A terminal feature recognition method for power trading system based on machine learning

Abstract

The present invention provides a method for identifying terminal features in a power trading system based on machine learning. The method comprises the following steps: data acquisition: using a network traffic acquisition tool to capture data packets transmitted on a network interface and save them as pcap files; data processing: parsing the collected data, removing noise data, and segmenting the data according to sessions; stacking ensemble learning: using random forest and XFGBoost classifiers to perform base classification on the data, and then using support vector machines for meta-classification to generate a set of candidate categories; and CBAM classification: using the CBAM model to perform deep feature extraction and precise classification on images generated from the collected raw traffic data based on the candidate category set output in the previous stage, and outputting the classification results. The above-mentioned scheme of the present invention improves the accuracy and precision of power terminal equipment identification.

Description

Technical Field

[0001] The present invention relates to a method for identifying terminal features of an electric power trading system based on machine learning, and belongs to the technical field of network security based on artificial intelligence. Background Art

[0002] Power trading systems are a crucial component of modern power market operations, aiming to optimize the allocation of power resources and improve market efficiency. Within power trading systems, efficient device management and accurate identification are crucial for ensuring stable system operation and reducing operating costs. With technological advancements, more and more devices are connected to the power grid, allowing users to conveniently connect and complete transactions through various devices (such as computers, smartphones, and tablets). This convenience improves user experience and operational efficiency, promoting smooth and efficient energy market transactions. However, this also presents new security challenges. With a large number of terminal devices connected to the network, overall network complexity will increase, and network security issues arising from terminal device vulnerabilities will become more prominent. Hackers will exploit these vulnerabilities to launch various cyberattacks. Therefore, detecting and identifying terminal devices is a crucial step in ensuring the security of power trading systems.

[0003] Given the diverse nature of power terminal equipment and the complex operating environments, traditional device identification methods often fail to meet practical needs. Key technologies for traffic collection and analysis are crucial for ensuring network security. By collecting network traffic data and analyzing protocol information in a layered manner, basic communication information and behavioral attributes of network users can be obtained. Previous research has shown that if similar devices have similar communication behaviors, different smart device categories can be distinguished by analyzing their network traffic. Stacking is an ensemble learning method that improves model performance by hierarchically combining the predictions of multiple base learners and optimizing them using a meta-learner. Its core principle is to construct a hierarchical structure: the bottom layer consists of multiple heterogeneous or homogeneous base learners (such as decision trees, support vector machines, and neural networks), which independently learn different features of the training data. The middle layer then feeds the base learners' predictions as new features into the meta-learner, which then learns how to optimally integrate these predictions to form the final output. The main process includes: (1) Divide the training data into k folds, train the base learner through k-fold cross-validation, use k-1 folds of data for training each time, and generate prediction values ​​for the remaining 1 fold to ensure that each sample is predicted once by the base learner; (2) Concatenate the prediction results of the base learner into a new feature matrix as the input of the meta-learner; (3) Train the meta-learner to learn the mapping relationship between the base model prediction and the true label; (4) For new data, the base learner first predicts, and then the meta-learner outputs the final result. Stacking has excellent performance and breaks through the bottleneck of a single model. By reducing the bias or variance of a single model through weighted fusion, the overall generalization ability can be achieved; Stacking is based on good flexibility and scalability, allowing the mixing of different types of base models to adapt to multimodal data scenarios, and can dynamically combine strategies and be hierarchically scalable. Stacking is widely used in cross-modal learning, small sample learning, and robustness improvement.

[0004] CBAM is a lightweight attention mechanism module designed for convolutional neural networks (CNNs) to dynamically enhance important information in feature maps and suppress irrelevant noise. Its core idea is to allow the network to automatically learn "where to look" and "what to focus on," thereby improving the model's perception of key features. The core principle of CBAM is divided into two collaborative stages: channel attention and spatial attention. Spatial attention focuses on the spatial importance of the feature map. By performing average pooling and maximum pooling on the feature map along the channel dimension, the spliced ​​feature map is input into the convolutional layer to generate a spatial weight matrix, which further enhances the spatial features of key areas (such as the outline of a cat's head) and weakens background noise.

[0005] CBAM is efficient and lightweight, requiring only a small number of parameters (such as the dimensionality reduction layer in MLP and the single-layer convolution in spatial attention) to reduce the Top-1 classification error rate by 1-2% in mainstream networks such as ResNet-50, with almost negligible computational overhead. CBAM has a modular design and supports plug-and-play, and can be seamlessly embedded in different architectures such as ResNet, MobileNet, and YOLO without modifying the backbone network structure. CBAM has a dual-path collaborative gain effect. Channel attention filters important information from the feature dimension, and spatial attention locates key areas from the spatial dimension. The two are sequentially superimposed (channel priority by default) to form a multi-level feature optimization, showing stronger robustness in complex scenes (such as occlusion and lighting changes). Therefore, CBAM is widely used in fields such as image classification, target detection, and semantic segmentation. Summary of the Invention

[0006] In response to the shortcomings of the existing technology, the present invention proposes a method for identifying terminal features of power trading systems based on machine learning. This solution combines Stacking ensemble learning with the convolutional block attention mechanism (CBAM) to propose an innovative device identification framework (SA-CBAM). Stacking ensemble learning improves the robustness and generalization ability of device classification by integrating base learners such as random forests and XGBoost with the support vector machine (SVM) meta-learner; CBAM uses channel and spatial attention mechanisms to dynamically extract key feature areas from traffic images, thereby enhancing the model's deep learning ability for device behavior patterns. By combining the advantages of both, this solution has higher accuracy and precision in the scenario of large-scale, real-time identification of power terminal devices.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A method for identifying terminal features in a power trading system based on machine learning includes the following four steps:

[0009] 1. Data collection: Use network traffic collection tools to capture and discover data packets transmitted on the network interface and save them as pcap format files;

[0010] 2. Data collation: Process the collected traffic data, remove irrelevant data, and segment it by session to facilitate subsequent product extraction and analysis;

[0011] 3. Stacking ensemble learning: Use the stacking method to quickly process structured data and complete the preliminary screening of device categories;

[0012] 4. CBAM classification: CBAM is used to perform deep feature extraction and accurate classification on the preliminary screening results;

[0013] Compared with the prior art, the present invention has the following beneficial effects:

[0014] 1. The present invention designs and implements a device identification model based on Stacking machine learning, which combines random forest and XGBoost as base learners, SVM as a meta-learner, and performs parameter optimization. Stacking quickly processes structured data and completes the preliminary screening of device categories by integrating base learners such as random forest and XGBoost. This multi-model collaborative approach can effectively improve the accuracy and robustness of preliminary classification. Support vector machine (SVM) is used as a meta-learner to further optimize the prediction results of the base learner. SVM maximizes the classification distance by finding the maximum margin hyperplane, thereby improving the accuracy of classification. Using SVM as a meta-classifier helps to integrate the output results of the base classifier to obtain a more accurate classification decision boundary. Through this combination, Stacking ensemble learning not only takes advantage of the advantages of multiple base learners, but also further improves the generalization ability and robustness of the model through the meta-learner, so that it can better cope with high-dimensional and unstructured device traffic data.

[0015] 2. This paper proposes a device identification method based on a convolutional neural network enhanced with attention mechanism (CBAM). This method utilizes the dual mechanisms of channel attention and spatial attention to achieve dynamic attention to key feature regions. By converting the raw traffic data of network devices into images, it automatically learns device features and achieves accurate classification of network devices. CBAM calculates the importance weight of each feature channel through global average pooling and global max pooling, and uses fully connected layers to generate a channel-level weight distribution. These weights represent the contribution of each channel to feature extraction, and the model focuses on these important channels, thereby enhancing the targeted feature extraction. CBAM compresses the channel dimension of the feature map and uses convolution operations to generate a spatial weight map, focusing on regions with high response in the feature map. These high-response regions often contain key behavioral characteristics of the device. Combining channel attention and spatial attention generates attention-enhanced feature maps. These feature maps not only retain important information in the raw traffic data but also dynamically focus on key regions through the attention mechanism, significantly improving the model's ability to capture key characteristics of device communication behavior.

[0016] In summary, this paper combines Stacking ensemble learning with the convolutional block attention mechanism to propose an innovative device recognition scheme with higher accuracy and precision, which can provide effective technical support for large-scale real-time device recognition tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 A framework diagram of a terminal feature recognition method for a power trading system based on machine learning is provided as an example of the present invention.

[0019] Figure 2 A diagram showing the overall steps of a method for identifying terminal features in a power trading system based on machine learning provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to better understand the present technical solution, the method of the present invention is described in detail below with reference to the accompanying drawings.

[0021] This paper proposes a machine learning-based terminal feature recognition method for power trading systems. The method consists of four steps: data acquisition, data processing, stacking ensemble learning, and CBAM classification. Data acquisition involves using network traffic collection tools to capture and discover data packets transmitted on network interfaces and save them as pcap files. Data processing involves processing the collected traffic data, removing irrelevant data, and segmenting it by session for subsequent feature extraction and analysis. Stacking ensemble learning utilizes stacking methods to rapidly process structured data and perform preliminary screening of device categories. CBAM classification involves using CBAM to perform in-depth feature extraction and precise classification of the initial screening results.

[0022] Step S1: Data acquisition

[0023] Data collection is a critical first step in researching device identification methods for power trading systems based on traffic and machine learning. Network traffic collection tools such as WireShark and tcpdump can be used to capture and analyze data packets transmitted on network interfaces in the power Internet of Things in real time, saving them as pcap files for subsequent analysis.

[0024] Multiple collection devices can be deployed at key nodes (including gateways, switches, and user-end devices) to ensure that all communication data in the wide area network and local area network are covered, minimizing data loss.

[0025] Step S2: Data processing

[0026] The collected raw network traffic data is usually unstructured and needs to be preprocessed to extract useful information.

[0027] S2.1, data parsing and filtering;

[0028] Parse and filter the pcap file to remove irrelevant broadcast packets, multicast packets and other noise data.

[0029] S2.2, data segmentation;

[0030] Data is segmented by session to facilitate subsequent feature extraction and analysis. A session refers to traffic with the same five-tuple information: source IP address, source port, destination IP address, destination port, and transport protocol. Compared to a single data packet, a session flow contains a large number of behavioral characteristics of device communication traffic, which can help machine learning models better identify devices. At the same time, data cleaning methods commonly used in supervised learning are used, including processing missing values, duplicate data, and outliers. Missing values ​​are processed by interpolation or filling; duplicate data is directly deleted to avoid affecting model training; and outliers need to be detected and processed through statistical analysis or machine learning methods.

[0031] Step S3: stacking ensemble learning

[0032] The performance of a single machine learning model may be affected by noise in the dataset or complex relationships that are difficult to capture, resulting in suboptimal performance. Stacking ensemble learning can achieve more accurate classification and prediction by fusing the prediction results of multiple base learners.

[0033] S3.1 Feature extraction

[0034] Use network packet capture tools (such as Wireshark) or programming libraries (such as Scapy) to extract protocol fields at each layer. Use protocol analysis tools to deeply parse specific fields in the packet and extract relevant information. Calculate information such as traffic length and port numbers, and record this information in a dataset to form a feature set. Extracted plaintext traffic features are categorized into three types: protocol features, behavioral features, and extended features.

[0035] Protocol features are the protocols involved in each network layer in data traffic, including the ARP protocol at the link layer and the IP and ICMP protocols at the network layer.

[0036] Behavioral features include the total length of the data packet, the length of the data portion, the original data, and port number related information.

[0037] Extended features are internal field information of specific protocols extracted from device traffic analysis, including the length of the EAPOL protocol and the DNS protocol ID number. Different features constitute the identification feature set for identifying devices.

[0038] This method uses the prediction results of multiple base classifiers as new features to input into a meta-classifier, thereby further improving prediction accuracy. Compared with other ensemble learning algorithms, it can more effectively integrate multiple different algorithms. This method uses random forest and XGBoost as base classifiers, and SVM as a meta-classifier. The specific algorithm is as follows:

[0039]

[0040]

[0041] S3.2, Random Forest and XGBoost base classification

[0042] The input includes a training dataset and a test dataset, as well as two base classifiers (Random Forest RF and XGBoost) and a meta classifier (Support Vector Machine SVM).

[0043] The algorithm first divides the training dataset into a training meta-dataset and a validation dataset for base classifier training and meta-feature generation. During the base classifier training phase, Random Forest and XGBoost are trained on the training meta-dataset to generate two base classifier models.

[0044] S3.3 SVM meta-classification

[0045] During the meta-feature generation phase, each base classifier is used to predict the class probability for each sample in the validation and test datasets, and these probability values ​​are combined into a meta-feature vector. This step provides input features for subsequent meta-classifier training and testing. During the meta-classifier training phase, a support vector machine is trained on the meta-features of the validation data and their corresponding labels to generate the final meta-classifier model. Subsequently, during the testing phase, the meta-classifier is used to predict the class probability for each sample in the test dataset, and the top class is selected as the candidate class set based on the probability value. Finally, the algorithm returns a candidate class set for each test sample, which contains the corresponding class and its probability.

[0046] Step S4: CBAM classification

[0047] For the candidate category set output in the previous step, the present invention uses the CBAM model to perform deep feature extraction and precise classification on the images generated by the collected raw traffic data. Convolutional neural networks (CNNs) have powerful feature extraction capabilities, and the introduced attention mechanism further enhances the focus on key features. Specifically, the design of the CBAM module enables the model to dynamically identify important areas in device traffic data, thereby improving the accuracy and robustness of classification. CBAM can use the classification probability distribution results of Stacking to dynamically adjust its feature weight distribution, focusing on feature areas of high-confidence categories.

[0048] S4.1. Feature Matrix Extraction

[0049] A feature matrix is ​​extracted from the traffic of each session. Features include packet length, arrival time interval, transport protocol identifier, and port number. These features reflect the behavioral patterns and protocol distribution characteristics of device communication.

[0050] S4.2. 2D Image Conversion

[0051] After generating the feature matrix, the present invention further converts it into a two-dimensional image format. By zero-padding the feature matrix to a fixed size, a feature image of uniform size can be generated for input into the CNN model for processing. Each pixel in the image corresponds to a specific feature value of a specific data packet, and the pixel distribution pattern can reflect the communication behavior characteristics of the device. Through this image conversion, complex temporal features are embedded in a two-dimensional space, adapting the sensitivity of the convolution operation to local patterns. For the candidate device categories identified by S3, their category labels are provided as additional inputs to the CBAM model together with the traffic image.

[0052] S4.3 CBAM classification

[0053] Through this preprocessing process, raw traffic data is efficiently converted into an input format suitable for CBAM model processing, while retaining the key characteristics of device communication behavior. Combined with the candidate classification information provided by Stacking, CBAM can not only effectively mine complex unstructured features, but also further improve the accuracy and robustness of classification.

[0054] When dealing with the identification of diverse devices in power trading systems, device communication behaviors often exhibit complex characteristic patterns. To address this, this paper employs a convolutional neural network model based on CBAM. By introducing an attention mechanism, it enhances the ability to focus on key areas of traffic images, thereby enabling accurate identification of device categories. The CBAM design includes a convolutional feature extraction module, an attention module, and a classification module. The specific algorithm is as follows:

[0055]

[0056]

[0057] Input includes raw network traffic data , candidate categories and their probabilities from Stacking , as well as model parameters Θ and image size (H, W). The goal of the algorithm is to generate the final predicted label of the device based on traffic data and candidate categories

[0058] First, in step a, the raw network traffic data is preprocessed. Features F (such as packet length, timestamp, etc.) are extracted from each session s and normalized to ensure consistency in their numerical range. Next, the feature matrix F is resized to a fixed size (H, W) through zero padding and converted into a grayscale image I s , prepare for subsequent CNN processing.

[0059] In step b, the algorithm converts the candidate category probability P from Stacking s Fusion to each image I s This design allows the model to further utilize the prior classification information provided by Stacking based on image features to enhance classification capabilities.

[0060] In step c, the image features are extracted through convolutional neural network. First, the convolutional layer is used to extract the input image I s Generate a preliminary feature map F. Then, introduce CBAM (Attention Mechanism Module) to enhance the feature extraction capability. The Channel Attention Module (CAM) calculates the importance weight of each channel in the feature map and weights it to the original feature map to generate the channel-enhanced feature F. c Then, the spatial attention module (SAM) weights the spatial dimension of the channel-enhanced feature map to further generate the spatially enhanced feature F s .

[0061] In step d, the algorithm enhances the feature F s First, F s Flattened into a feature vector and compared with the candidate category probability P of Stacking s Then, the final category prediction of each sample is calculated through the fully connected layer and the Softmax activation function.

[0062] Finally, the algorithm returns the predicted labels for all sessions As the final result of device identification.

Claims

1. A method for identifying terminal features of a power trading system based on machine learning, characterized in that: The implementation steps include: Step S1: Data collection: Use a network traffic collection tool to capture and discover data packets transmitted on the network interface and save them as pcap format files; Step S2: Data processing: The collected raw network traffic data is unstructured and needs to be preprocessed to extract useful information; Step S2.1: data parsing and filtering; Step S2.2: data segmentation; Step S3: Stacking ensemble learning: Stacking ensemble learning fuses the prediction results of multiple base learners to perform classification and prediction more accurately; Step S3.1: feature extraction; Step S3.2: Random Forest and XGBoost base classification; Input training dataset and test dataset, as well as two base classifiers: Random Forest RF and XGBoost, and a meta-classifier: Support Vector Machine SVM; The training dataset is divided into a training meta-dataset and a validation dataset for base classifier training and meta-feature generation. During the base classifier training phase, random forest and XGBoost are trained on the training meta-dataset to generate two base classifier models. Step S3.3: meta-classification; In the meta-feature generation phase, for each sample in the validation and test datasets, each base classifier is used to predict the category probability, and these probability values ​​are combined into a meta-feature vector; this step provides input features for subsequent meta-classifier training and testing; During the meta-classifier training phase, the support vector machine is trained on the meta-features of the validation data and their corresponding labels to generate the final meta-classifier model. Subsequently, during the testing phase, the meta-classifier predicts the class probability for each sample in the test dataset and selects the top class as the candidate class set based on the probability value. Finally, the algorithm returns a candidate class set for each test sample, which contains the corresponding class and its probability. Step S4: CBAM classification: Use the CBAM model to perform deep feature extraction and accurate classification on the images generated by the collected raw traffic data; S4.1, Feature Matrix Extraction; S4.2, 2D image conversion; After generating the feature matrix, it is converted into a two-dimensional image format. By zero-padding the feature matrix to a fixed size, a uniformly sized feature image is generated for input into the CNN model for processing. Each pixel in the image corresponds to a specific feature value of a specific data packet, and the pixel distribution pattern can reflect the communication behavior characteristics of the device. Through this image conversion, complex temporal features are embedded in a two-dimensional space, adapting to the convolution operation's sensitivity to local patterns. For candidate device categories identified by S3, their category labels are provided as additional input to the CBAM model along with the traffic image. S4.

3. CBAM classification.

2. A method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S1 is: Use network traffic collection tools to capture and analyze data packets transmitted on the network interface in real time, and save them as pcap format files for subsequent analysis; deploy multiple collection devices at key nodes to ensure that all communication data in the wide area network and local area network can be covered to minimize data loss.

3. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S2.1 is as follows: Parse and filter the pcap files saved by the collected data to remove irrelevant noise data.

4. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S2.2 is as follows: Data is segmented by session for subsequent feature extraction and analysis. A session refers to traffic with the same five-tuple information, namely source IP address, source port, destination IP address, destination port, and transport protocol. At the same time, data cleaning methods commonly used in supervised learning are used to handle missing values ​​by interpolation or filling. Duplicate data is directly deleted to avoid affecting model training. Outliers need to be detected and processed through statistical analysis or machine learning methods.

5. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S3.1 is as follows: Use network packet capture tools to extract protocol fields at each layer, and use protocol analysis tools to deeply parse specific fields of data packets, extract relevant information, and record it in a data set to form a feature set; the extracted plaintext traffic features are divided into three categories: protocol features, behavioral features, and extended features.

6. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S4.1 is as follows: Extract feature matrix from traffic of each session; These characteristics reflect the behavioral patterns and protocol distribution characteristics of device communications.

7. The method for identifying terminal features of a power trading system based on machine learning according to claim 1, characterized in that: The specific implementation process of step S4.3 is as follows: Through the preprocessing process, the raw traffic data is efficiently converted into an input form suitable for CBAM model processing, while retaining the key characteristics of device communication behavior; Combined with the candidate classification information provided by Stacking, the classification results are finally output.

Images