Power network attack real-time defense method and related device

Abstract

The invention provides a power network attack real-time defense method and a related device, and the method comprises the steps: classifying the flow data of a power network, and obtaining the attack type data distribution; constructing based on the attack type data distribution to obtain an attack type association rule knowledge base; and determining a data stream of the traffic data, and detecting the base attack type association rule knowledge base and the data stream to obtain a network defense decision. According to the invention, the real-time performance, the accuracy and the adaptive capability of power network attack detection can be obviously improved.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a real-time defense method and related apparatus for power grid attacks. Background Art

[0002] This section is intended to provide background or context for the embodiments of this disclosure as set forth in the claims. The description herein is not intended to be a prior art simply because it is included in this section.

[0003] With the deepening of the digital transformation of power systems, traditional security protection systems face three core challenges: the dynamic evolution of attack patterns, the lag in rule base updates, and the inefficiency of processing massive logs. As a critical infrastructure, the power system's security incidents are characterized by high concealment, high complexity, and high severity, making it difficult for traditional static rule bases to cope with constantly changing attack methods.

[0004] However, in related technologies, intrusion detection systems suffer from problems such as delayed static rule updates, high false alarm rates, low algorithm efficiency, and difficulty in handling massive logs through centralized processing. Summary of the Invention

[0005] In view of this, the purpose of this disclosure is to propose a real-time defense method and related device for power grid attacks, which at least to some extent solves one of the technical problems in the related technologies.

[0006] To achieve the above objectives, the first aspect of this exemplary embodiment provides a method for real-time defense against power grid attacks, the method comprising:

[0007] By classifying the traffic data of the power network, the distribution of attack types can be obtained;

[0008] A knowledge base of attack type association rules is constructed based on the attack type data distribution.

[0009] The data flow of the traffic data is determined, and detection is performed based on the attack type association rule knowledge base and the data flow to obtain a network defense decision.

[0010] In some exemplary embodiments, classifying the traffic data of the power network to obtain the attack type data distribution includes:

[0011] The traffic data is transformed to obtain key-value pairs;

[0012] Feature extraction is performed on the key values ​​to obtain a feature dataset;

[0013] The feature dataset is classified to obtain a list of intermediate key-value pairs;

[0014] Aggregate the list of intermediate key-value pairs to obtain an aggregated dataset;

[0015] Feature extraction is performed on the aggregated dataset to obtain the security feature vector of the power network;

[0016] The security feature vectors are classified to obtain the attack type data distribution.

[0017] In some exemplary embodiments, the construction of an attack type association rule knowledge base based on the attack type data distribution includes:

[0018] The security feature vector is transformed to obtain the query matrix;

[0019] The query matrix is ​​summed column by column to obtain the feature frequencies;

[0020] The support of the feature frequencies is calculated to obtain the second frequent itemset;

[0021] The second frequent itemset is optimized based on matrix operations to obtain candidate itemsets;

[0022] The support of the candidate itemset is calculated to obtain the first frequent itemset;

[0023] The support of the first frequent itemset is calculated to obtain the association rules.

[0024] The traffic data is evaluated based on the association rules to obtain an association rule knowledge base;

[0025] The association rule knowledge base and the attack type data distribution are matched to obtain the attack type association rule knowledge base.

[0026] In some exemplary embodiments, the step of detecting based on the attack type association rule knowledge base and the data stream to obtain a network defense decision includes:

[0027] Feature extraction is performed on the data stream to obtain data stream features;

[0028] The data stream features are transformed to obtain a data stream feature vector;

[0029] The network defense decision is obtained by matching the data flow feature vector with the attack type association rule knowledge base.

[0030] Based on the same inventive concept, a second aspect of the exemplary embodiments of this disclosure provides a real-time defense device against power grid attacks, comprising:

[0031] The data distribution determination module is configured to classify the traffic data of the power network to obtain the attack type data distribution;

[0032] The knowledge base determination module is configured to construct an attack type association rule knowledge base based on the attack type data distribution.

[0033] The defense decision determination module is configured to determine the data stream of the traffic data, perform detection based on the attack type association rule knowledge base and the data stream, and obtain a network defense decision.

[0034] In some exemplary embodiments, the data distribution determination module is specifically configured as follows:

[0035] The traffic data is transformed to obtain key-value pairs;

[0036] Feature extraction is performed on the key values ​​to obtain a feature dataset;

[0037] The feature dataset is classified to obtain a list of intermediate key-value pairs;

[0038] Aggregate the list of intermediate key-value pairs to obtain an aggregated dataset;

[0039] Feature extraction is performed on the aggregated dataset to obtain the safety feature vector of the power network;

[0040] The security feature vectors are classified to obtain the attack type data distribution.

[0041] In some exemplary embodiments, the knowledge base determination module is specifically configured as follows:

[0042] The security feature vector is transformed to obtain the query matrix;

[0043] The query matrix is ​​summed column by column to obtain the feature frequencies;

[0044] The support of the feature frequencies is calculated to obtain the second frequent itemset;

[0045] The second frequent itemset is optimized based on matrix operations to obtain candidate itemsets;

[0046] The support of the candidate itemsets is calculated to obtain the first frequent itemset;

[0047] The support of the first frequent itemset is calculated to obtain the association rules.

[0048] The traffic data is evaluated based on the association rules to obtain an association rule knowledge base;

[0049] The association rule knowledge base and the attack type data distribution are matched to obtain the attack type association rule knowledge base.

[0050] In some exemplary embodiments, the defense decision determination module is specifically configured as follows:

[0051] Feature extraction is performed on the data stream to obtain data stream features;

[0052] The data stream features are transformed to obtain a data stream feature vector;

[0053] The network defense decision is obtained by matching the data flow feature vectors with the attack type association rule knowledge base.

[0054] Based on the same inventive concept, a third aspect of the exemplary embodiments of this disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method as described in the first aspect.

[0055] Based on the same inventive concept, a fourth aspect of the exemplary embodiments of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method as described in the first aspect.

[0056] Based on the same inventive concept, a fifth aspect of the exemplary embodiments of this disclosure provides a computer program product including computer program instructions that, when run on a computer, cause the computer to perform the method as described in the first aspect.

[0057] As can be seen from the above description, the real-time defense method and related apparatus for power network attacks provided in this disclosure include: classifying power network traffic data to obtain attack type data distribution; constructing an attack type association rule knowledge base based on the attack type data distribution; determining the data flow of the traffic data; and performing detection based on the attack type association rule knowledge base and the data flow to obtain a network defense decision. This disclosure can significantly improve the real-time performance, accuracy, and adaptability of power network attack detection. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in this disclosure or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A schematic diagram illustrating an application scenario of a real-time defense method against power network attacks provided as an exemplary embodiment of this disclosure;

[0060] Figure 2 A flowchart illustrating a real-time defense method against power network attacks provided as an exemplary embodiment of this disclosure;

[0061] Figure 3 A schematic diagram of data uploading for a real-time defense method against power network attacks provided as an exemplary embodiment of this disclosure;

[0062] Figure 4 A schematic diagram of a real-time defense device against power network attacks provided as an exemplary embodiment of this disclosure;

[0063] Figure 5 A schematic diagram of the structure of an electronic device hardware provided for an exemplary embodiment of this disclosure. DETAILED DESCRIPTION

[0064] It is understood that before using the technical solutions disclosed in the various embodiments of this application, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this application in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0065] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this application's technical solution, based on the prompt message.

[0066] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0067] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this application. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this application.

[0068] It is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0069] To make the objectives, technical solutions, and advantages of this disclosure clearer, the principles and spirit of this disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided merely to enable those skilled in the art to better understand and implement this disclosure, and are not intended to limit the scope of this disclosure in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0070] In this article, it is important to understand that any number of elements in the accompanying figures is for illustrative purposes and not for limitation, and any naming is for distinction only and has no limiting meaning.

[0071] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this disclosure should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar words used in the embodiments of this disclosure do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly. The article "a" or "an" preceding an element does not exclude the existence of multiple such elements.

[0072] The principles and spirit of this disclosure will be explained in detail below with reference to several representative embodiments.

[0073] As described in the background section, intrusion detection systems suffer from problems such as delayed static rule updates, high false alarm rates, low algorithm efficiency, and difficulty in handling massive logs with centralized processing. Specifically, with the deepening of the digital transformation of power systems, traditional security protection systems face three core challenges: dynamic evolution of attack patterns, delayed rule base updates, and insufficient efficiency in processing massive logs. As a critical infrastructure, the power system exhibits highly concealed, complex, and harmful security incidents, making it difficult for traditional static rule bases to cope with constantly evolving attack methods. Especially in scenarios such as power dispatching systems, smart substations, and distribution automation, attackers are constantly innovating their attack methods against SCADA systems, smart meters, and industrial control equipment, while the feature databases that existing security devices rely on have long update cycles, resulting in a severe lack of protection against "zero-day attacks."

[0074] In existing technologies, traditional intrusion detection systems mainly rely on static rule bases and fixed thresholds for judgment, which are difficult to adapt to the rapid evolution of attack patterns, resulting in problems such as lagging rule base updates and high false positive rates. Especially in complex environments of collaborative defense, due to the wide distribution of equipment at various levels of the power system and the differentiated protection requirements, existing association rule mining algorithms have low computational efficiency and cannot meet the needs of real-time defense decision-making. In addition, power internet security data processing faces the efficiency bottleneck of real-time analysis of massive logs, and traditional centralized processing architectures are unable to handle high-concurrency data streams, affecting the timeliness of defense response.

[0075] To address the aforementioned problems, this disclosure provides a real-time defense method and related apparatus for power grid attacks. The method includes:

[0076] This disclosure classifies power network traffic data to obtain attack type data distribution; constructs an attack type association rule knowledge base based on the attack type data distribution; determines the data flow of the traffic data; and performs detection based on the attack type association rule knowledge base and the data flow to obtain network defense decisions. By classifying power network traffic data to obtain attack type data distribution, constructing an attack type association rule knowledge base based on this distribution, determining the data flow of the traffic data, and performing detection based on the association rule knowledge base and the data flow, a network defense decision is finally obtained. This achieves dynamic classification and association of defense elements, effectively improving the power internet security situation awareness and collaborative defense efficiency, reducing security incident response time, and providing more accurate and efficient security protection capabilities for critical power system infrastructure.

[0077] After introducing the basic principles of this disclosure, various non-limiting embodiments of this disclosure will be described in detail below.

[0078] refer to Figure 1 This is a schematic diagram illustrating an application scenario of the real-time defense method against power network attacks provided by an exemplary embodiment of this disclosure.

[0079] This application scenario includes a terminal device 101 and a server 102. The terminal device 101 and the server 102 can be connected via a wired or wireless communication network to achieve data interaction.

[0080] Terminal device 101 may be an electronic device located close to the user side, possessing data transmission and multimedia input / output functions, including but not limited to desktop computers, mobile phones, portable computers, tablet computers, media players, smart wearable devices, personal digital assistants (PDAs), or other electronic devices capable of performing the aforementioned functions. This electronic device may include a processor and a display screen with touch input functionality. The display screen is used to present a graphical user interface (GUI), which can display an application interface. The processor is used to process application data, generate the GUI, and control the display of the GUI on the screen.

[0081] Server 102 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0082] In some exemplary embodiments, the real-time defense method against power grid attacks can be run on terminal device 101 or server 102.

[0083] When the real-time defense method against power grid attacks is running on server 102, server 102 is used to provide real-time defense services against power grid attacks to users of terminal device 101.

[0084] Server 102 classifies the traffic data of the power network to obtain the attack type data distribution;

[0085] Server 102 constructs an attack type association rule knowledge base based on the attack type data distribution.

[0086] Server 102 determines the data stream of the traffic data. After detecting the attack type association rule knowledge base and the data stream, server 102 obtains a network defense decision and then transmits the network defense decision to terminal device 101.

[0087] It should be noted that the above application scenarios are shown only to facilitate understanding of the spirit and principles of this disclosure, and the implementation of this disclosure is not limited in any way. On the contrary, the implementation of this disclosure can be applied to any applicable scenario.

[0088] refer to Figure 2 A real-time defense method for power grid attacks, the method comprising the following steps:

[0089] Step S210: Classify the traffic data of the power network to obtain the attack type data distribution.

[0090] This step addresses the efficiency bottleneck in real-time processing of massive log data in the field of power network security. Traditional centralized processing architectures struggle to handle high-concurrency data streams, impacting the timeliness of defense responses. By employing a distributed computing framework, parallel data processing is achieved, significantly improving processing efficiency.

[0091] In practical implementation, the power network flow data refers to:

[0092] Power network security log data (i.e., flow data) is distributed and stored using the Hadoop Distributed File System (HDFS). The data acquisition process can be represented as the original dataset D = {d_1, d_2, ..., d_n} (where d_i is a single security log record). (See reference...) Figure 3 ,use Figure 3 This method uploads data to HDFS, thereby solving the performance bottleneck problem of traditional centralized storage and supporting efficient storage and access of petabyte-level security logs.

[0093] In some embodiments, classifying the traffic data of the power network to obtain the attack type data distribution includes:

[0094] The traffic data is transformed to obtain key-value pairs;

[0095] Feature extraction is performed on the key values ​​to obtain a feature dataset;

[0096] The feature dataset is classified to obtain a list of intermediate key-value pairs;

[0097] Aggregate the list of intermediate key-value pairs to obtain an aggregated dataset;

[0098] Feature extraction is performed on the aggregated dataset to obtain the security feature vector of the power network;

[0099] The security feature vectors are classified to obtain the attack type data distribution.

[0100] In practice, the traffic data is transformed to obtain key-value pairs; features are extracted from the key-value pairs to obtain a feature dataset; and the feature dataset is classified to obtain an intermediate list of key-value pairs.

[0101] The MapReduce framework is used to process traffic data in parallel. MapReduce data processing consists of two main stages: the Map stage and the Reduce stage. First, the Map stage transforms the power network traffic data: the Map function encapsulates each raw log record (traffic data) into key-value pairs. in For line numbers or timestamps This is the entire log entry; it is then parsed within the same Map task. Key features such as protocol type, service type, and connection status are extracted to form a feature dataset. Records are then initially classified according to feature values, generating a list of zero to multiple intermediate key values. For "feature-category" combinations, The final output is the number of times the combination appears in the current data block. This data is then used for subsequent Reduce aggregation, enabling integrated block-level processing, feature extraction, and preliminary classification.

[0102] In practice, the aggregated dataset is obtained by aggregating the intermediate key-value pair list as follows:

[0103] During the Reduce phase, the system receives a list of intermediate key-value pairs from the Map phase, where each key... Represents a certain "feature-category" combination, corresponding to The set of occurrences of this combination across all data blocks; the Reduce function performs a function on each... and To perform aggregation, The total frequency is obtained by summing the counts in the table, and then the result is encapsulated into new key-value pairs. It is still the same feature-category combination. Given its global occurrence count, the final output is... As an aggregated dataset, it completes cross-node merging and generates normalized results that can be directly used for subsequent association rule mining.

[0104] In specific implementation, the method for extracting features from the aggregated dataset to obtain the security feature vector of the power network is as follows:

[0105] When performing feature extraction on the aggregated dataset, a specially designed function F is called to map each aggregated log entry d_i to a security feature vector: F(d_i) = {f_1, f_2, ..., f_m}. In the power network security scenario, taking the NSL-KDD dataset as an example (where NSL-KDD is a widely used public dataset for network intrusion detection research, derived from the KDD Cup1999 dataset, mainly used to evaluate the performance of anomaly detection algorithms (such as Isolation Forest, SVM, etc.) in the network security field), key features such as protocol type, service type, and connection status flags are extracted for subsequent processing. The NSL-KDD dataset is used, containing training and testing sets, covering various attack types and normal traffic. Each record in the NSL-KDD dataset contains 43 features, of which 41 refer to the traffic input itself, and the last two are the label (normal or attack) and the score (the severity of the traffic input itself). The key features selected are protocol type, service type, and connection status flags, as well as attack type labels, with the possibility of expanding to include more features. The protocol type is a classification feature, with possible values ​​including TCP, UDP, and ICMP. The service type is also a classification feature, with possible values ​​including, but not limited to, http, ftp, telnet, smtp, and domain_u, totaling 60 possible service values. This feature represents the target network service, i.e., the service corresponding to the destination port used by the connection. The connection status flag is a classification feature, with possible values ​​including SF, S0, REJ, RSTR, RSTO, SH, S1, S2, S3, and OTH, totaling 11 possible flag values. This feature represents the connection status, with each value representing a different connection status.

[0106] In practice, the security feature vectors are classified to obtain the data distribution of the attack types:

[0107] Based on the extracted security feature vectors, preliminary classification of power network security events is performed to preliminarily statistically analyze the data distribution of power network security logs, providing a foundation for subsequent association rule mining. The NSL_KDD dataset categorizes attacks into four types: Denial-of-Service (DoS) attacks, Probe attacks, Remote Access to Networks (R2L) attacks, and Local Access to Networks (U2R) attacks. 1) DoS is an attack that attempts to shut down traffic to and from a target system. The IDS is overwhelmed by abnormal traffic that the system cannot handle and shuts down to protect itself. This prevents normal traffic from accessing the network. An example of this might be an online retailer being overwhelmed with online orders on a big promotional day, and because the network cannot handle all the requests, it shuts down to prevent paying customers from buying anything. This is the most common attack in the dataset. 2) Probe is an attack that attempts to obtain information from the network. The goal here is to steal important information like a thief, whether it's personal information about customers or banking information. 3) U2R is an attack that starts with a regular user account and attempts to access the system or network as a superuser (root). Attackers attempt to exploit vulnerabilities in the system to gain root privileges / access rights. 4) R2L is an attack that attempts to gain local access to a remote machine. The attacker lacks local access to the system / network and attempts to gain access by "cracking" them. The data distribution for each attack type is shown in Table 1:

[0108] Table 1. Data Distribution of Attack Types in the NSL_KDD Dataset

[0109]

[0110]

[0111] Step S220: Based on the attack type data distribution, construct an attack type association rule knowledge base.

[0112] In this step, matrix operation optimization solves the problem of low computational efficiency in the traditional Apriori algorithm, significantly improving the algorithm's efficiency.

[0113] In some embodiments, the construction of an attack type association rule knowledge base based on the attack type data distribution includes:

[0114] The security feature vector is transformed to obtain the query matrix;

[0115] Based on the query matrix, the first frequent itemset is obtained;

[0116] Based on the attack type data distribution and the first frequent itemset, an attack type association rule knowledge base is constructed.

[0117] In practice, the security feature vector is transformed to obtain the query matrix in the following way:

[0118] Converting power network security features into binary matrices lays the foundation for efficient matrix operations. Attribute matrix A contains all possible network features (such as protocol type, service type, connection status, etc.). Query matrix Q: Each row represents a network connection record, and each column represents a feature; a value of 1 indicates the record possesses the feature, and a value of 0 indicates it does not. In power network security scenarios, this matrix representation method can efficiently handle the following features: power SCADA protocol features (such as Modbus, DNP3, IEC61850, etc.); power equipment communication behavior features (such as control commands, data queries, configuration modifications, etc.); and power system abnormal state features (such as voltage fluctuations, frequency deviations, load mutations, etc.).

[0119] In specific implementation, the first frequent itemset is obtained by constructing it based on the query matrix as follows:

[0120] By efficiently identifying frequent items of a single feature through matrix operations, the first frequent itemset can be generated.

[0121] In specific implementation, the attack type association rule knowledge base is constructed based on the attack type data distribution and the first frequent itemset in the following way:

[0122] The confidence screening is guided by the attack type data distribution. The "feature → attack type" rule is extracted from the first frequent itemset and dynamically updated into an association rule knowledge base after support evaluation and deprecation cleaning.

[0123] The above exemplary embodiments have described how to obtain the association rule knowledge base. Below, we will specifically describe how to obtain the first frequent itemset:

[0124] In this exemplary embodiment, the step of constructing a first frequent itemset based on the query matrix includes:

[0125] The query matrix is ​​summed column by column to obtain the feature frequencies;

[0126] The support of the feature frequencies is calculated to obtain the second frequent itemset;

[0127] The second frequent itemset is optimized based on matrix operations to obtain candidate itemsets;

[0128] The support of the candidate itemset is calculated to obtain the first frequent itemset.

[0129] In practice, the query matrix is ​​summed column by column to obtain the feature frequencies; the support of the feature frequencies is then calculated to obtain the second frequent itemset.

[0130] Matrix operations are used to efficiently identify frequent items for individual features, laying the foundation for subsequent iterations. The summation of each column of the query matrix Q yields the frequency of each feature (i.e., feature frequency). Dividing this frequency by the total number of records (i.e., power network flow data) gives the support for each feature. Features with support greater than or equal to the minimum support threshold are selected, forming a frequent one-itemset L1. In this model, each column of the attribute matrix A corresponds to a candidate feature. By summing each column of A and calculating the support, the columns that meet the threshold constitute the frequent one-itemset L1. In power network security scenarios, this step can quickly identify: frequently occurring abnormal protocols (such as non-standard Modbus requests), common attack characteristics (such as power system scanning and abnormal authentication attempts), and communication patterns of critical equipment (such as the communication frequency between the master station and substations).

[0131] In practice, the second frequent itemset is optimized based on matrix operations to obtain the candidate itemset in the following way:

[0132] By leveraging set operations and matrix operations, candidate itemsets are generated efficiently, avoiding the extensive loop comparisons found in the traditional Apriori algorithm. Two itemsets are selected from frequent k-1 itemsets Lk-1. If the first k-2 items of these two itemsets are identical, they are merged to generate a new candidate k-itemset. This method avoids generating unnecessary candidates and significantly reduces computational cost. This optimization is particularly suitable for identifying complex attack chains (such as multi-stage attacks that involve scanning followed by penetration), detecting abnormal communication patterns between devices (such as communication between substations and unauthorized equipment), and detecting abnormal operation sequences in power distribution automation systems.

[0133] In specific implementation, the support of the candidate itemset is calculated to obtain the first frequent itemset in the following way:

[0134] The support of candidate itemsets is efficiently calculated using matrix operations, and frequent itemsets are iteratively generated until no new frequent itemsets can be generated. For each candidate itemset, its support is calculated using matrix operations, and candidate itemsets with support greater than or equal to the minimum support threshold are selected to form a frequent k-itemset Lk. Then, the process of optimizing frequent itemsets based on matrix operations and calculating the support of optimized frequent itemsets is repeated until no new frequent itemsets can be generated, thus obtaining the first frequent itemset.

[0135] The above exemplary embodiment describes how to obtain the first frequent itemset. Below, we will specifically describe how to obtain the attack type association rule knowledge base:

[0136] In this exemplary embodiment, the step of constructing the attack type association rule knowledge base based on the attack type data distribution and the first frequent itemset includes:

[0137] The support of the first frequent itemset is calculated to obtain the association rules.

[0138] The traffic data is evaluated based on the association rules to obtain an association rule knowledge base;

[0139] The association rule knowledge base and the attack type data distribution are matched to obtain the attack type association rule knowledge base.

[0140] In specific implementation, support is calculated on the first frequent itemset to obtain association rules; the traffic data is evaluated based on the association rules to obtain the association rule knowledge base.

[0141] First, based on the first frequent itemset, an initial knowledge base is constructed using NSL-KDD training data. Association rules, support data, and frequent patterns are automatically extracted to form a complete knowledge base containing "feature-attack type" mappings, occurrence frequencies, and co-occurrence patterns. Then, a dynamic support evaluation mechanism is activated to continuously record and calculate the average rate of change of support for each pattern. Patterns with continuously rising support are marked as emerging threats and given higher priority, while patterns with continuously declining support have their weights reduced, achieving parameter adaptation. At the same time, a rule evolution tracking and outdated rule cleanup mechanism is run. Combining three indicators—rule age, usage frequency, and support trend—rules that are "old but underused" or have "significantly declining support" are immediately marked as outdated and removed. Thus, a concise, timely, and highly confident association rule knowledge base is continuously output during the real-time evaluation of traffic data.

[0142] In practice, the method for matching the association rule knowledge base and the attack type data distribution to obtain the attack type association rule knowledge base is as follows:

[0143] The system matches the current attack type data distribution with the association rule knowledge base, retaining only the rules corresponding to the active attack types in the distribution; then it triggers a specific format generation mechanism to extract high-confidence rules in the form of "protocol type-service type-connection status flag → DoS / Probe / R2L / U2R" from the frequent itemset, and immediately removes rules with confidence scores below the threshold. Finally, it outputs the attack type association rule knowledge base, enabling security analysts to understand and apply it directly.

[0144] Step S230: Determine the data flow of the traffic data, perform detection based on the attack type association rule knowledge base and the data flow, and obtain a network defense decision.

[0145] In this step, by accurately matching the data stream with the association rule knowledge base and conducting risk assessment, the system not only significantly improves the accuracy of attack identification, but also generates differentiated defense strategies for various types of attacks, thereby comprehensively strengthening the defense effect.

[0146] In specific implementation, the data stream of the traffic data refers to:

[0147] The system continuously receives data streams of traffic data from the power network, including SCADA communication, substation network traffic, and enterprise IT system logs. In this solution, the test set of the NSL_NDD dataset is used as the real-time data stream.

[0148] In some embodiments, the step of detecting based on the attack type association rule knowledge base and the data stream to obtain a network defense decision includes:

[0149] Feature extraction is performed on the data stream to obtain data stream features;

[0150] The data stream features are transformed to obtain a data stream feature vector;

[0151] The network defense decision is obtained by matching the data flow feature vector with the attack type association rule knowledge base.

[0152] In specific implementation, feature extraction is performed on the data stream to obtain data stream features; the data stream features are then transformed to obtain data stream feature vectors in the following manner:

[0153] For each piece of data, feature extraction is performed, and the raw data is converted into a feature vector. The features also include key network features such as protocol type, service type, and connection status flags.

[0154] In practice, the network defense decision is obtained by matching the data flow feature vector with the attack type association rule knowledge base.

[0155] When predicting attack types in a data stream using an attack type association rule knowledge base, the data stream feature vector is matched with the association rules in the knowledge base. If a feature satisfies the antecedent of a rule, its consequent is predicted as a possible attack type. Multiple rules may match simultaneously, requiring a priority strategy to select the best rule. An efficient rule matching strategy is designed to select the best rule from multiple matching rules for prediction. This strategy prioritizes the longest rule and prioritizes the highest confidence rule. Longest rule priority: the more features a rule contains, the more specific the rule, and the higher its priority. Highest confidence priority: among rules of the same length, the higher the confidence level, the more reliable the rule, and the higher its priority. This strategy effectively reduces false positives and improves prediction accuracy. Subsequently, differentiated defenses are triggered in real time based on the predicted attack type, thereby generating network defense decisions. Specifically, for DoS attacks, the following measures are taken: traffic scrubbing, activating backup servers, and updating firewall rules; for probing attacks, the following measures are taken: blocking the scanning source IP, strengthening port scanning detection, and activating the honeypot system; for R2L attacks, the following measures are taken: locking affected accounts, enhancing access authentication, and restricting remote access permissions; and for U2R attacks, the following measures are taken: isolating affected systems, initiating system integrity checks, and restricting privileged operations.

[0156] It should be noted that the method of this disclosure embodiment can be executed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method of this disclosure embodiment, and the multiple devices will interact with each other to complete the method described.

[0157] It should be noted that the above description describes some embodiments of this disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0158] Based on the same inventive concept, corresponding to any of the above embodiments, this disclosure also provides a real-time defense device against power network attacks.

[0159] refer to Figure 4 The real-time defense device against power grid attacks includes:

[0160] The data distribution determination module 410 is configured to classify the traffic data of the power network to obtain the attack type data distribution;

[0161] The knowledge base determination module 420 is configured to construct an attack type association rule knowledge base based on the attack type data distribution.

[0162] The defense decision determination module 430 is configured to determine the data stream of the traffic data, perform detection based on the association rule knowledge base and the data stream, and obtain a network defense decision.

[0163] In this exemplary embodiment, the data distribution determination module 410 is specifically configured as follows:

[0164] The traffic data is transformed to obtain key-value pairs; features are extracted from the key-value pairs to obtain a feature dataset; the feature dataset is classified to obtain an intermediate key-value pair list; the intermediate key-value pair list is aggregated to obtain an aggregated dataset; features are extracted from the aggregated dataset to obtain a security feature vector of the power network; the security feature vector is classified to obtain the attack type data distribution.

[0165] In this exemplary embodiment, the knowledge base determination module 420 is specifically configured as follows:

[0166] The security feature vector is transformed to obtain a query matrix; the query matrix is ​​summed column by column to obtain feature frequencies; the support of the feature frequencies is calculated to obtain a second frequent itemset; the second frequent itemset is optimized based on matrix operations to obtain candidate itemsets; the support of the candidate itemsets is calculated to obtain a first frequent itemset; the support of the first frequent itemset is calculated to obtain association rules; the traffic data is evaluated based on the association rules to obtain an association rule knowledge base; the association rule knowledge base and the attack type data distribution are matched to obtain an attack type association rule knowledge base.

[0167] In this exemplary embodiment, the defense decision determination module 430 is specifically configured as follows:

[0168] The data flow of the traffic data is determined, and features are extracted from the data flow to obtain data flow features; the data flow features are transformed to obtain data flow feature vectors; the network defense decision is obtained by matching the data flow feature vectors with the attack type association rule knowledge base.

[0169] For ease of description, the above apparatus is described in terms of its functions, divided into various modules. Of course, in implementing this disclosure, the functions of each module can be implemented in one or more software and / or hardware.

[0170] The apparatus described above is used to implement the corresponding real-time defense method against power network attacks in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0171] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the real-time defense method against power network attacks described in any of the above embodiments.

[0172] Figure 5 This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0173] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0174] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0175] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0176] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0177] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0178] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0179] The electronic devices described above are used to implement the corresponding real-time defense method against power grid attacks in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0180] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the real-time defense method against power network attacks as described in any of the above embodiments.

[0181] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0182] The aforementioned non-transitory computer-readable storage media can be any available medium or data storage device that a computer can access, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0183] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the real-time defense method against power network attacks as described in any of the embodiments in the exemplary method section above, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0184] Based on the same inventive concept, corresponding to the real-time power grid attack defense method described in any of the above embodiments, this disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to perform the real-time power grid attack defense method. Corresponding to the execution entity for each step in each embodiment of the real-time power grid attack defense method, the processor executing the corresponding step may belong to the corresponding execution entity.

[0185] The computer program product of the above embodiments is used to cause the computer and / or the processor to execute the real-time defense method against power network attacks as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0186] Those skilled in the art will recognize that embodiments of this disclosure can be implemented as a system, method, or computer program product. Therefore, this disclosure can be implemented as entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." Furthermore, in some embodiments, this disclosure can also be implemented as a computer program product contained in one or more computer-readable media, which includes computer-readable program code.

[0187] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (not exhaustive) of a computer-readable storage medium may include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0188] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0189] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0190] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0191] It should be understood that each block of a flowchart and / or block diagram, as well as combinations of blocks in a flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine that, when executed by a computer or other programmable data processing device, creates means for implementing the functions / operations specified in the blocks of the flowchart and / or block diagram.

[0192] These computer program instructions may also be stored in a computer-readable medium that enables a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce a product comprising an instruction apparatus that implements the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0193] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, such that the instructions that execute on the computer or other programmable apparatus can provide a process for implementing the functions / operations specified in the boxes of a flowchart and / or block diagram.

[0194] Furthermore, although the operations of the methods of this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. Rather, the steps depicted in the flowcharts may be executed in a different order. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0195] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0196] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0197] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0198] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0199] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0200] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

[0201] While the spirit and principles of this disclosure have been described with reference to several specific embodiments, it should be understood that this disclosure is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for convenience of expression. This disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. The scope of the appended claims is to be interpreted in the broadest sense, thereby encompassing all such modifications and equivalent structures and functions.

Claims

1. A real-time defense method for power grid attacks, characterized in that, include: By classifying the traffic data of the power network, the distribution of attack types can be obtained; A knowledge base of attack type association rules is constructed based on the attack type data distribution. The data flow of the traffic data is determined, and detection is performed based on the attack type association rule knowledge base and the data flow to obtain a network defense decision.

2. The method according to claim 1, characterized in that, The classification of power network traffic data to obtain attack type data distribution includes: The traffic data is transformed to obtain key-value pairs; Feature extraction is performed on the key values ​​to obtain a feature dataset; The feature dataset is classified to obtain a list of intermediate key-value pairs; Aggregate the list of intermediate key-value pairs to obtain an aggregated dataset; Feature extraction is performed on the aggregated dataset to obtain the security feature vector of the power network; The security feature vectors are classified to obtain the attack type data distribution.

3. The method according to claim 2, characterized in that, The attack type association rule knowledge base, constructed based on the attack type data distribution, includes: The security feature vector is transformed to obtain the query matrix; Based on the query matrix, the first frequent itemset is obtained; Based on the attack type data distribution and the first frequent itemset, an attack type association rule knowledge base is constructed.

4. The method according to claim 3, characterized in that, The construction based on the query matrix yields the first frequent itemset, including: The query matrix is ​​summed column by column to obtain the feature frequencies; The support of the feature frequencies is calculated to obtain the second frequent itemset; The second frequent itemset is optimized based on matrix operations to obtain candidate itemsets; The support of the candidate itemset is calculated to obtain the first frequent itemset.

5. The method according to claim 3, characterized in that, The attack type association rule knowledge base, constructed based on the attack type data distribution and the first frequent itemset, includes: The support of the first frequent itemset is calculated to obtain the association rules. The traffic data is evaluated based on the association rules to obtain an association rule knowledge base; The association rule knowledge base and the attack type data distribution are matched to obtain the attack type association rule knowledge base.

6. The method according to claim 1, characterized in that, The process of detecting attacks based on the attack type association rule knowledge base and the data stream to obtain network defense decisions includes: Feature extraction is performed on the data stream to obtain data stream features; The data stream features are transformed to obtain a data stream feature vector; The network defense decision is obtained by matching the data flow feature vector with the attack type association rule knowledge base.

7. A real-time defense device against power grid attacks, characterized in that, include: The data distribution determination module is configured to classify the traffic data of the power network to obtain the attack type data distribution; The knowledge base determination module is configured to construct an attack type association rule knowledge base based on the attack type data distribution. The defense decision determination module is configured to determine the data stream of the traffic data, perform detection based on the attack type association rule knowledge base and the data stream, and obtain a network defense decision.

8. The apparatus according to claim 7, characterized in that, The data distribution determination module is specifically configured as follows: The traffic data is transformed to obtain key-value pairs; Feature extraction is performed on the key values ​​to obtain a feature dataset; The feature dataset is classified to obtain a list of intermediate key-value pairs; Aggregate the list of intermediate key-value pairs to obtain an aggregated dataset; Feature extraction is performed on the aggregated dataset to obtain the safety feature vector of the power network; The security feature vectors are classified to obtain the attack type data distribution.

9. The apparatus according to claim 8, characterized in that, The knowledge base determination module is specifically configured as follows: The security feature vector is transformed to obtain the query matrix; The query matrix is ​​summed column by column to obtain the feature frequencies; The support of the feature frequencies is calculated to obtain the second frequent itemset; The second frequent itemset is optimized based on matrix operations to obtain candidate itemsets; The support of the candidate itemsets is calculated to obtain the first frequent itemset; The support of the first frequent itemset is calculated to obtain the association rules. The traffic data is evaluated based on the association rules to obtain an association rule knowledge base; The association rule knowledge base and the attack type data distribution are matched to obtain the attack type association rule knowledge base.

10. The apparatus according to claim 9, characterized in that, The defense decision determination module is specifically configured as follows: Feature extraction is performed on the data stream to obtain data stream features; The data stream features are transformed to obtain a data stream feature vector; The network defense decision is obtained by matching the data flow feature vectors with the attack type association rule knowledge base.

11. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the method as described in any one of claims 1 to 6.

12. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions for causing the computer to perform the method of any one of claims 1 to 6.

13. A computer program product, characterized in that, It includes computer program instructions that, when run on a computer, cause the computer to perform the method as described in any one of claims 1 to 6.

Images