A method, device, equipment and medium for power system data security analysis

Abstract

The present invention provides a power system data security analysis method, device, equipment, and medium, relating to the technical field of power systems. The method comprises: determining a security analysis strategy for a host in a future time period based on the host's operating data in a current time period using a machine learning algorithm; obtaining network traffic data for the host in the future time period according to the security analysis strategy to obtain multiple data features of the network traffic data; determining whether the network traffic data contains known attack features based on each data feature; and performing cluster analysis on the network traffic data using an unsupervised machine learning algorithm to obtain clustering results. Based on the clustering results, determining whether the network traffic data contains unknown attack features. The present invention utilizes dynamic adjustment of the security analysis strategy and actively explores unknown attack features in the network traffic data using an unsupervised machine learning algorithm, thereby improving the detection accuracy of power system data security.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and in particular to a method, device, equipment and medium for security analysis of power system data. Background Art

[0002] With the development of information technology and intelligent power systems, power systems face increasingly complex security threats, especially attacks from Advanced Persistent Threats (APTs). Therefore, in order to monitor power system security in real time, it is necessary to identify APT attack characteristics to ensure power system data security.

[0003] In related technologies, traditional security detection technology relies on known APT attack features in APT attack detection. Moreover, due to its weak data retrieval capabilities, it is unable to accurately monitor new or variant APT attacks that are difficult to identify, thereby affecting the detection accuracy of attack behaviors. Summary of the Invention

[0004] The problem solved by the present invention is how to improve the detection accuracy of power system data security.

[0005] To solve the above problems, the present invention provides a method, device, equipment and medium for power system data security analysis.

[0006] In a first aspect, a power system data security analysis method of the present invention includes:

[0007] Get the host's operating data in the current time period;

[0008] Determining, by a machine learning algorithm, a security analysis strategy for the host in a future time period based on the operating data in the current time period;

[0009] Acquiring network traffic data of the host within the future time period according to the security analysis strategy, and analyzing the network traffic data to obtain a plurality of data features of the network traffic data;

[0010] Determining whether the network traffic data has a known attack feature based on each of the data features;

[0011] If the network traffic data contains the known attack feature, determining that the network traffic data contains attack behavior;

[0012] If the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result;

[0013] According to the clustering result, determining whether the network traffic data has unknown attack features;

[0014] If so, it is determined that the network traffic data contains attack behavior; if not, it is determined that the network traffic data does not contain attack behavior.

[0015] Optionally, determining a security analysis strategy for the host in a future time period based on the operating data in the current time period by a machine learning algorithm includes:

[0016] Performing feature extraction on the operating data of the current time period using a machine learning algorithm to obtain the CPU usage, memory usage, and network load of the host, and using the CPU usage, memory usage, and network load as key features of the operating data;

[0017] Perform prediction based on the key features to obtain operating data of the host in the future time period;

[0018] Obtaining a security detection frequency and a security detection depth of the host according to the operation data in the future time period;

[0019] The security analysis strategy for the host in the future time period is generated according to the security detection frequency and the security detection depth.

[0020] Optionally, the analyzing the network traffic data to obtain multiple data features of the network traffic data includes:

[0021] Determining the flow size of the network flow data according to the sum of the lengths of all data packets in the network flow data;

[0022] Determining the flow direction of the network traffic data based on the source IP address and the destination IP address in the network traffic data;

[0023] Determining the number of times the host establishes connections with the external IP address based on the network traffic data, and determining the connection frequency based on the number of times;

[0024] For each length of the data packet in the network traffic data, determining a data packet length distribution of the network traffic data;

[0025] The traffic size, the flow direction, the connection frequency, and the data packet length distribution are used as the data features.

[0026] Optionally, judging whether the network traffic data contains a known attack feature according to each of the data features includes:

[0027] Comparing the data feature with an attack feature database to determine whether the data feature matches an attack feature in the attack feature database;

[0028] If the data feature matches the attack feature in the attack feature database, determining that the network traffic data contains a known attack feature;

[0029] If the data feature does not match the attack feature in the attack feature database, it is determined that the network traffic data does not contain a known attack feature.

[0030] Optionally, if the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result, including:

[0031] When it is determined that the network traffic data does not contain the known attack feature, performing similarity analysis on the network traffic data using a K-Means algorithm to obtain Euclidean distances between all data points in the network traffic data and multiple initial cluster centers;

[0032] According to the Euclidean distance between the data point and the initial cluster center, each data point is assigned to the initial cluster center with the smallest Euclidean distance corresponding to the data point, thereby obtaining multiple clusters of the network traffic data, and the clusters are used as the clustering results.

[0033] Optionally, judging whether the network traffic data has unknown attack features according to the clustering result includes:

[0034] Determining characteristic statistics of each cluster of the network traffic data according to the clustering result, wherein the characteristic statistics include the number and distribution data of data points of the cluster;

[0035] Determining whether the network traffic data contains abnormal clusters based on the number and distribution of data points in the clusters;

[0036] If so, it is determined that the network traffic data has unknown attack features;

[0037] If not, it is determined that the network traffic data does not have unknown attack features.

[0038] Optionally, judging whether the network traffic data includes abnormal clusters based on the number and distribution data of the data points of the clusters includes:

[0039] Obtaining a proportion of the cluster according to the number of data points of the cluster and the total number of data points of the network traffic data;

[0040] Determining the inter-cluster distance between every two of the clusters according to the distribution data of the clusters;

[0041] When the inter-cluster distances between the cluster and other clusters exceed a preset distance threshold, and / or the proportion of the cluster exceeds a preset proportion threshold, it is determined that an abnormal cluster exists in the network traffic data.

[0042] In a second aspect, the present invention provides a power system data security analysis device, comprising:

[0043] A data acquisition unit is used to obtain the operating data of the host in the current time period;

[0044] a prediction unit, configured to determine, by a machine learning algorithm and based on the operating data of the current time period, a security analysis strategy for the host in a future time period;

[0045] a feature extraction unit, configured to obtain network traffic data of the host within the future time period according to the security analysis strategy, and analyze the network traffic data to obtain a plurality of data features of the network traffic data;

[0046] a known attack feature determination unit, configured to determine, based on each of the data features, whether the network traffic data contains a known attack feature; if the network traffic data contains the known attack feature, determining that the network traffic data contains an attack behavior; and if the network traffic data does not contain the known attack feature, performing cluster analysis on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result;

[0047] The unknown attack feature judgment unit is used to judge whether the network traffic data has unknown attack features according to the clustering result; if so, it is determined that the network traffic data has attack behavior; if not, it is determined that the network traffic data does not have attack behavior.

[0048] In a third aspect, an electronic device of the present invention includes a computer-readable storage medium storing a computer program and a processor. When the computer program is read and executed by the processor, the power system data security analysis method as described above is implemented.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the above-mentioned power system data security analysis method is implemented.

[0050] The power system data security analysis method, apparatus, device, and medium of the present invention obtain operating data from a host in the current time period. Based on the operating data from the current time period, the method then uses a machine learning algorithm to determine the host's security analysis strategy for a future time period. The method utilizes the machine learning algorithm to mine potential patterns and trends in the data, thereby predicting the host's security analysis strategy for the future time period. This allows for better adaptation to real-time changes in the power system's operating status, proactively adjusting detection priorities and resource allocation, and more effectively addressing various security risks, significantly improving detection accuracy and timeliness. Network traffic data from the host in the future time period is obtained according to the security analysis strategy, ensuring the targeted and effective data collection. The method analyzes the network traffic data to obtain multiple data features. Based on each data feature, the method determines whether the network traffic data contains known attack features. By comprehensively examining these features, a more comprehensive understanding of the characteristics of the network traffic is achieved, accurately identifying whether the network traffic contains known attack features. If the network traffic data contains known attack features, the network traffic data is determined to contain attack behavior, avoiding the detection delays and omissions that often occur in traditional detection technologies that rely on manual experience or fixed rules. If there are no known attack features in the network traffic data, the network traffic data is clustered and analyzed using an unsupervised machine learning algorithm to automatically discover potential abnormal patterns and structures from the data. By analyzing the clustering results, unknown attack features that are significantly different from normal traffic patterns are identified, thereby forming an active exploration method for unknown threats. This effectively makes up for the shortcomings of traditional detection technology when facing new or variant APT attacks, and greatly enhances the comprehensiveness and accuracy of detection. The present invention utilizes dynamic adjustment of security analysis strategies and actively explores unknown attack features in network traffic data through unsupervised machine learning algorithms, thereby improving the detection accuracy of power system data security and providing more reliable and accurate protection for power system data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 1 is a flow chart of a method for power system data security analysis according to an embodiment of the present invention;

[0052] Figure 2 This is a schematic structural diagram of a power system data security analysis device in another embodiment of the present invention;

[0053] Figure 3 The figure is a schematic structural diagram of an electronic device according to another embodiment of the present invention. DETAILED DESCRIPTION

[0054] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0055] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0056] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to"; the term "based on" means "based at least in part on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments"; the term "optionally" means "optional embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0057] It should be noted that the modifications of "one" and "multiple" mentioned in the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0058] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0059] In response to the problems existing in the above-mentioned related technologies, this embodiment provides a power system data security analysis method, device, equipment and medium.

[0060] Combine Figure 1 As shown, an embodiment of the present invention provides a power system data security analysis method, including:

[0061] Get the host's running data in the current time period.

[0062] Specifically, the host plays a core role in the monitoring and data acquisition system of the power system. The SCADA system collects various data from power stations, substations and transmission lines through the host, and performs real-time monitoring and analysis. When the host obtains the operating data of the host in the current time period, it usually requires a data acquisition tool to collect data from multiple key indicators of the host in real time. In a preferred embodiment of the present invention, the collected operating data covers CPU usage, memory usage, and network load, etc. Taking CPU usage as an example, the CPU usage data is read regularly through system interfaces such as performance counters to ensure that the current operating status of the host can be accurately reflected. The collection of memory usage involves monitoring the allocation and usage of memory to understand the occupancy status of the host's memory resources. The collection of network load data is usually achieved through traffic monitoring tools or network card drivers to obtain information such as the size and number of network data packets entering and leaving the host in real time.

[0063] A security analysis strategy for the host in a future time period is determined based on the operating data of the current time period through a machine learning algorithm.

[0064] Specifically, using machine learning algorithms to determine future security analysis strategies requires first determining the length of the future time period. For example, predicting the security status within the next five minutes, one hour, or one day depends on specific security requirements and the real-time nature of the data. The collected operational data is then preprocessed, including data cleaning and normalization, to eliminate noise and outliers, making the data more suitable for the algorithm's input requirements. A time series prediction algorithm is then selected to predict the host's operational trends. Based on the prediction results, a detailed security analysis strategy is formulated, clarifying the frequency and depth of testing, thereby making security testing more forward-looking and targeted. In a preferred embodiment of the present invention, the machine learning algorithm can be a long short-term memory network. The host's operational data for the current time period is preprocessed and normalized before being input into a trained LSTM model. The model outputs a predicted security status for the host in the future time period, which may include predicted values for various security indicators, such as expected network traffic volume and estimated CPU utilization.

[0065] The network traffic data of the host in the future time period is obtained according to the security analysis strategy, and the network traffic data is analyzed to obtain multiple data features of the network traffic data.

[0066] Specifically, according to the established security analysis strategy, network traffic monitoring tools are used to acquire real-time network traffic data from hosts over a future timeframe. After acquiring this data, feature extraction algorithms are applied to analyze it, extracting key data features such as traffic volume, direction, connection frequency, and packet length distribution. These features provide crucial insights for subsequent attack detection.

[0067] Based on each of the data features, it is determined whether the network traffic data contains a known attack feature.

[0068] Specifically, the system searches a known attack signature database for common attack patterns, such as the high-traffic characteristics of DDoS attacks and the specific packet structures of SQL injection attacks. The extracted data features are then compared and matched against the signature database one by one. For example, if the extracted traffic volume characteristics increase dramatically within a short period of time, far exceeding the normal service traffic range, and also match the traffic pattern of a DDoS attack, it can be preliminarily determined that a known attack signature exists in the network traffic data.

[0069] If the network traffic data contains the known attack feature, it is determined that the network traffic data contains attack behavior.

[0070] Specifically, when known attack signatures are detected in network traffic data, the attack detection mechanism is immediately triggered. Based on pre-set detection rules, if the attack signature matches a certain threshold, the network traffic data is deemed to contain an attack. This process requires ensuring the accuracy and reliability of the detection rules to avoid misjudgments.

[0071] If the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result.

[0072] Specifically, in the absence of known attack signature matches, an appropriate unsupervised clustering algorithm, such as K-Means, is selected to perform cluster analysis on the network traffic data. In a preferred embodiment of the present invention, the unsupervised machine learning algorithm is a K-Means algorithm. Cluster centers are first randomly initialized for the data. The distance between data points and cluster centers is iteratively calculated, and the data points are assigned to the clusters to which the nearest cluster centers belong. The positions of the cluster centers are continuously updated until the cluster centers no longer change or the maximum number of iterations is reached, ultimately resulting in a clustering result.

[0073] According to the clustering result, it is determined whether the network traffic data has unknown attack features.

[0074] Specifically, by analyzing the clustering results, we identify abnormal clusters that are significantly different from normal traffic patterns. For example, the traffic volume, connection frequency, and other characteristics of certain clusters differ significantly from normal traffic patterns. By setting anomaly determination rules, if the density of a cluster falls below a certain threshold or the similarity between a cluster's characteristics and normal patterns falls below a set value, we determine that unknown attack signatures exist in the network traffic data.

[0075] If so, it is determined that the network traffic data contains attack behavior; if not, it is determined that the network traffic data does not contain attack behavior.

[0076] Specifically, based on the analysis and judgment of the clustering results, if there are unknown attack features, it is determined that there is an attack behavior in the network traffic data; otherwise, it is determined that there is no attack behavior, thereby ensuring the accuracy and reliability of the judgment results.

[0077] The power system data security analysis method of the present invention obtains the operating data of a host in the current time period and then, using a machine learning algorithm, determines the host's security analysis strategy for a future time period based on the current time period's operating data. The machine learning algorithm exploits potential patterns and trends in the data to predict the host's security analysis strategy for the future time period. This method better adapts to real-time changes in the power system's operating status, proactively adjusts detection priorities and resource allocation, and effectively addresses various security risks, significantly improving the accuracy and timeliness of detection. Network traffic data for the host in the future time period is obtained according to the security analysis strategy, ensuring the targeted and effective data collection. The network traffic data is analyzed to obtain multiple data features. Based on each data feature, the network traffic data is determined to contain known attack features. A comprehensive examination of these features provides a more comprehensive understanding of the characteristics of the network traffic, accurately identifying whether the network traffic contains known attack features. If the network traffic data contains known attack features, the attack behavior is determined to be present, avoiding the detection delays and omissions that occur in traditional detection technologies that rely on manual experience or fixed rules. If there are no known attack features in the network traffic data, the network traffic data is clustered and analyzed using an unsupervised machine learning algorithm to automatically discover potential abnormal patterns and structures from the data. By analyzing the clustering results, unknown attack features that are significantly different from normal traffic patterns are identified, thereby forming an active exploration method for unknown threats. This effectively makes up for the shortcomings of traditional detection technology when facing new or variant APT attacks, and greatly enhances the comprehensiveness and accuracy of detection. The present invention utilizes dynamic adjustment of security analysis strategies and actively explores unknown attack features in network traffic data through unsupervised machine learning algorithms, thereby improving the detection accuracy of power system data security and providing more reliable and accurate protection for power system data security.

[0078] Optionally, determining a security analysis strategy for the host in a future time period based on the operating data in the current time period by a machine learning algorithm includes:

[0079] Performing feature extraction on the operating data of the current time period using a machine learning algorithm to obtain the CPU usage, memory usage, and network load of the host, and using the CPU usage, memory usage, and network load as key features of the operating data;

[0080] Perform prediction based on the key features to obtain operating data of the host in the future time period;

[0081] Obtaining a security detection frequency and a security detection depth of the host according to the operation data in the future time period;

[0082] The security analysis strategy for the host in the future time period is generated according to the security detection frequency and the security detection depth.

[0083] Specifically, key features are extracted from the host's operating data during the current time period. PCA can be used for feature extraction. PCA is a commonly used data dimensionality reduction and feature extraction method. It performs a linear transformation on the original data and projects it onto new coordinate axes, making the new features (principal components) uncorrelated and sorted by variance. In power system data security analysis, PCA can be used to preprocess host operating data to extract the most important features, such as CPU usage, memory usage, and network load. This method reduces the data dimension and removes redundant information while retaining the key features, improving the efficiency and accuracy of subsequent analysis. The operating data includes multiple metrics such as CPU usage, memory usage, and network load. The machine learning algorithm selects CPU usage, memory usage, and network load as key features. This is because CPU usage reflects the host's computational load, memory usage reflects storage resource usage, and network load is directly related to network communication. These three metrics effectively characterize the host's operating status and lay the foundation for subsequent predictions. Based on the extracted key features, a suitable time series prediction model is trained. For example, suppose we select a historical data sequence length of 10 and a predicted future data sequence length of 2. We construct input-output pairs using the extracted key feature sequence, where the input sequence is the key feature values from time points 1 to 10, and the output sequence is the key feature values from time points 11 and 12. After model training, by inputting a new key feature sequence, we can predict the key feature values for future time periods. This is considered the host's future operating data and provides a basis for security analysis strategies. Based on the predicted future operating data, the host's security monitoring frequency and depth are set. For example, if a host's network load is predicted to increase in the future, potentially increasing the risk of cyberattacks, the security monitoring frequency can be appropriately increased to monitor network traffic changes in real time and promptly identify potential threats. At the same time, the monitoring depth can be increased to meticulously examine network traffic content and accurately identify attack signatures. By integrating factors such as security monitoring frequency and depth, a security analysis strategy for the host in the future time period is generated. This strategy specifies how to implement security monitoring, making it dynamically adaptable and able to adjust the monitoring plan based on the host's future operating status, thereby improving the level of data security protection in the power system.

[0084] In this embodiment of the present invention, a machine learning algorithm is used to extract features from the host's current operating data, predict future operating data, and formulate security analysis strategies, effectively improving the accuracy and adaptability of power system data security detection. Furthermore, the dynamically generated security analysis strategies closely align with the host's future operating state, enhancing the foresight and flexibility of power system data security protection.

[0085] Optionally, the analyzing the network traffic data to obtain multiple data features of the network traffic data includes:

[0086] Determining the flow size of the network flow data according to the sum of the lengths of all data packets in the network flow data;

[0087] Determining the flow direction of the network traffic data based on the source IP address and the destination IP address in the network traffic data;

[0088] Determining the number of times the host establishes connections with the external IP address based on the network traffic data, and determining the connection frequency based on the number of times;

[0089] For each length of the data packet in the network traffic data, determining a data packet length distribution of the network traffic data;

[0090] The traffic size, the flow direction, the connection frequency, and the data packet length distribution are used as the data features.

[0091] Specifically, the sum of all packet lengths in network traffic data is counted. For example, if the sum of packet lengths within a given time period (e.g., one minute) is 10MB, then the traffic volume for that period is 10MB. This directly reflects the volume of network communication data. The source and destination IP addresses are analyzed. If the source IP is from an external network and the destination IP is from an internal host, the traffic is considered inbound; otherwise, it is considered outbound. For example, if host A (internal IP: 192.168.1.100) receives a packet from internet IP 110.100.100.100, this is recorded as inbound traffic. Flow direction analysis can help understand the direction of data transmission and distinguish inbound from outbound traffic, providing a foundation for security policy formulation. The number of connections between the host and external IP addresses is counted. For example, if a host establishes connections with 100 different external IP addresses within one minute, the connection frequency is 100 times per minute. A high connection frequency may indicate a scanning attack or brute force attack. The length of each packet is analyzed, and the proportion of packets in different length ranges is counted. For example, statistics show that during a certain time period, packets between 100 and 200 bytes accounted for 30% of total traffic, while packets between 300 and 400 bytes accounted for 50%. This distribution pattern helps identify anomalous communication behavior, such as the fixed-length packets generated by the spread of specific malware. Traffic size, direction, connection frequency, and packet length distribution are integrated into data features. These features comprehensively describe the characteristics of network traffic, providing multi-dimensional information for subsequent attack detection.

[0092] In an embodiment of the present invention, by performing multi-dimensional analysis on network traffic data and extracting data features, and through correlation analysis of multi-dimensional features, an in-depth understanding of network traffic is achieved, the accuracy and reliability of security detection are improved, and the data security of the power system is enhanced.

[0093] Optionally, judging whether the network traffic data contains a known attack feature according to each of the data features includes:

[0094] Comparing the data feature with an attack feature database to determine whether the data feature matches an attack feature in the attack feature database;

[0095] If the data feature matches the attack feature in the attack feature database, determining that the network traffic data contains a known attack feature;

[0096] If the data feature does not match the attack feature in the attack feature database, it is determined that the network traffic data does not contain a known attack feature.

[0097] Specifically, to determine whether the network traffic data contains known attack features, it is necessary to accurately match the data features with the attack feature database. In a preferred embodiment of the present invention, taking DDoS attacks as an example, the attack feature database stores typical features of such attacks. When the monitored network traffic data features show an abnormal increase in connection frequency, such as the number of connections in a short period of time far exceeds the normal threshold, the data features are compared with the high connection frequency features of the DDoS attack in the database. If the match is successful, it can be determined that the current network traffic contains known DDoS attack features; conversely, if the data features do not find a corresponding match, it is considered that there are no known attack features.

[0098] In this embodiment of the present invention, by comparing extracted data features with a database of known attack signatures, known attack behaviors in network traffic can be quickly and accurately identified. This signature-matching-based detection method not only reduces the false positive rate but also enables timely detection and early warning of attacks, providing ample time for the power system to implement protective measures and effectively ensuring data security.

[0099] Optionally, if the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result, including:

[0100] When it is determined that the network traffic data does not contain the known attack feature, performing similarity analysis on the network traffic data using a K-Means algorithm to obtain Euclidean distances between all data points in the network traffic data and multiple initial cluster centers;

[0101] According to the Euclidean distance between the data point and the initial cluster center, each data point is assigned to the initial cluster center with the smallest Euclidean distance corresponding to the data point, thereby obtaining multiple clusters of the network traffic data, and the clusters are used as the clustering results.

[0102] Specifically, after determining that the network traffic data does not contain known attack signatures, the K-Means algorithm is used to initiate the similarity analysis process, which includes calculating the Euclidean distance between each data point in the network traffic data and multiple initial cluster centers. Taking the data points and cluster centers in two-dimensional space as an example, the Euclidean distance formula is:

[0103] L= ;

[0104] Where L is the Euclidean distance, (x1, y1) is the coordinate data of the data point in the two-dimensional coordinate system, and (x2, y2) is the coordinate data of the cluster center in the two-dimensional coordinate system. This quantifies the similarity between the data point and the cluster center. Based on the calculated Euclidean distance, each data point is assigned to the cluster corresponding to the initial cluster center closest to it. If the distance between data point A and cluster center C1 is less than its distance to other cluster centers such as C2 and C3, A is temporarily assigned to cluster C1. After all data points are assigned, multiple clusters are initially formed. The center point of each cluster is recalculated as the new cluster center. The above steps are repeated, recalculating the distance between the data point and the new cluster center and reassigning the data points, until the cluster center position stabilizes or the preset number of iterations is reached. The final clustering result includes the set of data points within each cluster and their corresponding features. For example, a cluster may contain a collection of data points with high traffic but short duration connections, which initially reveals the inherent structure of the data points.

[0105] In this embodiment, the K-Means algorithm deeply mines hidden patterns in network traffic data, identifying normal traffic patterns and effectively distinguishing potential attack traffic, thereby improving detection accuracy. This, in conjunction with traditional methods for detecting known attack signatures, comprehensively safeguards power system data security.

[0106] Optionally, judging whether the network traffic data has unknown attack features according to the clustering result includes:

[0107] Determining characteristic statistics of each cluster of the network traffic data according to the clustering result, wherein the characteristic statistics include the number and distribution data of data points of the cluster;

[0108] Determining whether the network traffic data contains abnormal clusters based on the number and distribution of data points in the clusters;

[0109] If so, it is determined that the network traffic data has unknown attack features;

[0110] If not, it is determined that the network traffic data does not have unknown attack features.

[0111] Specifically, based on the clustering results, characteristic statistics such as the number of data points and distribution data are calculated for each cluster. The number of data points directly reflects the size of the cluster; the distribution data reveals the density or sparseness of data points within the cluster, comprehensively reflecting the characteristics of the cluster. The number and distribution of data points within a cluster are used to determine whether there are abnormal clusters. Since normal clusters typically contain a large number of data points, a cluster with very few data points, such as only 1% of the total data points, may be an abnormal cluster. Similarly, a cluster with sparse data points and significantly greater spacing between data points than other clusters may also be an abnormal cluster, indicating that its data point characteristics differ significantly from normal traffic. If an abnormal cluster exists, it is determined that the network traffic data contains unknown attack signatures; otherwise, it is not. For example, in a cluster analysis, a cluster is found to have extremely few data points and a sparse distribution. Further analysis reveals that the packets in this cluster have unusual payload content and abnormal traffic patterns, which are clearly inconsistent with normal business traffic. Therefore, an unknown attack signature is determined to be present. In a preferred embodiment of the present invention, the network traffic data is clustered and analyzed by the K-Means algorithm to obtain multiple clusters. The total number of data points is 1000. Among them, cluster A contains 950 data points, which are densely distributed and account for 95% of the total number of data points; cluster B contains 30 data points, accounting for 3%, and the data points are slightly sparsely distributed; cluster C has only 10 data points, accounting for 1%, and the data points are extremely sparsely distributed, and the distance between data points is significantly larger than that of other clusters. Further analysis of cluster C shows that its data packets have special payload content and contain uncommon binary patterns, which are significantly different from the normal continuous and stable traffic pattern of the power system. Combined with this information, cluster C is determined to be an abnormal cluster, and its characteristics are significantly different from normal business traffic. Based on this, it is determined that the network traffic data has unknown attack characteristics, which may be caused by new attacks or variant attacks.

[0112] In this embodiment of the present invention, by analyzing clustering results to determine whether network traffic data contains unknown attack signatures, the power system's ability to detect new attacks can be effectively improved. This significantly enhances the comprehensiveness and adaptability of data security detection, allowing for the timely identification of potential threats and the implementation of countermeasures. This helps the power system formulate response strategies in advance and mitigate the risks posed by unknown attacks.

[0113] Optionally, judging whether the network traffic data includes abnormal clusters based on the number and distribution data of the data points of the clusters includes:

[0114] Obtaining a proportion of the cluster according to the number of data points of the cluster and the total number of data points of the network traffic data;

[0115] Determining the inter-cluster distance between every two of the clusters according to the distribution data of the clusters;

[0116] When the inter-cluster distances between the cluster and other clusters exceed a preset distance threshold, and / or the proportion of the cluster exceeds a preset proportion threshold, it is determined that an abnormal cluster exists in the network traffic data.

[0117] Specifically, it is calculated according to the formula "cluster proportion = number of data points in the cluster / total number of data points × 100%". For example, if a cluster has 100 data points and the total number of network traffic data points is 1000, then the cluster proportion is 10%. If the cluster proportion exceeds the preset proportion threshold (such as 5%), it may be an abnormal cluster. In addition, the Euclidean distance formula is used to calculate the distance between different clusters. The formula is: The Euclidean distance calculation formula is: (Take two-dimensional space as an example). For cluster A (center coordinates (a1, a1)) and cluster B (center coordinates (b2, b2)), substitute the formula to calculate the Euclidean distance between the center coordinates of the clusters. If the distance exceeds the preset distance threshold, it is considered that the difference between the two clusters is significant. When the inter-cluster distances between a cluster and other clusters exceed the preset distance threshold, or the proportion of clusters exceeds the preset proportion threshold, it is determined that there are abnormal clusters in the network traffic data. In a preferred embodiment of the present invention, in a certain cluster analysis, it is found that the inter-cluster distances between cluster C and the remaining clusters are all greater than 3, or their proportion is as high as 20% (exceeding the set 5% threshold), then it is determined that there are abnormal clusters.

[0118] In an embodiment of the present invention, by comprehensively considering the proportion of data points in a cluster and the distance between clusters to determine abnormal clusters, the power system's detection accuracy and reliability for unknown attack features can be effectively improved. Proportion analysis can identify clusters of unusual size, which may be caused by large-scale attacks or abnormal traffic from a small number of hosts; inter-cluster distance analysis can discover clusters with significantly different characteristics, or the result of independent attack behaviors. This method enables the power system to accurately and promptly detect unknown attack threats, enhancing the rigor and effectiveness of data security protection, which is of great significance for ensuring the stable operation of the power system.

[0119] Combine Figure 2 As shown, an embodiment of the present invention provides a power system data security analysis device, comprising:

[0120] A data acquisition unit is used to obtain the operating data of the host in the current time period;

[0121] a prediction unit, configured to determine, by a machine learning algorithm and based on the operating data of the current time period, a security analysis strategy for the host in a future time period;

[0122] a feature extraction unit, configured to obtain network traffic data of the host within the future time period according to the security analysis strategy, and analyze the network traffic data to obtain a plurality of data features of the network traffic data;

[0123] a known attack feature determination unit, configured to determine, based on each of the data features, whether the network traffic data contains a known attack feature; if the network traffic data contains the known attack feature, determining that the network traffic data contains an attack behavior; and if the network traffic data does not contain the known attack feature, performing cluster analysis on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result;

[0124] The unknown attack feature judgment unit is used to judge whether the network traffic data has unknown attack features according to the clustering result; if so, it is determined that the network traffic data has attack behavior; if not, it is determined that the network traffic data does not have attack behavior.

[0125] The advantages of the power system data security analysis device of the present invention over the prior art are the same as the advantages of the above-mentioned power system data security analysis method over the prior art, and will not be repeated here.

[0126] An embodiment of the present invention provides an electronic device, comprising a computer-readable storage medium storing a computer program and a processor. When the computer program is read and executed by the processor, the power system data security analysis method as described above is implemented.

[0127] In other words, an electronic device 300 includes a memory 310 and a processor 320 connected to the memory 310; the memory 310 is configured to store a computer program; and the processor 320 is configured to perform the following operations when executing the computer program:

[0128] Get the host's operating data in the current time period;

[0129] Determining, by a machine learning algorithm, a security analysis strategy for the host in a future time period based on the operating data in the current time period;

[0130] Acquiring network traffic data of the host within the future time period according to the security analysis strategy, and analyzing the network traffic data to obtain a plurality of data features of the network traffic data;

[0131] Determining whether the network traffic data has a known attack feature based on each of the data features;

[0132] If the network traffic data contains the known attack feature, determining that the network traffic data contains attack behavior;

[0133] If the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result;

[0134] According to the clustering result, determining whether the network traffic data has unknown attack features;

[0135] If so, it is determined that the network traffic data contains attack behavior; if not, it is determined that the network traffic data does not contain attack behavior.

[0136] The advantages of the electronic device of the present invention over the prior art are the same as the advantages of the above-mentioned power system data security analysis method over the prior art, and will not be repeated here.

[0137] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the power system data security analysis method described above is implemented.

[0138] In other words, a non-volatile computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to perform the following operations:

[0139] Get the host's operating data in the current time period;

[0140] Determining, by a machine learning algorithm, a security analysis strategy for the host in a future time period based on the operating data in the current time period;

[0141] Acquiring network traffic data of the host within the future time period according to the security analysis strategy, and analyzing the network traffic data to obtain a plurality of data features of the network traffic data;

[0142] Determining whether the network traffic data has a known attack feature based on each of the data features;

[0143] If the network traffic data contains the known attack feature, determining that the network traffic data contains attack behavior;

[0144] If the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result;

[0145] According to the clustering result, determining whether the network traffic data has unknown attack features;

[0146] If so, it is determined that the network traffic data contains attack behavior; if not, it is determined that the network traffic data does not contain attack behavior.

[0147] The advantages of the computer-readable storage medium of the present invention over the prior art are the same as the advantages of the above-mentioned power system data security analysis method over the prior art, and will not be repeated here.

[0148] Although the present invention is disclosed as above, the scope of protection disclosed by the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the scope of protection of the present invention.

Claims

1. A power system data security analysis method, characterized in that: include: Get the host's operating data in the current time period; Determining, by a machine learning algorithm, a security analysis strategy for the host in a future time period based on the operating data in the current time period; Acquiring network traffic data of the host within the future time period according to the security analysis strategy, and analyzing the network traffic data to obtain a plurality of data features of the network traffic data; Determining whether the network traffic data has a known attack feature based on each of the data features; If the network traffic data contains the known attack feature, determining that the network traffic data contains attack behavior; If the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result; specifically, the method includes: after determining that the network traffic data does not contain the known attack feature, similarity analysis is performed on the network traffic data using a K-Means algorithm to obtain Euclidean distances between all data points in the network traffic data and multiple initial cluster centers; according to the Euclidean distance between the data point and the initial cluster center, each data point is assigned to the initial cluster center with the smallest Euclidean distance corresponding to the data point, to obtain multiple clusters of the network traffic data, and the clusters are used as the clustering results; Determining whether the network traffic data has unknown attack features based on the clustering results; specifically comprising: determining, based on the clustering results, feature statistics of each cluster of the network traffic data, the feature statistics including the number of data points and distribution data of the cluster; determining whether the network traffic data has abnormal clusters based on the number of data points and distribution data of the cluster; if so, determining that the network traffic data has unknown attack features; if not, determining that the network traffic data does not have unknown attack features; Wherein, judging whether there is an abnormal cluster in the network traffic data based on the number and distribution data of the cluster data includes: obtaining the proportion of the cluster according to the number of data points of the cluster and the total number of data points of the network traffic data; determining the inter-cluster distance between every two clusters according to the distribution data of the cluster; when the inter-cluster distances between the cluster and other clusters exceed a preset distance threshold, and / or the proportion of the cluster exceeds a preset proportion threshold, judging that there is an abnormal cluster in the network traffic data; If so, it is determined that the network traffic data contains attack behavior; if not, it is determined that the network traffic data does not contain attack behavior.

2. The power system data security analysis method according to claim 1, characterized in that: Determining, by a machine learning algorithm and based on the operating data of the current time period, a security analysis strategy for the host in a future time period includes: Performing feature extraction on the operating data of the current time period using a machine learning algorithm to obtain the CPU usage, memory usage, and network load of the host, and using the CPU usage, memory usage, and network load as key features of the operating data; Perform prediction based on the key features to obtain operating data of the host in the future time period; Obtaining a security detection frequency and a security detection depth of the host according to the operation data in the future time period; The security analysis strategy for the host in the future time period is generated according to the security detection frequency and the security detection depth.

3. The power system data security analysis method according to claim 1, characterized in that: The analyzing the network traffic data to obtain multiple data features of the network traffic data includes: Determining the flow size of the network flow data according to the sum of the lengths of all data packets in the network flow data; Determining the flow direction of the network traffic data based on the source IP address and the destination IP address in the network traffic data; Determining the number of times the host establishes connections with the external IP address based on the network traffic data, and determining the connection frequency based on the number of times; For each length of the data packet in the network traffic data, determining a data packet length distribution of the network traffic data; The traffic size, the flow direction, the connection frequency, and the data packet length distribution are used as the data features.

4. The power system data security analysis method according to claim 1, characterized in that: The determining, based on each of the data features, whether the network traffic data contains a known attack feature includes: Comparing the data feature with an attack feature database to determine whether the data feature matches an attack feature in the attack feature database; If the data feature matches the attack feature in the attack feature database, determining that the network traffic data contains a known attack feature; If the data feature does not match the attack feature in the attack feature database, it is determined that the network traffic data does not contain a known attack feature.

5. A power system data security analysis device, characterized in that: include: A data acquisition unit is used to obtain the operating data of the host in the current time period; a prediction unit, configured to determine, by a machine learning algorithm and based on the operating data of the current time period, a security analysis strategy for the host in a future time period; a feature extraction unit, configured to obtain network traffic data of the host within the future time period according to the security analysis strategy, and analyze the network traffic data to obtain a plurality of data features of the network traffic data; a known attack feature determination unit, configured to determine whether the network traffic data contains a known attack feature based on each of the data features; If the network traffic data contains the known attack feature, determining that the network traffic data contains attack behavior; If the network traffic data does not contain the known attack feature, cluster analysis is performed on the network traffic data using an unsupervised machine learning algorithm to obtain a clustering result; specifically, the method includes: after determining that the network traffic data does not contain the known attack feature, similarity analysis is performed on the network traffic data using a K-Means algorithm to obtain Euclidean distances between all data points in the network traffic data and multiple initial cluster centers; according to the Euclidean distance between the data point and the initial cluster center, each data point is assigned to the initial cluster center with the smallest Euclidean distance corresponding to the data point, to obtain multiple clusters of the network traffic data, and the clusters are used as the clustering results; An unknown attack feature judgment unit is configured to judge whether the network traffic data has unknown attack features based on the clustering results; specifically, the unit comprises: determining, based on the clustering results, feature statistics of each cluster of the network traffic data, the feature statistics including the number of data points and distribution data of the cluster; judging, based on the number of data points and distribution data of the cluster, whether the network traffic data has abnormal clusters; if so, judging that the network traffic data has unknown attack features; if not, judging that the network traffic data does not have unknown attack features; Among them, judging whether there is an abnormal cluster in the network traffic data based on the number of data points and distribution data of the cluster includes: obtaining the proportion of the cluster based on the number of data points of the cluster and the total number of data points of the network traffic data; determining the inter-cluster distance between every two clusters based on the distribution data of the cluster; when the inter-cluster distance between the cluster and other clusters exceeds a preset distance threshold, and / or the proportion of the cluster exceeds a preset proportion threshold, judging that there is an abnormal cluster in the network traffic data; if so, judging that there is an attack behavior in the network traffic data, and if not, judging that there is no attack behavior in the network traffic data.

6. An electronic device, characterized in that: The invention comprises a computer-readable storage medium storing a computer program and a processor, wherein when the computer program is read and executed by the processor, the power system data security analysis method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the power system data security analysis method according to any one of claims 1 to 4 is implemented.

Images