A digital power grid information security identification method, device, equipment and medium

Abstract

The application discloses a kind of digital power grid information security identification method, device, electronic equipment and computer readable storage medium, applied to network information security technical field, to solve the problem of low efficiency and security of digital power grid information security analysis, comprising: obtaining the first attack type analysis result sent by client;Wherein, the first attack type analysis result is obtained by the information security identification local model pre-trained on the client after analyzing the current digital power grid information obtained by the client;Second attack type analysis result is obtained by analyzing the first attack type analysis result through the pre-trained information security identification global model;Second attack type analysis result is returned to client, so that client analyzes second attack type analysis result, determines the attack type of current digital power grid information;The application can improve the analysis efficiency and data information security.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network information security, in particular to a digital power grid information security identification method and device, electronic equipment and computer readable storage medium. BACKGROUND

[0002] In recent years, with the wide access of large-scale new energy power sources and new energy storage, the structure and form of the power system are undergoing profound changes. Digitalization is an important support for the development of new power system construction. Relying on the support of various digital platforms, the new power system realizes the coordinated operation and intelligent interaction of source, network, load and storage, and multi-flow fusion. However, the more abundant data and more intelligent interaction mode in the new power system also bring more network security risks.

[0003] In the face of increasingly prominent digital power grid information security problems, at present, network intrusion detection methods are usually used to detect and protect the digital power grid information, so as to improve the security protection ability of the power grid. Most of the current security protection methods are centralized, which requires users to upload raw data information to high-performance cloud servers for centralized training analysis. Not only is the analysis efficiency low, but also the information security protection effect is poor, which is easy to cause sensitive information leakage.

[0004] Therefore, how to improve the efficiency and security of digital power grid information security analysis has become a problem to be solved by those skilled in the art. SUMMARY

[0005] The purpose of the embodiments of the present application is to provide a digital power grid information security identification method, device, electronic equipment and computer readable storage medium, which can improve the analysis efficiency and data information security in use.

[0006] To solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] In one aspect, the present application provides a digital power grid information security identification method applied to a central server, comprising:

[0008] Obtaining a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information obtained by the client through a pre-trained information security identification local model located on the client;

[0009] Obtaining a second attack type analysis result by analyzing the first attack type analysis result through a pre-trained information security identification global model;

[0010] The second attack type analysis result is returned to the client, so that the client parses the second attack type analysis result and determines the attack type of the current digital power grid information.

[0011] In an embodiment, the training process of the information security identification local model and the information security identification global model comprises:

[0012] Each client corresponds to a local power grid data set, and a federated learning method is used to train the information security identification local model located at each client, and the local model parameters of each information security identification local model are aggregated to train the information security identification global model located at the central server.

[0013] In an embodiment, the training process of the information security identification local model and the information security identification global model located at each client comprises:

[0014] In each round of iterative training process, the global model parameters of the information security identification global model are sent to the corresponding client, and the information security identification local model is trained and the parameters are updated based on the global model parameters and the local power grid information data set at the client;

[0015] The updated local model parameters sent by the client are obtained, the local model parameters sent by each client are aggregated, and the information security identification global model is trained to obtain new global model parameters;

[0016] If the training end condition is met, the trained information security identification local model and the trained information security identification global model are obtained, and if the training end condition is not met, the next round of iterative training is performed.

[0017] In an embodiment, the training and parameter updating of the information security identification local model based on the global model parameters and the local power grid information data set comprises:

[0018] The information security identification local model is trained based on the global model parameters and the local power grid information data set by using a method of minimizing an objective function;

[0019] In the training process, a stochastic gradient descent optimizer is used to update the local model parameters;

[0020] The objective function is: , Let be the objective function. To identify local models for information security based on training samples loss function, To identify global model parameters for information security global model, D i This is the local data information set of the i-th client. k is the index of the training sample in the local data information set, k=1,…,m, and m is the total number of training samples in the local data information set.

[0021] In one implementation, updating the local model parameters using a stochastic gradient descent optimizer includes:

[0022] The local model parameters are updated based on the local model parameter update formula; the local model parameter update formula is:

[0023] ;

[0024] ;

[0025] in, These are the global model parameters in the t-th training round. These are the local model parameters for the i-th client after the (t+1)-th round of training. These are the updated local model parameters after the t-th training iteration. For learning rate, For randomly selected power grid data information corresponding to the i-th client, These are the local model parameters after the t-th round of training for the i-th client. For a federal model.

[0026] In one implementation, the updated local model parameters sent by the client are obtained, and the local model parameters sent by each client are aggregated, including:

[0027] The updated local model parameters sent by multiple clients are obtained, and the updated local model parameters are aggregated using federated learning aggregation rules; wherein, the federated learning aggregation rules are constructed based on an aggregation relation, which is:

[0028] ; q represents the global model parameters after the (t+1)th round of training, and q represents the number of clients participating in the local model training.

[0029] In one embodiment, the global model for information security identification includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network, and a softmax layer connected in sequence.

[0030] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0031] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0032] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0033] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0034] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0035] Another aspect of the embodiment of the application further provides a digital power grid information security identification device, applied to a central server, comprising:

[0036] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0037] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0038] The first attack type analysis result sent by the client is input into the multi-head attention structure to obtain first feature information.

[0039] Another aspect of the embodiment of the application further provides an electronic device, comprising:

[0040] The memory is used for storing a computer program.

[0041] The processor is used for executing the computer program to realize the steps of the digital power grid information security identification method.

[0042] Another aspect of the embodiment of the application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps of the digital power grid information security identification method.

[0043] From the above technical solutions, the embodiments of the present application have the following advantages:

[0044] The embodiment of the present application provides a digital power grid information security identification method, device, electronic equipment and computer readable storage medium, including: obtaining the first attack type analysis result sent by the client; wherein the first attack type analysis result is obtained by analyzing the current digital power grid information obtained by the client through the pre-trained information security identification local model located on the client; the second attack type analysis result is obtained by analyzing the first attack type analysis result through the pre-trained information security identification global model; the second attack type analysis result is returned to the client, so that the client analyzes the second attack type analysis result to determine the attack type of the current digital power grid information.

[0045] Therefore, in the embodiment of the present application, the information security identification local model is pre-trained on the client, and the information security identification global model is pre-trained on the central server, the training processes of the information security identification local model and the information security identification global model are associated, when the client needs to analyze the current digital power grid information, the information security identification local model on the client can be used to analyze and identify the current digital power grid information to obtain the first attack type analysis result, and the first attack type analysis result is sent to the central server, the central server analyzes and identifies the first attack type analysis result through the information security identification global model to obtain the second attack type analysis result, and the client determines the attack type of the current digital power grid information according to the second attack type analysis result sent by the central server. In the present application, the current digital power grid information of the client does not need to be sent directly to the central server, but the first attack type analysis result after preliminary analysis is sent to the central server, the central server does not need to analyze all the digital power grid information, but analyzes the first attack type analysis result through the information security identification global model in the central server, so that the attack type of the current digital power grid information can be obtained, therefore, the present application can improve the analysis efficiency and data information security.

[0046] In addition, the present application also provides a corresponding implementation device, electronic equipment and computer readable storage medium for the digital power grid information security identification method, further making the method more practical, and the device, electronic equipment and computer readable storage medium have corresponding advantages. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the prior art and the embodiments will be briefly introduced as follows. Obviously, the drawings described in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0048] Figure 1 A flowchart of a digital power grid information security identification method provided by the embodiment of the present application is shown in the figure.

[0049] Figure 2 An architecture diagram of a digital power grid information security identification system provided by the embodiment of the present application is shown in the figure.

[0050] Figure 3 An architecture diagram of an information security identification global model provided by the embodiment of the present application is shown in the figure.

[0051] Figure 4 A diagram showing the detection accuracy of different methods on various attack types on the NSL-KDD dataset is shown in the figure.

[0052] Figure 5 A diagram showing the protection success rate of different methods on the UNSW-NB15 dataset is shown in the figure.

[0053] Figure 6 A structural diagram of a digital power grid information security identification device provided by the embodiment of the present application is shown in the figure.

[0054] Figure 7 A structural diagram of an electronic device provided by the embodiment of the present application is shown in the figure.

[0055] Figure 8 A structural diagram of a computer readable storage medium provided by the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0056] The embodiments of the present application provide a digital power grid information security identification method, device, electronic equipment and computer readable storage medium, which can improve the analysis efficiency and data information security in use.

[0057] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0058] Please refer to Figure 1 ,Figure 1 A flowchart of a digital power grid information security identification method provided by an embodiment of the present application. The method is applied to a central server and includes the following steps.

[0059] S110: Obtain a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information obtained by the client through a pre-trained information security identification local model located on the client;

[0060] It should be noted that, in the present application, the information security identification local model is pre-trained on each client, and the information security identification global model is pre-trained on the central server. For each client, after obtaining the current digital power grid information, the client can perform preliminary attack type analysis on the current digital power grid information through the information security identification local model on the client to obtain a first attack type analysis result, and then send the first attack type analysis result to the central server. For the central server, the first attack type analysis result sent by the client can be obtained, which can include initial attack type analysis information and client identification information, etc.

[0061] S120: Analyze the first attack type analysis result through the pre-trained information security identification global model to obtain a second attack type analysis result;

[0062] It can be understood that, after obtaining the first attack type analysis result sent by the client, the central server can further analyze the attack type of the first attack type analysis result through the information security identification global model located on the central server to obtain a second attack type analysis result. That is, in the present application, the central server analyzes the first attack type analysis result sent by the client after preliminary analysis, rather than directly analyzing the current digital power grid information of the client, so that information security problems such as information leakage can be avoided.

[0063] S130: Return the second attack type analysis result to the client, so that the client can analyze the second attack type analysis result to determine the attack type of the current digital power grid information.

[0064] Specifically, after the central server obtains the second attack type analysis result, the central server can return the second attack type analysis result to the client according to the client identification information in the first attack type analysis result. After receiving the second attack type analysis result, the client can analyze the second attack type analysis result, and obtain the attack type in the second attack type analysis result, i.e., the final attack type of the current digital power grid information.

[0065] The following will be a detailed description and introduction of the present scheme, please parameters Figures 2 to 5 .

[0066] In an embodiment, the training process of the information security identification local model and the information security identification global model can include:

[0067] The information security identification local model located at each client is trained by combining the local power grid data set corresponding to each client with the federated learning method, and the local model parameters of each information security identification local model are aggregated to train the information security identification global model located at the central server.

[0068] It can be understood that a predetermined number (less than or equal to the total number of cluster clients) of clients can be selected from all clients in the cluster in the present application. For each selected client, the local power grid data set corresponding to each client can be determined in advance, and the initial model of the information security identification local model is constructed at each client, and the initial model of the information security identification global model is constructed at the central server side in advance. Then, the information security identification local model of each client is trained by combining the federated learning method, and each information security identification local model is aggregated to further train the information security identification global model of the central server. The information security identification local model of each client side and the information security identification global model of the central server side are obtained by training. In an embodiment, the process of training the information security identification local model located at each client by combining the local power grid data set corresponding to each client with the federated learning method, and aggregating the local model parameters of each information security identification local model to train the information security identification global model located at the central server can include:

[0069] In each round of iterative training process, the global model parameters of the information security identification global model are sent to the corresponding client, and the information security identification local model is trained and the parameters are updated based on the global model parameters and the local power grid information data set at the client;

[0070] The updated local model parameters sent by the client are obtained, the local model parameters sent by each client are aggregated, and the information security identification global model is trained to obtain new global model parameters;

[0071] In the case of meeting the training end condition, the trained information security identification local model and the trained information security identification global model are obtained, and in the case of not meeting the training end condition, the next round of iterative training is performed.

[0072] It should be noted that in the process of each round of iterative training, the central server can obtain the global model parameters of the current information security identification global model in this round of training, and then send (for example, broadcast in the form of broadcast) the global model parameters to each corresponding client. After each client receives the global model parameters sent by the central server, the information security identification local model on the client is trained according to the global model parameters and the local power grid information dataset of the client, and the parameter update of the information security identification local model is performed. For each client, the updated local model parameters of the information security identification local model can be sent to the central server. After the central server obtains the local model parameters of each client, the local model parameters of each client can be aggregated, and then the training of the information security identification global model is performed, so as to obtain the new global model parameters after the current training. At this time, it can be further determined whether the training end condition is met, for example, whether the current training round reaches the preset iteration number, or whether the loss value of the current information security identification global model is less than or equal to the preset loss value. If the current training round reaches the preset iteration number, or the loss value of the current information security identification global model is less than or equal to the preset loss value, the training can be ended, and the information security identification local model trained by each client and the information security identification global model trained by the central server are obtained.

[0073] Of course, if the current training round does not reach the preset iteration number, or the loss value of the current information security identification global model is not less than the preset loss value, the next round of iterative training can be entered until the training end condition is met. The information security identification local model trained by each client and the information security identification global model trained by the central server are obtained.

[0074] It should be noted that the information security identification local model and the information security identification global model in the embodiment can be models established based on a bidirectional long short-term memory network-convolutional neural network (BiLSTM-DNN).

[0075] In addition, please refer to Figure 2In actual application, a control center can also be set. In the process of the first round of iteration, the central server can obtain the initial model parameters of the information security identification global model, and then broadcast the initial model parameters to each client in a secure manner, so that each client trains and updates the parameters of the information security identification local model according to the received initial model parameters and the power grid information data in the local power grid information data set. The control center can filter each information security identification local model after updating the parameters, and transmit each information security identification local model that meets the condition to the central server after secure aggregation according to the selection condition preset by the central server. Specifically, the local model parameters corresponding to each information security identification local model that meets the selection condition are aggregated and transmitted to the central server, so that the central server trains the information security identification global model.

[0076] It should be further noted that, in the embodiments of the present application, the federated learning method is used for information processing. The client does not need to send all the local power grid information to the central server, but trains the information security identification local model locally, sends the local model parameters to the central server for training of the information security identification global model. The present application realizes model training under the premise of protecting data information privacy, and further promotes the circulation and sharing of power grid information.

[0077] The central server of the federated learning architecture cooperates with a set of N clients holding training data to jointly train a deep learning model (that is, an information security identification global model) to obtain optimal model parameters (that is, optimal parameters of the information security identification global model).

[0078] In an embodiment, the process of training and updating the parameters of the information security identification local model based on the global model parameters and the local power grid information data set can include:

[0079] The information security identification local model is trained based on the global model parameters and the local power grid information data set by using a method of minimizing an objective function.

[0080] In the training process, a stochastic gradient descent optimizer is used to update the local model parameters.

[0081] The objective function is: , is the objective function, is the loss function of the information security identification local model on the training sample , and is used to represent the error between the model prediction value and the actual value. The global model parameters of the global model for information security identification are obtained, D i The local data information set of the i-th client is obtained, k is the serial number of the training sample in the local data information set, k = 1, …, m, and m is the total number of training samples in the local data information set.

[0082] It should be noted that in the present embodiment, the information security identification local model can be trained by using the method of minimizing the objective function on the local power grid information data set according to the global model parameters, wherein the objective function is Then, the model parameters of the information security identification local model are calculated by the SGD (stochastic gradient descent) optimizer during the training process and are updated.

[0083] In the present embodiment, the process of updating the local model parameters by using the stochastic gradient descent optimizer can include:

[0084] The local model parameters are updated based on the local model parameter update relationship, wherein the local model parameter update relationship is:

[0085] ;

[0086] wherein, is the global model parameter in the t-th round of training, is the local model parameter of the i-th client after the t+1-th round of training, , is the updated local model parameter after the t-th round of training, is the learning rate, is the randomly extracted power grid data information corresponding to the i-th client, is the local model parameter of the i-th client after the t-th round of training, is the federated model, denotes the gradient operator.

[0087] It can be understood that the model parameters are updated by using the SGD optimizer, and the updated model parameters of the information security identification local model are calculated by the client , wherein, can be calculated In the present application, the accuracy of parameter updating can be improved by this way.

[0088] In an embodiment, the process of obtaining the updated local model parameters sent by the client and aggregating the local model parameters sent by each client can include:

[0089] Obtain the updated local model parameters sent by the plurality of clients, and aggregate the updated local model parameters using a federated learning aggregation rule; wherein the federated learning aggregation rule is constructed based on an aggregation relationship formula, and the aggregation relationship formula is:

[0090] is the global model parameter after the t+1th round of training, and q is the number of clients participating in local model training.

[0091] It should be noted that the updated local model parameters of the local model are aggregated by the central server using the FedAvg (Federated Averaging Algorithm) aggregation rule in the federated learning method, and the FedAvg aggregation rule is constructed according to the aggregation relationship formula In this application, the updated local model parameters are aggregated using the federated learning aggregation rule, which not only enables the local model on the client side to better adapt to the characteristics of the local data, but also enables the global model to be aggregated after the local advantages of each client are integrated, thereby improving the generalization ability of the model to different data distributions.

[0092] In an embodiment, the information security identification global model in the embodiment includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network, and a softmax layer connected in sequence.

[0093] Then, the process of analyzing the first attack type analysis result by the pre-trained information security identification global model to obtain the second attack type analysis result can include:

[0094] Input the first attack type analysis result sent by the client into the multi-head attention structure to obtain first feature information;

[0095] Input the first feature information into the bidirectional long short-term memory network to obtain second feature information by obtaining the connection between the front and rear features and retaining the time sequence information;

[0096] Input the second feature information into the deep neural network for feature extraction to obtain third feature information;

[0097] Input the third feature information into the softmax layer for classification to obtain the second attack type analysis result.

[0098] It should be noted that the architecture of the information security identification global model in the embodiment is as shown in Figure 3 ​As shown, specifically, a model constructed based on a BiLSTM-DNN network, the BiLSTM network is good at processing timing information and overcomes the problems existing in the RNN structure, in order to make the extracted features more rich, a multi-head attention structure is used before the BiLSTM module to obtain information features.

[0099] Among them, the multi-head attention structure extracts information features (for example, the first feature information is extracted from the first attack type analysis result) through a multi-head attention function, and the multi-head attention function The expression of the multi-head attention function is specifically:

[0100] Among them, Q is the query of attention, K is the key of attention, and V is the value of attention, is the total number of heads, is the weight matrix, and Concat is the vector concatenation operation, is the feature of the jth head, and ;

[0101] ; wherein, , and are the weight matrices corresponding to the input of the jth head, is the feature dimension; and softmax is an activation function.

[0102] In addition, in the embodiment, after obtaining the information features, the first feature information can be input into the bidirectional long short-term memory network to obtain the connection between the front and rear features and retain the timing information, and obtain the second feature information. The expression of the second feature information H can be:

[0103] Among them, is the forward output of the BiLSTM network, is the reverse output of the BiLSTM network.

[0104] Further, after obtaining the second feature information H, the second feature information H is input into a deep neural network for feature extraction to obtain third feature information. The deep neural network DNN includes two hidden layers, and the expression of the output of any one hidden layer can be:

[0105] Among them, is an activation function, is the threshold value of the DNN network, b is the bias of the DNN network, and x is the input of the hidden layer.

[0106] Therefore, in the embodiment of the application, the information security identification local model is trained in advance on the client, the information security identification global model is trained on the central server, the training processes of the information security identification local model and the information security identification global model are associated, when the client needs to analyze the current digital power grid information, the information security identification local model on the client can be used to analyze and identify the current digital power grid information to obtain a first attack type analysis result, and the first attack type analysis result is sent to the central server, the central server analyzes and identifies the first attack type analysis result through the information security identification global model to obtain a second attack type analysis result, and the client determines the attack type of the current digital power grid information according to the second attack type analysis result sent by the central server. In the application, the current digital power grid information of the client does not need to be sent directly to the central server, but the first attack type analysis result after preliminary analysis is sent to the central server, and the central server does not need to analyze all the digital power grid information, but analyzes the first attack type analysis result through the information security identification global model in the central server to obtain the attack type of the current digital power grid information, so that the application can improve the analysis efficiency and information security.

[0107] That is, in the embodiment of the application, the global model of the improved BiLSTM-DNN model is used to globally divide the network attack type in the power grid information data, if the network attack behavior is found, the position is accurately located, the authority of the abnormal behavior node is managed, the attack behavior is isolated, and the security protection of the digital power grid information is realized.

[0108] The following will be described by taking an experiment as an example. For example, the network attack in the digital power grid is diversified, and the NSL-KDD data set is selected for test analysis in combination with the actual situation of the power grid. The NSL-KDD data set contains more than 100,000 data in total, and the data distribution is shown in Table 1.

[0109] Table 1: Sample distribution table of NSL-KDD data set

[0110]

[0111] The experimental operating system uses Ubuntu20.04 server version, the processor is Intel Xeon Silver 4210, the memory is 64.0 GB, the GPU is NVIDIA Tesla T4 16 GB, and the improved BiLSTM-DNN model is built using Tensorflow-gpu-1.15.0, the model is trained for a total of 100 times, the Dropout is set to 0.5, and the learning rate is set to 0.001. In addition, attack detection accuracy and security protection success rate are used for evaluation in the experiment.

[0112] The method proposed in this application ( Figure 4 The proposed method in the experiment was compared and analyzed with two related methods (Related Technique 1 and Related Technique 2). The detection accuracy of the three methods on the NSL-KDD dataset for various attack types is as follows: Figure 4 As shown, Normal represents the normal situation, and various attack types include DoS, Probe, R2L, and U2R.

[0113] Depend on Figure 4 As can be seen, the proposed method achieves good detection results for various attack types in the NSL-KDD dataset, with an accuracy exceeding 95%. This is because the proposed method utilizes an improved BiLSTM-DNN model for federated learning, fully considering the spatiotemporal characteristics of digital power grid information, thus ensuring the reliability of attack detection. Related technique 1 uses a DBN-LSTM model for attack detection, achieving an accuracy close to the proposed method, but lacks consideration for massive amounts of information and key details, resulting in poor detection performance for a small number of R2L and U2R types. Another related technique 2 employs an ADWIN-SVM model for attack detection, but lacks the support of a federated learning environment, achieving an accuracy of around 90%.

[0114] After multiple experiments, the attack detection and security protection results of the three methods on the NSL-KDD dataset are shown in Table 2.

[0115] Table 2 Comparison of results for different methods on the NSL-KDD dataset

[0116]

[0117] As shown in Table 2, the attack detection accuracy and protection success rate of the method provided in this application (i.e., the proposed method) are 98.15% and 97.92%, respectively, which are superior to other comparative methods. This is because the method provided in this application uses an improved BiLSTM-DNN model for attack type detection, ensuring better detection results. Furthermore, federated learning offers good data privacy, further improving the reliability of data security protection, thus significantly increasing the protection success rate. Related technology 1 uses a DBN-LSTM model for network attack detection, but lacks distributed learning with massive amounts of data, resulting in poor protection effectiveness and a success rate of 91.38%. Another related technology 2 uses an ADWIN-SVM model for attack detection, but this model has insufficient feature extraction capabilities and lacks the support of a federated learning environment, thus its protection success rate is 10.46% lower than the proposed method.

[0118] In order to demonstrate the universality of the method provided in the application, three data sets NSL-KDD, UNSW-NB15 and CIC-IDS2017 can also be selected for comparative experiments, wherein the UNSW-NB15 data set contains 9 attacks, 49 features and 1 labeled features; the CIC-IDS2017 data set contains 9 traffic types, and the information security protection success rate of the method provided in the application on the three data sets is as shown in Figure 5

[0119] As can be seen from Figure 5 , the protection success rate of the method provided in the application on the UNSW-NB15 data set is relatively low, about 86%, because the data set is all real network information, and the type characteristics are more complex. The CIC-IDS2017 data set combines similar abnormal attack properties, simplifying the attack type, so the protection performance of the method is obviously improved compared with the UNSW-NB15 data set, and the protection performance on the NSL-KDD data set is close to 97%, which is ideal. In summary, the method can achieve good protection effect on the three data sets, and has strong robustness.

[0120] It can be seen that the method for information security protection of digital power grid based on federated learning and deep learning provided in the application designs the overall architecture of digital power grid information security protection, analyzes the data information based on the federated learning architecture, and takes the improved BiLSTM-DNN model as the local model and the global model of the federated learning architecture. The attack detection results of the local model are aggregated by the global model of the best improved BiLSTM-DNN model to realize the security protection of digital power grid information. The method is experimentally demonstrated based on the NSL-KDD data set, and the results show that the improved BiLSTM-DNN model ensures the high attack detection performance of the method, and the attack detection accuracy reaches 98.15%, and the robustness is good. The federated learning has good data privacy protection ability, and in combination with the improved BiLSTM-DNN model, the information security protection ability of the method is further improved, and the protection success rate reaches 97.92%.

[0121] ​The application also provides a corresponding device for the digital power grid information security identification method, further making the method more practical. The device can be described from the perspective of functional modules and the perspective of hardware. The digital power grid information security identification device provided by the application is introduced below. The device is used to implement the digital power grid information security identification method provided by the application. In this embodiment, the digital power grid information security identification device can include or be divided into one or more program modules, which are stored in a storage medium and executed by one or more processors to complete the digital power grid information security identification method disclosed in the above embodiment. The program module referred to by the application refers to a series of computer program instruction segments that can complete a specific function. It is more suitable to describe the execution process of the digital power grid information security identification device in the storage medium than the program itself. The following description will specifically introduce the functions of each program module in this embodiment. The digital power grid information security identification device described below can be mutually corresponding and referred to with the digital power grid information security identification method described above.

[0122] Based on the perspective of functional modules, see Figure 6 , Figure 6 The structure diagram of the digital power grid information security identification device provided by the application in a specific embodiment. The device is applied to a central server and can include:

[0123] The acquisition module 11 is configured to acquire a first attack type analysis result sent by a client. The first attack type analysis result is obtained by analyzing current digital power grid information acquired by the client through a pre-trained information security identification local model located on the client.

[0124] The first analysis module 12 is configured to analyze the first attack type analysis result through a pre-trained information security identification global model to obtain a second attack type analysis result.

[0125] The second analysis module 13 is configured to return the second attack type analysis result to the client, so that the client analyzes the second attack type analysis result to determine the attack type of the current digital power grid information.

[0126] In an embodiment, the device further includes:

[0127] The training module is configured to train the information security identification local model located on each client by combining the local power grid data set corresponding to each client respectively and the federated learning method, and aggregate the local model parameters of each information security identification local model to train the information security identification global model located on the central server.

[0128] In an embodiment, the training module includes:

[0129] a local model training unit configured to, in each round of iterative training, send global model parameters of the information security identification global model to the corresponding client, and train and update parameters of the information security identification local model based on the global model parameters and the local power grid information dataset at the client;

[0130] a global model training unit configured to obtain the updated local model parameters sent by the clients, aggregate the local model parameters sent by the respective clients, and train the information security identification global model to obtain new global model parameters;

[0131] a determination unit configured to, if a training end condition is met, obtain a trained information security identification local model and a trained information security identification global model, and if the training end condition is not met, perform the next round of iterative training.

[0132] In an embodiment, the local model training unit comprises:

[0133] a first training subunit configured to train the information security identification local model based on the global model parameters and the local power grid information dataset using a method of minimizing an objective function;

[0134] an updating subunit configured to update the local model parameters using a stochastic gradient descent optimizer during the training;

[0135] wherein the objective function is: , is the objective function, is a loss function of the information security identification local model on the training sample , is used to represent the error between the model prediction value and the actual value, is the global model parameter of the information security identification global model, and D i is the local data information set of the i-th client, k is the serial number of the training sample in the local data information set, k = 1, …, m, and m is the total number of training samples in the local data information set.

[0136] In an embodiment, the updating subunit is specifically configured to:

[0137] update the local model parameters based on a local model parameter updating relationship; the local model parameter updating relationship is:

[0138] ;

[0139] ;

[0140] wherein, is the global model parameter in the tth training round, is the local model parameter of the ith client after the t+1th training round, is the updated local model parameter after the tth training round, is the learning rate, is the randomly extracted power grid data information corresponding to the ith client, is the local model parameter of the ith client after the tth training round, is the federated model.

[0141] In an implementation, the global model training unit is configured to:

[0142] obtain the updated local model parameters sent by the plurality of clients, and aggregate the updated local model parameters using a federated learning aggregation rule, wherein the federated learning aggregation rule is constructed based on an aggregation relationship formula, and the aggregation relationship formula is:

[0143] ; is the global model parameter after the t+1th training round, and q is the number of clients participating in the local model training.

[0144] In an implementation, the information security identification global model includes a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network, and a softmax layer connected in sequence.

[0145] The second analysis module 13 includes:

[0146] The first analysis unit is configured to input the first attack type analysis result sent by the client to the multi-head attention structure to obtain first feature information.

[0147] The second analysis unit is configured to input the first feature information to the bidirectional long short-term memory network to obtain second feature information by obtaining the connection between the front and rear features and retaining the timing information.

[0148] The third analysis unit is configured to input the second feature information to the deep neural network for feature extraction to obtain third feature information.

[0149] The classification unit is configured to input the third feature information to the softmax layer for classification to obtain the second attack type analysis result.

[0150] It should be noted that the digital power grid information security identification device provided in the embodiments of the present application has the same beneficial effects as the digital power grid information security identification method provided in the above embodiments. For the specific introduction of the digital power grid information security identification method involved in the present embodiment, reference can be made to the above embodiments, which will not be repeated here.

[0151] The digital power grid information security identification device mentioned above is described from the perspective of functional modules, and further, the application also provides an electronic device, which is described from the perspective of hardware. Figure 7 As shown in a structural diagram of an electronic device provided by an embodiment of the application, Figure 7 The electronic device includes a memory 20 configured to store a computer program.

[0152] A processor 21 is configured to implement the steps of the digital power grid information security identification method of the above-described embodiments when executing the computer program.

[0153] The electronic device provided by the embodiment can include, but is not limited to, a smartphone, a tablet computer, a notebook computer, or a desktop computer, etc.

[0154] The processor 21 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one of a hardware form of a DSP (Digital Signal Processing), a FPGA (Field-Programmable Gate Array), and a PLA (Programmable Logic Array). The processor 21 can also include a main processor and a coprocessor. The main processor is a processor configured to process data in a wake-up state, also referred to as a CPU (Central Processing Unit). The coprocessor is a low-power processor configured to process data in a standby state. In some embodiments, the processor 21 can be integrated with a GPU (Graphics Processing Unit) configured to be responsible for rendering and drawing of content to be displayed on a display screen. In some embodiments, the processor 21 can further include an AI (Artificial Intelligence) processor configured to process computing operations related to machine learning.

[0155] The memory 20 can include one or more computer-readable storage media. The computer-readable storage media can be non-transitory. The memory 20 can also include high-speed random access memory and nonvolatile, computer-readable storage media such as one or more magnetic disk storage devices, optical storage devices, flash memory devices, solid-state memory devices, or any other non-transitory computer-readable storage medium, which can be internal to or external to the electronic device. In some embodiments, the memory 20 can be an internal storage unit of the electronic device, such as a hard disk of a server. In other embodiments, the memory 20 can also be an external storage device of the electronic device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, or the like. Further, the memory 20 can include both an internal storage unit and an external storage device of the electronic device. The memory 20 can be used to store not only application software and various data installed in the electronic device, such as program codes for executing the digital power grid information security identification method, but also data that has been output or will be output. In the present embodiment, the memory 20 is used to store at least the following computer program 201, which, after being loaded and executed by the processor 21, can implement the related steps of the digital power grid information security identification method disclosed in any of the preceding embodiments. In addition, the memory 20 can also store resources such as an operating system 202 and data 203, and the storage manner can be temporary storage or permanent storage. The operating system 202 can include Windows, Unix, Linux, and the like. The data 203 can include, but is not limited to, data corresponding to the result of the digital power grid information security identification method, and the like.

[0156] In some embodiments, the electronic device can further include a display screen 22, an input / output interface 23, a communication interface 24, a power supply 25, and a communication bus 26. Among them, the display screen 22 and the input / output interface 23 such as a keyboard belong to a user interface, and the optional user interface can further include a standard wired interface, a wireless interface, etc. Optionally, in some embodiments, the display can be an LED display, a liquid crystal display, a touch liquid crystal display, an OLED (Organic Light-Emitting Diode) touch, etc. The display can also be appropriately referred to as a display screen or a display unit, used to display information processed in the electronic device and used to display a visualized user interface. The communication interface 24 can optionally include a wired interface and / or a wireless interface, such as a WI-FI interface, a Bluetooth interface, etc., and is usually used to establish a communication connection between the electronic device and other electronic devices. The communication bus 26 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 In the figure, only one thick line is used to represent, but it does not mean that there is only one bus or one type of bus.

[0157] Those skilled in the art can understand that Figure 7 The structure shown in the figure does not constitute a limitation on the electronic device, and can include more or fewer components than the illustration.

[0158] It can be understood that if the digital grid information security identification method in the above embodiments is realized in the form of a software function unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and executes all or part of the steps of the method of each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable ROM, a register, a hard disk, a removable magnetic disk, a CD-ROM, a magnetic disk or an optical disk, and various media that can store program codes.

[0159] Based on this, as Figure 8As shown, the embodiment of the present application further provides a computer readable storage medium, and the computer readable storage medium 30 stores a computer program 31, and the computer program 31 is executed by a processor to implement the steps of the digital power grid information security identification method.

[0160] The various embodiments are described in a progressive manner in the specification, and each embodiment focuses on the difference from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the apparatus disclosed by the embodiments, since it corresponds to the method disclosed by the embodiments, the description is relatively simple, and the related parts can be referred to the method part.

[0161] It should also be noted that the terms such as first and second in the specification are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0162] The above description of the disclosed embodiments enables a person skilled in the art to implement or use the present application. Various modifications to the embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A digital power grid information security identification method, characterized in that, The application is applied to a central server, comprising: obtaining a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information obtained by the client through a pre-trained information security identification local model located on the client; analyzing the first attack type analysis result through a pre-trained information security identification global model to obtain a second attack type analysis result; returning the second attack type analysis result to the client so that the client analyzes the second attack type analysis result to determine the attack type of the current digital power grid information; wherein: the information security identification global model comprises a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network and a softmax layer connected in turn; the information security identification global model analyzes the first attack type analysis result to obtain a second attack type analysis result, comprising: inputting the first attack type analysis result sent by the client into the multi-head attention structure to obtain first feature information; inputting the first feature information into the bidirectional long short-term memory network to obtain second feature information by obtaining the connection between the front and rear features and retaining the time sequence information; inputting the second feature information into the deep neural network for feature extraction to obtain third feature information; inputting the third feature information into the softmax layer for classification to obtain the second attack type analysis result.

2. The method of claim 1, wherein, The training process of the information security identification local model and the information security identification global model comprises: training the information security identification local model located on each client through the local power grid data set corresponding to each client in combination with the federated learning method, and aggregating the local model parameters of each information security identification local model to train the information security identification global model located on the central server.

3. The method of claim 2, wherein, training the information security identification local model located on each client through the local power grid data set corresponding to each client in combination with the federated learning method, and aggregating the local model parameters of each information security identification local model to train the information security identification global model located on the central server, comprising: in each round of iterative training process, sending the global model parameters of the information security identification global model to the corresponding client, and training and updating the information security identification local model based on the global model parameters and the local power grid information data set in the client; obtaining the updated local model parameters sent by the client, aggregating the local model parameters sent by each client, and training the information security identification global model to obtain new global model parameters; if the training end condition is met, the trained information security identification local model and the trained information security identification global model are obtained, and if the training end condition is not met, the next round of iterative training is performed.

4. The digital grid information security identification method of claim 3, wherein, training and parameter updating of the information security identification local model based on the global model parameters and the local power grid information dataset, comprising: training the information security identification local model based on the global model parameters and the local power grid information dataset by using a method of minimizing an objective function; in the training process, the local model parameters are updated by using a stochastic gradient descent optimizer; wherein the objective function is: , is the objective function, is a loss function of the information security identification local model for the training sample , is a global model parameter of the information security identification global model, D i is a local data information set of the i-th client, , k is the serial number of the training sample in the local data information set, k = 1, …, m, and m is the total number of training samples in the local data information set.

5. The digital grid information security identification method of claim 4, wherein, the local model parameters are updated by using the stochastic gradient descent optimizer, comprising: updating the local model parameters based on a local model parameter updating relationship; the local model parameter updating relationship is: ； ； wherein, is the global model parameter in the tth round of training, is the local model parameter of the ith client after the t+1th round of training, is the updated local model parameter after the tth round of training, is the learning rate, is the randomly extracted power grid data information corresponding to the ith client, is the local model parameter of the ith client after the tth round of training, is the federated model.

6. The digital grid information security identification method of claim 5, wherein, obtaining the updated local model parameters sent by the client, and aggregating the local model parameters sent by each client, comprising: obtaining the updated local model parameters sent by multiple clients, and aggregating the updated local model parameters by using a federated learning aggregation rule; wherein the federated learning aggregation rule is constructed based on an aggregation relationship; the aggregation relationship is: ; are the global model parameters after the t+1th round of training, and q is the number of clients participating in local model training.

7. A digital power grid information security identification device, characterized in that, applied to a central server, comprising: an obtaining module, configured to obtain a first attack type analysis result sent by a client; wherein the first attack type analysis result is obtained by analyzing current digital power grid information obtained by the client by using a pre-trained information security identification local model located on the client; a first analysis module, configured to analyze the first attack type analysis result by using a pre-trained information security identification global model to obtain a second attack type analysis result; a second analysis module, configured to return the second attack type analysis result to the client, so that the client analyzes the second attack type analysis result to determine an attack type of the current digital power grid information; wherein: the information security identification global model comprises a multi-head attention structure, a bidirectional long short-term memory network, a deep neural network and a softmax layer connected in sequence; the second analysis module comprises: a first analysis unit, configured to input the first attack type analysis result sent by the client into the multi-head attention structure to obtain first feature information; a second analysis unit, configured to input the first feature information into the bidirectional long short-term memory network to obtain second feature information by obtaining the connection between the front and rear features and retaining the time sequence information; a third analysis unit, configured to input the second feature information into the deep neural network to extract features to obtain third feature information; a classification unit, configured to input the third feature information into the softmax layer to classify to obtain the second attack type analysis result.

8. An electronic device, comprising: comprising: a memory, configured to store a computer program; a processor, configured to execute the computer program to implement the steps of the digital power grid information security identification method in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, the computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the digital power grid information security identification method in any one of claims 1 to 6.

Images