Intelligent power grid APT attack follow-up detection method and system based on flexible gray scale

Abstract

The invention discloses a smart power grid APT attack follow-up detection method and system based on flexible gray, and relates to the technical field of network security. The method comprises the following steps: constructing an intelligent power grid equipment relation graph, collecting interactive network flow data between equipment in real time, extracting gray features such as a flow fluctuation rate, a protocol anomaly degree and a time sequence viscosity coefficient, and constructing an anomaly detection model for behavior classification. A transverse propagation behavior path analysis technology is adopted, propagation intensity and path range indexes are quantified, a real-time abnormal curve and a normal reference curve are compared in combination with a dynamic time bending algorithm, and the detection sensitivity is dynamically adjusted through a hyperbola deviation analysis model. According to the method, through a flexible gray feature extraction and iterative feedback mechanism, the problem of detection lag caused by high APT attack concealment and complex propagation path is effectively solved, the false alarm rate is remarkably reduced while the high detection rate is kept, and a dynamic self-adaptive detection solution is provided for intelligent power grid safety protection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for detecting APT attacks on smart grids based on flexible grayscale. Background Art

[0002] The efficiency and security of smart grids are crucial to the functioning of modern society. With their widespread adoption, their complexity and network scale are increasing, posing numerous new challenges to power systems. In particular, smart grids can be subject to severe security threats from advanced persistent threats (APTs), including data breaches and system disruptions. Existing detection methods, which mostly target specific security threats, lack adaptability and a global perspective, making it difficult to accurately identify and promptly respond to APT attacks.

[0003] Traditional detection of interactions between smart grid devices relies primarily on static rule matching and fixed thresholds. While this approach is straightforward, it often lacks accuracy and sensitivity when faced with complex and volatile network environments and APT attacks. APT attacks are particularly stealthy, able to remain undetected for extended periods and gradually infiltrate the system. Existing static detection methods struggle to effectively identify these covert attacks.

[0004] Based on this, a smart grid APT attack sticking detection method and system based on flexible grayscale is proposed. Summary of the Invention

[0005] The purpose of the present invention is to provide a smart grid APT attack sticking detection method and system based on flexible grayscale, which solves the technical problem of the prior art in capturing small abnormal changes in the interactive behavior between devices and identifying early signs of APT attacks.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A smart grid APT attack sticking detection method based on flexible grayscale includes the following steps: Step 1: According to a preset relationship map between smart grid devices, the interactive network traffic between two devices is obtained and the grayscale data of the interactive network traffic between two devices is extracted, and an anomaly detection model is constructed to classify the interactive behaviors between smart grid devices; and the initial detection sensitivity is obtained through recognition analysis;

[0008] Step 2: Based on the detected abnormal interaction behavior categories between smart grid devices, a lateral propagation behavior path diagram is constructed. Through statistical analysis, the lateral propagation behavior intensity index and path range index between each device are obtained. A detection sensitivity adjustment judgment model is constructed to determine whether the initial detection sensitivity of the corresponding abnormal interaction behavior is appropriate.

[0009] Step 3: Obtain the abnormal interaction network traffic grayscale data and baseline interaction network traffic grayscale data between the two devices when the detection results in step 2 are not applicable to generate abnormal interaction behavior curves and baseline characteristic curves, and construct a hyperbola deviation analysis model through data analysis to obtain the corresponding adjustment detection sensitivity between the two devices, and return to step 1 for iterative analysis of anomaly detection.

[0010] As a further solution of the present invention: the preset relationship map between smart grid devices is a network model in which each device type in the smart grid and the attributes corresponding to each device type are defined as nodes, and the direct communication links between devices, functional dependencies and the attributes between the communication relationships of each device are defined as edges.

[0011] As a further solution of the present invention: the interactive network traffic data between the two devices includes: interactive network traffic rate A i , Protocol abnormal event B between devices i , interactive time series C i ; Wherein, i represents the index variable of each device in the preset relationship map between smart grid devices and i=1,2,n; n is the number of devices in the preset relationship map between smart grid devices; the interactive network traffic rate A i , Protocol abnormal event B between devices i All are directly obtained through the system, the interaction time series C i Interaction event timestamps t1, t2, ..., t based on the interaction behavior between devices z ; where t j Represents the jth event timestamp in the interaction event timestamp, z represents the number of interaction event timestamps; calculate the interval time Δt between two adjacent events j =t j+1 -t j , where j = 1, 2, z-1; the calculated time interval Δt results are arranged in order from short to long to obtain the interaction time series C i .

[0012] As a further solution of the present invention: extracting the grayscale data of the interactive network traffic between two devices according to the interactive network traffic between two devices, including: using the B2M / T2G mapping algorithm to obtain the grayscale data of the interactive network traffic between two devices, including: traffic fluctuation rate Protocol Abnormality and the temporal viscosity coefficient ACF(k);

[0013] Among them, the flow fluctuation rate The acquisition logic is: the interactive network traffic rate A i , calculate the standard deviation and mean of the rate within the window, and calculate the flow fluctuation rate by ratio

[0014] The abnormality of the protocol The acquisition logic is: based on the number of protocol abnormal events, the ratio of the number of protocol abnormalities to the total number of events is calculated to obtain the protocol abnormality degree

[0015] The acquisition logic of the time series viscosity coefficient is: extract the interaction time series C i , the time series viscosity coefficient ACF(k) is calculated by the autocorrelation coefficient calculation formula, according to the formula: Where ACF(k) is the autocorrelation coefficient of lag k, which is defined as the time series viscosity coefficient. k is the preset lag step size and is a positive integer. Δt j represents the jth time interval, is the mean of the time interval sequence, and m is the total length of the time interval sequence.

[0016] As a further solution of the present invention: constructing an anomaly detection model to classify the interactive behaviors between smart grid devices; and obtaining initial detection sensitivity through identification analysis, including: constructing an anomaly detection model to classify the interactive behaviors between smart grid devices based on the obtained grayscale data of interactive network traffic between two devices, including: the anomaly detection model P, according to the formula:

[0017] Among them, s is the abnormal score of the interaction between two devices based on the Sigmoid function, s∈[0,1], θ base To preset the initial detection sensitivity, 1 represents the abnormal interaction behavior category and 0 represents the normal interaction behavior category;

[0018] Based on the classification results of the above anomaly detection model, the initial detection sensitivity θ corresponding to each abnormal interaction behavior category is extracted base .

[0019] As a further solution of the present invention: the horizontal propagation behavior path diagram is a horizontal propagation behavior path diagram with smart grid devices as nodes, abnormal interaction behavior types between two devices as edges, and edge weights as abnormal interaction frequencies obtained based on historical interaction data; each horizontal propagation behavior path is as follows:

[0020] Among them, LJ represents the set of horizontal propagation behavior paths, Indicates the corresponding device, t j represents the jth event timestamp in the interaction event timestamp, z represents the number of interaction event timestamps, i represents the index variable of each device in the preset smart grid device relationship graph and i=1,2,n; n is the number of devices in the preset smart grid device relationship graph.

[0021] As a further solution of the present invention: the lateral propagation behavior path map is used to obtain the lateral propagation behavior strength index and path range index between two devices through statistical analysis. The acquisition logic of the lateral propagation behavior strength index is as follows: calculate the single path strength I path :For each path LJ=[Device1,Device2,Device n ], path strength I path is the sum of the weights of all edges in the path:

[0022]

[0023] Among them, W(Device i ,Device i+1 ) represents the edge weight between devices i and i+1;

[0024] Based on single path strength I path , calculate all device pairs (Device i ,Device i+1 ) and perform average processing to obtain the lateral propagation intensity I of the device pair i,i+1 ;

[0025] The horizontal propagation behavior path range index R path The acquisition logic is: Get the path length L corresponding to each path path , time span T path and device diversity D path The comprehensive path range index R is obtained by weighted calculation path ; The time span T path Indicates the time difference between the first and last events in the path; the device diversity D path Indicates the proportion of different device types; the horizontal propagation intensity index I′ is obtained through normalization. path and the horizontal propagation path range index R′ path ; Construct the detection sensitivity adjustment judgment model IR, its specific form is:

[0026] Among them, I th and Rth They represent the preset thresholds corresponding to the propagation behavior intensity index and the horizontal propagation behavior path range index, respectively. 0 means that the initial detection sensitivity corresponding to the current path is applicable, and 1 means it is not applicable.

[0027] As a further solution of the present invention: a hyperbola deviation analysis model includes: performing time series fitting on the real-time interactive network traffic grayscale data obtained from the detection results determined to be "not applicable" and the benchmark interactive network traffic grayscale data obtained based on a preset historical normal database to generate a real-time abnormal curve G abnormal (t) and normal reference curve G base (t); Use the dynamic time warping (DTW) algorithm to align the normal baseline curve G base (t) and real-time abnormal curve G abnormal (t), and calculate the normalized cumulative deviation Δ according to the formula:

[0028] Among them, DTW(G abnormal (t),G base (t)) is used to process the phase difference of the time series; max(|G abnormal (t),|,|G base (t)|) is the maximum length of the two curves.

[0029] As a further solution of the present invention: according to the size of the cumulative deviation Δ, the initial detection sensitivity θ is adjusted in three cases base Get the adjusted detection sensitivity θ new , according to the formula:

[0030] Among them, δ up and δ low represents the preset upper and lower thresholds of the deviation, and β is the preset adjustment amplitude control parameter.

[0031] The flexible grayscale-based smart grid APT attack tracking detection system is characterized by an interactive behavior anomaly detection module that uses a preset smart grid device relationship map to collect real-time interactive network traffic data between devices, extracts grayscale data of interactive network traffic between two devices, and constructs a machine learning-based anomaly detection model to classify interactive behaviors between devices.

[0032] The lateral propagation behavior analysis module is used to construct a lateral propagation path map based on detected abnormal interaction behaviors, and quantitatively analyze the propagation intensity and path range indicators between devices;

[0033] The sensitivity dynamic adjustment module is used to compare the characteristic curves of abnormal interactive traffic grayscale data and benchmark data when the initial sensitivity is not applicable, quantify the degree of deviation using the hyperbola deviation analysis model, and generate the adjusted detection sensitivity.

[0034] Beneficial effects of the present invention:

[0035] (1) The present invention quantifies the propagation intensity and path range indicators through the lateral propagation behavior path diagram, and dynamically adjusts the detection sensitivity in combination with the hyperbolic deviation analysis model, and optimizes the abnormal judgment threshold in real time; this mechanism can be adaptively adjusted according to the spatiotemporal characteristics of the attack behavior, significantly improving the detection accuracy and reducing the misjudgment problem caused by the static threshold; at the same time, by constructing the device relationship map and the lateral propagation path map and the path range indicator, combined with multi-dimensional grayscale features such as the time series viscosity coefficient and the protocol anomaly degree, the causal propagation path in the attack chain can be effectively identified, which is particularly suitable for scenarios with diverse device types and complex dependencies in smart grids, and significantly improves the detection capability of covert lateral attacks.

[0036] (2) The present invention introduces the dynamic time warping (DTW) algorithm to align the real-time anomaly curve with the baseline curve, and eliminates the influence of time series length and phase differences by normalizing the cumulative deviation, so that the deviation analysis is more in line with the actual attack mode and the ability to capture the timing characteristics of APT attacks is enhanced; through dynamic sensitivity adjustment, the adjusted detection sensitivity is fed back to the anomaly detection model for iterative analysis, and the system steady state is achieved in combination with the convergence condition; this closed-loop mechanism enables the system to continuously learn the evolution law of attack behavior, adapt to new APT attack variants, and ensure long-term detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The present invention will be further described below with reference to the accompanying drawings.

[0038] Figure 1 This is a flow chart of a method for detecting APT attacks on smart grids based on flexible grayscale according to the present invention;

[0039] Figure 2 This is a method logic diagram of step 2 in the smart grid APT attack sticking detection method based on flexible grayscale of the present invention;

[0040] Figure 3 This is a method logic diagram of step 3 of the smart grid APT attack sticking detection method based on flexible grayscale of the present invention;

[0041] Figure 4 It is a schematic diagram of the module structure of the smart grid APT attack sticking detection system based on flexible grayscale of the present invention. DETAILED DESCRIPTION

[0042] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0043] Example 1

[0044] See also Figure 1 As shown, the present invention is a smart grid APT attack sticking detection method based on flexible grayscale, comprising the following steps:

[0045] Step 1: Based on the preset relationship map between smart grid devices, the interactive network traffic between each device is extracted and the grayscale data of the interactive network traffic between each device is obtained based on the corresponding grayscale features of the interactive network traffic. An anomaly detection model is constructed to classify the interactive behaviors between smart grid devices. The initial detection sensitivity is obtained through identification analysis. The grayscale data of the interactive network traffic includes: traffic volatility, protocol anomaly, and time series viscosity coefficient.

[0046] The preset smart grid device relationship map describes the connection relationship and communication links between various devices in the smart grid for subsequent analysis;

[0047] Specifically, it can be: a network model in which each device type and the attributes corresponding to each device type in the smart grid are defined as nodes, and the direct communication links between devices, functional dependencies, and attributes between the communication relationships between devices are defined as edges;

[0048] It should be noted that the preset relationship graph between smart grid devices is based on knowledge graph technology developed by researchers in related fields. It integrates the grid topology (branch head and terminal busbars, load connection relationships, etc.) with equipment life cycle management data (procurement, commissioning, and maintenance records). It constructs a multidimensional relationship network model between devices through entity extraction (convolutional neural network, recurrent neural network) and relationship extraction (decision tree, association rule mining).

[0049] Furthermore, based on the preset relationship map between smart grid devices, the interactive network traffic data between two devices in the relationship map between smart grid devices is extracted, and the interactive network traffic data between two devices includes: interactive network traffic rate A i , Protocol abnormal event B between devices i , interactive time series C i ; Wherein, i represents the index variable of each device in the preset relationship map between smart grid devices and i=1,2,n; n is the number of devices in the preset relationship map between smart grid devices; the interactive network traffic rate Ai , Protocol abnormal event B between devices i All are directly obtained through the system, the interaction time series C i Interaction event timestamps t1, t2, ..., t based on the interaction behavior between devices z ; where t j Represents the jth event timestamp in the interaction event timestamp, z represents the number of interaction event timestamps; calculate the interval time Δt between two adjacent events j =t j+1 -t j , where j = 1, 2, z-1; the calculated time interval Δt results are arranged in order from short to long to obtain the interaction time series C i ;

[0050] The B2M / T2G mapping algorithm is used to convert network traffic data into grayscale images, and morphological operations are used to enhance the contrast of image features to obtain the grayscale data of interactive network traffic between two devices, including: traffic fluctuation rate Protocol abnormality Y B and the temporal viscosity coefficient ACF(k);

[0051] Among them, the flow fluctuation rate The acquisition logic is: Use sliding window to count the interactive network traffic rate A in each window i , calculate the standard deviation and mean of the rate within the window, and calculate the flow fluctuation rate by ratio

[0052] The abnormality of the protocol The acquisition logic is as follows: count the number of protocol abnormal events such as verification failure and illegal port access in each time window, calculate the ratio of the number of protocol abnormalities to the total number of events, and obtain the protocol abnormality degree.

[0053] The acquisition logic of the time series viscosity coefficient is: extract the interaction time series C i , the time series viscosity coefficient ACF(k) is calculated by the autocorrelation coefficient calculation formula, according to the formula: Where ACF(k) is the autocorrelation coefficient of lag k, which is defined as the time series viscosity coefficient. k is the preset lag step size and is a positive integer. represents the jth time interval, is the mean of the time interval sequence, m is the total length of the time interval sequence;

[0054] Based on the grayscale data of the interaction network traffic between two devices, an anomaly detection model is constructed to classify the interaction behaviors between smart grid devices. This includes: using a logistic regression framework to map grayscale features to anomaly probabilities, and constructing a probabilistic model to evaluate the anomaly score s∈[0,1] of the interaction between two devices, according to the formula:

[0055] in, is the Sigmoid function, which maps the linear combination to the interval [0,1]. w1, w2, and w3 are the preset weight coefficients of the grayscale data of each interactive network traffic. b is the preset bias term, which needs to be learned through training data. is the flow fluctuation rate, is the agreement anomaly degree, ACF(k) is the temporal viscosity coefficient;

[0056] By presetting the initial detection sensitivity θ base ,Construct an anomaly detection model P to determine the interactive behavior category, according to the formula:

[0057] Where 1 represents the abnormal interaction behavior category, and 0 represents the normal interaction behavior category;

[0058] Based on the classification results of the above anomaly detection model, the initial detection sensitivity θ corresponding to each abnormal interaction behavior category is extracted base .

[0059] See also Figure 2 As shown, step 2: Based on the detected abnormal interaction behavior categories between smart grid devices, a lateral propagation behavior path diagram is constructed, and through statistical analysis, the lateral propagation behavior intensity index and path range index between each device are obtained to form an attack feature set. Based on the attack feature set, a detection sensitivity adjustment judgment model is constructed to determine whether the initial detection sensitivity of the corresponding abnormal interaction behavior is applicable; including:

[0060] The horizontal propagation behavior path diagram is constructed by using a system graph database to construct a horizontal propagation behavior path diagram with smart grid devices as nodes, abnormal interaction behavior types between two devices as edges, and edge weights as abnormal interaction frequencies obtained based on historical interaction data;

[0061] A time sequence graph traversal method is used to identify the weights of the edges corresponding to the propagation chains of each lateral propagation path in the lateral propagation behavior path graph. The corresponding lateral propagation behavior path propagation chain whose edge weight is greater than the preset standard edge weight is marked as a seed event. Starting from the seed event with the largest difference between the edge weights greater than the preset standard edge weights among various sub-events, a backward search is performed in chronological order to merge the abnormal interaction behavior types in which the device nodes have a preset communication relationship and the time interval meets the causal condition. Thus, a set LJ of all lateral propagation behavior paths with a length greater than or equal to 2 is generated. Each lateral propagation behavior path is as follows:

[0062] The horizontal propagation behavior path is: Among them, LJ represents the set of horizontal propagation behavior paths, Indicates the corresponding device, t j represents the jth event timestamp in the interaction event timestamp, and z represents the number of interaction event timestamps;

[0063] Obtaining lateral propagation intensity and path range indicators between two devices through statistical analysis, and constructing a detection sensitivity adjustment judgment model, including: performing data analysis on the lateral propagation path diagram to obtain lateral propagation intensity and path range indicators;

[0064] The logic for obtaining the horizontal propagation behavior strength index is as follows: first calculate the single path strength I path :For each path LJ=[Device1,Device2,…,Device n ], path strength I path is the sum of the weights of all edges in the path:

[0065]

[0066] Among them, W(Device i ,Device i+1 ) represents the edge weight between devices i and i+1;

[0067] Based on single path strength I path , calculate all device pairs (Device i ,Device i+1 ) and perform average processing to obtain the lateral propagation intensity I of the device pair i,i+1 ; That is, the path strength of a device pair is the average path strength among all its related paths;

[0068] The horizontal propagation behavior path range index R path The acquisition logic is: Get the path length L corresponding to each path path , time span T path and device diversity Dpath The comprehensive path range index R is obtained by weighted calculation path ; The time span T path Indicates the time difference between the first and last events in the path; the device diversity D path Indicates the proportion of different device types (such as core devices, terminal devices, etc.);

[0069] The transmission behavior intensity index and the horizontal transmission behavior path range index are normalized to obtain the processed horizontal transmission behavior intensity index I′ path and the horizontal propagation path range index R′ path ;Construct detection sensitivity adjustment judgment model IR; Among them, I th and R th They represent the preset thresholds corresponding to the intensity index of the propagation behavior and the range index of the horizontal propagation behavior path, respectively. 0 means that the initial detection sensitivity corresponding to the current path is applicable, and 1 means it is not applicable.

[0070] In this embodiment, by constructing a lateral propagation path diagram of abnormal interactive behaviors of smart grid devices and combining time series analysis with statistical modeling, accurate detection and dynamic response adjustment of complex attack behaviors are achieved.

[0071] See also Figure 3 As shown, step three: obtain the abnormal interaction network traffic grayscale data and benchmark interaction network traffic grayscale data between the two devices under the non-applicable detection results in step two to generate abnormal interaction behavior curves and benchmark characteristic curves, and construct a hyperbola deviation analysis model through data analysis to obtain the corresponding adjustment detection sensitivity between the two devices, and return to step one for iterative analysis of anomaly detection; including:

[0072] From the detection results judged as "not applicable", the real-time interactive network traffic grayscale data of the same device pair is selected as the real-time interactive network traffic grayscale data. At the same time, the interactive network traffic grayscale data between any two devices is extracted from the system's historical normal database as the baseline interactive network traffic grayscale data.

[0073] Perform time series fitting on the real-time interactive network traffic grayscale data and the benchmark interactive network traffic grayscale data to generate a real-time anomaly curve G abnormal (t) and normal reference curve G base (t);

[0074] Use the dynamic time warping (DTW) algorithm to align the normal baseline curve G base (t) and real-time abnormal curve G abnormal (t), and calculate the normalized cumulative deviation Δ according to the formula:

[0075] Among them, DTW(G abnormal (t),G base (t)) is used to process the phase difference of the time series (such as delay, expansion), ensuring that the deviation calculation after alignment is more accurate; max(|G abnormal (t),|,|G base (t)|) uses the maximum value of the two curve lengths to eliminate the influence of curve length on the deviation value;

[0076] According to the size of the cumulative deviation Δ, the initial detection sensitivity θ is adjusted in three cases base Get the adjusted detection sensitivity θ new , according to the formula:

[0077] Among them, δ up and δ low The preset upper and lower thresholds representing the deviation can be set through historical data statistics or experiments. β is the preset adjustment amplitude control parameter that determines the intensity of the deviation's impact on sensitivity.

[0078] Specifically, when Δ>θ up , improve sensitivity (θ base >θ new ) to catch potential exceptions;

[0079] When Δ<θ new , reduce sensitivity (θ base <θ new ) to reduce false positives;

[0080] When δ low ≤Δ≤δ up When, among them, if Sensitivity increases gradually; if Sensitivity gradually decreases;

[0081] According to the corresponding adjustment detection sensitivity θ between the two devices new , adjust the corresponding initial detection sensitivity, obtain the adjusted detection sensitivity after adjustment and optimization, and return to step 1 to perform iterative analysis of anomaly detection;

[0082] For the test results judged as "not applicable" in step 2, adjust the detection sensitivity θ according to its corresponding new , directly replaces the initial detection sensitivity θ of the device base ; The adjusted detection sensitivity θ newInput the anomaly detection model from step 1 to form a closed-loop feedback loop. If the average value of the sensitivity adjustment for Q consecutive times during the iteration is lower than the preset threshold, the system is considered to have converged and the iteration is terminated. The specific number of Q times can be determined based on actual needs.

[0083] In this embodiment, by establishing an interactive network traffic data collection and analysis mechanism based on the relationship graph between smart grid devices, interactive behaviors between smart grid devices are monitored and classified in real time, and an anomaly detection model is constructed to identify abnormal interactive behaviors. The interactive behavior anomaly detection module extracts grayscale data on the interactive network traffic rate, protocol anomaly events, and interaction time series between devices. It then utilizes a B2M / T2G mapping algorithm to obtain features such as traffic volatility, protocol anomaly, and time series stickiness coefficient. The anomaly detection model constructed based on these features can identify abnormal interactive behaviors and ultimately determine the initial detection sensitivity. Simultaneously, the lateral propagation behavior analysis module statistically analyzes the path graph of abnormal interactive behaviors to quantify the intensity and path range of lateral propagation behaviors. This enables the dynamic sensitivity adjustment module to rapidly calculate the adjusted detection sensitivity when the detection sensitivity is not appropriate by constructing a hyperbolic deviation analysis model and comparing the characteristic curves of abnormal interactive traffic data with baseline data. This enables iterative optimization of the anomaly detection model, ensuring effective real-time detection and response to APT attack stickiness in the smart grid, and providing a dynamic and adaptive detection solution for smart grid security protection.

[0084] Example 2

[0085] See also Figure 4 As shown, as a second embodiment of the present invention, a smart grid APT attack tracking detection system based on flexible grayscale includes: an interactive behavior anomaly detection module for collecting interactive network traffic data between devices in real time through a preset smart grid device relationship map, extracting grayscale data of interactive network traffic between two devices, building an anomaly detection model based on machine learning, and classifying interactive behaviors between devices;

[0086] The lateral propagation behavior analysis module is used to construct a lateral propagation path map based on detected abnormal interaction behaviors, and quantitatively analyze the propagation intensity and path range indicators between devices;

[0087] The sensitivity dynamic adjustment module is used to compare the characteristic curves of abnormal interactive traffic grayscale data and benchmark data when the initial sensitivity is not applicable, quantify the degree of deviation using the hyperbola deviation analysis model, and generate the adjusted detection sensitivity.

[0088] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters and thresholds in the formulas are set by technicians in this field according to actual conditions.

[0089] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A smart grid APT attack sticking detection method based on flexible grayscale, characterized by: The following steps are involved: Step 1: Based on the preset relationship map between smart grid devices, obtain the interactive network traffic between each device and extract the grayscale data of the interactive network traffic between each device. Build an anomaly detection model to classify the interactive behaviors between smart grid devices; and obtain the initial detection sensitivity through recognition analysis; Step 2: Based on the detected abnormal interaction behavior categories between smart grid devices, a lateral propagation behavior path diagram is constructed. Through statistical analysis, the lateral propagation behavior intensity index and path range index between each device are obtained. A detection sensitivity adjustment judgment model is constructed to determine whether the initial detection sensitivity of the corresponding abnormal interaction behavior is appropriate. Step 3: Obtain the abnormal interaction network traffic grayscale data and baseline interaction network traffic grayscale data between the two devices when the detection results in step 2 are not applicable to generate abnormal interaction behavior curves and baseline characteristic curves, and construct a hyperbola deviation analysis model through data analysis to obtain the corresponding adjustment detection sensitivity between the two devices, and return to step 1 for iterative analysis of anomaly detection.

2. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 1 is characterized in that: The preset relationship graph between smart grid devices is a network model that defines each device type in the smart grid and the attributes corresponding to each device type as nodes, and defines the direct communication links, functional dependencies and attributes between the communication relationships of each device as edges.

3. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 1 is characterized in that: The interactive network traffic data between the two devices includes: interactive network traffic rate A i , Protocol abnormal event B between devices i , interactive time series C i ; Wherein, i represents the index variable of each device in the preset relationship map between smart grid devices and i=1,2,...,n; n is the number of devices in the preset relationship map between smart grid devices; the interactive network traffic rate A i , Protocol abnormal event B between devices i All are directly obtained through the system, the interaction time series C i Interaction event timestamps t1, t2, ..., t based on the interaction behavior between devices z ; where t j Represents the jth event timestamp in the interaction event timestamp, z represents the number of interaction event timestamps; calculate the interval time Δt between two adjacent events j =t j+1 -t j , where j = 1, 2, ..., z-1; the calculated time interval Δt results are arranged in order from short to long to obtain the interaction time series C i .

4. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 3 is characterized in that: Extract the grayscale data of the interactive network traffic between two devices based on the interactive network traffic between two devices, including: using the B2M / T2G mapping algorithm to obtain the grayscale data of the interactive network traffic between two devices, including: traffic fluctuation rate Protocol Abnormality and the temporal viscosity coefficient ACF(k); Among them, the flow fluctuation rate The acquisition logic is: the interactive network traffic rate A i , calculate the standard deviation and mean of the rate within the window, and calculate the flow fluctuation rate by ratio The abnormality of the protocol The acquisition logic is: based on the number of protocol abnormal events, the ratio of the number of protocol abnormalities to the total number of events is calculated to obtain the protocol abnormality degree The logic for obtaining the time series viscosity coefficient is as follows: extract the interaction time series C i , the time series viscosity coefficient is calculated by the autocorrelation coefficient calculation formula Where ACF(k) is the autocorrelation coefficient of lag k, which is defined as the time series viscosity coefficient. k is the preset lag step size and is a positive integer. Δt j represents the jth time interval, is the mean of the time interval sequence, and m is the total length of the time interval sequence.

5. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 1 is characterized in that: Build an anomaly detection model to classify the interaction behaviors between smart grid devices; The initial detection sensitivity is obtained through identification analysis, including: based on the obtained grayscale data of the interactive network traffic between two devices, an anomaly detection model is constructed to classify the interactive behaviors between smart grid devices, including: the anomaly detection model P, according to the formula: Among them, s is the abnormal score of the interaction between two devices based on the Sigmoid function, s∈[0,1], θ base To preset the initial detection sensitivity, 1 represents the abnormal interaction behavior category and 0 represents the normal interaction behavior category; Based on the classification results of the above anomaly detection model, the initial detection sensitivity θ corresponding to each abnormal interaction behavior category is extracted base .

6. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 1 is characterized in that: The horizontal propagation behavior path diagram is a horizontal propagation behavior path diagram with smart grid devices as nodes, abnormal interaction behavior types between two devices as edges, and edge weights as abnormal interaction frequencies obtained based on historical interaction data; Each of its horizontal propagation behavior paths is as follows: Among them, LJ represents the set of horizontal propagation behavior paths, Device i Indicates the corresponding device, t j represents the jth event timestamp in the interaction event timestamp, z represents the number of interaction event timestamps, i represents the index variable of each device in the preset smart grid device relationship graph and i=1,2,...,n; n is the number of devices in the preset smart grid device relationship graph.

7. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 1 is characterized in that: The lateral propagation behavior path diagram and the lateral propagation behavior strength index and path range index between two devices are obtained through statistical analysis. The acquisition logic of the lateral propagation behavior strength index is as follows: Calculate the single path strength I path :For each path LJ=[Device1,Device2,Device n ], path strength I path is the sum of the weights of all edges in the path: Among them, W(Device i ,Device i+1 ) represents the edge weight between devices i and i+1; Based on single path strength I path , calculate all included device pairs (Device i ,Device i+1 ) and perform average processing to obtain the lateral propagation intensity I of the device pair i,i+1 ; The horizontal propagation behavior path range index R path The acquisition logic is: Get the path length L corresponding to each path path , time span T path and device diversity D path The comprehensive path range index R is obtained by weighted calculation path ; The time span T path Indicates the time difference between the first and last events in the path; the device diversity D path Indicates the proportion of different device types; the horizontal propagation intensity index I′ is obtained through normalization. path and the horizontal propagation path range index R′ path ; Construct the detection sensitivity adjustment judgment model IR, its specific form is: Among them, I th and R th They represent the preset thresholds corresponding to the propagation behavior intensity index and the horizontal propagation behavior path range index, respectively. 0 means that the initial detection sensitivity corresponding to the current path is applicable, and 1 means it is not applicable.

8. The method and system for detecting smart grid APT attacks based on flexible grayscale according to claim 1 is characterized in that: The hyperbola deviation analysis model includes: performing time series fitting on the real-time interactive network traffic grayscale data obtained from the detection results determined to be inapplicable and the benchmark interactive network traffic grayscale data obtained based on the preset historical normal database to generate a real-time abnormal curve G abnormal (t) and normal reference curve G base (t); Use the dynamic time warping (DTW) algorithm to align the normal baseline curve G base (t) and real-time abnormal curve G abnormal (t), and calculate the normalized cumulative deviation Δ according to the formula: Among them, DTW(G abnormal (t),G base (t)) is used to process the phase difference of the time series; max(|G abnormal (t),|,|G base (t)|) is the maximum length of the two curves.

9. The smart grid APT attack sticking detection method based on flexible grayscale according to claim 8 is characterized in that: According to the size of the cumulative deviation Δ, the initial detection sensitivity θ is adjusted in three cases base Get the adjusted detection sensitivity θ new , according to the formula: Among them, δ up and δ low represents the preset upper and lower thresholds of the deviation, and β is the preset adjustment amplitude control parameter.

10. A smart grid APT attack sticking detection system based on flexible grayscale, used to implement the smart grid APT attack sticking detection method based on flexible grayscale according to any one of claims 1 to 9, characterized in that: The interaction behavior anomaly detection module is used to collect real-time interaction network traffic data between devices through a preset smart grid device relationship map, extract grayscale data of interaction network traffic between two devices, build an anomaly detection model based on machine learning, and classify the interaction behaviors between devices; The lateral propagation behavior analysis module is used to construct a lateral propagation path map based on detected abnormal interaction behaviors, and quantitatively analyze the propagation intensity and path range indicators between devices; The sensitivity dynamic adjustment module is used to compare the characteristic curves of abnormal interactive traffic grayscale data and benchmark data when the initial sensitivity is not applicable, quantify the degree of deviation using the hyperbola deviation analysis model, and generate the adjusted detection sensitivity.

Images