GAN-based power protocol honeypot trapping and anomaly identification method

Abstract

The application discloses a power protocol honeypot trapping and anomaly identification method based on GAN, constructs a data set by collecting real power protocol traffic, generates diversified attack samples conforming to the protocol syntax by using the GAN of the Transformer architecture, and improves the robustness by combining data enhancement technologies such as random truncation and noise injection. A virtual honeypot device is deployed to simulate the behavior of power equipment, real-time fusion of attack logs and traffic characteristics is performed, a graph neural network is used to model the cross-message interaction relationship, and self-supervised learning is introduced to detect semantic anomalies. Experiments show that the method achieves a detection accuracy of 98.2% on IEEE 123-Bus and other data sets, supports dynamic adaptation of protocol versions, and realizes accurate tracing of attack source IP and intent through honeypot log correlation analysis, thereby effectively improving the active defense capability of the power system against new attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system security, and particularly relates to a GAN-based power protocol honeypot trapping and abnormality identification method, which is used for improving the attack detection capability of power communication protocols (such as IEC 60870-5-104, Modbus, DNP3, etc.). BACKGROUND

[0002] With the development of energy internet and smart grid, power system communication protocols are facing increasingly complex network attack threats. Traditional honeypot technology simulates real power equipment to attract attackers, but has the following defects:

[0003] Single attack sample: existing honeypots rely on preset rules or static data, making it difficult to generate diverse attack samples, resulting in limited recognition of new attacks.

[0004] Insufficient abnormality detection accuracy: rule-based abnormality detection models (such as threshold judgment, feature matching) have low recognition rates for stealthy attacks (such as protocol fuzzing attacks, zero-day exploit) and rely on manually labeled data.

[0005] Poor dynamic adaptability: version iteration and communication mode changes of power protocols require frequent updates of traditional honeypot rules, resulting in high maintenance costs.

[0006] In the prior art, some documents propose a deep learning-based power protocol abnormality detection method, but it relies on a large amount of labeled data; some documents use traditional GAN to generate attack traffic, but do not combine honeypot trapping mechanisms, and cannot realize real-time tracking and feedback optimization of attack behavior. Therefore, an innovative method combining GAN and honeypot technology is urgently needed to improve the intelligent level of power system security protection. SUMMARY

[0007] This section aims to summarize some aspects of the embodiments of the present application and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the abstract and title of the specification to avoid obscuring the purpose of this section, abstract and title, and such simplifications or omissions cannot be used to limit the scope of the present application.

[0008] In view of the above problems existing in the prior art of power communication protocol, the present application is proposed.

[0009] Therefore, the technical problem solved by the present application is to solve the problems of insufficient recognition of complex attack patterns, high false positive rate and poor dynamic adaptability of existing honeypot systems.

[0010] To solve the above technical problems, the application provides the following technical solutions: a power protocol honeypot trapping and anomaly identification method based on GAN, comprising the following steps: S1: collecting real protocol traffic from a power system communication link to construct an original data set; S2: extracting time sequence features and semantic features of protocol fields and converting them into a tensor format input model; S3: GAN generates attack samples; S4: constructing a virtual power device based on the generated attack samples, simulating real communication behavior, and deploying a honeypot trapping strategy; S5: multi-modal fusion of attack behavior data collected by the honeypot and real-time traffic features; S6: modeling protocol interaction relationships using a graph neural network to capture cross-message anomaly patterns; S7: associating anomaly detection results with honeypot trapping logs, optimizing GAN generation strategies, and synchronously locating attack source IP and attack intent by analyzing attacker behavior paths.

[0011] As a preferred scheme of the power protocol honeypot trapping and anomaly identification method based on GAN, wherein the real protocol traffic collected in S1 includes ASDU messages of IEC 60870-5-104 and function code requests of Modbus.

[0012] As a preferred scheme of the power protocol honeypot trapping and anomaly identification method based on GAN, wherein after S2, the method further comprises: expanding the data set through random truncation and noise injection to improve the robustness of the model.

[0013] As a preferred scheme of the power protocol honeypot trapping and anomaly identification method based on GAN, wherein the GAN generates attack samples in S3 specifically includes the following structure and implementation method:

[0014] 1. Generator network

[0015] Input: semantic feature vector of power protocol;

[0016] Structure: use Transformer architecture to generate attack messages that conform to protocol syntax;

[0017] 2. Discriminator network

[0018] Input: mixed data of real protocol traffic and generated attack samples;

[0019] Structure: LSTM-based time sequence classifier to distinguish between real data and generated data;

[0020] 3. Training process

[0021] Optimize GAN by minimizing cross-entropy loss function, so that the attack samples output by the generator are consistent with the real traffic in terms of semantics and time sequence.

[0022] As a preferred scheme of the power protocol honeypot trapping and anomaly identification method based on GAN, wherein the minimum cross-entropy loss function is specifically:

[0023]

[0024] Wherein, z is an input noise vector, obeying a prior distribution p z ; G(z) is a generator network, inputting noise z and outputting generated attack sample x g ∈X; D(x g ) is a discriminator network, inputting sample x g , and outputting probability value D(x g ) ∈ [0, 1]; E z~pz is the expectation of noise distribution p z .

[0025] As a preferred scheme of the power protocol honeypot trapping and anomaly identification method based on GAN, wherein the honeypot trapping strategy in S4 specifically comprises: dynamically adjusting the honeypot response according to the behavior of the attacker; recording the operation path of the attacker to generate an attack fingerprint.

[0026] As a preferred scheme of the power protocol honeypot trapping and anomaly identification method based on GAN, wherein S6 further comprises: introducing self-supervised learning to detect semantic anomalies by predicting protocol fields.

[0027] The application provides a power protocol honeypot trapping and anomaly identification method based on GAN, which has the following beneficial effects:

[0028] 1. Attack sample diversity: GAN-generated attack samples cover protocol syntax boundary conditions and implicit vulnerabilities, significantly improving the trapping coverage of the honeypot and increasing the attack identification rate by more than 30%;

[0029] 2. Anomaly detection accuracy: the multi-modal model combining GNN and self-supervised learning achieves a detection accuracy of 98.2% on public power protocol data sets (such as IEEE 123-Bus and CIGRE), with a false positive rate of less than 2%;

[0030] 3. Dynamic adaptability: through an online learning mechanism, the model can automatically adapt to protocol version iterations (such as the extended fields of Modbus TCPv1.1 to v1.2);

[0031] 4. Attack tracing capability: the combination of the attack fingerprint recorded by the honeypot and the semantic analysis of the detection model realizes accurate backtracking of the attack path. BRIEF DESCRIPTION OF DRAWINGS

[0032] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings. Among them:

[0033] Figure 1 The method flow chart of the power protocol honeypot trapping and abnormality identification method based on GAN provided by the present application. DETAILED DESCRIPTION

[0034] In order to make the above-mentioned purposes, features and advantages of the present application more apparent and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings of the specification. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort should be within the scope of protection of the present application.

[0035] In the prior art, there are documents that propose a power protocol anomaly detection method based on deep learning, but rely on a large amount of labeled data; there are also documents that use traditional GAN to generate attack traffic, but do not combine the honeypot trapping mechanism, and cannot realize real-time tracking and feedback optimization of attack behavior.

[0036] Therefore, referring to Figure 1 The present application provides a power protocol honeypot trapping and abnormality identification method based on GAN, comprising the following steps:

[0037] S1: Collecting real protocol traffic (ASDU message of IEC 60870-5-104, function code request of Modbus) from the communication link of the power system, and constructing an original data set;

[0038] It should be noted that:

[0039] ① Collection tool: using a network sniffing tool (such as Wireshark, tcpdump or a custom protocol parser) to capture the communication traffic of the power system.

[0040] ② Protocol type:

[0041] IEC 60870-5-104: Extracting ASDU (Application Service Data Unit) message, including address field, control field, data field and other fields.

[0042] Modbus: Capturing function code request (such as 0x03 read register, 0x06 write single register) and response message.

[0043] DNP3: Extract control field, object reference, data field, etc. in frame structure.

[0044] ③Collection environment: deployed in the middle node of power system communication link (such as gateway, switch), to ensure data integrity.

[0045] ④Data format: raw traffic is saved in PCAP file, and key fields are extracted through protocol parser.

[0046] S2: Extract the timing characteristics and semantic characteristics of protocol fields (address field, control field, data field), and convert them into tensor format input model;

[0047] It should be noted that:

[0048] Steps:

[0049] ①Field extraction:

[0050] Semantic features: extract protocol field values (such as Modbus function code 0x03, IEC 60870-5-104 ASDU type).

[0051] Timing characteristics: calculate the time interval of message sending (such as the timestamp of command sequence), data update frequency.

[0052] ②Feature coding:

[0053] Semantic features: One-Hot encoding for discrete fields (such as function code); normalization processing for continuous fields (such as data field values).

[0054] Timing characteristics: convert timestamp to time interval sequence (such as Δt = t i+1 -t i ), and perform sliding window segmentation.

[0055] ③Tensor construction:

[0056] Concatenate semantic features (such as function code, data length) and timing features (such as Δt sequence) into two-dimensional tensor (such as [N, T, D], where N is the number of samples, T is the time step, and D is the feature dimension).

[0057] S3: GAN generates attack samples;

[0058] S4: Based on the generated attack samples, construct virtual power equipment to simulate real communication behavior and complete the deployment of honeypot trapping strategy;

[0059] It should be noted that:

[0060] 1. Protocol simulation layer

[0061] Objective: Construct virtual power devices (such as SCADA servers, smart meters) to simulate real communication behavior.

[0062] Implementation method:

[0063] ① Protocol stack implementation: Use Python's scapy library or dedicated simulation tools (such as PcapPlusPlus) to implement protocol parsing and response.

[0064] ② Virtual device:

[0065] SCADA server: Simulate telemetry data upload (such as voltage, current values) and remote control command response.

[0066] Smart meter: Simulate power reading reporting and parameter setting requests.

[0067] 2, trapping strategy

[0068] ① Dynamic response mechanism:

[0069] Fake error code: When detecting illegal function code requests (such as 0x10), return error codes (such as 0x03).

[0070] Delayed response: Increase response delay (such as 500ms) for high-frequency requests (such as 10 times per second), induce attacker behavior patterns.

[0071] ② Behavior tracking module:

[0072] Log recording: Record attacker operation path (such as command sequence, data reading frequency).

[0073] Attack fingerprint generation: Extract attack features (such as "illegal function code + high-frequency request") through clustering algorithms (such as K-means).

[0074] S5: Multimodal fusion of honeypot collected attack behavior data and real-time traffic features (such as IP source address, protocol version);

[0075] S6: Use graph neural network (GNN) to model protocol interaction relationships, capture cross-message abnormal patterns (such as illegal command sequence);

[0076] S7: Associate anomaly detection results with honeypot trapping logs, optimize GAN generation strategy (such as increase the generation ability of new attacks), synchronize through analyzing attacker behavior path, locate attack source IP and attack intent (such as data tampering, service interruption).

[0077] Please note:

[0078] 1, model feedback

[0079] Objective: Optimize GAN generation strategy to increase the ability to generate new attacks.

[0080] Method:

[0081] Attack feature correlation: Associate anomaly detection results (e.g., "illegal function code + high-frequency request") with honeypot logs to generate new attack samples.

[0082] Generator optimization: Adjust generator input features (e.g., add new function code field) or adjust loss function weights (e.g., increase λ1 to enhance semantic constraints).

[0083] 2、Attack Trace

[0084] Objective: Locate the attack source IP and attack intent.

[0085] Method:

[0086] IP tracking: Analyze the attack source IP's access frequency (e.g., number of accesses per minute) and command patterns (e.g., "read register + write register") through honeypot logs.

[0087] Intent classification: Use classifiers (e.g., SVM, LSTM) to determine attack intent (e.g., data tampering, service interruption).

[0088] Attack path backtracking: Analyze command sequences (e.g., "read register → write register") to infer the attacker's target (e.g., data theft or control interference).

[0089] Note: After S2, it also includes: Expand the data set through random truncation and noise injection to improve model robustness and prevent overfitting.

[0090] Note:

[0091] ① Random truncation: Randomly truncate sub-sequences (e.g., retain the first 50% of packets) from long packet sequences to simulate incomplete attack behavior.

[0092] ② Noise injection:

[0093] Gaussian noise: Add Gaussian noise with mean 0 and standard deviation 0.1 to continuous fields (e.g., data field values).

[0094] Discrete noise: Randomly replace function code fields (e.g., replace 0x03 with 0x04 to simulate illegal requests).

[0095] ③ Data synthesis:

[0096] Use GAN to generate additional samples (e.g., illegal function code requests, super-long data field padding) to supplement the original data set.

[0097] It should be noted that the S3 step GAN generates attack samples specifically includes the following structure and implementation method:

[0098] 1. Generator network (Generator)

[0099] ① Input: semantic feature vector of power protocol (such as function code, data length, timestamp).

[0100] ② Structure:

[0101] Transformer architecture:

[0102] Encoder: Map input semantic features (such as function code One-Hot vector) to hidden space.

[0103] Decoder: Generate attack messages that meet the protocol syntax (such as illegal function code requests, super-long data field padding).

[0104] Output: The generated attack samples are in tensor format (such as [T, D], T is the message sequence length, D is the field dimension).

[0105] ③ Constraints:

[0106] Protocol syntax check: The generated message needs to meet the protocol specification (such as Modbus function code range is 0x00-0xFF, IEC 60870-5-104 ASDU type needs to meet the standard).

[0107] Semantic consistency: The generated function code needs to be logically matched with the data field value (such as 0x03 reading register needs to contain valid register address).

[0108] 2. Discriminator network (Discriminator)

[0109] ① Input: mixed data of real protocol traffic and generated attack samples;

[0110] ② Structure:

[0111] LSTM time series classifier: Input tensor [N, T, D] (N is the number of samples, T is the time step, D is the feature dimension). Extract time series features through LSTM layer, output probability value (D(x)) representing the probability of the sample being real data.

[0112] Output: Probability value D(x) ∈ [0,1], used to distinguish real data from generated data.

[0113] 3. Training process

[0114] Optimize GAN by minimizing cross-entropy loss function, so that the attack samples generated by the generator are consistent with the real traffic in terms of semantics and time series.

[0115] Further, the minimum cross-entropy loss function is specifically:

[0116]

[0117] where z is the input noise vector (latent space sample), which is subject to a prior distribution p z (such as a uniform distribution or a Gaussian distribution); G(z) is a generator network, which inputs noise z and outputs a generated attack sample x g ∈X(such as a protocol message sequence); D(x g ) is a discriminator network, which inputs a sample x g , and outputs a probability value D(x g ) ∈ [0, 1], representing the probability that the sample is real data; E z~pz is the expectation (i.e., the average) of the noise distribution p z .

[0118] It should be noted that in the present application, the training objective of the generative adversarial network (GAN) is to minimize the cross-entropy loss function, so that the attack sample output by the generator (Generator) is consistent with the real power protocol traffic in terms of semantic features (such as protocol field values) and timing features (such as message sending intervals and command sequences). The following is a specific loss function design and parameter explanation:

[0119] Table 1: Loss function parameter details

[0120] Parameter Meaning Description z Noise vector Random variable sampled from latent space, used to generate attack samples. In power protocol scenarios, z can contain semantic constraints of protocol fields (e.g. function code, data length, etc.). G(z) Generator network Using a Transformer or LSTM architecture, input z, output attack sample x that conforms to protocol syntax g (eg. illegal function code requests, overlong data field padding). D(x g )]]> Discriminator network LSTM or CNN-based time series classifier, input x g , output its probability of being real data. In the power protocol scenario, D(x g ) needs to capture both semantic consistency (e.g., whether the field values are consistent with the protocol specification) and timing consistency (e.g., whether the message sending frequency is abnormal). logD(G(z)) Log-likelihood function Log probability of discriminator output, used to measure the "authenticity" of generated samples. The goal of the generator is to maximize D(G(z)), i.e. minimize -logD(G(z)). E z-pz ]]> Expectation operation Calculate the average loss of generated samples by randomly sampling noise z, ensuring coverage of diverse attack patterns.

[0121] Loss function optimization process:

[0122] The generator optimizes the following objective through backpropagation:

[0123]

[0124] Semantic consistency: The generator needs to learn the grammar rules of the power protocol (such as Modbus function code range and IEC60870-5-104 ASDU structure), so that the generated attack sample is consistent with the real traffic in terms of field values.

[0125] Timing consistency: The generator needs to simulate the communication mode of the real protocol (such as command sequence and data update frequency) to avoid generating samples that significantly deviate from normal behavior in terms of timing.

[0126] To further improve the quality of the generated samples, a multi-task loss function can be introduced, combining the constraints of semantic features and timing features:

[0127]

[0128] Semantic loss L semantic : Calculate the mean square error (MSE) or cross-entropy of the generated sample and the real data in the field value.

[0129] Timing loss L temporal : Calculate the timing similarity (such as dynamic time warping DTW distance) of the generated sample and the real traffic by LSTM or Transformer.

[0130] α, β, γ: weight coefficients, balance the importance of each task.

[0131] Further, the honeypot trapping strategy in S4 includes:

[0132] Adjust the honeypot response dynamically according to the attacker's behavior;

[0133] Record the attacker's operation path and generate the attack fingerprint.

[0134] Further, in S6, it also includes: introducing self-supervised learning to detect semantic anomalies by predicting protocol fields (such as data field values).

[0135] It should be noted that in S5, the anomaly detection model construction specifically includes:

[0136] 1, Feature fusion layer

[0137] Objective: Fuse the attack behavior data collected by the honeypot with real-time traffic features.

[0138] Method:

[0139] ① Multi-modal feature splicing:

[0140] Honeypot data: attack fingerprint (such as command sequence, data reading frequency).

[0141] Real-time traffic features: IP source address, protocol version, message sending interval.

[0142] ② Feature normalization: Standardize numerical value features (such as IP address, time interval).

[0143] 2, Detection model

[0144] ① Main model: Graph Neural Network (GNN)

[0145] Objective: Model protocol interaction relationships and capture cross-message anomaly patterns.

[0146] Implementation:

[0147] Node representation: Each message as a node, with semantic features (such as function code, data field value).

[0148] Edge construction: Establish edges based on message timestamps and command sequences (e.g., "Command A → Command B").

[0149] Graph convolution: Learn node embeddings through GNN to detect abnormal subgraphs (e.g., illegal command sequences).

[0150] ② Auxiliary model: Self-supervised learning

[0151] Objective: Predict protocol fields (e.g., data field values) to detect semantic anomalies.

[0152] Implementation:

[0153] Masked language model: Randomly mask data field values (e.g., hide 50% of the fields), train the model to predict the masked parts.

[0154] Loss function: Use cross-entropy loss to constrain the generated values to match the true values.

[0155] 3、Dynamic update mechanism

[0156] Objective: Adapt to protocol version changes (e.g., extended fields from Modbus TCP v1.1 to v1.2).

[0157] Method:

[0158] ① Incremental learning: Regularly fine-tune model parameters with newly collected traffic data (e.g., learning rate decay to 0.001).

[0159] ② Online learning: When a new protocol version is detected, automatically load the pre-trained model and expand the feature dimension.

[0160] Example 1: Modbus protocol attack trap

[0161] Data collection: Collect Modbus TCP traffic from a substation, extract fields such as function code (0x03, 0x06), register address, etc.

[0162] GAN training: Generator learns to generate illegal function code requests (e.g., 0x10) and super-long data field messages.

[0163] Honeypot deployment: Simulate a Modbus server, respond to attacker requests and record operation logs.

[0164] Detection model: GNN analyzes attacker command sequences (e.g., continuous reading of register 0x0001), identifies potential data theft behavior.

[0165] Example 2: IEC 60870-5-104 protocol anomaly detection

[0166] Feature extraction: Convert ASDU message type identifier (TI), cause of transmission (COT) to time series vector.

[0167] GAN generation: Generate fake telemetry data (e.g. abnormal voltage values) and illegal control commands.

[0168] Anomaly detection: Self-supervised model predicts data domain values. If the prediction error exceeds the threshold (e.g. 10%), an alarm is triggered.

[0169] In order to verify the beneficial effects of the present application, the following simulation experiments are carried out:

[0170] 1. Experimental objectives

[0171] Verify the following technical effects: attack sample diversity (GAN generation capability); anomaly detection accuracy (GNN + self-supervised model); dynamic adaptability (protocol version update); attack traceability (honeypot log analysis).

[0172] 2. Data set

[0173] Table 2: Data set sample description table

[0174] Dataset name Protocol type Sample size Attack type Protocol version IEEE 123-Bus IEC 60870-5-104 50000 Fake ASDU messages, illegal control 2010.2 CIGRE Modbus TCP 30000 Long data field, illegal function code v1.1 Actual power environment data DNP3, IEC 61850 20000 Fuzzing attack, zero-day exploit Multiple versions mixed

[0175] 3. Evaluation index

[0176] Table 3: Evaluation index description table

[0177] Indicator Definition Attack recognition rate Proportion of attack samples correctly identified by GNN model False positive rate Proportion of normal traffic misjudged as attack by model Detection delay Average time (ms) from attack occurrence to model response Dynamic adaptability Detection accuracy maintained by model after protocol version update Traceability accuracy Success rate of locating attack source IP and intent through honeypot logs

[0178] 4. Experimental steps

[0179] Step 1: Attack sample generation verification

[0180] The experimental design compares the diversity of attack samples generated by traditional rule engines and GAN:

[0181] Control group: Attack samples based on predefined rules (e.g. fixed function code 0x10);

[0182] Experimental group: Attack samples generated by the GAN of the present application (with semantic constraints);

[0183] Results table

[0184] Table 4: Control results table (1)

[0185] Attack type Control group sample size Experimental group sample size Protocol compliance Semantic diversity (function code distribution) Illegal function code 100 10000 0% 0x10 (single) Long data field 50 5000 0% Fixed length Semantically abnormal messages 0 8000 100% 0x03, 0x06, 0x10 mixed Implicit exploit 0 2000 95% Dynamic field combination

[0186] Conclusion: GAN-generated samples cover protocol syntax boundaries (e.g. Modbus function codes 0x00-0xFF full range), and through semantic consistency constraints (e.g. function code 0x03 must contain a valid register address), compliance reaches 95%, significantly better than traditional methods.

[0187] Step 2: Anomaly detection accuracy verification

[0188] Experimental design compares three detection models: traditional rule engine (threshold judgment); LSTM time series model (no graph structure); GNN+ self-supervised model of the invention.

[0189] Test scenario

[0190] Normal traffic: Modbus function code 0x03 (read register) + valid data;

[0191] Attack traffic: 0x10 (illegal function code) + super-long data field (length > 255);

[0192] Results table

[0193] Table 5: Control results table (2)

[0194] Model type Attack recognition rate False positive rate Detection delay (ms) Cross-message anomaly capture ability Rule engine 62% 18% 5 None LSTM time series model 85% 9% 12 Single message only GNN + self-supervised model 98.2% 1.8% 8 Cross 3-message sequence anomaly (e.g. 0x03→0x10→0x06)

[0195] GNN detection confidence: 0.97 (based on node embedding similarity).

[0196] Step 3: Dynamic adaptability verification

[0197] Experimental design simulates Modbus protocol version upgrade (v1.1→v1.2 adds extended field), tests model online learning ability: initial training data: v1.1 protocol traffic (10000 samples); online update data: v1.2 protocol traffic (2000 samples).

[0198] Results table

[0199] Table 6: Control results table (3)

[0200] Stage v1.1 detection rate v1.2 detection rate Field expansion learning efficiency (hours) Initial model 98.5% 72% - After online learning 99.0% 97.2% 2.5

[0201] Step 4: Attack tracing verification

[0202] Experimental design simulates APT attack scenarios to verify the synergy of honeypot logs and detection models: attack path: external IP→honeypot (fake SCADA server)→internal device; attack intent: data tampering (modify electric meter readings).

[0203] Results table

[0204] Table 7: Control results table (4)

[0205] Traceability dimension Invention scheme Traditional honeypot scheme Attack source IP location 100% accurate (192.168.1.100) 60% accurate Behavior path restoration Complete sequence: 0x03→0x06→0x10 Only fragment information Intent classification accuracy 98% 72% Response time (ms) 150 500

[0206] 5. Comparative experiments

[0207] Table 8: Performance comparison table

[0208] Technical scheme Attack recognition rate False positive rate Dynamic adaptation time Traceability accuracy Traditional rule engine 62% 18% Cannot adapt 40% Static GAN + no honeypot 85% 12% Cannot adapt 65% Invention scheme (full process) 98.2% 1.8% 2.5 hours 98%

[0209] 6. Conclusion

[0210] Attack sample generation: GAN generates samples with 95% compliance through Transformer+ protocol syntax constraints, and the diversity is increased by 20 times.

[0211] Detection accuracy: GNN model performs excellently in cross-packet anomaly detection (such as illegal command sequence), with a false positive rate reduced to 1.8%.

[0212] Dynamic adaptation: Online learning mechanism enables the model to maintain a detection rate of 97.2% after protocol version update, with a maintenance cost reduced by 60%.

[0213] Attack tracing: Honeypot logs and detection model cooperate to achieve an attack intent classification accuracy of 98%, with a response time shortened by 70%.

[0214] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application and not to limit it. Although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced by equivalents without departing from the spirit and scope of the present application, and they should be covered in the scope of the claims of the present application.

Claims

1. A method for GAN-based power protocol honeypot trapping and anomaly identification, characterized in that, The method comprises the following steps: S1: Collecting real protocol traffic from the power system communication link to build an original data set; S2: Extracting the timing features and semantic features of the protocol fields in the protocol traffic and converting them into a tensor format for input to the training of the GAN and the subsequent abnormal detection model; S3: Using GAN to generate attack samples that conform to the protocol specification in terms of semantics and timing; S4: Building a virtual power device as a honeypot based on the generated attack samples to simulate real communication behavior and deploy a trapping strategy; S5: Fusing the attack fingerprints and real-time traffic context features collected by the honeypot, through feature splicing and normalization to build a multi-modal feature vector, the attack fingerprints being attack command sequences and operation frequency, and the context features being source IP address and protocol version; S6: Building a communication interaction graph, where network packets are nodes, and the timing and command logic relationship between packets are edges, and then using GNN to learn node embedding representation to identify illegal command sequence cross-packet abnormal interaction patterns, and combining self-supervised learning to predict protocol fields to detect semantic anomalies within a single packet; S7: Associating the abnormal detection results identified in S6 with the honeypot trapping logs to optimize the generation strategy of GAN in S3, and simultaneously locating the attack source IP and attack intent by analyzing the attacker's behavior path.

2. The GAN-based power protocol honeypot trapping and anomaly identification method according to claim 1, characterized in that, The real protocol traffic collected in S1 includes ASDU packets of IEC 60870-5-104 and function code requests of Modbus. 3.The GAN-based power protocol honeypot trapping and anomaly identification method of claim 2, wherein, After step S2, the data set is expanded through random truncation and noise injection to improve the robustness of the model.

4. The GAN-based power protocol honeypot trapping and anomaly identification method according to claim 3, characterized in that, The GAN generated attack samples in step S3 specifically include the following structure and implementation method:

1. Generator network Input: semantic feature vector of power protocol; Structure: use Transformer architecture to generate attack packets that conform to the protocol syntax; 2. Discriminator network Input: mixed data of real protocol traffic and generated attack samples; Structure: LSTM-based timing classifier to distinguish between real data and generated data; 3. Training process Optimize GAN by minimizing cross-entropy loss function to make the attack samples output by the generator consistent with real traffic in terms of semantics and timing.

5. The GAN-based power protocol honeypot trapping and anomaly identification method according to claim 4, characterized in that, The minimized cross-entropy loss function is specifically: ； where z is the input noise vector, which follows the prior distribution p z ; G(z) is the generator network, which takes the noise z as input and outputs the generated attack sample x g ∈ X; D(x g ) is the discriminator network, which takes the sample x g as input and outputs the probability value D(x g ) ∈ [0, 1]; E z~pz is the expectation over the noise distribution p z .

6. The GAN-based power protocol honeypot trapping and anomaly identification method according to claim 5, characterized in that, The honeypot trapping strategy in step S4 specifically includes: Adjusting the honeypot response according to the attacker's behavior; Recording the attacker's operation path to generate attack fingerprints.

7. The GAN-based power protocol honeypot trapping and anomaly identification method according to claim 6, characterized in that, In step S6, self-supervised learning is introduced to detect semantic anomalies by predicting protocol fields.

Images