Power transaction service security risk prediction method and device based on timing detection

Abstract

The application provides a power transaction business security risk prediction method and device based on time sequence detection, the method comprises the following steps: preliminarily dividing linear time sequence data components from the time sequence data; using an autoregressive integrated moving average model to evaluate the linear fitting significance of the divided linear time sequence data components, and then generating a linear business security risk prediction result; performing residual error processing on the to-be-observed time sequence data and the time sequence data with linear fitting significance exceeding a preset threshold in the linear time sequence data components, to obtain nonlinear time sequence data components; using a multilayer stacked long short-term memory network to extract features from the nonlinear time sequence data components, and performing nonlinear prediction to generate a nonlinear business security risk prediction result; and comprehensively combining the linear business security risk prediction result and the nonlinear business security risk prediction result to obtain a final business security risk prediction result through an activation function.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security business security risk prediction, and in particular to a power transaction business security risk prediction method and device based on time series detection. BACKGROUND

[0002] In the Internet era, the power industry is in a period of rapid development. Emerging power businesses such as intelligent distributed power distribution automation, user-side demand response, and millisecond-level precise load control are booming, and various types of power grid equipment, power terminals, and electricity customers are experiencing explosive growth. The power transaction system is a core component of the modern power market, responsible for managing the transaction process between power supply and demand. With the growth of global energy demand and the advancement of energy system reform, the power market is gradually developing towards liberalization and competition. This change brings a more complex and dynamic market environment, but also new security risk challenges.

[0003] There is a large amount of transaction data, market data, and monitoring data in the power transaction system, involving multiple participants, multiple markets, and complex transaction structures. These complex structures bring uncertainty and complexity to business security risks in transactions, greatly increasing the difficulty of business security risk prediction. In order to reduce the risks that may occur in the network system, many researchers have adopted various network security technologies to predict business security risks in time series data over the past few decades.

[0004] The existing technology has the following problems: (1) Due to the complexity of users and network environment of the power transaction system network itself, it is difficult to conduct unified research on users and network environment; (2) The current various business security risk prediction models are insufficient in extracting different features in multivariate time series, and lack long-term dependence; (3) The limitations of single models have a great impact on prediction accuracy.

[0005] Therefore, how to design a more effective and accurate power transaction business security risk prediction method is a technical problem to be solved. SUMMARY

[0006] In view of this, the embodiments of the present application provide a power transaction business security risk prediction method and device based on time series detection to eliminate or improve one or more defects in the prior art.

[0007] One aspect of the present application provides a power transaction business security risk prediction method based on time series detection, which comprises the following steps: data preprocessing is performed on time series data to be observed in a power transaction system, and linear time series data components are preliminarily divided from the time series data; autoregressive integrated moving average model is used to evaluate the linear fitting significance of the divided linear time series data components, linear prediction is performed based on the time series data with linear fitting significance exceeding a preset threshold in the linear time series data components to generate a linear business security risk prediction result; residual processing is performed on the time series data to be observed and the time series data with linear fitting significance exceeding the preset threshold in the linear time series data components to obtain nonlinear time series data components; features are extracted from the nonlinear time series data components by using a multilayer stacked long short-term memory network, and nonlinear prediction is performed to generate a nonlinear business security risk prediction result; and the linear business security risk prediction result and the nonlinear business security risk prediction result are integrated to obtain a final business security risk prediction result through an activation function.

[0008] In some embodiments of the present application, the data preprocessing of the time series data to be observed comprises: converting a non-numeric data format into a numeric value, quantizing discrete data, and scaling the data to the [0, 1] interval for normalization.

[0009] In some embodiments of the present application, the evaluation of the linear fitting significance of the divided linear time series data components by using the autoregressive integrated moving average model comprises: performing stability test on the input linear time series data components, and performing difference operation on the time series data that fails the stability test to improve its stability; for the time series data that passes the stability test, evaluating the linear fitting significance of the divided linear time series data components by using an autoregressive model and a moving average model; wherein the autoregressive model is used to capture the autocorrelation of the time series data, the past time step observations are used to predict the current value, the moving average model is used to capture the moving average part of the time series data, the past time step errors are used to predict the current value, and the linear fitting significance is evaluated by comparing the predicted current value with the actual current value.

[0010] In some embodiments of the present application, before the features are extracted from the nonlinear time series data components by using the multilayer stacked long short-term memory network, the method further comprises: performing white noise detection by using a Ljung-Box module to evaluate the autocorrelation of the nonlinear time series data components obtained through the residual processing, and inputting the time series data passing the Ljung-Box module to the multilayer stacked long short-term memory network.

[0011] In some embodiments of the present application, the multi-layer stacked long short-term memory network comprises a first layer long short-term memory network, a second layer long short-term memory network and a third layer long short-term memory network, which contain a number of units sequentially decreasing by 2n times, and n is a positive integer; the method for extracting features from the nonlinear time series data components by using the multi-layer stacked long short-term memory network and generating nonlinear business security risk prediction results by nonlinear prediction comprises: extracting first-order features by using the first layer long short-term memory network; passing the output of the first layer long short-term memory network through a batch normalization layer and a Dropout layer, and extracting second-order features by using the second layer long short-term memory network; passing the output of the second layer long short-term memory network through a batch normalization layer and a Dropout layer, and extracting third-order features by using the third layer long short-term memory network; splicing the first-order features, the second-order features and the third-order features, and processing them through a full connection layer and an activation function to obtain the nonlinear business security risk prediction results.

[0012] In some embodiments of the present application, the method further comprises the steps of pre-training the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, and using a historical time series data with a preset length as a training set; for the training set used for training the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, the preprocessing step further comprises: copying the true values of the training set data, and moving the copied true values backward by one time period on the time gradient, and splicing the moved true values to the original data set.

[0013] In some embodiments of the present application, the method further comprises: acquiring time series data in a power trading environment in real time, and if it is monitored that the business security risk prediction result exceeds a preset threshold after obtaining the final business security risk prediction result through processing, an alarm is generated.

[0014] Corresponding to the above method, the present application also provides a power trading business security risk prediction device based on time series detection, which comprises a processor, a memory and a computer program / instruction stored on the memory, wherein the processor is used to execute the computer program / instruction, and when the computer program / instruction is executed, the device realizes the steps of the method in any one of the above embodiments.

[0015] Corresponding to the above method, the present application also provides a computer readable storage medium, which stores a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method in any one of the above embodiments are realized.

[0016] Corresponding to the above method, the present application also provides a computer program product, which comprises a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps of the method in any one of the above embodiments are realized.

[0017] The power transaction business security risk prediction method based on time sequence detection can evaluate the significance of linear time sequence data components through an autoregressive integrated moving average model, thereby selecting time sequence data with good linear fitting significance for linear prediction, performing nonlinear prediction on the remaining time sequence data as nonlinear time sequence data components through residual processing, thereby splitting the time sequence data into linear and nonlinear parts for prediction, and comprehensively obtaining the final business security risk prediction result.

[0018] Additional advantages, objects, and features of the application will be set forth in part by the description that follows, and will become apparent to those skilled in the art upon examination of the following figures and detailed description thereof or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the description and claims hereof as well as the appended drawings.

[0019] It will be understood by those skilled in the art that the objects and advantages of the present application can not be limited to the above specifically described, and the above and other objects that can be achieved by the present application will be more clearly understood according to the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0020] The drawings described herein are intended to provide further understanding of the present application, form a part of the application, and do not constitute a limitation of the present application. In the drawings:

[0021] Figure 1 The flow chart of the power transaction business security risk prediction method based on time sequence detection in an embodiment of the present application.

[0022] Figure 2 The structural schematic diagram of the LSTM module in an embodiment of the present application.

[0023] Figure 3 The structural schematic diagram of the AR-LSTM algorithm in an embodiment of the present application.

[0024] Figure 4 The structural schematic diagram of the three-layer stacked LSTM network in an embodiment of the present application.

[0025] Figure 5 The structural schematic diagram of the computer device included in the power transaction business security risk prediction device based on time sequence detection in an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description will be made to the present application with reference to the embodiments and drawings. Herein, the illustrative embodiments of the present application and the description thereof are used to explain the present application, but not as a limitation to the present application.

[0027] Herein, it is also needed to be explained that, in order to avoid the present application being obscured by unnecessary details, only the structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0028] It should be emphasized that the term "comprises / comprising" when used in this text means the presence of a feature, element, step or component, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0029] Herein, it is also needed to be explained that, if not specially stated, the term "connection" in this text can not only mean direct connection, but also mean indirect connection with intermediate.

[0030] Hereinafter, the embodiments of the present application will be described with reference to the drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0031] The service security risk prediction model based on time series detection is based on past time series to make prediction, to judge whether the newly observed time series data is different or the same as the past, compared with the single time point anomaly prediction, the time series anomaly value is more associated with a whole subsequence, these methods in the threshold selection of anomaly can be roughly divided into two categories: the first category is the way of experience threshold selection, this way is through the field of expert knowledge and experience to judge the abnormal range and select threshold, the subsequent threshold change is also by artificial; the other category is the dynamic threshold selection method, the threshold changes according to the algorithm and specific data.

[0032] The time series data-based business security risk detection method based on experience threshold selection can be roughly divided into three categories: distance-based, classification-based and prediction-based. The most representative method is K nearest neighbor algorithm (KNN), which is a distance-based algorithm for classification and regression problems. In the KNN algorithm, each data sample is calculated based on the average distance between the sample and other samples to obtain an anomaly score. If the anomaly score exceeds the set threshold, the sample is considered to be an abnormal sample. The time series data business security risk detection method based on dynamic threshold selection includes various deep neural network models, such as AE (autoencoder) and VAE (variational autoencoder) deep generative models. Many researchers have studied and improved neural networks and generative models, such as SPOT and DSPOT algorithms, which initialize about 1000 data points and calculate the anomaly threshold in the flow data by statistics. Now, the prediction method based on time series data combined with the gradually developed neural network in the network security system has been widely used. By learning the time dependence and the relationship between variables, the information with business security risk can be analyzed and predicted more effectively and accurately. Alternatively, the business security risk detection model can also select KNN, RF, SGAD-GAN, SPOT and DSPOT algorithms.

[0033] Based on the above analysis, an ideal power transaction system business security risk prediction method should achieve the following design goals: (1) to realize the statistical analysis of power transaction system network flow time series data; (2) to maintain high accuracy of abnormal data prediction in complex transaction network environment; (3) to conduct real-time detection of time series data including network flow data and to produce alarm when there is a trend of abnormal data.

[0034] Therefore, the present application proposes a more effective and higher prediction accuracy business security risk prediction method based on the current business security risk monitoring framework. In the power transaction environment, LSTM and ARIMA algorithms are combined for business security risk prediction, aiming to optimize the business security risk detection effect in complex network flow environment, and the business security risk detection performance of the method under different conditions is evaluated through actual experiment simulation.

[0035] The network environment and network users in the power transaction system are highly complex, making it difficult to study users and network environment uniformly. At the same time, various business security risk prediction models do not adequately extract different features in multivariate time series and lack long-span time dependence. Finally, the limitations of single model have a great impact on prediction accuracy. Therefore, a more effective and higher prediction accuracy business security risk prediction method needs to be designed based on the current business security risk monitoring framework.

[0036] The application provides a power transaction business security risk prediction method and device based on time sequence detection, and the key innovation points are as follows: (1) the ARIMA and multilayer LSTM network are combined into an AR-LSTM model by using window feature preprocessing and linear and nonlinear filtering to capture the space-time correlation of time sequence data, and the linear mode and the nonlinear mode of the time sequence data are distinguished by adopting the combined model; (2) the significance of the entire data is tested by Ljung-Box, so as to judge whether the ARIMA model itself can significantly and effectively fit the sequence information, and the time sequence data after fitting is subjected to Ljung-Box white noise detection, so that the nonlinear mode can be screened out; (3) the nonlinear mode is given to the multilayer LSTM for processing, and through the combined network structure and linear and nonlinear mode filtering, the long-term change trend of the time sequence can be obtained, and the space-time correlation between the sequence variables can also be captured.

[0037] The above key innovation points make the scheme more suitable for processing time sequence data with complex data characteristics, and the processing result has high accuracy.

[0038] Figure 1 The application provides a power transaction business security risk prediction method based on time sequence detection, and the application provides a flowchart of the power transaction business security risk prediction method based on time sequence detection. The power transaction business security risk prediction method based on time sequence detection comprises the following steps:

[0039] Step S110: data preprocessing is performed on time sequence data to be observed in a power transaction system, and linear time sequence data components are preliminarily divided from the time sequence data.

[0040] In the specific implementation process, in the power transaction system, the time sequence data comprises time sequence flow data and / or time sequence business data, and whether there is a business security risk in the power transaction system is predicted based on the time sequence data related to the business in the power transaction system.

[0041] Step S120: the linear fitting significance of the divided linear time sequence data components is evaluated by using an autoregressive integrated moving average model, and a linear business security risk prediction result is generated by performing linear prediction based on the time sequence data with linear fitting significance exceeding a preset threshold in the linear time sequence data components.

[0042] Step S130: residual processing is performed on the time sequence data to be observed and the time sequence data with linear fitting significance exceeding the preset threshold in the linear time sequence data components, and a nonlinear time sequence data component is obtained.

[0043] Step S140: features are extracted from the nonlinear time series data components by using a multi-layer stacked long short-term memory network, and a nonlinear prediction is performed to generate a nonlinear business security risk prediction result.

[0044] Step S150: the linear business security risk prediction result and the nonlinear business security risk prediction result are integrated, and a final business security risk prediction result is obtained through an activation function.

[0045] The power transaction business security risk prediction method based on time series detection provided in the application can evaluate the significance of linear time series data components by using an autoregressive integrated moving average model, so that only time series data with good linear fitting significance is selected for linear prediction, and the remaining time series data is processed as nonlinear time series data components for nonlinear prediction, so that the time series data is divided into linear and nonlinear parts for prediction, and the final business security risk prediction result is obtained by integration. It is beneficial to improve the accuracy of the prediction result, and it is beneficial to avoid the influence between data with different correlations by dividing into linear and nonlinear parts.

[0046] In some embodiments of the application, the data preprocessing of the time series data to be observed includes: converting the data format of non-numeric type to numeric type, quantizing the discrete data, and scaling the data to the interval [0, 1] for normalization.

[0047] In the specific implementation process, the time series data is preprocessed by using window feature preprocessing. When processing time series data, a continuous time data can be divided into multiple fixed length windows, and each window represents an independent sample. In this way, the dynamic characteristics of data changing over time can be captured, and the data is more suitable for subsequent feature extraction and model training.

[0048] By using this embodiment, the training set, test set or time series data to be observed can be preprocessed in advance, and the preprocessed time series data is beneficial to subsequent efficient model training and feature extraction, and is beneficial to realize fast business security risk prediction.

[0049] In some embodiments of the present application, the step S120 of evaluating the linear fitting significance of the divided linear time series data component by using the autoregressive integrated moving average model comprises: performing a stability test on the input linear time series data component, and performing a difference operation on the time series data that fails the stability test to improve the stability thereof; and for the time series data that passes the stability test, evaluating the linear fitting significance of the divided linear time series data component by using an autoregressive model and a moving average model. The autoregressive model is used to capture the autocorrelation of the time series data, and the past time steps of observations are used to predict the current value, while the moving average model is used to capture the moving average part of the time series data, and the past time steps of errors are used to predict the current value, and the linear fitting significance is evaluated by comparing the predicted current value with the actual current value.

[0050] By using this embodiment, the linear fitting significance of the linear time series data component can be evaluated by using the autoregressive integrated moving average model, and the stability of the time series data can be improved by the difference operation.

[0051] In some embodiments of the present application, before the feature is extracted from the nonlinear time series data component by using the multi-layer stacked long short-term memory network, the method further comprises: performing white noise detection by using a Ljung-Box module to evaluate the autocorrelation of the nonlinear time series data component obtained after the residual processing, and inputting the time series data passing the Ljung-Box module to the multi-layer stacked long short-term memory network.

[0052] By using this embodiment, the autocorrelation of the nonlinear time series data component can be detected by using the Ljung-Box module, the linear relationship between the values of the time series at different time points can be measured, and the extraction effect of the nonlinear time series data component can be verified, which is beneficial to guarantee the accuracy of the nonlinear prediction.

[0053] In some embodiments of the present application, the multi-layer stacked long short-term memory network comprises a first layer long short-term memory network, a second layer long short-term memory network and a third layer long short-term memory network, which contain the number of units sequentially decreasing by 2n times, and n is a positive integer. In another embodiment of the present application, the number of units of the first layer long short-term memory network, the second layer long short-term memory network and the third layer long short-term memory network can sequentially decrease by or 2n times. n

[0054] ​Correspondingly, the feature is extracted from the nonlinear time series data component by using the multi-layer stacked long short-term memory network, and a nonlinear prediction is generated to generate a nonlinear business security risk prediction result, including: (1) extracting a first-order feature by using a first layer long short-term memory network; (2) the output of the first layer long short-term memory network is processed through a batch normalization layer and a Dropout layer, and a second layer long short-term memory network is used to extract a second-order feature; (3) the output of the second layer long short-term memory network is processed through a batch normalization layer and a Dropout layer, and a third layer long short-term memory network is used to extract a third-order feature; (4) the first-order feature, the second-order feature and the third-order feature are spliced, and processed through a full connection layer and an activation function to obtain the nonlinear business security risk prediction result.

[0055] By using the embodiment, the feature extraction can be performed by using the multi-layer long short-term memory network with decreasing scale, and the problems of easy overfitting and weak feature adaptability of the single-layer LSTM network can be solved. The robustness of the model itself is enhanced and the risk of overfitting of the model is reduced by using the batch normalization layer and the Dropout layer, and the accuracy of the business security risk prediction result is improved.

[0056] In some embodiments of the present application, the method further comprises the steps of: pre-training the autoregressive integral moving average model and the multi-layer stacked long short-term memory network, and using a historical time series data with a preset length as a training set; and for the training set used for training the autoregressive integral moving average model and the multi-layer stacked long short-term memory network, the preprocessing step further comprises: copying the true value of the training set data, and moving the copied true value backward by one time period on the time gradient, and splicing the moved true value to the original data set.

[0057] By using the embodiment, the autoregressive integral moving average model and the multi-layer stacked long short-term memory network can be pre-trained based on the historical data, and the required time length in the test phase and the actual business security risk prediction phase can be saved.

[0058] In some embodiments of the present application, the method further comprises: acquiring time series data in a power transaction environment in real time, and generating an alarm if it is monitored that the business security risk prediction result exceeds a preset threshold after obtaining the final business security risk prediction result.

[0059] By using the embodiment, the abnormal situation of the business security risk existing in the power transaction environment can be detected, and the detection effect of the business security risk in the complex network flow environment can be optimized.

[0060] In some embodiments of the present application, the Long Short-Term Memory (LSTM) network adopted by the multi-layer stacked long short-term memory network is a kind of RNN, and the general recurrent neural network has a chain form of repeated neural network, so it is very effective in processing long sequence data, but when the data sample is too large, the recurrent neural network is prone to gradient disappearance or explosion problems in learning and training, and the long short-term memory module (LSTM module) is used in the long short-term memory network to overcome the above problems existing in the general recurrent neural network.

[0061] Figure 2 The structure diagram of the LSTM module in an embodiment of the present application is shown. The LSTM module controls the input and output information through a designed threshold structure, and adds three threshold functions (input gate, output gate and forget gate) to control the flow process of information on the basis of RNN, and the structure is as shown in Figure 2 .

[0062] Among them, and are the input and output of the memory cell at time t, respectively. The state value of the next cell represents the state value of the next cell. The forget gate is responsible for clearing the information that needs to be forgotten in the last memory cell ; the input gate is responsible for calculating and deciding the update value and the state of the next cell . Through the calculation of the forget gate, the input gate and , the required state value can be continuously transmitted down; The output value of the cell is calculated and decided by the output gate .

[0063] The calculation method of each threshold function is as follows:

[0064] ;

[0065] Among them, is the activation function of each gate, is the candidate state at time t, is the corresponding weight matrix, is the corresponding bias term, and tanh is the activation function.

[0066] In some embodiments of the present application, the ARIMA model used combines an autoregressive (AR) model, a difference (I) model and a moving average (MA) model. The model is generally expressed in the form of .

[0067] The working process of the ARIMA model includes: (1) Since the time series data can have non-stationarity (mean, variance or autocorrelation changes over time), the ARIMA model performs difference (I) operation to obtain stationary time series data; (2) For time series data that meet the requirements of the stability test, the autoregressive (AR) model is used to capture the autocorrelation of the time series data, and the observation value at the past time step is used to predict the current value; (3) The ARIMA model attempts to capture the moving average (MA) part of the time series data, and uses the error (the difference between the observation value and the previous predicted value) at the past time step to predict the current value.

[0068] The ARIMA model first performs d-order difference on the original sequence , denoted as , to make the original sequence stationary. Then, in the autoregressive process of ARIMA, the data amount at the current time is only related to the data amount at the previous time and the disturbance at the current time, which can be expressed as , where is the value at the current time, is a constant term, is an autocorrelation coefficient, is a disturbance term at the time, is the autoregressive order. In the moving average model of ARIMA, the data amount at the current time is related to the disturbance entering the system at the previous time, so it is necessary to perform moving average on the error term, which can be expressed as , where is the moving average coefficient, is the moving average order. ARIMA combines the above steps to establish the relationship between the current time data and the historical data and the model disturbance, and the overall expression is: .

[0069] Figure 3 is the structural diagram of the AR-LSTM algorithm in an embodiment of the present application. In the specific implementation process, in order to achieve the design goal of the ideal power transaction system business security risk prediction method, the present application proposes a business security risk prediction method combining LSTM and ARIMA in the power transaction environment, and defines the business security risk prediction algorithm as AR-LSTM algorithm. The specific process of the method is as followsFigure 3 The application is shown.

[0070] In Figure 3 The application is shown. The method comprises the following steps:

[0071] (1) Model preprocessing. Before applying the AR-LSTM-based business security risk prediction method, data preprocessing operations need to be performed on the training set and the test set. Data preprocessing includes the following: (1) First, format conversion is performed on all non-numeric data, for example, data such as protocol, state, and attack type are encoded and converted to floating-point type, and all discrete data are quantized to make the features easier to analyze and process. (2) Normalize all data to the [0, 1] interval to improve the accuracy and convergence speed of the model. (3) The true value of the training set data is copied and moved back by one time period on the time gradient, and is spliced to the original data set as a new true value. That is, for any time , assuming that the original data set has dimensional features, the original data ~ is taken as input, and the last column is taken as output data, to obtain a training data set with closer time relationships.

[0072] During the feature preprocessing stage, linear and nonlinear mode division is performed. Generally, time series data can be considered as a set of random variables that only vary with time, and is composed of linear time series data components and nonlinear time series data components , which can be represented as After output feature analysis and optimization, the linear time series data components and the nonlinear time series data components are obtained.

[0073] (2) The ARIMA module in the AR-LSTM model predicts based on the linear time series data components to obtain the linearly fitted significant time series data , which is based on and obtains linear business security risk prediction results through parameter estimation, model diagnosis, and classification prediction. and the nonlinear part of the time series data component obtained after residual calculation, whose calculation formula is AR, MA in ARIMA are linear models, linear mode information can be easily obtained from time series, ARIMA model can perform significance test on the whole data to determine whether the ARIMA model itself can significantly and effectively fit the sequence information, after fitting the sequence, linear components in the data can be screened out and prediction results can be obtained, and only nonlinear time series data is reserved in the residual part of the model .

[0074] (3) Ljung-Box white noise detection. The nonlinear time series data is subjected to Ljung-Box white noise detection to determine whether the sequence calculated by the residual is a white noise sequence to determine whether the nonlinear information is successfully extracted. Ljung-Box white noise detection is a detection step, is a residual sequence that has not been detected, if the detection is passed, the symbol is modified to . The statistical quantity calculation formula of Ljung-Box test is: . Wherein is the sample capacity of input, is the set range, is the autocorrelation coefficient of order. When the calculated , it is indicated that the residual sequence is a white noise sequence, and the fitting effect of the ARIMA model on the linear sequence is good; on the contrary, when , it is indicated that the nonlinear information extraction effect is not good.

[0075] (4) The nonlinear mode time series data that has passed the Ljung-Box white noise detection is taken as the input of the multi-layer stacked LSTM network to optimize feature extraction, and the output nonlinear business security risk prediction result .

[0076] (5) Finally, the output of the ARIMA module and the output of the LSTM module are added, and the classification prediction result is obtained through the activation function ReLU and the Softmax layer . The calculation formula is .

[0077] In the specific implementation process, the three-layer stacked LSTM network can be used to optimize the LSTM model, which is beneficial to solve the problems of easy overfitting and weak feature adaptability of the single-layer LSTM network, and the structure is as shown in Figure 4 , and Figure 4 is a structure diagram of a three-layer stacked LSTM network in an embodiment of the application.

[0078] Figure 4 The process shown includes: passing the residual sequence detected that is, the nonlinear time series data component) is first passed through a first layer LSTM containing 256 units to obtain a first-order feature; then the feature output is optimized through a batch normalization layer and a Dropout layer to enhance the robustness of the model itself and reduce the risk of model overfitting, and the optimized data is transmitted to a second layer LSTM containing 128 units to obtain a second-order feature; similarly, after optimization through a batch normalization layer and a Dropout layer again, the data is transmitted to a third LSTM layer containing 64 units to obtain a third-order feature. The first-order feature, the second-order feature and the third-order feature are finally transmitted to a fully connected layer to obtain a 32-dimensional feature, and finally a layer of Softmax is used for classification to extract a vector with a dimension equal to the number of target classes, obtaining a nonlinear business security risk prediction result .

[0079] In addition, since the prediction model is a classification prediction model, the nonlinear business security risk prediction result may also be referred to as a nonlinear abnormal traffic classification prediction result or an abnormal traffic classification prediction result, and further, the classification prediction model can be a binary classification prediction model.

[0080] The above, the power transaction business security risk prediction method and device based on time series detection proposed by the application combines the autoregressive integrated moving average model ARIMA and the multi-layer stacked long short-term memory network Multi-LSTM, and the whole is named as the AR-LSTM model. Compared with the prior art, the AR-LSTM model can improve the accuracy, precision, recall rate and root mean square error of the binary classification detection result and the multi-classification detection result.

[0081] The power transaction business security risk prediction method based on time series detection proposed by the application can evaluate the significance of linear time series data components through the autoregressive integrated moving average model, so as to select only the time series data with good linear fitting significance for linear prediction, and the remaining time series data is processed through residual to be nonlinearly predicted as nonlinear time series data components, so as to split the time series data into linear and nonlinear parts for prediction respectively, and obtain the final business security risk prediction result. It is beneficial to improve the accuracy of the prediction result, and splitting into linear and nonlinear parts is beneficial to avoid the influence between data with different correlations.

[0082] ​To further verify the performance of the AR-LSTM model proposed in the scheme, a control is set through a simulation experiment. The public data set UNSW-NB15 includes a total of nine data flow types that exist business security risks, and after the AR-LSTM model is trained through the pytorch training framework, detailed testing is performed in the data set UNSW-NB15. The specific testing process is as follows:

[0083] First, the nine attacks in the data set are combined as traffic that exists business security risks, and are distinguished from normal traffic as a binary classification comparison experiment, in which the AR-LSTM method achieves the highest accuracy of 93.56%, while the original LSTM network structure without modification achieves a detection accuracy of only 86.35%, and the AR-LSTM model has excellent classification effect; and in a multi-classification comparison experiment of the nine data flow types that exist business security risks and the normal type in the data set, the prediction accuracy of the AR-LSTM method is also higher than that of other methods of the same type, reaching 87.38%.

[0084] The experimental results show that, compared with other time series detection-based security risk prediction schemes, AR-LSTM is more suitable for processing complex multi-element time series flow data such as UNSW-NB15, and is more suitable for the more complex network environment and higher-dimensional data flow in the current power trading system. Therefore, in summary, the AR-LSTM method is an efficient, excellent classification effect and suitable for complex network environment business security risk prediction method in the power trading system.

[0085] Corresponding to the above method, the application also provides a time series detection-based power transaction business security risk prediction device, which comprises a computer device, the computer device comprising a processor and a memory, the memory storing computer instructions, and the processor being configured to execute the computer instructions stored in the memory, so that the system implements the steps of the method as described above.

[0086] Figure 5 The computer device structure diagram of the time series detection-based power transaction business security risk prediction device in an embodiment of the application. Referring to Figure 5 , the computer device 00 comprises a processor 01, a memory 02, and a computer program stored in the memory 02 and executable on the processor 01, and the processor 01 executes the computer program to implement the human data server access control method provided by the above method embodiment.

[0087] The processor 01 and the memory 02 are connected, such as connected through a bus 03. The processor 01 can be a CPU (Central Processing Unit), a general processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic device, transistor logic device, hardware component or any combination thereof. It can implement or execute various exemplary logical blocks, modules and circuits described in combination with the disclosure. The processor 01 can also be a combination of computing functions, such as including one or more microprocessor combinations, combinations of DSP and microprocessor, etc. The bus 03 can include a channel for transmitting information between the above components. The bus 03 can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 130 can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Figure 5 The memory 02 is used to store a computer program corresponding to the human data server access control method of the above-mentioned embodiments of the present application, which is controlled and executed by the processor 01. The processor 01 is used to execute the computer program stored in the memory 02 to realize the content shown in the above-mentioned method embodiments.

[0088] Corresponding to the above-mentioned method, the present application also provides a computer readable storage medium, which stores a computer program / instruction, and the computer program / instruction is executed by the processor to realize the steps of the method described in any one of the above embodiments. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0089] Corresponding to the above-mentioned method, the present application also provides a computer program product, which includes a computer program / instruction, and the computer program / instruction is executed by the processor to realize the steps of the method described in any one of the above embodiments.

[0090] Those of ordinary skill in the art will appreciate that the various illustrative components, systems and methods described in connection with the embodiments disclosed herein can be implemented as hardware, software, or both. The particular implementation is dependent on the specific application and design constraints imposed on the overall system. Skilled persons can implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application. When implemented in hardware, for example, the hardware can comprise an electronic circuit, an Application Specific Integrated Circuit (ASIC), a suitable firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the application are the program or code segments to perform a specific task. The program or code segments can be stored in a machine-readable medium, or transmitted by a carrier wave as data signals over a transmission medium or communication link.

[0091] It is to be understood that the application is not limited to the particular configurations and processes described herein and shown in the drawings, which can be varied in accordance with the particular needs of the application. For the sake of brevity, conventional techniques and methods related to making and using the application can not be described in detail herein. In the above embodiments, several specific steps are described and illustrated in order to provide a thorough understanding of the present application. However, the process of the present application can be practiced with less than all of the described specific steps, or with additional steps, or with variations of the described steps, without departing from the spirit and scope of the present application.

[0092] In the present application, features described and / or illustrated in connection with one embodiment can be used in the same or a similar way or in conjunction with or in place of features of another embodiment.

[0093] The above description is only preferred embodiments of the present application, not for limiting the present application. The embodiments of the present application can be variously changed and / or modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of the present application.

Claims

1. A time-series detection-based security risk prediction method for power transaction services, characterized in that, The method comprises the following steps: data preprocessing is performed on time series data to be observed in a power transaction system, and a linear time series data component is preliminarily divided from the time series data; linear fitting significance of the divided linear time series data component is evaluated by using an autoregressive integrated moving average model, and a linear prediction is generated based on time series data with linear fitting significance exceeding a preset threshold in the linear time series data component to obtain a linear business security risk prediction result; residual processing is performed on the time series data to be observed and the time series data with linear fitting significance exceeding the preset threshold in the linear time series data component to obtain a nonlinear time series data component; features are extracted from the nonlinear time series data component by using a multilayer stacked long short-term memory network, and a nonlinear prediction is generated to obtain a nonlinear business security risk prediction result; the linear business security risk prediction result and the nonlinear business security risk prediction result are integrated, and an activation function is used to obtain a final business security risk prediction result; the linear fitting significance of the divided linear time series data component is evaluated by using an autoregressive integrated moving average model, which comprises the following steps: stability testing is performed on the input linear time series data component, and for time series data that fails the stability testing, a difference operation is performed to improve the stability thereof; for time series data that passes the stability testing, the linear fitting significance of the divided linear time series data component is evaluated by using an autoregressive model and a moving average model; wherein the autoregressive model is used to capture the autocorrelation of the time series data, and the past time step observation values are used to predict the current value; the moving average model is used to capture the moving average part of the time series data, and the past time step errors are used to predict the current value; and the linear fitting significance is evaluated by comparing the predicted current value with the actual current value.

2. The method of claim 1, wherein, The data preprocessing of the time series data to be observed comprises the following steps: converting the data format of non-numeric data into numeric data, quantifying the discrete data, and scaling the data to the interval [0, 1] for normalization.

3. The method of claim 1, wherein, Before the features are extracted from the nonlinear time series data component by using the multilayer stacked long short-term memory network, the method further comprises the following steps: white noise detection is performed by using a Ljung-Box module to evaluate the autocorrelation of the nonlinear time series data component obtained through the residual processing, and time series data passing the Ljung-Box module is input into the multilayer stacked long short-term memory network.

4. The method of claim 1, wherein, The multilayer stacked long short-term memory network comprises a first layer long short-term memory network, a second layer long short-term memory network and a third layer long short-term memory network, which have a number of units sequentially decreasing by 2n times, and n is a positive integer; the features are extracted from the nonlinear time series data component by using the first layer long short-term memory network, and a nonlinear prediction is generated to obtain a nonlinear business security risk prediction result, which comprises the following steps: first-order features are extracted by using the first layer long short-term memory network; The output of the first layer of long short-term memory network is subjected to a batch normalization layer and a Dropout layer, and a second layer of long short-term memory network is used to extract second-order features; The output of the second layer of long short-term memory network is subjected to a batch normalization layer and a Dropout layer, and a third layer of long short-term memory network is used to extract third-order features; The first-order features, the second-order features and the third-order features are spliced, and subjected to a full connection layer and an activation function to obtain a nonlinear business security risk prediction result.

5. The method of claim 1, wherein, The method further comprises: The steps of pre-training the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network use a historical time series data with a preset length as a training set; For the training set used to train the autoregressive integrated moving average model and the multi-layer stacked long short-term memory network, the preprocessing step further comprises: copying the true value of the training set data, and moving the true value backward by one time period on the time gradient, and splicing the moved true value to the original data set.

6. The method of claim 1, wherein, The method further comprises: acquiring time series data in a power transaction environment in real time, and after obtaining the final business security risk prediction result through processing, if it is monitored that the business security risk prediction result exceeds a preset threshold, an alarm is generated. 7.A time-series detection based power transaction service security risk prediction apparatus comprising a processor, a memory and computer programs / instructions stored on the memory, wherein, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the method according to any one of claims 1 to 6.

8. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instructions, when executed by the processor, implement the steps of the method according to any one of claims 1 to 6.

9. A computer program product comprising computer programs / instructions, characterized in that, The computer program / instructions, when executed by the processor, implement the steps of the method according to any one of claims 1 to 6. The computer program / instructions, when executed by the processor, implement the steps of the method according to any one of claims 1 to 6.

Images