Digital power grid information security identification method, device, equipment and medium

Abstract

The invention discloses a digital power grid information security identification method and device, electronic equipment and a computer readable storage medium, which are applied to the technical field of network information security and solve the problem of low efficiency and security of digital power grid information security analysis, and the method comprises the following steps: obtaining a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing the current digital power grid information acquired by the client through a pre-trained information security identification local model located on the client; analyzing the first attack type analysis result through a pre-trained information security identification global model to obtain a second attack type analysis result; the second attack type analysis result is returned to the client so that the client can analyze the second attack type analysis result, and the attack type of the current digital power grid information is determined; according to the invention, the analysis efficiency and the data information security can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to a digital power grid information security identification method, device, electronic equipment and computer-readable storage medium. Background Art

[0002] In recent years, with the widespread integration of large-scale renewable energy power sources and new energy storage technologies, the structure and form of the power system have undergone profound changes. Digitalization is a key enabler for the construction and development of this new power system. Leveraging various digital platforms, this system enables coordinated operation, intelligent interaction, and multi-stream integration across power generation, grid, load, and storage. However, the richer data and more intelligent interaction within this new power system also present increased cybersecurity risks.

[0003] Faced with the increasingly prominent issue of digital power grid information security, network intrusion detection methods are currently commonly used to conduct network intrusion detection and security protection on digital power grid information to enhance the security protection capabilities of the power grid. Most current security protection methods are centralized, requiring users to upload raw data to high-performance cloud servers for centralized training and analysis. This not only has low analysis efficiency, but also poor information security protection, which can easily lead to the leakage of sensitive information.

[0004] In view of this, how to improve the efficiency and security of digital power grid information security analysis has become a problem that technical personnel in this field need to solve. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide a digital power grid information security identification method, device, electronic device and computer-readable storage medium, which can improve analysis efficiency and data information security during use.

[0006] To solve the above technical problems, the embodiments of the present invention provide the following technical solutions:

[0007] In one aspect, the present invention provides a digital power grid information security identification method, which is applied to a central server and includes:

[0008] Obtaining a first attack type analysis result sent by the client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information obtained by the client using a pre-trained information security identification local model located on the client;

[0009] Analyzing the first attack type analysis result using a pre-trained information security identification global model to obtain a second attack type analysis result;

[0010] The second attack type analysis result is returned to the client, so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

[0011] In one embodiment, the training process of the information security identification local model and the information security identification global model includes:

[0012] The local power grid data set corresponding to each client is used in combination with the federated learning method to train the information security identification local model located at each client, and the local model parameters of each information security identification local model are aggregated to train the information security identification global model located at the central server.

[0013] In one embodiment, the training of the information security identification local model at each client by using the local power grid dataset corresponding to each client in combination with a federated learning method, and aggregating the local model parameters of each information security identification local model to train the information security identification global model at the central server includes:

[0014] During each round of iterative training, the global model parameters of the information security identification global model are sent to the corresponding client, and the client trains and updates the parameters of the information security identification local model based on the global model parameters and the local power grid information dataset;

[0015] Obtaining updated local model parameters sent by the client, aggregating the local model parameters sent by each client, and training the information security identification global model to obtain new global model parameters;

[0016] When the training end conditions are met, the trained information security identification local model and the trained information security identification global model are obtained. When the training end conditions are not met, the next round of iterative training is carried out.

[0017] In one embodiment, training and parameter updating of the information security identification local model based on the global model parameters and the local power grid information dataset includes:

[0018] The information security identification local model is trained according to the global model parameters and the local power grid information data set by minimizing the objective function;

[0019] During the training process, a stochastic gradient descent optimizer is used to update local model parameters;

[0020] Among them, the objective function is: , is the objective function, Identifying local model pairs for information security training samples The loss function is Identify global model parameters of the global model for information security, D i is the local data information set of the i-th client, , k is the serial number of the training sample in the local data information set, k=1,…,m, m is the total number of training samples in the local data information set.

[0021] In one embodiment, updating local model parameters using a stochastic gradient descent optimizer includes:

[0022] The local model parameters are updated based on the local model parameter update relational expression; the local model parameter update relational expression is:

[0023] ;

[0024] ;

[0025] in, is the global model parameter in the tth round of training, is the local model parameter of the i-th client after the t+1th round of training, are the updated local model parameters after the tth round of training, is the learning rate, is the randomly selected power grid data information corresponding to the i-th client, is the local model parameter of the i-th client after the t-th round of training, It is a federal model.

[0026] In one embodiment, obtaining updated local model parameters sent by the client and aggregating the local model parameters sent by each client includes:

[0027] Obtain updated local model parameters sent by multiple clients, and aggregate the updated local model parameters using a federated learning aggregation rule; wherein the federated learning aggregation rule is constructed based on an aggregation relation, and the aggregation relation is:

[0028] ; is the global model parameter after the t+1th round of training, and q is the number of clients participating in the local model training.

[0029] In one embodiment, the information security identification global model includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network and an sftmax layer connected in sequence;

[0030] The analyzing the first attack type analysis result by using the pre-trained information security identification global model to obtain the second attack type analysis result includes:

[0031] Inputting the first attack type analysis result sent by the client into the multi-head attention structure to obtain first feature information;

[0032] Inputting the first information feature into the bidirectional long short-term memory network, obtaining the second feature information by acquiring the connection between the previous and next features and retaining the temporal information;

[0033] Inputting the second feature information into the deep neural network for feature extraction to obtain third feature information;

[0034] The third feature information is input into the sftmax layer for classification to obtain a second attack type analysis result.

[0035] Another embodiment of the present invention provides a digital power grid information security identification device, which is applied to a central server and includes:

[0036] an acquisition module, configured to acquire a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information acquired by the client using a pre-trained information security identification local model located on the client;

[0037] A first analysis module, configured to analyze the first attack type analysis result using a pre-trained information security recognition global model to obtain a second attack type analysis result;

[0038] The second analysis module is configured to return the second attack type analysis result to the client, so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

[0039] Another aspect of the present invention provides an electronic device, including:

[0040] memory for storing computer programs;

[0041] A processor is configured to implement the steps of the digital power grid information security identification method as described above when executing the computer program.

[0042] Another aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the digital power grid information security identification method described above are implemented.

[0043] It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages:

[0044] An embodiment of the present invention provides a digital power grid information security identification method, device, electronic device and computer-readable storage medium, including: obtaining a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing the current digital power grid information obtained by the client through a pre-trained information security identification local model located on the client; analyzing the first attack type analysis result through a pre-trained information security identification global model to obtain a second attack type analysis result; and returning the second attack type analysis result to the client so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

[0045] Thus, it can be seen that in the embodiment of the present application, the information security identification local model is pre-trained on the client, and the information security identification global model is trained on the central server at the same time. The training process of the information security identification local model and the information security identification global model are related. When the client needs to analyze the current digital power grid information, the current digital power grid information can be analyzed and identified by the information security identification local model on the client to obtain a first attack type analysis result, and the first attack type analysis result is sent to the central server. The central server analyzes and identifies the first attack type analysis result by using the information security identification global model to obtain a second attack type analysis result. The client determines the attack type of the current digital power grid information based on the second attack type analysis result sent by the central server. In the present application, the current digital power grid information of the client does not need to be sent directly to the central server. Instead, the first attack type analysis result after preliminary analysis is sent to the central server. The central server does not need to perform centralized analysis on all digital power grid information. Instead, the first attack type analysis result is analyzed by the information security identification global model in the central server to obtain the attack type of the current digital power grid information. Therefore, the present application can improve analysis efficiency and data information security.

[0046] In addition, the present invention also provides corresponding implementation devices, electronic devices and computer-readable storage media for the digital power grid information security identification method, further making the method more practical, and the devices, electronic devices and computer-readable storage media have corresponding advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the prior art and the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0048] Figure 1 A flowchart of a digital power grid information security identification method provided by an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the architecture of a digital power grid information security identification system provided by an embodiment of the present invention;

[0050] Figure 3 An architectural diagram of an information security identification global model provided by an embodiment of the present invention;

[0051] Figure 4 Schematic diagram of the detection accuracy of different methods for various attack types on the NSL-KDD dataset;

[0052] Figure 5 Schematic diagram of the protection success rate of different methods on the UNSW-NB15 dataset;

[0053] Figure 6 A schematic diagram of the structure of a digital power grid information security identification device provided by an embodiment of the present invention;

[0054] Figure 7 A schematic structural diagram of an electronic device provided by an embodiment of the present invention;

[0055] Figure 8 A schematic structural diagram of a computer-readable storage medium provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0056] Embodiments of the present invention provide a digital power grid information security identification method, device, electronic device, and computer-readable storage medium, which can improve analysis efficiency and data information security during use.

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0058] Please refer to Figure 1 , Figure 1 This is a flow chart of a digital power grid information security identification method provided by an embodiment of the present invention. The method is applied to a central server and includes:

[0059] S110: Obtaining a first attack type analysis result sent by the client; wherein the first attack type analysis result is obtained by analyzing the current digital power grid information obtained by the client using a pre-trained information security identification local model located on the client;

[0060] It should be noted that in this application, a local information security identification model is pre-trained on each client, and a global information security identification model is pre-trained on the central server. For each client, after the client obtains the current data grid information, the local information security identification model on the client can be used to perform a preliminary attack type analysis on the current data grid information to obtain a first attack type analysis result, and then the first attack type analysis result is sent to the central server. The central server can obtain the first attack type analysis result sent by the client, and the first attack type analysis result may include initial attack type analysis information and client identification information.

[0061] S120: Analyze the first attack type analysis result using a pre-trained information security identification global model to obtain a second attack type analysis result;

[0062] It is understood that after obtaining the first attack type analysis result sent by the client, the central server can further analyze the attack type of the first attack type analysis result using the global information security identification model located on the central server to obtain a second attack type analysis result. In other words, in this application, the central server analyzes the first attack type analysis result sent by the client after preliminary analysis, rather than directly analyzing the client's current digital power grid information, thereby avoiding information security issues such as information leakage.

[0063] S130: Return the second attack type analysis result to the client, so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

[0064] Specifically, after the central server obtains the second attack type analysis result, it can return the second attack type analysis result to the client based on the client identification information in the first attack type analysis result. After the client receives the second attack type analysis result, it parses the second attack type analysis result to obtain the attack type in the second attack type analysis result, that is, the final attack type of the current digital power grid information.

[0065] The following is a detailed description and introduction of this solution. Figures 2 to 5 .

[0066] In one embodiment, the training process of the above-mentioned information security identification local model and information security identification global model may include:

[0067] The local power grid data set corresponding to each client is used in combination with the federated learning method to train the information security identification local model located at each client, and the local model parameters of each information security identification local model are aggregated to train the information security identification global model located at the central server.

[0068] It is understandable that in the present application, a preset number of clients (less than or equal to the total number of cluster clients) can be selected from all the clients of the cluster. For each selected client, the local power grid data set corresponding to each client can be pre-determined, and an initial model of the information security identification local model can be constructed on each client, and an initial model of the information security identification global model can be pre-constructed on the central server side. Then, the information security identification local model of each client is trained in combination with the federated learning method, and the various information security identification local models are aggregated to further train the information security identification global model of the central server. The information security identification local model on each client side and the information security identification global model on the central server side are obtained through training. In one embodiment, the above-mentioned process of training the information security identification local model located at each client using the local power grid data set corresponding to each client and combining the federated learning method, and aggregating the local model parameters of each information security identification local model to train the information security identification global model located at the central server, can include:

[0069] During each round of iterative training, the global model parameters of the information security identification global model are sent to the corresponding client, and the client trains and updates the parameters of the information security identification local model based on the global model parameters and the local power grid information dataset;

[0070] Obtain updated local model parameters sent by the client, aggregate the local model parameters sent by each client, and train the information security recognition global model to obtain new global model parameters;

[0071] When the training end conditions are met, the trained information security identification local model and the trained information security identification global model are obtained. When the training end conditions are not met, the next round of iterative training is carried out.

[0072] It should be noted that, in this embodiment, during each round of iterative training, the central server can obtain the global model parameters of the current information security identification global model during this round of training, and then send the global model parameters (for example, by broadcasting) to each corresponding client. After each client receives the global model parameters sent by the central server, it trains the information security identification local model on the client according to the global model parameters and the local power grid information data set of the client, and updates the parameters of the local model parameters of the information security identification local model. For each client, the local model parameters of the updated information security identification local model can be sent to the central server. After the central server obtains the local model parameters of each client, it can aggregate the local model parameters of each client, and then train the information security identification global model to obtain the new global model parameters after this round of training. At this time, it can be further determined whether the training end conditions are met, such as whether the current training round has reached the preset number of iterations, or whether the loss value of the current information security identification global model is less than or equal to the preset loss value. If the current training round has reached the preset number of iterations, or the loss value of the current information security identification global model is less than or equal to the preset loss value, the training can be ended to obtain the information security identification local models trained by each client and the information security identification global model trained by the central server.

[0073] Of course, if the current training round does not reach the preset number of iterations, or the loss value of the current information security identification global model is not less than the preset loss value, it can enter the next round of iterative training until the training end conditions are met to obtain the information security identification local models trained by each client and the information security identification global model trained by the central server.

[0074] It should also be noted that the information security identification local model and the information security identification global model in this embodiment can both be models established based on a bidirectional long short-term memory network-convolutional neural network (BiLSTM-DNN).

[0075] Also, please refer to Figure 2In practical applications, a control center can also be set up. During the first round of iterations, the central server can obtain the initialization model parameters of the global information security identification model and then securely broadcast them to each client through broadcasting, so that each client can train the local information security identification model and update the parameters based on the received initialization model parameters and the power grid information data in the local power grid information dataset. The control center can filter the local information security identification models after the updated parameters, securely aggregate the local information security identification models that meet the conditions according to the selection conditions preset by the central server, and then transmit them to the central server. Specifically, the local model parameters corresponding to the local information security identification models that meet the selection conditions are aggregated and transmitted to the central server, so that the central server can train the global information security identification model.

[0076] It should also be noted that the embodiment of the present application adopts a federated learning method for information processing. The client does not need to send all local power grid information to the central server. Instead, the client trains the local model for information security identification and sends the local model parameters to the central server for training the global model for information security identification. The present application realizes model training under the premise of protecting data information privacy, thereby promoting the circulation and sharing of power grid information.

[0077] Among them, the central server of the federated learning architecture cooperates with a set of N clients holding training data , jointly train deep learning models (i.e., information security identification global model), and obtain the optimal model parameters (That is, the optimal parameters of the global model for information security identification).

[0078] In one embodiment, the process of training and updating the parameters of the information security identification local model based on the global model parameters and the local power grid information dataset may include:

[0079] The information security identification local model is trained based on the global model parameters and the local power grid information dataset by minimizing the objective function.

[0080] During the training process, a stochastic gradient descent optimizer is used to update local model parameters;

[0081] Among them, the objective function is: , is the objective function, Identifying local model pairs for information security training samples The loss function is It is used to express the error between the model prediction value and the actual value. Identify global model parameters of the global model for information security, D i is the local data information set of the i-th client, , k is the serial number of the training sample in the local data information set, k=1,…,m, m is the total number of training samples in the local data information set.

[0082] It should be noted that in this embodiment, the information security identification local model can be trained by minimizing the objective function on the local power grid information data set according to the global model parameters, where the objective function is Then, during the training process, the model parameters of the information security identification local model are calculated through the SGD (stochastic gradient descent) optimizer. and update it.

[0083] The process of updating local model parameters using the stochastic gradient descent optimizer in this embodiment may include:

[0084] Update the local model parameters based on the local model parameter update relation; the local model parameter update relation is:

[0085] ;

[0086] in, is the global model parameter in the tth round of training, is the local model parameter of the i-th client after the t+1th round of training, , are the updated local model parameters after the tth round of training, is the learning rate, is the randomly selected power grid data information corresponding to the i-th client, is the local model parameter of the i-th client after the t-th round of training, For the federal model, represents the gradient operator.

[0087] It is understandable that the SGD optimizer is used to update the model parameters, and the updated model parameters of the local model are identified by the client computing information security. , , which can be achieved by It can be calculated In this application, the accuracy of parameter updating can be improved by this method.

[0088] In one embodiment, the process of obtaining updated local model parameters sent by the client and aggregating the local model parameters sent by each client may include:

[0089] Obtain updated local model parameters sent by multiple clients and aggregate the updated local model parameters using the federated learning aggregation rule. The federated learning aggregation rule is constructed based on the aggregation relation, which is:

[0090] ; is the global model parameter after the t+1th round of training, and q is the number of clients participating in the local model training.

[0091] It should be noted that the FedAvg (Federated Averaging Algorithm) aggregation rule in the federated learning method is used by the central server to aggregate the local model parameters after the local model is updated. The FedAvg aggregation rule is based on the aggregation relationship This application uses federated learning aggregation rules to aggregate updated local model parameters. This not only enables the client-side local model to better adapt to the characteristics of local data, but also, after global model aggregation, it can integrate the local advantages of each client and improve the model's ability to generalize to different data distributions.

[0092] In one embodiment, the global model for information security identification in this embodiment includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network, and an SFTMAX layer connected in sequence;

[0093] Then, the process of analyzing the first attack type analysis result using the pre-trained information security identification global model to obtain the second attack type analysis result may include:

[0094] Input the first attack type analysis result sent by the client into the multi-head attention structure to obtain the first feature information;

[0095] The first information feature is input into the bidirectional long short-term memory network, and the second feature information is obtained by obtaining the connection between the previous and next features and retaining the temporal information;

[0096] Inputting the second feature information into a deep neural network for feature extraction to obtain third feature information;

[0097] The third feature information is input into the sftmax layer for classification to obtain the second attack type analysis result.

[0098] It should be noted that the architecture of the information security identification global model in this embodiment is as follows Figure 3As shown in the figure, this is a model built based on the BiLSTM-DNN network. The BiLSTM network is good at processing time series information and overcomes the problems existing in the RNN structure. In order to make the extracted features richer, a multi-head attention structure is used before the BiLSTM module to obtain information features.

[0099] Among them, the multi-head attention structure extracts information features through the multi-head attention function (for example, extracting the first attack type analysis result to obtain the first feature information), and the multi-head attention function The specific expression is:

[0100] , where Q is the attention query, K is the attention key, and V is the attention value. is the total number of heads, is the weight matrix, Concat is the vector concatenation operation, is the feature of the jth head, and ;

[0101] ;in, 、 and are the weight matrices corresponding to the input of the j-th head, is the feature dimension; softmax is the activation function.

[0102] In addition, in this embodiment, after obtaining the information feature, the first information feature can be input into the bidirectional long short-term memory network to obtain the second feature information by obtaining the connection between the previous and next features and retaining the temporal information. The expression of the second feature information H can be:

[0103] ,in, is the forward output of the BiLSTM network, is the reverse output of the BiLSTM network.

[0104] Furthermore, after obtaining the second feature information H, the second feature information H is input into a deep neural network for feature extraction to obtain third feature information. The deep neural network DNN includes two hidden layers, and the output of any hidden layer is The expression can be:

[0105] ,in, is the activation function, is the threshold of the DNN network, b is the bias of the DNN network, and x is the input of the hidden layer.

[0106] Thus, it can be seen that in the embodiment of the present application, the information security identification local model is pre-trained on the client, and the information security identification global model is trained on the central server at the same time. The training process of the information security identification local model and the information security identification global model are related. When the client needs to analyze the current digital power grid information, the current digital power grid information can be analyzed and identified by the information security identification local model on the client to obtain a first attack type analysis result, and the first attack type analysis result is sent to the central server. The central server analyzes and identifies the first attack type analysis result through the information security identification global model to obtain a second attack type analysis result. The client determines the attack type of the current digital power grid information based on the second attack type analysis result sent by the central server. In the present application, the current digital power grid information of the client does not need to be sent directly to the central server, but the first attack type analysis result after preliminary analysis is sent to the central server. The central server does not need to perform centralized analysis on all digital power grid information, but analyzes the first attack type analysis result through the information security identification global model in the central server to obtain the attack type of the current digital power grid information. Therefore, the present application can improve analysis efficiency and information security.

[0107] That is, in the embodiment of the present application, the global model of the optimal improved BiLSTM-DNN model is used to globally divide the types of network attacks in the power grid information data. If a network attack behavior is found, it will be immediately and accurately located, and the permissions of the abnormal behavior nodes will be managed to isolate the attack behavior and achieve security protection of digital power grid information.

[0108] The following experiment illustrates this issue. For example, cyberattacks in digital power grids present diverse challenges. Considering the actual situation of power grids, the NSL-KDD dataset was selected for testing and analysis. The NSL-KDD dataset contains over 100,000 data points, and its distribution is shown in Table 1.

[0109] Table 1 Sample distribution of NSL-KDD dataset

[0110] The experimental operating system used was Ubuntu 20.04 Server Edition, with an Intel Xeon Silver 4210 processor, 64.0 GB of memory, and an NVIDIA Tesla T4 16 GB GPU. Tensorflow-gpu-1.15.0 was used to build the improved BiLSTM-DNN model. The model was trained 100 times with a dropout ratio of 0.5 and a learning rate of 0.001. The experiment also evaluated attack detection accuracy and security protection success rate.

[0111] The method proposed in this application ( Figure 4 The proposed method in the paper is compared with two methods in related technologies, related technology 1 and related technology 2, and the detection accuracy of the three methods on the NSL-KDD dataset for various attack types is as follows: Figure 4 As shown, Normal is the normal situation, and various attack types include Dos, Probe, R2L, and U2R.

[0112] Depend on Figure 4 As can be seen, the proposed method achieves good detection results for various attack types in the NSL-KDD dataset, with accuracy exceeding 95%. This is because the proposed method utilizes an improved BiLSTM-DNN model for federated learning, fully considering the spatiotemporal characteristics of digital power grid information, thereby ensuring the reliability of attack detection. Related technology 1, which uses a DBN-LSTM model for attack detection, achieves similar accuracy to the proposed method. However, it lacks consideration of massive and critical information, resulting in poor detection of R2L and U2R attacks in a small number of samples. Another related technology, 2, uses the ADWIN-SVM model for attack detection, but lacks the support of a federated learning environment, resulting in a detection accuracy of approximately 90%.

[0113] After multiple experiments, the attack detection and security protection results of the three methods on the NSL-KDD dataset are shown in Table 2.

[0114] Table 2 Comparison of results of different methods on the NSL-KDD dataset

[0115]

[0116] As shown in Table 2, the attack detection accuracy and protection success rate of the method provided in this application (also known as the proposed method) are 98.15% and 97.92%, respectively, which are superior to other comparative methods. This is because the method provided in this application uses an improved BiLSTM-DNN model for attack type detection, ensuring good detection results. At the same time, federated learning has good data privacy, further improving the reliability of data information security protection, thereby significantly improving the protection success rate. Related technology 1 uses a DBN-LSTM model to implement network attack detection, but lacks distributed learning of massive data information, resulting in poor protection results and a success rate of 91.38%. Another related technology 2 uses the ADWIN-SVM model for attack detection. This model has insufficient feature extraction capabilities and lacks the support of a federated learning environment. Therefore, its protection success rate is 10.46% lower than that of the proposed method.

[0117] In order to demonstrate the universality of the method provided in this application, three data sets, NSL-KDD, UNSW-NB15 and CIC-IDS2017, can also be selected for comparative experiments. The UNSW-NB15 data set contains 9 types of attacks, 49 features and 1 marker feature; the CIC-IDS2017 data set contains 9 traffic types. The information security protection success rate of the method provided in this application on the three data sets is as follows: Figure 5 shown.

[0118] Depend on Figure 5 As can be seen, the proposed method achieves a relatively low protection success rate of approximately 86% on the UNSW-NB15 dataset. This is because the dataset consists of real network information with complex characteristics. However, the CIC-IDS2017 dataset simplifies the attack types by combining similar anomalies. As a result, the proposed method achieves significantly improved protection performance compared to the UNSW-NB15 dataset and is close to that achieved on the NSL-KDD dataset, exceeding 97%, demonstrating excellent results. In summary, the proposed method achieves good protection results on all three datasets, demonstrating strong robustness.

[0119] It can be seen that the digital power grid information security protection method based on federated learning and deep learning provided by the present invention designs an overall architecture for digital power grid information security protection, performs data information analysis based on the federated learning architecture, and uses the improved BiLSTM-DNN model as the local model and global model of the federated learning architecture. The attack detection results of the local model are aggregated by the global model of the optimal improved BiLSTM-DNN model to achieve the security protection of digital power grid information. The proposed method is experimentally demonstrated based on the NSL-KDD dataset. The results show that the improved BiLSTM-DNN model ensures the high attack detection performance of the proposed method, and its attack detection accuracy reaches 98.15%, and its robustness is good; federated learning has good data privacy protection capabilities, and combined with the improved BiLSTM-DNN model, the information security protection capability of the proposed method is further improved, and its protection success rate reaches 97.92%.

[0120] The present invention also provides a corresponding device for the digital grid information security identification method, further making the method more practical. The device can be described from the perspective of functional modules and hardware. The following describes the digital grid information security identification device provided by the present invention, which is used to implement the digital grid information security identification method provided by the present invention. In this embodiment, the digital grid information security identification device may include or be divided into one or more program modules, which are stored in a storage medium and executed by one or more processors to complete the digital grid information security identification method disclosed in the above embodiment. The program module referred to in the present invention refers to a series of computer program instruction segments that can perform specific functions and is more suitable for describing the execution process of the digital grid information security identification device in the storage medium than the program itself. The following description will specifically introduce the functions of each program module in this embodiment. The digital grid information security identification device described below and the digital grid information security identification method described above can be referenced in correspondence.

[0121] From the perspective of functional modules, see Figure 6 , Figure 6 This is a structural diagram of a digital power grid information security identification device provided by the present invention in a specific embodiment. The device is applied to a central server and may include:

[0122] An acquisition module 11 is configured to acquire a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing the current digital power grid information acquired by the client using a pre-trained information security identification local model located on the client;

[0123] A first analysis module 12 is configured to analyze the first attack type analysis result using a pre-trained information security recognition global model to obtain a second attack type analysis result;

[0124] The second analysis module 13 is configured to return the second attack type analysis result to the client, so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

[0125] In one embodiment, the device further comprises:

[0126] The training module is used to train the information security identification local model located at each client through the local power grid data set corresponding to each client and the federated learning method, and aggregate the local model parameters of each information security identification local model to train the information security identification global model located at the central server.

[0127] In one embodiment, the training module includes:

[0128] The local model training unit is used to send the global model parameters of the information security identification global model to the corresponding client in each round of iterative training, and train and update the parameters of the information security identification local model based on the global model parameters and the local power grid information data set on the client;

[0129] A global model training unit is used to obtain updated local model parameters sent by the client, aggregate the local model parameters sent by each client, and train the information security recognition global model to obtain new global model parameters;

[0130] The determination unit is used to obtain the trained information security identification local model and the trained information security identification global model when the training end conditions are met, and to carry out the next round of iterative training when the training end conditions are not met.

[0131] In one embodiment, the local model training unit includes:

[0132] A first training subunit is configured to train an information security identification local model based on global model parameters and a local power grid information dataset by minimizing an objective function;

[0133] The update subunit is used to update local model parameters using a stochastic gradient descent optimizer during training;

[0134] Among them, the objective function is: , is the objective function, Identifying local model pairs for information security training samples The loss function is It is used to express the error between the model prediction value and the actual value. Identify global model parameters of the global model for information security, D i is the local data information set of the i-th client, , k is the serial number of the training sample in the local data information set, k=1,…,m, m is the total number of training samples in the local data information set.

[0135] In one embodiment, the updating subunit is specifically configured to:

[0136] Update the local model parameters based on the local model parameter update relation; the local model parameter update relation is:

[0137] ;

[0138] ;

[0139] in, is the global model parameter in the tth round of training, is the local model parameter of the i-th client after the t+1th round of training, are the updated local model parameters after the tth round of training, is the learning rate, is the randomly selected power grid data information corresponding to the i-th client, is the local model parameter of the i-th client after the t-th round of training, It is a federal model.

[0140] In one embodiment, the global model training unit is used to:

[0141] Obtain updated local model parameters sent by multiple clients and aggregate the updated local model parameters using the federated learning aggregation rule. The federated learning aggregation rule is constructed based on the aggregation relation, which is:

[0142] ; is the global model parameter after the t+1th round of training, and q is the number of clients participating in the local model training.

[0143] In one embodiment, the global model for information security identification includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network, and an sftmax layer connected in sequence;

[0144] The second analysis module 12 includes:

[0145] A first analysis unit is configured to input the first attack type analysis result sent by the client into the multi-head attention structure to obtain first feature information;

[0146] The second analysis unit is used to input the first information feature into the bidirectional long short-term memory network, and obtain the second feature information by obtaining the connection between the previous and next features and retaining the temporal information;

[0147] A third analysis unit is used to input the second feature information into a deep neural network for feature extraction to obtain third feature information;

[0148] The classification unit is used to input the third feature information into the sftmax layer for classification to obtain a second attack type analysis result.

[0149] It should be noted that the digital grid information security identification device provided in the embodiment of the present invention has the same beneficial effects as the digital grid information security identification method provided in the above embodiment. For the specific introduction of the digital grid information security identification method involved in this embodiment, please refer to the above embodiment, and this application will not repeat it here.

[0150] The digital power grid information security identification device mentioned above is described from the perspective of functional modules. Furthermore, the present invention also provides an electronic device, which is described from the perspective of hardware. Figure 7 A structural diagram of an electronic device provided in an embodiment of the present application, such as Figure 7 As shown, the electronic device includes: a memory 20 for storing computer programs;

[0151] The processor 21 is configured to implement the steps of the digital power grid information security identification method of the above embodiment when executing a computer program.

[0152] The electronic device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer, or a desktop computer.

[0153] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0154] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the memory 20 may be an internal storage unit of the electronic device, such as a server's hard drive. In other embodiments, the memory 20 may also be an external storage device of the electronic device, such as a plug-in hard drive equipped on a server, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. Furthermore, the memory 20 may include both an internal storage unit and an external storage device of the electronic device. The memory 20 may be used not only to store application software installed in the electronic device and various data, such as program code used in executing the digital power grid information security identification method, but also to temporarily store data that has been output or is to be output. In this embodiment, the memory 20 is used to store at least the following computer program 201, which, when loaded and executed by the processor 21, is capable of implementing the relevant steps of the digital power grid information security identification method disclosed in any of the aforementioned embodiments. In addition, resources stored in memory 20 may include an operating system 202 and data 203, which may be stored in either a temporary or permanent manner. Operating system 202 may include Windows, Unix, Linux, and the like. Data 203 may include, but is not limited to, data corresponding to the results of the digital power grid information security identification method.

[0155] In some embodiments, the electronic device may further include a display screen 22, an input / output interface 23, a communication interface 24, a power supply 25, and a communication bus 26. Among them, the display screen 22 and the input / output interface 23, such as a keyboard, are user interfaces, and the optional user interface may also include a standard wired interface, a wireless interface, etc. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode) touch device, etc. The display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface. The communication interface 24 may optionally include a wired interface and / or a wireless interface, such as a WI-FI interface, a Bluetooth interface, etc., which is generally used to establish a communication connection between the electronic device and other electronic devices. The communication bus 26 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0156] Those skilled in the art will understand that Figure 7 The structure shown in the figure does not constitute a limitation of the electronic device, and may include more or fewer components than shown in the figure.

[0157] It is understandable that if the digital power grid information security identification method in the above-mentioned embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and executes all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: USB flash drive, mobile hard disk, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk or optical disk, etc. Various media that can store program code.

[0158] Based on this, Figure 8As shown, an embodiment of the present invention further provides a computer-readable storage medium, on which a computer program 31 is stored. When the computer program 31 is executed by a processor, the steps of the above-mentioned digital power grid information security identification method are implemented.

[0159] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0160] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

[0161] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A digital power grid information security identification method, characterized in that: Applied to the central server, including: Obtaining a first attack type analysis result sent by the client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information obtained by the client using a pre-trained information security identification local model located on the client; Analyzing the first attack type analysis result using a pre-trained information security identification global model to obtain a second attack type analysis result; The second attack type analysis result is returned to the client, so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

2. The digital power grid information security identification method according to claim 1, characterized in that: The training process of the information security identification local model and the information security identification global model includes: The local power grid data set corresponding to each client is used in combination with the federated learning method to train the information security identification local model located at each client, and the local model parameters of each information security identification local model are aggregated to train the information security identification global model located at the central server.

3. The digital power grid information security identification method according to claim 2, characterized in that: The method includes training the information security identification local model located at each client by using the local power grid dataset corresponding to each client in combination with the federated learning method, and aggregating the local model parameters of each information security identification local model to train the information security identification global model located at the central server, including: During each round of iterative training, the global model parameters of the information security identification global model are sent to the corresponding client, and the client trains and updates the parameters of the information security identification local model based on the global model parameters and the local power grid information dataset; Obtaining updated local model parameters sent by the client, aggregating the local model parameters sent by each client, and training the information security identification global model to obtain new global model parameters; When the training end conditions are met, the trained information security identification local model and the trained information security identification global model are obtained. When the training end conditions are not met, the next round of iterative training is carried out.

4. The digital power grid information security identification method according to claim 3, characterized in that: Training and parameter updating of the information security identification local model based on the global model parameters and the local power grid information data set include: The information security identification local model is trained according to the global model parameters and the local power grid information data set by minimizing the objective function; During the training process, a stochastic gradient descent optimizer is used to update local model parameters; Among them, the objective function is: , is the objective function, Identifying local model pairs for information security training samples The loss function is Identify global model parameters of the global model for information security, D i is the local data information set of the i-th client, , k is the serial number of the training sample in the local data information set, k=1,…,m, m is the total number of training samples in the local data information set.

5. The digital power grid information security identification method according to claim 4, characterized in that: The method of updating local model parameters using a stochastic gradient descent optimizer includes: The local model parameters are updated based on the local model parameter update relational expression; the local model parameter update relational expression is: ； ； in, is the global model parameter in the tth round of training, is the local model parameter of the i-th client after the t+1th round of training, are the updated local model parameters after the tth round of training, is the learning rate, is the randomly selected power grid data information corresponding to the i-th client, is the local model parameter of the i-th client after the t-th round of training, It is a federal model.

6. The digital power grid information security identification method according to claim 5, characterized in that: Obtaining updated local model parameters sent by the client, and aggregating the local model parameters sent by each client, including: Obtain updated local model parameters sent by multiple clients, and aggregate the updated local model parameters using a federated learning aggregation rule; wherein the federated learning aggregation rule is constructed based on an aggregation relation, and the aggregation relation is: ; is the global model parameter after the t+1th round of training, and q is the number of clients participating in the local model training.

7. The digital power grid information security identification method according to any one of claims 1 to 6, characterized in that: The information security identification global model includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network and an SFTMAX layer connected in sequence; The analyzing the first attack type analysis result by using the pre-trained information security identification global model to obtain the second attack type analysis result includes: Inputting the first attack type analysis result sent by the client into the multi-head attention structure to obtain first feature information; Inputting the first information feature into the bidirectional long short-term memory network, obtaining the second feature information by acquiring the connection between the previous and next features and retaining the temporal information; Inputting the second feature information into the deep neural network for feature extraction to obtain third feature information; The third feature information is input into the sftmax layer for classification to obtain a second attack type analysis result.

8. A digital power grid information security identification device, characterized in that: Applied to the central server, including: an acquisition module, configured to acquire a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information acquired by the client using a pre-trained information security identification local model located on the client; A first analysis module, configured to analyze the first attack type analysis result using a pre-trained information security recognition global model to obtain a second attack type analysis result; The second analysis module is configured to return the second attack type analysis result to the client, so that the client can parse the second attack type analysis result and determine the attack type of the current digital power grid information.

9. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the digital power grid information security identification method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the digital power grid information security identification method according to any one of claims 1 to 7.

Images