A method, device, equipment and medium for secure transmission of power system information

Abstract

The present invention provides a method, apparatus, device, and medium for secure transmission of information in a power system, relating to the technical field of secure information transmission. The method comprises employing a hash algorithm and asymmetric encryption to generate a digital encryption signature; acquiring and locking a received file at a receiving end, decrypting the digital encryption signature, generating a received summary identifier, and comparing the original summary identifier with the received summary identifier to generate an identifier security verification result; when the identifier security verification result is secure, acquiring communication data between a transmitting end and a receiving end corresponding to the information to be transmitted, inputting the communication data into a trained transmission behavior model, and generating an information security probability; when the information security probability is greater than or equal to a preset probability threshold, respectively collecting an actual physical fingerprint and an auxiliary physical fingerprint to determine physical similarity; when the physical similarity is greater than or equal to a preset similarity threshold, generating an information transmission normal report, and unlocking the received file. The present invention can improve security.

Description

Technical Field

[0001] The present invention relates to the technical field of secure information transmission, and in particular to a method, device, equipment and medium for secure information transmission in a power system. Background Art

[0002] The power system requires a wide range of information to be transmitted, covering every link from power generation to power consumption. This information is crucial for ensuring stable operation of the power system, optimizing resource allocation, and enabling rapid response.

[0003] In related technologies, data in power systems are usually transmitted directly through public or semi-public networks. However, these network environments are relatively open, and the risk of directly transmitted information being intercepted and tampered with is relatively high, resulting in lower security of power system information. Summary of the Invention

[0004] The problem solved by the present invention is how to improve the security of power system information.

[0005] To solve the above problems, the present invention provides a method, device, equipment and medium for secure transmission of power system information.

[0006] In a first aspect, the present invention provides a method for securely transmitting power system information, comprising:

[0007] Acquire information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature;

[0008] Packaging the information to be transmitted and the digital encryption signature, and sending them to a receiving end of the power system;

[0009] Acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a receiving summary identifier, compare the original summary identifier with the receiving summary identifier, verify the information transmission security, and generate an identifier security verification result;

[0010] When the identification security verification result is safe, obtaining communication data between the sending end and the receiving end corresponding to the information to be transmitted, inputting the communication data into the trained transmission behavior model, and generating an information security probability;

[0011] When the information security probability is greater than or equal to a preset probability threshold, respectively collecting the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and when the physical similarity is greater than or equal to a preset similarity threshold, generating an information transmission normal report and unlocking the received file;

[0012] When the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold, an information transmission abnormality report is generated.

[0013] Optionally, the communication data includes data frequency data, traffic pattern data, communication path data, protocol type data and delay fluctuation data;

[0014] The trained transmission behavior model includes an input processing layer, a multi-layer GCN network, a timing network, a fusion layer and an output layer;

[0015] The input processing layer is used to classify the data frequency data, the traffic pattern data, the communication path data, the protocol type data, and the delay fluctuation data into graph data and non-graph data;

[0016] The multi-layer GCN network extracts the node representation corresponding to the graph data based on the attention mechanism;

[0017] The time series network is used to extract time series features corresponding to the non-graph data;

[0018] The fusion layer is used to fuse all the node representations and the time series features to generate fusion features;

[0019] The output layer is used to generate the information security probability according to the fusion features using an activation function.

[0020] Optionally, the temporal network includes a dynamic time step embedding unit, a multi-scale convolutional attention unit, an adaptive sparse memory enhanced Transformer, and a state-aware gated recurrent unit;

[0021] The dynamic time step embedding unit is used to embed the time series features into time intervals using a position encoding function to generate a time interval embedding vector sequence;

[0022] The multi-scale convolutional attention unit is used to perform local correlation extraction and attention weighting on the time interval embedding vector sequence at multiple time granularities to generate enhanced local attention features;

[0023] The adaptive sparse memory-enhanced Transformer is used to fuse the external memory matrix to the enhanced local attention feature to generate a memory-enhanced attention feature;

[0024] The state-aware gated recurrent unit is used to capture the long-term dependencies of the memory-enhanced attention features based on a state-aware mechanism and generate the time series features.

[0025] Optionally, the fusion layer includes a heterogeneous information network unit, a projection transformation unit, and a deep neural decision forest unit;

[0026] The heterogeneous information network unit is used to capture the semantic relationship between all the node representations and the time series features, and generate a semantic relationship embedding vector;

[0027] The projection transformation unit is used to project the semantic relationship embedding vector, all the node representations and the time series features into the same latent space, and perform linear transformation to generate preliminary fusion features;

[0028] The deep neural decision forest unit is used to further refine the preliminary fusion features based on the hierarchical characteristics of the decision tree to generate the fusion features.

[0029] Optionally, determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint includes:

[0030] respectively constructing an actual spatial intensity map of the actual physical fingerprint and an auxiliary spatial intensity map of the auxiliary physical fingerprint;

[0031] Mapping the actual space intensity map and the auxiliary space intensity map to a low-dimensional space respectively, and using a kernel density estimation method to construct actual probability distribution characteristics of the actual space intensity map in the low-dimensional space and auxiliary probability distribution characteristics of the auxiliary space intensity map in the low-dimensional space respectively;

[0032] The physical similarity is generated according to the actual probability distribution feature and the auxiliary probability distribution feature.

[0033] Optionally, generating the physical similarity according to the actual probability distribution feature and the auxiliary probability distribution feature includes:

[0034] According to the actual probability distribution characteristics and the auxiliary probability distribution characteristics, the physical similarity is generated using a physical similarity formula and an interference function, wherein the physical similarity formula includes:

[0035] ;

[0036] Wherein, S is the physical similarity,F real is the actual probability distribution characteristic, F aux is the auxiliary probability distribution feature, is the scaling factor, D is the interference function, To enhance the nonlinear discrimination ability factor.

[0037] Optionally, after generating the information transmission exception report, the method further includes:

[0038] The communication connection between the sending end and the receiving end is disconnected, and the received file is deleted.

[0039] In a second aspect, the present invention provides a device for securely transmitting power system information, comprising:

[0040] An encryption module is used to obtain information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature;

[0041] a packaging module, configured to package the information to be transmitted and the digital encryption signature, and send the package to a receiving end of the power system;

[0042] a decryption module, configured to acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a received summary identifier, compare the original summary identifier with the received summary identifier, verify the information transmission security, and generate an identifier security verification result;

[0043] a probability module, configured to, when the identification security verification result is secure, obtain communication data between the transmitting end and the receiving end corresponding to the information to be transmitted, input the communication data into a trained transmission behavior model, and generate an information security probability;

[0044] a similarity module, configured to, when the information security probability is greater than or equal to a preset probability threshold, respectively collect the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determine the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and, when the physical similarity is greater than or equal to a preset similarity threshold, generate an information transmission normal report and unlock the received file;

[0045] The result module is used to generate an information transmission abnormality report when the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold.

[0046] In a third aspect, the present invention provides an electronic device comprising a memory and a processor;

[0047] The memory is used to store computer programs;

[0048] The processor is configured to implement the method for secure transmission of power system information as described in the first aspect when executing the computer program.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for secure transmission of power system information as described in the first aspect is implemented.

[0050] The beneficial effects of the power system information security transmission method, device, equipment and medium of the present invention are:

[0051] Since the summary identifier generated by the hash algorithm is unique, any tampering with the original information will cause the summary to change. Therefore, the hash algorithm is used to extract the original summary identifier of the information to be transmitted, and the original summary identifier is encrypted with the private key of asymmetric encryption to generate a digital encryption signature. The identities of both the sender and the receiver can be verified, effectively preventing third parties from forging identities and tampering with information, reducing the risk of information being intercepted and tampered with, and improving the security of the power system. The information to be transmitted is then packaged and encapsulated with the digital encryption signature and sent to the receiving end of the power system. The receiving file of the receiving end is then obtained and locked, and is unlocked only after subsequent security verification, further improving the security of the power system. The digital encryption signature is then decrypted with the public key of asymmetric encryption to generate a receiving summary identifier, and the original summary identifier and the receiving summary identifier are compared to verify the information transmission. Security, generating identification security verification results, can make a preliminary judgment on the received data to confirm whether it has been tampered with. When the preliminary judgment result is safe, the communication data is input into the trained transmission behavior model, and the communication process between the sender and the receiver is judged twice to confirm whether there is a possibility of interception and tampering, and the information security probability is generated. When the information security probability is greater than or equal to the preset probability threshold, that is, when the second judgment is also normal, a third judgment is made, and the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender are collected respectively, and the physical similarity of the actual physical fingerprint and the auxiliary physical fingerprint is determined to confirm whether the device at the sender is authentic, avoiding the possibility of intercepting and tampering with information by the simulated device, and finally generating an accurate information transmission normal report, and unlocking the confirmed safe received file for system use. The present invention can greatly reduce the risk of information being intercepted and tampered by encryption and layered three-layer verification, and each layer has a different verification angle, which can accurately confirm whether the received information has been tampered with. Finally, the secure file after three layers of precise verification is unlocked for use, greatly improving the security of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic diagram of a flow chart of a method for securely transmitting power system information provided by an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of the structure of a power system information security transmission device provided by an embodiment of the present invention;

[0054] Figure 3 A schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0056] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0057] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to"; the term "based on" means "based at least in part on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments"; the term "optionally" means "optional embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0058] It should be noted that the modifications of "one" and "multiple" mentioned in the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0059] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0060] In response to the problems existing in the above-mentioned related technologies, this embodiment provides a method, device, equipment and medium for secure transmission of power system information.

[0061] like Figure 1 As shown, an embodiment of the present invention provides a method for securely transmitting power system information, comprising:

[0062] The information to be transmitted of the power system is obtained, an original summary identifier of the information to be transmitted is extracted by using a hash algorithm, and the original summary identifier is encrypted by using a private key of asymmetric encryption to generate a digital encryption signature.

[0063] Specifically, the information to be transmitted in the power system refers to the various data and information that needs to be exchanged and processed during the operation and management of the power system, such as telemetry data, remote control commands, transaction information, and maintenance information. This information is crucial to ensuring the safe, stable, and efficient operation of the power grid. The original digest identifier is a fixed-length unique identifier generated by a hash algorithm on input data of any length. For example, SHA-256 generates a 256-bit hash value. This is then encrypted with the private key using the asymmetric RSA tool to generate a binary or Base64-encoded digital signature, achieving double encryption and facilitating subsequent verification.

[0064] The information to be transmitted and the digital encryption signature are packaged and encapsulated, and sent to a receiving end of the power system.

[0065] Specifically, the information to be transmitted is packaged and encapsulated with a digital encryption signature. At the same time, a lightweight MAC (message authentication code) can be combined with a timestamp to form an "integrity tag" attached to the packaged data packet and sent to the receiving end of the power system for subsequent integrity and security verification.

[0066] Acquire and lock the receiving file of the receiving end, decrypt the digital encryption signature using the public key of asymmetric encryption, generate a receiving summary identifier, compare the original summary identifier with the receiving summary identifier, verify the information transmission security, and generate an identifier security verification result.

[0067] Specifically, the receiving file of the receiving end is obtained and locked, and then unlocked and used after successful verification. The public key of the RSA tool using the asymmetric encryption algorithm is used to decrypt the digital encryption signature to generate the receiving summary identifier of the receiving end, and the original summary identifier and the receiving summary identifier are compared. That is, all contents of the original summary identifier and the receiving summary identifier are compared, such as the encoding, format and timestamp, etc., to verify the integrity and security of the information transmission, and generate the identifier security verification result of all contents of the original summary identifier and the receiving summary identifier. For example, if the encoding of the original summary identifier and the receiving summary identifier are consistent, the format of the original summary identifier and the receiving summary identifier are consistent, and the timestamp of the original summary identifier and the receiving summary identifier are consistent, the identifier security verification result is safe. When any of the contents are inconsistent, the identifier security verification result is abnormal.

[0068] When the identification security verification result is safe, communication data between the sending end and the receiving end corresponding to the information to be transmitted is obtained, and the communication data is input into the trained transmission behavior model to generate an information security probability.

[0069] Specifically, when the identification security verification result is secure, the communication data between the sender and receiver corresponding to the information to be transmitted is obtained, and the communication data is input into the trained transmission behavior model to generate the information security probability, and then a second verification is performed. Because, ideally, if the hash algorithm is secure enough, the key is not leaked, and the system is implemented correctly, the summary decrypted by the public key is exactly the same as the original summary, which means that the data has not been tampered with. However, in actual work, there are some potential risks that may cause data to be tampered with. For example, the hash algorithm has a collision vulnerability. That is, if an attacker finds two different input data that have the same hash value (called a hash collision), then the data can be tampered with and the signature can be forged; the private key is leaked or misused. That is, if an attacker steals the private key of the sender's signer, then the signature of any data can be forged. Therefore, the trained transmission behavior model is used to re-verify the communication data between the sender and the receiver to determine whether there is any abnormal behavior during the communication process, such as intercepting and tampering with data. The transmission behavior model can adopt a combination of neural networks and timing models to deeply analyze the characteristics and timing relationships between data. The transmission behavior model can be trained through historical secure communication data to obtain a trained transmission behavior model to analyze current data and generate information security probability.

[0070] When the information security probability is greater than or equal to a preset probability threshold, the actual physical fingerprint of the sending end and the auxiliary physical fingerprint of the same source device as the sending end are collected respectively, and the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint is determined. When the physical similarity is greater than or equal to the preset similarity threshold, an information transmission normal report is generated, and the received file is unlocked.

[0071] Specifically, the preset probability threshold can be set based on actual circumstances, for example, 95%. The preset similarity threshold can also be set based on actual circumstances, for example, 96%. A homologous device refers to a device of the same model, size, and operating time as the transmitter device. The physical fingerprint refers to real-time operating parameters unique to power system equipment, such as the current waveform of the opening and closing coils, power frequency harmonic components, and the shaft torsional vibration frequency waveform. When the information security probability is greater than or equal to the preset probability threshold, it indicates that the transmission behavior model has not detected abnormal behavior during the communication process. However, vulnerabilities may still exist. For example, an attacker may use a fake transmitter device, a simulated transmitter device, or a hacked transmitter device to send information and spread tampered information. Therefore, the actual physical fingerprint of the transmitter and the auxiliary physical fingerprint of the homologous device are collected separately. The physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint is determined. When the physical similarity is greater than or equal to the preset similarity threshold, the transmitter device is determined to be authentic and uncompromised, thereby proving the security of the received information. A report on normal information transmission is generated, and the received file is unlocked for use.

[0072] When the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold, an information transmission abnormality report is generated.

[0073] Specifically, when the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold, it indicates that there is an abnormality in data transmission, and an information transmission abnormality report is generated.

[0074] In this embodiment, since the summary identifier generated by the hash algorithm is unique, any tampering with the original information will cause the summary to change. Therefore, the original summary identifier of the information to be transmitted is extracted by using the hash algorithm, and the original summary identifier is encrypting the original summary identifier with the asymmetric encryption private key to generate a digital encryption signature, which can verify the identities of both the sender and the receiver, effectively prevent a third party from forging an identity and tampering with information, reduce the risk of information being intercepted and tampered with, and improve the security of the power system. The information to be transmitted is then packaged and encapsulated with the digital encryption signature and sent to the receiving end of the power system. The receiving file of the receiving end is then obtained and locked, and is unlocked only after subsequent security verification, further improving the security of the power system. The digital encryption signature is then decrypted with the asymmetric encryption public key to generate a receiving summary identifier, and the original summary identifier and the receiving summary identifier are compared to verify the information. The information transmission security generates an identification security verification result, which can make a preliminary judgment on the received data to confirm whether it has been tampered with. When the preliminary judgment result is safe, the communication data is input into the trained transmission behavior model, and the communication process between the sender and the receiver is judged again to confirm whether there is a possibility of interception and tampering. The information security probability is generated, and when the information security probability is greater than or equal to the preset probability threshold, that is, when the second judgment is also normal, a third judgment is made, respectively collecting the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the device with the same source as the sender, and determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint to confirm whether the device at the sender is authentic, avoiding the possibility of simulated devices intercepting and tampering with information, and finally generating an accurate information transmission normal report, and unlocking the confirmed safe received file for system use. The present invention can greatly reduce the risk of information being intercepted and tampered by encryption and layered three-layer verification, and each layer has a different verification angle, which can accurately confirm whether the received information has been tampered with. Finally, the secure file after three layers of precise verification is unlocked for use, greatly improving the security of the power system.

[0075] Optionally, the communication data includes data frequency data, traffic pattern data, communication path data, protocol type data and delay fluctuation data;

[0076] The trained transmission behavior model includes an input processing layer, a multi-layer GCN network, a timing network, a fusion layer and an output layer;

[0077] The input processing layer is used to classify the data frequency data, the traffic pattern data, the communication path data, the protocol type data, and the delay fluctuation data into graph data and non-graph data;

[0078] The multi-layer GCN network extracts the node representation corresponding to the graph data based on the attention mechanism;

[0079] The time series network is used to extract time series features corresponding to the non-graph data;

[0080] The fusion layer is used to fuse all the node representations and the time series features to generate fusion features;

[0081] The output layer is used to generate the information security probability according to the fusion features using an activation function.

[0082] Specifically, communication data includes data frequency data, traffic pattern data, communication path data, protocol type data, and delay fluctuation data. Communication path data is graph data, while data frequency data, traffic pattern data, protocol type data, and delay fluctuation data are non-graph data. The trained transmission behavior model consists of a sequentially connected input processing layer, a multi-layer GCN network, a time series network, a fusion layer, and an output layer. The input processing layer is used to classify data frequency data, traffic pattern data, communication path data, protocol type data, and delay fluctuation data into graph data and non-graph data, and perform standardization and normalization to obtain standardized graph and non-graph data. The multi-layer GCN network uses multiple layers of GCN to capture node relationships of varying depths. Through an attention mechanism, the model dynamically focuses on different nodes or edges, improving sensitivity to key information and extracting node representations corresponding to the graph data. The time series network is used to extract time series features corresponding to the non-graph data. The fusion layer is used to fuse all node representations and time series features to generate fused features. The output layer outputs the security probability of the current communication data through a series of fully connected layers plus a Softmax activation function, generating an information security probability based on the fused features.

[0083] Optionally, the temporal network includes a dynamic time step embedding unit, a multi-scale convolutional attention unit, an adaptive sparse memory enhanced Transformer, and a state-aware gated recurrent unit;

[0084] The dynamic time step embedding unit is used to embed the time series features into time intervals using a position encoding function to generate a time interval embedding vector sequence;

[0085] The multi-scale convolutional attention unit is used to perform local correlation extraction and attention weighting on the time interval embedding vector sequence at multiple time granularities to generate enhanced local attention features;

[0086] The adaptive sparse memory-enhanced Transformer is used to fuse the external memory matrix to the enhanced local attention feature to generate a memory-enhanced attention feature;

[0087] The state-aware gated recurrent unit is used to capture the long-term dependencies of the memory-enhanced attention features based on a state-aware mechanism and generate the time series features.

[0088] Specifically, the temporal network includes a dynamic time step embedding unit, a multi-scale convolutional attention unit, an adaptive sparse memory enhanced Transformer, and a state-aware gated recurrent unit connected in sequence; the dynamic time step embedding unit is used to encode irregular time intervals into vector representations using a position encoding function, and embed time series features into time intervals to help the model understand the relative time distance between events and generate a time interval embedding vector sequence; the multi-scale convolutional attention unit is used to extract local correlation and perform attention weighting on the time interval embedding vector sequence at multiple time granularities, that is, to extract local correlation from multiple time granularities and perform attention weighting. Among them, the multi-scale convolutional attention unit uses multiple one-dimensional convolution kernels (such as kernel_size = [3, 5, 7]) in parallel to extract local features. Each convolution layer is followed by LayerNorm and ReLU, and then the convolution outputs are spliced ​​and compressed to a unified dimension through linear transformation. Then, the multi-head attention mechanism is applied to capture cross-scale context dependencies and generate enhanced local attention features. The Adaptive Sparse Memory Enhanced Transformer adds a long-term memory mechanism to the traditional Transformer to improve the model's ability to model long-term dependencies and introduce an external memory matrix. In each Transformer block, the current enhanced local attention feature is similar to the memory library, the most relevant memory fragment is selected, and the most relevant memory fragment is fused with the enhanced local attention feature to generate a memory-enhanced attention feature with long-term memory enhancement. The state-aware gated recurrent unit further captures the long-term dependencies in the sequence and introduces a state-aware mechanism to enhance the model's sensitivity to abnormal behavior and generate time series features. The state-aware gated recurrent unit first obtains the preliminary sequence hidden state through a bidirectional gated recurrent unit, and then inputs the result into the state-aware LSTM model. The state-aware LSTM model adjusts the activation thresholds of the forget gate and input gate based on the state change in the previous step, and defines a state change detection function, such as Euclidean distance or cosine similarity, to dynamically adjust the gating mechanism to ultimately generate time series features.

[0089] Optionally, the fusion layer includes a heterogeneous information network unit, a projection transformation unit, and a deep neural decision forest unit;

[0090] The heterogeneous information network unit is used to capture the semantic relationship between all the node representations and the time series features, and generate a semantic relationship embedding vector;

[0091] The projection transformation unit is used to project the semantic relationship embedding vector, all the node representations and the time series features into the same latent space, and perform linear transformation to generate preliminary fusion features;

[0092] The deep neural decision forest unit is used to further refine the preliminary fusion features based on the hierarchical characteristics of the decision tree to generate the fusion features.

[0093] Specifically, the fusion layer consists of a sequentially connected heterogeneous information network unit, a projection unit, and a deep neural decision forest unit. The heterogeneous information network (HIN) unit can model different types of nodes (e.g., users, items, locations) and edges (e.g., friendships, visit history). For communication data, this can potentially lead to a better understanding of the correlations between different communication patterns, such as how data of a certain protocol type affects traffic patterns along a specific path. The HIN unit, through its learned embedding vectors, can capture the complex semantic relationships between these different types of entities—that is, between all node representations and time series features. This enhances the model's understanding of diverse data sources, improving the robustness and accuracy of the overall system, and generating a semantic relationship embedding vector. The projection unit projects the semantic relationship embedding vector, all node representations, and time series features into the same latent space and performs a linear transformation to generate preliminary fused features. The deep neural decision forest unit further refines the preliminary fused features based on the hierarchical nature of decision trees. The preliminary fused features are used as input to train a series of decision trees, each splitting based on a different subset of features. For each sample data of the decision tree, its path in all trees is recorded and converted into binary encoding form to form a new feature representation, that is, to generate fusion features.

[0094] Optionally, determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint includes:

[0095] respectively constructing an actual spatial intensity map of the actual physical fingerprint and an auxiliary spatial intensity map of the auxiliary physical fingerprint;

[0096] Mapping the actual space intensity map and the auxiliary space intensity map to a low-dimensional space respectively, and using a kernel density estimation method to construct actual probability distribution characteristics of the actual space intensity map in the low-dimensional space and auxiliary probability distribution characteristics of the auxiliary space intensity map in the low-dimensional space respectively;

[0097] The physical similarity is generated according to the actual probability distribution feature and the auxiliary probability distribution feature.

[0098] Specifically, each sampling point in the physical fingerprint is used as a node in the actual spatial intensity map. A sampling point is a specific data point extracted from the physical fingerprint that reflects the operating characteristics of the device at that moment. When the physical fingerprint includes the opening and closing coil current waveform, power frequency harmonic components, and shaft torsional vibration frequency waveform, these waveforms are time-aligned before sampling to obtain a unified time series of sampling points. The connection distance between nodes is first determined. Connection distance refers to the temporal distance between two nodes. Then, the signal difference between the nodes is determined. Signal difference refers to the difference between the signal features represented by the two nodes. This difference can be measured using Euclidean distance. The combination of the connection distance and signal difference between the sampling points is set as the edge weight. The combination of connection distance and signal difference can be calculated using a weighted method. A spatial intensity map is then constructed based on the node and edge weights. Specifically, if the edge weight between two nodes is less than a preset edge threshold, an edge is constructed between the two nodes. This judgment is repeated and an edge is constructed between every two nodes until all nodes are judged, resulting in a spatial intensity map. Therefore, based on this step, the actual spatial intensity map can be constructed based on the node and edge weights of the actual physical fingerprint, and the auxiliary spatial intensity map can be constructed based on the node and edge weights of the auxiliary physical fingerprint. Laplacian eigenmaps are then used to map the actual spatial intensity map and the auxiliary spatial intensity map to low-dimensional space, respectively. Kernel density estimation is then used to construct the actual probability distribution characteristics of the actual spatial intensity map in low-dimensional space, and the auxiliary probability distribution characteristics of the auxiliary spatial intensity map in low-dimensional space. The actual probability distribution characteristics and the auxiliary probability distribution characteristics express the distribution characteristics of the actual physical fingerprint and the auxiliary physical fingerprint in low-dimensional space. Therefore, the physical similarity can be determined based on the actual probability distribution characteristics and the auxiliary probability distribution characteristics.

[0099] Optionally, generating the physical similarity according to the actual probability distribution feature and the auxiliary probability distribution feature includes:

[0100] According to the actual probability distribution characteristics and the auxiliary probability distribution characteristics, the physical similarity is generated using a physical similarity formula and an interference function, wherein the physical similarity formula includes:

[0101] ;

[0102] Wherein, S is the physical similarity, F real is the actual probability distribution characteristic, F aux is the auxiliary probability distribution feature, is the scaling factor, D is the interference function, To enhance the nonlinear discrimination ability factor.

[0103] Specifically, an interference function is set in the physical similarity formula to simulate the interference of environmental changes on the signal to increase the accuracy of the technology. The nonlinear discrimination ability enhancement factor can enhance the nonlinear discrimination ability so that small differences are amplified when calculating the similarity score, thereby increasing the sensitivity to subtle differences and generating accurate physical similarity.

[0104] Optionally, after generating the information transmission exception report, the method further includes:

[0105] The communication connection between the sending end and the receiving end is disconnected, and the received file is deleted.

[0106] Specifically, in abnormal circumstances, in order to prevent further harm from intercepted and tampered files, Xu disconnected the communication connection between the sender and the receiver and deleted the received files to ensure the safety of the power system.

[0107] like Figure 2 As shown, an embodiment of the present invention provides a power system information security transmission device, including:

[0108] An encryption module is used to obtain information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature;

[0109] a packaging module, configured to package the information to be transmitted and the digital encryption signature, and send the package to a receiving end of the power system;

[0110] a decryption module, configured to acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a received summary identifier, compare the original summary identifier with the received summary identifier, verify the information transmission security, and generate an identifier security verification result;

[0111] a probability module, configured to, when the identification security verification result is secure, obtain communication data between the transmitting end and the receiving end corresponding to the information to be transmitted, input the communication data into a trained transmission behavior model, and generate an information security probability;

[0112] a similarity module, configured to, when the information security probability is greater than or equal to a preset probability threshold, respectively collect the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determine the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and, when the physical similarity is greater than or equal to a preset similarity threshold, generate an information transmission normal report and unlock the received file;

[0113] The result module is used to generate an information transmission abnormality report when the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold.

[0114] like Figure 3 As shown, an electronic device 300 provided by an embodiment of the present invention includes a memory 310 and a processor 320; the memory 310 is used to store computer programs; the processor 320 is used to implement the above-mentioned method for secure transmission of power system information when executing the computer program.

[0115] In other words, an electronic device 300 includes a memory 310 and a processor 320 coupled to the memory 310; the memory 310 is configured to store a computer program; and the processor 320 is configured to perform the following operations when executing the computer program:

[0116] Acquire information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature;

[0117] Packaging the information to be transmitted and the digital encryption signature, and sending them to a receiving end of the power system;

[0118] Acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a receiving summary identifier, compare the original summary identifier with the receiving summary identifier, verify the information transmission security, and generate an identifier security verification result;

[0119] When the identification security verification result is safe, obtaining communication data between the sending end and the receiving end corresponding to the information to be transmitted, inputting the communication data into the trained transmission behavior model, and generating an information security probability;

[0120] When the information security probability is greater than or equal to a preset probability threshold, respectively collecting the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and when the physical similarity is greater than or equal to a preset similarity threshold, generating an information transmission normal report and unlocking the received file;

[0121] When the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold, an information transmission abnormality report is generated.

[0122] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the above-mentioned method for secure transmission of power system information is implemented.

[0123] In other words, a non-volatile computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to perform the following operations:

[0124] Acquire information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature;

[0125] Packaging the information to be transmitted and the digital encryption signature, and sending them to a receiving end of the power system;

[0126] Acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a receiving summary identifier, compare the original summary identifier with the receiving summary identifier, verify the information transmission security, and generate an identifier security verification result;

[0127] When the identification security verification result is safe, obtaining communication data between the sending end and the receiving end corresponding to the information to be transmitted, inputting the communication data into the trained transmission behavior model, and generating an information security probability;

[0128] When the information security probability is greater than or equal to a preset probability threshold, respectively collecting the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and when the physical similarity is greater than or equal to a preset similarity threshold, generating an information transmission normal report and unlocking the received file;

[0129] When the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold, an information transmission abnormality report is generated.

[0130] An electronic device 300 that can serve as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device 300 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 300 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0131] Electronic device 300 includes a computing unit that can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. An input / output (I / O) interface is also connected to the bus.

[0132] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM). In this application, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network elements. Some or all of these units can be selected based on actual needs to achieve the objectives of the embodiments of the present invention. Furthermore, the functional units in the various embodiments of the present invention can be integrated into a single processing unit, each unit can exist physically separately, or two or more units can be integrated into a single unit. These integrated units can be implemented in either hardware or software functional units.

[0133] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A method for secure transmission of power system information, characterized in that: include: Acquire information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature; Packaging the information to be transmitted and the digital encryption signature, and sending them to a receiving end of the power system; Acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a receiving summary identifier, compare the original summary identifier with the receiving summary identifier, verify the information transmission security, and generate an identifier security verification result; When the identification security verification result is safe, obtaining communication data between the sending end and the receiving end corresponding to the information to be transmitted, inputting the communication data into the trained transmission behavior model, and generating an information security probability; When the information security probability is greater than or equal to a preset probability threshold, respectively collecting the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determining the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and when the physical similarity is greater than or equal to a preset similarity threshold, generating an information transmission normal report and unlocking the received file; When the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold, an information transmission abnormality report is generated; The communication data includes data frequency data, traffic pattern data, communication path data, protocol type data and delay fluctuation data; The trained transmission behavior model includes an input processing layer, a multi-layer GCN network, a timing network, a fusion layer and an output layer; The input processing layer is used to classify the data frequency data, the traffic pattern data, the communication path data, the protocol type data, and the delay fluctuation data into graph data and non-graph data; The multi-layer GCN network extracts node representations corresponding to the graph data based on the attention mechanism; The time series network is used to extract time series features corresponding to the non-graph data; The fusion layer is used to fuse all the node representations and the time series features to generate fusion features; The output layer is used to generate the information security probability according to the fusion feature using an activation function; The determining of the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint includes: respectively constructing an actual spatial intensity map of the actual physical fingerprint and an auxiliary spatial intensity map of the auxiliary physical fingerprint; Mapping the actual space intensity map and the auxiliary space intensity map to a low-dimensional space respectively, and using a kernel density estimation method to construct actual probability distribution characteristics of the actual space intensity map in the low-dimensional space and auxiliary probability distribution characteristics of the auxiliary space intensity map in the low-dimensional space respectively; generating the physical similarity according to the actual probability distribution feature and the auxiliary probability distribution feature; Generating the physical similarity according to the actual probability distribution feature and the auxiliary probability distribution feature includes: According to the actual probability distribution characteristics and the auxiliary probability distribution characteristics, the physical similarity is generated using a physical similarity formula and an interference function, wherein the physical similarity formula includes: ； Wherein, S is the physical similarity, F real is the actual probability distribution characteristic, F aux is the auxiliary probability distribution feature, is the scaling factor, D is the interference function, To enhance the nonlinear discrimination ability factor.

2. The method for secure transmission of power system information according to claim 1, characterized in that: The temporal network includes a dynamic time step embedding unit, a multi-scale convolutional attention unit, an adaptive sparse memory enhanced Transformer, and a state-aware gated recurrent unit; The dynamic time step embedding unit is used to embed the time series features into time intervals using a position encoding function to generate a time interval embedding vector sequence; The multi-scale convolutional attention unit is used to perform local correlation extraction and attention weighting on the time interval embedding vector sequence at multiple time granularities to generate enhanced local attention features; The adaptive sparse memory-enhanced Transformer is used to fuse the external memory matrix to the enhanced local attention feature to generate a memory-enhanced attention feature; The state-aware gated recurrent unit is used to capture the long-term dependencies of the memory-enhanced attention features based on a state-aware mechanism and generate the time series features.

3. The method for secure transmission of power system information according to claim 1, characterized in that: The fusion layer includes a heterogeneous information network unit, a projection transformation unit and a deep neural decision forest unit; The heterogeneous information network unit is used to capture the semantic relationship between all the node representations and the time series features, and generate a semantic relationship embedding vector; The projection transformation unit is used to project the semantic relationship embedding vector, all the node representations and the time series features into the same latent space, and perform linear transformation to generate preliminary fusion features; The deep neural decision forest unit is used to further refine the preliminary fusion features based on the hierarchical characteristics of the decision tree to generate the fusion features.

4. The method for secure transmission of power system information according to any one of claims 1 to 3, characterized in that: After generating the information transmission abnormality report, the method further includes: The communication connection between the sending end and the receiving end is disconnected, and the received file is deleted.

5. A power system information security transmission device, characterized in that: include: An encryption module is used to obtain information to be transmitted from the power system, extract an original summary identifier of the information to be transmitted using a hash algorithm, and encrypt the original summary identifier using a private key of an asymmetric encryption to generate a digital encryption signature; a packaging module, configured to package the information to be transmitted and the digital encryption signature, and send the package to a receiving end of the power system; a decryption module, configured to acquire and lock the received file of the receiving end, decrypt the digital encryption signature using the public key of the asymmetric encryption, generate a received summary identifier, compare the original summary identifier with the received summary identifier, verify the information transmission security, and generate an identifier security verification result; a probability module, configured to, when the identification security verification result is secure, obtain communication data between the transmitting end and the receiving end corresponding to the information to be transmitted, input the communication data into a trained transmission behavior model, and generate an information security probability; a similarity module, configured to, when the information security probability is greater than or equal to a preset probability threshold, respectively collect the actual physical fingerprint of the sender and the auxiliary physical fingerprint of the same source device as the sender, determine the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint, and, when the physical similarity is greater than or equal to a preset similarity threshold, generate an information transmission normal report and unlock the received file; A result module, configured to generate an information transmission anomaly report when the identification security verification result is abnormal, or the information security probability is less than a preset probability threshold, or the physical similarity is less than a preset similarity threshold; The communication data includes data frequency data, traffic pattern data, communication path data, protocol type data and delay fluctuation data; The trained transmission behavior model includes an input processing layer, a multi-layer GCN network, a timing network, a fusion layer and an output layer; The input processing layer is used to classify the data frequency data, the traffic pattern data, the communication path data, the protocol type data, and the delay fluctuation data into graph data and non-graph data; The multi-layer GCN network extracts the node representation corresponding to the graph data based on the attention mechanism; The time series network is used to extract time series features corresponding to the non-graph data; The fusion layer is used to fuse all the node representations and the time series features to generate fusion features; The output layer is used to generate the information security probability according to the fusion feature using an activation function; The determining of the physical similarity between the actual physical fingerprint and the auxiliary physical fingerprint includes: respectively constructing an actual spatial intensity map of the actual physical fingerprint and an auxiliary spatial intensity map of the auxiliary physical fingerprint; Mapping the actual space intensity map and the auxiliary space intensity map to a low-dimensional space respectively, and using a kernel density estimation method to construct actual probability distribution characteristics of the actual space intensity map in the low-dimensional space and auxiliary probability distribution characteristics of the auxiliary space intensity map in the low-dimensional space respectively; generating the physical similarity according to the actual probability distribution feature and the auxiliary probability distribution feature; Generating the physical similarity according to the actual probability distribution feature and the auxiliary probability distribution feature includes: According to the actual probability distribution characteristics and the auxiliary probability distribution characteristics, the physical similarity is generated using a physical similarity formula and an interference function, wherein the physical similarity formula includes: ； Wherein, S is the physical similarity, F real is the actual probability distribution characteristic, F aux is the auxiliary probability distribution feature, is the scaling factor, D is the interference function, To enhance the nonlinear discrimination ability factor.

6. An electronic device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is configured to implement the method for securely transmitting power system information according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by the processor, the method for secure transmission of power system information according to any one of claims 1 to 4 is implemented.

Images