Screening algorithm optimization and defense method and device of power internet of things defense strategy

Abstract

The invention discloses a screening algorithm optimization and defense method and device for a power internet of things defense strategy, and belongs to the field of network security, the method comprises the following steps: obtaining log processing data, each log processing data being obtained when different honeypot processing technologies for screening the power internet of things defense strategy are used for defense; preprocessing the log of the defense process to obtain data; using the log processing data to reconstruct a real-time attack restoration graph of the network attack, and determining an attack evaluation value based on the real-time attack restoration graph; and performing optimization processing on a preset screening algorithm according to the attack evaluation value. According to the method, the algorithm is optimized through the real-time log processed by the honeypot technology, so that the optimized algorithm can fit the real-time condition of honeypot processing, the screening deviation is reduced, the algorithm screening precision is improved, the defense effect of the screened honeypot technology is improved, and the risk that data is stolen or tampered is reduced.

Description

Technical Field

[0001] This invention relates to the technical fields of network security and machine learning, and in particular to an optimization of the screening algorithm, defense method and device for a power Internet of Things (IoT) defense strategy. Background Technology

[0002] As a core component of the smart grid, the Internet of Things (IoT) in the power system enables comprehensive interconnection and intelligent sensing across all aspects of power generation, transmission, transformation, distribution, and consumption. With technological updates and development, its interconnected power data acquisition and monitoring control (SCADA) system is also gradually becoming more information-based and intelligent.

[0003] With the development of intelligent systems, the cyberattacks encountered during use are becoming increasingly severe, especially Advanced Persistent Threats (APTs). These APTs can disrupt critical infrastructure of specific targets through coordinated attacks by multiple attackers, affecting the normal power supply of the power grid. To cope with different cyberattacks, a common approach is to control the system offline when the power Internet of Things (IoT) is attacked, and then acquire network traffic data of the attack while offline. A filtering algorithm is then used to select appropriate honeypot technologies for defense based on the attack type in the network traffic data, preventing attacks from affecting the normal operation of the power grid.

[0004] However, the commonly used methods have the following technical problems: Existing algorithms need to be offline to analyze network traffic data in batches to determine the attack type and select the corresponding honeypot technology for defense. However, offline analysis can only determine the attack type before going offline, and network attack types are constantly changing. Therefore, the honeypot technology selected offline often deviates from the actual online situation, the algorithm processing accuracy is low, the selected honeypot technology has poor defense effect, and it also increases the risk of data being stolen or tampered with. Summary of the Invention

[0005] This invention provides an optimized screening algorithm, defense method, and device for power Internet of Things (IoT) defense strategies. It can solve the technical problems of existing technologies that have biases in determining honeypot technology through offline methods, low accuracy in screening honeypot technology, and reduced defense effectiveness.

[0006] A first aspect of this invention provides a method for optimizing a screening algorithm for power Internet of Things (IoT) defense strategies, the method comprising:

[0007] Obtain log processing data, wherein each log processing data is data obtained by preprocessing the logs of the defense process when different honeypot processing technologies of the power Internet of Things defense strategy are used for defense;

[0008] The log processing data is used to reconstruct a real-time attack reconstruction map of the network attack, and the attack evaluation value is determined based on the real-time attack reconstruction map.

[0009] The preset filtering algorithm is optimized based on the attack evaluation value. The preset filtering algorithm is an algorithm that selects different honeypot processing technologies for defense from the power Internet of Things defense strategy.

[0010] This invention optimizes the algorithm by processing real-time logs using honeypot technology, so that the optimized algorithm can fit the real-time situation of honeypot processing, thereby reducing the bias of the selection, improving the accuracy of the algorithm selection, enhancing the defense effect of the selected honeypot technology, and reducing the risk of data theft or tampering.

[0011] In conjunction with the first aspect, in one implementation, the step of reconstructing a real-time attack reconstruction diagram of a network attack using the log processing data includes:

[0012] Determine the annotation information of the user on the log processing data, and filter multiple attack nodes from the log processing data based on the annotation information;

[0013] The time point of each attack node is determined, and multiple attack nodes are connected in chronological order according to the time points to obtain a real-time attack reconstruction map, wherein the connection process involves sequentially connecting two adjacent attack nodes.

[0014] In conjunction with the first aspect, in one implementation, determining the attack evaluation value based on the real-time attack reconstruction graph includes:

[0015] Determine the node parameters of each attack node in the real-time attack reconstruction graph. The node parameters include the total number of actions of the attack node itself and the number of actions from the attack node to the adjacent attack nodes.

[0016] The attack weight value of each attacking node is calculated based on the node parameters, and the attack evaluation value is calculated using the attack weight value.

[0017] In conjunction with the first aspect, in one implementation, the preset screening algorithm includes: K-means clustering algorithm and Q-learning algorithm;

[0018] The optimization of the preset filtering algorithm based on the attack evaluation value includes:

[0019] The attack evaluation value is used to optimize the target cluster centers of the K-means clustering algorithm, and the clustering threshold of the K-means clustering algorithm is adjusted according to the false positive rate or false negative rate of the honeypot processing technology.

[0020] If the network attack is determined to be a complete attack chain based on the real-time attack reconstruction graph, the reward function of the Q-learning algorithm is adjusted using the attack evaluation value.

[0021] In conjunction with the first aspect, in one implementation, obtaining log processing data includes:

[0022] Obtain the initial log data corresponding to different honeypot processing technologies. The initial log data is the log data recorded when the honeypot processing technology performs defense.

[0023] Different initial log data are preprocessed to obtain processed log data, wherein the preprocessing includes: data cleaning, field extraction, normalization, and time sorting.

[0024] A second aspect of this invention provides a defense method for the power Internet of Things, the method comprising:

[0025] When the power Internet of Things (IoT) is attacked by a network, real-time traffic data of the power IoT is obtained based on the sliding window technology. Features are extracted from the real-time traffic data and converted into vectors to obtain a traffic feature vector.

[0026] The preset strategy filtering algorithm is invoked to filter target honeypot technologies from the preset defense strategy based on the traffic feature vector, and the target honeypot technologies are invoked for defense processing. The preset strategy filtering algorithm is an algorithm optimized according to the filtering algorithm optimization method of the power Internet of Things defense strategy as described above.

[0027] In conjunction with the first aspect, in one implementation, the preset strategy screening algorithm includes a K-means clustering algorithm and a Q-learning algorithm;

[0028] The step of invoking the preset strategy filtering algorithm to filter target honeypot technologies from the preset defense strategy based on the traffic feature vector, and then invoking the target honeypot technology for defense processing, includes:

[0029] The kernel function of the K-means clustering algorithm is called to calculate the cluster center distance of the traffic feature vector, and the traffic feature vector is clustered according to the cluster center distance to obtain several clusters;

[0030] Calculate the density parameter of each cluster and determine the clustering information of each cluster based on the density parameter;

[0031] The Q-learning algorithm is invoked to select target honeypot technologies from the preset defense strategy based on the clustering information, and the target honeypot technologies are invoked for defense processing.

[0032] In conjunction with the first aspect, in one implementation, the step of invoking the Q-learning algorithm to filter target honeypot technologies from a preset defense strategy based on the clustering labels, and then invoking the target honeypot technologies for defense processing, includes:

[0033] If the random number is greater than the preset exploration probability, the Q-learning algorithm is called to calculate the reward value of each honeypot technology within the preset defense strategy based on each action label of the clustering information. The honeypot technology with the largest reward value is selected as the target honeypot technology, and the target honeypot technology is activated for defense processing.

[0034] If the random number is less than the preset exploration probability, one of the preset defense strategies is randomly selected as the target honeypot technology, and the target honeypot technology is activated for defense processing; or, if the random number is less than the preset exploration probability, no defense processing is performed.

[0035] A third aspect of this invention provides a device for optimizing a screening algorithm for power Internet of Things (IoT) defense strategies, the device comprising:

[0036] The log acquisition module is used to acquire log processing data, wherein each piece of log processing data is data obtained by preprocessing the logs of the defense process when different honeypot processing technologies of the power Internet of Things defense strategy are used for defense.

[0037] The evaluation value determination module is used to reconstruct a real-time attack reconstruction diagram of the network attack using the log processing data, and determine the attack evaluation value based on the real-time attack reconstruction diagram.

[0038] The algorithm optimization module is used to optimize the preset screening algorithm based on the attack evaluation value. The preset screening algorithm is an algorithm that selects different honeypot processing technologies for defense from the power Internet of Things defense strategy.

[0039] A fourth aspect of the present invention provides a defense device for the power Internet of Things, the device comprising:

[0040] The conversion module is used to acquire real-time traffic data of the power Internet of Things (IoT) based on sliding window technology when the power IoT is under network attack, extract features from the real-time traffic data and convert them into vectors to obtain traffic feature vectors.

[0041] The defense module is used to call a preset strategy screening algorithm to screen target honeypot technologies from the preset defense strategy according to the traffic feature vector, and to call the target honeypot technology for defense processing. The preset strategy screening algorithm is an algorithm optimized according to the screening algorithm optimization method of the power Internet of Things defense strategy as described above.

[0042] Compared to existing technologies, the present invention provides an optimized screening algorithm, defense method, and apparatus for a power IoT defense strategy. The advantages of this invention are as follows: When invoking honeypot processing technology for defense within a power IoT defense strategy, the invention can acquire log processing data of the defense process; reconstruct a real-time attack reconstruction map of the network attack based on the log processing data, and determine the attack evaluation value based on the real-time attack reconstruction map; and optimize the preset screening algorithm according to the attack evaluation value. This invention optimizes the algorithm using real-time logs processed by honeypot technology, ensuring that the optimized algorithm closely matches the real-time situation of honeypot processing, thereby reducing screening bias, improving the accuracy of algorithm screening, enhancing the defense effect of the selected honeypot technology, and reducing the risk of data theft or tampering. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating a screening algorithm method for a power Internet of Things (IoT) defense strategy provided in an embodiment of the present invention.

[0044] Figure 2 This is a schematic flowchart of a defense method for the Internet of Things in the power industry provided in an embodiment of the present invention;

[0045] Figure 3 This is an operation flowchart of a method for invoking and optimizing a power Internet of Things (IoT) defense strategy according to an embodiment of the present invention;

[0046] Figure 4 This is a schematic diagram of the structure of a screening algorithm device for a power Internet of Things defense strategy provided in an embodiment of the present invention;

[0047] Figure 5 This is a schematic diagram of the structure of a defense device for the Internet of Things in the power industry, provided in an embodiment of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] As a core component of the smart grid, the Internet of Things (IoT) in the power system enables comprehensive interconnection and intelligent sensing across all aspects of power generation, transmission, transformation, distribution, and consumption. With technological updates and development, its interconnected power data acquisition and monitoring control (SCADA) system is also gradually becoming more information-based and intelligent.

[0050] With the development of intelligent systems, the cyberattacks encountered during use are becoming increasingly severe, especially Advanced Persistent Threats (APTs). These APTs can disrupt critical infrastructure of specific targets through coordinated attacks by multiple attackers, affecting the normal power supply of the power grid. To cope with different cyberattacks, a common approach is to control the system offline when the power Internet of Things (IoT) is attacked, and then acquire network traffic data of the attack while offline. A filtering algorithm is then used to select appropriate honeypot technologies for defense based on the attack type in the network traffic data, preventing attacks from affecting the normal operation of the power grid.

[0051] However, the commonly used methods have the following technical problems: Existing algorithms need to be offline to analyze network traffic data in batches to determine the attack type and select the corresponding honeypot technology for defense. However, offline analysis can only determine the attack type before going offline, and network attack types are constantly changing. Therefore, the honeypot technology selected offline often deviates from the actual online situation, the algorithm processing accuracy is low, the selected honeypot technology has poor defense effect, and it also increases the risk of data being stolen or tampered with.

[0052] To address the aforementioned issues, the following specific embodiments will provide a detailed description and explanation of the optimization of the screening algorithm, the defense method, and the apparatus for a power Internet of Things (IoT) defense strategy provided in this application.

[0053] To address the technical issues of biased offline honeypot identification and low accuracy in honeypot screening, which reduces defense effectiveness, this paper refers to... Figure 1 The following are schematic flowcharts illustrating a method for optimizing a screening algorithm for a power Internet of Things (IoT) defense strategy, according to an embodiment of the present invention.

[0054] As an example, the optimization method for the screening algorithm of the power Internet of Things defense strategy may include:

[0055] S11. Obtain log processing data, wherein each log processing data is data obtained by preprocessing the logs of the defense process when different honeypot processing technologies of the power Internet of Things defense strategy are used for defense.

[0056] In one embodiment, the power IoT defense strategy can include various honeypot processing techniques, which can be used to defend against attacks on the power IoT. To determine the defensive effectiveness of each honeypot processing technique and to optimize the selection algorithm subsequently, the raw logs of each honeypot processing technique can be obtained.

[0057] Specifically, outputting the logs of each honeypot processing technology to standard output or a file yields the raw logs. These raw logs can record key events such as connection failures, protocol errors, and attack behaviors. To further improve the accuracy of optimization, the raw logs can be preprocessed to obtain processed log data. Preprocessing can include routine data cleaning and completion.

[0058] Since the raw logs from different honeypot processing technologies may have different formats, in order to unify the different raw logs, the step of obtaining log processing data, as an example, may include the following sub-steps:

[0059] S111. Obtain the initial log data corresponding to different honeypot processing technologies. The initial log data is the log data recorded when the honeypot processing technology performs defense.

[0060] S112. Preprocess the different initial log data to obtain log processing data, wherein the preprocessing includes: data cleaning, field extraction, normalization and time sorting.

[0061] In one embodiment, the original log files corresponding to different honeypot processing technologies can be obtained first to obtain initial log data.

[0062] For example, a power IoT defense strategy includes low-interaction honeypot processing technology, medium-interaction honeypot processing technology, and high-interaction honeypot processing technology, which can obtain initial log data from these three processing technologies. Next, the three initial log data can be preprocessed. Preprocessing includes: data cleaning, field extraction, normalization, and time sorting.

[0063] Data cleaning can include filtering out irrelevant data such as heartbeat packets and network noise.

[0064] Field extraction can be performed by extracting triples from each log entry in the initial log data. The extracted triples can look like the following:

[0065] `(t_i,command_i,target_i)`.

[0066] The triple includes `t_i`, which is the timestamp of the attack (accurate to milliseconds); `command_i`, which is the attack command (such as `nmap-sV`, `exploit / windows / smb / ms17_010_eternalblue`); and `target_i`, which is the attack target (such as `192.168.1.1:445`, ` / etc / passwd`).

[0067] Normalization can be used to convert log formats from different honeypot processing technologies into a unified structure. In one operational mode, the log formats from different honeypot processing technologies can be converted into a unified structure using a standardization command (e.g., unifying `nmap-sS-P0` into `nmap-sS`). Through the above normalization process, the log format can be converted into a standardized target (e.g., unifying `C:\Windows\System32\` into `%SystemRoot%\System32\`).

[0068] Time sorting can be performed by arranging the triples in ascending order based on the timestamps (`t_i`) of the attack occurrences, thus forming an attack sequence.

[0069] In one embodiment, after completing the above processing, the attack sequence can be as follows:

[0070] `T={(t_1,command_1,target_1),...,(t_k,command_k,target_k)}`.

[0071] The log formats of different honeypots are converted into a unified log structure, which is then used to reconstruct the attack chain, analyze the attack behaviors captured by the honeypots, and extract threat intelligence.

[0072] S12. Reconstruct a real-time attack reconstruction diagram of the network attack using the log processing data, and determine the attack evaluation value based on the real-time attack reconstruction diagram.

[0073] In one embodiment, based on the aforementioned log processing data, a real-time attack reconstruction map of the network attack can be reconstructed. The network attack can be analyzed using the real-time attack reconstruction map, and the defensive effect of the current honeypot processing technology can be determined based on the real-time network attack. This allows it to be determined whether the currently used honeypot processing technology can resist network attacks. If it can, it means that the selected honeypot processing technology meets the actual needs; otherwise, if it cannot, it means that the selected honeypot processing technology does not meet the actual needs, the selection accuracy of the selection algorithm is not high, and it needs to be optimized and adjusted.

[0074] In an optional embodiment, the step of reconstructing a real-time attack reconstruction graph of the network attack using the log processing data may include the following sub-steps:

[0075] S121. Determine the user's annotation information for the log processing data, and filter multiple attack nodes from the log processing data based on the annotation information.

[0076] S122. Determine the time node of each attack node, and perform connection processing on multiple attack nodes according to the order of the time nodes to obtain a real-time attack reconstruction map, wherein the connection processing is to connect two adjacent attack nodes in sequence.

[0077] In one operational mode, when constructing a real-time attack reconstruction graph, the user can first annotate the log processing data, and then obtain the user's annotation information for the log processing data. This annotation information marks the attack stages of the network attack. Through this annotation information, the attack stage to which each attack action belongs can be identified, such as scanning or vulnerability exploitation, thereby determining the state and type of the network attack.

[0078] In one embodiment, the information annotated during the attack phase can be as shown in the table below:

[0079] Attack Phase Mark command / target reconnaissance Port scanning, protocol detection, service identification Initial visit First session established successfully; login attempt successful. Vulnerability Exploitation Known vulnerabilities (such as CVE-2015-5374) and shellcode execution were detected. Privilege Escalation sudo su`, `runas / user:Administrator`, exploiting privilege escalation vulnerabilities Lateral movement Scanning internal network IPs, using PsExec, and passing hashes. Goal achieved Data transmission, device restart, industrial control command injection … …

[0080] Next, attack nodes with an attack state can be identified using the annotation information. Each attack node represents the state of an attack phase. It should be noted that each attack phase corresponds to one node, i.e., an attack node, which is created when the first action of a new phase is detected. Therefore, by determining the actions of the attack phase within the annotation information, an attack node can be obtained.

[0081] For example, the first attack node is the initial access node, which is triggered when the first valid session occurs; the second attack node is the vulnerability exploitation node, which is triggered when a known vulnerability is detected; the third attack node is the lateral movement node, which is triggered when scanning IPs or protocols, etc.

[0082] Furthermore, each attacking node can have node attributes, including a unique identifier (such as `state_id`, `S1`), attack phase (`phase`), the first occurrence time of the node's attack phase (`start_time`), the last update time of the node's attack phase (`end_time`), the set of all commands for the node's attack phase (`commands`), and the set of all targets for the node's attack phase (`targets`).

[0083] Next, the timestamp (`t_i`) of each attack node can be obtained to get the time node. Then, by connecting multiple attack nodes in the order of the time nodes, a real-time attack reconstruction diagram can be obtained.

[0084] During connection, the line connecting two attack nodes can be represented as a directed edge connecting two state nodes, used to represent the evolution of the attack phase.

[0085] When making a connection, if the current action belongs to an existing stage node, then update that node (expand `commands` and `targets`, update `end_time`); if the current action belongs to a new stage, then create a new node and extend an edge from the previous node to connect to the next node.

[0086] In an optional embodiment, determining the attack evaluation value based on the real-time attack reconstruction graph may include the following sub-steps:

[0087] S123. Determine the node parameters of each attack node in the real-time attack reconstruction graph. The node parameters include the total number of actions of the attack node itself and the number of actions from the attack node to the adjacent attack nodes.

[0088] S124. Calculate the attack weight value of each attack node based on the node parameters, and use the attack weight value to calculate the attack evaluation value.

[0089] In one embodiment, node parameters for each attack node in the real-time attack reconstruction graph can be obtained, wherein the node parameters include the total number of actions of the attack node itself and the number of actions from the attack node to adjacent attack nodes.

[0090] For example, consider two attack nodes, attack node a and attack node b. The node parameters for attack node a can include the total number of actions performed by node a itself, and the number of actions from attack node a to attack node b, thus representing the number of actions from attack node a to its neighboring attack nodes. Next, the attack weight value can be calculated using the node parameters of each attack node.

[0091] Specifically, the attack weight value can be obtained by calculating the ratio of the number of actions from the attacking node to its neighboring attacking nodes to the total number of actions of the attacking node itself.

[0092] In one embodiment, taking attack node a as an example, the attack weight value of attack node a can be calculated as follows:

[0093]

[0094] In the above formula, W(a→b) is the attack weight value of attacking node a.

[0095] After calculating the attack weight value for each attacking node, the corresponding attack evaluation value is calculated using the attack weight value for each attacking node. The attack evaluation value can be an evaluation value of the network attack complexity.

[0096] In one embodiment, the attack evaluation value can be calculated as follows:

[0097]

[0098] In the above formula, Complexity is the attack evaluation value, w i Let represent the attack weight value, i represent the attack node, and I represent the indicator function.

[0099] For example, the attack weight of an attack node in the exploit phase is 0.7, the attack weight of an attack node in the scanning phase is 0.3, and the attack weight of an attack node in the lateral movement phase is 0.6. Their indicator functions can be shown in the table below:

[0100]

[0101] S13. Optimize the preset screening algorithm based on the attack evaluation value. The preset screening algorithm is an algorithm that selects different honeypot processing technologies for defense from the power Internet of Things defense strategy.

[0102] The preset filtering algorithm can be optimized based on the numerical value of the attack assessment. The preset filtering algorithm can be an algorithm that selects the corresponding honeypot processing technology from different honeypot processing technologies of the power Internet of Things defense strategy for defense when the power Internet of Things is attacked by the network.

[0103] In one embodiment, the preset screening algorithm includes: K-means clustering algorithm and Q-learning algorithm.

[0104] In practice, the K-means clustering algorithm is used to classify network attack data and determine the type of network attack, while the Q-learning algorithm is used to select the appropriate honeypot defense technology based on the type of network attack.

[0105] As an example, optimizing the preset filtering algorithm based on the attack evaluation value may include the following sub-steps:

[0106] S131. Optimize the target cluster centers of the K-means clustering algorithm using the attack evaluation value, and adjust the clustering threshold of the K-means clustering algorithm according to the false positive rate or false negative rate of the honeypot processing technology.

[0107] S132. If the network attack is determined to be a complete attack chain based on the real-time attack reconstruction graph, the reward function of the Q-learning algorithm is adjusted using the attack evaluation value.

[0108] In practice, the cluster center parameter η can be calculated using the attack evaluation value. Its calculation can be represented by the following formula:

[0109] η = 0.2Complexity;

[0110] In the above formula, Complexity is the attack assessment value.

[0111] Next, the target cluster centers of the K-means clustering algorithm can be optimized using the cluster center parameters. The updated target cluster centers can be represented by the following formula:

[0112]

[0113] In the above formula, F represents the set of attack feature vectors extracted from the network attack data, which can be specifically represented as follows:

[0114] F = {f1, f2, ..., f} m};

[0115] Similarly, the false positive or false negative rate of honeypot processing techniques can be filtered using the clustering threshold θ of the dynamic K-means clustering algorithm. The adjustment formula for the clustering threshold θ can be as follows:

[0116] θ new =θ old ×(1+λ(FPR-FPR target ));

[0117] Where FPR is the current false positive rate, and FPRtarget is the target false positive rate (usually set to 0.03).

[0118] In practice, if the current false alarm rate (FPR) is greater than 0.03, the clustering threshold θ can be increased to reduce false alarms; if the current false alarm rate (FPR) is less than 0.03, the clustering threshold θ can be decreased to improve sensitivity.

[0119] For the Q-learning algorithm, it can be determined whether the real-time attack reconstruction graph is a complete attack chain. If the real-time attack reconstruction graph is a complete attack chain, the Q-value of the reward function of the Q-learning algorithm can be adjusted.

[0120] Specifically, the Q-value of the adjusted reward function can be as follows:

[0121] r(s,a) = δ·complexity;

[0122] In the above formula, r(s, a) is the Q value of the adjusted reward function, and δ is a calculation constant, which can generally be 0.5.

[0123] If the real-time attack reconstruction graph is determined to be a new attack pattern, the Q value of the reward function can be adjusted to 0.8, i.e., r(s, a) = 0.8, to encourage the discovery of unknown network attack threats.

[0124] In another alternative embodiment, if it is determined that the real-time attack reconstruction graph is not a complete attack chain, for example, if the attacker terminates the session early (potentially identifying a honeypot), the Q-value of the reward function of the Q-learning algorithm can also be adjusted.

[0125] The specific adjustments can be shown in the following formula:

[0126] r(s, a) = -p, where p can generally be 1.0, but can be adjusted according to actual needs.

[0127] In this embodiment, the present invention provides a method for optimizing the screening algorithm of a power Internet of Things (IoT) defense strategy. Its advantages are as follows: When invoking honeypot processing technology for defense in a power IoT defense strategy, the present invention can obtain log processing data of the defense process; reconstruct a real-time attack reconstruction diagram of the network attack based on the log processing data, and determine the attack evaluation value based on the real-time attack reconstruction diagram; and optimize the preset screening algorithm according to the attack evaluation value. The present invention optimizes the algorithm using real-time logs processed by honeypot technology, enabling the optimized algorithm to better reflect the real-time situation of honeypot processing, thereby reducing screening bias, improving the accuracy of algorithm screening, enhancing the defense effect of the selected honeypot technology, and reducing the risk of data theft or tampering.

[0128] Currently, the common method for network attack defense involves acquiring network traffic data in an offline state and then using filtering algorithms to select appropriate honeypot technologies for defense based on the attack type in the network traffic data, thus preventing attacks from affecting the normal operation of the power grid. However, existing algorithms require offline conditions to analyze network traffic data in batches to determine the attack type and select corresponding honeypot technologies for defense. But offline analysis can only determine the attack type before going offline, while network attack types are constantly changing. Therefore, the honeypot technologies selected offline often deviate from the actual online situation, resulting in low algorithm processing accuracy.

[0129] To address the issue of biased honeypot selection and low accuracy in existing technologies that analyze traffic data offline, this paper refers to... Figure 2 The diagram shows a schematic flowchart of a defense method for the Internet of Things in the power industry provided by an embodiment of the present invention.

[0130] As an example, the defense method for the power Internet of Things may include:

[0131] S21. When the power Internet of Things is attacked by the network, real-time traffic data of the power Internet of Things is obtained based on the sliding window technology, features are extracted from the real-time traffic data and converted into vectors to obtain traffic feature vectors.

[0132] When the power Internet of Things (IoT) is under cyberattack, real-time traffic data of the power IoT can be acquired. Since cyberattacks generate a large volume of data, to improve the accuracy of subsequent analysis, the acquired real-time traffic data of the power IoT can be segmented, and each segment can be analyzed and processed.

[0133] Among them, cyberattacks can be cyber deception, specifically using scams or fake actions to hinder or overturn the attacker's cognitive process, disrupt the attacker's automated tools, delay or block the attacker's activities, and achieve the purpose of "deception" by using false responses, intentional confusion, fake actions, misleading and other forged information.

[0134] In one operating mode, the traffic data stream can be dynamically segmented using a sliding window technique (window size = 100ms, step size = 10ms) to obtain real-time traffic data.

[0135] Among them, the sliding window technology can set the window size to 100ms and the window sliding step size to 10ms, that is, the window moves once every 10ms.

[0136] In practice, network packet capture libraries (such as Scapy, pcap, etc.) can be used to capture data packets in real time and timestamp each packet. The captured packets can then be assigned to windows, specifically based on their timestamps, in a sliding window; a single packet may belong to multiple windows (due to window overlap).

[0137] The real-time traffic data obtained can include the following:

[0138] First, the five-tuple data includes: source IP, destination IP, source port, destination port, and protocol type.

[0139] Second, the payload entropy value, which is used to detect encrypted traffic. The payload entropy value for calculating the payload content can be expressed by the following formula:

[0140]

[0141] The payload entropy value is used to detect encrypted or obfuscated traffic, where p(x) i ) represents the frequency of occurrence of the byte value i in the payload.

[0142] Third, packet length variance, specifically, can be used to identify scanning behavior and statistically analyze the variance of packet length within a window to identify scanning behavior.

[0143] Fourth, the suddenness of traffic flow, specifically the rate of change of traffic flow per unit time.

[0144] For each window, features can be extracted from the data packets within the processing window, and then the features of each data packet can be combined into a feature vector to obtain real-time traffic data.

[0145] In one embodiment, feature extraction is performed on the 5-tuple data, extracting the source IP, destination IP, source port, destination port, and protocol from each data packet. Within a window, the frequency of occurrence of the 5-tuple data can be counted, or the 5-tuple data for each data packet can be directly recorded for later use.

[0146] In one embodiment, for the payload entropy value, the entropy value is calculated for the payload of each data packet. A higher entropy value indicates more random data, potentially indicating encrypted traffic. Then, statistical characteristics (such as mean, maximum, etc.) of the entropy values ​​of all data packets within the window can be calculated.

[0147] In one embodiment, to determine the packet length variance, the lengths of all packets can be collected within a window, and then the variance of these lengths can be calculated. A large variance likely indicates the presence of scanning activity, as scanning typically generates a large number of probe packets of varying lengths.

[0148] In one embodiment, for traffic bursts, the rate of change of traffic per unit time can be calculated. The distribution of arrival intervals within a statistical window is analyzed, and a burst coefficient (such as the ratio of peak to mean) is calculated. Combined with a sliding window's cumulative confirmation mechanism, the window size is dynamically adjusted to adapt to traffic bursts.

[0149] For each window, the extracted features can be combined into a feature vector, including: statistical features of quintuples (e.g., the number of different quintuples, or the number of times each quintuple appears), statistical features of load entropy (mean, maximum, etc.), packet length variance, and traffic burstiness. Through the above operations, real-time traffic data can be converted into a traffic feature vector.

[0150] S22. The preset strategy filtering algorithm is invoked to filter target honeypot technologies from the preset defense strategy according to the traffic feature vector, and the target honeypot technologies are invoked for defense processing. The preset strategy filtering algorithm is an algorithm optimized according to the power Internet of Things defense strategy filtering algorithm optimization method described in the above embodiment.

[0151] In one embodiment, the preset defense strategy can be a honeynet: including one or more honeypots, which can provide attackers with a more comprehensive interactive environment, enabling security personnel to monitor and trap attack activities in a highly controllable honeypot network, and to understand the attacker's attack methods, attack intentions and attack tools.

[0152] A honeypot is a security resource whose value lies in being detected, attacked, and compromised. By deploying security resources with no business purpose, attackers are tricked into using them illegally, thereby capturing and analyzing attack behavior, understanding attack tools and methods, and inferring attack intentions and motives.

[0153] In one embodiment, after obtaining the traffic feature vector, a preset strategy filtering algorithm can be invoked to select one of several different honeypot processing technologies in the preset defense strategy as the target honeypot technology based on the traffic feature vector, and then the target honeypot technology can be started for defense processing, which can reduce the impact of network attacks.

[0154] The preset strategy screening algorithm is an algorithm optimized according to the power Internet of Things defense strategy screening algorithm optimization method described in the above embodiments.

[0155] In an optional embodiment, the preset strategy screening algorithm includes K-means clustering algorithm and Q-learning algorithm;

[0156] As an example, the step of invoking the preset strategy filtering algorithm to filter target honeypot technologies from the preset defense strategy based on the traffic feature vector, and then invoking the target honeypot technology for defense processing, may include the following sub-steps:

[0157] S221. Call the kernel function of the K-means clustering algorithm to calculate the cluster center distance of the traffic feature vector, and determine the clustering of the traffic feature vector based on the cluster center distance to obtain several clusters.

[0158] S222. Calculate the density parameter of each cluster and determine the clustering information of each cluster based on the density parameter.

[0159] S223. The Q-learning algorithm is invoked to select target honeypot technologies from the preset defense strategy based on the clustering information, and the target honeypot technologies are invoked for defense processing.

[0160] In one operational mode, the K-means clustering algorithm can be the kernel K-means algorithm (specifically, an algorithm that maps data to a high-dimensional space using a kernel function and then performs clustering in that high-dimensional space). Since traffic feature vectors are non-linear features, such as entropy-based features, packet length variance within a sliding window, and traffic burstiness, while traditional K-means algorithms can only handle linearly separable data (linear features), this invention, based on kernel K-means, can dynamically process newly added data points without recalculating the increment of the entire dataset.

[0161] In one embodiment, the kernel function (Radial Basis Function, RBF) of the kernel K-means algorithm, also known as the Gaussian kernel function, is a kernel function with strong nonlinear expressive power, and its calculation formula is as follows:

[0162] K(x,y)=exp(-γ||xy|| 2 );

[0163] In the above formula, x and y represent the traffic feature vectors, respectively; γ is the only hyperparameter of the Gaussian kernel function. The larger γ is, the narrower the Gaussian curve is, and the more sensitive it is to local data during classification (which may lead to overfitting). The smaller γ is, the flatter the Gaussian curve is, and the more inclined it is to global smoothness during classification (which may lead to underfitting); ||xy|| represents the norm of the vector; exp represents the exponent e, which maps the distance to the interval (0,1]. The closer the value is to 1, the more similar x and y are.

[0164] The RBF kernel function in the kernel K-means algorithm is universal and can handle linearly separable features (when γ is very small, the RBF kernel approximates a linear kernel). Linear features are already linearly separable in the original space, so theoretically, a kernel function is not needed. In incremental kernel K-means, the RBF kernel is used uniformly to process all features.

[0165] The objective function of the kernel K-means algorithm in the feature space is to minimize the sum of squared distances from each data point to its cluster center, i.e., the sum of squared errors within the cluster. Specifically, the calculation can be shown in the following formula:

[0166]

[0167] Where J is the sum of squared errors within a cluster, k is the number of clusters, and x is the number of data points in the dataset; This represents the vector obtained by mapping data point x to a high-dimensional feature space through a kernel function; Let C be the cluster center of the c-th cluster. c Let n represent the set of samples of class c. c This represents the number of samples in class c.

[0168] When performing clustering using the kernel K-means algorithm, the aforementioned objective function can be used in the incremental kernel K-means algorithm to uniformly process all traffic feature vectors using the RBF kernel. It should be noted that linear traffic feature vectors are already linearly separable in the original space, therefore theoretically, a kernel function is not needed.

[0169] Next, the distance from the traffic feature vector to the cluster center can be calculated using the following formula to obtain the cluster center distance.

[0170] d(φ(x),μ c )=||φ(x)-μc|| 2 =K(x,x)-2 / n c 2 ∑ y∈Cc K(x,x)+1 / n c 2 ∑ y,z∈Cc K(y,z);

[0171] The above formula represents the distance from the data point x in the traffic feature vector to the cluster center, where, The vector x represents the data point x mapped to a high-dimensional feature space by a kernel function; μc represents the c-th cluster center, where C c Let n represent the set of samples of class c. c represents the number of samples in class c; K is the kernel function (RBF kernel).

[0172] Next, the category to which the data point of the traffic feature vector belongs can be determined based on the cluster center distance. For example, it can be determined whether the cluster center distance is less than the clustering threshold θ. If the cluster center distance from the data point x of the traffic feature vector to the cluster center μc is less than the clustering threshold θ, then the data point x of the traffic feature vector is assigned to the cluster center μc, and the center of the cluster center μc can be updated. The update calculation can be shown in the following formula:

[0173]

[0174] In the above formula, This represents the mean vector of the c-th cluster center after the update; n represents the mean vector of the c-th cluster center before the update; c represents the number of samples in class c; x represents the new data point (traffic feature vector) to be assigned, whose dimension must be consistent with the cluster center.

[0175] If the cluster center distance is greater than the clustering threshold θ, a new cluster can be created for the data point x of the traffic feature vector. After the above operation, the data points of the traffic feature vector can be divided into different categories, resulting in several clusters.

[0176] It should be noted that during classification, the rate of change of the radius of each cluster can be monitored, and the rate of change of the radius can be expressed by the following formula:

[0177]

[0178] Where, r c current r c prevThese represent the radius of the c-th cluster at the current time or the previous time, respectively, which is the maximum distance from all data points within the cluster to the cluster center.

[0179] If the rate of change of radius exceeds 20% (i.e., the rate of change of radius of the cluster Δr) c If the value is greater than 0.2, it indicates a significant change in the data distribution, which triggers an adjustment to the clustering threshold. The adjusted clustering threshold can be as follows: θ = 0.8. By adjusting the clustering threshold θ, the boundaries of the clusters can be tightened.

[0180] In one embodiment, three clusters can be obtained by clustering, which can be a core cluster (a cluster with dense sample points and high internal consistency), a sparse cluster (a cluster with scattered sample points and low density), and a similar cluster (a cluster with high similarity to other clusters).

[0181] After obtaining several clusters, different clusters can be labeled. Labeling allows for the evaluation of cluster quality and the determination of the cluster category, enabling the adoption of different strategies in subsequent steps (honeypot scheduling).

[0182] During annotation, the density parameter of each cluster can be calculated first. The density parameter includes the density value and similarity. The density value of each cluster can be expressed as follows:

[0183]

[0184] If the density value is greater than the density threshold, it means that the cluster has a high density and a large size, and the cluster can be labeled as a core cluster; if the density value is less than the density threshold, it means that the cluster has a low density, and the cluster can be labeled as a sparse cluster.

[0185] For each non-core cluster, calculate its similarity to all core clusters, where the similarity can be expressed as follows:

[0186]

[0187] If a non-core cluster has a similarity threshold exceeding that of a core cluster, the cluster can be labeled as a similar cluster (a similar cluster belonging to the core cluster, which may be its subclass or associated cluster). Through this labeling, the clustering information for each cluster can be obtained, i.e., similar cluster, core cluster, or sparse cluster, and the category of each cluster can be determined based on this clustering information.

[0188] Finally, the clustering information described by the Q-learning algorithm can be used to determine the corresponding target honeypot technology from the preset defense strategy, and then the target honeypot technology can be used for defense processing.

[0189] To dynamically schedule appropriate target honeypot technologies based on clustering results, as an example, the step of invoking the Q-learning algorithm to select target honeypot technologies from a preset defense strategy based on the clustering labels and invoking the target honeypot technologies for defense processing may include the following sub-steps:

[0190] S2231. If the random number is greater than the preset exploration probability, the Q-learning algorithm is called to calculate the reward value of each honeypot technology in the preset defense strategy based on each action label of the clustering information. The honeypot technology with the largest reward value is selected as the target honeypot technology, and the target honeypot technology is activated for defense processing.

[0191] S2232. If the random number is less than the preset exploration probability, select one from the preset defense strategy as the target honeypot technology and start the target honeypot technology for defense processing; or, if the random number is less than the preset exploration probability, do not perform defense processing.

[0192] In one embodiment, the preset defense strategy may include different honeypot processing technologies, each with corresponding honeypot resources. Honeypot resources refer to the collection of various hardware and software components and configuration elements used to build, run and manage the honeypot system in a dynamic scheduling environment.

[0193] Based on the above analysis, clusters can be categorized into similar clusters, core clusters, or sparse clusters, and different honeypot processing techniques can be used for different clusters. Correspondingly, honeypot processing techniques can also be categorized into three types: low-interaction honeypot processing techniques, medium-interaction honeypot processing techniques, and high-interaction honeypot processing techniques.

[0194] Based on the clustering information mentioned above, threat levels can be identified as low (scanning / probing), medium (exploitation attempts), and high (Advanced Persistent Threat (APT) / 0-day behavior), thereby identifying the type, complexity, and target of the attack behavior. If the cluster label is "scanning," a low-interaction honeypot cluster is scheduled; if the cluster label is "vulnerability detection," a medium-interaction honeypot cluster is scheduled; and if the cluster label is "APT" or "suspected 0-day behavior," a high-interaction honeypot cluster is scheduled.

[0195] Specifically, the correspondence between the labeled clustering information, the cluster types, and the corresponding honeypot processing techniques can be shown in the table below.

[0196]

[0197]

[0198] During the screening process, the state space of the power Internet of Things (IoT) can be determined, which includes CPU utilization, memory usage, and attack threat level. Specifically, it can be shown below:

[0199] s = (CPU utilization, memory usage, attack threat level).

[0200] The threat level can be determined based on the labels of the clustering information: a label of 0 indicates a normal threat level; a label of 1 indicates a scanning threat level; a label of 2 indicates a vulnerability exploitation threat level; and a label of 3 indicates an APT threat level.

[0201] Different honeypot handling techniques can be used for different threat levels. For example, a tag of 0 results in no action; a tag of 1 activates low-interaction honeypot handling techniques; a tag of 2 activates medium-interaction honeypot handling techniques; and a tag of 3 activates high-interaction honeypot handling techniques.

[0202] The corresponding action space is a∈{label 0: no action, label 1: start low-interaction honeypot, label 2: start medium-interaction honeypot, label 3: start high-interaction honeypot}.

[0203] In one embodiment, the reward function r(s,a) of the Q-learning algorithm can be used for triggering. The reward function serves several purposes: 1. Guiding policy optimization: By quantitatively evaluating attack trapping effectiveness, resource consumption, and the authenticity of the deception, it provides a clear optimization objective for reinforcement learning algorithms. 2. Reconciling the conflict between security and resource efficiency: Maximizing the number of interaction steps to collect attack data while controlling computational resource consumption to avoid system overload. 3. Providing real-time feedback on the effects of actions (such as switching honeypot levels) to drive Q-learning and other algorithms to update their strategies.

[0204] In the Q-learning algorithm, the Q-table is a two-dimensional matrix. Its rows represent all possible state spaces *s*, containing attack clustering labels (e.g., scanning, known vulnerability exploitation, suspicious zero-day behavior). The columns represent all possible actions *a*, i.e., honeypot scheduling types (e.g., low-interaction honeypot processing, medium-interaction honeypot processing, high-interaction honeypot processing). The reward function value, also known as the cell value (Q-Value), is the expected cumulative reward value Q(s,a) for selecting action *a* in state space *s*.

[0205] In practice, clustering information output by clustering algorithms can be received (including labeled information and threat levels (0: normal, 1: scanning, 2: exploitation, 3: APT)).

[0206] Next, the current resource state can be encoded as s. Then, the corresponding action a is randomly selected with probability ε, thereby filtering out the target honeypot technology.

[0207] The exploration probability ε can be preset to 0.3 (i.e., 30% random exploration);

[0208] Define an optional action set A = {0, 1, 2, 3} (corresponding to no action, low-interaction honeypot processing, medium-interaction honeypot processing, and high-interaction honeypot processing techniques, respectively).

[0209] Next, a random number generator can be called to generate a uniformly distributed random number rand in the interval [0,1). Then, determine whether the random number rand is greater than the exploration probability ε.

[0210] If the random number rand is greater than the exploration probability ε, then the reward value Q(s,a) of each honeypot technology within the preset defense strategy is calculated using the reward function of the Q-learning algorithm. Then, the honeypot action with the largest reward value Q(s,a) is selected as the target honeypot technology, and finally, the target honeypot technology is activated for defense processing.

[0211] If the random number rand is less than the exploration probability ε, then any action a is uniformly and randomly selected from the action set A, i.e., one action is randomly selected from the preset defense strategy as the target honeypot technology, and the target honeypot technology is activated for defense processing; or no action is taken and no defense processing is performed.

[0212] For example, when the random number rand = 0.25 (< 0.3), since rand is less than the exploration probability ε, a = 2 is randomly selected, meaning a medium-interaction honeypot treatment is chosen as the target honeypot technology for defense. When the random number rand = 0.6, a = 1, where the Q value is the largest, means a low-interaction honeypot treatment is chosen as the target honeypot technology for defense. This operational method ensures a balance between exploration and exploitation.

[0213] In one operational mode, during defense, honeypot interactions can be monitored and the reward function calculated. Simultaneously, the Q-value of the Q-learning algorithm can be updated. Specifically, the Q-value can be updated iteratively using the Bellman equation.

[0214] The updated Q value can be expressed as follows:

[0215]

[0216] Where η is the adaptive learning rate, r is the reward / penalty function, and γ is the discount factor.

[0217] In this embodiment, the present invention provides a defense method for the power Internet of Things (IoT). Its advantages are as follows: When the power IoT is under network attack, the present invention can acquire real-time traffic data of the power IoT based on sliding window technology, extract features from the real-time traffic data and convert them into vectors to obtain traffic feature vectors; a preset strategy filtering algorithm is invoked to filter target honeypot technologies from a preset defense strategy based on the traffic feature vectors, and the target honeypot technologies are then invoked for defense processing. Analyzing the real-time traffic data of the attack can accurately filter honeypot technologies that meet real-time requirements for defense, which not only improves the accuracy of filtering and reduces the deviation between honeypot technologies and online requirements, but also reduces the impact of the attack, thereby reducing the risk of data theft or modification.

[0218] Reference Figure 3 The diagram illustrates an operation flowchart of a method for invoking and optimizing a power Internet of Things (IoT) defense strategy according to an embodiment of the present invention.

[0219] In one operational approach, power IoT defense strategies can be screened first, and then the algorithm can be optimized based on the effectiveness of the defense. That is, first execute... Figure 2 The operation process, then execute Figure 1 The operating procedure.

[0220] Reference Figure 3 Its operation may include the following steps:

[0221] The first step is to obtain real-time traffic data streams.

[0222] The second step involves a proactive defense strategy for the power IoT based on streaming K-means clustering algorithm and lightweight honeypot model to determine whether the traffic data stream is abnormal.

[0223] The third step is to determine if the traffic data flow is normal, confirming it as business network communication. If the traffic data flow is abnormal, then corresponding defense technologies can be selected, which may include low-interaction honeypot processing, medium-interaction honeypot processing, and high-interaction honeypot processing.

[0224] The fourth step is dynamic honeypot scheduling. Based on the clustering results, appropriate honeypot resources are dynamically scheduled, and corresponding honeypot processing is initiated for the hierarchical honeypot architecture (low, medium, and high interaction honeypots).

[0225] The fifth step is to record the attacker's interactions with the honeypot, thus recording the complete attack chain.

[0226] Step 6: Optimize clustering and honeypot strategies based on attack analysis results.

[0227] like Figure 3As shown, low-interaction honeypot processing technology can be written in Go, simulating the handshake response of common industrial control protocols (Modbus / TCP, IEC 104, etc.), requiring less than 5MB of memory.

[0228] The specific operation details of Go microservices using low-interaction honeypot processing technology are as follows:

[0229] First, the service architecture: TCP listeners are created using the lightweight Go standard library's `net` package. Each protocol (Modbus / TCP, IEC 104) runs in a separate goroutine, but can share the same port (distributed via protocol identification) or different ports. A microservice architecture is adopted, with each protocol emulated as a microservice, and the listening port and protocol type can be specified via command-line arguments.

[0230] Second, memory control: Avoid global variables and caches, and use stack memory as much as possible. Use an object pool (sync.Pool) to reuse objects and reduce memory allocation. Set GOMAXPROCS=1, because honeypots are usually I / O intensive, a single CPU core is sufficient, and this reduces the memory overhead of multi-core systems. Use compact data structures (e.g., use `uint8` instead of `int`).

[0231] Third, connection management: create a goroutine for each connection, but control the number of goroutines (use buffered channels as a limit on the number of connections).

[0232] Fourth, logging: Output logs to standard output or a file, with concise log content (only record critical events: connection, protocol errors, attack behavior, etc.).

[0233] Fifth, configuration management: Configure ports, protocol types, log levels, etc. through environment variables or command-line parameters.

[0234] The specific operational details of protocol simulation for low-interaction honeypot processing technology, taking Modbus / TCP simulation as an example:

[0235] First, protocol specifications: Modbus / TCP is a TCP-based Modbus protocol using port 502. Message structure: MBAP header (7 bytes) + Modbus PDU.

[0236] Second, the simulation steps: Listen on the TCP port (default 502). Receive client data and parse the MBAP header (transaction identifier, protocol identifier, length, unit identifier). Check the protocol identifier (0x0000) and unit identifier (usually 0xFF or 0x00). Parse the PDU (function code and request data).

[0237] Generate a response based on the function code: Construct the response MBAP header (transaction identifier is the same as the request, length field is recalculated) and PDU, and send them to the client.

[0238] For honeypot processing technology, it can be based on Docker containers to simulate vulnerable services (such as the S7comm vulnerability in CVE-2015-5374), requiring 50-100MB of memory.

[0239] The specific operation details of Docker containers for honeypot processing technology and CVE vulnerability simulation:

[0240] The first step is to build a Docker container. You can write a Dockerfile to build an image that includes the vulnerability simulation service.

[0241] The second step is to provide a vulnerability simulation service. You can use Python or other languages ​​to write a service that simulates the S7comm vulnerability (CVE-2015-5374).

[0242] The third step is to start the container. The container can be started according to the instructions of the scheduling system, and the network can be configured to redirect attack traffic to the container.

[0243] The fourth step is logging, which records the attacker's behavior and sends it to a central log server for analysis.

[0244] For high-interaction honeypot processing technology, it can be based on KVM virtual machine, running a complete power system image, activating on demand, and capturing behavior.

[0245] Operational details of KVM virtual machines using high-interaction honeypot processing technology:

[0246] The first step is environment setup: Use KVM to create a complete operating system virtual machine (such as Ubuntu / CentOS), deploy real business services and simulate a complete power system network topology; configure CPU and memory resource isolation for the virtual machine to ensure that attacks do not affect the host machine; set up the virtual machine snapshot function to facilitate quick restoration of the initial state after an attack.

[0247] The second step is vulnerability-induced configuration: deliberately open high-risk ports (such as 445 / 3389) in a virtual machine and deploy an older version of software with vulnerabilities; implant fake sensitive data as bait.

[0248] APT behavior capture operations may include the following:

[0249] The first step is multi-dimensional monitoring: record all system calls, process creation, file operations, and other behaviors within the virtual machine; capture network traffic (including encrypted communication) and correlate and analyze DNS requests and C2 server connections.

[0250] The second step involves advanced analytics: detecting fileless attacks and process injection through memory forensics; analyzing the execution chain of malicious samples downloaded by attackers using sandboxing techniques; and tracing lateral movement behaviors (such as pass-the-hash attacks and internal scanning).

[0251] The third step is automated response: when suspicious operations (such as large-scale data export) are detected, alarms are automatically triggered and virtual machines are isolated; attack fingerprints (such as IP and tool characteristics) are synchronized to the enterprise firewall to achieve coordinated defense.

[0252] By introducing a sliding window mechanism to dynamically segment traffic data streams and extract real-time traffic data (including 5-tuples (source / destination IP + port + protocol), payload entropy (for detecting encrypted traffic), packet length variance (for identifying scanning behavior), etc.), millisecond-level attack detection can be achieved, improving processing efficiency. Simultaneously, logging of the selected defense techniques and algorithm optimization enables seamless integration of detection and response, transforming clustering labels into honeypot deployment strategies in real time, and constructing a dual-closed-loop learning architecture.

[0253] This invention also provides a device for optimizing the screening algorithm of power Internet of Things (IoT) defense strategies, see [link to relevant documentation]. Figure 4 The diagram shows a schematic of the structure of a screening algorithm optimization device for a power Internet of Things defense strategy provided in an embodiment of the present invention.

[0254] As an example, the filtering algorithm optimization device for the power Internet of Things defense strategy may include:

[0255] The log acquisition module 401 is used to acquire log processing data, wherein each log processing data is data obtained by preprocessing the logs of the defense process when different honeypot processing technologies of the power Internet of Things defense strategy are used for defense.

[0256] The evaluation value determination module 402 is used to reconstruct a real-time attack reconstruction diagram of the network attack using the log processing data, and determine the attack evaluation value based on the real-time attack reconstruction diagram.

[0257] The algorithm optimization module 403 is used to optimize the preset screening algorithm based on the attack evaluation value. The preset screening algorithm is an algorithm that selects different honeypot processing technologies for defense from the power Internet of Things defense strategy.

[0258] Optionally, the step of reconstructing a real-time attack reconstruction diagram of the network attack using the log processing data includes:

[0259] Determine the annotation information of the user on the log processing data, and filter multiple attack nodes from the log processing data based on the annotation information;

[0260] The time point of each attack node is determined, and multiple attack nodes are connected in chronological order according to the time points to obtain a real-time attack reconstruction map, wherein the connection process involves sequentially connecting two adjacent attack nodes.

[0261] Optionally, determining the attack evaluation value based on the real-time attack reconstruction graph includes:

[0262] Determine the node parameters of each attack node in the real-time attack reconstruction graph. The node parameters include the total number of actions of the attack node itself and the number of actions from the attack node to the adjacent attack nodes.

[0263] The attack weight value of each attacking node is calculated based on the node parameters, and the attack evaluation value is calculated using the attack weight value.

[0264] Optionally, the preset screening algorithm includes: K-means clustering algorithm and Q-learning algorithm;

[0265] The optimization of the preset filtering algorithm based on the attack evaluation value includes:

[0266] The attack evaluation value is used to optimize the target cluster centers of the K-means clustering algorithm, and the clustering threshold of the K-means clustering algorithm is adjusted according to the false positive rate or false negative rate of the honeypot processing technology.

[0267] If the network attack is determined to be a complete attack chain based on the real-time attack reconstruction graph, the reward function of the Q-learning algorithm is adjusted using the attack evaluation value.

[0268] Optionally, obtaining log processing data includes:

[0269] Obtain the initial log data corresponding to different honeypot processing technologies. The initial log data is the log data recorded when the honeypot processing technology performs defense.

[0270] Different initial log data are preprocessed to obtain processed log data, wherein the preprocessing includes: data cleaning, field extraction, normalization, and time sorting.

[0271] This invention also provides a defense device for the power Internet of Things (IoT), see [link to relevant documentation]. Figure 5 The diagram shows a structural schematic of a defense device for the Internet of Things (IoT) of the power industry, according to an embodiment of the present invention.

[0272] As an example, the defense device for the power Internet of Things may include:

[0273] The conversion module 501 is used to acquire real-time traffic data of the power Internet of Things based on sliding window technology when the power Internet of Things is under network attack, extract features from the real-time traffic data and convert them into vectors to obtain a traffic feature vector.

[0274] Defense module 502 is used to call a preset strategy filtering algorithm to filter target honeypot technologies from the preset defense strategy according to the traffic feature vector, and call the target honeypot technology for defense processing. The preset strategy filtering algorithm is an algorithm optimized according to the power Internet of Things defense strategy filtering algorithm optimization method described in the above embodiment.

[0275] Optionally, the preset strategy screening algorithm includes K-means clustering algorithm and Q-learning algorithm;

[0276] The step of invoking the preset strategy filtering algorithm to filter target honeypot technologies from the preset defense strategy based on the traffic feature vector, and then invoking the target honeypot technology for defense processing, includes:

[0277] The kernel function of the K-means clustering algorithm is called to calculate the cluster center distance of the traffic feature vector, and the traffic feature vector is clustered according to the cluster center distance to obtain several clusters;

[0278] Calculate the density parameter of each cluster and determine the clustering information of each cluster based on the density parameter;

[0279] The Q-learning algorithm is invoked to select target honeypot technologies from the preset defense strategy based on the clustering information, and the target honeypot technologies are invoked for defense processing.

[0280] Optionally, the step of invoking the Q-learning algorithm to filter target honeypot technologies from a preset defense strategy based on the clustering labels, and then invoking the target honeypot technologies for defense processing, includes:

[0281] If the random number is greater than the preset exploration probability, the Q-learning algorithm is called to calculate the reward value of each honeypot technology within the preset defense strategy based on each action label of the clustering information. The honeypot technology with the largest reward value is selected as the target honeypot technology, and the target honeypot technology is activated for defense processing.

[0282] If the random number is less than the preset exploration probability, one of the preset defense strategies is randomly selected as the target honeypot technology, and the target honeypot technology is activated for defense processing; or, if the random number is less than the preset exploration probability, no defense processing is performed.

[0283] Those skilled in the art will understand that, for ease of description and brevity, the specific working process of the device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0284] Furthermore, this application also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the power Internet of Things (IoT) defense strategy screening algorithm optimization method or the power IoT defense method as described in the above embodiments.

[0285] Furthermore, embodiments of this application also provide a computer-readable storage medium storing a computer-executable program, the computer-executable program being used to cause a computer to execute the filtering algorithm optimization method for the power Internet of Things defense strategy as described in the above embodiments, or the power Internet of Things defense method.

[0286] In the description of the embodiments of the present invention, it should be noted that the terms "above," "below," etc., indicating the orientation or positional relationship are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention. When an element such as a layer, region, or substrate is referred to as being "above" or "on top of" another element, it may be directly on the other element, or there may be an intermediate element. Conversely, when an element is referred to as being "directly on" or "above" another element, there is no intermediate element. It should also be understood that when an element is referred to as being "below" or "under" another element, it may be directly below or under the other element, or there may be an intermediate element. Conversely, when an element is referred to as being "directly below" or "under" another element, there is no intermediate element. Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0287] Those skilled in the art will understand that embodiments of this application may also include computer program products. Therefore, this application may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0288] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), devices, and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0289] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0290] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0291] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for optimizing a screening algorithm for a power Internet of Things (IoT) defense strategy, characterized in that, The method includes: Obtain log processing data, wherein each log processing data is data obtained by preprocessing the logs of the defense process when different honeypot processing technologies of the power Internet of Things defense strategy are used for defense; The real-time attack reconstruction diagram of the network attack is reconstructed using the log processing data, and the attack evaluation value is determined based on the real-time attack reconstruction diagram. The preset filtering algorithm is optimized based on the attack evaluation value. The preset filtering algorithm is an algorithm that selects different honeypot processing technologies for defense from the power Internet of Things defense strategy.

2. The method for optimizing the screening algorithm of the power Internet of Things defense strategy according to claim 1, characterized in that, The real-time attack reconstruction diagram of the network attack using the log processing data includes: Determine the annotation information of the user on the log processing data, and filter multiple attack nodes from the log processing data based on the annotation information; The time point of each attack node is determined, and multiple attack nodes are connected in chronological order according to the time points to obtain a real-time attack reconstruction map, wherein the connection process is to connect two adjacent attack nodes in sequence.

3. The method for optimizing the screening algorithm of the power Internet of Things defense strategy according to claim 2, characterized in that, The process of determining the attack evaluation value based on the real-time attack reconstruction graph includes: Determine the node parameters of each attack node in the real-time attack reconstruction graph. The node parameters include the total number of actions of the attack node itself and the number of actions from the attack node to the adjacent attack nodes. The attack weight value of each attacking node is calculated based on the node parameters, and the attack evaluation value is calculated using the attack weight value.

4. The method for optimizing the screening algorithm of the power Internet of Things defense strategy according to claim 1, characterized in that, The preset screening algorithms include: K-means clustering algorithm and Q-learning algorithm; The optimization of the preset filtering algorithm based on the attack evaluation value includes: The attack evaluation value is used to optimize the target cluster centers of the K-means clustering algorithm, and the clustering threshold of the K-means clustering algorithm is adjusted according to the false positive rate or false negative rate of the honeypot processing technology. If the network attack is determined to be a complete attack chain based on the real-time attack reconstruction graph, the reward function of the Q-learning algorithm is adjusted using the attack evaluation value.

5. The method for optimizing the screening algorithm of the power Internet of Things defense strategy according to claim 1, characterized in that, The acquisition of log processing data includes: Obtain the initial log data corresponding to different honeypot processing technologies. The initial log data is the log data recorded when the honeypot processing technology performs defense. Different initial log data are preprocessed to obtain processed log data, wherein the preprocessing includes: data cleaning, field extraction, normalization, and time sorting.

6. A defense method for the power Internet of Things, characterized in that, The method includes: When the power Internet of Things (IoT) is attacked by a network, real-time traffic data of the power IoT is obtained based on the sliding window technology. Features are extracted from the real-time traffic data and converted into vectors to obtain a traffic feature vector. The preset strategy filtering algorithm is invoked to filter target honeypot technologies from the preset defense strategy based on the traffic feature vector, and the target honeypot technologies are invoked for defense processing. The preset strategy filtering algorithm is an algorithm optimized by the filtering algorithm optimization method of the power Internet of Things defense strategy according to any one of claims 1-5.

7. The defense method for the power Internet of Things according to claim 6, characterized in that, The preset strategy screening algorithm includes K-means clustering algorithm and Q-learning algorithm; The step of invoking the preset strategy filtering algorithm to filter target honeypot technologies from the preset defense strategy based on the traffic feature vector, and then invoking the target honeypot technology for defense processing, includes: The kernel function of the K-means clustering algorithm is called to calculate the cluster center distance of the traffic feature vector, and the traffic feature vector is clustered according to the cluster center distance to obtain several clusters; Calculate the density parameter of each cluster and determine the clustering information of each cluster based on the density parameter; The Q-learning algorithm is invoked to select target honeypot technologies from the preset defense strategy based on the clustering information, and the target honeypot technologies are invoked for defense processing.

8. The defense method for the power Internet of Things according to claim 7, characterized in that, The step of invoking the Q-learning algorithm to filter target honeypot technologies from a preset defense strategy based on the clustering labels, and then invoking the target honeypot technologies for defense processing, includes: If the random number is greater than the preset exploration probability, the Q-learning algorithm is called to calculate the reward value of each honeypot technology within the preset defense strategy based on each action label of the clustering information. The honeypot technology with the largest reward value is selected as the target honeypot technology, and the target honeypot technology is activated for defense processing. If the random number is less than the preset exploration probability, one of the preset defense strategies is randomly selected as the target honeypot technology, and the target honeypot technology is activated for defense processing; or, if the random number is less than the preset exploration probability, no defense processing is performed.

9. A device for optimizing a screening algorithm for a power Internet of Things (IoT) defense strategy, characterized in that, The device includes: The log acquisition module is used to acquire log processing data, wherein each piece of log processing data is data obtained by preprocessing the logs of the defense process when different honeypot processing technologies of the power Internet of Things defense strategy are used for defense. The evaluation value determination module is used to reconstruct a real-time attack reconstruction diagram of the network attack using the log processing data, and determine the attack evaluation value based on the real-time attack reconstruction diagram. The algorithm optimization module is used to optimize the preset screening algorithm based on the attack evaluation value. The preset screening algorithm is an algorithm that selects different honeypot processing technologies for defense from the power Internet of Things defense strategy.

10. A defense device for the Internet of Things (IoT) of power systems, characterized in that, The device includes: The conversion module is used to acquire real-time traffic data of the power Internet of Things (IoT) based on sliding window technology when the power IoT is under network attack, extract features from the real-time traffic data and convert them into vectors to obtain traffic feature vectors. The defense module is used to call a preset strategy filtering algorithm to filter target honeypot technologies from the preset defense strategy according to the traffic feature vector, and to call the target honeypot technologies for defense processing. The preset strategy filtering algorithm is an algorithm optimized by the filtering algorithm optimization method of the power Internet of Things defense strategy according to any one of claims 1-5.

Images