Method for detecting abnormal access behavior of power internet of things equipment and electronic equipment

Abstract

The invention provides an abnormal access behavior detection method for power Internet of Things equipment and electronic equipment, and relates to the technical field of network security. The method comprises the steps of collecting device information and communication information of each device in a target electric power Internet of Things; performing initial clustering at each edge node gateway according to the communication information of each device to obtain a local behavior pattern of each device; meanwhile, extracting feature data of the equipment information and the communication information; performing secondary clustering on the cloud server based on the local behavior pattern of each device to obtain a global unit traffic pattern; and based on the feature data, the local behavior pattern and the global unit flow pattern, detecting an equipment abnormal access behavior in the target power Internet of Things. According to the method, multi-dimensional joint detection can be carried out, so that abnormity judgment does not depend on a single classification algorithm any more, and safety protection is matched with the real-time requirement of the electric power Internet of Things.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a power Internet of Things device abnormal access behavior detection method and an electronic device. BACKGROUND

[0002] With the wide application and deep integration of communication technology, automation control technology, new energy access technology, Internet of Things technology and big data analysis technology in the new power system, the power grid system presents the characteristics of ubiquitous interconnection, multi-energy complementation, efficient interaction and intelligent openness. Among them, the high proportion of distributed power represented by wind power and photovoltaic power makes the power flow and information of the distribution network realize bidirectional flow, and the distribution network business also changes from large-scale collection to full-factor control.

[0003] At the same time, the new power business further covers many aspects such as early planning, production operation, management, comprehensive service, new business expansion and power ecological environment construction, focusing on new energy demand and intelligent interaction of users. In addition, edge physical agents gradually play an important role in business and communication connection in the power Internet of Things, and the deployment location and communication topology structure of the business terminal at the end of the power grid have broken the inherent 10kV, 0.4kV voltage level division line, and emerged many businesses such as smart substations, power grid equipment state and environment monitoring, comprehensive energy services, new energy vehicles, virtual power plants, microgrids and intelligent distribution areas.

[0004] As an important infrastructure for physical power grid connection and control, the terminal communication access network needs to meet the new needs of safety, ubiquity and economy of the new power system. The power Internet of Things can comprehensively sense the state of power equipment and systems through the deployment of a large number of sensors and edge terminals, and realize real-time data collection, communication and state control in power generation, power transmission, power distribution and power consumption.

[0005] The power Internet of Things has the characteristics of multi-point, wide area and harsh environment, which makes the terminal easy to be forged or destroyed. At the same time, many malicious software and network attacks targeting the power Internet of Things system continue to appear, leading to an increasingly severe network security situation of the power Internet of Things. Especially with the escalation of network attacks, attackers can use terminals as a stepping stone to break through network boundaries, access the internal network for horizontal movement, and even obtain higher access permissions through permission escalation operations, which will inevitably have adverse effects on the power Internet of Things and even the entire new power system. Therefore, how to deal with network security risks has become an important issue for the security protection of the power Internet of Things architecture.

[0006] In addition, the behavior of power Internet of Things devices is influenced by multiple factors such as the operation state of the power system, network communication conditions, and the state of the device itself, and presents complex nonlinear, dynamic, and spatial topology correlation and time series dependence characteristics. The behavior information is contained in different time granularities and spatial ranges, and single-scale or single-type features are difficult to fully describe the complexity. For key tasks such as device health assessment and regional network situation awareness, it is particularly necessary to build multi-scale spatiotemporal features to understand the long-term behavior evolution or cross-device coordination state.

[0007] As a new network security scheme and concept, the zero trust model (ZTM) establishes a confirmation mechanism through hardware, software, users, and network traffic to achieve end-to-end security protection in public information network scenarios. Numerous studies have shown that the zero trust mechanism can effectively enhance the security protection capability of the power Internet of Things network through continuous trust evaluation and dynamic authorization. It emphasizes that any personnel or device, even within an organization, must be authenticated and authorized to access resources, which means that internal devices and systems must also be authenticated and authorized to communicate and access critical resources in the power Internet of Things. Behavior analysis and anomaly detection technology are used to discover attack or abnormal behavior of user nodes in a timely manner, providing information support for continuous trust evaluation and dynamic access control, which is the key to implementing the zero trust architecture.

[0008] In recent years, researchers have conducted research on anomaly detection in the power Internet of Things and zero trust environment and proposed various solutions. For example, basic and fine-grained raw features such as protocol type, address, port, and payload segment are extracted directly from network device communication data packets to capture immediate details of device behavior and high-fidelity network activity views, such as lightweight traffic anomaly detection schemes, Internet of Things device identification and anomaly detection schemes based on traffic analysis technology, and measurement-based real-time data quality anomaly detection and improved algorithms based on isolation forests. However, these features have inherent defects such as high dimensionality, redundancy, and noise, making it difficult to effectively reveal deep cross-time and cross-device correlation patterns and behavior rules, limiting their insight in complex network environments.

[0009] At present, feature engineering methods can also be used to deeply process, convert and combine the original features to generate derived features with higher abstraction levels, such as using user behavior time and location attributes to associate and encode and map into a feature vector, and then implementing anomaly detection through deep learning, implementing anomaly detection through embedded temporal information user behavior semantic feature extraction for multi-source log data and user session behavior data, and implementing anomaly detection through a user abnormal behavior detection model based on user historical behavior and attention mechanism. However, such anomaly detection schemes often directly use classification algorithms for anomaly detection through basic data collection and analysis, which is difficult to meet the security requirements of the zero-trust power internet architecture. SUMMARY

[0010] Embodiments of the present application provide a power internet of things device abnormal access behavior detection method and an electronic device to solve the problem of insufficient anomaly detection capability under the zero-trust power internet.

[0011] In a first aspect, embodiments of the present application provide a power internet of things device abnormal access behavior detection method, comprising: Collecting device information and communication information of each device in a target power internet of things; At each edge node gateway, performing initial clustering according to the communication information of each device to obtain a local behavior pattern of each device; meanwhile, extracting feature data of the device information and the communication information; At a cloud server, performing secondary clustering based on the local behavior pattern of each device to obtain a global unit flow pattern; Based on the feature data, the local behavior pattern and the global unit flow pattern, detecting device abnormal access behavior in the target power internet of things.

[0012] In a possible implementation, based on the feature data, the local behavior pattern and the global unit flow pattern, detecting device abnormal access behavior in the target power internet of things, comprising: Based on the feature data, the local behavior pattern and the global unit flow pattern, obtaining a statistical index; Inputting the statistical index into a pre-trained detection model to obtain device abnormal access behavior in the target power internet of things; Wherein, in the pre-trained detection model, individual behavior baseline and group behavior baseline are used as detection standards; the individual behavior baseline is determined based on the local behavior pattern, and the group behavior baseline is determined based on the global unit flow pattern.

[0013] In a possible implementation, based on the feature data, the local behavior pattern and the global unit flow pattern, obtaining a statistical index, comprising: Grouping the feature data, the local behavior pattern and the global unit flow pattern into a feature group of each device; capturing a feature group data sequence of each device based on a first preset time window; calculating a statistical index of each feature value in the feature group of each device based on the feature group data sequence of each device.

[0014] In a possible implementation, at each edge node gateway, initial clustering is performed according to the communication information of each device to obtain a local behavior pattern of each device, including: At each edge node gateway, the communication information of each device is divided into continuous data segments based on a second preset time window. Feature values of the corresponding continuous data segments of each device are extracted, and initial clustering is performed to obtain a local behavior pattern of each device.

[0015] In a possible implementation, after secondary clustering is performed on the local behavior patterns of each device at the cloud server to obtain a global unit flow pattern, the method further includes: Each gateway node receives the global unit flow pattern sent by the cloud server. At each gateway node, the global unit flow pattern is compared with the local behavior pattern to determine a unit flow number of each data segment in the communication information. The unit flow number is assigned to each data segment.

[0016] In a possible implementation, based on the feature data, the local behavior pattern and the global unit flow pattern, a device abnormal access behavior in a target power Internet of Things is detected, including: Based on the feature data, the local behavior pattern and the global unit flow pattern, a device abnormal access behavior in a target power Internet of Things is detected, and a unit flow number corresponding to the device with the abnormal access behavior is output.

[0017] In a possible implementation, secondary clustering is performed on the local behavior patterns of each device at the cloud server to obtain a global unit flow pattern, including: At each gateway node, a mean vector corresponding to each local behavior pattern is calculated based on the local behavior pattern of each device, and the mean vector is uploaded to the cloud server. At the cloud server, secondary clustering is performed based on the mean vector to obtain a global unit flow pattern.

[0018] In a possible implementation, feature data of device information and communication information is extracted, including: A preset aggregation statistical method is used to perform aggregation analysis on the device information and the communication information to obtain a feature distribution pattern. The feature data is extracted according to the feature distribution pattern.

[0019] In a second aspect, an embodiment of the present application provides an electric power Internet of Things device abnormal access behavior detection device, comprising: A collection module is configured to collect device information and communication information of each device in a target electric power Internet of Things; A gateway module is configured to perform initial clustering on each edge node gateway according to the communication information of each device to obtain a local behavior mode of each device; meanwhile, feature data of the device information and the communication information is extracted; A cloud module is configured to perform secondary clustering on a cloud server based on the local behavior mode of each device to obtain a global unit flow mode; A detection module is configured to detect device abnormal access behavior in the target electric power Internet of Things based on the feature data, the local behavior mode, and the global unit flow mode.

[0020] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the method in the first aspect or any possible implementation manner of the first aspect when executing the computer program.

[0021] In the embodiment of the present application, the clustering of the communication information of each device and the corresponding feature extraction are performed on each edge node gateway, and only the extracted or integrated feature data is uploaded on the information, rather than the original data collected, thereby meeting the privacy protection requirement of the zero trust architecture. In order to effectively reveal deep cross-time and cross-device association modes and behavior rules, the secondary clustering is performed on the cloud server in the embodiment, and the abnormal behavior is effectively captured from a macro perspective. Finally, the multi-dimensional joint detection is performed based on the feature data, the local behavior mode, and the global unit flow mode, so that the abnormal judgment is no longer dependent on a single classification algorithm, and the security protection is matched with the real-time requirement of the electric power Internet of Things. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is an implementation flowchart of the electric power Internet of Things device abnormal access behavior detection method provided by the embodiment of the present application; Figure 2 is an architecture diagram of a detection model provided by the embodiment of the present application; Figure 3 is a structural schematic diagram of the electric power Internet of Things device abnormal access behavior detection device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0023] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0024] Figure 1 is an implementation flowchart of the electric power Internet of Things device abnormal access behavior detection method provided by the embodiment of the present application. As shown in Figure 1As shown, the method comprises: Step 110: Collecting device information and communication information of each device in the target power Internet of Things.

[0025] Each key network node in the structure of the target power Internet of Things can collect device information and communication information of each device in the network structure in real time, and take the collected device information and communication information as a raw data set.

[0026] The device information includes communication-related parameters, such as communication hardware identification, such as physical address, communication module model, etc.; communication configuration information, such as preset network parameters, list of supported communication protocols, port configuration, etc.; communication state attributes, such as communication module running state, communication-related parameters in firmware version, including communication timeout threshold, upper limit of retransmission times, etc. Configuration solidified in firmware, affecting device communication behavior rules, etc.

[0027] The communication information can include port connection frequency, data volume mode, source IP address, source port, destination IP address, destination port, protocol type, etc.

[0028] Step 120: At each edge node gateway, according to the communication information of each device, initial clustering is performed to obtain the local behavior pattern of each device; at the same time, the feature data of the device information and the communication information is extracted.

[0029] In this embodiment, in order to ensure network security, when performing initial clustering, only the edge gateway layer is implemented to prevent the risk of tampering during information upload to the server.

[0030] Specifically, based on each edge node gateway, that is, the local gateway, the feature vector of the communication information of each device is extracted, and initial clustering is performed based on the feature vector to capture the individual characteristics of each device. The cluster obtained by initial clustering is taken as the local behavior pattern of each device.

[0031] Correspondingly, the feature data in the device information and the communication information in the raw data set is extracted to provide a basis for subsequent detection.

[0032] Step 130: In the cloud server, based on the local behavior pattern of each device, secondary clustering is performed to obtain a global unit flow pattern.

[0033] In this embodiment, each edge gateway node uploads the obtained local behavior pattern and feature data to the cloud server. Since the uploaded is not raw data, it can significantly reduce network communication load, enhance user privacy protection, and maximize data security.

[0034] The cloud server performs secondary clustering based on the local behavior patterns of the devices to obtain a global unit flow pattern for representing a macroscopic trend.

[0035] Step 140: Based on the feature data, the local behavior pattern, and the global unit flow pattern, detecting abnormal access behavior of the devices in the target power Internet of Things.

[0036] Finally, in the cloud server, based on the feature data, the local behavior pattern, and the global unit flow pattern, detecting abnormal access behavior of the devices in the target power Internet of Things.

[0037] In this way, the security during data uploading can be ensured, so that the cloud server always contacts the feature data or the processed data, rather than the original data, thereby ensuring the privacy and security of each user.

[0038] In addition, the behaviors of the devices in the power Internet of Things are affected by the operation state of the power system, the network communication condition, the state of the devices, and various other factors, and present complex nonlinear, dynamic, and spatial topology correlation and time sequence dependence characteristics. Through multi-source data fusion analysis, the embodiment can avoid the problem that a single scale or a single type of feature is difficult to comprehensively describe the complexity of the power Internet of Things devices, and can provide accurate and efficient abnormal behavior recognition capability for the power Internet of Things under the zero-trust architecture.

[0039] As can be seen from the above, the core idea of the present application is to establish an enhanced security framework based on the zero-trust architecture, integrate artificial intelligence (AI) and multi-scale spatiotemporal feature engineering technology, and provide strong, adaptive, and decentralized trust assurance in the power Internet of Things environment. Specifically, first, the communication information of each device is clustered at each edge node gateway, and the corresponding features are extracted. When the information is uploaded, only the extracted or integrated feature data is uploaded, rather than the original data collected, thereby meeting the privacy protection requirements of the zero-trust architecture. Moreover, in order to effectively reveal deep cross-time and cross-device correlation patterns and behavior rules, the embodiment performs secondary clustering in the cloud server to effectively capture abnormal behaviors from a macroscopic perspective. Finally, the embodiment detects in multiple dimensions based on the feature data, the local behavior pattern, and the global unit flow pattern, so that the abnormality judgment is no longer dependent on a single classification algorithm, and the security protection is matched with the real-time requirements of the power Internet of Things.

[0040] In an optional embodiment, in step 120, the initial clustering is performed at each edge node gateway based on the communication information of each device to obtain a local behavior pattern of each device, which can include: In the edge node gateway, the communication information of each device is divided into continuous data segments based on a second preset time window.

[0041] The feature values of the corresponding continuous data segments of each device are extracted, and initial clustering is performed to obtain the local behavior patterns of each device.

[0042] To improve the pertinence, accuracy and interpretability of clustering, before initial clustering, the communication information of each device is divided into continuous data segments according to a unit time window, i.e., a second preset time window, that is, the second preset time window is set as , and the continuous data segment is represented as

[0043] In the formula, .

[0044] For the obtained continuous data segment, the zero-flow segment without data packets is removed, wherein the zero-flow segment without data packets satisfies .

[0045] For each device , the feature vector extraction is performed on the corresponding continuous data segment, wherein the feature vector, i.e., the feature value, is represented as , which can include packet rate, byte entropy, protocol distribution, etc. The extracted feature vector is initially clustered to obtain the local behavior pattern of each device, wherein the initial clustering can adopt the K-Means algorithm, and the formula is represented as

[0046] Each cluster in the formula represents a local behavior pattern of the device.

[0047] In an optional embodiment, the feature data of the device information and the communication information extracted in step 120 can include: The device information and the communication information are aggregated and analyzed by using a preset aggregation statistical method to obtain a feature distribution pattern.

[0048] The feature data is extracted according to the feature distribution pattern.

[0049] Considering that the core security principle in the zero-trust power Internet of Things environment is "never trust, always verify", when the device is initially accessed, based on the limited trust model, the network access permission is strictly limited, the communication target and the function range are limited, and it is usually temporarily assumed that all access devices are benign (i.e., the device itself is not attacked, and it will not actively initiate an attack behavior). At this time, the specific communication target and performance characteristics (such as the connection frequency of a specific port, the data volume pattern) of the device in the initial stage can be mapped as identity recognition and behavior baseline characteristics.

[0050] However, when the device is subjected to attacks such as Brute Force or Port Scanning, its communication mode will deviate sharply from the normal behavior baseline, typically manifested as attempts to establish multiple short connections with a large number of different target addresses. In such scenarios, relying on single connection, relatively static raw features (such as source / destination IP addresses, ports) often lacks sufficient discrimination to distinguish between benign and malicious traffic.

[0051] In order to more accurately identify such complex abnormal behaviors, it is necessary to introduce aggregated features that capture macroscopic behavior patterns and contextual information from a longer time scale or higher granularity aggregation perspective, thereby significantly improving the discrimination ability between malicious and benign traffic.

[0052] Therefore, in addition to the features obtained by the initial clustering, the embodiment also uses a preset aggregation statistical method to aggregate and analyze the device information and communication information, to identify the long-term behavior patterns, abnormal associations or dynamic change rules of the device, and to obtain feature distribution patterns. The preset aggregation statistical method can be a cross-connection or cross-time aggregation statistical method, For the feature distribution pattern, time series analysis is used to further analyze its dynamic change trend, sequence dependence or periodic pattern over time to obtain feature data.

[0053] The feature data can include flow features, jitter, channel features, and source IP-MAC binding features, wherein the flow feature refers to a complete communication session data sequence between two endpoints identified by a five-tuple (source IP address, source port, destination IP address, destination port, protocol type) under a specific transport layer protocol (such as TCP / UDP). Analyzing flow features helps to understand the overall behavior pattern of the communication session, and flow features can include session duration, total number of bidirectional packets, total byte size, packet size distribution, etc.

[0054] Jitter refers to the degree of fluctuation in the time interval between consecutive data packets in the same data flow. Significant jitter can indicate network congestion, unstable routing, or being subjected to certain interference type attacks, such as delay injection, and is a key indicator for evaluating network service quality and detecting transport layer anomalies.

[0055] Channel features focus on the two communication endpoints, i.e., the communication logic between the network layer IP and the transport layer protocol / port, and extracting channel features helps to reveal deep association patterns and interaction intensity between network entities, which is of great value for detecting hidden channel communication or cross-protocol collaborative attack behavior.

[0056] The source IP-MAC binding feature refers to associating source IP address and source MAC address information, and is used to detect whether there is an abnormal binding relationship in the network, for example, an abnormal association of multiple IP addresses with one MAC address, or an abnormal association of multiple MAC addresses with one IP address. Such abnormal changes are used to represent strong indicators of IP spoofing, man-in-the-middle attacks, or device hijacking (such as becoming a zombie node).

[0057] In an optional embodiment, in step 130, the cloud server performs secondary clustering based on the local behavior patterns of the devices to obtain the global unit flow pattern, which can include: In each gateway node, the mean vector corresponding to each local behavior pattern is calculated based on the local behavior pattern of each device, and the mean vector is uploaded to the cloud server.

[0058] In the cloud server, the mean vector is subjected to secondary clustering to obtain the global unit flow pattern.

[0059] In this embodiment, each gateway node calculates the mean vector corresponding to each local behavior pattern based on the local behavior pattern of each device, that is:

[0060] Through the above formula, all mean vectors are obtained, that is and the mean vector is uploaded to the cloud server.

[0061] In the cloud server, the mean vector is subjected to secondary clustering to obtain the global unit flow pattern, wherein the calculation formula is:

[0062] In the formula, is the global unit flow pattern, is the cluster center thereof, and the special pattern represents a zero flow segment.

[0063] In an optional embodiment, after the cloud server performs secondary clustering based on the local behavior patterns of the devices to obtain the global unit flow pattern in step 130, the method further includes: Each gateway node receives the global unit flow pattern sent by the cloud server.

[0064] In each gateway node, the global unit flow pattern is compared with the local behavior pattern to determine the unit flow number of each data segment in the communication information.

[0065] The unit flow number is assigned to each data segment.

[0066] The cloud server obtains a global unit flow mode through secondary clustering, that is, After receiving the global unit flow mode distributed by the cloud server, each gateway node compares the local feature corresponding to the gateway node, that is, the local behavior mode, with the global unit flow mode, determines the attribution, and allocates a unit flow number to each data segment. The calculation formula can be expressed as: .

[0067] Based on the above formula, the communication information is converted into a unit flow number sequence, which can realize the lightweight representation of the complex flow mode. Through this way, not only the dynamic characteristics of the time sequence communication information can be retained, but also the analysis efficiency and privacy security in the large-scale Internet of Things environment can be significantly improved. The obtained unit flow number sequence is:

[0068] Then, each edge gateway node uploads the obtained unit flow number sequence to the cloud server for subsequent processing.

[0069] In an optional embodiment, the step 140 of detecting the abnormal access behavior of the device in the target power Internet of Things based on the feature data, the local behavior mode, and the global unit flow mode can include: Step 141: obtaining a statistical index based on the feature data, the local behavior mode, and the global unit flow mode.

[0070] Step 142: inputting the statistical index into a pre-trained detection model to obtain the abnormal access behavior of the device in the target power Internet of Things.

[0071] In the pre-trained detection model, the individual behavior baseline and the group behavior baseline are used as the detection standard. The individual behavior baseline is determined based on the local behavior mode, and the group behavior baseline is determined based on the global unit flow mode.

[0072] In this embodiment, the cloud server determines the individual behavior baseline and the group behavior baseline based on the received local behavior mode and the obtained global unit flow mode, which are used as the standard for subsequent detection. The individual behavior baseline is used to represent the normal behavior of each device, and the group behavior baseline is used to represent the normal behavior corresponding to the shared attribute of the device.

[0073] The following steps can be performed in each edge gateway node or in the cloud server: The feature data, local behavior patterns and global unit flow patterns constitute a feature group of each device, and based on a first preset time window, a data sequence of the feature group of each device is captured for dynamic calculation to obtain various statistical indicators, such as count, average value, variance, median value and the like of the characteristic value; and for jitter, average jitter is calculated. The first preset time window can be a plurality of preset time windows, such as 1 second, 5 seconds, 10 seconds, 30 seconds and 60 seconds, and for each data sequence, a sliding time window technology can be used to capture the data packet sequence at a fixed interval.

[0074] Through the above method, the change of the feature at different time scales can be evaluated, both the sudden short-term anomaly can be captured sensitively, and the latent long-term trend can be identified effectively, and comprehensive behavior analysis from micro to macro is provided. The sharp rise of the data packet count or the flow feature in the short time window (such as 1 second or 5 seconds) can indicate a distributed denial of service (Distributed Denial of Service, DDoS) attack or a burst of scanning behavior; and the slow and continuous growth of the flow feature or the abnormal drift of the source IP-MAC binding relationship in the longer time window (such as 30 seconds or 60 seconds) is more likely to indicate the existence of a low-speed denial of service attack (Slow DoS) or a hidden data leakage activity. At the same time, the longer time window can smooth the instantaneous fluctuation, and the robustness to background noise is improved, and the flexibility in the time dimension significantly improves the reliability and accuracy of the anomaly detection system.

[0075] In the embodiment, the pre-trained detection model can be a Transformer model, which is improved by using multi-scale feature fusion and can realize anomaly detection on different behavior baselines.

[0076] Figure 2 is an architecture diagram of the detection model provided by the embodiment of the application; the following refers to Figure 2 The detection process of the embodiment is described.

[0077] First, the statistical indicators are input into the pre-trained detection model, and the statistical indicators are converted into low-dimensional and dense vector representations in the feature embedding layer of the model. The position encoder injects position information into the vector output by the feature embedding layer, so that the model can perceive the time sequence or spatial order of the features. The stacked encoder layer encodes the input sequence features in depth, captures long-distance dependence and context association within the sequence, and outputs feature representations containing global semantics.

[0078] The stacked decoder layer generates an output sequence meeting the task requirements based on the global features output by the encoder and the vectors with position information output by the position encoder, and finally determines the abnormal access behavior of the device in the target power internet of things through the all-connected layer based on the individual behavior baseline and the group behavior baseline as the detection standard.

[0079] Since the embodiment encodes the data segments of each device, the unit flow number sequence corresponding to the device is generated, and accordingly, when the abnormal access behavior of the device in the target power internet of things is monitored, the corresponding unit flow number sequence can be output to accurately locate the device with abnormal access and the abnormal access period of the device.

[0080] Compared with the traditional model, the detection model provided by the embodiment has the following advantages: taking accuracy, macro-averaged precision, macro-averaged recall and macro-averaged F1 score as main performance indicators, the model can better extract multi-dimensional features of data, so that the detection performance is improved to a certain extent. Especially in terms of accuracy and precision, the scheme is improved more significantly than other algorithms, fully illustrating that the model has good performance in anomaly detection.

[0081] In summary, the method provided by the embodiment of the application can be summarized as follows: In the initial stage of data collection, the global two-stage clustering technology is used to analyze the power internet of things flow. This design abstracts through edge-cloud collaboration layering, while compressing the data size, the spatio-temporal characteristics of the flow behavior are completely preserved, providing infrastructure support for large-scale anomaly detection and energy efficiency optimization of the power internet of things.

[0082] Since the behavior of the power internet of things device is affected by the operation state of the power system, the network communication condition, the state of the device itself and other factors, it presents complex nonlinearity, dynamics and spatial topology correlation and time series dependence. These behavior information is contained in different time granularity and spatial range, and single scale or single type of feature is difficult to fully describe its complexity. In order to understand the key tasks of long-term behavior evolution or cross-device collaborative state, a multi-scale spatio-temporal feature set is constructed by fusing original features and deep feature engineering.

[0083] In the process of anomaly detection of the zero-trust power internet of things, a multi-scale feature fusion enhanced Transformer model is designed to realize anomaly detection and classification output of different behavior baselines. The scheme provides accurate and efficient anomaly behavior recognition capability for the power internet of things under the zero-trust architecture through spatio-temporal multi-scale feature fusion and behavior correlation mining.

[0084] For the zero-trust power internet of things under the new power system, a deep mining and continuous detection system covering all elements of the network data throughout the whole life cycle of the data is formed, and the security policy is adaptively adjusted according to the dynamic change of the detection result.

[0085] A zero-trust network solution is constructed for heterogeneous access of distributed resources in a new power system, providing plug-and-play access services for devices, and after device access, the network trust evaluation system adjusts the trust degree of the device according to the behavior of the device, and guarantees the service quality and security of communication.

[0086] In the whole scene of heterogeneous access of distributed resources in the new power system, the interaction among access authentication, identity proof and trust evaluation forms a complex problem model. By designing the overall framework at the system level, the zero-trust principle is combined with AI (feature engineering and model), and the decentralized trust guarantee is innovatively realized, breaking through the traditional boundary security mode.

[0087] The above method has the following beneficial effects: Through multi-scale feature fusion and behavior association mining, the feature discrimination ability of normal and abnormal behaviors is significantly improved, and accurate and efficient anomaly identification (for example, accurately detecting abnormal behaviors of devices or users) is realized. Deep feature engineering mines the value of data, laying the foundation for building a "high-performance and high-robustness device state perception and security protection system", which can effectively cope with various factors such as power system operation state and network communication condition.

[0088] Based on the dynamic detection result, the security policy is adaptively adjusted, supporting real-time data flow, suitable for the high real-time requirement of the power system; at the same time, feature engineering and model design enhance the robustness of the system to data noise and changes.

[0089] By fusing original features and deep feature engineering to construct a multi-scale spatio-temporal feature set, it is an effective solution to cope with the complexity of power internet of things device behavior and multi-dimensional information. This method significantly improves the feature representation ability, deeply mines the data value, and lays the foundation for building a high-performance and high-robustness device state perception and security protection system.

[0090] The two-stage hierarchical clustering strategy (edge + cloud) optimizes resource allocation, the edge layer processes local data to reduce delay, and the cloud integrates global data to support large-scale deployment, effectively coping with the challenges of large number of devices and large amount of data.

[0091] Through multi-scale spatio-temporal feature engineering and improved Transformer model, the accuracy of anomaly detection is significantly improved, reducing false positives and false negatives, meeting the ultra-high security requirements of the power system.

[0092] The hierarchical clustering strategy optimizes the data processing flow, that is, the edge layer reduces data transmission delay, and the cloud provides a global view, combined with the AI model to realize fast detection, supporting the high real-time demand of the power internet of things, such as timely response to device anomalies.

[0093] The zero trust principle of "from no trust, always verification" is realized, a continuous detection system throughout the whole life cycle of data is formed, decentralized trust guarantee is provided, the limitation of traditional boundary security is broken through, and more comprehensive and adaptive protection is provided for the power Internet of Things.

[0094] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiment of the application.

[0095] The following is the device embodiment of the application, and for details not described in detail, reference can be made to the corresponding method embodiments described above.

[0096] Figure 3 The structure schematic diagram of the power Internet of Things device abnormal access behavior detection device provided by the embodiment of the application is shown, only the part related to the embodiment of the application is shown for convenience of description, and the details are as follows: The acquisition module 31 is configured to acquire device information and communication information of each device in the target power Internet of Things; The gateway module 32 is configured to perform initial clustering according to the communication information of each device at each edge node gateway, to obtain a local behavior mode of each device; meanwhile, feature data of the device information and the communication information is extracted; The cloud module 33 is configured to perform secondary clustering based on the local behavior mode of each device at a cloud server, to obtain a global unit flow mode; The detection module 34 is configured to detect the device abnormal access behavior in the target power Internet of Things based on the feature data, the local behavior mode and the global unit flow mode.

[0097] In a possible implementation manner, the detection module 34 is specifically configured to: obtain statistical indexes based on the feature data, the local behavior mode and the global unit flow mode; input the statistical indexes into a pre-trained detection model, to obtain the device abnormal access behavior in the target power Internet of Things; In the pre-trained detection model, an individual behavior baseline and a group behavior baseline are used as detection standards; the individual behavior baseline is determined based on the local behavior mode, and the group behavior baseline is determined based on the global unit flow mode.

[0098] In a possible implementation manner, the detection module 34 is specifically configured to: compose a feature group of each device based on the feature data, the local behavior mode and the global unit flow mode; capture a feature group data sequence of each device based on a first preset time window; Based on the feature group data sequence of each device, statistical indicators of each feature value in the feature group of each device are calculated.

[0099] In a possible implementation, the gateway module 32 is specifically configured to: At each edge node gateway, based on a second preset time window, the communication information of each device is divided into continuous data segments; Feature values of the corresponding continuous data segments of each device are extracted, and initial clustering is performed to obtain local behavior patterns of each device.

[0100] In a possible implementation, the gateway module 32 is further configured to: Each gateway node receives a global unit flow pattern sent by the cloud server; At each gateway node, the global unit flow pattern is compared with the local behavior pattern to determine a unit flow number of each data segment in the communication information; The unit flow number is assigned to each data segment.

[0101] In a possible implementation, the detection module 34 is specifically configured to: Based on the feature data, the local behavior pattern and the global unit flow pattern, a device abnormal access behavior in the target power internet of things is detected, and a unit flow number corresponding to a device with an abnormal access behavior is output.

[0102] In a possible implementation, the cloud module 33 is specifically configured to: At each gateway node, based on the local behavior pattern of each device, a mean vector corresponding to each local behavior pattern is calculated, and the mean vector is uploaded to the cloud server; At the cloud server, based on the mean vector, secondary clustering is performed to obtain a global unit flow pattern.

[0103] In a possible implementation, the gateway module 32 is specifically configured to: A preset aggregation statistical method is used to perform aggregation analysis on the device information and the communication information to obtain a feature distribution pattern; According to the feature distribution pattern, feature data is extracted.

[0104] The embodiment of the application further provides an electronic device, including a memory and a processor, the memory stores a computer program, and the processor implements the method in the above method embodiment when executing the computer program.

[0105] In the above embodiments, the description of each embodiment is focused on, and the part not described or recorded in a certain embodiment can be referred to the relevant description of other embodiments. If there is no special description and logical conflict, the terms and / or descriptions between different embodiments are consistent and can be mutually referred to, and the technical features in different embodiments can be combined to form new embodiments according to their inherent logical relationship.

[0106] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can still be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for detecting abnormal access behavior of power Internet of Things devices, characterized in that: include: Collect device information and communication information of each device in the target power Internet of Things; At each edge node gateway, initial clustering is performed based on the communication information of each device to obtain the local behavior pattern of each device; at the same time, feature data of the device information and the communication information are extracted; In the cloud server, secondary clustering is performed based on the local behavior pattern of each device to obtain the global unit traffic pattern; Based on the characteristic data, the local behavior pattern and the global unit traffic pattern, abnormal access behavior of devices in the target power Internet of Things is detected.

2. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 1 is characterized in that: The detecting abnormal access behavior of devices in the target power Internet of Things based on the characteristic data, the local behavior pattern, and the global unit traffic pattern includes: Obtaining statistical indicators based on the characteristic data, the local behavior pattern, and the global unit flow pattern; Inputting the statistical indicators into a pre-trained detection model to obtain abnormal access behavior of devices in the target power Internet of Things; Among them, in the pre-trained detection model, individual behavior baseline and group behavior baseline are used as detection standards; the individual behavior baseline is determined based on the local behavior pattern, and the group behavior baseline is determined based on the global unit flow pattern.

3. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 2 is characterized in that: The obtaining of statistical indicators based on the characteristic data, the local behavior pattern, and the global unit traffic pattern includes: Combining the characteristic data, the local behavior pattern and the global unit flow pattern into a characteristic group for each device; Based on a first preset time window, capturing a feature group data sequence of each device; Based on the feature group data sequence of each device, the statistical index of each feature value in the feature group of each device is calculated.

4. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 1 is characterized in that: At each edge node gateway, initial clustering is performed based on the communication information of each device to obtain the local behavior pattern of each device, including: At each edge node gateway, based on a second preset time window, the communication information of each device is divided into continuous data segments; The characteristic values ​​of the continuous data segments corresponding to each device are extracted and initial clustering is performed to obtain the local behavior pattern of each device.

5. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 4 is characterized in that: After performing secondary clustering on the cloud server based on the local behavior pattern of each device to obtain a global unit traffic pattern, the method further includes: Each gateway node receives the global unit traffic pattern sent by the cloud server; At each gateway node, comparing the global unit flow pattern with the local behavior pattern to determine a unit flow number for each data segment in the communication information; Assign unit flow numbers to each data segment.

6. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 5 is characterized in that: The detecting abnormal access behavior of devices in the target power Internet of Things based on the characteristic data, the local behavior pattern, and the global unit traffic pattern includes: Based on the characteristic data, the local behavior pattern and the global unit flow pattern, abnormal access behavior of devices in the target power Internet of Things is detected, and the unit flow number corresponding to the device with abnormal access behavior is output.

7. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 1 is characterized in that: The cloud server performs secondary clustering based on the local behavior pattern of each device to obtain a global unit traffic pattern, including: At each gateway node, based on the local behavior pattern of each device, a mean vector corresponding to each local behavior pattern is calculated, and the mean vector is uploaded to the cloud server; On the cloud server, secondary clustering is performed based on the mean vector to obtain a global unit traffic pattern.

8. The method for detecting abnormal access behavior of power Internet of Things devices according to claim 1 is characterized in that: The extracting characteristic data of the device information and the communication information includes: Using a preset aggregation statistical method, performing aggregation analysis on the device information and the communication information to obtain a characteristic distribution pattern; Feature data is extracted according to the feature distribution pattern.

9. A device for detecting abnormal access behavior of power Internet of Things devices, characterized in that: include: The acquisition module is used to collect device information and communication information of each device in the target power Internet of Things; The gateway module is used to perform initial clustering at each edge node gateway based on the communication information of each device to obtain the local behavior pattern of each device; at the same time, extract the feature data of the device information and the communication information; The cloud module is used to perform secondary clustering based on the local behavior pattern of each device on the cloud server to obtain the global unit traffic pattern; A detection module is used to detect abnormal access behavior of devices in the target power Internet of Things based on the characteristic data, the local behavior pattern and the global unit traffic pattern.

10. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 8 is implemented.

Images