Intelligent power grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization

Abstract

The invention discloses a smart power grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization, which comprises the following steps: S1, collecting network flow data from a power grid environment and carrying out feature extraction and normalization processing, S2, initializing a weight value for each attack category, taking the initialized category weight as a part of a loss function, and taking the initial category weight as a part of the loss function; applying to a training process of a neural network model; s3, monitoring misclassification frequency and category prediction information entropy of each attack category in real time in a model training process, S4, constructing a category sample quantity, real-time misclassification frequency and real-time prediction information entropy as inputs, S5, optimizing a weight generation network by adopting inner layer updating and outer layer updating of meta-learning, and S5, carrying out prediction on the category prediction information entropy of each attack category. S6, a dynamic misclassification feedback module updates a category weight result in real time, the result and weight generation network parameters generated by optimization of the meta learning module act together, and neural network training is guided through a loss function; and finally, the trained model is used for real-time detection of the attack behavior of the smart power grid in a test set. The method is suitable for a multi-class and inter-class unbalanced smart grid network intrusion scene, has the capability of updating the weight in real time, and forms a closed-loop optimization mechanism.

Description

Technical Field

[0001] The present invention relates to the field of smart grid security protection technology, and in particular to a smart grid intrusion detection method based on a dynamic misclassification feedback mechanism and meta-learning collaborative optimization. Background Art

[0002] As energy systems accelerate their transformation toward intelligent and networked systems, smart grids have become the core support for modern power infrastructure. Smart grids deeply integrate power systems with information and communications technologies, presenting real-time, heterogeneous, and complex communication architectures. With the continued evolution of smart grids, large-scale data collection and network communication technologies are gradually integrated into every aspect of the power system, continuously increasing the degree of digitization and networking of power grid infrastructure.

[0003] In a smart grid environment, various types of sensors, smart meters, controllers, and electrical devices together form a heterogeneous network of devices, generating massive amounts of data and generating diverse data types. Grid control and data exchange are extremely time-sensitive, with some critical operations requiring completion within milliseconds. Building upon traditional grids, smart grids implement new features such as bidirectional real-time interaction, distributed energy resource integration, and large-scale data collection. These features expand the network scope and data flows, increasing the complexity of system operations and magnifying network security risks. Once an intrusion occurs, malicious attacks can trigger cascading failures through the highly coupled nature of the grid system, causing widespread power outages and resulting in severe economic losses. Therefore, designing an intrusion detection method with strong generalization capabilities and high detection accuracy is crucial to ensuring the security of smart grids.

[0004] Intrusion detection plays a crucial role in smart grid security and defense, and its design must comprehensively consider multiple requirements, including real-time performance, accuracy, and system resource efficiency. Compared to relying solely on preventative measures such as encryption and authentication, intrusion detection systems can monitor network-wide data flows and communication behavior in real time, thereby promptly detecting anomalous behavior before cyberattacks bypass perimeter defenses. In smart grid environments, the diverse array of devices, frequent communications, and close interconnectedness create a large number and variety of potential vulnerabilities. This requires intrusion detection methods to not only process large amounts of data but also provide real-time detection and rapid response capabilities for various anomalous behaviors.

[0005] Smart grid data is extremely imbalanced, with normal behavior data overwhelmingly dominating network traffic, while attacks account for only a tiny fraction. Due to this severe data imbalance, traditional classification models tend to prioritize the majority class in pursuit of overall accuracy, resulting in a high underreporting rate for minority attacks, which can have serious consequences for critical infrastructure. Furthermore, the limited sample size of new attack vectors and advanced persistent threats in smart grids complicates supervised learning approaches. This lack of sufficient positive training examples not only reduces the model's accuracy for identifying these low-frequency attacks but also makes it difficult to accurately distinguish malicious behavior from noise in normal data during anomaly detection. Furthermore, the smart grid network environment and attack patterns are highly dynamic. As the characteristics of normal system traffic constantly change and attackers continuously develop new intrusion strategies, pre-trained detection models that fail to promptly update and adapt to shifts in data distribution will gradually lose generalization capabilities and significantly inadequate their ability to respond to unknown attacks. It can be seen that the existing intrusion detection methods urgently need further research and improvement in terms of improving the detection capabilities of unbalanced data and small sample attacks, and enhancing the adaptability of the model to the dynamic environment of smart grids. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a fast, accurate and reliable collaborative intrusion detection method for smart grids in a smart grid scenario.

[0007] To this end, the technical solution proposed in the present invention is an intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization, comprising the following steps:

[0008] S1. Collect network traffic data from the power grid environment and perform feature extraction and normalization processing to construct time series data samples and divide them into training and test sets;

[0009] S2. Initialize weight values for each attack category and use the initialized category weights as part of the loss function in the training process of the neural network model;

[0010] S3. During model training, monitor the misclassification frequency and predicted information entropy of each attack category in real time. Calculate new category weights based on the misclassification frequency and predicted information entropy of each category in the current cycle. Apply the updated category weights to the loss function calculation for the next training cycle in real time.

[0011] S4. Construct a weight generation network that takes the number of class samples, real-time misclassification frequency, and real-time predicted information entropy as input and outputs dynamic class weights. Apply a meta-learning approach to optimize the parameters of the weight generation network, with the optimization objective being the weight generation network's ability to map input signals to output weights.

[0012] S5. Meta-learning inner and outer updates are used to optimize the weight generation network. For each attack category task, the category data is divided into a support set and a query set. In the inner update step, the support set data is used to calculate the loss function and update the task-specific parameters of the weight generation network to obtain task-specific temporary network parameters. In the outer update step, the loss function results of the query set data of each category are used to summarize and calculate the gradients of each category task, and update the global initial parameters of the weight generation network.

[0013] S6. The results of the dynamic misclassification feedback module that updates the category weights in real time work together with the weights generated by the meta-learning module to generate network parameters, guiding neural network training through the loss function. The final trained model is used in the test set for real-time detection of smart grid attack behaviors.

[0014] Furthermore, in the aforementioned S1, network traffic data is first comprehensively collected in the smart grid environment, covering normal business traffic and various types of attack traffic, and key grid characteristic parameters such as voltage, current, frequency, and phase angle are recorded in parallel; then the collected raw data is cleaned to remove missing values, outliers, and redundant information; on this basis, according to the intrusion detection requirements, key fields representing attack behaviors are extracted from the cleaned data, a feature set is constructed, and the Min-Max normalization method is used to map each feature to a unified numerical interval; then, a sliding window mechanism is used to generate continuous time series data samples, the window size is set at a fixed time interval, and the data in each window is used as the input feature matrix; finally, the constructed time series samples are divided into a training set and a test set according to a preset ratio, which are used for model training and performance evaluation, respectively.

[0015] In this way, the modular construction and flexible division of raw power grid flow data are achieved, thus providing a high-quality data foundation that is user-defined, precisely controllable, and user-friendly for intrusion detection models.

[0016] Furthermore, in the aforementioned S2, for the power grid environment intrusion detection task, the initial number of samples of each attack category is counted, and the initial value of the category weight is calculated based on the inverse of the number of samples; the calculated initial category weight is incorporated into the loss function. The formula for the initial category weight is as follows:

[0017]

[0018] Among them, W irepresents the initial weight value of the i-th category, n i is the total number of samples of this category in the training set, ε is a smoothing constant used to avoid zero or excessive weights caused by zero samples or very small samples, and γ is a hyperparameter that controls the weight decay rate and is used to adjust the relative differences between weights of different categories. The initial category weights are applied to the training process of the neural network model by means of a weighted cross entropy loss function.

[0019] In this way, adaptive adjustment of the imbalanced number of samples in each attack category in the power grid intrusion detection task is achieved, and the initial category weights are organically integrated into the weighted cross entropy loss function, thereby effectively improving the robustness and detection accuracy of the neural network model training process.

[0020] Furthermore, in the aforementioned S3, during the model training process, after each training cycle, the misclassification frequency of each category in the current cycle is counted in real time. Specifically, it is calculated as the ratio of the number of misclassifications of the category to the total number of occurrences of the category. The calculation formula is as follows:

[0021]

[0022] Here, t represents the current iteration or time step in the training process.

[0023] According to the model's predicted output probability distribution for each category in the current training cycle, the category prediction information entropy is calculated to measure the model's prediction uncertainty for the current category. Define the prediction uncertainty index H for category i i (t) is:

[0024]

[0025] Among them, S i is the sample set of category i, P(x i ) represents the probability that the model predicts that the sample x is of category i. Based on the above two types of dynamic indicators, the real-time weight adjustment formula is defined as follows:

[0026] W′ i (t) = W i ·[1+α·f i (t)+β·H i (t)]

[0027] Among them, W i is the initial weight mentioned above, α and β are hyperparameters, which are used to control the influence of misclassification frequency and category entropy on the weight. Finally, the loss function is defined in the form of weighted cross entropy:

[0028]

[0029] Through this step, this method realizes dynamic weighted updates based on misclassification frequency and prediction information entropy, thereby performing real-time and precise regulation of the cost-sensitive loss function during the training process, achieving high adaptability and control accuracy.

[0030] Furthermore, in the aforementioned S4, a weight generation network f is constructed θ (·), the network is a multi-layer perceptron structure including input layer, hidden layer and output layer; the number of samples of each attack category and the frequency of category misclassification obtained by real-time monitoring f i (t), category prediction information entropy H i (t) is used as the input feature of the weight generation network, and the output is the dynamic weight W′ of each category i (t), the network is expressed as:

[0031] W′ i (t) = f θ (n i , f i (t), H i (t)) The number of output nodes of the weight generation network is the dynamic weight corresponding to each category. The output layer uses a linear activation function, and the hidden layer uses a nonlinear activation function. The weight generation uses a meta-learning method to optimize the parameters of the weight generation network, so that the network can respond to changes in the input signal in real time and output dynamic weights that match the current category state.

[0032] In this way, this method not only breaks through the limitations of traditional fixed weight settings, but also uses meta-learning technology to generate and update the weights corresponding to each attack category in real time under dynamic input changes, thereby achieving high adaptability and precise control of weight adjustment during model training.

[0033] Furthermore, in the aforementioned S5, the power grid attack data is divided into tasks by category, and the data of each category task is further divided into a support set and a query set, where the support set is used for inner layer parameter update, and the query set is used for outer layer parameter update; in the meta-learning inner layer update process, the support set data of each category task is used to calculate the cost-sensitive loss function, and the task-specific temporary parameters of the weight generation network are updated by the gradient descent method to obtain the task-specific temporary network parameters θ. The expression of the inner layer update is:

[0034]

[0035] Among them, η inner represents the learning rate during the inner layer update process, represents the gradient of the parameter θ, Indicates that in the task The loss function defined above, f θ (·) represents the weight generation network. During the meta-learning outer layer update process, the query set data corresponding to each category task is used to calculate the task loss function separately, and the gradient of each task loss function is summarized. The global initial parameters of the weight generation network are updated through gradient descent. The expression of the outer layer update is defined as follows:

[0036]

[0037] Among them, η outer is the learning rate of the outer optimization, θ′ i For the task Support set Temporary parameters obtained from training.

[0038] The inner update step emphasizes the rapid parameter adaptation of single-category tasks, while the outer update step emphasizes the parameter generalization ability of cross-category tasks. The overall parameters of the weight generation network are optimized through a double-layer update mechanism.

[0039] Furthermore, in the aforementioned S6, the category weights updated in real time by the dynamic misclassification feedback module and the dynamic weights generated by the weight generation network after meta-learning optimization are integrated as the final category weights of the cost-sensitive loss function of the current training cycle; the loss function is calculated using the above-mentioned final category weights, gradient backpropagation is performed, the neural network model parameters are updated, and iteration is performed until the training termination conditions are met; after the training is completed, the trained model is used for real-time intrusion detection in a smart grid environment, the model detection performance is evaluated through a test set, and finally the grid intrusion detection results are output.

[0040] The present invention provides a smart grid intrusion detection system based on dynamic misclassification feedback and meta-learning collaborative optimization. The system includes a data acquisition and preprocessing module, an initial weight assignment module, a dynamic weight generation module, a misclassification feedback module, and a meta-learning collaborative optimization module. The smart gateway first cleans, normalizes, and constructs time series samples of the collected grid flow data, and extracts key feature vectors. The initial weight assignment module calculates and initializes category weights based on the number of samples in each attack category and integrates them into the cost-sensitive loss function. The dynamic weight generation module outputs new category weights based on real-time statistical misclassification frequencies and predicted information entropy. The misclassification feedback module reports misclassification information in real time during model training and uses the feedback results to update the weight generation network parameters. The meta-learning collaborative optimization module globally optimizes the weight generation network through inner and outer layer update mechanisms to achieve adaptive detection capabilities for sample imbalance and concept drift threats.

[0041] Compared with the existing technology, the advantages of the present invention are as follows: the intrusion detection method based on dynamic misclassification and meta-learning collaborative optimization proposed in the present invention can realize real-time and adaptive adjustment of the weights of each category in response to problems such as serious imbalance in data sample distribution, scarcity of attack samples and concept drift in smart grids. In the present invention, by monitoring the misclassification frequency and predicted information entropy of each category and dynamically updating the weights by weighted linear combination, it is ensured that the sensitivity to a few abnormal categories during the model training process is effectively improved. At the same time, the constructed weight generation network uses a meta-learning strategy to model the input features, which can quickly respond to changes in the input signal and output dynamic weights that conform to the current category status, thereby achieving fine control in the cost-sensitive loss function. This scheme significantly reduces the missed alarm rate and false alarm rate of the intrusion detection method in new attack scenarios, improves the adaptability, robustness and detection accuracy of the model in dynamic and complex environments, and provides an efficient, flexible and reliable intrusion detection technology solution for security protection in smart power network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of a smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization;

[0043] Figure 2 The comparison between the smart grid intrusion detection method proposed in this patent using dynamic misclassification feedback and meta-learning collaborative optimization and other weight adjustment strategies is demonstrated;

[0044] Figure 3 It is a comparison of the performance of existing small sample detection methods and the intrusion detection method proposed in this patent;

[0045] Figure 4 This is a performance comparison of the complete model and three ablation models in the small sample detection task;

[0046] Figure 5 is the ROC curve of the complete model and each ablation model on the test set. DETAILED DESCRIPTION

[0047] The following describes the technical solution and effects of the present invention in detail with reference to the accompanying drawings. A simulation result comparing the present invention with an existing intrusion detection method is also provided as an example. However, this example is merely an example for explaining the present invention and should not be construed as limiting the present invention.

[0048] Embodiment: Based on dynamic misclassification feedback and meta-learning collaborative optimization technology, the present invention proposes a real-time adaptive intrusion detection method for power grid environments. The method has low false alarm rate and missed alarm rate, and strong system reliability and stability.

[0049] Figure 1 The present invention presents a smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization, which includes the following steps:

[0050] S1. Collect network traffic data from the power grid environment and perform feature extraction and normalization processing to construct time series data samples and divide them into training and test sets;

[0051] S2. Initialize weight values for each attack category and use the initialized category weights as part of the loss function in the training process of the neural network model;

[0052] S3. During model training, monitor the misclassification frequency and predicted information entropy of each attack category in real time. Calculate new category weights based on the misclassification frequency and predicted information entropy of each category in the current cycle. Apply the updated category weights to the loss function calculation for the next training cycle in real time.

[0053] S4. Construct a weight generation network that takes the number of class samples, real-time misclassification frequency, and real-time predicted information entropy as input and outputs dynamic class weights. Apply a meta-learning approach to optimize the parameters of the weight generation network, with the optimization objective being the weight generation network's ability to map input signals to output weights.

[0054] S5. Meta-learning inner and outer updates are used to optimize the weight generation network. For each attack category task, the category data is divided into a support set and a query set. In the inner update step, the support set data is used to calculate the loss function and update the task-specific parameters of the weight generation network to obtain task-specific temporary network parameters. In the outer update step, the loss function results of the query set data of each category are used to summarize and calculate the gradients of each category task, and update the global initial parameters of the weight generation network.

[0055] Furthermore, in the aforementioned S1, network traffic data is first comprehensively collected in the smart grid environment, covering normal business traffic and various types of attack traffic, and key grid characteristic parameters such as voltage, current, frequency, and phase angle are recorded in parallel; then the collected raw data is cleaned to remove missing values, outliers, and redundant information; on this basis, according to the intrusion detection requirements, key fields representing attack behaviors are extracted from the cleaned data, a feature set is constructed, and the Min-Max normalization method is used to map each feature to a unified numerical interval; then, a sliding window mechanism is used to generate continuous time series data samples, the window size is set at a fixed time interval, and the data in each window is used as the input feature matrix; finally, the constructed time series samples are divided into a training set and a test set according to a preset ratio, which are used for model training and performance evaluation, respectively.

[0056] In this way, the modular construction and flexible division of raw power grid flow data are achieved, thus providing a high-quality data foundation that is user-defined, precisely controllable, and user-friendly for intrusion detection models.

[0057] Furthermore, in the aforementioned S2, for the power grid environment intrusion detection task, the initial number of samples of each attack category is counted, and the initial value of the category weight is calculated based on the inverse of the number of samples; the calculated initial category weight is incorporated into the loss function. The formula for the initial category weight is as follows:

[0058]

[0059] Among them, W i represents the initial weight value of the i-th category, n i is the total number of samples of this category in the training set, ε is a smoothing constant used to avoid zero or excessive weights caused by zero samples or very small samples, and γ is a hyperparameter that controls the weight decay rate and is used to adjust the relative differences between weights of different categories. The initial category weights are applied to the training process of the neural network model by means of a weighted cross entropy loss function.

[0060] In this way, adaptive adjustment of the imbalanced number of samples in each attack category in the power grid intrusion detection task is achieved, and the initial category weights are organically integrated into the weighted cross entropy loss function, thereby effectively improving the robustness and detection accuracy of the neural network model training process.

[0061] Furthermore, in the aforementioned S3, during the model training process, after each training cycle, the misclassification frequency of each category in the current cycle is counted in real time. Specifically, it is calculated as the ratio of the number of misclassifications of the category to the total number of occurrences of the category. The calculation formula is as follows:

[0062]

[0063] According to the model's predicted output probability distribution for each category in the current training cycle, the category prediction information entropy is calculated to measure the model's prediction uncertainty for the current category. Define the prediction uncertainty index H for category i i (t) is:

[0064]

[0065] Among them, S i is the sample set of category i, P(x i ) represents the probability that the model predicts that sample x is class j. Based on the above two types of dynamic indicators, the real-time weight adjustment formula is defined as follows:

[0066] W′i (t) = W i ·[1+α·f i (t)+β·H i (t)]

[0067] Among them, W i is the initial weight mentioned above, α and β are hyperparameters, which are used to control the influence of misclassification frequency and category entropy on the weight. Finally, the loss function is defined in the form of weighted cross entropy:

[0068]

[0069] Through this step, this method realizes dynamic weighted updates based on misclassification frequency and prediction information entropy, thereby performing real-time and precise regulation of the cost-sensitive loss function during the training process, achieving high adaptability and control accuracy.

[0070] Furthermore, in the aforementioned S4, a weight generation network f is constructed θ (·), the network is a multi-layer perceptron structure including input layer, hidden layer and output layer; the number of samples of each attack category and the frequency of category misclassification obtained by real-time monitoring f i (t), category prediction information entropy H i (t) is used as the input feature of the weight generation network, and the output is the dynamic weight W′ of each category i (t), the network is expressed as:

[0071] W′ i (t) = f θ (n i , f i (t), H i (t))

[0072] The number of output nodes of the weight generation network is the dynamic weight corresponding to each category. The output layer uses a linear activation function, and the hidden layer uses a nonlinear activation function. The weight generation uses a meta-learning method to optimize the parameters of the weight generation network, so that the network can respond to changes in the input signal in real time and output dynamic weights that match the current category status.

[0073] Figure 2 The paper presents a comparison between the smart grid intrusion detection method proposed in this patent, which combines dynamic misclassification feedback with meta-learning collaborative optimization, and other weight adjustment strategies. The five weight adjustment strategies used in the comparative experiment are:

[0074] (1) Inverse Frequency: a weighted method based on category distribution;

[0075] (2) Sqrt Weight: square root weighting;

[0076] (3) Cross Entropy (CE) cross entropy loss function;

[0077] (4) Mean Squared Error (MSE)

[0078] (5) Mean Absolute Error (MAE) Mean absolute error.

[0079] Compared with other weighting strategies, our proposed approach achieves superior overall performance. Our proposed approach achieves 83.04% accuracy and 82.99% precision, respectively, and an F1 score of 82.86%, both significantly higher than other methods. SqrtWeight and CE also perform relatively well in detection, achieving F1 scores of 80.55% and 81.37%, respectively, but still lag behind our proposed approach. Furthermore, MAE and MSE lag behind other control approaches in terms of precision, F1 score, and false alarm rate.

[0080] Figure 3 The performance comparison between the existing small sample detection methods and the intrusion detection method proposed in this patent is demonstrated. In the same experimental environment, this paper selected a variety of typical oversampling methods such as SMOTE and ADASYN, combined with traditional machine learning models such as BaggingClassifier and KNN, and improved loss function strategies such as Focal Loss and LDAM Loss for control experiments. The experimental process maintained the same data set and hyperparameter configuration, and finally compared and evaluated the detection effect in multiple dimensions such as Accuracy, Precision, Recall, F1 Score and false alarm rate. The experimental results show that the method proposed in this patent achieved the highest accuracy, precision and F1 value, reaching 83.04%, 82.99% and 82.86% respectively, and has different degrees of improvement over many control algorithms.

[0081] Figure 4This paper presents a performance comparison of the full model and three ablation models on the small-shot detection task, using the same network structure and training process. The full model (Full) integrates initial weights, dynamic misclassification feedback, and a meta-learning optimization module, representing the complete solution proposed in this paper. Ablation 1 (Ablation 1) uses only the initial weights without any adaptive mechanism. Ablation 2 (Ablation 2) adds dynamic misclassification feedback to the initial weights. Ablation 3 (Ablation 3) retains the initial weights and incorporates a meta-learning optimization module. The comparison results show that Ablation 1, due to its lack of dynamic adjustment, performs significantly worse than the other two solutions with a single adaptive module. Ablations 2 and 3 both show improvement after introducing a single adaptive mechanism, but none are as good as the full model. By simultaneously utilizing dynamic misclassification feedback and a meta-learning optimization module, the full model achieves higher detection accuracy and robustness, demonstrating a significant performance advantage and fully demonstrating the synergistic gain effect between these two adaptive mechanisms.

[0082] Figure 5 The ROC curves of the full model and each ablation model on the test set are presented, and the corresponding AUC values are calculated. The results show that the ROC curve of the full model (Full) generally ranks higher than all other ablation schemes, achieving a higher true positive rate at the same level of negative false positives, with an AUC value of 97%, demonstrating the best positive discrimination ability. In comparison, the Ablation 1 model, which only uses the initial weights, performs the weakest. The Ablation 2 model, which adds dynamic misclassification feedback to the initial weights, achieves an AUC value of 96.9%, demonstrating the key role of this module in improving the model's discrimination ability. The Ablation 3 model (initial weights plus meta-learning optimization module) performs slightly better than Ablation 1, but still falls short of the full model overall. These ROC curves and corresponding AUC metrics fully verify that the proposed full model, through the synergistic effect of dynamic misclassification feedback and the meta-learning optimization module, demonstrates superior detection performance and robustness in the multi-class attack detection task.

[0083] It should be noted that the modules (or units) in this embodiment are logical in nature. In specific implementations, multiple modules (or units) can be combined into one module (or unit), and one module (or unit) can be split into multiple modules (or units). It should also be noted that the drawings only show the parts related to the present invention, not all structures.

[0084] It should be noted that any process or method description in the flowchart or otherwise described herein may be understood to represent a module, segment or portion of code including one or more executable instructions for implementing specific logical functions or steps of the process, and the scope of the preferred embodiments of the present invention includes alternative implementations, in which the functions may be performed in a different order than shown or discussed, including in substantially the same manner or in the reverse order according to the functions involved, which should be understood by those skilled in the art to which the embodiments of the patent belong.

[0085] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0086] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention without departing from the principles and purpose of the present invention.

Claims

1. A smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization, characterized by: The method comprises the following steps: S1. Collect network traffic data from the power grid environment and perform feature extraction and normalization processing to construct time series data samples and divide them into training and test sets; S2. Initialize weight values for each attack category and use the initialized category weights as part of the loss function in the training process of the neural network model; S3. During model training, monitor the misclassification frequency and predicted information entropy of each attack category in real time. Calculate new category weights based on the misclassification frequency and predicted information entropy of each category in the current cycle. Apply the updated category weights to the loss function calculation for the next training cycle in real time. S4. Construct a weight generation network that takes the number of class samples, real-time misclassification frequency, and real-time predicted information entropy as input and outputs dynamic class weights. Apply a meta-learning approach to optimize the parameters of the weight generation network, with the optimization objective being the weight generation network's ability to map input signals to output weights. S5. Optimize the weight generation network using meta-learning inner and outer updates. For each attack category task, divide the category data into a support set and a query set. In the inner update step, use the support set data to calculate the loss function and update the task-specific parameters of the weight generation network to obtain task-specific temporary network parameters. In the outer update step, use the loss function results of the query set data for each category to aggregate and calculate the gradients of each category task and update the global initial parameters of the weight generation network. S6. The results of the dynamic misclassification feedback module that updates the category weights in real time work together with the weights generated by the meta-learning module to generate network parameters, guiding neural network training through the loss function. The final trained model is used in the test set for real-time detection of smart grid attack behaviors.

2. The smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization according to claim 1, characterized in that: In S1, network traffic data is first comprehensively collected in a smart grid environment, covering both normal business traffic and various types of attack traffic, while simultaneously recording key grid characteristic parameters such as voltage, current, frequency, and phase angle. The collected raw data is then cleaned to remove missing values, outliers, and redundant information. Based on this, key fields representing attack behaviors are extracted from the cleaned data according to intrusion detection requirements, a feature set is constructed, and each feature is mapped to a unified numerical interval using the Min-Max normalization method. Continuous time series data samples are then generated using a sliding window mechanism, with the window size set at a fixed time interval, and the data within each window is used as an input feature matrix. Finally, the constructed time series samples are divided into training sets and test sets according to the preset ratio, which are used for model training and performance evaluation respectively.

3. The smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization according to claim 1, characterized in that: In S2, for the power grid environment intrusion detection task, the initial number of samples of each attack category is counted, and the initial value of the category weight is calculated based on the inverse of the number of samples; the calculated initial category weight is combined with the loss function, and the initial category weight formula is as follows: Among them, W i represents the initial weight value of the i-th category, n i is the total number of samples of this category in the training set, ε is a smoothing constant used to avoid zero or excessive weights caused by zero samples or very small samples, and γ is a hyperparameter that controls the weight decay rate and is used to adjust the relative differences between weights of different categories. The initial category weights are applied to the training process of the neural network model by means of a weighted cross entropy loss function.

4. The smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization according to claim 1, characterized in that: In S3, during the model training process, after each training cycle, the misclassification frequency of each category in the current cycle is counted in real time. Specifically, it is calculated as the ratio of the number of misclassifications of the category to the total number of occurrences of the category. The category misclassification frequency calculation formula is as follows: Where t represents the current iteration or time step in the training process, According to the model's predicted output probability distribution for each category in the current training cycle, the category prediction information entropy is calculated to measure the model's prediction uncertainty for the current category, and the prediction uncertainty index H for category i is defined. i (t) is: Among them, S i is the sample set of category i, P(x i ) represents the probability that the model predicts that the sample x is of category i. Based on the above two types of dynamic indicators, the real-time weight adjustment formula is defined as follows: W′ i (t)=W i ·[1+α·f i (t)+β·H i (t)] Among them, W i is the initial weight mentioned above, α and β are hyperparameters, which are used to control the influence of misclassification frequency and category entropy on weight respectively. Finally, the loss function is defined in the form of weighted cross entropy:

5. The smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization according to claim 1, characterized in that: In S4, a weight generation network f is constructed. θ (·), the network is a multi-layer perceptron structure including input layer, hidden layer and output layer; the number of samples of each attack category and the frequency of category misclassification obtained by real-time monitoring f i (t), category prediction information entropy H i (t) is used as the input feature of the weight generation network, and the output is the dynamic weight W′ of each category i (t), the network is expressed as: W′ i (t)=f θ (n i ,f i (t),H i (t)) The number of output nodes of the weight generation network is the dynamic weight corresponding to each category. The output layer uses a linear activation function, and the hidden layer uses a nonlinear activation function. Weight generation uses meta-learning methods to optimize the parameters of the weight generation network, so that the network can respond to changes in input signals in real time and output dynamic weights that match the current category state.

6. The smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization according to claim 1, characterized in that: The specific method of S5 is as follows: the power grid attack data is divided into tasks by category. The data of each category task is further divided into a support set and a query set. The support set is used for inner layer parameter update, and the query set is used for outer layer parameter update. In the meta-learning inner layer update process, the support set data of each category task is used to calculate the cost-sensitive loss function, and the task-specific temporary parameters of the weight generation network are updated by the gradient descent method to obtain the task-specific temporary network parameters θ. The expression of the inner layer update is: Among them, η inner represents the learning rate during the inner layer update process, represents the gradient of the parameter θ, Indicates that in the task The loss function defined above, f θ (·) represents the weight generation network. During the meta-learning outer layer update process, the query set data corresponding to each category task is used to calculate the task loss function separately, and the gradient of each task loss function is summarized. The global initial parameters of the weight generation network are updated by gradient descent. The expression of the outer layer update is defined as follows: Among them, η outer is the learning rate of the outer optimization, θ′ i For the task Support set Temporary parameters obtained from training. The inner update step emphasizes the rapid parameter adaptation of single-category tasks, while the outer update step emphasizes the parameter generalization ability of cross-category tasks. The overall parameters of the weight generation network are optimized through a double-layer update mechanism.

7. The smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization according to claim 1, characterized in that: The specific method of S6 is as follows: the category weights updated in real time by the dynamic misclassification feedback module are integrated with the dynamic weights generated by the weight generation network after meta-learning optimization, and used as the final category weights of the cost-sensitive loss function of the current training cycle; The loss function is calculated using the final category weights, gradient backpropagation is performed, the neural network model parameters are updated, and the iteration is performed until the training termination condition is met; After the training is completed, the trained model is used for real-time intrusion detection in the smart grid environment. The model detection performance is evaluated through the test set, and the grid intrusion detection results are finally output.

8. A smart grid intrusion detection system based on dynamic misclassification feedback and meta-learning collaborative optimization, characterized by: Used to implement the smart grid intrusion detection method based on dynamic misclassification feedback and meta-learning collaborative optimization as described in any one of claims 1 to 7, the system includes a data acquisition and preprocessing module, a dynamic weight generation module, a misclassification feedback module and a meta-learning collaborative optimization module, the data acquisition and preprocessing module is responsible for real-time acquisition, cleaning and time series sample construction of power grid flow data, the dynamic weight generation module outputs dynamic weights according to the number of various samples, misclassification frequency and predicted information entropy, the misclassification feedback module applies the updated weights to the cost-sensitive loss function and adjusts the model parameters in real time during each training cycle, and the meta-learning collaborative optimization module globally optimizes the weight generation network parameters through inner layer update and outer layer update mechanisms to achieve efficient recognition of small sample data categories and adaptive model updates, thereby maintaining efficient detection capabilities.

Images