as follows: ,in, It is a random mask matrix.

13. The system according to claim 11, characterized in that, Fine-tuning the trained detection model using pseudo-labeled data includes: Let the unlabeled dataset be denoted as Using a pre-trained model on unlabeled samples Make predictions and generate prediction probabilities. : ,in Indicates parameters The model; Combined with confidence threshold Generating pseudo-labels based on predicted probabilities : Combining pseudo-label data with labeled data Use merged datasets The model was trained again to optimize its parameters: In this process, after each round of training, pseudo-labels are regenerated, the model is updated, and training is repeated.

14. The system according to claim 9, characterized in that, The finely tuned detection model is deployed to the network of distributed new energy power stations. Lightweight models are deployed on edge devices at the power stations to perform real-time traffic detection. Detection results or suspected malicious traffic data are uploaded to the central control platform for comprehensive analysis. These edge devices utilize AI inference capabilities to run lightweight model inference services, using Flask to provide an HTTP interface through which data is transmitted in real-time. Detection results from the edge devices are uploaded to the central control platform via a secure protocol. The platform aggregates data from multiple power stations for global analysis and alerts.

15. The system according to claim 9, characterized in that, It also includes a model maintenance module, used to collect new traffic data to regularly evaluate, update, and optimize the deployed models, specifically including: The periodic update unit is used to periodically retrain or fine-tune the model by collecting new traffic data in real time, cleaning and labeling it, so that it can adapt to the latest traffic characteristics. The rollback settings unit is used to establish an automated update pipeline and rollback mechanism, which can quickly restore the old version when a problem is found; The performance evaluation unit is used to evaluate inference speed, resource utilization, and detection accuracy. Detection accuracy focuses on false positive rate, false negative rate, and data distribution drift. The model training strategy is adjusted based on the evaluation results.

16. A computer device, characterized in that, The device includes one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the malicious traffic detection method for distributed new energy power stations as described in any one of claims 1-8.

17. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the malicious traffic detection method for distributed new energy power stations as described in any one of claims 1-8.

Images