Power distribution network attack detection method based on artificial intelligence, medium and terminal

Abstract

The invention is suitable for the technical field of power distribution network security, and relates to a power distribution network attack detection method based on artificial intelligence, a medium and a terminal, and the method comprises the steps: S10, carrying out the preprocessing of data, unifying the dimension, and removing useless data; s20, using a two-stage deep learning model to realize learning of data features, using a conditional variation auto-encoder to realize effective classification of known category traffic, and based on a classification result, using a support vector description algorithm to screen out outlier samples; s30, taking the distance between the samples in the feature space and the centroid as a scoring mechanism, and judging samples beyond a threshold set by the scoring mechanism as unknown attacks; and S40, integrating experimental results from the step S10 to the step S30, and realizing fine-grained classification of flow of a known category in the power distribution network data and effective detection of an unknown attack type. The unknown attack of the power distribution network is detected by using the existing data, and the detection efficiency and the safety of the power distribution network are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of distribution network cybersecurity, and particularly relates to a method, medium, and terminal for detecting attacks on a distribution network based on artificial intelligence. Background Art

[0002] In order to achieve the digital transformation and upgrading of the distribution network, more and more intelligent devices are applied to the distribution network, which results in the characteristics of multi-source heterogeneity of the distribution network data. At the same time, this also provides a path for criminals to launch cyberattacks on the distribution network. Attackers may secretly launch attacks on the distribution network system through the distribution communication network, such as injecting malicious software such as worm viruses and Trojan programs, which may cause the information receiving terminal at the distribution end to be unable to receive the control instructions from the master station, and further damage the distribution facilities.

[0003] Intrusion detection technology is an effective means of network security defense. By monitoring the network status and detecting communication traffic data, it realizes the isolation of dangerous data. The existing intrusion detection technology mainly uses deep learning technology to capture the underlying texture features and high-level semantic features of network traffic and detect network attack data. However, most of the existing intrusion detection technologies rely on rich prior information, that is, a large-scale data set is required. In addition, this model relying on prior information can only detect the existing attack types in the data set and cannot detect new unknown attacks, with low detection efficiency and insufficient distribution network security. The patent with the publication number CN113904846B provides a multi-stage intrusion detection method combining a Gaussian mixture model and ranking learning, including S1 obtaining malicious intrusion traffic data to obtain a network traffic feature data set; S2 dividing the network traffic feature data set and extracting the optimal features; S3 predicting the prior information set to obtain the misclassified samples and the overlapping sample distribution; S4 matching the feature values of the misclassified samples with the optimal feature test set and obtaining the first-stage prediction result through model prediction; S5 combining the misclassified sample distribution to obtain overlapping samples and non-overlapping samples, formulating a prediction label for the overlapping samples based on the prior information of the overlapping samples, and obtaining the second-stage prediction result; S6 classifying and predicting the non-overlapping samples to obtain the first splicing vector; S7 predicting the first splicing vector through a ranking learning model to obtain the third-stage prediction result. This patent relies on prior information for intrusion detection and cannot detect unknown attacks, having the same drawbacks as the existing technology.

[0004] Therefore, how to use the existing data to detect unknown attacks on the distribution network to improve the detection efficiency and the security of the distribution network is an urgent problem to be solved by those skilled in the art. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of the present invention is to provide a distribution network attack detection method based on artificial intelligence, so as to solve the problem that the intrusion detection method in the prior art cannot use existing data to detect unknown attacks on the distribution network, resulting in low detection efficiency and distribution network security; in addition, the present invention also provides a distribution network attack detection medium and terminal based on artificial intelligence.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0007] In a first aspect, the present invention provides a distribution network attack detection method based on artificial intelligence, comprising the following steps:

[0008] S10, pre-process the data, unify the dimensions and eliminate useless data;

[0009] S20, use a two-stage deep learning model to learn data features, use conditional variational autoencoders to effectively classify known types of traffic, and use support vector description algorithms to filter out outlier samples based on the classification results;

[0010] S30, using the distance between the sample and the centroid in the feature space as a scoring mechanism, and identifying samples outside the threshold set by the scoring mechanism as unknown attacks;

[0011] S40, integrating the experimental results of step S10 to step S30 to achieve fine-grained classification of known types of traffic in the distribution network data and effective detection of unknown attack types.

[0012] Furthermore, the specific steps in step S10 are as follows:

[0013] S101. Use the Pandas library in Python to process the data, replace missing values ​​with zero filling, and replace infinity with mean filling;

[0014] S102, use Min-Max normalization to avoid some features having too much influence in model training due to their large value range;

[0015] S103. Use the random forest algorithm in machine learning to build multiple decision trees and summarize the prediction results.

[0016] Furthermore, in step S20, the first stage model uses the sample data processed by step S10 as the input of the model, and uses the deep learning model to learn key features that are strongly correlated with the sample classification performance.

[0017] Furthermore, the conditional variational autoencoder includes a prior network, an identification network, and a classification network. The purpose of the prior network and the identification network is to learn the latent variable space of the samples. The conditional variational autoencoder uses the KL divergence to measure the difference between the two latent variable spaces. The purpose of the classification network is to achieve accurate classification of the samples. In deep learning, the cross-entropy loss is used as the loss function. By combining the KL divergence and the cross-entropy loss as the combined loss function and using the Adam gradient update function, the model is trained until the model converges to achieve accurate classification of the known sample data.

[0018] Furthermore, in the second-stage model, anomalies are detected by setting a threshold for the reconstruction error. By introducing the deep support vector description algorithm, a hypersphere with a radius of R is learned, and the outlier anomalies are isolated outside the hypersphere.

[0019] Furthermore, on the basis of the original reconstruction error, the Deep SVDD loss is introduced to increase the difference between the unknown class traffic and the known class traffic by fitting the hypersphere. Then, according to the sample data distribution after fitting by the hypersphere, the known class traffic and the unknown class traffic are distinguished.

[0020] Furthermore, in step S30, the formula of the scoring mechanism is as follows:

[0021] S(x i )=||μ(x i ,y i )-c||;

[0022] where μ(x i ,y i ) is the sample feature space learned by the model, and c is the centroid of the hypersphere fitted by the Deep SVDD algorithm.

[0023] Furthermore, compared with the known classes, the anomaly scores of the unknown classes show an outlier state, and the unknown classes are effectively detected by setting an appropriate threshold for the anomaly score set.

[0024] In a second aspect, the present invention also provides a computer-readable storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0025] In a third aspect, the present invention also provides an electronic terminal, including: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory so that the terminal executes the method described above.

[0026] Compared with the prior art, the power distribution network attack detection method, medium, and terminal based on artificial intelligence provided by the present invention have at least the following beneficial effects:

[0027] Most existing intrusion detection technologies rely on rich prior information, that is, a large-scale dataset is required. In addition, the model relying on prior information can only detect the existing attack types in the dataset and cannot detect new unknown attacks, resulting in low detection efficiency and insufficient security of the distribution network. The process of the present invention is simple and easy to operate. Aiming at the deficiency of active defense measures against network attacks in the distribution network, a new two-stage network model is proposed using conditional variational autoencoders to achieve effective classification of known category traffic and effective detection of unknown type traffic. Aiming at the characteristics of multi-source heterogeneous traffic data in the distribution network, the Pandas function library and random forest algorithm are used to clean the data and screen features, removing redundant features and retaining features strongly related to classification performance. A new scoring mechanism is proposed by combining the deep support vector description algorithm, effectively solving the problem that the reconstruction ability of the generative network is too strong, resulting in too small a difference between the generated samples and the reconstructed samples. The whole invention effectively improves the detection efficiency and the security of the distribution network. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the solution of the present invention, the drawings required for the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0029] Figure 1 It is a flowchart of a distribution network attack detection method based on artificial intelligence provided by an embodiment of the present invention;

[0030] Figure 2 It is a logic diagram of a distribution network attack detection method based on artificial intelligence provided by an embodiment of the present invention;

[0031] Figure 3 It is a general block diagram of a two-stage model in a distribution network attack detection method based on artificial intelligence provided by an embodiment of the present invention;

[0032] Figure 4 It is a schematic diagram of the DeepSVDD algorithm of a distribution network attack detection method based on artificial intelligence provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0033] To facilitate the understanding of the present invention, the present invention will be described more comprehensively below with reference to the relevant drawings. The preferred embodiments of the present invention are shown in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, these embodiments are provided to make the understanding of the disclosure of the present invention more thorough and comprehensive.

[0034] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which this invention belongs. The terms used in the description of the present invention herein are for the purpose of describing specific embodiments only and are not intended to limit the present invention.

[0035] The present invention provides an artificial intelligence-based distribution network attack detection method, which is applied to the detection process of new unknown attacks on the distribution network. The artificial intelligence-based distribution network attack detection method includes the following steps:

[0036] S10. Preprocess the data to unify the dimension and eliminate useless data; S20. Use a two-stage deep learning model to learn the data features, use a conditional variational autoencoder to effectively classify the known-class traffic, and based on the classification results, use a support vector description algorithm to screen out the outlier samples; S30. Use the distance between the samples and the centroid in the feature space as a scoring mechanism, and determine the samples outside the threshold set by the scoring mechanism as unknown attacks; S40. Integrate the experimental results of steps S10 to S30 to achieve fine-grained classification of the known-class traffic in the distribution network data and effective detection of unknown attack types.

[0037] The present invention uses the existing data to detect unknown attacks on the distribution network, improving the detection efficiency and the security of the distribution network.

[0038] To enable those skilled in the art to better understand the solution of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings.

[0039] The present invention provides an artificial intelligence-based distribution network attack detection method, which is applied to the detection process of new unknown attacks on the distribution network, in combination with Figures 1 to 4 , in this embodiment, the artificial intelligence-based distribution network attack detection method includes the following steps:

[0040] S10. Preprocess the data to unify the dimension and eliminate useless data.

[0041] Most of the existing network attack data are in two forms: Pcap packets and CSV files. In this embodiment, it mainly focuses on CSV-format samples, and the data feature is that each column represents a certain feature of the traffic. For example, timestamps, traffic five-tuples, and packet durations, etc. For sample files in this format, there are usually values such as missing values and infinity values that cannot be parsed by a computer. In response to this situation, in this embodiment, the Pandas function library in the Python language is used to process the data.

[0042] Specifically, in this embodiment, missing values are replaced by zero filling, and infinity is replaced by mean filling. Since the numerical ranges of different features of the samples may vary greatly, unifying the dimension can ensure the consistency of the input data. In this embodiment, Min-Max normalization is adopted to avoid certain features having too much influence on model training due to large numerical ranges. In the CSV-format samples, there are often redundant traffic features. To screen out features with greater relevance to classification, the Random Forest algorithm in machine learning is used in this embodiment. Random Forest improves the accuracy and robustness of the overall model by constructing multiple decision trees and aggregating their prediction results. This algorithm performs well when dealing with large amounts of data and features and is not prone to overfitting.

[0043] S20. Use a two-stage deep learning model to achieve learning of data features. The purpose of the first-stage model is to effectively classify known-category traffic using a Conditional Variational Autoencoder (CVAE). The conditional variational autoencoder includes a prior network, an identification network, and a classification network. The model first calculates the difference between the sample latent variable spaces generated by the prior network and the identification network respectively through the KL divergence to ensure that the generated latent variable space is an accurate representation of the samples. Then, the classification network is used and the cross-entropy loss function is utilized to achieve accurate classification of known categories; the purpose of the second-stage model is to effectively detect unknown attacks. Based on the classification results of the previous stage in this stage, the Support Vector Data Description (SVDD) algorithm is used to screen out outlier samples.

[0044] Specifically, in this embodiment, the first-stage model takes the sample data after data preprocessing as the input of the model, and uses the powerful feature learning ability of the deep learning model to learn the key features strongly related to the sample classification performance. The first-stage model adopts a conditional variational autoencoder as the feature learning model. CVAE is a generative model, including a prior network, an identification network, and a classification network. The purpose of the prior network and the identification network is to learn the latent variable space of the samples, which is an accurate representation of the sample data. The difference between the latent variable spaces learned by the two lies in the presence or absence of prior information. To ensure the accuracy of the learned latent variable space, CVAE uses the KL divergence to measure the difference between the two latent variable spaces. The purpose of the classification network is to achieve accurate classification of the samples. In deep learning, the cross-entropy loss is usually used as the loss function. By combining the KL divergence and the cross-entropy loss as the combined loss function and using the Adam gradient update function, the model is trained until the model converges to achieve accurate classification of the known sample data.

[0045] Furthermore, in this embodiment, since the model in the first stage lacks prior information on unknown-class traffic, unknown-class traffic will be misjudged as known classes. Therefore, the task of the second-stage model is to correct this error. For the misjudged unknown-class traffic, theoretically, a large reconstruction error will be generated during the training process of the second-stage model. By setting a threshold for the reconstruction error, anomalies can be detected. Due to the powerful representation ability of the generative model, both known and unknown samples in the data will be well reconstructed, that is, the calculated reconstruction errors may all be very low. To solve this problem, the second-stage model introduces the Deep Support Vector Data Description (Deep SVDD) algorithm to learn a hypersphere with a radius of R, isolating the outlier anomalies outside the hypersphere. The distance between the outlier and the centroid should be greater than that of the points inside the hypersphere. The Deep SVDD algorithm is a deep learning variant of the SVDD algorithm, and its feature learning module consists of several neural layers, which can effectively solve the problem of high-dimensional feature disappearance in the SVDD algorithm.

[0046] Specifically, the model in the second stage reuses the recognition network in the first stage and reconstructs samples through the generative network. To ensure the quality of the reconstructed samples, on the basis of the original reconstruction error, the Deep SVDD loss is introduced to increase the difference between unknown-class traffic and known-class traffic by fitting the hypersphere. Finally, according to the sample data distribution after fitting by the hypersphere, a new scoring function is used to distinguish between known-class traffic and unknown-class traffic.

[0047] S30: Use the distance between the sample and the centroid in the feature space as the scoring mechanism, and judge the samples outside the threshold set by the scoring mechanism as unknown attacks.

[0048] Specifically, in this embodiment, the traditional autoencoder anomaly detection model uses the reconstruction error as the scoring mechanism and realizes effective classification of known samples and anomaly samples by setting appropriate thresholds. In fact, due to the too strong reconstruction ability of the autoencoder and the widespread existence of data set pollution, it is usually difficult to achieve effective anomaly detection using the reconstruction error as the scoring mechanism. In this embodiment, the distance between the sample and the centroid in the feature space is used as the new scoring mechanism, and the formula is as follows:

[0049] S(x i )=||μ(x i ,y i )-c||;

[0050] Where, μ(x i ,y i) is the sample feature space learned by the model. c is the centroid of the hypersphere fitted by the Deep SVDD algorithm. Compared with the known classes, the anomaly scores of the unknown classes show an outlier state. By setting an appropriate threshold for the set of anomaly scores, effective detection of the unknown classes can be achieved.

[0051] S40. Integrate the experimental results of the two stages in steps S10 to S30 to achieve fine-grained classification of the known-class traffic in the distribution network data and effective detection of unknown attack types.

[0052] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, any one of the methods in this embodiment is implemented.

[0053] The embodiment of the present invention also provides an electronic terminal, including: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory so that the terminal executes any one of the methods in this embodiment.

[0054] For the computer-readable storage medium in this embodiment, those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to the computer program. The foregoing computer program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above method embodiments; and the foregoing storage medium includes: various media such as ROM, RAM, magnetic disk, or optical disc that can store program codes.

[0055] The electronic terminal provided in this embodiment includes a processor, a memory, a transceiver, and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication with each other. The memory is used to store a computer program, the communication interface is used for communication, and the processor and the transceiver are used to run the computer program so that the electronic terminal executes each step of the above method.

[0056] The method, medium, and terminal for detecting attacks on a distribution network based on artificial intelligence described in the above embodiments, compared with the prior art, most existing intrusion detection technologies rely on rich prior information, that is, a large-scale dataset is required. In addition, the models relying on prior information can only detect the existing attack types in the dataset and cannot detect new unknown attacks, resulting in low detection efficiency and insufficient security of the distribution network. The process of the present invention is simple and convenient to operate. Aiming at the deficiency of the active defense measures against network attacks in the distribution network, a new two-stage network model is proposed using conditional variational autoencoders to achieve effective classification of known-class traffic and effective detection of unknown-class traffic. Aiming at the characteristics of multi-source heterogeneous traffic data in the distribution network, the Pandas library and the random forest algorithm are used to clean the data and screen features, removing redundant features and retaining features strongly related to classification performance. A new scoring mechanism is proposed by combining the deep support vector description algorithm, effectively solving the problem that the reconstruction ability of the generative network is too strong, resulting in too small a difference between the generated samples and the reconstructed samples. The entire invention effectively improves the detection efficiency and the security of the distribution network.

[0057] Obviously, the embodiments described above are only the preferred embodiments of the present invention, rather than all embodiments. The preferred embodiments of the present invention are shown in the drawings, but do not limit the patent scope of the present invention. The present invention can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosed content of the present invention more thorough and comprehensive. Although the present invention has been described in detail with reference to the foregoing embodiments, for those skilled in the art, they can still modify the technical solutions described in the foregoing specific embodiments, or perform equivalent replacements for some of the technical features. Any equivalent structure directly or indirectly using the content of the specification and drawings of the present invention in other related technical fields shall be similarly within the scope of the patent protection of the present invention.

Claims

1. A distribution network attack detection method based on artificial intelligence, characterized in that: The following steps are involved: S10, pre-process the data, unify the dimensions and eliminate useless data; S20, use a two-stage deep learning model to learn data features, use conditional variational autoencoders to effectively classify known types of traffic, and use support vector description algorithms to filter out outlier samples based on the classification results; S30, using the distance between the sample and the centroid in the feature space as a scoring mechanism, and identifying samples outside the threshold set by the scoring mechanism as unknown attacks; S40, integrating the experimental results of step S10 to step S30 to achieve fine-grained classification of known types of traffic in the distribution network data and effective detection of unknown attack types.

2. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 1, characterized in that: The specific steps in step S10 are as follows: S101. Use the Pandas library in Python to process the data, replace missing values ​​with zero filling, and replace infinity with mean filling; S102, use Min-Max normalization to avoid some features having too much influence in model training due to their large value range; S103. Use the random forest algorithm in machine learning to build multiple decision trees and summarize the prediction results.

3. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 1, characterized in that: In step S20, the first stage model uses the sample data processed by step S10 as the input of the model, and uses the deep learning model to learn key features that are strongly correlated with the sample classification performance.

4. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 3 is characterized in that: The conditional variational autoencoder includes a priori network, a recognition network and a classification network. The purpose of the priori network and the recognition network is to learn the latent variable space of the sample. The conditional variational autoencoder uses KL divergence to measure the difference between two latent variable spaces. The purpose of the classification network is to achieve accurate classification of samples. In deep learning, cross entropy loss is used as a loss function. By combining KL divergence and cross entropy loss as a joint loss function, the Adam gradient update function is used to train the model until the model converges, thereby achieving accurate classification of known sample data.

5. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 4 is characterized in that: The second stage model detects anomalies by setting a threshold for the reconstruction error, and introduces a deep support vector description algorithm to learn a hypersphere with a radius of R to isolate abnormal outliers outside the hypersphere.

6. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 5, characterized in that: On the basis of the original reconstruction error, Deep SVDD loss is introduced to increase the difference between unknown category traffic and known category traffic by fitting a hypersphere. Then, the known category traffic and unknown category traffic are distinguished according to the distribution of sample data after hypersphere fitting.

7. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 1, characterized in that: In step S30, the formula of the scoring mechanism is as follows: S(x i )=||μ(x i ,y i )-c||; Among them, μ(x i ,y i ) is the sample feature space learned by the model, and c is the centroid of the hypersphere fitted by the Deep SVDD algorithm.

8. The method for detecting attacks on a distribution network based on artificial intelligence according to claim 1, characterized in that: Compared with known categories, the anomaly scores of unknown categories are outliers. Effective detection of unknown categories can be achieved by setting a suitable threshold for the anomaly score set.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

10. An electronic terminal, characterized in that: include: Processor and memory; The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the terminal executes the method according to any one of claims 1 to 8.

Images