Power system network space service intrusion detection method and device based on traceability graph, terminal equipment and storage medium

Abstract

The invention discloses a power system network space service intrusion detection method and device based on a traceability graph, terminal equipment and a storage medium, and relates to the technical field of information, and the method comprises the steps: obtaining to-be-detected data of a power grid system; inputting to-be-detected data into the trained convolutional neural network model to obtain a feature vector of the to-be-detected data; the Euclidean distance between the feature vector of the to-be-detected data and each normal behavior feature vector is calculated, and whether an intrusion behavior exists or not is judged based on the Euclidean distance; wherein the step of training the convolutional neural network model comprises the following steps: acquiring normal behavior data and intrusion behavior data through an automatic traceability collection and storage system to generate a traceability graph; constructing each normal behavior feature vector and each abnormal behavior feature vector based on the traceability graph; and training the convolutional neural network model until the precision requirement is met. According to the invention, the problem that various network intrusion behaviors are difficult to identify in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method, device, terminal equipment and storage medium for detecting business intrusion in power system cyberspace based on a traceability graph. Background Art

[0002] As power grids evolve toward automation and intelligence, cybersecurity threats are also emerging. Current power grids are the result of a highly coupled integration of traditional power systems with information and communications systems. The introduction of information systems exposes power systems to the risk of cyberattacks. Furthermore, improper operator operations, such as weak passwords and configuration file errors, can also lead to intrusions. Intrusion detection is a reliable and proactive defense against cyberattacks. It examines the system for intrusions or potential risks, and examines traces of operations in the system to determine whether the operator's actions were safe. Common cyberattack defense measures can be categorized as network communication protection, network device protection, network software system protection, and network service protection. While these current defenses can mitigate the frequency of intrusions to a certain extent, they cannot fundamentally eliminate hacker intrusions. While existing power systems can proactively protect against complex and diverse network environments and attack vectors, they struggle to promptly identify a wide variety of cyber intrusions and attack behaviors. This is especially true when faced with new and unprecedented attack methods, such as novel cyberattacks. Detecting potential intrusions by tracing massive amounts of operational information to ensure timely maintenance and stable grid operation remains a key challenge. Summary of the Invention

[0003] The embodiments of the present invention provide a method, apparatus, terminal device and storage medium for detecting business intrusion in power system cyberspace based on a traceability graph. The present invention can solve the problem that the existing technology is difficult to identify various network intrusion behaviors.

[0004] An embodiment of the present invention provides a method for detecting power system cyberspace services intrusion based on a traceability graph, including:

[0005] Obtain the data to be tested from the power grid system;

[0006] Input the data to be detected into the trained convolutional neural network model, and obtain the feature vector of the data to be detected through the trained convolutional neural network model;

[0007] Calculate the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in the preset rule base feature vector set. When the minimum Euclidean distance is greater than a preset threshold, it is determined that the data to be detected has intrusion behavior;

[0008] The convolutional neural network model is trained through the following steps:

[0009] In the established virtual power grid system, the normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system. Based on the normal behavior data and intrusion behavior data, the traceability diagram of each normal behavior and the traceability diagram of each intrusion behavior are generated;

[0010] For each traceability graph of normal behavior and each traceability graph of intrusion behavior, a preset number of central nodes and their corresponding neighboring nodes are selected, and a comprehensive ranking is performed based on the importance values ​​of the central node and its corresponding neighboring nodes, as well as the distance between the central node and its corresponding neighboring nodes. Based on the comprehensive ranking results, a feature vector of each normal behavior and a feature vector of each abnormal behavior are constructed;

[0011] Each normal behavior feature vector and each abnormal behavior feature vector are input into a convolutional neural network model, and the convolutional neural network model is trained until the accuracy requirement of the convolutional neural network model is met.

[0012] Furthermore, the Euclidean distance is calculated using the following formula:

[0013]

[0014] Where D is the Euclidean distance, n means that both the feature vector of the data to be detected and the feature vector of a normal behavior contain n elements, and x i is the i-th element in the feature vector of the data to be detected, y i is the i-th element in a normal behavior feature vector.

[0015] Furthermore, generating a traceability diagram of each normal behavior and a traceability diagram of each intrusion behavior based on the normal behavior data and the intrusion behavior data includes:

[0016] Based on the automatic tracing collection and storage system, the dependency relationship between each object in the normal behavior data and the intrusion behavior data is determined, and the normal behavior tracing data and the intrusion behavior tracing data are obtained according to the dependency relationship between each object;

[0017] Based on the normal behavior tracing data and the intrusion behavior tracing data, a tracing graph of each normal behavior and a tracing graph of each intrusion behavior are generated.

[0018] Furthermore, for each normal behavior traceability graph and each intrusion behavior traceability graph, selecting a preset number of central nodes and neighboring nodes corresponding to the central nodes includes:

[0019] Calculate the importance of each node based on the dependency importance value of each node in the traceability graph of each normal behavior and each intrusion behavior, as well as the number of attributes of each node;

[0020] Based on the importance value of each node, the importance of each node is sorted, and a preset number of nodes are selected as central nodes according to the importance sorting results;

[0021] The nodes directly adjacent to each central node are ranked by importance to determine the neighboring nodes corresponding to each central node.

[0022] Furthermore, the importance value of each node is calculated using the following formula:

[0023] SI(p)=H(p)+A(p);

[0024] Where H(p)=Hp+∑H(p i );

[0025] p i ∈Mp

[0026] In the formula, SI(p) is the importance value of node p, H(p) is the dependency importance value of node p, A(p) is the number of attributes of node p, Hp is the importance value of node p itself, and i is the i-th child node of node p, Mp is the node set consisting of all child nodes of node p, H(p i ) is the dependency importance value of the i-th child node of the p node.

[0027] Furthermore, the comprehensive sorting based on the importance values ​​of the central node and the neighboring nodes corresponding to the central node, as well as the distance between the central node and the neighboring nodes corresponding to the central node, includes:

[0028] Sort the central node and its corresponding neighboring nodes in descending order of importance to obtain an importance sequence;

[0029] According to the distance between the neighboring nodes corresponding to each central node and the central node, the importance sequence is sorted and adjusted in order from near to far to obtain a comprehensive sorting result.

[0030] Another embodiment of the present invention provides a power system cyberspace service intrusion detection device based on a traceability graph, comprising:

[0031] Data acquisition module, feature vector extraction module and intrusion behavior judgment module:

[0032] The data acquisition module is used to acquire the data to be detected of the power grid system;

[0033] The feature vector extraction module is used to input the data to be detected into the trained convolutional neural network model, and obtain the feature vector of the data to be detected through the trained convolutional neural network model; wherein, the convolutional neural network model is trained through the following steps: in the constructed virtual power grid system, normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system, and based on the normal behavior data and the intrusion behavior data, a traceability graph of each normal behavior and a traceability graph of each intrusion behavior are generated; for each traceability graph of normal behavior and each traceability graph of intrusion behavior, a preset number of central nodes and neighboring nodes corresponding to the central nodes are selected, and comprehensive sorting is performed according to the importance value of the central node and the neighboring nodes corresponding to the central node, as well as the distance between the central node and the neighboring nodes corresponding to the central node, and each normal behavior feature vector and each abnormal behavior feature vector are constructed according to the comprehensive sorting result; each normal behavior feature vector and each abnormal behavior feature vector are input into the convolutional neural network model, and the convolutional neural network model is trained until the accuracy requirement of the convolutional neural network model is met;

[0034] The intrusion behavior judgment module is used to calculate the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in the preset rule base feature vector set. When the minimum Euclidean distance is greater than a preset threshold, it is judged that the data to be detected has intrusion behavior.

[0035] Furthermore, the intrusion behavior judgment module calculates the Euclidean distance using the following formula:

[0036]

[0037] Where D is the Euclidean distance, n means that both the feature vector of the data to be detected and the feature vector of a normal behavior contain n elements, and x i is the i-th element in the feature vector of the data to be detected, y i is the i-th element in a normal behavior feature vector.

[0038] Another embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a power system cyberspace business intrusion detection method based on a traceability graph as described in any one of the embodiments.

[0039] Another embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute a power system cyberspace business intrusion detection method based on a traceability graph as described in any of the above embodiments.

[0040] The following beneficial effects are achieved by implementing the present invention:

[0041] The present invention discloses a method, device, terminal equipment and storage medium for power system cyberspace business intrusion detection based on a traceability graph. The method obtains data to be detected from the power grid system; inputs the data to be detected into a trained convolutional neural network model to obtain a feature vector of the data to be detected; calculates the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in a preset rule base feature vector set, and when the minimum Euclidean distance is greater than a preset threshold, it is judged that there is intrusion behavior in the data to be detected; wherein, the step of training the convolutional neural network model includes: in a constructed virtual power grid system, obtaining normal behavior data and intrusion behavior data through an automatic traceability collection and storage system, and generating a traceability graph for each normal behavior and a traceability graph for each intrusion behavior; for each traceability graph of normal behavior and each traceability graph of intrusion behavior, constructing each normal behavior feature vector and each abnormal behavior feature vector; inputting each normal behavior feature vector and each abnormal behavior feature vector into the convolutional neural network model, and training the convolutional neural network model until the accuracy requirements of the convolutional neural network model are met. The present invention uses an automatic traceability collection and storage system to comprehensively trace the power system's operating data, extracting feature vector information from the operating data. These feature vectors are then combined with a convolutional neural network model to construct an efficient intrusion detection mechanism. By calculating the Euclidean distance between the feature vectors of the data to be detected and the feature vectors of normal behavior, the system can accurately determine whether an intrusion has occurred. Even in the face of unprecedented attack methods such as new network attacks, the present invention can detect a wide variety of network intrusion behaviors by tracing the extracted feature vectors and comparing them with normal behavior, significantly improving the power grid's security protection capabilities in the face of complex network environments and unknown threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flow chart of a method for detecting cyberspace business intrusion in a power system based on a traceability graph provided by one embodiment of the present invention.

[0043] Figure 2 It is a structural diagram of an automatic traceability collection and storage system provided by one embodiment of the present invention.

[0044] Figure 3 It is a structural diagram of a power system cyberspace business intrusion detection method based on a traceability graph provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0046] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0047] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly specify the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is more than two, unless otherwise clearly and specifically defined.

[0048] like Figure 1 As shown, in order to solve the problem that the existing technology is difficult to identify various network intrusion behaviors, an embodiment of the present invention provides a power system cyberspace service intrusion detection method based on a traceability graph, including the following steps:

[0049] Step S1, obtaining the data to be detected of the power grid system;

[0050] In the present invention, the data to be detected generated during the operation of the power grid system is obtained to provide a data basis for subsequent intrusion detection on the data to be detected.

[0051] Step S2: input the data to be detected into the trained convolutional neural network model, and obtain the feature vector of the data to be detected through the trained convolutional neural network model; wherein, the convolutional neural network model is trained through the following steps: in the constructed virtual power grid system, normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system, and based on the normal behavior data and the intrusion behavior data, a traceability graph of each normal behavior and a traceability graph of each intrusion behavior are generated; for each traceability graph of normal behavior and each traceability graph of intrusion behavior, a preset number of central nodes and neighboring nodes corresponding to the central nodes are selected, and comprehensive sorting is performed according to the importance value of the central node and the neighboring nodes corresponding to the central node, as well as the distance between the central node and the neighboring nodes corresponding to the central node, and each normal behavior feature vector and each abnormal behavior feature vector are constructed according to the comprehensive sorting result; each normal behavior feature vector and each abnormal behavior feature vector are input into the convolutional neural network model, and the convolutional neural network model is trained until the accuracy requirement of the convolutional neural network model is met;

[0052] In the present invention, the data to be detected is input into a trained convolutional neural network model, and feature information is extracted from the data to be detected by the trained convolutional neural network model to obtain a feature vector of the data to be detected;

[0053] Specifically, after the data to be tested is input into the trained convolutional neural network model, it undergoes several layers of convolution-pooling operations. Each convolution kernel extracts feature information from the data to be tested according to the required features of its own parameters, and performs pooling operations on the feature information obtained by each convolution kernel. In addition, an activation function is introduced to introduce nonlinear features into the network model to simulate and process complex situations. Finally, the data output to the fully connected layer represents the feature vector formed by the data to be tested.

[0054] The following is a detailed description of the training steps of the convolutional neural network model:

[0055] 1. First, a virtual grid system is built by simulating the power grid system. Based on various applications, the virtual grid system is invaded to generate normal behavior information and intrusion behavior operation information, preparing for subsequent traceability information extraction;

[0056] Schematically, the virtual power grid system is attacked based on the following six applications: phishing email simulates a typical advanced persistent threat attack, which deceives users into downloading malicious Trojans by clicking on malicious browser links in emails provided by attackers, thereby sending sensitive information to the attacker's remote machine; the image processing vulnerability Imagetragick allows users to crop and scale images when uploading them to a specified server, which is an attack on the user's host; Ransomeware is an attacker who exploits vulnerabilities in the server to use and modify database contents by executing CONFIG instructions on its open TCP port; Proftpd application is a file transfer protocol FTP server program for Unix platforms. There is a backdoor command execution vulnerability in its 1.3.3c version, which allows remote unauthenticated users to access the system. The attacker uses BackTrack The proftpd_133c_backdoor.rb script provided in the penetration testing tool metaspolit provided by the 5R3 operating system can obtain root privileges on the attacked machine and thus launch attacks on the server. The Ptrace application is a tool that enables one process to control another. This tool has the vulnerability CAN-2003-0127, which allows attackers to attack the user's host by inputting the application's test data into a trained convolutional neural network model. The Flash application is a tool for playing and executing SWF type files in real time. Its Linux platform version 10.0.12.36 has the vulnerability CVE-2008-5499, which allows attackers to launch attacks when users load specially formatted SWF type files.

[0057] 2. In the established virtual power grid system, the normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system. Based on the normal behavior data and intrusion behavior data, the traceability diagram of each normal behavior and each intrusion behavior is generated;

[0058] In a preferred embodiment, generating a traceability graph of each normal behavior and a traceability graph of each intrusion behavior based on the normal behavior data and the intrusion behavior data includes:

[0059] Based on the automatic tracing collection and storage system, the dependency relationship between each object in the normal behavior data and the intrusion behavior data is determined, and the normal behavior tracing data and the intrusion behavior tracing data are obtained according to the dependency relationship between each object;

[0060] Based on the normal behavior tracing data and the intrusion behavior tracing data, a tracing graph of each normal behavior and a tracing graph of each intrusion behavior are generated.

[0061] In this application, based on the automatic traceability collection and storage system, normal behavior data and intrusion behavior data are obtained in the constructed virtual power grid system, and the normal behavior data and intrusion behavior data are converted into normal behavior traceability data and intrusion behavior traceability data, and a traceability graph is generated. That is, the traceability data is obtained based on the dependency relationship formed by the sequence of generation between each object in the normal behavior data and the intrusion behavior data, and a directed acyclic graph is generated as the traceability graph based on the traceability data. Each node in the directed acyclic graph represents an object, and the directed edge represents the mutual dependency relationship between two object nodes.

[0062] Schematically, when an object P process generates an object file T during its running phase, traceability data from T->P will be generated, which means that there is a dependency relationship between file T and process P, and T depends on P. Assume that after the object P process creates object file T, it writes data to object file T. According to the above dependency relationship, the traceability data generated is P->T->P. This traceability chain forms a loop. If we understand it according to this chain, process P depends on itself, which does not conform to the law of causality. Therefore, the automatic traceability collection and storage system can distinguish the two processes by adding version information to this loop information, obtaining P.1->T->P.2, thereby destroying the ring relationship.

[0063] The structure of the automatic traceability collection and storage system (PASS) is as follows: Figure 2 As shown, it consists of the following parts:

[0064] Application: This section refers to the programs used by the user.

[0065] PASS library: This library exports the Data Protection Application Programming Interface (DPAPI) to the user layer. Users can add code to collect the traceability information they need and then send it to the PASS library via the Data Protection Application Programming Interface (DPAPI).

[0066] SOCKET: responsible for collecting network information.

[0067] Tracing interception layer: intercepts the information generated by system calls and delivers the collected data to the next layer.

[0068] Traceability detection layer: converts the information received from the previous layer into traceability data. The interception layer and the detection layer jointly generate traceability data.

[0069] Provenance Analysis Layer: This layer is used to resolve potential issues in the provenance record stream. It removes recurring traceability data from the provenance exploration layer to ensure that circular dependencies are not present in the generated data.

[0070] The PASS system primarily contains two types of traceability data. One part is raw data generated by users, such as when a user creates a new file or when a hardware device performs a task. The other part is derived information generated by the system through the management of raw data, such as system execution commands. Whenever an object is generated, the PASS system creates a unique ID identifier (pnode) based on the order of its creation time, starting from 1. In the traceability data model, nodes are traceability objects, and connections are dependencies. Each object and its attributes are shown in Table 1:

[0071] Table 1 Description of objects and attributes involved in the traceability data model

[0072]

[0073] Use the structure to encapsulate the node and name it NodeNum. Each node needs to look for the parent node upward or the child node downward. Two arrays are set in the structure to store the input and output nodes for subsequent recursive calculation of the importance value. The NodeNum structure is as follows:

[0074] struct NodeNum

[0075] {

[0076] int pnode;

[0077] int InNode[MAX_NUM];

[0078] int OutNode[MAX_NUM];

[0079] };

[0080] Where pnode is the node number of each node in the traceability graph, InNode is the input node, and OutNode is the output node.

[0081] The traceability records the historical information of the object. Since it records the dependency information between individual objects, it can be used in intrusion detection. Compared with the previously commonly used log and other methods to collect data as intrusion detection data sets, the detector can have a more systematic understanding of the entire intrusion process. During the operation process, the traceability system can record all user operations involving processes, files, pipelines, etc. as nodes. In addition, more importantly, it records the relationship between these nodes. This ensures that the traceability information collector can reproduce the operation behavior by analyzing the dependency relationship, and can also directly detect suspicious processes and files by analyzing the attribute information in the node. Therefore, this application gives the advantages of traceability information on the convolutional neural network model to achieve better detection results.

[0082] 3. For each normal behavior traceability graph and each intrusion behavior traceability graph, select a preset number of central nodes and their corresponding neighboring nodes, perform comprehensive sorting based on the importance values ​​of the central node and its corresponding neighboring nodes, as well as the distance between the central node and its corresponding neighboring nodes, and construct each normal behavior feature vector and each abnormal behavior feature vector based on the comprehensive sorting results;

[0083] In a preferred embodiment, for each normal behavior traceability graph and each intrusion behavior traceability graph, selecting a preset number of central nodes and neighboring nodes corresponding to the central nodes includes:

[0084] Calculate the importance of each node based on the dependency importance value of each node in the traceability graph of each normal behavior and each intrusion behavior, as well as the number of attributes of each node;

[0085] Based on the importance value of each node, the importance of each node is sorted, and a preset number of nodes are selected as central nodes according to the importance sorting results;

[0086] The nodes directly adjacent to each central node are ranked by importance to determine the neighboring nodes corresponding to each central node.

[0087] In a preferred embodiment, the importance value of each node is calculated using the following formula:

[0088] SI(p)=H(p)+A(p);

[0089] in,

[0090] In the formula, SI(p) is the importance value of node p, H(p) is the dependency importance value of node p, A(p) is the number of attributes of node p, Hp is the importance value of node p itself, and i is the i-th child node of node p, Mp is the node set consisting of all child nodes of node p, H(p i ) is the dependency importance value of the i-th child node of the p node.

[0091] Specifically, according to the dependency importance value of each node in the traceability graph of each normal behavior and the traceability graph of each intrusion behavior, as well as the number of attributes of each node, the importance value of each node is calculated, and the importance of each node is sorted to determine the central node of each traceability graph. The dependency relationship is used to determine the nodes directly adjacent to each central node, and the neighborhood nodes corresponding to the central node are obtained based on the importance sorting of the directly adjacent nodes.

[0092] Schematically, the object file T contains the attribute type TYPE, name NAME, INODE information and file generation time FREEZETIME, then the number of node attributes A(p) of the T node is 4. At this time, the importance value of the T node is 4 plus the dependency importance value of the T node. The dependency importance value of the T node is the sum of the own importance value of the T node and the dependency importance values ​​of all child nodes of the T node; the node's own importance value is a fixed value pre-set according to its type and criticality. For example: the self-importance value of a critical process (such as sshd) can be preset to 3, and the self-importance value of an ordinary file can be preset to 1.

[0093] In the traceability graph, the Node_Info structure of each node is constructed as follows:

[0094] struct Node_Info

[0095] {int pnode;

[0096] int H;

[0097] int Attr;

[0098] int SI;

[0099] };

[0100] In this structure, the H value is the dependency importance value, the Attr value is the number of attributes contained in the pnode node, and SI is the node importance value calculated by the formula.

[0101] The object types and attributes collected by tracing are shown in Table 2:

[0102] Table 2 Object types and attributes collected by traceability

[0103]

[0104] In a preferred embodiment, the comprehensive sorting based on the importance values ​​of the central node and the neighboring nodes corresponding to the central node, and the distance between the central node and the neighboring nodes corresponding to the central node, includes:

[0105] Sort the central node and its corresponding neighboring nodes in descending order of importance to obtain an importance sequence;

[0106] According to the distance between the neighboring nodes corresponding to each central node and the central node, the importance sequence is sorted and adjusted in order from near to far to obtain a comprehensive sorting result.

[0107] Specifically, the importance of the central node and the neighboring nodes corresponding to the central node is sorted. After the sorting is completed, the sequence is adjusted in order from near to far according to the distance between the neighboring nodes corresponding to each central node and the central node to obtain a comprehensive sorting result. Based on the comprehensive sorting result, each normal behavior feature vector and each abnormal behavior feature vector are constructed.

[0108] Construct the structure SNode linked list to save the node importance SI and the distance between the node and the central node:

[0109] struct SNode{

[0110] int SI;

[0111] int distance;

[0112] struct SNode*next;

[0113] };

[0114] The distance value represents the distance between the neighboring node and the central node. For example, the distance value of node B that is directly adjacent to node A is 1. The distance value of node C that is directly adjacent to B but has no direct relationship with A is 2. The SNode linked list is sorted to reproduce the traceability graph information to the greatest extent possible.

[0115] 4. Input each normal behavior feature vector and each abnormal behavior feature vector into the convolutional neural network model, and train the convolutional neural network model until the accuracy requirements of the convolutional neural network model are met;

[0116] Specifically, the convolutional neural network model is trained based on the known classification results of each normal behavior feature vector and each abnormal behavior feature vector, and the known classification results of each normal behavior feature vector and each abnormal behavior feature vector are compared with the output results of the convolutional neural network model. The optimization algorithm is used to reversely update the randomly filled values ​​in the forward propagation process to train a convolutional neural network model that meets the requirements.

[0117] Schematically, using the tensorflow framework, the number of convolution-pooling layers in the convolutional neural network model is set to 2, the convolution kernel size is set to 3*3, the number of bias parameters of the fully connected layer is 256, and the data and bias parameters in the convolution kernel are initialized with random values ​​according to the normal distribution. After the forward propagation operations such as convolution-pooling-activation function, the first output result is calculated. By comparing with the classification of each normal behavior feature vector and each abnormal behavior feature vector, the optimization algorithm is used to reversely update the randomly filled values ​​in the forward propagation process. Through iteration, a composite convolutional neural network model that meets the requirements is trained.

[0118] Step S3: Calculate the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in the preset rule base feature vector set. When the minimum Euclidean distance is greater than a preset threshold, it is determined that the data to be detected has intrusion behavior.

[0119] In a preferred embodiment, the Euclidean distance is calculated by the following formula:

[0120]

[0121] Where D is the Euclidean distance, n means that both the feature vector of the data to be detected and the feature vector of a normal behavior contain n elements, and x i is the i-th element in the feature vector of the data to be detected, y i is the i-th element in a normal behavior feature vector.

[0122] Specifically, the Euclidean distance calculation formula is used to calculate the Euclidean distance between the feature vector of the data to be detected and the feature vectors of each normal behavior in the preset rule base feature vector set, all calculated Euclidean distances are sorted, and the smallest Euclidean distance is selected for comparison with the preset threshold. If the smallest Euclidean distance is greater than the preset threshold, it is judged that the data to be detected has intrusion behavior, otherwise it is normal behavior.

[0123] like Figure 3 FIG. 1 is a schematic diagram of a power system cyberspace service intrusion detection device based on a traceability graph according to an embodiment of the present invention, comprising:

[0124] Data acquisition module, feature vector extraction module and intrusion behavior judgment module:

[0125] The data acquisition module is used to acquire the data to be detected of the power grid system;

[0126] The feature vector extraction module is used to input the data to be detected into the trained convolutional neural network model, and obtain the feature vector of the data to be detected through the trained convolutional neural network model; wherein, the convolutional neural network model is trained through the following steps: in the constructed virtual power grid system, normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system, and based on the normal behavior data and the intrusion behavior data, a traceability graph of each normal behavior and a traceability graph of each intrusion behavior are generated; for each traceability graph of normal behavior and each traceability graph of intrusion behavior, a preset number of central nodes and neighboring nodes corresponding to the central nodes are selected, and comprehensive sorting is performed according to the importance value of the central node and the neighboring nodes corresponding to the central node, as well as the distance between the central node and the neighboring nodes corresponding to the central node, and each normal behavior feature vector and each abnormal behavior feature vector are constructed according to the comprehensive sorting result; each normal behavior feature vector and each abnormal behavior feature vector are input into the convolutional neural network model, and the convolutional neural network model is trained until the accuracy requirement of the convolutional neural network model is met;

[0127] The intrusion behavior judgment module is used to calculate the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in the preset rule base feature vector set. When the minimum Euclidean distance is greater than a preset threshold, it is judged that the data to be detected has intrusion behavior.

[0128] Furthermore, the intrusion behavior judgment module calculates the Euclidean distance using the following formula:

[0129]

[0130] Where D is the Euclidean distance, n means that both the feature vector of the data to be detected and the feature vector of a normal behavior contain n elements, and x i is the i-th element in the feature vector of the data to be detected, y i is the i-th element in a normal behavior feature vector.

[0131] It can be understood that the above-mentioned device item embodiments correspond to the method item embodiments of the present invention, and can implement a power system cyberspace business intrusion detection method based on a traceability graph provided by any of the above-mentioned method item embodiments of the present invention.

[0132] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0133] Those skilled in the art will clearly understand that for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0134] Another preferred embodiment of the present invention provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a power system cyberspace business intrusion detection method based on a traceability graph as described in any one of the above embodiments.

[0135] It should be noted that the terminal devices mentioned herein may include computing devices such as desktop computers, laptops, PDAs, and cloud servers. Terminal devices may include, but are not limited to, processors and memory. Those skilled in the art will appreciate that, for example, terminal devices may also include input / output devices, network access devices, and buses.

[0136] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the terminal device, connecting various parts of the entire terminal device using various interfaces and lines.

[0137] The memory can be used to store the computer program, and the processor realizes various functions of the terminal device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created based on the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0138] Another preferred embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute a power system cyberspace business intrusion detection method based on a traceability graph as described in any one of the present inventions.

[0139] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. The computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium.

[0140] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A power system cyberspace service intrusion detection method based on traceability graph, characterized in that: include: Obtain the data to be tested from the power grid system; The data to be tested is input into the trained convolutional neural network model, and the feature vector of the data to be tested is obtained through the trained convolutional neural network model; Calculate the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in the preset rule base feature vector set. When the minimum Euclidean distance is greater than a preset threshold, it is determined that the data to be detected has intrusion behavior; The convolutional neural network model is trained through the following steps: In the established virtual power grid system, the normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system. Based on the normal behavior data and intrusion behavior data, the traceability diagram of each normal behavior and the traceability diagram of each intrusion behavior are generated; For each traceability graph of normal behavior and each traceability graph of intrusion behavior, a preset number of central nodes and their corresponding neighboring nodes are selected, and a comprehensive ranking is performed based on the importance values ​​of the central node and its corresponding neighboring nodes, as well as the distance between the central node and its corresponding neighboring nodes. Based on the comprehensive ranking results, a feature vector of each normal behavior and a feature vector of each abnormal behavior are constructed; Each normal behavior feature vector and each abnormal behavior feature vector are input into a convolutional neural network model, and the convolutional neural network model is trained until the accuracy requirement of the convolutional neural network model is met.

2. The method for detecting power system cyberspace services intrusion based on a traceability graph according to claim 1, characterized in that: The Euclidean distance is calculated using the following formula: Where D is the Euclidean distance, n means that both the feature vector of the data to be detected and the feature vector of a normal behavior contain n elements, and x i is the i-th element in the feature vector of the data to be detected, y i is the i-th element in a normal behavior feature vector.

3. The method for detecting power system cyberspace services intrusion based on a traceability graph according to claim 2, characterized in that: The generating of the traceability diagram of each normal behavior and the traceability diagram of each intrusion behavior based on the normal behavior data and the intrusion behavior data includes: Based on the automatic tracing collection and storage system, the dependency relationship between each object in the normal behavior data and the intrusion behavior data is determined, and the normal behavior tracing data and the intrusion behavior tracing data are obtained according to the dependency relationship between each object; Based on the normal behavior tracing data and the intrusion behavior tracing data, a tracing graph of each normal behavior and a tracing graph of each intrusion behavior are generated.

4. The method for detecting power system cyberspace services intrusion based on a traceability graph according to claim 3, characterized in that: For each normal behavior traceability graph and each intrusion behavior traceability graph, selecting a preset number of central nodes and neighboring nodes corresponding to the central nodes includes: Calculate the importance of each node based on the dependency importance value of each node in the traceability graph of each normal behavior and each intrusion behavior, as well as the number of attributes of each node; Based on the importance value of each node, the importance of each node is sorted, and a preset number of nodes are selected as central nodes according to the importance sorting results; The nodes directly adjacent to each central node are ranked by importance to determine the neighboring nodes corresponding to each central node.

5. The method for detecting power system cyberspace services intrusion based on a traceability graph according to claim 4, characterized in that: The importance value of each node is calculated using the following formula: SI(p)=H(p)+A(p); Where H(p)=Hp+∑H(p i ); p i ∈Mp In the formula, SI(p) is the importance value of node p, H(p) is the dependency importance value of node p, A(p) is the number of attributes of node p, Hp is the importance value of node p itself, and i is the i-th child node of node p, Mp is the node set consisting of all child nodes of node p, H(p i ) is the dependency importance value of the i-th child node of the p node.

6. The method for detecting power system cyberspace services intrusion based on a traceability graph according to claim 5, characterized in that: The comprehensive sorting based on the importance values ​​of the central node and the neighboring nodes corresponding to the central node, as well as the distances between the central node and the neighboring nodes corresponding to the central node, includes: Sort the central node and its corresponding neighboring nodes in descending order of importance to obtain an importance sequence; According to the distance between the neighboring nodes corresponding to each central node and the central node, the importance sequence is sorted and adjusted in order from near to far to obtain a comprehensive sorting result.

7. A power system cyberspace service intrusion detection device based on a traceability graph, characterized in that: include: Data acquisition module, feature vector extraction module and intrusion behavior judgment module: The data acquisition module is used to acquire the data to be detected of the power grid system; The feature vector extraction module is used to input the data to be detected into the trained convolutional neural network model, and obtain the feature vector of the data to be detected through the trained convolutional neural network model; wherein, the convolutional neural network model is trained through the following steps: in the constructed virtual power grid system, normal behavior data and intrusion behavior data are obtained through the automatic traceability collection and storage system, and based on the normal behavior data and the intrusion behavior data, a traceability graph of each normal behavior and a traceability graph of each intrusion behavior are generated; for each traceability graph of normal behavior and each traceability graph of intrusion behavior, a preset number of central nodes and neighboring nodes corresponding to the central nodes are selected, and comprehensive sorting is performed according to the importance value of the central node and the neighboring nodes corresponding to the central node, as well as the distance between the central node and the neighboring nodes corresponding to the central node, and each normal behavior feature vector and each abnormal behavior feature vector are constructed according to the comprehensive sorting result; each normal behavior feature vector and each abnormal behavior feature vector are input into the convolutional neural network model, and the convolutional neural network model is trained until the accuracy requirement of the convolutional neural network model is met; The intrusion behavior judgment module is used to calculate the Euclidean distance between the feature vector of the data to be detected and each normal behavior feature vector in the preset rule base feature vector set. When the minimum Euclidean distance is greater than a preset threshold, it is judged that the data to be detected has intrusion behavior.

8. The power system cyberspace service intrusion detection device based on a traceability graph according to claim 7 is characterized in that: The intrusion behavior judgment module calculates the Euclidean distance using the following formula: Where D is the Euclidean distance, n means that both the feature vector of the data to be detected and the feature vector of a normal behavior contain n elements, and x i is the i-th element in the feature vector of the data to be detected, y i is the i-th element in a normal behavior feature vector.

9. A terminal device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a power system cyberspace business intrusion detection method based on a traceability graph as described in any one of claims 1 to 6.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein, when the computer program is running, the device where the storage medium is located is controlled to execute a power system cyberspace business intrusion detection method based on a traceability graph as described in any one of claims 1 to 6.

Images