Power network intrusion analysis method and system based on data fusion

Abstract

The invention provides a power network intrusion analysis method and system based on data fusion, and the method comprises the steps: obtaining a multi-source monitoring data set in a power network, carrying out the dynamic feature fusion processing of the multi-source monitoring data set, and generating a multi-dimensional fusion feature set related to a power equipment node, inputting the multi-dimensional fusion feature set into a preset abnormal behavior recognition model for intrusion analysis processing, generating an abnormal behavior data set of the power equipment nodes, and generating a network security defense strategy set according to the abnormal behavior data set, the network security defense strategy set comprises a real-time blocking instruction and a node state repairing instruction for different abnormal behavior types, feeding back the network security defense strategy set to the power network control center to trigger defense response operation, and adjusting a collection strategy of the multi-source monitoring data set according to an execution result of the defense response operation. According to the invention, the system resource consumption is reduced while the intrusion detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a power network intrusion analysis method and system based on data fusion. Background Art

[0002] With the increasing intelligence of power systems, power network intrusion analysis technology has become a core component of energy security. Traditional power security monitoring technologies primarily employ a standalone monitoring model. Sensors deployed at power equipment nodes collect operational parameters such as voltage fluctuations and current harmonics, using threshold comparison to identify equipment overloads or line faults. Network traffic monitoring devices capture network behavior data such as communication protocol types and port access records, and use rule-based matching to detect common network attacks. However, these isolated analysis methods struggle to identify new, complex attack vectors. Attackers tamper with communication protocols to trigger abnormal device operating parameters or exploit device overloads to mask malicious port scanning. This results in a disconnected detection of the correlation between physical-layer anomalies and network-layer attacks. Existing response strategies for detection results are limited to single actions like blocking network connections or restarting devices. These strategies are unable to simultaneously eliminate threats at multiple nodes along the attack chain and lack mechanisms to repair the damaged device's operational status. This results in a long recovery period and high secondary risk. In addition, the fixed-frequency device data collection and network traffic packet capture mode are difficult to dynamically adapt to the feature extraction requirements in complex attack scenarios, resulting in an analysis dilemma where key attack features are missed and redundant data coexists. Summary of the Invention

[0003] The present invention provides a data fusion-based power network intrusion analysis method and system.

[0004] In a first aspect, an embodiment of the present invention provides a power network intrusion analysis method based on data fusion, comprising the following steps:

[0005] Acquire a multi-source monitoring data set in the power network, wherein the multi-source monitoring data set includes node operation data streams and network communication data streams of multiple power equipment nodes;

[0006] Performing dynamic feature fusion processing on the multi-source monitoring data set to generate a multi-dimensional fusion feature set associated with the power equipment node;

[0007] Inputting the multi-dimensional fusion feature set into a preset abnormal behavior recognition model for intrusion analysis and processing to generate an abnormal behavior data set of the power equipment node;

[0008] generating a network security defense strategy set based on the abnormal behavior data set, wherein the network security defense strategy set includes real-time blocking instructions and node status repair instructions for different abnormal behavior types;

[0009] The network security defense strategy set is fed back to the power network control center to trigger a defense response operation, and the collection strategy of the multi-source monitoring data set is adjusted according to the execution result of the defense response operation.

[0010] In a second aspect, an embodiment of the present invention provides a computer system, including:

[0011] a memory storing a computer program;

[0012] A processor is used to load the computer program to implement the power network intrusion analysis method based on data fusion as described above.

[0013] The data fusion-based power network intrusion analysis method provided by the present invention obtains a deep fusion monitoring data set of the operation data stream of the power equipment node and the network communication data stream, and performs dynamic feature fusion processing on the physical layer status characteristics of the equipment and the network protocol layer behavior characteristics, thereby generating a multi-dimensional fusion feature set that can characterize the coupling relationship between the abnormal operation of the equipment and the network attack behavior. When performing intrusion analysis based on the abnormal behavior recognition model, it is not only possible to identify the physical attack characteristics of the equipment operation layer such as voltage fluctuation and power anomaly, but also to synchronously capture the network attack behavior characteristics such as port scanning and protocol tampering. The precise detection of complex attack modes is achieved through the spatiotemporal correlation analysis of the equipment operation status and network communication behavior. The dynamic generation mechanism of the defense strategy set is adopted. On the basis of tracing the attack path and locating the key blocking points, the coordinated execution of the real-time blocking instructions and the node status repair instructions is combined to effectively solve the defect of the traditional defense strategy that only blocks the attack but ignores the recovery of the damaged equipment status, and simultaneously achieves the rapid reconstruction of attack behavior suppression and system operation security. By dynamically optimizing and adjusting the multi-source monitoring data collection strategy, and adaptively matching the collection granularity of device operating parameters and network communication characteristics according to the defense response effect, we can overcome the contradiction between incomplete feature coverage and data redundancy in the fixed monitoring mode, thereby improving the accuracy of intrusion detection while reducing system resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a flow chart of a power network intrusion analysis method based on data fusion provided by an embodiment of the present invention.

[0015] Figure 2 It is a schematic diagram of the composition of a computer system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0017] See also Figure 1 , Figure 1 A flowchart of a power network intrusion analysis method based on data fusion provided by an embodiment of the present invention, which can be executed by a computer system, includes the following steps:

[0018] Step S100: Acquire a multi-source monitoring data set in a power network, where the multi-source monitoring data set includes node operation data flows and network communication data flows of multiple power equipment nodes.

[0019] A multi-source monitoring data set refers to a data set obtained from multiple different sources and containing various types of information. In the power grid scenario, it is primarily composed of node operation data streams and network communication data streams. Node operation data streams describe the operating status of power equipment nodes themselves, covering various physical quantities and status information during the equipment's operation, reflecting the real-time working status of the power equipment. Network communication data streams are data generated when equipment nodes communicate with each other in the power grid. They include information on communication protocols, packet transmission, and other aspects, reflecting the information exchange between devices.

[0020] A variety of data acquisition devices and technologies can be used to collect multi-source monitoring data from power networks. For node operation data streams, sensors can be used to collect relevant equipment operational data. For example, voltage sensors can be used to monitor equipment voltage in real time, current transformers can be used to obtain current data, and power sensors can be used to measure equipment power. These sensors can be installed at key locations on power equipment, continuously collecting data at a preset sampling frequency, converting the collected analog signals into digital signals, and transmitting them via data transmission lines to a data storage and processing center. For network communication data streams, network traffic monitoring devices can be used to capture and record them. For example, network probes or intrusion detection systems (IDS) can be deployed at key nodes or communication links in the power network to monitor and analyze network data packets. These devices can capture the data link layer frame structure and the network layer packet structure, extracting information such as the source port number, destination port number, and protocol type identifier, and organizing this information into a network communication data stream for storage and subsequent processing.

[0021] Step S200: performing dynamic feature fusion processing on a multi-source monitoring data set to generate a multi-dimensional fusion feature set associated with a power equipment node.

[0022] Dynamic feature fusion processing comprehensively considers the time-varying characteristics of different types of data in a multi-source monitoring data set and organically combines these features. This processing method fully accounts for the dynamic nature of the data and can more accurately reflect the operating status and communication behavior of power equipment nodes at different times. A multi-dimensional fusion feature set is a set of features that includes multiple dimensions. Each dimension describes the operating status and network communication behavior of power equipment nodes from different perspectives. By fusing these features, a more comprehensive and in-depth understanding of the working conditions of power equipment nodes can be achieved.

[0023] As an embodiment, step S200 performs dynamic feature fusion processing on a multi-source monitoring data set to generate a multi-dimensional fusion feature set associated with a power equipment node, which may specifically include the following steps S210 to S240:

[0024] Step S210: performing data preprocessing on the node operation data stream to obtain a standardized node operation data set, which includes device voltage fluctuation characteristics, current phase shift characteristics, and power abnormal fluctuation characteristics.

[0025] Data preprocessing is the process of cleaning, transforming, and extracting features from raw data to improve data quality and usability. When processing node operation data streams, raw data may contain interference such as noise and outliers, so data preprocessing is necessary to remove these interferences and extract valuable features. A standardized node operation dataset is a preprocessed dataset with a unified format and specifications. It contains device voltage fluctuation characteristics, current phase shift characteristics, and abnormal power fluctuation characteristics, which can more accurately reflect the operating status of power equipment nodes.

[0026] The device voltage fluctuation characteristic describes the fluctuations in node voltage at power equipment during operation and reflects the stability of the equipment voltage. The current phase offset characteristic reflects the degree of current phase deviation relative to normal conditions, which may be related to factors such as the equipment's load characteristics and circuit faults. The abnormal power fluctuation characteristic indicates abnormal changes in equipment power during operation, which may indicate a device failure or external attack.

[0027] As an implementation method, step S210 performs data preprocessing on the node operation data stream to obtain a standardized node operation data set, which may specifically include the following steps S211 to S216:

[0028] Step S211: performing noise filtering processing on the original node operation data stream, removing electromagnetic interference signals and sensor acquisition abnormal values, and generating a preliminary purified data stream.

[0029] Raw node operation data streams are unprocessed data collected directly from power equipment nodes. They may contain noise information such as electromagnetic interference signals and sensor anomalies. Electromagnetic interference signals are caused by the complex electromagnetic environment of the power grid. Interference signals generated by surrounding electrical equipment and transmission lines may affect data accuracy. Sensor anomalies refer to data collected during the data collection process that is inconsistent with actual conditions due to sensor failures, external interference, and other reasons.

[0030] Noise filtering can be achieved using a variety of filtering algorithms. For example, a mean filter algorithm is used to run each data point in the data stream on the original node, calculate the average of its adjacent data points, and use this average as the filtering result for that data point. Specifically, for a time series data set {x1, x2, ..., xN} of length N, a window size M (M is an odd number) is selected. For each data point xi (i = (M+1) / 2, ..., N-(M-1) / 2), its filtered value yi is calculated as the average of the M data points within the window, that is, yi = (xi-(M-1) / 2+xi-(M-1) / 2+1+...+xi+(M-1) / 2) / M. In this way, data can be effectively smoothed and noise interference removed.

[0031] Step S212: performing time series segmentation processing on the preliminary cleansed data stream to generate a set of device operating status snapshots within equally spaced time windows.

[0032] Time series segmentation involves dividing continuous time series data into multiple equally spaced time windows at preset intervals. The data within each time window constitutes a device operating status snapshot. A device operating status snapshot is a set of data reflecting the operating status of a power equipment node within a preset time window, including various operating parameters of the equipment within that time window.

[0033] When performing time series segmentation processing, you can select an appropriate time window size based on actual needs. For example, choose a time window size of 1 minute and divide the preliminary cleansed data stream into minute segments. For each time window, extract device operating data such as voltage, current, and power to form a device operating status snapshot. This method can convert continuous time series data into a discrete set of device operating status snapshots, facilitating subsequent analysis and processing.

[0034] Step S213: Extract the effective voltage value, fundamental current component, and power factor characteristic parameters within each time window to generate the original operating characteristic parameter set.

[0035] The effective voltage value refers to the root mean square value of the AC voltage within one cycle, which can reflect the actual power - doing ability of the voltage. The fundamental current component refers to the component of the AC current whose frequency is the same as the power supply frequency and is the main component of the current. The power factor is an important indicator to measure the efficiency of electrical equipment in using electrical energy, which represents the ratio of the active power consumed by the equipment to the apparent power.

[0036] To extract the effective voltage value, fundamental current component, and power factor characteristic parameters within each time window, corresponding calculation methods can be adopted. For the effective voltage value, it can be calculated by squaring the voltage data within the time window, taking the average value, and then taking the square root. For the fundamental current component, the Fourier transform method can be used to transform the current data within the time window into the frequency domain and extract the component with the same frequency as the power supply frequency. The power factor can be obtained by calculating the ratio of the active power to the apparent power within the time window. The active power can be calculated by the voltage, current, and the cosine value of the power factor angle, and the apparent power is the product of the effective voltage value and the effective current value. Combining the effective voltage value, fundamental current component, and power factor characteristic parameters extracted within each time window can generate the original operating characteristic parameter set.

[0037] Step S214: Dynamically compare the effective voltage value in the original operating characteristic parameter set with the preset voltage safety range to generate the device voltage fluctuation characteristics in the standardized node operating dataset.

[0038] The preset voltage safety range is the pre - set allowable voltage fluctuation range based on the design requirements and operating standards of the power system. The dynamic comparison process is to compare the effective voltage value in the original operating characteristic parameter set with the preset voltage safety range in real - time, analyze whether the effective voltage value is within the safety range and the degree of deviation from the safety range.

[0039] When performing the dynamic comparison process, first determine the preset voltage safety range. For example, the voltage safety range is [Umin, Umax]. Then, for each effective voltage value Ui in the original operating characteristic parameter set, determine whether it is within the safety range. If Ui is within [Umin, Umax], the voltage is considered normal; if Ui < Umin or Ui > Umax, the voltage is considered to have fluctuated. The degree of voltage fluctuation can be quantified by calculating the difference between the effective voltage value and the boundary value of the safety range, and these quantification results are used as the device voltage fluctuation characteristics and stored in the standardized node operating dataset.

[0040] Step S215: performing harmonic component decomposition processing on the current fundamental component, extracting the proportion of each harmonic content to generate the current phase offset feature in the standardized node operation data set.

[0041] Harmonic decomposition is the process of breaking down the fundamental current component into harmonic components of varying frequencies. In power systems, the presence of nonlinear loads can cause current to contain harmonic components, which can cause phase shifts in the current. The harmonic content percentage refers to the proportion of harmonic components of varying frequencies in the total current.

[0042] The harmonic decomposition of the fundamental current component can be performed using the Fourier series expansion method. The fundamental current component is represented as a superposition of a series of sine waves and cosine waves of different frequencies. By calculating the amplitude and phase of each harmonic component, the proportion of each harmonic content is obtained. Specifically, for a periodic current signal i(t), it can be expanded into a Fourier series: i(t) = a0 + ∑(an*cos(nωt) + bn*sin(nωt)), where a0 is the DC component, an and bn are the coefficients of each harmonic, ω is the fundamental angular frequency, and n is the harmonic number. By calculating the coefficients of each harmonic, the amplitude and phase of each harmonic can be obtained, and then the proportion of each harmonic content can be calculated. These proportions of each harmonic content are stored in the standardized node operation data set as current phase offset features.

[0043] Step S216: Based on the correlation analysis of the power factor characteristic parameters and the equipment load rate data, the power abnormal fluctuation characteristics in the standardized node operation data set are generated.

[0044] Equipment load factor data refers to the ratio of the actual load of power equipment to the rated load, reflecting the equipment's load condition. Correlation analysis studies the relationship between power factor characteristic parameters and equipment load factor data, analyzing how the power factor changes at different load factors to determine whether there are any abnormal power fluctuations.

[0045] When performing correlation analysis, you can first establish a relationship model between the power factor and the equipment load rate. For example, by collecting a large amount of historical data and using regression analysis methods, a linear regression model between the power factor and the equipment load rate is established: PF = a*LR + b, where PF is the power factor, LR is the equipment load rate, and a and b are regression coefficients. Then, for the current power factor characteristic parameters and equipment load rate data, the equipment load rate is substituted into the regression model to calculate the expected power factor. The expected power factor is compared with the actual power factor. If the difference between the two exceeds the preset threshold, it is considered that the power has fluctuated abnormally. The quantified results of these abnormal power fluctuations are used as abnormal power fluctuation features and stored in the standardized node operation data set.

[0046] Step S220: performing protocol parsing processing on the network communication data stream to extract a communication protocol feature field set, wherein the communication protocol feature field set includes a data packet transmission interval feature, a protocol type identification feature, and a port access frequency feature.

[0047] Protocol parsing is the process of analyzing data packets in a network communication data stream, identifying the communication protocol, and extracting key information from the protocol. The communication protocol feature field set is a set of fields containing key features of the network communication protocol. These features can reflect the status and behavior of network communications.

[0048] The packet transmission interval feature refers to the time interval between adjacent packets, reflecting the timeliness and stability of packet transmission. The protocol type identification feature is used to identify the protocol type used in network communications and determine whether unauthorized protocols are being used. The port access frequency feature refers to the number of access requests to a port per unit time, reflecting the frequency of port usage and activity.

[0049] As an implementation manner, step S220, performing protocol parsing processing on the network communication data stream to extract a communication protocol feature field set, may specifically include the following steps S221 to S226:

[0050] Step S221: Capture the data link layer frame structure and network layer data packet structure in the electric power communication network, and generate an original communication data packet set.

[0051] The data link layer frame structure refers to the format of data units transmitted at the data link layer, including data link layer control information and upper-layer data. The network layer packet structure refers to the format of data units transmitted at the network layer, including network layer address information and upper-layer data. The original communication packet set is a collection of captured data link layer frame structures and network layer packet structures.

[0052] To capture the data link layer frame structure and network layer packet structure in the power communication network, you can use a network packet capture tool, such as Wireshark. Deploy the network packet capture tool at key nodes or communication links in the power communication network to monitor packet transmissions. As packets pass through, the network packet capture tool captures them and stores them as a collection of raw communication packets.

[0053] Step S222: Parse the transport layer protocol header information in the original communication data packet set, extract the source port number, destination port number and protocol type identifier, and generate a basic protocol feature set.

[0054] The transport layer protocol header refers to the header portion of a transport layer protocol packet. It contains key information such as the source port number, destination port number, and protocol type identifier. The source port number is the port number used by the sending application, the destination port number is the port number used by the receiving application, and the protocol type identifier identifies the protocol type used by the transport layer, such as TCP or UDP.

[0055] Parsing the transport layer protocol header information within the original communication data packet set can be performed according to the format specifications of different transport layer protocols. For example, the TCP protocol header information consists of a fixed length of 20 bytes, with the source and destination port numbers each occupying 2 bytes. The protocol type identifier can be determined by the protocol field in the IP header. By parsing these fields, the source port number, destination port number, and protocol type identifier can be extracted. This information can be combined to generate a basic protocol feature set.

[0056] Step S223: Counting the access request frequency of the target port number within a unit time, and generating a port access frequency feature in the communication protocol feature field set.

[0057] The frequency of access requests to a target port number per unit time is the number of access requests to a specific port number within a preset time interval. By counting the frequency of access requests to a target port number per unit time, you can understand port usage and activity.

[0058] To count the frequency of access requests to a target port number within a unit of time, a counting method can be used. A time window is set, such as one minute, and access requests to each target port number are counted within this time window. At the end of the time window, the number of access requests for each target port number is recorded and stored as a port access frequency feature in the communication protocol feature field set.

[0059] Step S224: Analyze the timing characteristics of the application layer protocol handshake messages in the original communication data packet set, calculate the time interval between the arrival of adjacent data packets to generate the data packet transmission interval characteristics in the communication protocol feature field set.

[0060] The timing characteristics of application layer protocol handshake messages refer to the order and time interval between sending and receiving handshake messages during the connection establishment process. The inter-arrival time interval of adjacent data packets refers to the time difference between the arrival of two adjacent data packets, reflecting the timeliness and stability of data packet transmission.

[0061] To analyze the timing characteristics of the application layer protocol handshake messages in the original communication data packet set, we can parse the application layer protocol handshake messages and record the send and receive time of each message. We then calculate the time interval between the arrival of two adjacent data packets. For example, in the HTTP protocol handshake process, we record the time it takes for the client to send a request message and the server to return a response message, and calculate the time interval between them. These adjacent data packet arrival time intervals are used as data packet transmission interval features and stored in the communication protocol feature field set.

[0062] Step S225: Identify the non-standard protocol field format in the network layer data packet structure, detect protocol field length anomalies and check code error events to generate an abnormal protocol handshake behavior identifier in the communication protocol feature field set.

[0063] A non-standard protocol field format refers to a field format within the network layer packet structure that does not conform to standard protocol specifications. A protocol field length anomaly refers to a protocol field length that does not conform to the length range specified by the standard protocol. A checksum error event refers to a situation where the calculated checksum value in a protocol packet is inconsistent with the actual value. The abnormal protocol handshake behavior indicator is used to identify abnormal protocol handshake behavior during network communications.

[0064] Identifying non-standard protocol field formats in the network layer data packet structure can be done by comparing them with standard protocol specifications. For example, for the IP protocol, its header length field should be within a set range. If it is detected that the header length field exceeds this range, it is considered that a non-standard protocol field format exists. Detecting protocol field length anomalies and checksum error events can be calculated and compared according to the provisions in the protocol specification. For example, for the TCP protocol, its header contains a checksum field. By recalculating the checksum and comparing it with the checksum in the data packet, if the two are inconsistent, it is considered that a checksum error event exists. These abnormal situations are used as abnormal protocol handshake behavior identifiers and stored in the communication protocol feature field set.

[0065] Step S226: establishing a compliance mapping relationship between the protocol type and the standard power communication protocol, marking the communication session using the unauthorized protocol type to generate a protocol type identification feature in the communication protocol feature field set.

[0066] Standard power communication protocols are defined in the power industry as communication protocols that meet safety and regulatory requirements. Compliance mapping associates protocol types with standard power communication protocols to determine whether they comply with the standards. Unauthorized protocol types are those that do not comply with standard power communication protocol requirements.

[0067] To establish a compliance mapping relationship between protocol types and standard power communication protocols, a protocol type database can be established to store the types and related information of standard power communication protocols in the database. For each protocol type in the network communication data stream, a search and comparison is performed in the database. If the protocol type is not in the database, it is considered an unauthorized protocol type. To mark communication sessions using unauthorized protocol types, an identification bit can be set in the communication protocol feature field set, and the identification bit of communication sessions using unauthorized protocol types can be set to a specific value. This identification information is stored as a protocol type identification feature in the communication protocol feature field set.

[0068] Step S230: performing time window alignment processing on the standardized node operation data set and the communication protocol feature field set to determine the associated mapping relationship between the operation status characteristics and communication behavior characteristics of the power equipment node in the same timing window.

[0069] Time window alignment involves matching and aligning standardized node operation datasets and communication protocol feature field sets within the same time window, enabling alignment between the operational status characteristics and communication behavior characteristics within the same time window. Association mapping describes the relationship between the operational status characteristics and communication behavior characteristics of power equipment nodes within the same timing window, reflecting the mutual influence between the equipment's operational status and network communication behavior.

[0070] As an embodiment, step S230 performs time window alignment processing on the standardized node operation data set and the communication protocol feature field set to determine the associated mapping relationship between the operation status characteristics and the communication behavior characteristics of the power equipment node within the same timing window. Specifically, the following steps S231 to S237 may be included:

[0071] Step S231: extracting a device data timestamp sequence according to the time window identifier in the device operation status snapshot set, and extracting a communication data timestamp sequence from the communication protocol feature field set.

[0072] The time window identifier in a device operating status snapshot set identifies the time window to which each device operating status snapshot belongs. The device data timestamp sequence is a sequence consisting of the timestamps corresponding to each snapshot in the device operating status snapshot set. The communication data timestamp sequence is a sequence consisting of the timestamps corresponding to each communication data item in the communication protocol feature field set.

[0073] To extract a device data timestamp sequence based on the time window identifiers in the device operating status snapshot set, the device operating status snapshot set can be traversed, each snapshot's time window identifier converted into a corresponding timestamp, and these timestamps are arranged in sequence to form a device data timestamp sequence. To extract a communication data timestamp sequence from the communication protocol feature field set, the communication protocol feature field set can be similarly traversed to extract the timestamps of each communication data to form a communication data timestamp sequence.

[0074] Step S232: performing time overlap interval matching processing on the device data timestamp sequence and the communication data timestamp sequence to generate a timestamp matching result of the device operation status snapshot and the communication protocol feature field containing the same time window identifier.

[0075] Time-overlap interval matching compares the device data timestamp sequence with the communication data timestamp sequence, identifies any overlapping intervals between the two sequences, and then matches the device operating status snapshots and communication protocol signature fields within these overlapping intervals. The timestamp matching result is a combination of the device operating status snapshots and communication protocol signature fields that contain the same time window identifier.

[0076] When matching overlapping time intervals, a dual-pointer approach can be used. Two pointers are set to point to the start of the device data timestamp sequence and the communication data timestamp sequence, respectively. The timestamps pointed to by the two pointers are compared. If the two timestamps fall within the same time window, the corresponding device operating status snapshot and communication protocol feature fields are matched and recorded. The pointers are then moved again, continuing the comparison until both sequences are exhausted. The matching results are stored as timestamp matching results.

[0077] Step S233: establishing a first event association index between the device voltage fluctuation feature and the data packet transmission interval feature in the timestamp matching result, and generating an association pair set of the voltage fluctuation event and the communication delay event.

[0078] The first event correlation index is used to establish a correlation between device voltage fluctuation characteristics and data packet transmission interval characteristics. A voltage fluctuation event refers to a fluctuation in device voltage, while a communication delay event refers to an excessively long data packet transmission interval. The correlation pair set is a set of correlation pairs consisting of voltage fluctuation events and communication delay events.

[0079] A first event association index is established between the device voltage fluctuation characteristics and the packet transmission interval characteristics in the timestamp matching results. The timestamp matching results are then traversed. For each matching device operating status snapshot and communication protocol characteristic field, the device voltage fluctuation characteristics are determined to exceed a set threshold. If so, a voltage fluctuation event is considered to have occurred. Simultaneously, the packet transmission interval characteristics are determined to exceed a set threshold. If so, a communication delay event is considered to have occurred. The combination of the voltage fluctuation event and the communication delay event is stored as an association pair in the association pair set.

[0080] Step S234: performing spatial distribution matching processing on the current phase offset characteristics and the port access frequency characteristics, analyzing the network path topology relationship between the device node positions in the current abnormal area and the high-frequency port access nodes, and generating a set of spatial correlation parameters.

[0081] Spatial distribution matching is the process of spatially matching and analyzing current phase offset characteristics and port access frequency characteristics. An abnormal current region is defined as an area where the current phase offset characteristic exceeds a set threshold. A high-frequency port access node is a node whose port access frequency characteristic exceeds a set threshold. Network path topology refers to the connection relationships and path information between nodes in the power network. The spatial association parameter set is a set of parameters that describes the network path topology relationship between the device node locations in the abnormal current region and the high-frequency port access nodes.

[0082] By performing spatial distribution matching on the current phase offset characteristics and port access frequency characteristics, we can first determine the location of device nodes in the current anomaly area based on the current phase offset characteristics, and the location of high-frequency port access nodes based on the port access frequency characteristics. Then, using the power network topology information, we analyze the network path topology between these nodes. For example, we can calculate the shortest path length between two nodes and the number of nodes passed through. These analysis results are stored as spatial correlation parameters in a spatial correlation parameter set.

[0083] Step S235: Based on the synchronization analysis and processing of the abnormal power fluctuation characteristics and the protocol type identification characteristics, the distribution density parameters of the illegal protocol usage behavior during the power mutation period are calculated to generate a protocol violation density sequence.

[0084] Synchronicity analysis is the process of studying the temporal synchronization between abnormal power fluctuation characteristics and protocol type identification features. A power mutation period is a time period in which abnormal power fluctuation characteristics exceed a set threshold. Illegal protocol usage refers to communication using unauthorized protocol types. The distribution density parameter describes the distribution of illegal protocol usage within a power mutation period. A protocol violation density sequence is a sequence of protocol violation density parameters within different power mutation periods.

[0085] Based on the synchronization analysis of abnormal power fluctuation characteristics and protocol type identification features, we first determine the power mutation period based on the abnormal power fluctuation characteristics. Then, we count the number and distribution of illegal protocol usage behaviors within these periods. The power mutation period can be divided into several small time windows. The ratio of the number of illegal protocol usage behaviors in each time window to the window length is calculated as the protocol violation density parameter within that time window. These protocol violation density parameters are arranged in chronological order to generate a protocol violation density sequence.

[0086] Step S236: performing multi-dimensional fusion processing on the association pair set, the spatial association parameter set, and the protocol violation density sequence to construct a multi-dimensional association feature vector reflecting the spatiotemporal correlation between the device operation status characteristics and the communication behavior characteristics.

[0087] Multidimensional fusion processing is the process of integrating and fusing sets of association pairs, sets of spatial correlation parameters, and protocol violation density sequences from multiple dimensions. A multidimensional correlation feature vector, a vector containing information from multiple dimensions, comprehensively and accurately reflects the spatiotemporal correlation between device operating status characteristics and communication behavior characteristics.

[0088] A feature splicing method can be used to perform multi-dimensional fusion processing on the association pair set, spatial association parameter set, and protocol violation density sequence. Each element in the association pair set, spatial association parameter set, and protocol violation density sequence is treated as a dimension, and these dimensions are spliced ​​together in a set order to form a multidimensional vector. For example, the number of association pairs in the association pair set is used as a dimension, the shortest path length in the spatial association parameter set is used as a dimension, and the protocol violation density parameter within a certain time window in the protocol violation density sequence is used as a dimension. In this way, a multidimensional correlation feature vector is constructed that reflects the spatiotemporal correlation between the device operating status characteristics and the communication behavior characteristics.

[0089] Step S237: Generate an association mapping relationship between the operating status feature and the communication behavior feature according to the weight distribution of each dimension in the multi-dimensional association feature vector. The association mapping relationship is used to describe the spatiotemporal coupling strength between the device abnormality indicator and the protocol violation behavior.

[0090] The weight distribution of each dimension refers to the weight value corresponding to each dimension in the multidimensional correlation feature vector. These weight values ​​reflect the importance of each dimension in describing the correlation between device operating status characteristics and communication behavior characteristics. The correlation mapping relationship is a mathematical model that describes the correlation between device operating status characteristics and communication behavior characteristics. It describes the spatiotemporal coupling strength between device anomaly indicators and protocol violations through the weighted combination of each dimension in the multidimensional correlation feature vector.

[0091] Based on the weight distribution of each dimension in the multidimensional correlation feature vector, a linear weighting approach can be used to generate a correlation mapping between operating status features and communication behavior features. First, the weight values ​​for each dimension are determined, which can be determined through expert experience, machine learning algorithms, or other methods. Then, each dimension value in the multidimensional correlation feature vector is multiplied by its corresponding weight value. These weighted dimension values ​​are then summed to obtain a comprehensive correlation strength value. This correlation strength value is then correlated with device anomaly indicators and protocol violations to form a correlation mapping relationship. For example, a linear regression model can be established: R = w1*x1+w2*x2+...+wn*xn, where R is the correlation strength value, wi is the weight value of the i-th dimension, and xi is the eigenvalue of the i-th dimension. Using this model, the spatiotemporal coupling strength between device anomaly indicators and protocol violations can be calculated based on the multidimensional correlation feature vector.

[0092] Step S240: Based on the association mapping relationship, feature dimension matching processing is performed on the device voltage fluctuation characteristics, current phase offset characteristics, power abnormal fluctuation characteristics, data packet transmission interval characteristics, protocol type identification characteristics, and port access frequency characteristics to generate a fused feature vector in the multi-dimensional fused feature set. Each feature dimension in the fused feature vector corresponds to a correlation strength parameter between the device operating status and network communication behavior of the power device node within a preset time window.

[0093] Feature dimension matching combines and matches device voltage fluctuation characteristics, current phase offset characteristics, abnormal power fluctuation characteristics, packet transmission interval characteristics, protocol type identification characteristics, and port access frequency characteristics based on correlation mapping relationships. This ensures that each feature dimension accurately reflects the correlation strength between the device operating status and network communication behavior of the power device node within a preset time window. The fused feature vector is a vector containing multiple feature dimensions, each of which represents a correlation strength parameter between the device operating status and network communication behavior.

[0094] As an implementation method, step S240 performs feature dimension matching processing on the device voltage fluctuation feature, current phase offset feature, power abnormal fluctuation feature, data packet transmission interval feature, protocol type identification feature, and port access frequency feature based on the association mapping relationship to generate a fused feature vector in the multi-dimensional fused feature set. Specifically, the following steps S241 to S247 may be included:

[0095] Step S241: converting the time series data of the equipment voltage fluctuation characteristics into a standardized fluctuation amplitude index.

[0096] Time series data on equipment voltage fluctuation characteristics refers to the data sequence of equipment voltage fluctuation characteristics over time. The standardized fluctuation amplitude index is an index obtained by standardizing the time series data on equipment voltage fluctuation characteristics. It can more accurately reflect the amplitude of equipment voltage fluctuation.

[0097] The normalization method can be used to convert the time series data of the device voltage fluctuation characteristics into a standardized fluctuation amplitude index. First, calculate the mean and standard deviation of the time series data of the device voltage fluctuation characteristics. Then, for each value in the time series data, subtract the mean and divide by the standard deviation to obtain the standardized value. Finally, these standardized values ​​are used as the standardized fluctuation amplitude index. For example, for the time series data {x1, x2, ..., xn} of the device voltage fluctuation characteristics, calculate its mean μ = (x1 + x2 + ... + xn) / n and standard deviation σ = sqrt(((x1-μ) 2 +(x2-μ) 2 +...+(xn-μ) 2 ) / n). For each value xi, calculate the normalized value yi = (xi - μ) / σ, and use these yi as the normalized fluctuation range index.

[0098] Step S242: Perform Fourier transform processing on the current phase shift characteristics to extract the main harmonic frequency components.

[0099] Fourier transform processing converts time-domain signals into frequency-domain signals. Through Fourier transform, the current phase shift characteristic can be converted from the time domain to the frequency domain, thereby extracting the primary harmonic frequency components. Primary harmonic frequency components are the harmonic frequency components with higher energy in the current phase shift characteristic, and they have a significant impact on the current phase shift.

[0100] The fast Fourier transform (FFT) algorithm can be used to perform Fourier transform processing on the current phase offset characteristics. First, the time series data of the current phase offset characteristics is used as input and converted into a frequency domain signal using the FFT algorithm. Then, the amplitude of each frequency component in the frequency domain signal is calculated, and the frequency component with the largest amplitude is identified as the primary harmonic frequency component. For example, given a current phase offset characteristic time series data of length N {x1, x2, ..., xN}, the FFT algorithm is used to convert it into a frequency domain signal {X1, X2, ..., XN}. The amplitude |Xi| of each frequency component is calculated, and the first K frequency components with the largest amplitude are selected as the primary harmonic frequency components.

[0101] Step S243: Mapping the abnormal power fluctuation characteristics into a discrete state transition probability matrix.

[0102] A discrete state transition probability matrix is ​​a matrix used to describe the probability of a system transitioning between different discrete states. Mapping abnormal power fluctuation characteristics into a discrete state transition probability matrix involves dividing the abnormal power fluctuation characteristics into several discrete states and calculating the probability of the system transitioning between these states.

[0103] First, based on the range of power fluctuation characteristics, the system is divided into several discrete states, such as low, medium, and high fluctuations. Then, the number of times the system transitions between different states in historical data is counted. Finally, the probability of each state transition is calculated, and these probabilities are combined into a discrete state transition probability matrix. For example, for a system containing three discrete states S1, S2, and S3, the number of transitions from state S1 to state S2 is n12, the number of transitions from state S1 to state S3 is n13, and so on. The transition probabilities P12 = n12 / (n12 + n13), P13 = n13 / (n12 + n13), and so on are calculated, and these probabilities are combined into a discrete state transition probability matrix.

[0104] Step S244: performing probability distribution fitting processing on the data packet transmission interval characteristics to generate transmission interval abnormality probability parameters.

[0105] Probability distribution fitting involves finding a suitable probability distribution model that closely matches the actual distribution of packet transmission interval characteristics. The transmission interval anomaly probability parameter is the probability of a packet transmission interval exceeding the normal range, calculated based on the fitted probability distribution model.

[0106] The probability distribution fitting process for the packet transmission interval characteristics can be performed using the maximum likelihood estimation method. First, select a suitable probability distribution model, such as normal distribution, exponential distribution, etc. Then, use the maximum likelihood estimation method to estimate the parameters of the probability distribution model based on the historical data of the packet transmission interval characteristics. Finally, based on the estimated parameters, calculate the probability that the packet transmission interval exceeds the normal range as the transmission interval abnormality probability parameter. For example, suppose the normal distribution model N(μ,σ 2 ), use the maximum likelihood estimation method to estimate the mean μ and standard deviation σ based on historical data. For a given normal range [a, b], calculate the probability P(X b), as the transmission interval anomaly probability parameter.

[0107] Step S245: Encode the protocol type identification feature into a multi-dimensional one-hot vector form.

[0108] A multidimensional one-hot vector is a method for encoding discrete variables into a vector form, where only one dimension has a value of 1 and the remaining dimensions have values ​​of 0. Encoding the protocol type identifier feature as a multidimensional one-hot vector converts different protocol type identifiers into corresponding multidimensional one-hot vectors to facilitate subsequent feature processing and analysis.

[0109] First, determine the set of all possible protocol type identifiers. Then, for each protocol type identifier, create a vector with a length equal to the set size of the protocol type identifier. Set the dimension corresponding to the protocol type identifier to 1 and all other dimensions to 0. For example, if the set of protocol type identifiers is {TCP, UDP, HTTP, FTP}, create a four-dimensional vector [1, 0, 0, 0] for the protocol type identifier TCP; create a four-dimensional vector [0, 1, 0, 0] for the protocol type identifier UDP, and so on. These multi-dimensional one-hot vectors are used as the encoding results of the protocol type identifier features.

[0110] Step S246: Use the attention mechanism to perform feature weight allocation processing on the standardized fluctuation amplitude index, the main harmonic frequency component, the discrete state transition probability matrix, the transmission interval abnormality probability parameter and the multi-dimensional one-hot vector.

[0111] Through the attention mechanism, different weights can be assigned to the standardized fluctuation amplitude index, main harmonic frequency components, discrete state transition probability matrix, transmission interval anomaly probability parameter and multi-dimensional one-hot vector, so that important features receive more attention in subsequent processing.

[0112] An attention mechanism is used to assign feature weights to these features. A neural network-based attention model can be employed. First, the standardized fluctuation amplitude index, the main harmonic frequency components, the discrete state transition probability matrix, the transmission interval anomaly probability parameter, and the multidimensional one-hot vector are fed into the attention model. The attention model learns the relationships between the input features and calculates an attention weight for each feature. Each feature is then multiplied by its corresponding attention weight to obtain a weighted feature. For example, for an input containing three features x1, x2, and x3, the attention model calculates attention weights w1, w2, and w3, respectively. The weighted features are then w1*x1, w2*x2, and w3*x3, respectively.

[0113] Step S247: Combine the weighted features of each dimension into a fused feature vector of unified dimension through a feature concatenation layer.

[0114] The feature concatenation layer combines multiple features of different dimensions into a single feature vector of uniform dimension. This concatenation layer combines the weighted normalized fluctuation amplitude index, primary harmonic frequency components, discrete state transition probability matrix, transmission interval anomaly probability parameter, and multi-dimensional one-hot vector into a single fused feature vector of uniform dimension.

[0115] In the feature concatenation layer, the weighted features of each dimension are arranged in a predetermined order and then concatenated to form a vector of uniform dimension. For example, suppose the weighted normalized fluctuation amplitude index is a one-dimensional vector, the main harmonic frequency component is a two-dimensional vector, the discrete state transition probability matrix is ​​a three-dimensional matrix, the transmission interval anomaly probability parameter is a one-dimensional vector, and the multidimensional one-hot vector is a four-dimensional vector. These features are concatenated in order to form a one-dimensional vector with a dimension of 1+2+3+1+4=11. This 11-dimensional vector is used as the fused feature vector.

[0116] Step S300: inputting the multi-dimensional fusion feature set into a preset abnormal behavior recognition model for intrusion analysis and processing to generate an abnormal behavior data set of the power equipment node.

[0117] The preset abnormal behavior recognition model is a pre-trained model used to identify abnormal behavior in power equipment nodes. Intrusion analysis processing is the process of analyzing a multi-dimensional fusion feature set to determine whether a power equipment node exhibits abnormal behavior. The abnormal behavior data set contains information related to abnormal behavior in power equipment nodes, such as the type, occurrence time, and severity of the abnormal behavior.

[0118] As an embodiment, step S300 inputs the multi-dimensional fusion feature set into a preset abnormal behavior recognition model for intrusion analysis and processing to generate an abnormal behavior data set of the power equipment node, which may specifically include the following steps S310 to S350:

[0119] Step S310: Construct a feature analysis layer and a behavior determination layer in the abnormal behavior recognition model. The feature analysis layer is used to extract device operation abnormality indicators in the fused feature vector, and the behavior determination layer is used to identify protocol violations in the network communication data flow.

[0120] The feature analysis layer is a crucial component of the abnormal behavior identification model. Its primary function is to analyze the fused feature vectors and extract indicators that reflect abnormal equipment operation. These indicators represent parameters that indicate abnormal operating conditions of power equipment nodes, such as voltage exceeding limits, current harmonic distortion, and power surges. The behavior determination layer is responsible for identifying protocol violations within network communication data streams. These violations include illegal port scans, abnormal protocol handshakes, and frequency overshoots.

[0121] As an implementation method, step S310, constructing a feature analysis layer and a behavior determination layer in the abnormal behavior recognition model, may specifically include the following steps S311 to S315:

[0122] Step S311: deploying a bidirectional long short-term memory network unit in the feature analysis layer to capture the temporal dependencies of device operation features.

[0123] The Bi-LSTM unit is a neural network unit capable of processing sequence data. It simultaneously considers both past and future information in sequence data, thereby better capturing temporal dependencies within the data. Deploying the Bi-LSTM unit in the feature analysis layer allows processing of device operational features within the fused feature vector and extracting temporal dependency information.

[0124] A bidirectional long short-term memory network unit consists of two LSTM units: a forward LSTM unit and a backward LSTM unit. The forward LSTM unit processes data starting from the beginning of the sequence, while the backward LSTM unit processes data starting from the end. The outputs of the two LSTM units are merged to produce the final output. For example, for a fused feature vector sequence {x1, x2, ..., xT} of length T, the forward LSTM unit processes starting from x1 and sequentially calculates the hidden state h1f, h2f, ..., hTf for each time step. The backward LSTM unit processes starting from xT and sequentially calculates the hidden state h1b, h2b, ..., hTb for each time step. The forward and backward hidden states are then merged to produce the final hidden state ht = [htf; htb], where [;] represents a vector concatenation operation.

[0125] Step S312: Construct a convolutional neural network module in the behavior decision layer to extract the spatial local pattern of communication protocol features.

[0126] A convolutional neural network (CNN) module is a neural network module designed to process spatially structured data. It uses convolution operations to extract local spatial patterns in the data. Building a CNN module within the behavior determination layer can process the communication protocol features in the network communication data stream, extracting local spatial patterns, and thus better identifying protocol violations. A CNN module typically consists of convolutional layers, pooling layers, and fully connected layers. Convolutional layers slide convolution kernels over the input data, performing convolution operations to extract local features. Pooling layers downsample the output of the convolutional layer, reducing the dimensionality of the data while retaining important feature information. Fully connected layers concatenate the outputs of the pooling layers to perform tasks such as classification or regression. For example, for a two-dimensional communication protocol feature matrix, the convolutional layer can extract different local patterns using different convolution kernels. The pooling layer can perform max pooling or average pooling on the convolutional layer output. The fully connected layer can then classify protocol violations based on the pooling layer output.

[0127] Step S313: Setting a cross-layer feature interaction channel to fuse the output features of the bidirectional long short-term memory network unit with the intermediate layer features of the convolutional neural network module.

[0128] Cross-layer feature interaction channels are a mechanism for enabling feature information exchange between different layers. By setting up cross-layer feature interaction channels, the output features of the bidirectional long-short-term memory network unit can be fused with the intermediate layer features of the convolutional neural network module. This allows for the combined use of the temporal dependencies of device operation characteristics and the spatial local patterns of communication protocol characteristics to improve the accuracy of abnormal behavior identification.

[0129] Cross-layer feature interaction channels can be established using concatenation or weighted summation. For example, the output features of a bidirectional long short-term memory network unit are concatenated with the intermediate layer features of a convolutional neural network module to generate a new feature vector. This new feature vector is then input into subsequent processing layers for further analysis and processing. Alternatively, the output features of a bidirectional long short-term memory network unit and the intermediate layer features of a convolutional neural network module are weighted and summed to generate a fused feature vector.

[0130] Step S314: Integrate a random forest-based classifier in the model output layer to comprehensively evaluate the joint threat level of device operation anomalies and communication behavior anomalies.

[0131] A random forest classifier is a type of ensemble learning classifier that combines multiple decision trees to perform classification tasks. Integrating a random forest classifier at the model output layer comprehensively considers information about abnormal equipment operation and abnormal communication behavior, classifying abnormal behavior of power equipment nodes and assessing their combined threat level.

[0132] The training process for a random forest classifier is as follows: First, multiple subsets are randomly extracted from the training data, and each subset is used to train a decision tree. Each decision tree is then trained based on its own training data to generate its own classification rules. Finally, the classification results of all decision trees are voted on to obtain the final classification result. In the abnormal behavior recognition model, the output features of the bidirectional long short-term memory network unit and the convolutional neural network module are used as input to the random forest classifier. The random forest classifier then classifies the combined threat level of device operation anomalies and communication behavior anomalies into high, medium, or low risk.

[0133] Step S315: Optimize the robustness parameters of the abnormal behavior recognition model through adversarial training methods so that it can recognize disguised covert attack patterns.

[0134] Adversarial training, which introduces adversarial examples into model training, improves the model's robustness, enabling it to resist adversarial attacks and identify disguised, covert attack patterns. In abnormal behavior recognition models, adversarial training optimizes the model's robustness parameters, enhancing the model's ability to recognize complex attack patterns.

[0135] The adversarial training process is as follows: First, adversarial examples are generated. Adversarial examples are created by adding subtle perturbations to the original examples, causing the model to misclassify them. Then, both the adversarial examples and the original examples are fed into the abnormal behavior recognition model for training. During training, the model continuously adjusts its parameters to improve classification accuracy for both the original and adversarial examples. Through multiple iterations of training, the model's robustness parameters are optimized, enabling it to better identify disguised, covert attack patterns.

[0136] Step S320: Perform device status anomaly detection processing on the fused feature vector through the feature analysis layer to generate a first anomaly detection result set of the power equipment node, the first anomaly detection result set including a voltage over-limit event identifier, a current harmonic distortion event identifier, and a power mutation event identifier.

[0137] Device status anomaly detection involves analyzing fused feature vectors to determine whether the operating status of a power device node is abnormal. The first anomaly detection result set contains information related to abnormal operating status of power device nodes. The first anomaly detection result set includes information related to abnormal operating status of power device nodes. The voltage over-limit event flag identifies events where the device voltage exceeds the safe range, the current harmonic distortion event flag identifies events where the harmonic components in the current are abnormal, and the power sudden change event flag identifies events where the device power suddenly changes.

[0138] By performing device status anomaly detection processing on the fused feature vector through the feature analysis layer, the temporal dependency information of the device operation features extracted by the bidirectional long short-term memory network unit can be utilized. For voltage over-limit events, the voltage-related features in the fused feature vector are compared with the preset voltage safety range. If it exceeds the safety range, it is marked as a voltage over-limit event. For current harmonic distortion events, the current harmonic component features in the fused feature vector are analyzed. If the harmonic content exceeds the set threshold, it is marked as a current harmonic distortion event. For power mutation events, the rate of change of the power features in the fused feature vector is calculated. If the rate of change exceeds the preset threshold, it is marked as a power mutation event. The identifiers of these abnormal events are combined into a first abnormality detection result set.

[0139] Step S330: Perform communication protocol compliance verification on the communication protocol feature field set through the behavior determination layer to generate a second anomaly detection result set, which includes an illegal port scanning behavior identifier, an abnormal protocol handshake behavior identifier, and a communication frequency exceeding limit behavior identifier.

[0140] Communication protocol compliance verification is the process of checking a set of communication protocol feature fields to determine whether network communications comply with standard power communication protocols. The second anomaly detection result set contains information related to abnormal network communication behavior. The illegal port scanning behavior identifier identifies scanning of unauthorized ports, the abnormal protocol handshake behavior identifier identifies behavior that does not comply with the standard protocol handshake process, and the communication frequency limit behavior identifier identifies behavior that exceeds the normal range of communication frequencies.

[0141] The communication protocol compliance verification process is performed on the communication protocol feature field set through the behavior determination layer, and the spatial local pattern information of the communication protocol features extracted by the convolutional neural network module can be used. For illegal port scanning behavior, the port access information in the communication protocol feature field set is checked. If the frequency of access requests to unauthorized ports is found to be too high, it is marked as illegal port scanning behavior. For abnormal protocol handshake behavior, the timing characteristics of the protocol handshake message in the communication protocol feature field set are analyzed. If it is found that the standard protocol handshake process is not met, it is marked as abnormal protocol handshake behavior. For communication frequency exceeding behavior, the data packet transmission frequency in the communication protocol feature field set is counted. If it exceeds the normal range, it is marked as communication frequency exceeding behavior. The identifiers of these abnormal behaviors are combined into a second abnormality detection result set.

[0142] Step S340: performing spatiotemporal correlation analysis on the first anomaly detection result set and the second anomaly detection result set to determine a causal relationship chain between the device operation anomaly indicator and the protocol violation behavior.

[0143] Spatiotemporal correlation analysis comprehensively considers the temporal and spatial relationships between the first and second anomaly detection result sets to analyze the causal relationship between device operational anomalies and protocol violations. A causal chain, a chain-like structure that describes the causal relationship between device operational anomalies and protocol violations, can help better understand the mechanisms and propagation paths of abnormal behavior.

[0144] As an embodiment, step S340 performs spatiotemporal correlation analysis on the first anomaly detection result set and the second anomaly detection result set to determine a causal relationship chain between the device operation anomaly indicator and the protocol violation behavior. Specifically, the following steps S341 to S349 may be included:

[0145] Step S341: extracting the device anomaly event timestamp in the first anomaly detection result set and the protocol violation event timestamp in the second anomaly detection result set.

[0146] The device anomaly event timestamp refers to the time information of each device anomaly event in the first anomaly detection result set. The protocol violation event timestamp refers to the time information of each protocol violation event in the second anomaly detection result set. By extracting these timestamps, we can provide time dimension information for subsequent spatiotemporal correlation analysis.

[0147] Extract the timestamp of the device abnormal event in the first abnormal detection result set and the timestamp of the protocol violation event in the second abnormal detection result set. You can traverse the first abnormal detection result set and the second abnormal detection result set, extract the timestamp information of each abnormal event respectively, and store these timestamp information as two timestamp sequences.

[0148] Step S342: Generate a set of associated event pairs according to the time interval between the device abnormality event timestamp and the protocol violation event timestamp, where each event pair in the associated event pair set includes the device abnormality event and the protocol violation event occurring within the same time window.

[0149] The time interval is the difference between the timestamp of the device anomaly event and the timestamp of the protocol violation event. A correlated event pair set is a collection of device anomaly events and protocol violation events that occurred within the same time window. By generating a correlated event pair set, you can initially screen out device anomaly events and protocol violation events that may have a causal relationship.

[0150] Generate a set of correlated event pairs based on the time interval between the device anomaly event timestamp and the protocol violation event timestamp. A time window size can be set, such as 1 minute. For each device anomaly event timestamp, search the protocol violation event timestamp sequence for protocol violation events that occurred within that time window and combine them into an event pair. Collect all such event pairs to form a set of correlated event pairs.

[0151] Step S343: performing network topology path analysis on each event pair in the associated event pair set to determine the physical connection path between the power equipment node corresponding to the equipment abnormality event and the network communication node associated with the protocol violation event.

[0152] Network topology path analysis is the process of studying the connection relationships and path information between nodes in a power network. By performing network topology path analysis on each event pair in a set of associated event pairs, the physical connection path between the power equipment node corresponding to the device anomaly event and the network communication node associated with the protocol violation event can be determined, providing spatial information for subsequent causal analysis.

[0153] For each event pair in the set of associated event pairs, network topology path analysis can be performed. This can leverage the power network's topology information and employ graph search algorithms, such as breadth-first search (BFS) or depth-first search (DFS), to find the shortest path or all possible paths between the power device node corresponding to the device anomaly event and the network communication node associated with the protocol violation event. This path information is stored for subsequent analysis.

[0154] Step S344: Generate a potential attack link set based on the physical connection path. The potential attack link set includes the propagation direction and path node sequence between the device abnormality event and the protocol violation event.

[0155] The potential attack link set is a collection of possible attack propagation paths between device anomalies and protocol violations. It includes the attack propagation direction and the sequence of nodes along the path. By generating a potential attack link set based on physical connection paths, we can further analyze the causal relationship and propagation mechanism between device anomalies and protocol violations.

[0156] Generating a potential attack link set based on the physical connection path allows us to determine the attack propagation direction and the node sequence along the physical connection path. For example, if the physical connection path is from node A to node B and then to node C, then the potential attack link can be represented as A->B->C, where A is the attack's starting node and B and C are the intermediate nodes along the way. All such potential attack links are collected to form a potential attack link set.

[0157] Step S345: extracting the device abnormality indicator change trend and protocol violation feature evolution sequence of each attack link in the potential attack link set.

[0158] The device anomaly indicator change trend refers to how the device anomaly indicator changes over time within the attack chain. The protocol violation feature evolution sequence refers to how the protocol violation features change over time within the attack chain. By extracting this information, we can further analyze the dynamic relationship between device anomaly events and protocol violation events.

[0159] To extract the device anomaly indicator change trends and protocol violation feature evolution sequences for each attack link in the potential attack link set, the first and second anomaly detection result sets are searched for the device anomaly indicator and protocol violation feature evolution sequences for each attack link in the potential attack link set, based on the path node sequence of each attack link in the potential attack link set. These indicators and features are then arranged in chronological order to obtain the device anomaly indicator change trends and protocol violation feature evolution sequences.

[0160] Step S346: Perform time alignment processing on the change trend of the device abnormality indicator and the evolution sequence of the protocol violation feature to generate the correlation strength parameter of each attack link.

[0161] Time series alignment is the process of aligning the changing trends of device anomaly indicators with the evolutionary sequences of protocol violation characteristics, enabling comparison and analysis on the same time scale. The correlation strength parameter describes the degree of correlation between the changing trends of device anomaly indicators and the evolutionary sequences of protocol violation characteristics.

[0162] To align the trends of device anomaly indicators with the evolution of protocol violation features, interpolation or resampling can be used. For example, a uniform time interval can be selected for the trends of device anomaly indicators and the evolution of protocol violation features, and resampling can be performed to make their time series of the same length. Then, a correlation coefficient, such as the Pearson correlation coefficient, is calculated between the trends of device anomaly indicators and the evolution of protocol violation features, and this correlation coefficient is used as the correlation strength parameter.

[0163] Step S347: Filter attack links whose correlation strength parameters exceed the dynamically adjusted threshold to construct an initial causal relationship chain.

[0164] The dynamically adjusted threshold is adjusted based on actual conditions and data analysis results to screen out attack links with high correlation strength. The initial causal chain consists of attack links whose correlation strength parameters exceed the dynamically adjusted threshold. This represents the initial causal relationship between device operational anomalies and protocol violations.

[0165] To construct an initial causal chain, we filter out attack links whose correlation strength parameters exceed a dynamically adjusted threshold. We traverse the set of potential attack links and compare each link's correlation strength parameter with the dynamically adjusted threshold. If the correlation strength parameter exceeds the threshold, the attack link is added to the initial causal chain.

[0166] Step S348: Perform multi-dimensional verification processing on the initial causal relationship chain, and the verification dimensions include event temporal continuity, path node matching, and data anomaly correlation.

[0167] Multi-dimensional verification is the process of verifying the initial causal chain from multiple dimensions to ensure its rationality and reliability. Event temporal continuity refers to whether the chronological order of events in the initial causal chain is logical. Path node matching refers to the degree to which the path nodes in the initial causal chain match the actual network topology. Data anomaly correlation refers to whether the data correlation between device anomaly indicators and protocol violation characteristics in the initial causal chain is reasonable.

[0168] The initial causal chain is verified from multiple dimensions, including event temporal continuity, path node matching, and data anomaly correlation. For event temporal continuity, the chronological order of events in the initial causal chain is checked to see if it complies with causal logic. For example, an attack event should occur before an equipment anomaly event. For path node matching, the path nodes in the initial causal chain are compared with the nodes in the actual network topology to check for any mismatches. For data anomaly correlation, the data association between the equipment anomaly indicators and protocol violation features in the initial causal chain is analyzed to see if it complies with actual conditions. For example, changes in the equipment anomaly indicators are correlated with changes in the protocol violation features.

[0169] Step S349: Mark the initial causal relationship chain that meets the multi-dimensional conditions as a causal relationship chain between the device operation abnormality indicator and the protocol violation behavior according to the verification result.

[0170] Based on the verification results, the initial causal chain that meets the multi-dimensional conditions is marked as a causal chain between device operation anomaly indicators and protocol violations. The initial causal chain can be traversed, and for each attack link, it is checked to see whether it meets the conditions of event temporal continuity, path node matching, and data anomaly correlation. If all conditions are met, the attack link is marked as a causal chain between device operation anomaly indicators and protocol violations.

[0171] Step S350: performing threat level classification processing on the first anomaly detection result set and the second anomaly detection result set based on the causal relationship chain, and generating high-risk behavior records and medium-risk behavior records in the abnormal behavior data set.

[0172] Threat level classification is the process of classifying abnormal behaviors in the first and second anomaly detection result sets based on the causal chain and determining their threat levels. High-risk behavior records are those with a high threat level, while medium-risk behavior records are those with a moderate threat level.

[0173] Based on the causal chain, the threat level classification process is performed on the first and second sets of anomaly detection results. The threat level of each abnormal behavior can be comprehensively assessed based on factors such as the correlation strength of the attack links in the causal chain, the complexity of the attack path, and the severity of the abnormal behavior. For example, abnormal behaviors with high correlation strength, complex attack paths, and severe abnormal behaviors are classified as high-risk behaviors; abnormal behaviors with moderate correlation strength, relatively simple attack paths, and less impactful abnormal behaviors are classified as medium-risk behaviors. These high-risk and medium-risk behavior records are stored in the abnormal behavior data set.

[0174] Step S400: Generate a network security defense strategy set based on the abnormal behavior data set. The network security defense strategy set includes real-time blocking instructions and node status repair instructions for different abnormal behavior types.

[0175] The network security defense policy set is a set of policies used to ensure the security of power networks. Real-time blocking instructions are used to promptly prevent the occurrence and spread of abnormal behavior, while node status repair instructions are used to restore the normal operation of affected power equipment nodes. By generating a network security defense policy set based on the abnormal behavior data set, appropriate defense strategies can be developed based on the type and severity of the abnormal behavior.

[0176] As an implementation method, step S400, generating a network security defense strategy set based on the abnormal behavior data set, may specifically include the following steps S410 to S450:

[0177] Step S410: perform attack path tracing on high-risk behavior records to determine the attacked entry location and attack propagation path of the power equipment node.

[0178] Attack path tracing is the process of analyzing high-risk behavior records to track the attack's source and propagation path. The attack entry point refers to the node where the attack begins entering the power network, and the attack propagation path refers to the path the attack takes within the power network.

[0179] Tracing the attack path from high-risk behavior records can leverage causal chains and network topology information. Starting from the abnormal events in the high-risk behavior records, the attack propagation direction is traced back according to the attack links in the causal chain to find the attack's starting point, i.e., the location of the attack entry point. Simultaneously, all nodes and paths along which the attack occurred are recorded to form the attack propagation path.

[0180] Step S420: Generate a first defense strategy subset according to the attacked entry location, the first defense strategy subset including an instruction to close an unauthorized communication port, an instruction to isolate an infected device node, and an instruction to reset an encryption communication key.

[0181] The attacked entry point is the starting point for attacks on the power network. The first subset of defense strategies generated based on this is designed to block further penetration and spread of attacks at the source. Closing unauthorized communication ports is a key measure to prevent attackers from exploiting unauthorized open ports to continue attacks. In power networks, numerous communication ports are used for data exchange between devices, but some ports may become security risks due to improper configuration or exploitation by attackers. Closing these unauthorized communication ports effectively reduces the attack surface. For example, through the network management system, a port scan is performed on the device corresponding to the attacked entry point to identify unauthorized open ports. Closing commands are then issued to prohibit external access to these ports.

[0182] Isolating infected nodes isolates infected nodes from other healthy devices on the network to prevent the attack from spreading. This can be accomplished by modifying access control lists (ACLs) on devices like network switches or firewalls to block communication between infected nodes and other nodes. For example, adding the infected node's IP address to a firewall's blacklist prevents it from transmitting data to other devices on the network.

[0183] The purpose of the resetting encryption key command is to prevent attackers from exploiting cracked encryption keys. Many communications on power grids utilize encryption technology to ensure data security. However, if an attacker were to obtain the encryption key, the confidentiality and integrity of the data would be compromised. Resetting the encryption key can update the encryption mechanism and enhance communication security. For example, a key management system can be used to generate new encryption keys and distribute them to relevant communication devices, ensuring that communications between devices are encrypted and decrypted using the new encryption keys.

[0184] Step S430: performing path blocking point analysis on the attack propagation path to determine a set of critical path blocking device nodes in the power network.

[0185] The attack propagation path is the path that an attacker takes when launching an attack on the power network. Path blocking point analysis is performed to identify key locations that can effectively prevent the attack from spreading. The critical path blocking device node set refers to the set of device nodes along the attack propagation path that can take appropriate measures to block the attack.

[0186] Path blocking point analysis can be performed using graph theory. The power network can be abstracted into a graph, where nodes represent power equipment and edges represent the communication connections between devices. Based on the attack propagation path, the properties of each node and edge along the path are analyzed, such as node importance and edge bandwidth. For example, nodes located at the core of the network, responsible for large amounts of data transmission, or key nodes connecting multiple subnets, often serve as important blocking points along the attack propagation path. Furthermore, node security and controllability can be considered, with nodes that are easy to operate and manage being selected as critical path blocking nodes. Through detailed analysis and evaluation of the attack propagation path, a set of critical path blocking nodes can be identified, providing a basis for subsequent defense strategy development.

[0187] Step S440: Generate a second defense strategy subset based on the critical path blocking device node set, the second defense strategy subset includes deploying traffic cleaning instructions, enabling protocol whitelist filtering instructions, and strengthening identity authentication strength instructions.

[0188] The set of critical path blocking device nodes identifies key nodes in the power network that can effectively block the spread of attacks. The second defense strategy subset generated based on this set aims to further enhance network security by operating on these key nodes. Deploying traffic cleaning instructions cleans network traffic passing through critical path blocking device nodes, removing malicious traffic. Traffic cleaning devices, such as intrusion detection systems (IDS) or intrusion prevention systems (IPS), can be deployed at key nodes. These devices monitor network traffic in real time, identify malicious traffic such as DDoS attack traffic and virus-infected traffic, and filter and clean it. For example, when a large amount of abnormal traffic is detected heading to a key node, the traffic cleaning device can automatically direct this traffic to a predefined cleaning center, where the traffic is analyzed and processed, removing malicious components before returning normal traffic to the network.

[0189] Enabling the protocol whitelist filtering command only allows data transmission using predefined, secure communication protocols, prohibiting the use of unauthorized protocols. Power grids use a variety of communication protocols, some of which may have security vulnerabilities that can be easily exploited by attackers. By enabling the protocol whitelist filtering command, a protocol whitelist is configured on critical path blocking device nodes, allowing only protocols that meet the whitelist requirements to pass. For example, only standard power communication protocols such as IEC 61850 and Modbus are allowed to communicate, prohibiting the use of non-standard or security-prone protocols.

[0190] The directive to strengthen authentication strength aims to increase authentication requirements for devices and users in power networks, ensuring that only legitimate devices and users can access network resources. Multi-factor authentication methods can be used, such as a combination of username / password, digital certificates, and biometrics. At critical path blocking device nodes, all access requests are strictly authenticated. For example, when a device attempts to access a critical node, in addition to providing a username and password, it must also provide a digital certificate for verification, and may also require biometric authentication, such as fingerprint or facial recognition. By strengthening authentication strength, attackers can be effectively prevented from impersonating legitimate devices or users to launch attacks.

[0191] Step S450: The first defense strategy subset and the second defense strategy subset are combined according to the preset defense priority to generate a real-time blocking instruction in the network security defense strategy set, and generate a node status repair instruction based on the medium-risk behavior record.

[0192] The preset defense priority is a pre-determined order of policy execution based on the security requirements of the power network and the severity of the attack. Combining the first and second defense policy subsets according to the preset defense priority ensures that the defense strategies are executed in the most effective order when responding to attacks. For example, in the event of an emergency attack, the priority is to close unauthorized communication ports and isolate infected device nodes to quickly cut off the source and propagation path of the attack. For more moderate attacks, these instructions can be supplemented with the deployment of traffic cleaning and the activation of protocol whitelist filtering.

[0193] By rationally combining the first and second defense strategy subsets, real-time blocking instructions are generated within the network security defense strategy set. These real-time blocking instructions can be quickly distributed to the corresponding device nodes through the network management system, ensuring that the defense strategy can take effect in a timely manner.

[0194] Moderate-risk behavior records refer to abnormal behavior records with a moderate threat level within a collection of abnormal behavior data. Node status repair instructions are generated based on these records to restore the normal operation of power equipment nodes affected by the moderate-risk abnormal behavior. For example, if a moderate-risk behavior record indicates an abnormality in the communication protocol of a device node, but the device itself is not seriously damaged, an instruction can be generated to restore the normal communication protocol configuration. If errors are detected in some of the device's data, instructions can be generated to repair and correct the data. These node status repair instructions can be used to promptly repair affected device nodes, reducing the impact of abnormal behavior on the power network.

[0195] Step S500: Feedback the network security defense strategy set to the power network control center to trigger a defense response operation, and adjust the collection strategy of the multi-source monitoring data set according to the execution result of the defense response operation.

[0196] The Power Network Control Center (PNCC) is the core management and control organization for the power network. Feeding back cybersecurity defense strategies to the PNCC allows the center to promptly understand the network's security status and implement appropriate defensive measures. Defense response operations refer to a series of security protection actions the PNCC performs on the power network based on the received cybersecurity defense strategies, such as executing real-time blocking commands and repairing affected device nodes.

[0197] As an embodiment, step S500 feeds back the network security defense strategy set to the power network control center to trigger a defense response operation, and adjusts the collection strategy of the multi-source monitoring data set according to the execution result of the defense response operation. Specifically, the following steps S510 to S550 may be included:

[0198] Step S510: sending the real-time blocking instruction to the target device node in the critical path blocking device node set for execution, and monitoring the instruction execution status data of the target device node.

[0199] Real-time blocking instructions are a crucial component of network security defense strategies, designed to prevent the continued spread of attacks. Sending real-time blocking instructions to target device nodes in the critical path blocking device node set can be accomplished through a network management system or a specialized instruction transmission protocol. For example, the Simple Network Management Protocol (SNMP) can be used to send instructions to target device nodes. Upon receiving the instructions, the target device nodes will perform the corresponding actions specified in the instructions, such as closing unauthorized communication ports and enabling protocol whitelist filtering.

[0200] Monitoring the command execution status data of target device nodes ensures correct command execution and promptly identifies any problems that arise during execution. This data can be collected by installing monitoring software on the target device nodes or by utilizing the device's own logging capabilities. For example, this data can be recorded, including the time the command was received, when it started, and when it was completed, as well as any errors or anomalies that occurred during execution. This data is then fed back to the power network control center for further analysis and processing.

[0201] Step S520: Evaluate the effectiveness parameter of the real-time blocking instruction according to the instruction execution status data. If the effectiveness parameter is lower than a preset threshold, activate the backup defense strategy and update the path blocking point of the attack propagation path.

[0202] Command execution status data reflects the execution status of real-time blocking commands. This data can be used to assess the effectiveness of real-time blocking commands. Effectiveness can be measured using various metrics, such as the success rate of command execution and the degree of reduction in attack traffic. For example, if attack traffic significantly decreases after executing the command to close unauthorized communication ports, the command is highly effective. If attack traffic remains unchanged or even increases after execution, the command is less effective.

[0203] The preset threshold is a pre-determined criterion based on power grid security requirements and historical experience. If the effectiveness parameter falls below the preset threshold, it indicates that the current real-time blocking instructions have failed to effectively prevent the spread of the attack, and a backup defense strategy needs to be activated. Backup defense strategies are pre-defined strategies to be used when the primary defense strategy fails, such as adding firewall rules or strengthening traffic monitoring. At the same time, the path blocking points along the attack propagation path must be updated. By reanalyzing the attack propagation path and incorporating the new attack situation, a new set of critical path blocking device nodes can be determined to enable more effective defense measures.

[0204] Step S530: performing operation status recovery verification processing on the power equipment node after executing the node status repair instruction, and generating an equipment status recovery report and a residual risk indicator.

[0205] Executing the node status repair instruction is to restore the normal operation of the power equipment node affected by the abnormal behavior. Performing the operation status recovery verification process on the power equipment node after executing the node status repair instruction is to ensure that the equipment node has been restored to normal operation and there are no residual safety hazards.

[0206] Verification of operational status recovery can be performed in a variety of ways, such as testing various operating parameters and functional testing of the device. For example, for a device node experiencing communication failure due to an attack, after executing the node status repair command, the device node's communication ports can be checked for proper operation, the correct configuration of the communication protocol, and stable data transmission. Through these inspections and tests, it can be determined whether the device node's operational status has returned to normal.

[0207] Based on the results of the operational status recovery verification process, a device status recovery report is generated. This report details the device node's recovery status, including a comparison of operational parameters before and after recovery, functional test results, and other information. It also assesses the remaining security risks of the device node and generates a residual risk indicator. This residual risk indicator can be expressed in terms of risk level and risk probability, providing a reference for subsequent security management.

[0208] Step S540: adjusting the collection strategy of the multi-source monitoring data set according to the device status recovery report and the residual risk indicator.

[0209] The equipment status recovery report and residual risk index reflect the current status and security risk of power equipment nodes. Adjusting the collection strategy of multi-source monitoring data sets based on this information can make the monitoring data more targeted and reflect the security status of the network.

[0210] If the device status recovery report shows that the device node has fully returned to normal and the residual risk index is low, the monitoring frequency of the device node can be appropriately reduced to reduce the workload of data collection. For example, the original collection of device operation data once a minute can be adjusted to once every five minutes. On the contrary, if the device status recovery report shows that there are still some problems with the device node, or the residual risk index is high, it is necessary to increase the monitoring frequency of the device node and increase the dimension of data collection. For example, in addition to collecting the basic operating parameters of the device, the monitoring of the device's network traffic, communication protocol, etc. is also increased. By adjusting the collection strategy of the multi-source monitoring data set, potential safety issues can be more effectively discovered and the security of the power network can be improved.

[0211] Step S550: deploying a policy execution monitoring module in the power network control center to continuously monitor the implementation effect of the network security defense policy set and dynamically optimize the detection threshold parameters of the abnormal behavior recognition model.

[0212] The Policy Execution Monitoring Module is used to monitor the effectiveness of the implementation of a set of network security defense policies in real time. Deploying the module within the power network control center enables comprehensive, real-time monitoring of the execution of network security defense policies. This module collects and analyzes various relevant data, such as changes in attack traffic, changes in device node status, and the success rate of command execution.

[0213] By continuously monitoring the effectiveness of the cybersecurity defense strategy set, we can promptly identify problems that arise during strategy execution, such as certain defense strategies failing to achieve their intended effects or new attack types being unable to be effectively identified. Based on the monitoring results, we can adjust and optimize the cybersecurity defense strategy to ensure its continued effectiveness in protecting the security of the power grid.

[0214] At the same time, the detection threshold parameters of the abnormal behavior identification model are dynamically optimized. The detection threshold parameters of the abnormal behavior identification model serve as the standard for determining whether network behavior is abnormal. Appropriate detection threshold parameters can improve the model's recognition accuracy. As the network security environment changes and attack methods evolve, the original detection threshold parameters may no longer be applicable. By monitoring and analyzing the effectiveness of network security defense strategies, we can understand the model's recognition performance in different situations and dynamically adjust the detection threshold parameters based on actual conditions. For example, if the model's recognition rate for certain types of attacks is low, the detection threshold can be appropriately lowered to increase the model's sensitivity. If the model's false alarm rate is high, the detection threshold can be appropriately increased to reduce false alarms. By dynamically optimizing the detection threshold parameters of the abnormal behavior identification model, the model's performance and adaptability can be improved, better ensuring the security of the power grid.

[0215] In summary, the data fusion-based power network intrusion analysis method provided by the present invention accurately identifies abnormal behavior in the power network and generates corresponding network security defense strategies by processing and analyzing multi-source monitoring data. Furthermore, by monitoring and adjusting the effectiveness of defense strategies and optimizing the abnormal behavior identification model, the security and reliability of the power network are continuously improved, effectively responding to various network attacks and security threats.

[0216] It is understandable that the various algorithms involved in the above-mentioned introductions to the embodiments of the present invention, such as the FFT algorithm, the mean filter algorithm, etc., can all be learned from the relevant content in the prior art. In order to save space, they will not be expanded too much in the embodiments of this application. In addition, when implementing the scheme of this application, those skilled in the art can supplement the details according to the common knowledge in this field. For example, according to the common knowledge in this field, normalization can be used to eliminate dimensional conflicts before feature fusion, interpolation can be used to eliminate dimensional differences, and historical data, experience or business scenario requirements can be combined to reasonably set thresholds, and models can be trained based on a general model training method, etc. This application will no longer provide redundant introductions to overly detailed implementation processes.

[0217] See also Figure 2 , Figure 2This is a schematic diagram of the structure of a computer system provided in an embodiment of the present invention. The computer system includes at least a processor 101, a communication interface 102, and a memory 103. The processor 101, communication interface 102, and memory 103 may be connected via a bus or other means. The processor 101 (or central processing unit (CPU)) is the computing and control core of the computer system, capable of parsing various instructions within the computer system and processing various data within the computer system. The communication interface 102 may optionally include a standard wired interface or a wireless interface (such as Wi-Fi, a mobile communication interface, etc.), which can be used to send and receive data under the control of the processor 101. The communication interface 102 can also be used for data transmission and interaction within the computer system. The memory 103 is a memory device in the computer system for storing programs and data. It is understood that the memory 103 here can include both the built-in memory of the computer system and, of course, the extended memory supported by the computer system. The memory 103 provides storage space, which stores the operating system of the computer system, but this is not limited by the present invention.

[0218] In one embodiment, the processor 101 executes the power network intrusion analysis method based on data fusion provided in the above embodiment of the present invention by running the computer program in the memory 103 .

Claims

1. A power network intrusion analysis method based on data fusion, characterized in that: The following steps are involved: Acquire a multi-source monitoring data set in the power network, wherein the multi-source monitoring data set includes node operation data streams and network communication data streams of multiple power equipment nodes; Performing dynamic feature fusion processing on the multi-source monitoring data set to generate a multi-dimensional fusion feature set associated with the power equipment node; Inputting the multi-dimensional fusion feature set into a preset abnormal behavior recognition model for intrusion analysis and processing to generate an abnormal behavior data set of the power equipment node; generating a network security defense strategy set based on the abnormal behavior data set, wherein the network security defense strategy set includes real-time blocking instructions and node status repair instructions for different abnormal behavior types; The network security defense strategy set is fed back to the power network control center to trigger a defense response operation, and the collection strategy of the multi-source monitoring data set is adjusted according to the execution result of the defense response operation.

2. The method according to claim 1, wherein The performing dynamic feature fusion processing on the multi-source monitoring data set to generate a multi-dimensional fusion feature set associated with the power equipment node includes: Performing data preprocessing on the node operation data stream to obtain a standardized node operation data set, wherein the standardized node operation data set includes device voltage fluctuation characteristics, current phase shift characteristics, and power abnormal fluctuation characteristics; Performing protocol parsing on the network communication data stream to extract a communication protocol feature field set, wherein the communication protocol feature field set includes a data packet transmission interval feature, a protocol type identification feature, and a port access frequency feature; Performing time window alignment processing on the standardized node operation data set and the communication protocol feature field set to determine an associated mapping relationship between the operation state characteristics and the communication behavior characteristics of the power equipment node within the same timing window; Based on the association mapping relationship, feature dimension matching processing is performed on the device voltage fluctuation feature, the current phase offset feature, the power abnormal fluctuation feature, the data packet transmission interval feature, the protocol type identification feature, and the port access frequency feature to generate a fusion feature vector in the multi-dimensional fusion feature set; Each feature dimension in the fused feature vector corresponds to a correlation strength parameter between the device operating state and the network communication behavior of the power device node within a preset time window.

3. The method according to claim 2, wherein The step of inputting the multi-dimensional fusion feature set into a preset abnormal behavior recognition model for intrusion analysis and processing to generate an abnormal behavior data set of the power equipment node includes: Constructing a feature analysis layer and a behavior determination layer in the abnormal behavior identification model, wherein the feature analysis layer is used to extract device operation abnormality indicators in the fused feature vector, and the behavior determination layer is used to identify protocol violations in the network communication data flow; Performing device state anomaly detection processing on the fused feature vector by the feature analysis layer to generate a first anomaly detection result set for the power device node, the first anomaly detection result set including a voltage over-limit event identifier, a current harmonic distortion event identifier, and a power mutation event identifier; Performing communication protocol compliance verification processing on the communication protocol feature field set by the behavior determination layer to generate a second anomaly detection result set, the second anomaly detection result set including an illegal port scanning behavior identifier, an abnormal protocol handshake behavior identifier, and a communication frequency exceeding limit behavior identifier; Performing spatiotemporal correlation analysis on the first anomaly detection result set and the second anomaly detection result set to determine a causal relationship chain between the device operation anomaly indicator and the protocol violation; Based on the causal relationship chain, threat level classification processing is performed on the first anomaly detection result set and the second anomaly detection result set to generate high-risk behavior records and medium-risk behavior records in the abnormal behavior data set.

4. The method according to claim 3, wherein Generating a network security defense strategy set according to the abnormal behavior data set includes: Performing attack path tracing on the high-risk behavior records to determine the attacked entry location and attack propagation path of the power equipment node; generating a first defense strategy subset according to the attacked entry location, the first defense strategy subset including an instruction to close an unauthorized communication port, an instruction to isolate an infected device node, and an instruction to reset an encryption communication key; Performing path blocking point analysis on the attack propagation path to determine a set of critical path blocking device nodes in the power network; generating a second defense strategy subset according to the critical path blocking device node set, the second defense strategy subset including a deployment traffic cleaning instruction, an enablement protocol whitelist filtering instruction, and an enhancement authentication strength instruction; The first defense strategy subset and the second defense strategy subset are processed according to the preset defense priority to generate a real-time blocking instruction in the network security defense strategy set, and the node status repair instruction is generated according to the medium-risk behavior record.

5. The method according to claim 4, wherein Feeding back the network security defense strategy set to the power network control center to trigger a defense response operation, and adjusting the collection strategy of the multi-source monitoring data set according to the execution result of the defense response operation, includes: Sending the real-time blocking instruction to a target device node in the critical path blocking device node set for execution, and monitoring instruction execution status data of the target device node; evaluating a validity parameter of the real-time blocking instruction according to the instruction execution status data, and if the validity parameter is lower than a preset threshold, initiating a backup defense strategy and updating a path blocking point of the attack propagation path; Performing operation status recovery verification processing on the power equipment node after executing the node status repair instruction, and generating an equipment status recovery report and a residual risk indicator; Adjusting the collection frequency and feature dimensions of the multi-source monitoring data set according to the device status recovery report and the residual risk indicator; A strategy execution monitoring module is deployed in the power network control center to continuously monitor the implementation effect of the network security defense strategy set and dynamically optimize the detection threshold parameters of the abnormal behavior recognition model.

6. The method according to claim 2, wherein The step of performing data preprocessing on the node operation data stream to obtain a standardized node operation data set includes: Perform noise filtering on the original node operation data stream, remove electromagnetic interference signals and sensor collection abnormal values, and generate a preliminary purified data stream; Performing time series segmentation processing on the preliminary cleansed data stream to generate a set of device operating status snapshots within equally spaced time windows; Extract the voltage RMS, current fundamental component and power factor characteristic parameters within each time window to generate a set of original operating characteristic parameters; Dynamically comparing the voltage effective value in the original operation characteristic parameter set with a preset voltage safety range to generate the device voltage fluctuation characteristics in the standardized node operation data set; Performing harmonic component decomposition processing on the current fundamental component, extracting the proportion of each harmonic content to generate a current phase offset feature in the standardized node operation data set; Based on the correlation analysis of the power factor characteristic parameters and the equipment load rate data, the power abnormal fluctuation characteristics in the standardized node operation data set are generated.

7. The method according to claim 2, wherein The performing protocol parsing on the network communication data stream to extract a communication protocol feature field set includes: Capture the data link layer frame structure and network layer packet structure in the power communication network and generate a set of original communication data packets; Parsing the transport layer protocol header information in the original communication data packet set, extracting the source port number, the destination port number and the protocol type identifier, and generating a basic protocol feature set; Counting the access request frequency of the target port number within a unit time, and generating a port access frequency feature in the communication protocol feature field set; Analyzing the application layer protocol handshake message timing characteristics in the original communication data packet set, and calculating the time intervals between arrivals of adjacent data packets to generate data packet transmission interval characteristics in the communication protocol feature field set; Identifying a non-standard protocol field format in the network layer data packet structure, detecting protocol field length anomalies and checksum error events to generate an abnormal protocol handshake behavior identifier in the communication protocol feature field set; A compliance mapping relationship between the protocol type and the standard power communication protocol is established, and a communication session using an unauthorized protocol type is marked to generate a protocol type identification feature in the communication protocol feature field set.

8. The method according to claim 2, wherein The performing time window alignment processing on the standardized node operation data set and the communication protocol feature field set to determine the associated mapping relationship between the operation state characteristics and the communication behavior characteristics of the power equipment node within the same timing window includes: Extracting a device data timestamp sequence according to a time window identifier in the device operation status snapshot set, and extracting a communication data timestamp sequence from the communication protocol feature field set; Performing time overlap matching processing on the device data timestamp sequence and the communication data timestamp sequence to generate a timestamp matching result of the device operation status snapshot and the communication protocol characteristic field containing the same time window identifier; Establishing a first event association index between the device voltage fluctuation feature and the data packet transmission interval feature in the timestamp matching result, and generating a set of association pairs of voltage fluctuation events and communication delay events; Performing spatial distribution matching processing on the current phase offset characteristics and the port access frequency characteristics, analyzing the network path topology relationship between the device node positions in the current abnormal area and the high-frequency port access nodes, and generating a set of spatial correlation parameters; Based on the synchronization analysis and processing of the abnormal power fluctuation characteristics and the protocol type identification characteristics, the distribution density parameters of the illegal protocol usage behavior during the power mutation period are calculated to generate a protocol violation density sequence; Performing multi-dimensional fusion processing on the association pair set, the spatial association parameter set, and the protocol violation density sequence to construct a multi-dimensional association feature vector reflecting the spatiotemporal correlation between the device operation status characteristics and the communication behavior characteristics; An association mapping relationship between the operating status feature and the communication behavior feature is generated according to the weight distribution of each dimension in the multidimensional association feature vector, and the association mapping relationship is used to describe the spatiotemporal coupling strength between the device abnormality index and the protocol violation behavior.

9. The method according to claim 2, wherein The performing feature dimension matching processing on the device voltage fluctuation feature, the current phase offset feature, the abnormal power fluctuation feature, the data packet transmission interval feature, the protocol type identification feature, and the port access frequency feature based on the association mapping relationship to generate a fused feature vector in the multi-dimensional fused feature set includes: Convert the time series data of equipment voltage fluctuation characteristics into a standardized fluctuation amplitude index; Perform Fourier transform on the current phase shift characteristics to extract the main harmonic frequency components; Mapping abnormal power fluctuation characteristics into discrete state transition probability matrix; Perform probability distribution fitting on the data packet transmission interval characteristics to generate transmission interval abnormality probability parameters; Encode the protocol type identification feature into a multi-dimensional one-hot vector form; Using an attention mechanism to perform feature weight allocation processing on the standardized fluctuation amplitude index, main harmonic frequency components, discrete state transition probability matrix, transmission interval abnormality probability parameter and multi-dimensional one-hot vector; The weighted features of each dimension are combined into the fused feature vector of unified dimension through the feature concatenation layer.

10. A computer system, characterized in that: include: a memory storing a computer program; A processor, configured to load the computer program to implement the power network intrusion analysis method based on data fusion according to any one of claims 1 to 9.

Images