Power transaction system terminal feature identification method based on machine learning

Abstract

The invention provides a power transaction system terminal feature recognition method based on machine learning, and the method comprises the steps: data collection: capturing a data packet transmitted on a network interface through a network flow collection tool, and storing the data packet as a pcap file; data processing: analyzing the collected data, removing noise data, and performing data segmentation according to sessions; stacking ensemble learning: a random forest and an XFGBoost classifier are respectively used to carry out base classification on the data, and then an SVM is used to carry out meta classification to generate a candidate category set; and CBAM classification: aiming at the candidate category set output in the previous stage, performing depth feature extraction and accurate classification on an image generated by the collected original flow data by using a CBAM model, and outputting a classification result. According to the scheme, the accuracy and the precision rate of identification of the power terminal equipment are improved.

Description

Technical Field

[0001] The present invention relates to a method for identifying terminal characteristics of a power trading system based on machine learning, and belongs to the technical field of network security based on artificial intelligence. Background Art

[0002] The power trading system is an important part of the operation of the modern power market, aiming to promote the optimal allocation of power resources and the improvement of market efficiency. In the power trading system, the efficient management and accurate identification of devices are crucial for ensuring the stable operation of the system and reducing operating costs. With the progress of technology, more and more devices are connected to the power network, and users can also conveniently connect and complete transactions through various devices (such as computers, smartphones, and tablets). This convenience improves the user experience and operation efficiency, and promotes the smooth and efficient conduct of energy market transactions. At the same time, it also brings new security challenges. The access of a large number of terminal devices to the network will further increase the overall complexity of the network, and the network security problems caused by terminal device vulnerabilities will become more prominent. Hackers will take advantage of the loopholes in the devices to create different network attack behaviors. Detecting and identifying terminal devices is an important way to ensure the security of the power trading system.

[0003] There is a wide variety of power terminal devices and their working environments are complex. Traditional device identification methods often fail to meet actual requirements. The key technologies of traffic collection and analysis are important means to ensure network security. By collecting network traffic data and hierarchically parsing protocol information, the basic communication information and behavioral attribute characteristics of network users can be obtained. Existing research has proven that if similar devices have similar communication behaviors, then different intelligent device categories can be distinguished by analyzing the network traffic of device communication. Stacking (stacked generalization) is an ensemble learning method that hierarchically combines the prediction results of multiple base learners and uses a meta-learner for optimization and integration to improve the model performance. Its core principle lies in constructing a hierarchical structure: the bottom layer consists of multiple heterogeneous or homogeneous base learners (such as decision trees, support vector machines, neural networks, etc.), which independently learn different features of the training data; the middle layer takes the prediction results of the base learners as new features and inputs them into the meta-learner, and the meta-learner (such as logistic regression, linear regression, etc.) learns how to optimally fuse these prediction results to form the final output. The main processes include: (1) dividing the training data into k folds, training the base learners through k-fold cross-validation, using k - 1 fold data for training each time, and generating prediction values for the remaining 1 fold to ensure that each sample is predicted by the base learners once; (2) concatenating the prediction results of the base learners into a new feature matrix as the input of the meta-learner; (3) training the meta-learner to learn the mapping relationship between the base model predictions and the true labels; (4) for new data, first predict by the base learners and then output the final result through the meta-learner. Stacking has excellent performance, breaks through the bottleneck of a single model, reduces the bias or variance of a single model through weighted fusion, and can make the overall reach a better generalization ability; Stacking has good flexibility and scalability, allows mixing different types of base models, adapts to multi-modal data scenarios, can dynamically combine strategies, and is hierarchically scalable. Stacking is widely used in cross-modal learning, few-shot learning, and robustness improvement, etc.

[0004] CBAM is a lightweight attention mechanism module designed specifically for convolutional neural networks (CNNs) to dynamically enhance important information in feature maps and suppress irrelevant noise. Its core idea is to enable the network to automatically learn "where to look" and "what to focus on", thereby enhancing the model's perception ability of key features. The core principle of CBAM is divided into two cooperative stages: channel attention and spatial attention. Spatial attention focuses on the importance of the spatial positions of feature maps. By performing average pooling and max pooling on the feature maps along the channel dimension, concatenating them and then inputting them into a convolutional layer to generate a spatial weight matrix, further enhancing the features at the spatial level in key regions (such as the head contour of a cat) and weakening background noise.

[0005] CBAM is efficient and lightweight. With only a small number of parameters (such as the dimensionality reduction layer in the MLP and the single-layer convolution in the spatial attention), it can reduce the Top-1 classification error rate by 1-2% in mainstream networks such as ResNet-50, and the computational overhead is almost negligible. CBAM has a modular design, supports plug-and-play, and can be seamlessly embedded into different architectures such as ResNet, MobileNet, and YOLO without modifying the backbone network structure. CBAM has a gain effect of dual-channel collaboration. Channel attention filters important information from the feature dimension, and spatial attention locates key regions from the spatial dimension. The two are sequentially stacked (default channel first) to form multi-level feature optimization, showing stronger robustness in complex scenarios (such as occlusion and illumination changes). Therefore, CBAM is widely used in fields such as image classification, object detection, and semantic segmentation. Summary of the Invention

[0006] In view of the deficiencies of the prior art, the present invention proposes a method for identifying terminal features of a power trading system based on machine learning. This solution combines Stacking ensemble learning with the Convolutional Block Attention Module (CBAM) to propose an innovative device recognition framework (SA-CBAM). Stacking ensemble learning improves the robustness and generalization ability of device classification by integrating base learners such as random forest and XGBoost with a support vector machine (SVM) meta-learner. CBAM, on the other hand, uses channel and spatial attention mechanisms to dynamically extract key feature regions from traffic images, enhancing the model's deep learning ability for device behavior patterns. By combining the advantages of both, this solution has higher accuracy and precision in scenarios of large-scale and real-time identification of power terminal devices.

[0007] To achieve the above objectives, the present invention provides the following technical solutions:

[0008] A method for identifying terminal features of a power trading system based on machine learning, including the following four steps:

[0009] 1. Data collection: Use a network traffic collection tool to capture and discover the data packets transmitted on the network interface and save them as pcap format files;

[0010] 2. Data cleaning: Process the collected traffic data, remove irrelevant data, and segment it according to sessions for subsequent feature extraction and analysis;

[0011] 3. Stacking ensemble learning: Use the Stacking method to quickly process structured data and complete the preliminary screening of device categories;

[0012] 4. CBAM classification: Use CBAM to perform deep feature extraction and precise classification on the preliminary screening results;

[0013] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0014] 1. The present invention designs and implements a device recognition model based on Stacking machine learning, which combines random forest and XGBoost as base learners, and SVM as a meta-learner, and optimizes the parameters. Stacking quickly processes structured data by integrating base learners such as random forest and XGBoost to complete the preliminary screening of device categories. This multi-model collaboration method can effectively improve the accuracy and robustness of the preliminary classification. Using the support vector machine (SVM) as a meta-learner to further optimize the prediction results of the base learners. SVM maximizes the classification margin by finding the maximum margin hyperplane, thereby improving the accuracy of classification. Taking SVM as a meta-classifier helps to integrate the output results of the base classifiers and obtain a more accurate classification decision boundary. Through this combination, Stacking ensemble learning not only utilizes the advantages of multiple base learners but also further improves the generalization ability and robustness of the model through the meta-learner, enabling it to better handle high-dimensional and unstructured device traffic data.

[0015] 2. The present invention proposes a device recognition method based on convolutional neural network with attention mechanism enhancement, CBAM, which utilizes the dual mechanisms of channel attention and spatial attention to achieve dynamic attention to key feature regions. By converting the original traffic data of network devices into image form, it automatically learns device features and realizes accurate classification of network devices; CBAM calculates the importance weights of each feature channel through global average pooling and global max pooling, and uses a fully connected layer to generate a channel-level weight distribution. These weights represent the contribution degree of each channel to feature extraction, and the model will focus on these important channels, thereby enhancing the pertinence of feature extraction; CBAM compresses the channel dimension of the feature map and uses convolutional operations to generate a spatial weight map, thereby focusing on the regions with high responses in the feature map. These high-response regions usually contain the key behavior features of the device; combining channel attention and spatial attention to generate an attention-enhanced feature map, these feature maps not only retain the important information in the original traffic data but also dynamically focus on the key regions through the attention mechanism, thereby significantly improving the model's ability to capture the key features of device communication behavior.

[0016] In summary, the present invention combines Stacking ensemble learning with convolutional block attention mechanism, proposes an innovative device recognition scheme, which has higher accuracy and precision, and can provide effective technical support for large-scale real-time device recognition tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] To more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.

[0018] Figure 1 It is a framework diagram of a method for identifying terminal features of a power trading system based on machine learning provided by an example of the present invention.

[0019] Figure 2 It is a general step diagram of a method for identifying terminal features of a power trading system based on machine learning provided by an embodiment of the present invention. Specific implementation manners

[0020] To better understand the technical solution, the method of the present invention will be described in detail below with reference to the drawings.

[0021] A method for identifying terminal features of a power trading system based on machine learning proposed by the present invention mainly consists of four steps, namely data collection, data processing, stacking ensemble learning, and CBAM classification. Data collection refers to using network traffic collection tools to capture and discover the data packets transmitted on the network interface and save them as pcap format files. Data processing refers to processing the collected traffic data, removing irrelevant data, and splitting it according to sessions for subsequent feature extraction and analysis. Stacking ensemble learning refers to using the Stacking method to quickly process structured data to complete the preliminary screening of device categories. CBAM classification refers to using CBAM to perform deep feature extraction and precise classification on the preliminary screening results.

[0022] Step S1: Data collection

[0023] In the research on the method for identifying devices in a power trading system based on traffic and machine learning, data collection is the key first step. Network traffic collection tools such as WireShark and tcpdump can be used to capture and analyze the data packets transmitted on the network interface in the power Internet of Things in real time and save them as pcap format files for subsequent analysis.

[0024] Multiple collection devices can be deployed at key nodes (including gateways, switches, and user-side devices) to ensure that all communication data in the wide area network and local area network can be covered, minimizing data loss to the greatest extent.

[0025] Step S2: Data processing

[0026] The original network traffic data collected is usually unstructured and needs to be preprocessed to extract useful information.

[0027] S2.1. Data Parsing and Filtering;

[0028] Parse and filter the pcap file to remove irrelevant broadcast packets, multicast packets, and other noise data.

[0029] S2.2. Data Segmentation;

[0030] Segment the data according to sessions for subsequent feature extraction and analysis. A session refers to the traffic with the same five-tuple information, and the five-tuple is the source IP address, source port, destination IP address, destination port, and transport protocol. Compared with a single data packet, the session flow contains a large number of behavioral characteristics of device communication traffic, which can help the machine learning model better identify the device. At the same time, use common data cleaning methods in supervised learning, including handling missing values, duplicate data, and outliers, etc. For missing values, interpolation or filling methods are used for processing; for duplicate data, it is directly deleted to avoid affecting model training; for outliers, they need to be detected and processed through statistical analysis or machine learning methods.

[0031] Step S3: Stacking Ensemble Learning

[0032] The performance of a single machine learning model may be affected by noise in the dataset or complex relationships that are difficult to capture, resulting in unsatisfactory performance. Stacking ensemble learning can classify and predict more accurately by fusing the prediction results of multiple base learners.

[0033] S3.1. Feature Extraction

[0034] Use a network packet capture tool (such as Wireshark) or programming library (such as Scapy) to extract protocol fields at each layer, use a protocol analysis tool to deeply analyze specific fields of the data packet, extract relevant information, calculate information such as the length of the traffic and port numbers, and record them in the dataset to form a feature set. The extracted plaintext traffic features are divided into three categories: protocol features, behavior features, and extended features.

[0035] Protocol features are the protocols involved in each layer of the network in the data traffic, including the ARP protocol at the link layer, and protocols such as IP and ICMP at the network layer;

[0036] Behavior features include the total length of the data packet, the length of the data part, the original data, and port number-related information.

[0037] Extended features are the internal field information of specific protocols extracted for device traffic analysis, including fields such as the length of the EAPOL protocol and the DNS protocol ID number. Different features constitute the identification feature set for identifying devices.

[0038] The present invention takes the prediction results of multiple base classifiers as new features and inputs them into a meta-classifier, thereby further improving the prediction accuracy. Compared with other ensemble learning algorithms, it can more effectively integrate multiple different algorithms. The present invention uses random forest and XGBoost as base classifiers, and SVM as a meta-classifier. The specific algorithm is as follows:

[0039]

[0040]

[0041] S3.2. Random Forest and XGBoost Base Classification

[0042] The input includes the training dataset, the test dataset, as well as two base classifiers (Random Forest RF and XGBoost) and a meta-classifier (Support Vector Machine SVM).

[0043] The algorithm first divides the training dataset into a training meta-dataset and a validation dataset for the training of the base classifiers and the generation of meta-features. In the training stage of the base classifiers, Random Forest and XGBoost are respectively trained on the training meta-dataset to generate two base classifier models.

[0044] S3.3. SVM Meta-Classification

[0045] In the stage of generating meta-features, for each sample in the validation dataset and the test dataset, the predicted class probabilities are obtained using each base classifier, and these probability values are combined into a meta-feature vector. This step provides the input features for the subsequent training and testing of the meta-classifier. In the training stage of the meta-classifier, the Support Vector Machine is trained on the meta-features of the validation data and their corresponding labels to generate the final meta-classifier model. Then, in the testing stage, for each sample in the test dataset, the class probabilities are predicted by the meta-classifier, and the top [number] classes are selected as the candidate class set according to the probability values. Finally, the algorithm returns the candidate class set for each test sample, which includes the corresponding classes and their probabilities.

[0046] Step S4: CBAM Classification

[0047] For the candidate class set output in the previous step, the present invention uses the CBAM model to perform deep feature extraction and precise classification on the images generated from the collected original traffic data. The Convolutional Neural Network (CNN) has powerful feature extraction capabilities, and the introduced attention mechanism further enhances the attention to key features. Specifically, the design of the CBAM module enables the model to dynamically identify important regions in the device traffic data, thereby improving the classification accuracy and robustness. CBAM can utilize the classification probability distribution results of Stacking to dynamically adjust its feature weight allocation and focus on the feature regions of high-confidence classes.

[0048] S4.1. Feature Matrix Extraction

[0049] Extract the feature matrix from the traffic of each session. The features include packet length, inter-arrival time interval, transport protocol identifier, port number, etc. These features reflect the behavior patterns of device communication and the characteristics of protocol distribution.

[0050] S4.2. Two-Dimensional Image Conversion

[0051] After generating the feature matrix, the present invention further converts it into a two-dimensional image format. By zero-padding the feature matrix to a fixed size, a feature image of uniform size can be generated for input into the CNN model for processing. Each pixel point in the image corresponds to a specific feature value of a specific data packet, and the pixel distribution pattern can reflect the communication behavior characteristics of the device. Through this image conversion, complex temporal features are embedded into a two-dimensional space, adapting to the sensitivity of convolutional operations to local patterns. For the candidate device categories obtained in S3, their category labels are used as additional inputs and provided to the CBAM model together with the traffic images.

[0052] S4.3. CBAM Classification

[0053] Through the above preprocessing process, the original traffic data is efficiently converted into an input form suitable for processing by the CBAM model, while retaining the key features of device communication behavior. Combining the candidate classification information provided by Stacking, CBAM can not only effectively mine complex unstructured features but also further improve the accuracy and robustness of classification.

[0054] When dealing with the identification task of diverse devices in the power trading system, the communication behavior of devices often has complex feature patterns. For this reason, the present invention adopts a convolutional neural network model based on CBAM, and enhances the ability to focus on key regions of traffic images by introducing an attention mechanism, so as to achieve accurate identification of device categories. The design of CBAM includes a convolutional feature extraction module, an attention module, and a classification module. The specific algorithm is as follows:

[0055]

[0056]

[0057] The input includes the original network traffic data , the candidate categories and their probabilities from Stacking , as well as the model parameters Θ and the image size (H, W). The goal of the algorithm is to generate the final predicted label of the device based on the traffic data and the candidate categories

[0058] First, in step a, the original network traffic data is preprocessed. Features F (such as packet length, timestamp, etc.) are extracted from each session s, and the features are normalized to ensure the consistency of their numerical ranges. Then, the feature matrix F is adjusted to a fixed size (H, W) through zero-padding operation and converted into a grayscale image I s , preparing for subsequent CNN processing.

[0059] In step b, the algorithm fuses the candidate class probabilities P s from Stacking into each image I s . This design allows the model to further utilize the prior classification information provided by Stacking based on the image features, enhancing the classification ability.

[0060] In step c, image features are extracted through a convolutional neural network. First, the input image I s is used by the convolutional layer to generate a preliminary feature map F. Then, CBAM (attention mechanism module) is introduced to enhance the feature extraction ability. The channel attention module (CAM) calculates the importance weights of each channel of the feature map and weights them onto the original feature map to generate a channel-enhanced feature F c . Next, the spatial attention module (SAM) weights the channel-enhanced feature map in the spatial dimension to further generate a spatially enhanced feature F s .

[0061] In step d, the algorithm classifies the enhanced feature F s . First, F s is flattened into a feature vector and concatenated with the candidate class probabilities P s from Stacking to form a comprehensive feature vector v'. Subsequently, through the fully connected layer and the Softmax activation function, the final class prediction for each sample is calculated

[0062] Finally, the algorithm returns the predicted labels of all sessions as the final result of device recognition.

Claims

1. A method for identifying terminal features of a power trading system based on machine learning, characterized in that: The implementation steps include: Step S1: Data collection: Use a network traffic collection tool to capture and discover data packets transmitted on the network interface and save them as pcap format files; Step S2: Data processing: The collected raw network traffic data is usually unstructured and needs to be preprocessed to extract useful information; Step S2.1: data analysis and filtering; Step S2.2: data segmentation; Step S3: stacking ensemble learning: Stacking ensemble learning can more accurately classify and predict by fusing the prediction results of multiple base learners; Step S3.1: feature extraction; Step S3.2: Random Forest and XGBoost base classification; Step S3.3: meta-classification; Step S4: CBAM classification: The present invention uses the CBAM model to perform deep feature extraction and accurate classification on the image generated by the collected raw traffic data; S4.1, feature matrix extraction; S4.2, 2D image conversion; S4.

3. CBAM classification.

2. A method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S1 is: Step S1: data collection; Use network traffic collection tools to capture and analyze data packets transmitted on the network interface in real time, and save them as pcap format files for subsequent analysis; deploy multiple collection devices at key nodes to ensure that all communication data in the WAN and LAN are covered to minimize data loss.

3. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S2.1 is as follows: S2.1, data analysis and filtering; Parse and filter the pcap files saved by the collected data to remove irrelevant noise data.

4. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S2.2 is as follows: S2.2, data segmentation; Data is segmented by session for subsequent feature extraction and analysis. A session refers to traffic with the same five-tuple information, namely source IP address, source port, destination IP address, destination port, and transmission protocol. At the same time, the data cleaning methods commonly used in supervised learning are used to process missing values ​​by interpolation or filling. Duplicate data is directly deleted to avoid affecting model training. Outliers need to be detected and processed through statistical analysis or machine learning methods.

5. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S3.1 is as follows: S3.1, feature extraction; Use network packet capture tools to extract protocol fields at each layer, use protocol analysis tools to deeply parse specific fields of data packets, extract relevant information, and record it in a data set to form a feature set; the extracted plaintext traffic features are divided into three categories: protocol features, behavioral features, and extended features.

6. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S3.2 is as follows: S3.2, Random Forest and XGBoost base classification; Input training data set and test data set, as well as two base classifiers: Random Forest RF and XGBoost, and a meta classifier: Support Vector Machine SVM; The training dataset is divided into a training meta-dataset and a validation dataset for base classifier training and meta-feature generation. In the base classifier training phase, random forest and XGBoost are trained on the training meta-dataset to generate two base classifier models.

7. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S3.2 is as follows: S3.2 SVM meta-classification; In the meta-feature generation stage, for each sample in the validation dataset and the test dataset, each base classifier is used to predict the category probability, and these probability values ​​are combined into a meta-feature vector; this step provides input features for subsequent meta-classifier training and testing; In the training phase of the meta-classifier, the support vector machine is trained on the meta-features of the validation data and their corresponding labels to generate the final meta-classifier model. Then, in the testing phase, for each sample in the test data set, the meta-classifier predicts the category probability and selects the previous category as the candidate category set based on the probability value. Finally, the algorithm returns a set of candidate categories for each test sample, which contains the corresponding categories and their probabilities.

8. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S4.1 is as follows: S4.1, feature matrix extraction; Extract feature matrix from traffic of each session; These characteristics reflect the behavioral patterns and protocol distribution characteristics of device communications.

9. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S4.2 is as follows: After generating the feature matrix, the present invention further converts it into a two-dimensional image format; by zero-filling the feature matrix to a fixed size, a feature image of uniform size can be generated so as to be input into the CNN model for processing; each pixel in the image corresponds to a specific feature value of a specific data packet, and the pixel distribution pattern can reflect the communication behavior characteristics of the device; through this image conversion, complex timing features are embedded in the two-dimensional space, adapting the sensitivity of the convolution operation to the local pattern; for the candidate device category obtained by S3, its category label is provided as an additional input to the CBAM model together with the traffic image.

10. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S4.3 is as follows: Through the above preprocessing process, the raw traffic data is efficiently converted into an input form suitable for CBAM model processing, while retaining the key characteristics of device communication behavior; Combined with the candidate classification information provided by Stacking, CBAM can not only effectively mine complex unstructured features, but also further improve the accuracy and robustness of classification, and finally output the classification results.

Images