Attack event prediction method and system based on low-intensity abnormal mode data

Abstract

The invention relates to the technical field of network security of a power monitoring system, and discloses an attack event prediction method and system based on low-intensity abnormal mode data, and the method comprises the steps: intercepting abnormal data fragments from historical multi-source heterogeneous data based on the low-intensity abnormal mode data selected from the historical multi-source heterogeneous data; analyzing to obtain a target abnormal data fragment; training the gating loop network model based on target key time sequence abnormal features obtained by performing feature extraction on the target abnormal data fragments to obtain a future time sequence feature prediction model; performing structured processing on the low-intensity abnormal event to obtain a spatial correlation feature topological structure; obtaining future time sequence features based on the future time sequence feature prediction model; and obtaining an attack event prediction result based on an abnormal event evolution graph constructed by fusing the future time sequence feature and the spatial correlation feature topological structure. According to the method provided by the invention, accurate identification can be carried out in the preparation stage of the attack event.

Description

Technical Field

[0001] The present invention relates to the technical field of network security of power monitoring systems, and in particular to a method and system for predicting attack events based on low-intensity abnormal pattern data. Background Art

[0002] With the rapid development of technology, power monitoring systems are moving towards intelligent and networked systems. This trend offers significant advantages in improving power system operational efficiency, optimizing resource allocation, and enhancing monitoring capabilities. However, this trend also comes at the cost of increasingly complex and severe cyberattack risks faced by power monitoring systems.

[0003] Attackers often use covert infiltration and carefully planned multi-stage attack chains to attack power dispatching and control systems. If a successful attack is successful, the normal operation of the power dispatching and control system will be severely disrupted, potentially causing a series of serious consequences such as large-scale power outages and unstable power supply, posing a huge threat to social production and life and national energy security.

[0004] Attack event prediction plays a central role in the information security protection architecture of power monitoring systems. The key to achieving accurate predictions lies in the integrated analysis of multi-source data, particularly the coordinated processing of host system logs, network communication traffic, and physical measurement data. Currently, existing methods for predicting information security attacks focus primarily on multi-source data generated before and / or during an attack. While these methods can accurately predict attacks to a certain extent, providing support for timely implementation of protective measures, they have a significant limitation: they cannot effectively predict the preparatory phase of an attack. Attackers often exploit this phase, gradually infiltrating the system through a series of exploratory operations, quietly creating the conditions for subsequent large-scale attacks and ultimately causing irreparable damage.

[0005] It can be seen that how to effectively predict the preparation stage of an attack event has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the Invention

[0006] The present invention provides an attack event prediction method and system based on low-intensity abnormal pattern data to solve the technical problem of how to effectively predict the preparation stage of an attack event. It can accurately identify the preparation stage of an attack event and prevent the occurrence of subsequent large-scale attack events.

[0007] In a first aspect, the present invention provides an attack event prediction method based on low-intensity abnormal pattern data, the method being applied in the preparation stage of the attack event, the method comprising: selecting low-intensity abnormal pattern data based on historical multi-source heterogeneous data acquired from a target power dispatching and control system, the low-intensity abnormal pattern data being defined as data having a signal strength less than a preset strength threshold and having a temporal and / or spatial distribution greater than a distance threshold; Based on the low-intensity abnormal pattern data, extract abnormal data segments from the historical multi-source heterogeneous data, perform periodicity, aggregation and burst analysis on the abnormal data segments, and obtain target abnormal data segments according to the analysis results; Extracting features from the target abnormal data segments to obtain target key time series abnormal features, and training the constructed gated recurrent network model based on the target key time series abnormal features to obtain a future time series feature prediction model; Perform node feature aggregation and image processing on the acquired low-intensity abnormal events to obtain the spatial correlation feature topology structure; In the actual prediction process, the target key time series anomaly features obtained based on real-time multi-source anomaly data are input into the future time series feature prediction model to obtain future time series features; The future time series features and the spatial correlation feature topological structure are fused to construct an abnormal event evolution map, and an attack event prediction result is obtained based on the abnormal event evolution map.

[0008] Preferably, the step of selecting low-intensity abnormal pattern data based on the acquired historical multi-source heterogeneous data corresponding to abnormal events of the target power dispatching and control system includes: Based on a first intensity threshold of the equipment load, evaluating and analyzing the acquired equipment load data to obtain an equipment load data sequence; classifying the acquired network communication data based on a second strength threshold of the communication rule to obtain a communication feature data sequence; Based on the third intensity threshold of the equipment operation rule, reliability analysis is performed on the acquired equipment measurement data to obtain an equipment operation data sequence; After aligning the time of the device load data sequence, the communication feature data sequence, and the device operation data sequence, a weighted average method is used to fuse them to obtain a fused data matrix; Calculating the local density of each data point in the fused data matrix using a preset first data distribution density function, and calculating the relative density ratio of each data point to its adjacent data points based on the local density; Low-intensity abnormal pattern data is obtained according to the relationship between the relative density ratio and the preset distance threshold.

[0009] Preferably, the performing periodicity, aggregation and burst analysis on the abnormal data segments to obtain target abnormal data segments with temporal correlation and spatial correlation includes: Obtaining a data period characteristic value based on the obtained autocorrelation coefficient of the abnormal data segment; Fitting a second data distribution density function of the abnormal data segment by a kernel density estimation algorithm, and obtaining an aggregation degree index based on the second data distribution density function; Calculating a standard deviation change rate of the abnormal data segment through a moving window, and obtaining a burst characteristic value based on the standard deviation change rate; Constructing an abnormal feature vector according to the data period characteristic value, the aggregation degree index and the burst characteristic value; A deep autoencoder is used to reconstruct the abnormal feature vector to obtain target abnormal data segments with temporal correlation and spatial correlation. The target abnormal data segments include at least: device load abnormal data segments, network communication abnormal data segments, device measurement abnormal data segments and permission change abnormal log segments.

[0010] Preferably, the feature extraction of the target abnormal data segment to obtain the target key time series abnormal feature includes: Calculating the permission change time interval of the permission change log obtained from the permission change abnormal log segment, and obtaining the permission change frequency feature sequence based on the permission change time interval; Based on the authority change frequency feature sequence, obtaining a message sending and receiving timestamp, and obtaining a round-trip delay value sequence according to the message sending and receiving timestamp; Extracting the abnormal device measurement data segments based on the round-trip delay value sequence, and performing offset analysis on the extracted abnormal device measurement data segments according to a preset first threshold value to obtain a measurement data over-limit amplitude sequence; Extracting the abnormal device load data segments based on the round-trip delay value sequence, performing offset analysis on the extracted abnormal device load data segments according to a preset second threshold value, and obtaining an excessive device load amplitude sequence; Extracting the network communication abnormal data segments based on the round-trip delay value sequence, and performing offset analysis on the extracted network communication abnormal data segments according to a preset third threshold value to obtain a network communication over-limit amplitude sequence; Standardizing the authority change frequency feature sequence, the round-trip delay value sequence, the measurement data over-limit amplitude sequence, the equipment load over-limit amplitude sequence, and the network communication over-limit amplitude sequence to obtain key timing anomaly features; The key timing anomaly features are screened to obtain target key timing anomaly features.

[0011] Preferably, the screening of the key timing anomaly features to obtain target key timing anomaly features further includes: Calculate the autocorrelation coefficient of the key time series anomaly feature using a sliding window to obtain a feature autocorrelation matrix; Using a cross-correlation function to calculate the nonlinear correlation between the characteristic autocorrelation matrices to obtain a characteristic correlation matrix; The singular value analysis method is used to quantify the contribution of low-intensity abnormal events to the feature correlation matrix, and the key timing abnormal features are selected according to the contribution quantification results to obtain target key timing abnormal features.

[0012] Preferably, the gated recurrent network model constructed according to the target key time series anomaly features is trained to obtain a future time series feature prediction model, including: A cross-validation method is used to divide the target key time series anomaly features to obtain a training set and a validation set; Setting the depth of the gated recurrent network model based on the number of hidden layer neurons, initializing the weights of the gated recurrent network model according to a normal distribution method, and obtaining an initial gated recurrent network model; The initial gated recurrent network model is trained using the training set, and the validation set is input into the trained initial gated recurrent network model to obtain a predicted sequence. The correlation coefficient between the predicted sequence and a true sequence corresponding to the target key time series anomaly feature is calculated to obtain a prediction accuracy index, where the true sequence is a future time-point data sequence in the historical multi-source heterogeneous data corresponding to the target key time series anomaly feature and has the same length as the predicted sequence; The initial gated recurrent network model is optimized according to the prediction accuracy index to obtain a future time series feature prediction model.

[0013] Preferably, the node feature aggregation and image processing of the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure includes: Obtaining low-intensity abnormal events corresponding to the low-intensity abnormal pattern data, and obtaining node spatial position coordinates from the distribution network topology structure according to the device node identifier, calculating the number of occurrences of the low-intensity abnormal events on the device node, and obtaining an event frequency matrix; Performing network structuring processing on the event frequency matrix to obtain an initial network structure; A fixed-step random walk method is used to visit network nodes of the initial network structure, and a transition probability matrix is constructed according to the co-occurrence frequency of the network node visits; Based on the transition probability matrix, calculating the spatial distances between network nodes in the initial network structure, aggregating the network nodes according to the spatial distances, and establishing propagation paths according to the association strengths of the network nodes within the aggregated group; The propagation paths are traversed by a breadth-first search algorithm to obtain a path sequence, the path sequence is quantified by a path scoring function, and the propagation paths are screened according to the quantified calculation results to obtain a spatial correlation feature topological structure.

[0014] Preferably, the fusing of the future time series features and the spatial correlation feature topological structure to construct an abnormal event evolution map includes: Performing multi-scale decomposition and feature dimension correlation calculation on the future time series features to obtain a feature correlation matrix, and constructing a time series feature weight function based on the feature correlation matrix to obtain a time series weight vector; Constructing a hierarchical tree structure based on the physical distances and electrical connection relationships between device nodes, calculating real-time update weights of the device nodes in the hierarchical tree structure using an exponential sliding average algorithm, and normalizing the spatial correlation features of the spatial correlation feature topological structure based on the real-time update weights to obtain a spatial weight vector; Calculating the association weight of the temporal weight vector and the spatial weight vector through a multi-head attention mechanism, and performing tensor splicing on the temporal weight vector and the spatial weight vector based on the association weight to obtain a spatiotemporal fusion feature vector; Based on the temporal dependency of the spatiotemporal fusion feature vectors captured by the long short-term memory network, an abnormal event evolution map is constructed.

[0015] Preferably, obtaining the attack event prediction result based on the abnormal event evolution graph includes: Conducting a quantitative situation assessment on the abnormal event evolution map, and predicting future situation trends based on the situation quantitative assessment results; A hierarchical early warning method is used to provide a graded early warning of the future trend and obtain attack event prediction results.

[0016] In a second aspect, the present invention further provides an attack event prediction system based on low-intensity abnormal pattern data, which implements the above-mentioned attack event prediction method based on low-intensity abnormal pattern data. The system includes: Data collection unit, target abnormal data segment acquisition unit, model training unit, spatial correlation feature structured processing unit, future time series feature prediction unit and attack event prediction unit; The data acquisition unit is configured to select low-intensity abnormal pattern data based on the acquired historical multi-source heterogeneous data of the target power dispatching and control system, wherein the low-intensity abnormal pattern data is set as data having a signal strength less than a preset strength threshold and a temporal and / or spatial distribution greater than a distance threshold; The target abnormal data segment acquisition unit is configured to intercept abnormal data segments from the historical multi-source heterogeneous data based on the low-intensity abnormal pattern data, perform periodicity, aggregation, and burst analysis on the abnormal data segments, and obtain target abnormal data segments according to the analysis results; The model training unit is used to extract features from the target abnormal data segment to obtain target key time series abnormal features, and train the constructed gated recurrent network model based on the target key time series abnormal features to obtain a future time series feature prediction model; The spatial correlation feature structured processing unit is used to perform node feature aggregation and image processing on low-intensity abnormal events to obtain a spatial correlation feature topological structure; The future time series feature prediction unit is used to input the target key time series anomaly features obtained based on real-time multi-source anomaly data into the future time series feature prediction model during the actual prediction process to obtain future time series features; The attack event prediction unit is used to fuse the future time series features and the spatial correlation feature topological structure to construct an abnormal event evolution map, and obtain an attack event prediction result based on the abnormal event evolution map.

[0017] The present invention provides a method and system for predicting attack events based on low-intensity abnormal pattern data. Compared with the existing technology, the embodiments of the present invention have the following beneficial effects: The attack event prediction method based on low-intensity abnormal pattern data provided by this application can accurately identify the attack event in the preparation stage, thereby preventing the occurrence of subsequent large-scale attack events. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a schematic diagram of the steps of a method for predicting attack events based on low-intensity abnormal pattern data provided by a preferred embodiment of the present invention; Figure 2 It is a structural diagram of an attack event prediction system based on low-intensity abnormal pattern data provided by a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0019] The following is a detailed explanation of the embodiments of the present invention in conjunction with the accompanying drawings. The embodiments are provided for illustrative purposes only and cannot be understood as limitations on the present invention. The accompanying drawings are for reference and illustration purposes only and do not constitute a limitation on the scope of patent protection of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In the description of the present invention, the terms "first", "second", "third", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first", "second", "third", etc. may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, the meaning of "multiple" is two or more.

[0020] In the description of the present invention, it should be noted that, unless otherwise expressly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or an indirect connection through an intermediate medium, or it can be a communication between the two components. The terms "vertical", "horizontal", "left", "right", "up", "down" and similar expressions used herein are for illustrative purposes only, and do not indicate or imply that the device or component referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. The term "and / or" used herein includes any and all combinations of one or more related listed items. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0021] In describing the present invention, it should be noted that, unless otherwise defined, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art. The terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. Those skilled in the art will understand the specific meanings of the above terms in the present invention in specific circumstances.

[0022] During the preparation phase of an attack, low-intensity anomaly patterns often appear simultaneously in multiple data sources. These patterns often manifest as weak and scattered signals that are difficult to identify directly through a single data source. Furthermore, the characteristics of low-intensity anomaly patterns are fuzzy and easily masked by normal fluctuations. Consequently, it is impossible to predict attack events in advance through low-intensity anomaly patterns, causing attackers to gradually infiltrate the system through exploratory operations during the preparation phase, ultimately leading to large-scale attacks.

[0023] Low-intensity anomaly pattern data exhibits specific regularities in temporal correlation and spatial distribution, such as temporal periodicity or spatial clustering. This regularity suggests that attackers are preparing for subsequent large-scale attacks, such as probing system weaknesses through tentative operations or covert infiltration.

[0024] In view of this, in an embodiment of the present invention, a method for predicting attack events based on low-intensity abnormal pattern data is provided. The method is applied to the preparation stage of the attack event. Figure 1 , the method comprising: S1 selects low-intensity abnormal pattern data based on the historical multi-source heterogeneous data of the target power dispatching and control system obtained, and the low-intensity abnormal pattern data is set to data with a signal strength less than a preset strength threshold and a time and / or spatial distribution greater than a distance threshold; in one embodiment of the present application, the multi-source heterogeneous data includes at least host system logs, network communication traffic data and equipment measurement data.

[0025] The host system log includes at least device load data and permission change logs. An adaptive collector is used to obtain the device load data recorded in the power host system log according to a fixed sampling period. The data integrity is evaluated by calculating the variance value of the data sampling point time interval. The variance value of the sampling point time interval is obtained by calculating the sum of the squares of the differences between two adjacent data sampling time points. The larger the variance value, the worse the data integrity. When the variance value exceeds the set variance threshold of 0.5, the data needs to be interpolated and supplemented. The time series correlation coefficient reflects the degree of association between adjacent data points. It is obtained by calculating the Pearson correlation coefficient of adjacent data points. A time series correlation coefficient greater than 0.8 indicates that the device load data has a strong time series correlation. After the integrity and correlation of the device load data are evaluated and verified, the device load data is compared with the preset first intensity threshold of the device load. When the device load data is less than the first intensity threshold, the corresponding device load data is classified into the device load data sequence.

[0026] For network communication data, during the parsing of communication packets, the network port number and packet size are extracted. The network port number is used to identify the protocol type of the network communication traffic data, which includes TCP and UDP. The packet size reflects the communication load intensity. Network communication data includes three dimensions: network port number, protocol type, and packet size. Based on the device operation rules, network communication data is divided into three categories: control instructions, status queries, and data reports. For control instructions, status queries, and data reports, corresponding second intensity thresholds are set. The packet size corresponding to the control instruction is compared with the second intensity threshold for control instructions. If the packet size corresponding to the control instruction is less than the second intensity threshold for control instructions, the corresponding network communication data is classified as a communication feature data sequence. The packet size corresponding to the status query is compared with the second intensity threshold for status queries. If the packet size corresponding to the status query is less than the second intensity threshold for status queries, the corresponding network communication data is classified as a communication feature data sequence. The packet size corresponding to the data report is compared with the second intensity threshold for data reports. If the packet size corresponding to the data report is less than the second intensity threshold for data reports, the corresponding network communication data is classified as a communication feature data sequence.

[0027] The equipment operating frequency in the equipment measurement data reflects the working status of the equipment. The normal operating frequency range is 45Hz to 55Hz. The equipment measurement accuracy value indicates the reliability of the measurement data. The accuracy levels are divided into three levels: 0.2, 0.5, and 1.0. The equipment sampling period value determines the time resolution of the data. For high-precision measurement requirements, the sampling period must be less than 20 milliseconds. Based on the three indicators of frequency deviation, measurement accuracy, and sampling period, the reliability score of the equipment measurement data is evaluated, with a score range of 0 to 100 points. The third strength threshold corresponding to the reliability is set based on the equipment operation rules, and the obtained reliability score evaluation result is compared with the third strength threshold. When the obtained reliability score evaluation result is less than the third strength threshold, the corresponding equipment measurement data is classified into the equipment operation data sequence.

[0028] After time alignment of the device load data series, the communication feature data series, and the device operation data series, a weighted average method was used to fuse them to create a fused data matrix. Specifically, the three data series were time-aligned using a sliding time window method with a window length of 10 seconds. In this application, the weights of the weighted average of the device load data series, communication feature data series, and device operation data series were set based on the importance of the data to the attack event.

[0029] The local density of each data point in the fused data matrix is calculated using a preset first data distribution density function. Based on the local density, the relative density ratio of each data point to its adjacent data points is calculated. The first data distribution density function is fitted using kernel density estimation. The relative density ratio is used to assess the degree of anomaly for each data point in the fused data matrix. The relative density ratio of each data point to its adjacent data points is used as the local anomaly factor. Data subsets with a local anomaly factor between 1.0 and 1.5 and an inter-point Euclidean distance greater than 3.0 are considered low-intensity anomaly pattern data.

[0030] The method for extracting low-intensity abnormal pattern data from historical multi-source heterogeneous data disclosed in this application can obtain low-intensity abnormal pattern data from multiple data sources, ensuring the accuracy, relevance and diversity of the low-intensity abnormal pattern data extraction.

[0031] S2. Based on the low-intensity abnormal pattern data, extract abnormal data segments from the historical multi-source heterogeneous data, perform periodicity, aggregation and burst analysis on the abnormal data segments, and obtain target abnormal data segments based on the analysis results; the data segments where the low-intensity abnormal pattern data is located can reflect the future trend of the low-intensity abnormal pattern data, so according to the preset length, extract abnormal data segments corresponding to the low-intensity abnormal pattern data from the historical multi-source heterogeneous data. The types of the extracted abnormal data segments should include: equipment load data, network communication data, equipment measurement data and permission change logs. Based on the autocorrelation coefficient of the acquired abnormal data segments, obtain the data period characteristic value, fit the second data distribution density function of the abnormal data segments through kernel density estimation, and obtain the aggregation degree index based on the second data distribution density function; calculate the standard deviation change rate of the abnormal data segments through a moving window, and obtain the burst characteristic value based on the standard deviation change rate.

[0032] The autocorrelation coefficient is used to measure the linear correlation between the data point lagged k periods behind and the current point in the time series. By finding the lag k corresponding to the peak of the autocorrelation function, the periodic characteristic value of the data is determined. For example, if the daily period k is 24, the power load data may fluctuate with a period of 24 hours.

[0033] The second data distribution density function of the abnormal data segment is fitted by kernel density estimation to reflect the clustering density of data points in different intervals. The clustering degree indicators include: kurtosis and density value. Kurtosis is used to measure the sharpness of the data distribution in the abnormal data segment. When the density value exceeds 80 data points per second, it is determined that data clustering exists in the interval.

[0034] By moving the window to calculate the standard deviation change rate, the degree of data fluctuation in the abnormal data segment is captured, the standard deviation of the data in the window is calculated, the data distribution characteristic value is obtained, and the extreme value of the statistical standard deviation is used as the sudden characteristic parameter.

[0035] Based on the data periodicity eigenvalues, aggregation index, and burstiness eigenvalues, an anomaly feature vector is constructed and reconstructed using a deep autoencoder to obtain target anomaly data segments with temporal and spatial correlation. Using a network structure consisting of three encoding and three decoding layers, the deep autoencoder reduces the original high-dimensional data into an 8-dimensional feature space, reconstructing anomaly data segments with an error of less than 1%. These target anomaly data segments exhibit both temporal and spatial correlations. These target anomaly data segments include at least: device load anomaly data segments, network communication anomaly data segments, device measurement anomaly data segments, and permission change anomaly log segments.

[0036] S3. Extract features of the target abnormal data segments to obtain target key timing abnormal features, and train the constructed gated recurrent network model based on the target key timing abnormal features to obtain a future time series feature prediction model; use the authority operation level divider to classify the authority change log records into management level, operation level, and query level, and obtain the authority change frequency feature sequence by calculating the authority change time interval; use the communication quality detector to record the message sending and receiving timestamps for the authority change frequency feature sequence, and obtain the round-trip delay value sequence by calculating the difference between the message request sending time and the response receiving time; extract the device measurement abnormal data segments based on the round-trip delay value sequence, and perform offset analysis on the extracted device measurement abnormal data segments according to the preset first threshold to obtain the measurement data excess time. The invention discloses a method for extracting abnormal data segments of equipment load based on the round-trip delay numerical sequence, performing offset analysis on the extracted abnormal data segments of equipment load according to the preset second threshold value, and obtaining an equipment load over-limit amplitude sequence; extracting abnormal data segments of network communication based on the round-trip delay numerical sequence, and performing offset analysis on the extracted abnormal data segments of network communication according to the preset third threshold value, and obtaining a network communication over-limit amplitude sequence; adopting a feature standardization processor to standardize the feature sequence of frequency of authority change, the round-trip delay numerical sequence, the measured data over-limit amplitude sequence, the equipment load over-limit amplitude sequence and the network communication over-limit amplitude sequence, adopting a feature combination algorithm to matrix-splice the five standardized feature sequences, reducing feature redundancy through the principal component analysis method, and obtaining key timing anomaly features.

[0037] In power dispatching and control systems, permission change logs contain information about the operation time, operation type, and permission level. Management-level permissions include configuration modification and parameter setting functions, operation-level permissions include issuing control commands, and query-level permissions only include data viewing. In actual operation, permission change logs for a substation show five changes to management-level permissions, eight changes to operation-level permissions, and 15 changes to query-level permissions within 10 minutes. By calculating the intervals between permission changes, the frequency characteristic values were 0.5 times / minute, 0.8 times / minute, and 1.5 times / minute, respectively. For the data segments corresponding to these permission change events, a communication quality monitor recorded the request and response messages for the control commands and calculated the round-trip delay from the timestamps. Under normal circumstances, the round-trip delay for control commands was within 50 milliseconds, but during abnormal periods, delays exceeding 200 milliseconds occurred multiple times. Analysis of these high-latency events revealed a positive correlation between round-trip delay and network load, with a significant increase when the network load exceeded 70%. In terms of equipment measurement data, taking the transformer oil temperature as an example, the oil temperature should be maintained between 45 and 65 degrees during normal operation. The equipment measurement data shows that during the abnormal period, the oil temperature fluctuated several times, reaching a maximum of 72 degrees and a minimum of 38 degrees. The deviation from the normal range reached 120% of the preset threshold. Through maximum and minimum value normalization processing, the authority change frequency feature sequence, round-trip delay numerical sequence, measurement data over-limit amplitude sequence, equipment load over-limit amplitude sequence and network communication over-limit amplitude sequence are mapped to the interval of 0 to 1, achieving dimensional unification between different physical quantities. This standardization processing method not only maintains the relative relationship between features, but also improves the comparability and interpretability of features. The five groups of standardized features are arranged in chronological order to form a key time series anomaly feature with time series characteristics.

[0038] Furthermore, a sliding window is used to calculate the autocorrelation coefficients of the key time series anomaly features to obtain the feature autocorrelation matrix; the cross-correlation function is used to calculate the nonlinear correlation between the feature autocorrelation matrices, and the feature correlation matrix is obtained through the Pearson coefficient; the singular value analysis method is used to quantify the contribution of low-intensity abnormal events on the feature correlation matrix, and the key time series anomaly features are selected according to the contribution quantification results to obtain the target key time series anomaly features.

[0039] In power dispatching and control systems, key timing anomaly features include five categories: authority change frequency, round-trip delay, measurement data overrun, equipment load overrun, and network communication overrun. These features are segmented using a 60-second sliding window with a 50% window overlap. Using substation operating data as an example, the calculated autocorrelation coefficient peaks at 0.85 at a delay of 300 seconds, indicating significant periodicity in the feature data. Data is considered stationary when the sequence variance is less than 0.1. Feature correlation analysis reveals a significant nonlinear correlation between authority change frequency and round-trip delay. When the authority change frequency increases from 2 to 8 times per minute, the round-trip delay increases from 50 milliseconds to 250 milliseconds, with a Pearson correlation coefficient of 0.92.

[0040] Autocorrelation analysis shows that the frequency of authority changes, round-trip delay values, measurement data limit violations, equipment load limit violations, and network communication limit violations have a clear temporal transmission relationship. Using singular value analysis to quantify the contribution of low-intensity anomalies to the feature correlation matrix, the contribution metric shows that authority change frequency anomalies have the greatest impact on system status, with an importance of 0.3, followed by round-trip delay anomalies, with an importance of 0.25, network communication limit violations, with an importance of 0.2, measurement data limit violations, with an importance of 1.5, and equipment load limit violations, with an importance of 1. This importance ranking reflects the evolution of anomalies: authority change frequency anomalies are often a prominent feature in the early stages of a fault, while measurement data limit violations and equipment load limit violations appear in the short period before a fault occurs. Monitoring these key features and combining their temporal correlations provides an important basis for timely detection and prevention of potential faults.

[0041] Furthermore, the constructed gated recurrent network model is trained based on the target key time series anomaly features to obtain a future time series feature prediction model. Specifically, the target key time series anomaly features are divided using a cross-validation method to obtain a training set and a validation set. Based on the gated recurrent network model, the depth of the gated recurrent network model is set based on the number of hidden layer neurons, and the weights of the gated recurrent network model are initialized using the normal distribution method to obtain an initial gated recurrent network model. The initial gated recurrent network model is trained using the training set, and the test set is input into the trained initial gated recurrent network model to obtain a predicted sequence. The correlation coefficient between the predicted sequence and the true sequence corresponding to the target key time series anomaly features is calculated to obtain a prediction accuracy index. The initial gated recurrent network model is optimized based on the prediction accuracy index to obtain a future time series feature prediction model. The true sequence is a future time moment data sequence with the same length as the predicted sequence in the historical multi-source heterogeneous data corresponding to the target key time series anomaly features.

[0042] S4. Node feature aggregation and visualization are performed on the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure; a low-intensity abnormal event is an event with low-intensity abnormal pattern data. The spatial position coordinates of the node are obtained from the distribution network topology structure according to the device node identifier, and the number of occurrences of the low-intensity abnormal event on the device node is calculated to obtain an event frequency matrix. The event frequency matrix is subjected to network structuring processing to obtain an initial network structure; a fixed-step random walk method is used to access network nodes in the initial network structure, and a transition probability matrix is constructed according to the co-occurrence frequency of network node access. Based on the transition probability matrix, a network node vector representation is obtained by a matrix decomposition method. The Euclidean distance between nodes is calculated according to the network node vector representation. If the Euclidean distance is less than a preset distance threshold, it is determined that there is an association relationship between the nodes. The network nodes are aggregated, and the node association strength is calculated according to the association relationship of the network nodes in the aggregated group. If the node association strength is greater than the preset strength threshold, a propagation path between nodes is established.

[0043] Furthermore, a breadth-first search algorithm is used to traverse the propagation paths to obtain a path sequence. This path sequence is then quantified using a path scoring function. Based on the quantified calculation results, the propagation paths are screened to obtain a spatial correlation feature topology. This application's path scoring function comprehensively considers node association strength and propagation delay. Propagation paths with a score above 0.6 are identified as core paths, reflecting the most likely spread direction of low-intensity anomalies.

[0044] In the target distribution network topology, the spatial location of device nodes is represented by longitude and latitude coordinates. The coordinates of a regional substation are 30.5 degrees north latitude and 114.3 degrees east longitude, and the distance between adjacent distribution equipment nodes ranges from 500 to 2000 meters. Low-intensity anomaly event frequency statistics show that the substation experienced 15 low-intensity anomalies within 24 hours, while adjacent distribution nodes experienced 12 and 8 anomalies, respectively. These low-intensity anomalies exhibit distinct temporal propagation characteristics. A random walk method with a step size of 4 was used to sample nodes, generating 128 access sequences of length 10 for each node. A node transition probability matrix was constructed by counting the co-occurrence frequencies of nodes in the access sequences. The spatial distance between nodes reflects their degree of topological connectivity. Spatial distance calculations show that the distance between the substation node experiencing an anomaly and its directly connected distribution nodes ranges from 0.2 to 0.4, while the distance to indirect nodes is greater than 0.8. A distance threshold of 0.5 was set, and nodes with distances below the threshold were grouped together, resulting in 12 node groups. One node group included one substation node and five distribution nodes. Low-intensity anomaly events at these nodes exhibited significant temporal transmission. Node feature aggregation employed a distance-weighted approach, with closer nodes receiving greater weights. Within these node groups, an aggregated feature reflecting the status of the entire group was calculated by calculating the weighted average of node features within the group. Node correlation strength calculations showed that the correlation strength between directly connected pairs of nodes ranged from 0.7 to 0.9, while the correlation strength across nodes decreased to 0.3 to 0.5. When low-intensity anomaly events propagate outward from the substation, they diffused step by step along physically connected paths. Propagation delay was positively correlated with physical distance, ranging from 5 to 15 minutes between adjacent nodes. A breadth-first search algorithm identified three primary propagation paths, covering distribution equipment in the east, south, and west directions. The path score comprehensively considers node connection strength and propagation delay. Propagation paths with a score above 0.6 are identified as core paths, reflecting the most likely spread direction of low-intensity anomaly events. Analysis of the node sequences along the core propagation paths reveals that low-intensity anomaly events exhibit significant spatial clustering and directionality, providing important insights for predicting their spread trends.

[0045] S5. During the actual prediction process, the target key time series anomaly features obtained based on the real-time multi-source anomaly data are input into the future time series feature prediction model to obtain future time series features. During the actual prediction process, the key time series anomaly features obtained based on the real-time multi-source anomaly data are used as feature vectors at the starting time and input into the future time series feature prediction model. Future time series features are output through cyclic calculations, and the output sequence length is determined based on the prediction time span. The predicted sequence is denormalized to restore the true numerical range of the feature data, thereby obtaining future time series features that reflect the evolution of the anomaly.

[0046] S6. Fusing the future time series features and the spatial correlation feature topological structure to construct an abnormal event evolution map, and obtaining attack event prediction results based on the abnormal event evolution map; performing multi-scale decomposition of the future time series features using wavelet transform, and calculating the mutual information entropy between feature dimensions after the multi-scale feature decomposition to obtain a feature correlation matrix. A timing feature weight function is constructed based on the feature correlation matrix to obtain a timing weight vector; a hierarchical tree structure is constructed according to the physical distance and electrical connection relationship between device nodes, and the exponential sliding average algorithm is used to calculate the real-time update weights of the device nodes in the hierarchical tree structure. The spatial correlation features of the spatial correlation feature topological structure are normalized based on the real-time update weights to obtain a spatial weight vector; the association weights of the timing weight vector and the spatial weight vector are calculated through a multi-head attention mechanism, and the timing weight vector and the spatial weight vector are tensor-spliced based on the association weights to obtain a spatiotemporal fusion feature vector; the temporal dependency of the spatiotemporal fusion feature vector is captured through a long short-term memory network, and an abnormal event evolution map is obtained based on the temporal dependency; a situation quantitative assessment is performed on the abnormal event evolution map, and the future situation trend is predicted based on the situation quantitative assessment results; a hierarchical warning method is used to perform a hierarchical warning on the future situation trend to obtain an attack event prediction result.

[0047] In power dispatching and control systems, future time series features include multidimensional feature data such as equipment operating parameters, equipment load data, communication status data, and control command data. Four-layer wavelet decomposition is used to decompose these feature data into components with different frequency bands. Taking transformer oil temperature data as an example, the decomposition yielded fluctuation components with periods of 10 minutes, 30 minutes, 1 hour, and 4 hours. Mutual information entropy calculations show that the correlation between oil temperature and the load current in equipment load data is 0.85, and the correlation with equipment operating parameters is 0.72. Based on these correlations, corresponding time series feature weights are assigned to equipment load data and equipment operating parameters. Cluster analysis of spatial correlation features is performed based on the physical location and electrical connectivity of the equipment. Within a 330 kV substation, equipment nodes can be divided into three layers based on connectivity: the substation layer, the trunk line layer, and the distribution equipment layer. The physical distance between nodes ranges from 100 meters to 5000 meters, and electrical connectivity is determined by the status of circuit breakers and disconnectors. In the hierarchical tree structure, the substation node is connected to four trunk lines, each of which is connected to six to eight distribution equipment. Feature update weights are calculated using an exponential sliding average with a decay coefficient of 0.1. In actual operation, when the current of a distribution equipment suddenly increases by 20%, the feature weight of that node rapidly increases from 0.3 to 0.7, driving a corresponding increase in the weights of adjacent nodes. The weights of the device nodes in the hierarchical tree structure are updated in real time to obtain real-time updated weights. Based on the real-time updated weights, the spatial correlation features of the spatial correlation feature topology are normalized to obtain a spatial weight vector. An eight-head attention mechanism is used to calculate the association weights between the temporal weight vector and the spatial weight vector, with each attention head capturing spatiotemporal correlation patterns at different scales. In constructing the anomaly evolution map, a convolutional neural network with three convolutional layers extracts local feature patterns, and a long short-term memory network with 64 hidden units captures long-term dependencies, based on which the anomaly event evolution map is constructed. The graph clearly shows how an anomaly propagates from the main transformer through the trunk line to the distribution equipment, with a propagation delay of 15 to 30 minutes. The situation score uses a scoring mechanism based on historical data statistics, with scores ranging from 0 to 0.3 for normal operation, 0.3 to 0.6 for minor anomalies, and greater than 0.6 for severe anomalies. A forecast indicates that the situation score for a particular distribution line will rise from 0.2 to 0.5 within the next two hours, indicating an intensifying anomaly. The tiered early warning mechanism uses three levels of thresholds: 0.4 triggers a level 3 warning, 0.5 triggers a level 2 warning, and 0.6 triggers a level 1 warning. Historical data validation shows that this early warning mechanism has an 85% accuracy rate for predicting slowly evolving, low-intensity anomalies, with an average lead time of 45 minutes. Dynamic correction of early warning results shows that when the occurrence of a low-intensity anomaly deviates from the predicted time by more than 30 minutes, the threshold is automatically adjusted by 10% to improve the accuracy of subsequent warnings.

[0048] In a preferred embodiment of the present invention, based on the historical multi-source heterogeneous data of the target power dispatching and control system obtained, low-intensity abnormal pattern data is selected, and the low-intensity abnormal pattern data is set as data with a signal strength less than a preset intensity threshold and a time and / or spatial distribution greater than a distance threshold; based on the low-intensity abnormal pattern data, abnormal data fragments are intercepted from the historical multi-source heterogeneous data, and the abnormal data fragments are analyzed for periodicity, aggregation and burstiness, and target abnormal data fragments are obtained according to the analysis results; feature extraction is performed on the target abnormal data fragments to obtain target key time series abnormal features, and the constructed gated recurrent network model is trained according to the target key time series abnormal features to obtain a future time series feature prediction model; node feature aggregation and imaging are performed on the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure; in the actual prediction process, the target key time series abnormal features obtained based on the real-time multi-source abnormal data are input into the future time series feature prediction model to obtain future time series features; the future time series features and the spatial correlation feature topological structure are fused to construct an abnormal event evolution map, and based on the abnormal event evolution map, an attack event prediction result is obtained. The attack event prediction method based on low-intensity abnormal pattern data provided by the present application can accurately identify attack events in the preparation stage, thereby preventing the occurrence of subsequent large-scale attack events.

[0049] Accordingly, if Figure 2 As shown, based on an attack event prediction method based on low-intensity abnormal pattern data, an embodiment of the present invention further provides an attack event prediction system based on low-intensity abnormal pattern data, which implements the attack event prediction method based on low-intensity abnormal pattern data disclosed in an embodiment of the present invention. The system is applied to the preparation stage of the attack event, including: a data acquisition unit 1, a target abnormal data segment acquisition unit 2, a model training unit 3, a spatial correlation feature structured processing unit 4, a future time series feature prediction unit 5 and an attack event prediction unit 6; The data acquisition unit 1 is configured to select low-intensity abnormal pattern data based on the acquired historical multi-source heterogeneous data of the target power dispatching and control system, wherein the low-intensity abnormal pattern data is defined as data having a signal strength less than a preset strength threshold and a temporal and / or spatial distribution greater than a distance threshold; The target abnormal data segment acquisition unit 2 is used to intercept abnormal data segments from the historical multi-source heterogeneous data based on the low-intensity abnormal pattern data, perform periodicity, aggregation and burst analysis on the abnormal data segments, and obtain target abnormal data segments according to the analysis results; The model training unit 3 is used to extract features from the target abnormal data segment to obtain target key time series abnormal features, and train the constructed gated recurrent network model based on the target key time series abnormal features to obtain a future time series feature prediction model; The spatial correlation feature structured processing unit 4 is used to perform node feature aggregation and image processing on the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure; The future time series feature prediction unit 5 is used to input the target key time series anomaly features obtained based on real-time multi-source anomaly data into the future time series feature prediction model to obtain future time series features during the actual prediction process; The attack event prediction unit 6 is used to fuse the future time series features and the spatial correlation feature topology structure to construct an abnormal event evolution map, and obtain an attack event prediction result based on the abnormal event evolution map.

[0050] For the specific definition of an attack event prediction system based on low-intensity abnormal pattern data, please refer to the above-mentioned definition of an attack event prediction method based on low-intensity abnormal pattern data, which will not be repeated here. A person of ordinary skill in the art will appreciate that the various modules and steps described in conjunction with the embodiments disclosed in the present invention can be implemented in hardware, software, or a combination of both. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0051] The present embodiment provides an attack event prediction method and system based on low-intensity abnormal pattern data, which are used to solve the technical problem of how to effectively predict the preparation stage of an attack event. Based on the acquired historical multi-source heterogeneous data of the target power dispatching and control system, low-intensity abnormal pattern data is selected. The low-intensity abnormal pattern data is set as data with a signal strength less than a preset intensity threshold and a time and / or spatial distribution greater than a distance threshold. Based on the low-intensity abnormal pattern data, abnormal data fragments are intercepted from the historical multi-source heterogeneous data, and the abnormal data fragments are analyzed for periodicity, aggregation, and burstiness. The target abnormal data fragments are obtained based on the analysis results. Feature extraction is performed on the target abnormal data fragments to obtain target key time series abnormal features. The constructed gated recurrent network model is trained based on the target key time series abnormal features to obtain a future time series feature prediction model. Node feature aggregation and visualization are performed on the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure. In the actual prediction process, the target key time series abnormal features obtained based on the real-time multi-source abnormal data are input into the future time series feature prediction model to obtain future time series features. The future time series features and the spatial correlation feature topological structure are fused to construct an abnormal event evolution map. Based on the abnormal event evolution map, the attack event prediction results are obtained. The attack event prediction method based on low-intensity abnormal pattern data provided by the present application can accurately identify attack events in the preparation stage, thereby preventing the occurrence of subsequent large-scale attack events.

[0052] Each embodiment in this specification is described in a progressive manner, and the same or similar parts of each embodiment can be directly referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. It should be noted that the various technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the various technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0053] The above-described embodiments merely represent several preferred implementations of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art can make several improvements and substitutions without departing from the technical principles of the present invention, and such improvements and substitutions should also be considered within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the scope of protection of the claims.

Claims

1. A method for predicting attack events based on low-intensity abnormal pattern data, characterized in that: The method is applied to the preparation stage of the attack event, and the method includes: Based on the acquired historical multi-source heterogeneous data of the target power dispatching and control system, low-intensity abnormal pattern data is selected, where the low-intensity abnormal pattern data is set as data with a signal strength less than a preset strength threshold and a temporal and / or spatial distribution greater than a distance threshold; Based on the low-intensity abnormal pattern data, extract abnormal data segments from the historical multi-source heterogeneous data, perform periodicity, aggregation and burst analysis on the abnormal data segments, and obtain target abnormal data segments according to the analysis results; Extracting features from the target abnormal data segments to obtain target key time series abnormal features, and training the constructed gated recurrent network model based on the target key time series abnormal features to obtain a future time series feature prediction model; Performing node feature aggregation and image processing on the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure; In the actual prediction process, the target key time series anomaly features obtained based on real-time multi-source anomaly data are input into the future time series feature prediction model to obtain future time series features; The future time series features and the spatial correlation feature topological structure are fused to construct an abnormal event evolution map, and an attack event prediction result is obtained based on the abnormal event evolution map.

2. The attack event prediction method based on low-intensity abnormal pattern data according to claim 1, characterized in that: The method of selecting low-intensity abnormal pattern data based on the acquired historical multi-source heterogeneous data corresponding to abnormal events of the target power dispatching and control system includes: Based on a first intensity threshold of the equipment load, evaluating and analyzing the acquired equipment load data to obtain an equipment load data sequence; classifying the acquired network communication data based on a second strength threshold of the communication rule to obtain a communication feature data sequence; Based on the third intensity threshold of the equipment operation rule, reliability analysis is performed on the acquired equipment measurement data to obtain an equipment operation data sequence; After aligning the time of the device load data sequence, the communication feature data sequence, and the device operation data sequence, a weighted average method is used to fuse them to obtain a fused data matrix; Calculating the local density of each data point in the fused data matrix using a preset first data distribution density function, and calculating the relative density ratio of each data point to its adjacent data points based on the local density; Low-intensity abnormal pattern data is obtained according to the relationship between the relative density ratio and the preset distance threshold.

3. The attack event prediction method based on low-intensity abnormal pattern data according to claim 1, characterized in that: The performing periodicity, aggregation and burst analysis on the abnormal data segments to obtain target abnormal data segments with temporal correlation and spatial correlation includes: Obtaining a data period characteristic value based on the obtained autocorrelation coefficient of the abnormal data segment; Fitting a second data distribution density function of the abnormal data segment by a kernel density estimation algorithm, and obtaining an aggregation degree index based on the second data distribution density function; Calculating a standard deviation change rate of the abnormal data segment through a moving window, and obtaining a burst characteristic value based on the standard deviation change rate; Constructing an abnormal feature vector according to the data period characteristic value, the aggregation degree index and the burst characteristic value; A deep autoencoder is used to reconstruct the abnormal feature vector to obtain target abnormal data segments with temporal correlation and spatial correlation. The target abnormal data segments include at least: device load abnormal data segments, network communication abnormal data segments, device measurement abnormal data segments and permission change abnormal log segments.

4. The attack event prediction method based on low-intensity abnormal pattern data according to claim 3, characterized in that: The feature extraction of the target abnormal data segment to obtain the target key time series abnormal feature includes: Calculating the permission change time interval of the permission change log obtained from the permission change abnormal log segment, and obtaining the permission change frequency feature sequence based on the permission change time interval; Based on the authority change frequency feature sequence, obtaining a message sending and receiving timestamp, and obtaining a round-trip delay value sequence according to the message sending and receiving timestamp; Extracting the abnormal device measurement data segments based on the round-trip delay value sequence, and performing offset analysis on the extracted abnormal device measurement data segments according to a preset first threshold value to obtain a measurement data over-limit amplitude sequence; Extracting the abnormal device load data segments based on the round-trip delay value sequence, performing offset analysis on the extracted abnormal device load data segments according to a preset second threshold value, and obtaining an excessive device load amplitude sequence; Extracting the network communication abnormal data segments based on the round-trip delay value sequence, and performing offset analysis on the extracted network communication abnormal data segments according to a preset third threshold value to obtain a network communication over-limit amplitude sequence; Standardizing the authority change frequency feature sequence, the round-trip delay value sequence, the measurement data over-limit amplitude sequence, the equipment load over-limit amplitude sequence, and the network communication over-limit amplitude sequence to obtain key timing anomaly features; The key timing anomaly features are screened to obtain target key timing anomaly features.

5. The attack event prediction method based on low-intensity abnormal pattern data according to claim 4, characterized in that: The screening of the key timing anomaly features to obtain target key timing anomaly features further includes: Calculate the autocorrelation coefficient of the key time series anomaly feature using a sliding window to obtain a feature autocorrelation matrix; Using a cross-correlation function to calculate the nonlinear correlation between the characteristic autocorrelation matrices to obtain a characteristic correlation matrix; The singular value analysis method is used to quantify the contribution of low-intensity abnormal events to the feature correlation matrix, and the key timing abnormal features are selected according to the contribution quantification results to obtain target key timing abnormal features.

6. The attack event prediction method based on low-intensity abnormal pattern data according to claim 1, characterized in that: The gated recurrent network model constructed according to the target key time series anomaly features is trained to obtain a future time series feature prediction model, including: A cross-validation method is used to divide the target key time series anomaly features to obtain a training set and a validation set; Setting the depth of the gated recurrent network model based on the number of hidden layer neurons, initializing the weights of the gated recurrent network model according to a normal distribution method, and obtaining an initial gated recurrent network model; The initial gated recurrent network model is trained using the training set, and the validation set is input into the trained initial gated recurrent network model to obtain a predicted sequence. The correlation coefficient between the predicted sequence and a true sequence corresponding to the target key time series anomaly feature is calculated to obtain a prediction accuracy index, where the true sequence is a future time-point data sequence in the historical multi-source heterogeneous data corresponding to the target key time series anomaly feature and has the same length as the predicted sequence; The initial gated recurrent network model is optimized according to the prediction accuracy index to obtain a future time series feature prediction model.

7. The attack event prediction method based on low-intensity abnormal pattern data according to claim 1, characterized in that: The node feature aggregation and image processing of the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure includes: Obtaining low-intensity abnormal events corresponding to the low-intensity abnormal pattern data, and obtaining node spatial position coordinates from the distribution network topology structure according to the device node identifier, calculating the number of occurrences of the low-intensity abnormal events on the device node, and obtaining an event frequency matrix; Performing network structuring processing on the event frequency matrix to obtain an initial network structure; A fixed-step random walk method is used to visit network nodes of the initial network structure, and a transition probability matrix is constructed according to the co-occurrence frequency of the network node visits; Based on the transition probability matrix, calculating the spatial distances between network nodes in the initial network structure, aggregating the network nodes according to the spatial distances, and establishing propagation paths according to the association strengths of the network nodes within the aggregated group; The propagation paths are traversed by a breadth-first search algorithm to obtain a path sequence, the path sequence is quantified by a path scoring function, and the propagation paths are screened according to the quantified calculation results to obtain a spatial correlation feature topological structure.

8. The attack event prediction method based on low-intensity abnormal pattern data according to claim 1, characterized in that: The fusing of the future time series features and the spatial correlation feature topology structure to construct an abnormal event evolution map includes: Performing multi-scale decomposition and feature dimension correlation calculation on the future time series features to obtain a feature correlation matrix, and constructing a time series feature weight function based on the feature correlation matrix to obtain a time series weight vector; Constructing a hierarchical tree structure based on the physical distances and electrical connection relationships between device nodes, calculating real-time update weights of the device nodes in the hierarchical tree structure using an exponential sliding average algorithm, and normalizing the spatial correlation features of the spatial correlation feature topological structure based on the real-time update weights to obtain a spatial weight vector; Calculating the association weight of the temporal weight vector and the spatial weight vector through a multi-head attention mechanism, and performing tensor splicing on the temporal weight vector and the spatial weight vector based on the association weight to obtain a spatiotemporal fusion feature vector; Based on the temporal dependency of the spatiotemporal fusion feature vectors captured by the long short-term memory network, an abnormal event evolution map is constructed.

9. The attack event prediction method based on low-intensity abnormal pattern data according to claim 8, characterized in that: The step of obtaining an attack event prediction result based on the abnormal event evolution graph includes: Conducting a quantitative situation assessment on the abnormal event evolution map, and predicting future situation trends based on the situation quantitative assessment results; A hierarchical early warning method is used to provide a hierarchical early warning of the future trend and obtain attack event prediction results.

10. An attack event prediction system based on low-intensity abnormal pattern data, implementing the attack event prediction method based on low-intensity abnormal pattern data according to any one of claims 1 to 9, characterized in that: The system is applied to the preparation stage of the attack event, and includes: a data acquisition unit, a target abnormal data segment acquisition unit, a model training unit, a spatial correlation feature structured processing unit, a future time series feature prediction unit and an attack event prediction unit; The data acquisition unit is configured to select low-intensity abnormal pattern data based on the acquired historical multi-source heterogeneous data of the target power dispatching and control system, wherein the low-intensity abnormal pattern data is set as data having a signal strength less than a preset strength threshold and a temporal and / or spatial distribution greater than a distance threshold; The target abnormal data segment acquisition unit is configured to intercept abnormal data segments from the historical multi-source heterogeneous data based on the low-intensity abnormal pattern data, perform periodicity, aggregation, and burst analysis on the abnormal data segments, and obtain target abnormal data segments according to the analysis results; The model training unit is used to extract features from the target abnormal data segment to obtain target key time series abnormal features, and train the constructed gated recurrent network model based on the target key time series abnormal features to obtain a future time series feature prediction model; The spatial correlation feature structured processing unit is used to perform node feature aggregation and image processing on the low-intensity abnormal events corresponding to the low-intensity abnormal pattern data to obtain a spatial correlation feature topological structure; The future time series feature prediction unit is used to input the target key time series anomaly features obtained based on real-time multi-source anomaly data into the future time series feature prediction model during the actual prediction process to obtain future time series features; The attack event prediction unit is used to fuse the future time series features and the spatial correlation feature topological structure to construct an abnormal event evolution map, and obtain an attack event prediction result based on the abnormal event evolution map.

Images