A power system security protection method and system based on federal RPA

Abstract

The application relates to the field of power system automation, and discloses a power system security protection method and system based on federal RPA. The method comprises the following steps: S1, a federal collaborative modeling stage: coordinating the collaborative training of individualized intrusion detection models and strategy generation models by a federal center server; S2, an intelligent response execution stage: a local RPA system runs the intrusion detection model in real time, converts the identification result into a power operation ontology language, performs compliance verification through a finite state machine, and outputs a safety response instruction and executes the same according to the strategy generation model; and S3, a dynamic optimization stage: through a federal reinforcement learning framework, combining RPA execution feedback data, the intrusion detection accuracy and the response strategy effectiveness are continuously optimized. The application constructs a three-stage technical framework of "federal collaborative modeling-intelligent response execution-dynamic closed-loop optimization", and provides a new RPA security protection system with accurate intrusion detection, dynamic compliance response and continuous optimization for a power system.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of power system automation, in particular, to a power system security protection method and system based on federated RPA. BACKGROUND

[0002] With the rapid development of smart grid and digital transformation, the power system has formed a highly interconnected "cloud-edge-end" collaborative architecture. Its openness and intelligent characteristics make it an important target for network attacks. In recent years, APT attacks (such as BlackEnergy, Industroyer) targeting the power system have shown a trend of diversification of means and concealment of attacks. Traditional intrusion detection methods based on rules or single machine learning models are difficult to effectively respond. At the same time, the strict requirements of the power system for real-time, reliability and compliance make the security defense face the core contradiction of "low detection accuracy, slow response speed and high operation risk".

[0003] Currently, the intrusion detection system based on RPA (Robotic Process Automation) can realize the automation of some security operations (such as log analysis, alarm triggering), but still has the following defects: the data of each node of the power system cannot be centrally shared due to security regulations, resulting in insufficient model training samples and limited detection coverage; more than 90% of the alarms rely on manual research and judgment, the response delay is high, and the automated response instructions lack real-time verification of power operation specifications, which is easy to cause misoperation accidents.

[0004] Federated RPA technology (Federated Robotic Process Automation) is an innovative solution that combines federated learning (Federated Learning) and robotic process automation (RPA), focusing on realizing cross-organizational automation collaboration while ensuring data privacy and security. Through federated learning, RPA systems of each participant train models independently locally and only exchange model parameters rather than raw data, thereby improving the intelligent level of the overall model while avoiding sensitive information leakage. This decentralized learning mode not only enhances the adaptability of RPA systems to complex tasks and diverse environments, but also continuously improves automation efficiency and accuracy through collective optimization.

[0005] Against this background, the present invention provides a power system security protection method and system based on federated RPA. The invention constructs a three-stage technical framework of "federated collaborative modeling - intelligent response execution - dynamic closed-loop optimization," and resolves the contradiction between data silos and model generalization based on a weighted personalized federated learning mechanism using causal feature fingerprints. It also constructs a compliance response system that deeply integrates finite state machines and RPA to overcome the challenge of security verification of automated instructions. Furthermore, relying on a dynamic optimization system based on federated reinforcement learning, it overcomes the technical bottleneck of iterative lag in traditional detection models. Thus, while ensuring the privacy of power data, the invention significantly improves the real-time performance, accuracy, and compliance of intrusion detection. Summary of the Invention

[0006] The purpose of this application is to provide a power system security protection method based on federated RPA. This invention proposes a power system security protection method and system based on federated RPA. By constructing a three-stage technical framework of "federated collaborative modeling - intelligent response execution - dynamic closed-loop optimization", a novel RPA security protection system is provided for the power system, offering accurate intrusion detection, dynamic compliance response, and continuous optimization.

[0007] To achieve the above objectives, this application provides the following technical solution:

[0008] In a first aspect, this invention discloses a power system security protection method based on federated RPA, comprising the following steps: S1, federated collaborative modeling stage, in which a federated central server coordinates the collaborative training of personalized intrusion detection models and policy generation models among various power nodes; S2, intelligent response execution stage, in which the local RPA system runs the intrusion detection model in real time, converts the identification results into power operation ontology language, performs compliance verification through a finite state machine, and outputs and executes security response instructions based on the policy generation model; S3, dynamic optimization stage, in which a federated reinforcement learning framework, combined with RPA execution feedback data, continuously optimizes the accuracy of intrusion detection and the effectiveness of response strategies.

[0009] More specifically, the power system security protection method based on federated RPA described above is characterized in that, in step S1, the federated collaborative modeling stage includes the following steps:

[0010] S11. Local model segmentation training: Each node trains a local model, with parameters divided into a general feature layer (…). ) and local dedicated layer ( The general feature layer is a feature extraction layer shared by all nodes, while the local dedicated layer is a personalized network layer unique to each node.

[0011] S12. Upload causal fingerprint: Filter high-attack-risk features of each node, generate a hash causal fingerprint set, and upload it to the server.

[0012] S13, parameter aggregation based on similarity, the server calculates the similarity weight of each node causal feature fingerprint , weighted aggregation of global general layer parameters .

[0013] More specifically, the above-mentioned power system security protection method based on federal RPA is characterized in that the causal feature fingerprint uploading comprises:

[0014] S121, screening high attack risk features, the calculation method is as follows:

[0015] , wherein, calculated by KS test (Kolmogorov-Smirnov test);

[0016] S122, generating hash causal feature fingerprint, the calculation method is as follows:

[0017] ;

[0018] The SHA3-256 using Keccak algorithm, its sponge structure is sensitive to the small changes of power data, and meets the one-way and collision resistance;

[0019] S123, generating hash causal feature fingerprint set Upload to the server.

[0020] More specifically, the above-mentioned power system security protection method based on federal RPA is characterized in that the parameter aggregation based on similarity comprises the following steps:

[0021] S131, the central server counts all the effective causal feature fingerprints uploaded by the nodes to obtain a global effective causal feature fingerprint set , and counts the effective causal feature fingerprint set of each node , wherein the effective causal feature fingerprint is a high attack risk feature selected by at least two nodes;

[0022] S132, calculating the similarity weight of each node , the calculation formula is as follows:

[0023] ,

[0024] Among them, indicates the model aggregation weight of node , and ​This represents the number of globally valid causal feature fingerprints. Represents a node The number of valid causal feature fingerprints was selected, and then weight normalization was performed. ;

[0025] S133, Weighted aggregation of global common layer parameters .

[0026] More specifically, the aforementioned power system security protection method based on federated RPA is characterized in that, in step S2, the power operation ontology language (POOL) includes: semantic descriptions of equipment operation instructions, power topology relationships, and security rule constraints; the compliance verification, based on the legal operation process of the power system modeled by a finite state machine, verifies whether the response instructions meet the current system state transition conditions; the generation process of the policy generation model includes matching predefined response levels according to the intrusion type and dynamically adjusting instruction parameters in conjunction with the compliance verification results.

[0027] More specifically, the power system security protection method based on federated RPA described above is characterized in that, in step S3, the optimization process of the federated reinforcement learning framework specifically includes:

[0028] S31. Each local RPA node uploads the de-identified execution data to the central server;

[0029] S32. Protect data security through differential privacy technology; S33. Distribute the updated global model to each node.

[0030] Secondly, this invention discloses a system for implementing a power system security protection method based on federated RPA, comprising a federated central server and RPA systems for each power node:

[0031] The Federation Center server includes: a model aggregation engine, an attack pattern library, and a policy optimizer.

[0032] The model aggregation engine is used to aggregate the intrusion detection models and strategy generation models of each power node RPA system;

[0033] The attack pattern library stores a global set of valid causal feature fingerprints and a set of valid causal feature fingerprints for each node.

[0034] The policy optimizer is used to optimize the policy generation model during the federated reinforcement learning process based on the power knowledge base.

[0035] Each power node RPA system includes: a local detection engine, a pool converter, and a policy executor.

[0036] The local detection engine includes a fingerprint generator and an intrusion detection model. The fingerprint generator is used to filter high-risk attack features, construct a hash causal feature fingerprint set, and upload it to the federated center server. The intrusion detection model is used to collect data from PMU devices and SCADA systems, and participate in federated collaborative modeling, real-time intrusion detection, and dynamic model optimization.

[0037] The POOL converter is used to convert the detection results into the power operation ontology language.

[0038] The policy executor includes a policy generation model and a policy verification; the policy generation model participates in federated collaborative modeling, system defense policy generation after an intrusion occurs, and dynamic model optimization; the policy verification is used to verify the feasibility of the policy generated by the policy generation model and execute it.

[0039] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention improves the model's generalization ability by dividing the intrusion detection model into a general feature layer (globally shared) and a local dedicated layer (node-specific) through federated collaborative modeling; it optimizes the global model's adaptability to heterogeneous power nodes by dynamically adjusting aggregation weights based on the similarity of anti-collision hash fingerprints of high-attack-risk features; it avoids unauthorized operations by modeling legitimate operation processes and verifying in real time whether RPA response commands conform to the current system state transition conditions; and it enhances the detection capability for new threats by continuously and dynamically optimizing the global model and having each node upload anonymized RPA execution feedback data. This invention provides a novel RPA security protection system for power systems, offering accurate intrusion detection, dynamic compliant response, and continuous optimization. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart of a power system security protection method based on Federal RPA provided for the application.

[0042] Figure 2 This is a system architecture diagram for a power system security protection method based on Federal RPA, provided for the application. Detailed Implementation

[0043] The technical solutions of the embodiments of this application will now be described with reference to the accompanying drawings. It should be noted that similar reference numerals and letters in the following drawings indicate similar items; therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0044] The terms “comprising,” “including,” or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase “comprising one…” does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0045] The terms “first,” “second,” etc., are used only to distinguish one entity or operation from another, and should not be construed as indicating or implying relative importance, nor as requiring or implying any such actual relationship or order between these entities or operations.

[0046] The basic idea of ​​this invention is as follows: In the federated collaborative modeling stage, a federated central server coordinates the collaborative training of personalized intrusion detection models and policy generation models among various power nodes; in the intelligent response execution stage, the local RPA system runs the intrusion detection model in real time, converts the identification results into power operation ontology language, performs compliance verification through a finite state machine, and outputs and executes security response instructions based on the policy generation model; in the dynamic optimization stage, a federated reinforcement learning framework, combined with RPA execution feedback data, continuously optimizes the accuracy of intrusion detection and the effectiveness of response strategies. By constructing a three-stage technical framework of "federated collaborative modeling - intelligent response execution - dynamic closed-loop optimization," a novel RPA security protection system with accurate intrusion detection, dynamic compliance response, and continuous optimization is provided for power systems.

[0047] like Figure 1 As shown, this invention provides a power system security protection method based on Federal RPA, comprising the following steps:

[0048] S1. In the federated collaborative modeling phase, the federated central server coordinates the collaborative training of personalized intrusion detection models and strategy generation models among various power nodes.

[0049] S11. Local model segmentation training: Each node trains a local model, with parameters divided into a general feature layer (…). ) and local dedicated layer ( The general feature layer is a feature extraction layer shared by all nodes, while the local dedicated layer is a personalized network layer unique to each node.

[0050] S12. Causal fingerprint upload: High-risk attack features of each node are filtered, and a hash causal fingerprint set is generated and uploaded to the server. Specifically, nodes... The causal fingerprint upload includes:

[0051] S121. Screen for high-risk attack features, calculated as follows:

[0052] ,in, Calculated using the Kolmogorov-Smirnov Test;

[0053] S122. Generate hash causal fingerprints, calculated as follows:

[0054] ;

[0055] The SHA3-256 algorithm using the Keccak algorithm has a sponge structure that is sensitive to small changes in power data and satisfies unidirectionality and collision resistance.

[0056] S123. Generate a hash causal feature fingerprint set. Uploaded to the server.

[0057] S13. Based on similarity-based parameter aggregation, the server calculates the causal feature fingerprint similarity weights for each node. Weighted aggregation of global common layer parameters .

[0058] S131. The central server counts the valid causal feature fingerprints uploaded by all nodes to obtain a global set of valid causal feature fingerprints. Statistical analysis of the effective causal feature fingerprint set of each node A valid causal fingerprint is one in which this high-risk attack feature is filtered by at least two nodes;

[0059] S132. Calculate the similarity weight of each node. The calculation formula is as follows:

[0060] ,

[0061] in, Represents a node The model aggregates weights. This represents the number of globally valid causal feature fingerprints. Represents a node The number of valid causal feature fingerprints was selected, and then weight normalization was performed. ;

[0062] S133, Weighted aggregation of global common layer parameters .

[0063] S2, Intelligent Response Execution Phase: The local RPA system runs the intrusion detection model in real time, converts the identification results into power operation ontology language, performs compliance verification through a finite state machine, and generates and executes security response instructions based on the strategy.

[0064] The Power Operation Ontology Language (POOL) includes: semantic descriptions of equipment operation instructions, power topology relationships, and security rule constraints; compliance verification, which verifies whether response instructions meet the current system state transition conditions based on the legal operation process of the power system modeled by finite state machines; and the generation process of the policy generation model, which includes matching predefined response levels according to the intrusion type and dynamically adjusting instruction parameters in combination with the compliance verification results.

[0065] S3, Dynamic Optimization Phase: Through a federated reinforcement learning framework and combined with RPA execution feedback data, the accuracy of intrusion detection and the effectiveness of response strategies are continuously optimized.

[0066] S31. Each local RPA node uploads the de-identified execution data to the central server;

[0067] S32. Protect data security through differential privacy technology; S33. Distribute the updated global model to each node.

[0068] like Figure 2 As shown, the present invention provides a system architecture diagram of a power system security protection method based on federated RPA, including a federated central server and RPA systems for each power node.

[0069] The Federation Center server includes: a model aggregation engine, an attack pattern library, and a policy optimizer.

[0070] The model aggregation engine is used to aggregate intrusion detection models and strategy generation models of RPA systems at various power nodes;

[0071] The attack pattern library stores the global set of valid causal feature fingerprints and the set of valid causal feature fingerprints for each node;

[0072] The policy optimizer is used to optimize the policy generation model during federated reinforcement learning based on the power knowledge base.

[0073] Each power node RPA system includes: a local detection engine, a pool converter, and a policy executor.

[0074] The local detection engine includes a fingerprint generator and an intrusion detection model. The fingerprint generator is used to screen high-risk attack features, construct a hash causal feature fingerprint set, and upload it to the federated center server. The intrusion detection model is used to collect data from PMU devices and SCADA systems, and participate in federated collaborative modeling, real-time intrusion detection, and dynamic model optimization.

[0075] The POOL converter is used to convert detection results into the power operation ontology language.

[0076] The policy executor includes a policy generation model and a policy verification mechanism. The policy generation model participates in federated collaborative modeling, system defense policy generation after an intrusion, and dynamic model optimization. The policy verification mechanism verifies the feasibility of the policies generated by the policy generation model and executes them.

[0077] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A power system security protection method based on Federal RPA, characterized in that, It includes the following steps: S1. In the federated collaborative modeling phase, the federated central server coordinates the collaborative training of personalized intrusion detection models and strategy generation models among various power nodes. S2, Intelligent Response Execution Phase: The local RPA system runs the intrusion detection model in real time, converts the identification results into power operation ontology language, performs compliance verification through a finite state machine, and generates and executes security response instructions based on the strategy. S3. In the dynamic optimization phase, the accuracy of intrusion detection and the effectiveness of response strategies are continuously optimized through a federated reinforcement learning framework combined with RPA execution feedback data. In step S1, the federated collaborative modeling phase includes the following steps: S11. Local model segmentation training: Each node trains a local model, with parameters divided into a general feature layer. and local dedicated layer The general feature layer is a feature extraction layer shared by all nodes, while the local dedicated layer is a personalized network layer unique to each node. S12. Upload causal fingerprint: Filter high-attack-risk features of each node, generate a hash causal fingerprint set and upload it to the server. S13. Based on similarity-based parameter aggregation, the server calculates the causal feature fingerprint similarity weights for each node. Weighted aggregation of global common layer parameters ; The causal feature fingerprint upload, specifically, the node... The causal fingerprint upload includes: S121. Screen for high-risk attack features, calculated as follows: ,in, Calculated using the Kolmogorov-Smirnov Test; S122. Generate hash causal fingerprints, calculated as follows: The The SHA3-256 algorithm using the Keccak algorithm has a sponge structure that is sensitive to small changes in power data and satisfies unidirectionality and collision resistance. S123. Generate a hash causal feature fingerprint set. Uploaded to the server; In step S3, the optimization process of the federated reinforcement learning framework specifically includes: S31. Each local RPA node uploads the de-identified execution data to the central server; S32. Protect data security through differential privacy technology; S33. After the global model is updated, it is distributed to each node.

2. The power system security protection method based on Federal RPA according to claim 1, characterized in that, The similarity-based parameter aggregation includes the following steps: S131. The central server counts the valid causal feature fingerprints uploaded by all nodes to obtain a global set of valid causal feature fingerprints. Statistical analysis of the effective causal feature fingerprint set of each node The effective causal feature fingerprint is defined as the high-attack-risk feature being filtered by at least two nodes; S132. Calculate the similarity weight of each node. The calculation formula is as follows: ,in, Represents a node The model aggregates weights. This represents the number of globally valid causal feature fingerprints. Represents a node The number of valid causal feature fingerprints was selected, and then weight normalization was performed. ; S133, Weighted aggregation of global common layer parameters .

3. The power system security protection method based on Federal RPA according to claim 1, characterized in that, In step S2, the power operation ontology language includes: semantic descriptions of equipment operation instructions, power topology relationships, and security rule constraints; the compliance verification is based on the legal operation process of the power system modeled by a finite state machine, verifying whether the response instructions meet the current system state transition conditions; the generation process of the strategy generation model includes matching predefined response levels according to the intrusion type and dynamically adjusting instruction parameters in combination with the compliance verification results.

4. A system for implementing a power system security protection method based on Federal RPA as described in any one of claims 1 to 3, characterized in that, This includes the federal center server and the RPA systems at each power node; The federation center server includes: a model aggregation engine, an attack pattern library, and a policy optimizer; The model aggregation engine is used to aggregate the intrusion detection models and strategy generation models of each power node RPA system; The attack pattern library stores a global set of valid causal feature fingerprints and a set of valid causal feature fingerprints for each node. The policy optimizer is used to optimize the policy generation model during federated reinforcement learning based on the power knowledge base. Each power node RPA system includes: a local detection engine, a POOL converter, and a policy executor; The local detection engine includes a fingerprint generator and an intrusion detection model. The fingerprint generator is used to filter high-risk attack features, construct a hash causal feature fingerprint set, and upload it to the federated center server. The intrusion detection model is used to collect data from PMU devices and SCADA systems, and participate in federated collaborative modeling, real-time system intrusion detection, and dynamic model optimization. The POOL converter is used to convert the detection results into power operation ontology language; The policy executor includes a policy generation model and a policy verification. The policy generation model participates in federated collaborative modeling, system defense policy generation after an intrusion occurs, and dynamic model optimization. The policy verification is used to verify the feasibility of the policy generated by the policy generation model and execute it.

Images