An artificial intelligence-based power monitoring system

Abstract

The present invention discloses an artificial intelligence-based power monitoring system, which relates to the field of power monitoring technology, including: extracting behavioral disturbance units from power system communication, operation and configuration logs; constructing a disturbance sequence by chronologically sequencing the behavioral disturbance units and the power system module dependencies; using the disturbance sequence to train a counterfactual generation network to form a counterfactual trajectory that corresponds one to one with the disturbance sequence; comparing the disturbance sequence with the counterfactual trajectory node by node, extracting deviation points and combining them into an attack evolution chain; constructing a multidimensional action prediction tensor based on the attack evolution chain to infer the probability distribution of the attacker's next action; dynamically adjusting the power monitoring system defense resources according to the output result of the action prediction tensor, and implementing specific granularity limitation, deception or diversion operations to interrupt the extension of the attack evolution chain. The present invention can gradually restore the attack path from the detected abnormal behavior and predict the attacker's possible next action.

Description

Technical Field

[0001] The present invention relates to the technical field of power monitoring, and in particular to a power monitoring system based on artificial intelligence. Background Art

[0002] In modern power systems, dispatch automation, remote control, and distributed monitoring have become core means of ensuring efficient energy transmission and stable grid operation. As power monitoring systems evolve toward a highly information-based, networked, and intelligent approach, their underlying support platforms are gradually integrating industrial control protocols, edge acquisition terminals, centralized dispatch hubs, and cloud-based data processing centers, building a cross-layer, cross-regional collaborative control system. However, the complex structure and open interfaces of power monitoring systems also expose them to increasingly severe cyberattack threats. These include covert intrusions exploiting device configuration flaws, command injection, and communication link tampering, all of which possess complete chain-like evolutionary capabilities and dynamic evasion capabilities.

[0003] Existing security protection mechanisms generally focus on rule matching, traffic feature analysis, or anomaly detection based on isolated events. These mechanisms struggle to capture the causal chain behind attack behavior, and are even more incapable of effectively revealing the complete path an attacker takes as they gradually infiltrate, probe, exploit, and execute critical attacks within the system. Therefore, power monitoring systems urgently need an intelligent analysis mechanism capable of contextual modeling, tracing behavioral deviations, and proactively predicting attack intent. This allows for coordinated, proactive defense from the perception layer to the control layer.

[0004] Based on this, the core technical problem that needs to be solved urgently is: how to build an attack chain analysis model with causal modeling and behavioral reasoning capabilities, which can gradually restore the attack path from the detected abnormal behavior and predict the attacker's possible next action to support the real-time defense response and strategy adjustment of the power monitoring system. Summary of the Invention

[0005] In order to solve the above technical problems, the present invention provides an artificial intelligence-based power monitoring system.

[0006] To achieve the above object, the technical solutions adopted by the present invention are as follows:

[0007] In one aspect, the present invention discloses an artificial intelligence-based power monitoring system, comprising the following steps:

[0008] Behavioral disturbance unit extraction module: extracts behavioral disturbance units from power system communication, operation and configuration logs, where a behavioral disturbance unit is defined as an atomic operation event that deviates from the baseline model;

[0009] Perturbation sequence construction module: This module constructs a perturbation sequence by chronologically arranging the behavioral perturbation units and their dependencies on the power system modules. Each perturbation sequence represents a potential exploration or operation chain of an attacker in the power system.

[0010] Counterfactual trajectory generation module: This module uses the perturbation sequence to train the counterfactual generation network, deduce the optimal execution trajectory that the system should exhibit under non-attack conditions, and form a counterfactual trajectory that corresponds one-to-one to the perturbation sequence;

[0011] Attack evolution chain restoration module: This module compares the perturbation sequence with the counterfactual trajectory node by node, extracts deviation points, and combines them into an attack evolution chain. The attack evolution chain depicts the attacker's true intrusion path and operational context.

[0012] Action Prediction Tensor Reasoning Module: This module constructs a multi-dimensional action prediction tensor based on the attack evolution chain. The tensor axes include operation type, target component, and intervention intensity, which is used to infer the probability distribution of the attacker's next action.

[0013] Response strategy trigger module: Based on the action prediction tensor output results, dynamically adjust the power monitoring system defense resources, implement specific granularity limitation, deception or diversion operations to interrupt the extension of the attack evolution chain.

[0014] Furthermore, the behavior perturbation unit extraction module includes a functional structure for executing a baseline model construction phase, wherein the baseline model construction phase includes:

[0015] Under the premise that the power monitoring system operates in an environment without attack disturbances, communication logs, operation logs, and configuration logs covering multiple complete scheduling cycles are collected, and the high confidence of the collected samples is ensured through environmental integrity marking;

[0016] An event semantic embedding network is used to transform the original event into a high-dimensional vector representation including the operation type number, execution module identifier, event trigger condition type, operation parameter feature vector and execution result indicator code;

[0017] Construct an encoder-decoder structure based on a bidirectional long short-term memory network to perform supervised training on event sequences, and introduce time interval regularization terms and module dependency constraints to improve reconstruction accuracy;

[0018] When the reconstruction error of the validation set converges to a preset threshold, the model is solidified as the original baseline behavior model, and the risk of model failure is monitored through a model drift detector.

[0019] The original benchmark behavior model is output in the form of a structured sequence prediction function set, and provides a subsequent module calling interface through an event-by-event error vector.

[0020] Further: the perturbation sequence building module includes:

[0021] A module dependency graph between power monitoring power system modules is constructed using static structure extraction and dynamic call tracing methods. The module dependency graph is a directed weighted graph with time sequence attributes.

[0022] A unified timeline mapping mechanism is used to process behavioral disturbance units from communication logs, operation logs, and configuration logs, and the time of disturbance units is normalized using the master node time as the reference source.

[0023] A sliding window aggregation algorithm is used to divide the normalized behavior perturbation units into multiple initial perturbation sequences according to the adjacent relationships in the module dependency graph, with the starting unit and the ending unit as the sequence boundaries.

[0024] The connectivity of the perturbation sequence on the module dependency graph is verified by the shortest path heuristic subgraph matching algorithm, and redundant perturbation units that do not meet the causal path requirements are automatically eliminated;

[0025] A unique perturbation sequence identification code is generated for each verified perturbation sequence, a structured perturbation sequence object is constructed, and the output is cached.

[0026] Further: the counterfactual trajectory generation module includes:

[0027] Based on the perturbation sequence set output by the perturbation sequence construction module and the benchmark execution sequence without abnormal offset provided in the benchmark model construction phase, structural alignment is performed using a module dependency graph path matching algorithm to generate training sample pairs of the perturbation sequence and the benchmark execution sequence;

[0028] A counterfactual generation network with a dual-input encoding structure is constructed. The network includes a perturbation sequence encoder for extracting the operation type flow, module path flow, and time rhythm flow in the perturbation sequence, and a context embedder that inputs the power monitoring power system module dependency graph and system state summary vector. The structured trajectory decoder combines this information to generate a counterfactual trajectory event sequence that conforms to the module dependency constraints.

[0029] The trajectory consistency scoring function is jointly constructed by behavioral semantic similarity, module path consistency rate and state response consistency. Multiple candidate counterfactual trajectories are evaluated, and the one with the lowest score is eliminated. Finally, the only optimal counterfactual trajectory is retained as the counterfactual corresponding trajectory of the perturbation sequence.

[0030] And output a structured trajectory pair, which includes a unique identification code of the perturbation sequence, a list of counterfactual trajectory events, a module path reconstruction graph, and a behavior consistency score vector, as input to the subsequent attack evolution chain restoration module.

[0031] Further: the attack evolution chain restoration module includes:

[0032] By constructing a structural alignment mapping relationship based on module position matching, operation type similarity calculation and time series consistency constraints, a node alignment list between the perturbation sequence and the counterfactual trajectory is generated;

[0033] Based on the node alignment list, each pair of operation nodes is analyzed for differences to identify deviation conditions such as inconsistent operation types, abnormal execution order, illegal execution parameters, or newly added unmatched nodes. Nodes that meet these conditions are marked as deviation points.

[0034] Based on the module dependency graph, the deviation points are sorted in time order and the paths are completed. Implicit path derivation nodes are introduced where necessary to construct an attack evolution chain object that includes node sequences, edge paths, perturbation and counterfactual position offset vectors, and a timestamp difference list.

[0035] The structural consistency of the attack evolution chain is calculated through deviation density, continuity score and module span score, and the effective evolution chain is screened for subsequent action prediction tensor reasoning processing.

[0036] Further: the action prediction tensor reasoning module includes:

[0037] Based on the attack evolution chain structure object, the deviation node sequence and its corresponding operation type, target component and intervention intensity features are extracted to construct a three-axis action prediction tensor defined by the operation type dimension, target component dimension and intervention intensity dimension.

[0038] A graph attention network is used to perform sequential modeling and probabilistic reasoning on the attack evolution chain node context and power system module dependencies, dynamically estimating the trigger probability of each combination of operation type, target component, and intervention intensity.

[0039] The action prediction tensor is processed through three-axis Softmax normalization to generate an interpretable and comparable next action probability distribution;

[0040] The high-confidence prediction results of operation types, target components, and intervention intensity in the probability distribution are encapsulated as structured prediction objects for calling by the response strategy triggering module.

[0041] Furthermore, the response strategy triggering module includes:

[0042] Based on the action prediction tensor, the operation type, target component, and intervention intensity tuple with the highest prediction probability are extracted. Combined with the safety level identification in the power system module dependency graph, a comprehensive risk score is calculated to screen high-risk prediction operation tuples and build a response trigger queue.

[0043] The policy-action mapping rule engine matches response action templates in a predefined response rule library. This response rule library is based on operation type matching patterns, target component labels, and intervention intensity ranges. Response actions include restricted operations, deceptive operations, and diversion operations. Response action templates support parameterized generation of specific execution instructions.

[0044] The response action is verified for dependency consistency and state constraints through the secure resource scheduler. After verification, it is executed sequentially as atomic operations, and the execution results are recorded in the response log.

[0045] In the attack evolution chain structure, the path nodes affected by the response action are marked as breakpoints, and the disturbance hit status of the breakpoint nodes is continuously monitored. If there is no disturbance at the breakpoint node for multiple cycles, the attack evolution chain is marked as terminated. Otherwise, the delayed recovery monitoring mode is maintained to ensure dynamic interruption and continuous protection of the attack evolution chain.

[0046] Compared with the prior art, the present invention has the following technical advances:

[0047] The present invention uses a behavioral perturbation unit extraction module to accurately identify each atomic operation event that deviates from the normal execution trajectory, namely the behavioral perturbation unit, in the communication log, operation log and configuration log of the power monitoring system based on structured event modeling and benchmark behavior sequence comparison. This granularity is much smaller than the traditional detection method based on traffic characteristics or log keywords. It not only avoids misjudgment and missed judgment, but also provides a fine-grained temporal semantic basis for subsequent path construction, so that the attack chain analysis has a high degree of accuracy. In the perturbation sequence construction module, the system does not simply time-order abnormal events, but introduces the module dependency graph within the power monitoring system as an association constraint to construct a potential operation chain that each attacker may promote within the system. This method can automatically avoid the interference of irrelevant perturbation noise and accurately restore the attacker's phased behavioral intention to infiltrate from the periphery to the core module, thereby forming a preliminary attack chain with reasonable operation sequence and component path integrity.

[0048] Traditional systems lack a clear path reference for comparing attack states and normal states. The counterfactual trajectory generation module in this invention introduces a trained generative network mechanism. Based on existing perturbation sequences, it deduces the optimal execution trajectory of the system in the absence of an attack, generating counterfactual trajectories that correspond one-to-one with each perturbation sequence. This design enables the identification of deviation points in the attack evolution path to be structurally comparable and logically interpretable, greatly enhancing the credibility and interpretability of subsequent attack chain reconstruction.

[0049] With the help of the attack evolution chain restoration module, the system compares the disturbance sequence with the counterfactual trajectory node by node, extracts the real offset points, and then combines them to form an attack evolution chain that highly fits the attacker's operation logic, and has clear time index and module path information. This chain not only supports backward tracing of the source of the attack, but also supports forward deduction of the attack purpose, providing the system with a continuous and explainable intrusion reasoning basis in both the time dimension and the logical dimension.

[0050] The action prediction tensor reasoning module and the response strategy triggering module in the system work together to construct a three-axis tensor (operation type, target component, and intervention intensity) based on the attack evolution chain, realizing high-dimensional probabilistic reasoning about the attacker's next behavior. The strategy mapping engine then dynamically generates limitation, deception, and steering operations corresponding to the reasoning results. This can not only interrupt the attack chain extension path in advance, but also guide the attacker into a misleading trajectory, effectively realizing intelligent control in the attack and defense game.

[0051] In summary, starting from anomaly detection, the present invention gradually establishes an integrated intelligent attack chain analysis mechanism that is data-driven, structural modeling, causal reasoning, and dynamic response. It can gradually restore the attack path from the detected abnormal behavior and predict the attacker's possible next action. It is significantly superior to traditional security technology paths based on rules, static strategies or isolated event analysis, and has stronger attack perception granularity, deeper behavior interpretation capabilities and higher response decision-making intelligence. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0053] In the attached figure:

[0054] Figure 1 This is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0055] The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present invention will be described below with reference to the accompanying drawings.

[0056] like Figure 1 As shown, the present invention discloses an artificial intelligence-based power monitoring system, comprising:

[0057] Behavioral disturbance unit extraction module: extracts behavioral disturbance units from power system communication, operation and configuration logs, where a behavioral disturbance unit is defined as an atomic operation event that deviates from the baseline model;

[0058] Perturbation sequence construction module: This module constructs a perturbation sequence by chronologically arranging the behavioral perturbation units and their dependencies on the power system modules. Each perturbation sequence represents a potential exploration or operation chain of an attacker in the power system.

[0059] Counterfactual trajectory generation module: This module uses the perturbation sequence to train the counterfactual generation network, deduce the optimal execution trajectory that the system should exhibit under non-attack conditions, and form a counterfactual trajectory that corresponds one-to-one to the perturbation sequence;

[0060] Attack evolution chain restoration module: This module compares the perturbation sequence with the counterfactual trajectory node by node, extracts deviation points, and combines them into an attack evolution chain. The attack evolution chain depicts the attacker's true intrusion path and operational context.

[0061] Action Prediction Tensor Reasoning Module: This module constructs a multi-dimensional action prediction tensor based on the attack evolution chain. The tensor axes include operation type, target component, and intervention intensity, which is used to infer the probability distribution of the attacker's next action.

[0062] Response strategy trigger module: Based on the action prediction tensor output results, dynamically adjust the power monitoring system defense resources, implement specific granularity limitation, deception or diversion operations to interrupt the extension of the attack evolution chain.

[0063] Specifically include:

[0064] During the implementation of the behavioral disturbance unit extraction module, the baseline model construction phase serves as the starting point for the entire behavioral deviation detection logic. Its core task is to build a stable, fine-grained, and structurally reducible original baseline behavioral model. This model must be able to fully characterize the normal operation of the power monitoring system in a safe state and serve as a reference for subsequent judgments on the existence of behavioral disturbance units. The implementation process of this module specifically includes the following sub-steps:

[0065] First, the system operates stably for a long period of time without being affected by any intrusion. For the three key behavior sources of communication logs, operation logs and configuration logs, a unified log extraction interface is used to collect time-continuous data samples. During the collection process, the system administrator performs manual confirmation and environmental verification to ensure that all collected data comes from an environment without attack disturbances. The collected data is also marked for environmental integrity, providing a high-confidence supervision basis for subsequent training.

[0066] Subsequently, an encoding mechanism based on the Operation Semantic Embedding Network (OSEN) was used to convert the original events recorded in the log (such as "substation controller setting value modification" or "RTU connection interruption and restoration") into a unified high-dimensional vector representation. Each event vector encoding includes the following five types of information components:

[0067] (1) Operation type number;

[0068] (2) Execution module identification;

[0069] (3) Event trigger condition type;

[0070] (4) Operation parameter feature vector (including numerical and structural parameters);

[0071] (5) Execution result indicator code.

[0072] This embedding expression allows subsequent models to capture fine-grained changes between operations in time series modeling and avoids the diffusion of model training errors caused by inconsistent operation semantics.

[0073] After event embedding, an encoder-decoder framework based on a bidirectional long short-term memory (Bi-LSTM) network is used to perform supervised learning training on the collected multiple continuous event sequences. The model training objective is to maximize the restoration of the operation order, temporal intervals, and coupling relationships between behaviors in the input event sequence, and to ensure that the cosine similarity between the output sequence and the input embedding sequence approaches 1 during convergence. During training, a time interval regularization term and a module dependency constraint term are introduced as auxiliary loss functions to penalize reconstruction paths in the prediction results that violate component dependencies or temporal logic, thereby improving the model's ability to fit the real-world system execution behavior.

[0074] When model training reaches a stable state (with the reconstruction error on the validation set fluctuating within a range of less than 1.5%), the encoder-decoder model parameters are solidified and encapsulated as the original baseline behavior model. To prevent the baseline model from aging during system evolution, this module also implements a Model Drift Verifier. This detector regularly checks for systematic drift in the reconstruction error distribution between the current running behavior and the baseline model. If a drift trend is established, the model retraining process is triggered. However, this action is manually executed after manual confirmation by the system to ensure that the model evolution is consistent with the security context.

[0075] Ultimately, the original baseline behavior model provides external services in the form of a set of structured sequence prediction functions: for any structured event input sequence of length N, it can output a prediction sequence of length N and an event-by-event error vector. This output interface will be repeatedly called in subsequent steps—the perturbation sequence construction module and the counterfactual trajectory generation module—to determine whether each event constitutes a behavioral perturbation unit.

[0076] As mentioned above, the benchmark model construction phase not only achieves high-precision system behavior modeling, but also ensures that the identification basis of behavioral perturbation units is traceable, adaptable, and comparable through the combination of semantic embedding, bidirectional LSTM modeling, and model drift mechanism, providing a strong constraint basis for the logical flow between modules.

[0077] After the behavior perturbation unit extraction module successfully outputs a series of behavior perturbation units that have been rigorously verified by reconstruction deviation, the core task of the perturbation sequence construction module is to assemble these atomic-level behavior perturbation units into structured perturbation sequences with causal chain characteristics based on the chronological order of operations and the system's internal module dependency graph. Each perturbation sequence corresponds to a potential intrusion stage or operational exploration path. The implementation process of this module can be divided into the following sub-steps:

[0078] This sub-step combines static structure extraction with dynamic call tracing to establish a module dependency graph between the control modules in the power monitoring system. Each node in the dependency graph represents a power system module with independent functions (such as remote terminal unit management, SCADA interface management, voltage regulation control, etc.), and each directed edge represents the data flow, control call or logical dependency relationship between modules.

[0079] Static structure extraction analyzes control system configuration files and system description templates (such as IEC 61850 SCL files) to obtain module topology boundaries. Dynamic call tracing uses runtime instrumentation to record the call frequency and interaction paths between modules, dynamically supplementing any implicit edges that may be missed in the static dependency graph. The final output is a directed, weighted module dependency graph with timing properties, which is used to determine the connectivity of subsequent perturbation paths.

[0080] Given that behavioral perturbation units may come from different log sources (communication logs, operation logs, configuration logs), and their recorded time granularity may be asynchronous, the timestamp information of all behavioral perturbation units must be normalized before the perturbation sequence is spliced. This process uses a unified timeline projection algorithm (Unified Timeline Projection Algorithm), using the system master node's clock as the reference source. The timestamps of all perturbation units are uniformly converted to standard UTC time and merged with a ±ε tolerance to ensure deterministic event sequencing within the tolerance range.

[0081] After all time-normalized behavioral perturbation units are sorted chronologically, an initial perturbation sequence is constructed using a sliding window aggregation algorithm. The window size is determined by the average system interaction period and the operation response latency. If multiple behavioral perturbation units occur between adjacent modules on the dependency graph within a time window, they are considered to be part of the same potential perturbation chain and included in the same perturbation sequence instance. Each perturbation sequence is marked by a starting unit and an ending unit as boundaries.

[0082] To ensure that each disturbance sequence is connected and executable on the power system module dependency graph, a shortest path heuristic subgraph matching algorithm is used to verify the constructed disturbance sequence: if no actual directed path can be found between any two adjacent behavioral disturbance units in the sequence on the module dependency graph, the system will trigger a sequence reconstruction mechanism, automatically attempting to expand the sequence boundary to the left or right, or remove the current disturbance unit from the sequence and retry in the next round of window scanning. This operation can effectively eliminate isolated disturbance units introduced by misselection or misjudgment, improving the semantic integrity of the disturbance sequence.

[0083] For each perturbation sequence that passes connectivity verification, the system generates a unique perturbation sequence identification code based on the set of behavioral perturbation units, module dependency graph path signature, and start and end timestamps. All perturbation sequences are then encapsulated as a structured data object for persistent caching. The structured object includes the following fields:

[0084]

[0085] These perturbation sequence objects will serve as the input basis for the next module, the counterfactual trajectory generation module, and become the initial structural unit for the system to further deduce the attack path.

[0086] After the perturbation sequence construction module outputs a series of perturbation sequences with clear temporal order, complete structural connectivity, and clear module dependency paths, the core task of the counterfactual trajectory generation module is to construct a counterfactual generation network with causal reasoning capabilities. Using this network, each perturbation sequence is used as input to infer the optimal execution trajectory that the system should exhibit in the absence of attack perturbations. In other words, counterfactual trajectories that correspond one-to-one with the original perturbation sequence are generated. These serve as a comparison benchmark for attack deviation behavior modeling and path evolution judgment in subsequent modules. The implementation process of this module includes the following substeps:

[0087] To train a counterfactual generation network capable of contrastive reasoning, it is first necessary to construct a large number of perturbation-non-perturbation sample pairs. To this end, the system selects a set of real-world, non-anomalous baseline execution sequences from the original baseline behavior model training set used by the behavior perturbation unit extraction module as target trajectory samples. It also uses the set of perturbation sequences constructed in the perturbation sequence construction module as input trajectory samples. Subsequently, a path matching algorithm on the module dependency graph is used to structurally align the perturbation sequences with the baseline execution sequences, selecting sample pairs with the most similar topology and time span to form a set of [perturbation sequence, optimal trajectory] tuples for training.

[0088] Based on the above training sample pairs, a counterfactual trajectory generator (CTG) with time series modeling and structure generation capabilities is constructed. The network adopts a dual-input encoding structure. The encoder on the left is responsible for reading the disturbance sequence and extracting the three main lines of the disturbance trajectory: operation type flow, module path flow, and time rhythm flow. The embedder on the right inputs the static module dependency graph of the power monitoring system and the current system state summary vector to form the deduction context. Subsequently, the encoder output and the context embedding are fused in the decoder, and the structure-aware trajectory decoder (Structure-Aware Trajectory Decoder) gradually generates each atomic operation event in the counterfactual trajectory. The output event sequence must meet the following three constraints:

[0089] All operations must exist on a reachable path in the module dependency graph;

[0090] The time interval between generated events does not exceed the maximum deviation range in the perturbation trajectory;

[0091] The system state changes conform to the action-response mapping rules defined in the baseline model of the behavioral disturbance unit extraction module.

[0092] Since the perturbation sequence may have more than one legal counterfactual trajectory candidate, the system needs to calculate the consistency score between each generated result and the baseline behavior pattern. The score consists of three parts:

[0093] (1) Behavioral semantic similarity (i.e., the average cosine similarity between the embedding vectors of atomic operation types);

[0094] (2) Module path consistency rate (the degree of path overlap between the generated path and the original path in the module dependency graph);

[0095] (3) State response consistency (the difference between the system state simulation results corresponding to the generated event sequence and the historical baseline state).

[0096] The candidate solution with the lowest score will be eliminated, and finally the only counterfactual trajectory with the highest score will be retained as the counterfactual corresponding trajectory of the current perturbation sequence.

[0097] After completing the counterfactual trajectory generation for each perturbation sequence, the system will generate a structured trajectory pair, including:

[0098] Unique identification code of the perturbation sequence (inherited from the output of the perturbation sequence construction module);

[0099] The corresponding list of counterfactual trajectory events (sorted by standard timestamp);

[0100] Module path reconstruction diagram (for visual path comparison);

[0101] Behavioral consistency score vector (used for downstream module deviation point extraction);

[0102] This structured trajectory pair will serve as the core input for the next module, the attack evolution chain restoration module, and node-level difference comparison and attack path identification will be performed based on this.

[0103] After the counterfactual trajectory generation module has successfully constructed a counterfactual trajectory corresponding to each perturbation sequence, the core task of this module is to perform a node-by-node bidirectional structural comparison between the perturbation sequence and the corresponding counterfactual trajectory, accurately identifying significant deviations in operation content, module paths, behavioral rhythm, and response logic between the two, and assembling these deviations into a clear and logical attack evolution chain according to the topological order and chronological sequence of the dependency graph. This attack evolution chain, as a structured representation of the attack behavior, depicts the attacker's actual intrusion path and operational context in the power monitoring system, providing behavioral-level evidence for subsequent prediction and response. The implementation of the entire module can be divided into the following sub-steps:

[0104] First, to achieve high-precision node-level difference extraction, a structural alignment mapping relationship must be established between the perturbation sequence and each atomic operation event in the counterfactual trajectory. This mapping is achieved through three criteria:

[0105] Module location matching: Only operations occurring on the same power system module are allowed as candidate alignment pairs;

[0106] Operation type similarity calculation: Use the event semantic embedding space used in the behavior perturbation unit extraction module to calculate the cosine similarity between two atomic operation events. Those exceeding a threshold (e.g., 0.85) are considered to be aligned.

[0107] Time series consistency constraint: The position of the perturbation operation on the time axis must not be reversed from its predicted position in the counterfactual trajectory, ensuring the consistency of the operation context.

[0108] Finally, the system generates a set of node alignment lists based on the above three constraints, each of which records the pairing of the disturbance event with its theoretical normal position.

[0109] After establishing the node alignment list, the system analyzes each pair of operations in turn to see if there are significant differences. Any node pair that meets any of the following deviation conditions is considered a valid deviation point:

[0110] The operation types are completely inconsistent (i.e., the semantic similarity is lower than the set threshold, such as 0.5);

[0111] The order of operations is significantly swapped or advanced (for example, an operation occurs at a point in the dependency graph where it should not be executed before its dependent modules);

[0112] The execution parameters of the operation have no corresponding reasonable values ​​in the counterfactual trajectory (for example, the control value is tampered with to an illegal range);

[0113] There is no matching node for the atomic operation event in the counterfactual trajectory (i.e., it is a newly added suspicious operation).

[0114] Each identified deviation point will be classified and labeled according to the following labels:

[0115] Type I deviation: unexpected operation in a legitimate module (internal exception);

[0116] Type II deviation: module external path intrusion (unauthorized behavior);

[0117] Type III deviation: execution order violation (timing speculation);

[0118] Type IV deviation: Completely new operation (implanted behavior).

[0119] All labels will be used to construct node attributes of the attack evolution chain.

[0120] The system arranges all deviation points in ascending order by timestamp and performs path completion and chain building based on the original module dependency graph in the perturbation sequence construction module. If there is a reachable path in the dependency graph between two non-directly connected deviation points, the intermediate modules on the path are marked as implicit path derivation nodes to ensure the structural traceability and integrity of the attack evolution chain. Finally, an attack evolution chain object is formed that includes the following structural information:

[0121] Node sequence (each node is an operation event with a deviation label)

[0122] Edge paths (connection paths on the module dependency graph)

[0123] Perturbation and counterfactual position offset vector

[0124] List of differences between the original event timestamp and the predicted timestamp

[0125] 4.4 Attack Evolution Chain Consistency Assessment and Optimization Reconstruction

[0126] Since some perturbation sequences may include non-aggressive random fluctuations, the system scores the constructed attack evolution chain for structural consistency, including:

[0127] Deviation density (ratio of the number of deviant nodes to the total number of nodes)

[0128] Continuity score (minimum length of a segment without deviation nodes in the attack evolution chain)

[0129] Module span score (number of system subdomains spanned)

[0130] If the score of an attack evolution chain is lower than the set security threshold (for example, the deviation density is <20%), the system will automatically mark it as an inactive chain and enter the delayed judgment pool to avoid misidentifying the error as an intrusion path; if the score is higher than the threshold, it will be marked as a valid evolution chain and directly handed over to the next module for tensor inference processing for the next action prediction.

[0131] After completing the structured attack evolution chain construction in the attack evolution chain restoration module, this module uses the deviation node sequence included in the attack evolution chain as input, combines the power system module dependency graph and the dynamic feature vectors in the attack path, and constructs a multidimensional action prediction tensor with high-dimensional behavioral state expression capabilities. This tensor serves as a carrier for inferring the attacker's next behavior. Its axis dimensions are clearly divided into the operation type dimension, the target component dimension, and the intervention intensity dimension. Through a probabilistic reasoning mechanism, it predicts the attacker's most likely next atomic operation behavior, achieving high-granularity, high-confidence forward-looking modeling of the intrusion evolution path. The implementation of the entire module can be divided into the following sub-steps:

[0132] 5.1 Attack Evolution Chain Embedding Representation Generation

[0133] To achieve the connection between the prediction model and the structured input data, this step first requires converting all deviation nodes in the attack evolution chain into a unified time series embedding representation. Each deviation node includes the following five types of feature information in the embedding vector:

[0134] The original action type encoding (derived from the semantic embedding model of the behavior perturbation unit extraction module);

[0135] The module path location encoding (topological coordinates in the module dependency graph);

[0136] Intervention label encoding (inheriting deviation type tags in the attack evolution chain restoration module, such as "overstepping authority" and "speculation");

[0137] Time offset vector (indicates the duration and rhythm amplitude of the node's deviation from the counterfactual trajectory);

[0138] Behavioral consistency residual (representing the residual error between the atomic operation and the corresponding counterfactual node).

[0139] All node embedding vectors are concatenated in the original attack time order to form a temporal embedding matrix of the attack evolution chain, which will serve as the main input of the prediction tensor generation network.

[0140] Next, the system constructs a three-dimensional Action Prediction Tensor (APT), whose three axes are defined as follows:

[0141] The first axis (operation type axis): enumerates all types of atomic operation instructions supported by the system;

[0142] The second axis (target component axis): enumerates all system component instances that can be directly operated in the module dependency graph;

[0143] The third axis (intervention intensity axis): defines the level of impact that operational behavior may have on the system state, divided into four levels: 0 (no impact), 1 (weak intervention), 2 (medium intervention), and 3 (strong intervention).

[0144] For each set of three-axis coordinate combinations, that is, a cell of the three-dimensional tensor, the system initializes it as the estimated probability of the operation-component-strength combination being triggered in the context of the current attack evolution chain. This estimate will be dynamically calculated in the next step through the graph attention mechanism.

[0145] The system employs an improved Graph Attention Network (GAT) architecture. Its underlying graph structure is the power system module dependency graph constructed in the perturbation sequence building module. Each module is represented as a node in the graph, and the embedding vector of each deviation node serves as the node's contextual feature. A multi-head attention mechanism is used to capture the conditional probabilistic dependencies of operational transitions between adjacent modules.

[0146] The network's training goal is to ensure that, for the next action in a historical attack evolution chain, its tensor unit has a significantly higher probability of activation in the current context than other candidate actions. During network training, an edge-weight sparse regularization term and a temporal feedforward guidance term are introduced to ensure that the model more accurately reflects the attacker's dynamic target selection patterns.

[0147] After completing the graph attention calculation, the system performs a three-axis Softmax normalization on the entire action prediction tensor to ensure that the probability distribution along each dimension is interpretable and comparable. Finally, the system extracts the three-axis coordinate combinations with the highest probability values ​​(e.g., the top 3) from the tensor as the prediction output. These combinations represent the atomic operation type, target component location, and impact intensity level that the attacker is most likely to perform in the next few steps within the context of the current attack evolution chain. The prediction result is encapsulated as a structured object, including the following fields:

[0148] Prediction ID (inherited attack evolution chain identification code);

[0149] A list of Top-N predicted operation tuples (each item is <operation type, target component, intervention intensity, predicted probability>);

[0150] Current context summary (summary vector of the node at the end of the attack evolution chain);

[0151] Module path dependency evidence (path segment references for decision tracing).

[0152] This prediction structure will serve as the direct input basis for the response strategy triggering module and drive the generation of adaptive deployment strategies for defense resources in the power monitoring system.

[0153] After the action prediction tensor inference module has output an action prediction tensor with clear probability weights, this module aims to utilize the multidimensional probability distribution information about the attacker's possible next behavior in this tensor. Combined with the current operating status and security policy level of the power monitoring system, this module implements a set of response strategy actions with granular controllable, triggerable rollback, and verifiable operation without interfering with normal operation. This allows for the proactive interruption and guided interference of the future path of the attack evolution chain. The implementation of the entire module is divided into the following sub-steps:

[0154] This step first extracts the top-N operation tuples (operation type, target component, intervention intensity) with the highest predicted probability from the action prediction tensor. The target component is then risk-weighted based on the security level identifier of the current system component in the module dependency graph (e.g., "protection level," "control level," or "acquisition level"). Subsequently, a risk score is calculated for each predicted operation tuple based on the following three joint criteria:

[0155] The predicted probability value itself (representing the strength of the attack intention);

[0156] Component criticality score (reflects the importance of the component in the system);

[0157] The intervention intensity rating (indicates how damaging the potential impact will be).

[0158] The system sets a dynamic response trigger threshold. Any prediction operation tuple whose total risk score exceeds the threshold will be included in the response trigger queue and serve as the trigger input for subsequent strategy generation.

[0159] For each prediction action tuple in the trigger queue, the system uses the Policy-Action Mapping Engine to search for a matching item in the predefined response rule base. The response rule base is built with a ternary conditional structure, and each rule has the following form:

[0160] <Operation type matching pattern, target component label, intervention intensity range> → <Response action template>

[0161] Response action templates include the following three types of policy actions:

[0162] Restricted operations: such as automatically lowering component access levels, blocking remote call interfaces, and temporarily switching control permissions to read-only mode;

[0163] Deception operations: For example, implanting fake component instances around the predicted component to trick the attacker into accessing non-authentic control channels and gather real intentions.

[0164] Steering operation: Actively changing the system call path or data dependency path to invalidate the attacker's expected path, thereby delaying the attack behavior and disrupting the consistency of the attack chain.

[0165] Policy action templates include parameterizable fields that allow for dynamic generation of specific execution instructions based on tensor inputs.

[0166] All matched response policy actions will be included in the policy execution plan queue and deployed sequentially by the system's security resource scheduler without affecting key business operations. To ensure that the response policy does not disrupt system consistency before and after execution, the scheduler will perform the following two verifications on each policy before execution:

[0167] Dependency consistency verification: Ensures that the response action does not destroy the existing control path loop in the current module dependency graph;

[0168] State constraint verification: Ensures that response execution does not cause system state jumps or invalid outputs (such as incorrect switching of voltage levels, incorrect restart of equipment, etc.).

[0169] Verified policy actions will be executed as atomic operations in the system's secure transaction channel. The execution results will be recorded in the response log and submitted to the downstream policy feedback module for analysis and evaluation.

[0170] After a response action is successfully deployed, the system will mark breakpoints in the attack evolution chain structure for all predicted path nodes affected by the response. These nodes will be marked as "High Confidence Prediction → Responded to Interruption" status. The system will continuously monitor these breakpoint nodes during subsequent operation cycles to see if they are still being hit by the perturbation sequence. If no actual perturbation occurs for multiple consecutive cycles, the attack evolution chain will be marked as "Terminated." Otherwise, it will enter "Delayed Recovery Monitoring Mode" to keep the response strategy in effect until the status is cleared.

[0171] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art will be able to modify the technical solutions described in the aforementioned embodiments or substitute equivalents for some of the technical features. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. An artificial intelligence-based power monitoring system, characterized in that: include: Behavioral disturbance unit extraction module: extracts behavioral disturbance units from power system communication, operation and configuration logs, where a behavioral disturbance unit is defined as an atomic operation event that deviates from the baseline model; Perturbation sequence construction module: This module constructs a perturbation sequence by chronologically arranging the behavioral perturbation units and their dependencies on the power system modules. Each perturbation sequence represents a potential exploration or operation chain of an attacker in the power system. Counterfactual trajectory generation module: This module uses the perturbation sequence to train the counterfactual generation network, deduce the optimal execution trajectory that the system should exhibit under non-attack conditions, and form a counterfactual trajectory that corresponds one-to-one to the perturbation sequence; Attack evolution chain restoration module: This module compares the perturbation sequence with the counterfactual trajectory node by node, extracts deviation points, and combines them into an attack evolution chain. The attack evolution chain depicts the attacker's true intrusion path and operational context. Action Prediction Tensor Reasoning Module: This module constructs a multi-dimensional action prediction tensor based on the attack evolution chain. The tensor axes include operation type, target component, and intervention intensity, which is used to infer the probability distribution of the attacker's next action. Response strategy trigger module: Based on the output results of the action prediction tensor, dynamically adjust the defense resources of the power monitoring system, and implement corresponding granularity limitation, deception or diversion operations to interrupt the extension of the attack evolution chain.

2. The power monitoring system based on artificial intelligence according to claim 1, characterized in that: The behavior perturbation unit extraction module includes functional structures for executing a baseline model construction phase, which includes: Under the premise that the power monitoring system operates in an environment without attack disturbances, communication logs, operation logs, and configuration logs covering multiple complete scheduling cycles are collected, and the high confidence of the collected samples is ensured through environmental integrity marking; An event semantic embedding network is used to transform the original event into a high-dimensional vector representation including the operation type number, execution module identifier, event trigger condition type, operation parameter feature vector and execution result indicator code; Construct an encoder-decoder structure based on a bidirectional long short-term memory network to perform supervised training on event sequences, and introduce time interval regularization terms and module dependency constraints to improve reconstruction accuracy; When the reconstruction error of the validation set converges to a preset threshold, the model is solidified as the original baseline behavior model, and the risk of model failure is monitored through a model drift detector. The original benchmark behavior model is output in the form of a structured sequence prediction function set, and provides a subsequent module calling interface through an event-by-event error vector.

3. The power monitoring system based on artificial intelligence according to claim 2, characterized in that: The perturbation sequence building module includes: A module dependency graph between power monitoring power system modules is constructed using static structure extraction and dynamic call tracing methods. The module dependency graph is a directed weighted graph with time sequence attributes. A unified timeline mapping mechanism is used to process behavioral disturbance units from communication logs, operation logs, and configuration logs, and the time of disturbance units is normalized using the master node time as the reference source. A sliding window aggregation algorithm is used to divide the normalized behavior perturbation units into multiple initial perturbation sequences according to the adjacent relationships in the module dependency graph, with the starting unit and the ending unit as the sequence boundaries. The connectivity of the perturbation sequence on the module dependency graph is verified by the shortest path heuristic subgraph matching algorithm, and redundant perturbation units that do not meet the causal path requirements are automatically eliminated; A unique perturbation sequence identification code is generated for each verified perturbation sequence, a structured perturbation sequence object is constructed, and the output is cached.

4. The artificial intelligence-based power monitoring system according to claim 3, characterized in that: The counterfactual trajectory generation module includes: Based on the perturbation sequence set output by the perturbation sequence construction module and the benchmark execution sequence without abnormal offset provided in the benchmark model construction phase, structural alignment is performed using a module dependency graph path matching algorithm to generate training sample pairs of the perturbation sequence and the benchmark execution sequence; A counterfactual generation network with a dual-input encoding structure is constructed. The network includes a perturbation sequence encoder for extracting the operation type flow, module path flow, and time rhythm flow in the perturbation sequence, and a context embedder that inputs the power monitoring power system module dependency graph and system state summary vector. The structured trajectory decoder combines this information to generate a counterfactual trajectory event sequence that conforms to the module dependency constraints. The trajectory consistency scoring function is jointly constructed by behavioral semantic similarity, module path consistency rate and state response consistency. Multiple candidate counterfactual trajectories are evaluated, and the one with the lowest score is eliminated. Finally, the only optimal counterfactual trajectory is retained as the counterfactual corresponding trajectory of the perturbation sequence. And output a structured trajectory pair, which includes a unique identification code of the perturbation sequence, a list of counterfactual trajectory events, a module path reconstruction graph, and a behavior consistency score vector, as input to the subsequent attack evolution chain restoration module.

5. The artificial intelligence-based power monitoring system according to claim 4, characterized in that: The attack evolution chain restoration module includes: By constructing a structural alignment mapping relationship based on module position matching, operation type similarity calculation and time series consistency constraints, a node alignment list between the perturbation sequence and the counterfactual trajectory is generated; Based on the node alignment list, each pair of operation nodes is analyzed for differences to identify deviation conditions such as inconsistent operation types, abnormal execution order, illegal execution parameters, or newly added unmatched nodes. Nodes that meet these conditions are marked as deviation points. Based on the module dependency graph, the deviation points are sorted in time order and the paths are completed. Implicit path derivation nodes are introduced to construct an attack evolution chain object including node sequences, edge paths, perturbation and counterfactual position offset vectors, and a timestamp difference list. The structural consistency of the attack evolution chain is calculated through deviation density, continuity score and module span score, and the effective evolution chain is screened for subsequent action prediction tensor reasoning processing.

6. The artificial intelligence-based power monitoring system according to claim 5, characterized in that: The action prediction tensor reasoning module includes: Based on the attack evolution chain structure object, the deviation node sequence and its corresponding operation type, target component and intervention intensity features are extracted to construct a three-axis action prediction tensor defined by the operation type dimension, target component dimension and intervention intensity dimension. A graph attention network is used to perform sequential modeling and probabilistic reasoning on the attack evolution chain node context and power system module dependencies, dynamically estimating the trigger probability of each combination of operation type, target component, and intervention intensity. The action prediction tensor is processed through three-axis Softmax normalization to generate an interpretable and comparable next action probability distribution; The high-confidence prediction results of operation types, target components, and intervention intensity in the probability distribution are encapsulated as structured prediction objects for calling by the response strategy triggering module.

7. The artificial intelligence-based power monitoring system according to claim 6, characterized in that: The response strategy triggering module includes: Based on the action prediction tensor, the operation type, target component, and intervention intensity tuple with the highest prediction probability are extracted. Combined with the safety level identification in the power system module dependency graph, a comprehensive risk score is calculated to screen high-risk prediction operation tuples and build a response trigger queue. The policy-action mapping rule engine matches response action templates in a predefined response rule library. This response rule library is based on operation type matching patterns, target component labels, and intervention intensity ranges. Response actions include restricted operations, deceptive operations, and diversion operations. Response action templates support parameterized generation of specific execution instructions. The response action is verified for dependency consistency and state constraints through the secure resource scheduler. After verification, it is executed sequentially as atomic operations, and the execution results are recorded in the response log. In the attack evolution chain structure, the path nodes affected by the response action are marked as breakpoints, and the disturbance hit status of the breakpoint nodes is continuously monitored. If there is no disturbance at the breakpoint node for multiple cycles, the attack evolution chain is marked as terminated. Otherwise, the delayed recovery monitoring mode is maintained to ensure dynamic interruption and continuous protection of the attack evolution chain.

Images