SVM and FCM combined electric power system vulnerability perception classification detection method
By combining the power system vulnerability awareness classification detection method of SVM and FCM, the integrated vulnerability detector and weight allocation mechanism are used to solve the accuracy of vulnerability identification in complex communication environments, and efficient and accurate vulnerability detection is achieved.
Patent Information
- Application Number
- CN202510865923.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-26
- Publication Date
- 2025-08-15
AI Technical Summary
In the prior art, power system vulnerability perception cannot efficiently, accurately and timely identify different types of vulnerabilities when facing complex and dynamically changing communication environments.
Combining support vector machine (SVM) and fuzzy C-mean (FCM) clustering algorithm, an integrated vulnerability detector is built, and the weight coefficient is configured for the communication transmission parameters to be detected through the weight allocation unit, and the perception results of multiple vulnerability detectors are fused to identify potential vulnerabilities.
It improves the accuracy and reliability of vulnerability detection in power system communication, and can efficiently identify different types of vulnerabilities.
Smart Images
Figure CN120498873A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field related to power systems, and specifically to a power system vulnerability perception, classification and detection method combining SVM and FCM. Background Art
[0002] With the development of intelligent power systems, power communication networks are becoming increasingly important within power infrastructure. The security and reliability of communication networks, particularly in the operation of distribution systems, substations, and smart meters, directly impact the stable operation of power systems. However, existing power system vulnerability awareness technologies struggle to efficiently, accurately, and promptly identify different types of vulnerabilities in complex and dynamically changing communication environments.
[0003] Therefore, in the existing technology, power system vulnerability perception faces the technical problem of being unable to efficiently, accurately and timely identify different types of vulnerabilities when facing a complex and dynamically changing communication environment. Summary of the Invention
[0004] This application provides a power system vulnerability perception and classification detection method that combines SVM and FCM. This method addresses the technical problem of existing power system vulnerability perception technologies being unable to efficiently, accurately, and promptly identify different types of vulnerabilities in complex and dynamically changing communication environments. Through cluster analysis and a weight allocation mechanism, it can efficiently and accurately identify potential vulnerabilities in power system communications and dynamically adjust the weights of detectors based on communication transmission parameters, thereby improving the accuracy and reliability of vulnerability detection.
[0005] The present application provides a power system vulnerability perception and classification detection method combining SVM and FCM, the method comprising: determining a target power system, and retrieving an integrated vulnerability detector corresponding to the target power system, the integrated vulnerability detector comprising a weight distribution unit and multiple vulnerability detectors, the weight distribution unit being constructed based on the FCM clustering algorithm, and each of the vulnerability detectors being constructed based on the SVM; obtaining communication transmission parameters to be detected of the target power system, inputting the communication transmission parameters to be detected into the integrated vulnerability detector, and configuring multiple weight coefficients for the communication transmission parameters to be detected through the weight distribution unit; performing vulnerability perception on the communication transmission parameters to be detected through the multiple vulnerability detectors to obtain multiple vulnerability perception results; and fusing the multiple vulnerability perception results based on the multiple weight coefficients to determine the vulnerability type of the communication transmission parameters to be detected.
[0006] In the implementation method, the target power system is determined, and the integrated vulnerability detector corresponding to the target power system is retrieved, including: obtaining the system identification of the target power system; using the system identification as an index, searching in the vulnerability detector repository to obtain the integrated vulnerability detector.
[0007] In the implementation method, the steps of constructing the vulnerability detector repository include: obtaining a first system identifier, collecting historical communication transmission parameters of the power system based on the first system identifier, and processing the historical communication transmission parameters of the power system to obtain multiple formatted communication transmission features; clustering the multiple formatted communication transmission features to obtain multiple cluster clusters, each cluster cluster has a corresponding feature cluster center, and each cluster cluster corresponds to a communication transmission state; for each cluster cluster, constructing multiple support vector machine classifiers, and using each cluster cluster to train each support vector machine classifier separately to form multiple vulnerability detectors; constructing the weight allocation unit according to the corresponding feature cluster center of each cluster cluster; integrating the weight allocation unit and multiple vulnerability detectors to obtain a first integrated vulnerability detector; and associating the first system identifier and the first integrated vulnerability detector and storing them in the vulnerability detector repository.
[0008] In the implementation method, the historical communication transmission parameters of the power system are processed to obtain formatted communication transmission characteristics, including: extracting multiple data samples from the historical communication transmission parameters of the power system in units of single time points, with each time point corresponding to one data sample; extracting characteristic parameters from each of the data samples, including data packet transmission delay, network bit error rate, channel signal-to-noise ratio, protocol frame integrity and connection stability; organizing the characteristic parameters of each of the data samples into a feature vector to obtain multiple formatted communication transmission characteristics.
[0009] In an implementation, the multiple formatted communication transmission features are clustered to obtain multiple clusters, each of which has a corresponding feature cluster center, including: setting the number of clusters and the fuzzy index to obtain multiple initial clusters, the number of clusters being determined according to the number of typical transmission states of power system communication; initializing the membership of each of the formatted communication transmission features to each initial cluster cluster to obtain a membership set of each of the formatted communication transmission features; determining the feature cluster center of each cluster based on the membership set of each of the formatted communication transmission features, and updating the membership set of each of the formatted communication transmission features according to the distance between each of the formatted communication transmission features and each feature cluster center; repeating the feature cluster center determination and membership set update process until the change in the membership set between two adjacent iterations is less than a preset threshold, and outputting multiple clusters and corresponding feature cluster centers.
[0010] In the implementation method, for each of the clusters, multiple support vector machine classifiers are constructed, and each of the support vector machine classifiers is trained separately using each of the clusters to form multiple vulnerability detectors, including: extracting a first cluster from the multiple clusters, and determining a first communication transmission state corresponding to the first cluster; extracting K formatted communication transmission features in the first cluster, and labeling the K formatted communication transmission features with vulnerability types based on the first communication transmission state to obtain K vulnerability type labels; constructing a first support vector machine classifier for the first cluster, and training the first support vector machine classifier based on the K formatted communication transmission features and the K vulnerability type labels to obtain a first vulnerability detector; training vulnerability detectors for the other clusters in the same manner as training the first vulnerability detector for the first cluster to obtain multiple vulnerability detectors.
[0011] In the implementation method, the weight allocation unit is used to configure multiple weight coefficients for the communication transmission parameters to be detected, including: extracting the characteristic vector of the communication transmission parameters to be detected to obtain the communication transmission characteristics to be detected; calculating the distance between the communication transmission characteristics to be detected and each characteristic cluster center to obtain multiple characteristic distances to be detected; obtaining the membership of the communication transmission parameters to be detected to each cluster cluster based on the multiple characteristic distances to be detected to obtain multiple memberships to be detected; and obtaining multiple weight coefficients based on the sum of each membership to be detected and the multiple memberships to be detected.
[0012] In an implementation, before obtaining multiple weight coefficients based on each of the memberships to be detected and the sum of the multiple memberships to be detected, the method further includes: setting a membership threshold; eliminating the memberships to be detected that are less than the membership threshold among the multiple memberships to be detected, and retaining the memberships to be detected that are greater than or equal to the membership threshold to form multiple valid memberships to be detected; and determining multiple weight coefficients based on the multiple valid memberships to be detected.
[0013] This application proposes a power system vulnerability perception and classification detection method that combines support vector machines (SVMs) and fuzzy matrix (FCMs). The method includes: determining a target power system and retrieving an integrated vulnerability detector corresponding to the target power system. The integrated vulnerability detector includes a weight assignment unit and multiple vulnerability detectors, the weight assignment unit being constructed based on the FCM clustering algorithm, and each vulnerability detector being constructed based on support vector machines (SVMs); obtaining communication transmission parameters to be detected from the target power system, inputting the communication transmission parameters to be detected into the integrated vulnerability detector, and assigning multiple weight coefficients to the communication transmission parameters to be detected via the weight assignment unit; performing vulnerability perception on the communication transmission parameters to be detected by the multiple vulnerability detectors to obtain multiple vulnerability perception results; and fusing the multiple vulnerability perception results based on the multiple weight coefficients to determine the vulnerability type of the communication transmission parameters to be detected. This method addresses the technical problem of existing power system vulnerability perception methods that cannot efficiently, accurately, and timely identify different types of vulnerabilities in complex and dynamically changing communication environments. Through cluster analysis and a weight assignment mechanism, potential vulnerabilities in power system communications can be efficiently and accurately identified, and the weights of the detectors can be dynamically adjusted based on the communication transmission parameters, thereby improving the accuracy and reliability of vulnerability detection. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the accompanying drawings of the embodiments of the present disclosure are briefly introduced below. Flowcharts are used in this application to illustrate the operations performed by the systems according to the embodiments of the present application. It should be understood that the preceding or following operations are not necessarily performed in precise order. Instead, various steps may be processed in reverse order or simultaneously as needed. Furthermore, other operations may be added to these processes, or one or more operations may be removed from these processes.
[0015] Figure 1 A flow chart of a power system vulnerability perception and classification detection method combining SVM and FCM provided in an embodiment of the present application;
[0016] Figure 2 A flow chart of a vulnerability detector repository constructed by a power system vulnerability perception and classification detection method combining SVM and FCM provided in an embodiment of the present application. DETAILED DESCRIPTION
[0017] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below.
[0018] In order to make the purpose, technical solutions and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limiting this application. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0019] In the following description, reference is made to “some embodiments”, which describes a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict, and the terms “first\second” involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. The terms “including” and “having” and any variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or modules that are not clearly listed or that are inherent to these processes, methods, products, or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. The terms used herein are for the purpose of describing the embodiments of this application only.
[0020] The embodiment of the present application provides a power system vulnerability perception classification detection method combining SVM and FCM, such as Figure 1 As shown, the method includes:
[0021] S10: Determine the target power system and call the integrated vulnerability detector corresponding to the target power system, the integrated vulnerability detector includes a weight allocation unit and multiple vulnerability detectors, the weight allocation unit is constructed based on the FCM clustering algorithm, and each of the vulnerability detectors is constructed based on the SVM; obtain the communication transmission parameters to be detected of the target power system, input the communication transmission parameters to be detected into the integrated vulnerability detector, and configure multiple weight coefficients for the communication transmission parameters to be detected through the weight allocation unit.
[0022] Determine the target power system to be detected, the target power system is any power infrastructure with a communication network, such as a distribution system, substation, smart meter, etc. in the power grid. Subsequently, retrieve the integrated vulnerability detector corresponding to the target power system, the integrated vulnerability detector includes a weight allocation unit and multiple vulnerability detectors, the weight allocation unit is constructed based on the FCM clustering algorithm, and each of the vulnerability detectors is constructed based on SVM. Further, obtain the communication transmission parameters to be detected of the target power system, extract data such as data packet transmission delay, network bit error rate, channel signal-to-noise ratio, protocol frame integrity and connection stability from the transmission parameters, and process them to obtain formatted communication transmission characteristics. Input the formatted communication transmission characteristics into the integrated vulnerability detector, and configure multiple weight coefficients for the communication transmission parameters to be detected through the weight allocation unit. The weight coefficients correspond to multiple vulnerability detectors in the integrated vulnerability detector.
[0023] The method provided in the embodiment of the present application further includes: obtaining a system identifier of the target power system; and searching in a vulnerability detector repository using the system identifier as an index to obtain the integrated vulnerability detector.
[0024] Determining a target power system and retrieving an integrated vulnerability detector corresponding to the target power system includes obtaining a system identifier for the target power system, where the system identifier is a code or number used to identify the target power system in the power network. Subsequently, using the system identifier as an index into a vulnerability detector repository, a search is performed for an integrated vulnerability detector corresponding to the target power system, and the search results are retrieved to obtain the integrated vulnerability detector. The vulnerability detector repository is a database containing multiple integrated vulnerability detectors, each corresponding to a target power system.
[0025] like Figure 2 As shown, the method provided in the embodiment of the present application also includes: obtaining a first system identifier, collecting historical communication transmission parameters of the power system based on the first system identifier, and processing the historical communication transmission parameters of the power system to obtain multiple formatted communication transmission features; clustering the multiple formatted communication transmission features to obtain multiple cluster clusters, each cluster cluster has a corresponding feature cluster center, and each cluster cluster corresponds to a communication transmission state; for each cluster cluster, constructing multiple support vector machine classifiers, and using each cluster cluster to train each support vector machine classifier separately to form multiple vulnerability detectors; constructing the weight allocation unit according to the corresponding feature cluster center of each cluster cluster; integrating the weight allocation unit and multiple vulnerability detectors to obtain a first integrated vulnerability detector; and associating the first system identifier and the first integrated vulnerability detector and storing them in the vulnerability detector repository.
[0026] The steps of constructing the vulnerability detector repository include: obtaining a first system identifier, where the first system identifier is any one of the system identifiers in the vulnerability detector repository; collecting historical communication transmission parameters of the power system based on the first system identifier, that is, obtaining historical communication transmission parameters transmitted by the first system identifier during historical operation; processing the historical communication transmission parameters of the power system to obtain multiple formatted communication transmission features; and further, setting a clustering center and clustering the multiple formatted communication transmission features to obtain multiple clusters, each cluster corresponding to a communication transmission state.
[0027] Furthermore, for each cluster, multiple untrained support vector machine classifiers are constructed, with the number of support vector machine classifiers matching the number of clusters. Each support vector machine classifier is trained using each cluster to form multiple vulnerability detectors, each corresponding to a communication transmission state. A weight allocation unit is constructed based on the feature cluster centers corresponding to each cluster. Constructing the weight allocation unit includes obtaining the feature cluster centers corresponding to each cluster, forming a set of feature cluster centers, and using the set of feature cluster centers as a reference for the weight allocation unit. Furthermore, a membership calculation module is configured to calculate the distance between the communication transmission parameter to be detected and each feature cluster center, and obtain corresponding membership parameters based on the calculated multiple distances. Subsequently, a weight normalization module is configured to assign weights to the obtained membership values, where the weights are the proportions of each membership value to the total of all membership values, to obtain weight coefficients corresponding to each vulnerability detector. Finally, the membership calculation module and the weight normalization module are integrated to construct a complete weight allocation unit. The weight distribution unit and the plurality of vulnerability detectors are integrated to obtain a first integrated vulnerability detector. The first system identifier and the first integrated vulnerability detector are associated and stored in the vulnerability detector repository. Other integrated vulnerability detectors for the power system are constructed using the same construction method and associated and stored in the vulnerability detector repository.
[0028] The method provided in an embodiment of the present application also includes: extracting multiple data samples from the historical communication transmission parameters of the power system in units of single time points, with each time point corresponding to one data sample; extracting characteristic parameters from each of the data samples, including data packet transmission delay, network bit error rate, channel signal-to-noise ratio, protocol frame integrity and connection stability; organizing the characteristic parameters of each of the data samples into a feature vector to obtain multiple formatted communication transmission features.
[0029] The historical communication transmission parameters of the power system are processed to obtain formatted communication transmission characteristics, including: dividing the data of the acquired historical communication transmission parameters according to the time series, extracting multiple data samples from the historical communication transmission parameters of the power system in units of a single time point, and collecting them at fixed time intervals. Each time point represents a collection of communication data, and each time point corresponds to a data sample. Subsequently, characteristic parameters are extracted from each of the acquired data samples, and the characteristic parameters include data packet transmission delay, network bit error rate, channel signal-to-noise ratio, protocol frame integrity and connection stability. Further, the characteristic parameters of each of the data samples are organized into a feature vector, wherein the feature vector is a structured method, and the extracted feature parameters are arranged into a vector in order to facilitate subsequent calculation and analysis. Each data sample corresponds to a feature vector, and each feature parameter corresponds to an element in the vector.
[0030] The method provided in an embodiment of the present application also includes: setting the number of clusters and the fuzzy index to obtain multiple initial cluster clusters, wherein the number of clusters is determined according to the number of typical transmission states of power system communication; initializing the membership of each of the formatted communication transmission characteristics to each initial cluster cluster to obtain a membership set of each of the formatted communication transmission characteristics; determining the feature cluster center of each cluster cluster based on the membership set of each of the formatted communication transmission characteristics, and updating the membership set of each of the formatted communication transmission characteristics according to the distance between each of the formatted communication transmission characteristics and each feature cluster center; repeatedly executing the feature cluster center determination and membership set update process until the change in the membership set of two adjacent iterations is less than a preset threshold, and outputting multiple cluster clusters and corresponding feature cluster centers.
[0031] Clustering the multiple formatted communication transmission features to obtain multiple clusters, each having a corresponding feature cluster center, includes: setting a number of clusters and a fuzzy index to obtain multiple initial clusters, wherein the number of clusters is the number of clusters to be divided, and the number of clusters is determined based on the number of typical transmission states of power system communication, such as normal transmission state, high-load transmission state, interference transmission state, and maintenance transmission state. The fuzzy index is the degree of fuzziness of the clustering and can generally be set by professional technicians. A higher fuzzy index will smooth the clustering results, allowing data points to belong to multiple cluster centers with different memberships, thereby reducing the possibility that data points belong to a single cluster. When obtaining multiple initial clusters, the multiple formatted communication transmission features are clustered into multiple initial clusters using a fuzzy C-means (FCM) clustering algorithm based on the set number of clusters and fuzzy index. Further, after obtaining the multiple initial clusters, the membership of each formatted communication transmission feature with each cluster is calculated based on the membership of each cluster to obtain a membership set for each formatted communication transmission feature. The membership degree is the possibility that a data point belongs to a certain cluster, and the value range is [0, 1]. The larger the membership degree, the higher the similarity between the data point and the cluster.
[0032] Subsequently, the feature cluster center of each cluster is determined based on the membership set of each formatted communication transmission feature. The feature cluster center is the weighted average of all data points in the cluster, with the weight value being the membership of each data point. After obtaining the feature cluster center of each cluster, the distance between each formatted communication transmission feature and each feature cluster center is calculated based on the cluster center, and the membership set of each formatted communication transmission feature is updated. The closer the distance, the higher the corresponding membership. The feature cluster center determination and membership set update process are repeated using the same steps until the change in the membership set between two adjacent iterations is less than a preset threshold, and multiple clusters and corresponding feature cluster centers are output. The preset threshold is a pre-set membership set change threshold. When it is greater than this threshold, it indicates that the currently determined cluster center is inaccurate and requires further iterative adjustment. If the membership set change is less than the preset threshold, the current cluster center and cluster can be used as the final clustering result.
[0033] The method provided in an embodiment of the present application also includes: extracting a first cluster from the multiple clusters and determining a first communication transmission state corresponding to the first cluster; extracting K formatted communication transmission features in the first cluster, and labeling the K formatted communication transmission features with vulnerability types based on the first communication transmission state to obtain K vulnerability type labels; constructing a first support vector machine classifier for the first cluster, and training the first support vector machine classifier based on the K formatted communication transmission features and the K vulnerability type labels to obtain a first vulnerability detector; training vulnerability detectors for the other clusters in the same manner as training the first vulnerability detector for the first cluster to obtain multiple vulnerability detectors.
[0034] For each of the clusters, multiple support vector machine classifiers are constructed and trained using each of the clusters to form multiple vulnerability detectors. This includes randomly extracting a first cluster from the multiple clusters and determining a first communication transmission state corresponding to the first cluster. Subsequently, K formatted communication transmission features are extracted from the first cluster, where K is a positive integer greater than 1. Based on the first communication transmission state, each of the K formatted communication transmission features is labeled with a vulnerability type, such as a vulnerability identified under a normal transmission state: protocol attack, data tampering, illegal access, etc., thereby obtaining K vulnerability type labels. An untrained support vector machine (SVM) classifier is supervisedly trained based on the K formatted communication transmission features extracted from the first cluster and their corresponding vulnerability type labels, enabling it to determine vulnerability types from input features, thereby completing the construction of the first support vector machine classifier. Vulnerability detectors are trained for the other clusters in the same manner as the first vulnerability detector was trained for the first cluster, thereby obtaining multiple vulnerability detectors.
[0035] The method provided in an embodiment of the present application also includes: extracting the characteristic vector of the communication transmission parameter to be detected to obtain the communication transmission feature to be detected; calculating the distance between the communication transmission feature to be detected and the center of each feature cluster to obtain multiple feature distances to be detected; obtaining the membership of the communication transmission parameter to be detected to each cluster cluster based on the multiple feature distances to be detected to obtain multiple memberships to be detected; and obtaining multiple weight coefficients based on the sum of each membership to be detected and the multiple memberships to be detected.
[0036] The weight allocation unit is used to configure multiple weight coefficients for the communication transmission parameter to be detected, including: extracting the characteristic vector of the communication transmission parameter to be detected to obtain the communication transmission feature to be detected. The membership calculation module of the weight allocation unit is used to calculate the distance between the communication transmission feature to be detected and each feature cluster center to obtain multiple feature distances to be detected. Then, the FCM membership calculation method is used to obtain the membership of the communication transmission parameter to be detected to each cluster cluster based on the multiple feature distances to be detected, and multiple memberships to be detected are obtained. Finally, based on the sum of each membership to be detected and the multiple memberships to be detected, the ratio of each membership to be detected to the sum of the multiple memberships to be detected is obtained to obtain multiple weight coefficients.
[0037] The method provided in an embodiment of the present application also includes: setting a membership threshold; eliminating the memberships to be detected that are less than the membership threshold from multiple memberships to be detected, and retaining the memberships to be detected that are greater than or equal to the membership threshold, to form multiple valid memberships to be detected; and determining multiple weight coefficients based on the multiple valid memberships to be detected.
[0038] Before obtaining multiple weight coefficients based on each of the memberships to be detected and the sum of the multiple memberships to be detected, the method further includes: setting a membership threshold. When the membership threshold is greater than the membership threshold, the membership of the corresponding data is high; conversely, if the membership is too low, it can be determined that the data does not belong to the corresponding cluster. Among the multiple memberships to be detected, the memberships to be detected that are less than the membership threshold are eliminated, and the memberships to be detected that are greater than or equal to the membership threshold are retained to form multiple valid memberships to be detected. Finally, multiple weight coefficients are determined based on the multiple valid memberships to be detected. This prevents detectors with very small memberships from participating in the fusion, thereby improving the reliability of the detection results.
[0039] The method provided in an embodiment of the present application also includes: performing vulnerability sensing on the communication transmission parameters to be detected through the multiple vulnerability detectors to obtain multiple vulnerability sensing results; fusing the multiple vulnerability sensing results based on the multiple weight coefficients to determine the vulnerability type of the communication transmission parameters to be detected.
[0040] The multiple vulnerability detectors detect vulnerabilities in the formatted communication transmission characteristics of the communication transmission parameters to be detected, obtaining multiple vulnerability detection results output by the multiple vulnerability detectors. Finally, the multiple vulnerability detection results are fused based on the multiple weight coefficients to determine the vulnerability type of the communication transmission parameters to be detected. During the fusion process, the vulnerability type results output by each vulnerability detector are grouped and classified according to the same type. All weight coefficients belonging to the same vulnerability type are accumulated and summed to obtain a total weight value corresponding to each vulnerability type. A weight percentage parameter for each vulnerability type is further calculated, i.e., the total weight value of the type divided by the sum of the weight values of all vulnerability types. The vulnerability type with the largest weight percentage is selected as the vulnerability type of the communication transmission parameters to be detected. Exemplary detection results and weights output by the multiple detectors are as follows: protocol attack, weight 0.3, data tampering, weight 0.2, protocol attack, weight 0.4, and protocol attack, weight 0.1. The total weight value of the protocol attack is 0.8, and the total weight value of the data tampering is 0.2. The calculated weight percentage of the protocol attack is 80%, and the weight percentage of the data tampering is 20%. Therefore, the final output detection result is the protocol attack. Through fusion processing, the detection results of different detectors are integrated to obtain a more accurate vulnerability analysis result.
[0041] The technical solution provided by the embodiment of the present invention determines the target power system and calls the integrated vulnerability detector corresponding to the target power system. The communication transmission parameters to be detected of the target power system are obtained, the communication transmission parameters to be detected are input into the integrated vulnerability detector, and a plurality of weight coefficients are configured for the communication transmission parameters to be detected through a weight distribution unit. Vulnerabilities are sensed on the communication transmission parameters to be detected by multiple vulnerability detectors to obtain multiple vulnerability perception results. The multiple vulnerability perception results are fused based on the multiple weight coefficients to determine the vulnerability type of the communication transmission parameters to be detected. The technical problem that the power system vulnerability perception in the prior art cannot efficiently, accurately and timely identify different types of vulnerabilities in the face of a complex and dynamically changing communication environment is solved. By utilizing cluster analysis and weight distribution mechanism, potential vulnerabilities in power system communications can be efficiently and accurately identified, and the weight of the detector can be dynamically adjusted based on the communication transmission parameters, thereby improving the accuracy and reliability of vulnerability detection.
[0042] The above are merely preferred embodiments of the present invention and the technical principles employed. Those skilled in the art will appreciate that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments, and substitutions are possible for those skilled in the art without departing from the scope of the present invention. Therefore, while the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments and may include many other equivalent embodiments without departing from the scope of the present invention.
Claims
1. A power system vulnerability perception and classification detection method combining SVM and FCM is characterized by: The method comprises: Determine a target power system and retrieve an integrated vulnerability detector corresponding to the target power system, wherein the integrated vulnerability detector includes a weight allocation unit and multiple vulnerability detectors, wherein the weight allocation unit is constructed based on an FCM clustering algorithm, and each of the vulnerability detectors is constructed based on an SVM; Acquire the communication transmission parameters to be detected of the target power system, input the communication transmission parameters to be detected into the integrated vulnerability detector, and configure a plurality of weight coefficients for the communication transmission parameters to be detected by the weight allocation unit; Perform vulnerability sensing on the communication transmission parameters to be detected by the multiple vulnerability detectors to obtain multiple vulnerability sensing results; The multiple vulnerability perception results are fused based on the multiple weight coefficients to determine the vulnerability type of the communication transmission parameter to be detected.
2. The method according to claim 1, characterized in that Determine a target power system and retrieve an integrated vulnerability detector corresponding to the target power system, including: Obtaining a system identifier of the target power system; The system identifier is used as an index to search in a vulnerability detector repository to obtain the integrated vulnerability detector.
3. The method according to claim 2, characterized in that The steps for building the vulnerability detector repository include: Acquiring a first system identifier, collecting historical communication transmission parameters of the power system based on the first system identifier, and processing the historical communication transmission parameters of the power system to obtain a plurality of formatted communication transmission features; Clustering the plurality of formatted communication transmission features to obtain a plurality of clusters, each of the clusters having a corresponding feature cluster center, and each cluster corresponding to a communication transmission state; Constructing multiple support vector machine classifiers for each of the clusters, and using each of the clusters to train each of the support vector machine classifiers to form multiple vulnerability detectors; Constructing the weight allocation unit according to the feature cluster centers corresponding to each of the clusters; Integrating the weight distribution unit and a plurality of vulnerability detectors to obtain a first integrated vulnerability detector; The first system identifier and the first integrated vulnerability detector are associated and stored in the vulnerability detector repository.
4. The method according to claim 3, characterized in that Processing the historical communication transmission parameters of the power system to obtain formatted communication transmission characteristics includes: Extract multiple data samples from the historical communication transmission parameters of the power system at a single time point, with each time point corresponding to a data sample; Extracting characteristic parameters from each of the data samples, including data packet transmission delay, network bit error rate, channel signal-to-noise ratio, protocol frame integrity, and connection stability; The characteristic parameters of each of the data samples are organized into a characteristic vector to obtain a plurality of formatted communication transmission characteristics.
5. The method according to claim 3, characterized in that Clustering the plurality of formatted communication transmission features to obtain a plurality of clusters, each of the clusters having a corresponding feature cluster center, including: Setting the number of clusters and the fuzzy index to obtain a plurality of initial clusters, wherein the number of clusters is determined according to the number of typical transmission states of power system communication; Initializing the membership of each of the formatted communication transmission features to each initial cluster to obtain a membership set of each of the formatted communication transmission features; Determining a feature cluster center of each cluster based on the membership set of each formatted communication transmission feature, and updating the membership set of each formatted communication transmission feature according to the distance between each formatted communication transmission feature and each feature cluster center; The process of determining the feature cluster center and updating the membership set is repeated until the membership set change between two adjacent iterations is less than a preset threshold, and multiple clusters and corresponding feature cluster centers are output.
6. The method according to claim 3, characterized in that For each of the clusters, multiple support vector machine classifiers are constructed, and each of the support vector machine classifiers is trained using each of the clusters to form multiple vulnerability detectors, including: Extracting a first cluster from the plurality of clusters, and determining a first communication transmission state corresponding to the first cluster; Extracting K formatted communication transmission features from the first cluster, and labeling the K formatted communication transmission features with vulnerability types based on the first communication transmission state to obtain K vulnerability type labels; Constructing a first support vector machine classifier for the first cluster, and training the first support vector machine classifier based on the K formatted communication transmission features and the K vulnerability type labels to obtain a first vulnerability detector; According to the method of training the first vulnerability detector for the first cluster, vulnerability detectors are trained for the other clusters to obtain multiple vulnerability detectors.
7. The method according to claim 3, characterized in that Configuring a plurality of weight coefficients for the communication transmission parameter to be detected by the weight allocation unit includes: Extracting the characteristic vector of the communication transmission parameter to be detected to obtain the communication transmission feature to be detected; Calculating the distance between the communication transmission feature to be detected and each feature cluster center to obtain a plurality of feature distances to be detected; Obtaining the membership of the communication transmission parameter to be detected to each cluster according to a plurality of characteristic distances to be detected, to obtain a plurality of memberships to be detected; A plurality of weight coefficients are obtained according to the sum of each of the to-be-detected memberships and the plurality of to-be-detected memberships.
8. The method according to claim 7, characterized in that Before obtaining a plurality of weight coefficients according to each of the memberships to be detected and the sum of the plurality of memberships to be detected, the method further includes: Set membership threshold; Eliminating the memberships to be detected that are less than the membership threshold from the multiple memberships to be detected, and retaining the memberships to be detected that are greater than or equal to the membership threshold, to form multiple valid memberships to be detected; A plurality of weight coefficients are determined according to the plurality of valid memberships to be detected.