Power system network security detection method, device, equipment and medium

Abstract

The present invention provides a power system network security detection method, apparatus, equipment, and medium, relating to the technical field of network security detection. The method comprises determining the node importance of each network node in the network topology structure based on network traffic data, extracting the delay time node curve, fluctuation time node curve, packet loss rate time node curve, and connection failure time node data of each network node, and constructing a network traffic time graph; inputting the graph structure, time series feature vector, and log semantic embedding vector into a trained security detection model to obtain a security detection score; generating a power system network security detection score based on the node importance and the security detection score of each network node; and dynamically adjusting the anomaly determination criteria based on real-time network performance parameters based on an adaptive threshold mechanism. A security detection result is generated based on the power system network security detection score and the anomaly determination criteria. The present invention can improve the accuracy of security detection.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a method, device, equipment and medium for network security detection of an electric power system. Background Art

[0002] Power system network security testing is a key step in protecting power infrastructure from cyberattacks. With the deep integration of information technology and power systems, the majority of primary and secondary equipment in power systems are connected via network communications. This includes primary equipment such as power generation, substation, and distribution equipment, as well as secondary equipment such as relay protection devices, measurement and control devices, and other specialized equipment. This increases the cybersecurity threats facing power systems. Therefore, implementing effective network security testing methods is crucial for protecting power systems.

[0003] In related technologies, power system networks mainly deploy intrusion detection systems (IDS) to monitor network security in real time and identify potential threats. However, IDS may generate a large number of false alarms (i.e., mistakenly labeling normal activities as attacks), and its detection capabilities for new or unknown attacks are limited, resulting in low accuracy of network security detection. Summary of the Invention

[0004] The problem solved by the present invention is how to improve the accuracy of network security detection.

[0005] To solve the above problems, the present invention provides a power system network security detection method, device, equipment and medium.

[0006] In a first aspect, the present invention provides a power system network security detection method, which is applied to a power system, wherein the power system includes a power generation side device, a substation side device, a power distribution device, a relay protection device, and a measurement and control device connected to a network communication;

[0007] The power system network security detection method comprises:

[0008] Obtaining a network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system, and determining the node importance of each network node in the network topology structure based on the log data, wherein each network node has a one-to-one correspondence with the power generation side equipment, the power transformation side equipment, the power distribution equipment, the relay protection device, and the measurement and control device;

[0009] Extracting the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data of each network node according to the network traffic data, and constructing a network traffic time graph for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data;

[0010] extracting the graph structure and time series feature vector of the network traffic time graph and the log semantic embedding vector of the log data respectively;

[0011] Inputting the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node;

[0012] A power system network security detection score is generated based on the node importance and the security detection score of each network node, and based on an adaptive threshold mechanism, the abnormality judgment standard is dynamically adjusted according to the real-time network performance parameters, and a security detection result is generated based on the power system network security detection score and the abnormality judgment standard.

[0013] Optionally, the trained security detection model includes a multimodal fusion module and a scoring module;

[0014] The multimodal fusion module is used to fuse the graph structure, the time series feature vector and the log semantic embedding vector to generate a final fusion feature;

[0015] The scoring module is used to dynamically predict the final fusion features to generate the security detection score.

[0016] Optionally, the multimodal fusion module includes a multimodal linear projection unit, a cross attention unit and a fusion unit;

[0017] The multimodal linear projection unit is used to linearly map the graph structure, the time series feature vector, and the log semantic embedding vector to a unified dimensional space respectively;

[0018] The cross attention unit is used to construct a cross attention matrix between the graph structure, the time series feature vector and the log semantic embedding vector in the unified dimensional space, calculate attention weights, and splice the cross attention matrix according to the attention weights to generate a linear splicing vector;

[0019] The fusion unit is used to convert the linear splicing vector into the final fusion feature through a fully connected layer and an activation function.

[0020] Optionally, the scoring module includes a multi-head feature projection unit, a self-attention enhancement unit, a graph-aware gating unit, a multi-granularity temporal memory unit, a differentiable threshold predictor, and a dynamic score generator;

[0021] The multi-head feature projection unit is used to perform multi-view linear mapping on the final fusion feature to generate a multi-view feature set;

[0022] The self-attention enhancement unit is used to perform self-attention enhancement on the features in the multi-view feature set to generate attention-enhanced features;

[0023] The graph-aware gating unit is configured to perform graph enhancement on the attention-enhanced feature based on the acquired neighbor representation of the graph structure and generate a graph-gated feature based on a graph attention mechanism;

[0024] The multi-granularity temporal memory unit is used to extract short-term memory dependencies and long-term memory dependencies in the graph gating features through a multi-scale LSTM network, and fuse the short-term memory dependencies and the long-term memory dependencies using an attention mechanism to generate memory enhancement features;

[0025] The differentiable threshold predictor is used to predict the dynamic normal threshold boundary of the memory enhancement feature;

[0026] The dynamic score generator is used to perform nonlinear changes on the memory enhancement feature and generate the safety detection score based on the dynamic normal threshold boundary.

[0027] Optionally, the adaptive threshold mechanism includes:

[0028] When the real-time network performance parameter is higher than the historical network performance parameter, raising the abnormality determination standard;

[0029] When the real-time network performance parameter is lower than the historical network performance parameter, the abnormality determination standard is lowered.

[0030] Optionally, the extracting the graph structure and the time series feature vector of the network traffic time graph, and the log semantic embedding vector of the log data respectively includes:

[0031] Using NetworkX to construct the graph structure of the network traffic time graph;

[0032] Using Pandas to perform window aggregation on the network traffic time map to obtain the time series feature vector;

[0033] HuggingFace Transformers is used to load the RoBERTa model, encode the log data, and obtain the log semantic embedding vector.

[0034] Optionally, obtaining the network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system includes:

[0035] Acquire the network topology structure of the power system, original real-time network performance parameters, and original network traffic data and original log data corresponding to each network node in the network topology structure;

[0036] Performing data cleaning and normalization on the original real-time network performance parameters, the original network flow data, and the original log data to obtain the real-time network performance parameters, clean network flow data, and clean log data;

[0037] The clean network flow data and the clean log data are respectively divided into time windows to obtain the network flow data and the log data.

[0038] In a second aspect, the present invention provides a power system network security detection device, which is applied to the power system network security detection method as described in the first aspect, and the power system network security detection device includes:

[0039] an acquisition module, configured to acquire a network topology structure of the power system, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure, and determine the node importance of each network node in the network topology structure based on the log data;

[0040] A construction module is used to extract the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data of each network node according to the network traffic data, and construct a network traffic time map for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data;

[0041] An extraction module, configured to extract the graph structure and time series feature vector of the network traffic time graph, and the log semantic embedding vector of the log data;

[0042] A scoring module, configured to input the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node;

[0043] A result module is used to generate a power system network security detection score based on the node importance and the security detection score of each network node, and based on an adaptive threshold mechanism, dynamically adjust the abnormality judgment standard according to the real-time network performance parameters, and generate a security detection result based on the power system network security detection score and the abnormality judgment standard.

[0044] In a third aspect, the present invention provides an electronic device comprising a memory and a processor;

[0045] The memory is used to store computer programs;

[0046] The processor is configured to implement the power system network security detection method as described in the first aspect when executing the computer program.

[0047] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the power system network security detection method as described in the first aspect is implemented.

[0048] The beneficial effects of the power system network security detection method, device, equipment and medium of the present invention are:

[0049] According to the log data, the node importance of each network node in the network topology is determined, and the role weight of each network node in the power system can be analyzed, which is helpful to identify the key equipment of the power system and facilitate subsequent analysis. According to the network traffic data, the delay time node curve, fluctuation time node curve, packet loss rate time node curve and connection failure time node data of each network node are extracted respectively, which can more finely capture the potential attack of the power system network or the small fluctuation caused by network intrusion, so that the subsequent detection results are more accurate. Through the delay time node curve, fluctuation time node curve, packet loss rate time node curve and connection failure time node data, the network traffic time map of each network node is constructed respectively. Various types of traffic data can be reflected on the same map, which is convenient for simultaneous analysis, can reduce analysis time and improve analysis speed. Then, by combining the map of each network node The structure, time series feature vector and log semantic embedding vector are input into the trained security detection model, which can mine potential threats from three perspectives: topological relationship, time change and log content, so that the model can better distinguish normal behavior from abnormal behavior, reduce false positives and missed negatives, improve the accuracy of security detection, and obtain a more accurate security detection score for each network node. Then, based on the node importance and the security detection score of each network node, the power system network security detection score is generated, which can make the power system network security detection score more focused on key equipment. Even if there are slight abnormalities in key equipment, they can be discovered in time. Finally, based on the adaptive threshold mechanism, the abnormality judgment standard is dynamically adjusted according to the real-time network performance parameters, and the security detection results are generated according to the power system network security detection score and the abnormality judgment standard, which can avoid false alarms caused by network differences and make the security detection results more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A schematic diagram of a flow chart of a power system network security detection method provided by one embodiment of the present invention;

[0051] Figure 2 A schematic diagram of the structure of a power system network security detection device provided by one embodiment of the present invention;

[0052] Figure 3 A schematic structural diagram of an electronic device provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0053] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, specific embodiments of the present invention are described in detail below with reference to the accompanying drawings. Although certain embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present invention. It should be understood that the drawings and embodiments of the present invention are for illustrative purposes only and are not intended to limit the scope of protection of the present invention.

[0054] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0055] The term "including" and its variations used in this document are open inclusions, that is, "including but not limited to"; the term "based on" means "based at least in part on"; the term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments"; the term "optionally" means "optional embodiments". The relevant definitions of other terms will be given in the following description. It should be noted that the concepts of "first", "second", etc. mentioned in the present invention are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0056] It should be noted that the modifications of "one" and "multiple" mentioned in the present invention are illustrative rather than restrictive. Those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0057] The names of the messages or information exchanged between multiple devices in the embodiments of the present invention are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0058] In response to the problems existing in the above-mentioned related technologies, this embodiment provides a power system network security detection method, device, equipment and medium.

[0059] like Figure 1 As shown, an embodiment of the present invention provides a power system network security detection method, which is applied to a power system, wherein the power system includes a power generation side device, a substation side device, a distribution device, a relay protection device, and a measurement and control device connected to the network communication;

[0060] The power system network security detection method comprises:

[0061] Obtain the network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system, and determine the node importance of each network node in the network topology structure based on the log data, wherein each network node has a one-to-one correspondence with the power generation side equipment, the substation side equipment, the distribution equipment, the relay protection device, and the measurement and control device.

[0062] Specifically, the network topology can clearly define the spatial distribution of each device in the power system. That is, each network node in the network topology represents a device in the power system, such as the power generation side equipment, substation side equipment, and distribution equipment in the primary equipment, and the relay protection device, measurement and control device, and other special equipment in the secondary equipment. Moreover, each network node has corresponding network traffic data and log data. Real-time network performance parameters can indicate the network quality of the network communication connection between each device in the power system. When the real-time network performance parameters are high, it means that the network quality of the network communication connection between each device in the power system is good. When the real-time network performance parameters are low, it means that the network quality of the network communication connection between each device in the power system is poor. Network traffic data refers to the network operation data of the power system, such as delay time node data, fluctuation time node data, packet loss rate time node data, and connection failure time node data. Log data refers to data that records user activities, system events, and error information. According to the number of events in the log data, the node importance of each network node in the network topology structure is determined. That is, when the log data of a network node is more than the log data of other network nodes, it means that the network node has processed more events, which means that the network node is more important than other network nodes, and its corresponding node importance is also greater. The more important the network node, the easier it is to be attacked. Therefore, by determining the importance of the node, the focus of subsequent security detection can be improved. The greater the node importance, the greater the proportion of the corresponding network node in the security score, thereby improving the accuracy of detection.

[0063] According to the network traffic data, the delay time node curve, fluctuation time node curve, packet loss rate time node curve and connection failure time node data of each network node are extracted respectively, and according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data, the network traffic time map of each network node is constructed respectively.

[0064] Specifically, the network traffic data includes delay time node data, fluctuation time node data, packet loss rate time node data, and connection failure time node data. The time in the delay time node data, fluctuation time node data, packet loss rate time node data, and connection failure time node data is used as the horizontal axis, and the corresponding data, namely the delay data, fluctuation data, packet loss rate, and connection failure data, is used as the vertical axis to obtain the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data. The delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data are unified in time step, and the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data are set in the same graph to obtain a network traffic time graph, which is convenient for simultaneous analysis of the delay time node data, the fluctuation time node data, the packet loss rate time node data, and the connection failure time node data, thereby reducing analysis time and improving analysis speed. Among them, each network node has a corresponding network traffic time graph.

[0065] The graph structure and time series feature vector of the network traffic time graph and the log semantic embedding vector of the log data are extracted respectively.

[0066] Specifically, the IP addresses or service ports of the network nodes corresponding to the network traffic time graph are used as nodes of the graph structure, the communication relationships of the network nodes are used as edges of the graph structure, and the delay time node data, fluctuation time node data, packet loss rate time node data, and connection failure time node data are used as edge attributes to obtain the graph structure of the network traffic time graph. The delay time node data, fluctuation time node data, packet loss rate time node data, and connection failure time node data in the network traffic time graph are extracted and reduced in dimension to obtain a time series feature vector. An encoder is used to encode the log data to obtain a log semantic embedding vector, which is then input into the model for analysis.

[0067] The graph structure, the time series feature vector, and the log semantic embedding vector of each network node are input into a trained security detection model to obtain a security detection score for each network node.

[0068] Specifically, the graph structure, time series feature vector and log semantic embedding vector of each network node are input into the trained security detection model to obtain the security detection score of each network node. The trained security detection model can be trained through a variety of machine learning, deep learning models or hybrid models to improve the accuracy of security detection.

[0069] A power system network security detection score is generated based on the node importance and the security detection score of each network node, and based on an adaptive threshold mechanism, the abnormality judgment standard is dynamically adjusted according to the real-time network performance parameters, and a security detection result is generated based on the power system network security detection score and the abnormality judgment standard.

[0070] Specifically, according to the importance of the node, the security detection score of each network node is weighted and summed to generate the power system network security detection score, and based on the adaptive threshold mechanism: when the real-time network performance parameters are higher than the historical network performance parameters, the abnormality judgment standard is increased; when the real-time network performance parameters are lower than the historical network performance parameters, the abnormality judgment standard is lowered. Then, according to the power system network security detection score and the abnormality judgment standard, when the power system network security detection score is within the adjusted abnormality judgment standard range, the security detection result is safe; when the power system network security detection score is not within the adjusted abnormality judgment standard range, the security detection result is abnormal.

[0071] In this embodiment, the node importance of each network node in the network topology is determined based on the log data, and the role weight of each network node in the power system can be analyzed, which is helpful to identify the key equipment of the power system and facilitate subsequent analysis. According to the network traffic data, the delay time node curve, fluctuation time node curve, packet loss rate time node curve and connection failure time node data of each network node are extracted respectively, which can more finely capture the potential attack on the power system network or the small fluctuation caused by network intrusion, so that the subsequent detection results are more accurate. The network traffic time map of each network node is constructed respectively through the delay time node curve, fluctuation time node curve, packet loss rate time node curve and connection failure time node data. Various types of traffic data can be reflected on the same map, which is convenient for simultaneous analysis, can reduce the analysis time and improve the analysis speed. The graph structure, time series feature vector and log semantic embedding vector are input into the trained security detection model, which can mine potential threats from three perspectives: topological relationship, time change and log content, so that the model can better distinguish normal behavior from abnormal behavior, reduce false positives and missed negatives, improve the accuracy of security detection, and obtain a more accurate security detection score for each network node. Then, based on the node importance and the security detection score of each network node, the power system network security detection score is generated, which can make the power system network security detection score more focused on key equipment. Even if there are slight abnormalities in key equipment, they can be discovered in time. Finally, based on the adaptive threshold mechanism, the abnormality judgment standard is dynamically adjusted according to the real-time network performance parameters, and the security detection results are generated according to the power system network security detection score and the abnormality judgment standard, which can avoid false alarms caused by network differences and make the security detection results more accurate.

[0072] Optionally, the trained security detection model includes a multimodal fusion module and a scoring module;

[0073] The multimodal fusion module is used to fuse the graph structure, the time series feature vector and the log semantic embedding vector to generate a final fusion feature;

[0074] The scoring module is used to dynamically predict the final fusion features to generate the security detection score.

[0075] Specifically, the trained security detection model includes a multimodal fusion module and a scoring module. The multimodal fusion module is used to fuse graph structures, time series feature vectors, and log semantic embedding vectors to generate a final fused feature. This module then mines potential threats from three perspectives: topological relationships, temporal changes, and log content, enabling multi-angle security analysis. The scoring module dynamically predicts the final fused feature and generates a security detection score. The scoring module can be trained using historical security data, thus acquiring the ability to analyze existing data.

[0076] Optionally, the multimodal fusion module includes a multimodal linear projection unit, a cross attention unit and a fusion unit;

[0077] The multimodal linear projection unit is used to linearly map the graph structure, the time series feature vector, and the log semantic embedding vector to a unified dimensional space respectively;

[0078] The cross attention unit is used to construct a cross attention matrix between the graph structure, the time series feature vector and the log semantic embedding vector in the unified dimensional space, calculate attention weights, and splice the cross attention matrix according to the attention weights to generate a linear splicing vector;

[0079] The fusion unit is used to convert the linear splicing vector into the final fusion feature through a fully connected layer and an activation function.

[0080] Specifically, the multimodal fusion module includes a seamlessly connected multimodal linear projection unit, a cross-attention unit, and a fusion unit. The multimodal linear projection unit linearly maps the data of each modality, namely the graph structure, the temporal feature vector, and the log semantic embedding vector, into a unified dimensional space. The hidden dimension of the space can be set to 256 or 512 to accommodate the data of each modality. The cross-attention unit is used to construct cross-attention matrices between the graph structure, temporal feature vector, and log semantic embedding vector within the unified dimensional space, namely, the cross-attention matrix between the graph structure and the temporal feature vector, the cross-attention matrix between the graph structure and the log semantic embedding vector, and the cross-attention matrix between the temporal feature vector and the log semantic embedding vector. It also calculates attention weights to clarify the temporal and spatial associations between the data of each modality. The cross-attention matrices are then concatenated based on the attention weights to generate a linear concatenation vector that reflects the characteristics of the data of each modality. The fusion unit is used to convert the linear concatenation vector into a final fused feature that reflects the characteristics of the data of each modality through a fully connected layer and an activation function, such as the ReLU activation function.

[0081] Optionally, the scoring module includes a multi-head feature projection unit, a self-attention enhancement unit, a graph-aware gating unit, a multi-granularity temporal memory unit, a differentiable threshold predictor, and a dynamic score generator;

[0082] The multi-head feature projection unit is used to perform multi-view linear mapping on the final fusion feature to generate a multi-view feature set;

[0083] The self-attention enhancement unit is used to perform self-attention enhancement on the features in the multi-view feature set to generate attention-enhanced features;

[0084] The graph-aware gating unit is configured to perform graph enhancement on the attention-enhanced feature based on the acquired neighbor representation of the graph structure and generate a graph-gated feature based on a graph attention mechanism;

[0085] The multi-granularity temporal memory unit is used to extract short-term memory dependencies and long-term memory dependencies in the graph gating features through a multi-scale LSTM network, and fuse the short-term memory dependencies and the long-term memory dependencies using an attention mechanism to generate memory enhancement features;

[0086] The differentiable threshold predictor is used to predict the dynamic normal threshold boundary of the memory enhancement feature;

[0087] The dynamic score generator is used to perform nonlinear changes on the memory enhancement feature and generate the safety detection score based on the dynamic normal threshold boundary.

[0088] Specifically, the scoring module includes a sequentially connected multi-head feature projection unit, a self-attention enhancement unit, a graph-aware gating unit, a multi-granularity temporal memory unit, a differentiable threshold predictor, and a dynamic scoring generator. The multi-head feature projection unit is used to perform multi-view linear mapping on the final fused features to generate a multi-view feature set; the self-attention enhancement unit is used to perform self-attention enhancement on the features in the multi-view feature set to strengthen key information, improve the expressiveness of key features, and generate attention-enhanced features; the graph-aware gating unit is used to perform graph enhancement on the attention-enhanced features based on the obtained neighbor representation of the graph structure and the graph attention mechanism, so as to utilize topological relationships, enhance the influence of important neighbors, and generate graph-gated features; the multi-granularity temporal memory unit is used to extract short-term memory dependencies, namely local time window LSTM, and long-term memory dependencies, namely global sequence LSTM, from the graph gating features through a multi-scale LSTM network, and use the attention mechanism to fuse short-term memory dependencies and long-term memory dependencies, model potential temporal dependency patterns, and generate memory-enhanced features; the differentiable threshold predictor is used to predict the dynamic normal threshold boundary of the memory-enhanced features through a small multi-layer perceptron; the dynamic score generator is used to perform nonlinear changes on the memory-enhanced features through another multi-layer perceptron and combined with the dynamic normal threshold boundary to achieve dynamic scoring and generate a security detection score.

[0089] Optionally, the adaptive threshold mechanism includes:

[0090] When the real-time network performance parameter is higher than the historical network performance parameter, raising the abnormality determination standard;

[0091] When the real-time network performance parameter is lower than the historical network performance parameter, the abnormality determination standard is lowered.

[0092] Specifically, when the real-time network performance parameters are higher than the historical network performance parameters, it indicates that the network performance of the network node is good, making it difficult to analyze delays, fluctuations, packet loss rates, and connection failures in the network traffic data. Therefore, the abnormality judgment standard is increased to avoid judging minor abnormalities as normal. When the real-time network performance parameters are lower than the historical network performance parameters, it indicates that the network performance of the network node is poor, making it easy to analyze delays, fluctuations, packet loss rates, and connection failures in the network traffic data. Therefore, the abnormality judgment standard is lowered to reduce analysis time and increase analysis speed.

[0093] Optionally, the extracting the graph structure and the time series feature vector of the network traffic time graph, and the log semantic embedding vector of the log data respectively includes:

[0094] Using NetworkX to construct the graph structure of the network traffic time graph;

[0095] Using Pandas to perform window aggregation on the network traffic time map to obtain the time series feature vector;

[0096] HuggingFace Transformers is used to load the RoBERTa model, encode the log data, and obtain the log semantic embedding vector.

[0097] Specifically, NetworkX is a powerful Python library for creating, manipulating, and studying complex network structures, dynamics, and functions. When constructing a network traffic time map, NetworkX is used to represent network entities (such as IP addresses or service ports) as nodes, and their interactions (such as the communication relationships between network nodes) as edges. Each edge can contain rich attribute information, such as delay time node data, fluctuation time node data, packet loss rate time node data, and connection failure time node data, thereby enriching functions to analyze these network structures, facilitating in-depth understanding of network behavior patterns, and identifying potential security threats or performance bottlenecks. Pandas is a powerful data analysis and manipulation tool suitable for processing tabular data. Pandas divides the time stream into fixed-length time windows (for example, 1 minute). For the data in each window, it is aggregated by statistically analyzing information of different dimensions (such as the number of connections, data transmission volume, etc.). The resulting time series feature vector can not only help compress the original data size, but also highlight the changing trend of time series characteristics. The HuggingFaceTransformers library provides an easy-to-use interface for loading pre-trained language models, such as BERT or RoBERTa. These models are based on the Transformer architecture and are good at capturing deep semantic information in text. By loading a suitable model through HuggingFaceTransformers, the text in unstructured log data is converted into meaningful vector representations. That is, the text of the input log data is passed to the BERT or RoBERTa model, and then the semantic embedding vector representing each log entry is extracted from the model output to obtain the log semantic embedding vector.

[0098] Optionally, obtaining the network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system includes:

[0099] Acquire the network topology structure of the power system, original real-time network performance parameters, and original network traffic data and original log data corresponding to each network node in the network topology structure;

[0100] Performing data cleaning and normalization on the original real-time network performance parameters, the original network flow data, and the original log data to obtain the real-time network performance parameters, clean network flow data, and clean log data;

[0101] The clean network flow data and the clean log data are respectively divided into time windows to obtain the network flow data and the log data.

[0102] Specifically, the original real-time network performance parameters, original network traffic data and original log data are preprocessed to obtain standard and clean real-time network performance parameters, and network traffic data and log data with uniform time steps, which are convenient for subsequent analysis.

[0103] like Figure 2 As shown, an embodiment of the present invention provides a power system network security detection device, which is applied to the power system network security detection method described above. The power system network security detection device includes:

[0104] an acquisition module, configured to acquire a network topology structure of the power system, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure, and determine the node importance of each network node in the network topology structure based on the log data;

[0105] A construction module is used to extract the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data of each network node according to the network traffic data, and construct a network traffic time map for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data;

[0106] An extraction module, configured to extract the graph structure and time series feature vector of the network traffic time graph, and the log semantic embedding vector of the log data;

[0107] A scoring module, configured to input the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node;

[0108] A result module is used to generate a power system network security detection score based on the node importance and the security detection score of each network node, and based on an adaptive threshold mechanism, dynamically adjust the abnormality judgment standard according to the real-time network performance parameters, and generate a security detection result based on the power system network security detection score and the abnormality judgment standard.

[0109] like Figure 3 As shown, an electronic device 300 provided by an embodiment of the present invention includes a memory 310 and a processor 320; the memory 310 is used to store computer programs; the processor 320 is used to implement the above-mentioned power system network security detection method when executing the computer program.

[0110] In other words, an electronic device 300 includes a memory 310 and a processor 320 coupled to the memory 310; the memory 310 is configured to store a computer program; and the processor 320 is configured to perform the following operations when executing the computer program:

[0111] Obtaining a network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system, and determining the node importance of each network node in the network topology structure based on the log data;

[0112] Extracting the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data of each network node according to the network traffic data, and constructing a network traffic time graph for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data;

[0113] extracting the graph structure and time series feature vector of the network traffic time graph and the log semantic embedding vector of the log data respectively;

[0114] Inputting the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node;

[0115] A power system network security detection score is generated based on the node importance and the security detection score of each network node, and based on an adaptive threshold mechanism, the abnormality judgment standard is dynamically adjusted according to the real-time network performance parameters, and a security detection result is generated based on the power system network security detection score and the abnormality judgment standard.

[0116] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the power system network security detection method described above is implemented.

[0117] In other words, a non-volatile computer-readable storage medium stores a computer program, which, when executed by a processor, causes the processor to perform the following operations:

[0118] Obtaining a network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system, and determining the node importance of each network node in the network topology structure based on the log data;

[0119] Extracting the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data of each network node according to the network traffic data, and constructing a network traffic time graph for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data;

[0120] extracting the graph structure and time series feature vector of the network traffic time graph and the log semantic embedding vector of the log data respectively;

[0121] Inputting the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node;

[0122] A power system network security detection score is generated based on the node importance and the security detection score of each network node, and based on an adaptive threshold mechanism, the abnormality judgment standard is dynamically adjusted according to the real-time network performance parameters, and a security detection result is generated based on the power system network security detection score and the abnormality judgment standard.

[0123] An electronic device 300 that can serve as a server or client of the present invention will now be described, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device 300 is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device 300 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0124] Electronic device 300 includes a computing unit that can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). The RAM can also store various programs and data required for device operation. The computing unit, ROM, and RAM are interconnected via a bus. An input / output (I / O) interface is also connected to the bus.

[0125] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium. When executed, the program can include the processes in the above-described method embodiments. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM). In this application, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network elements. Some or all of these units can be selected based on actual needs to achieve the objectives of the embodiments of the present invention. Furthermore, the functional units in the various embodiments of the present invention can be integrated into a single processing unit, each unit can exist physically separately, or two or more units can be integrated into a single unit. These integrated units can be implemented in either hardware or software functional units.

[0126] Although the present invention is disclosed as above, the protection scope of the present invention is not limited thereto. Those skilled in the art may make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will fall within the protection scope of the present invention.

Claims

1. A power system network security detection method, characterized in that: Applied to power systems, including power generation equipment, substation equipment, distribution equipment, relay protection devices, and measurement and control devices connected by network communication; The power system network security detection method comprises: Obtaining a network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system, and determining the node importance of each network node in the network topology structure based on the log data, wherein each network node has a one-to-one correspondence with the power generation side equipment, the power transformation side equipment, the power distribution equipment, the relay protection device, and the measurement and control device; Extracting the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data of each network node according to the network traffic data, and constructing a network traffic time graph for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve, and the connection failure time node data; extracting the graph structure and time series feature vector of the network traffic time graph and the log semantic embedding vector of the log data respectively; Inputting the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node; generating a power system network security detection score based on the node importance and the security detection score of each network node, dynamically adjusting anomaly determination criteria based on the real-time network performance parameters based on an adaptive threshold mechanism, and generating a security detection result based on the power system network security detection score and the anomaly determination criteria; The trained security detection model includes a multimodal fusion module and a scoring module; The multimodal fusion module is used to fuse the graph structure, the time series feature vector and the log semantic embedding vector to generate a final fusion feature; The scoring module is used to dynamically predict the final fusion feature to generate the security detection score; The scoring module includes a multi-head feature projection unit, a self-attention enhancement unit, a graph-aware gating unit, a multi-granularity temporal memory unit, a differentiable threshold predictor, and a dynamic score generator; The multi-head feature projection unit is used to perform multi-view linear mapping on the final fusion feature to generate a multi-view feature set; The self-attention enhancement unit is used to perform self-attention enhancement on the features in the multi-view feature set to generate attention-enhanced features; The graph-aware gating unit is configured to perform graph enhancement on the attention-enhanced feature based on the acquired neighbor representation of the graph structure and generate a graph-gated feature based on a graph attention mechanism; The multi-granularity temporal memory unit is used to extract short-term memory dependencies and long-term memory dependencies in the graph gating features through a multi-scale LSTM network, and fuse the short-term memory dependencies and the long-term memory dependencies using an attention mechanism to generate memory enhancement features; The differentiable threshold predictor is used to predict the dynamic normal threshold boundary of the memory enhancement feature; The dynamic score generator is used to perform nonlinear changes on the memory enhancement feature and generate the safety detection score based on the dynamic normal threshold boundary; The multimodal fusion module includes a multimodal linear projection unit, a cross attention unit and a fusion unit; The multimodal linear projection unit is used to linearly map the graph structure, the time series feature vector, and the log semantic embedding vector to a unified dimensional space respectively; The cross attention unit is used to construct a cross attention matrix between the graph structure, the time series feature vector and the log semantic embedding vector in the unified dimensional space, calculate attention weights, and splice the cross attention matrix according to the attention weights to generate a linear splicing vector; The fusion unit is used to convert the linear splicing vector into the final fusion feature through a fully connected layer and an activation function; The adaptive threshold mechanism includes: When the real-time network performance parameter is higher than the historical network performance parameter, raising the abnormality determination standard; When the real-time network performance parameter is lower than the historical network performance parameter, the abnormality determination standard is lowered.

2. The power system network security detection method according to claim 1, characterized in that: The extracting of the graph structure and the time series feature vector of the network traffic time graph and the log semantic embedding vector of the log data respectively includes: Using NetworkX to construct the graph structure of the network traffic time graph; Using Pandas to perform window aggregation on the network traffic time map to obtain the time series feature vector; HuggingFace Transformers is used to load the RoBERTa model, encode the log data, and obtain the log semantic embedding vector.

3. The power system network security detection method according to claim 1, characterized in that: The obtaining of the network topology structure, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure of the power system includes: Acquire the network topology structure of the power system, original real-time network performance parameters, and original network traffic data and original log data corresponding to each network node in the network topology structure; Performing data cleaning and normalization on the original real-time network performance parameters, the original network flow data, and the original log data to obtain the real-time network performance parameters, clean network flow data, and clean log data; The clean network flow data and the clean log data are respectively divided into time windows to obtain the network flow data and the log data.

4. A power system network security detection device, characterized in that: The method for detecting network security of a power system according to any one of claims 1 to 3, wherein the device for detecting network security of a power system comprises: an acquisition module, configured to acquire a network topology structure of the power system, real-time network performance parameters, and network traffic data and log data corresponding to each network node in the network topology structure, and determine the node importance of each network node in the network topology structure based on the log data; A construction module is used to extract the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data of each network node according to the network traffic data, and construct a network traffic time map for each network node according to the delay time node curve, the fluctuation time node curve, the packet loss rate time node curve and the connection failure time node data; An extraction module, configured to extract the graph structure and time series feature vector of the network traffic time graph, and the log semantic embedding vector of the log data; A scoring module, configured to input the graph structure, the time series feature vector, and the log semantic embedding vector of each network node into a trained security detection model to obtain a security detection score for each network node; a result module, configured to generate a power system network security detection score based on the node importance and the security detection score of each network node, and dynamically adjust anomaly determination criteria based on the real-time network performance parameters based on an adaptive threshold mechanism, and generate a security detection result based on the power system network security detection score and the anomaly determination criteria; The trained security detection model includes a multimodal fusion module and a scoring module; The multimodal fusion module is used to fuse the graph structure, the time series feature vector and the log semantic embedding vector to generate a final fusion feature; The scoring module is used to dynamically predict the final fusion feature to generate the security detection score; The scoring module includes a multi-head feature projection unit, a self-attention enhancement unit, a graph-aware gating unit, a multi-granularity temporal memory unit, a differentiable threshold predictor, and a dynamic score generator; The multi-head feature projection unit is used to perform multi-view linear mapping on the final fusion feature to generate a multi-view feature set; The self-attention enhancement unit is used to perform self-attention enhancement on the features in the multi-view feature set to generate attention-enhanced features; The graph-aware gating unit is configured to perform graph enhancement on the attention-enhanced feature based on the acquired neighbor representation of the graph structure and generate a graph-gated feature based on a graph attention mechanism; The multi-granularity temporal memory unit is used to extract short-term memory dependencies and long-term memory dependencies in the graph gating features through a multi-scale LSTM network, and fuse the short-term memory dependencies and the long-term memory dependencies using an attention mechanism to generate memory enhancement features; The differentiable threshold predictor is used to predict the dynamic normal threshold boundary of the memory enhancement feature; The dynamic score generator is used to perform nonlinear changes on the memory enhancement feature and generate the safety detection score based on the dynamic normal threshold boundary; The multimodal fusion module includes a multimodal linear projection unit, a cross attention unit and a fusion unit; The multimodal linear projection unit is used to linearly map the graph structure, the time series feature vector, and the log semantic embedding vector to a unified dimensional space respectively; The cross attention unit is used to construct a cross attention matrix between the graph structure, the time series feature vector and the log semantic embedding vector in the unified dimensional space, calculate attention weights, and splice the cross attention matrix according to the attention weights to generate a linear splicing vector; The fusion unit is used to convert the linear splicing vector into the final fusion feature through a fully connected layer and an activation function; The adaptive threshold mechanism includes: When the real-time network performance parameter is higher than the historical network performance parameter, raising the abnormality determination standard; When the real-time network performance parameter is lower than the historical network performance parameter, the abnormality determination standard is lowered.

5. An electronic device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is configured to implement the power system network security detection method according to any one of claims 1 to 3 when executing the computer program.

6. A computer-readable storage medium, characterized in that The storage medium stores a computer program, and when the computer program is executed by the processor, the power system network security detection method according to any one of claims 1 to 3 is implemented.

Images