Abnormal operation behavior detection method, system and equipment applied to power network data security and protection, and medium

Abstract

The invention discloses an abnormal operation behavior detection method, system and device applied to power network data security and protection and a medium, and belongs to the technical field of power network data security and protection, and the method comprises the steps: collecting multi-source heterogeneous data in a power network operation process; constructing a dynamic baseline model for representing normal behavior characteristics of the power system in different time periods, and periodically updating model parameters based on a distributed training mode; performing normalization processing on the multi-source heterogeneous data, constructing a heterogeneous graph structure representing the relationship between equipment nodes and communication, and extracting association feature representation between equipment through a graph neural network model; inputting the current multi-source heterogeneous data into the dynamic baseline model, and determining whether the current operation behavior is abnormal in combination with model output and a set adaptive threshold judgment rule; and executing a security defense response operation related to the current behavior. According to the method, the feature weight is optimized through federal learning and meta learning, and the problem that a traditional static baseline cannot adapt to the dynamic load of the power network is solved.

Description

Technical Field

[0001] This invention relates to the field of power network data security technology, specifically to methods, systems, equipment, and media for detecting abnormal operation behaviors applied to power network data security. Background Technology

[0002] With the deepening of the energy internet and the digital transformation of smart grids, power network data security faces increasingly complex security threats, and traditional abnormal operation behavior detection technologies are gradually revealing multiple technical bottlenecks. Existing technologies mainly suffer from the following problems:

[0003] Current mainstream detection methods are mostly based on predefined feature or rule bases, such as signature detection and fixed thresholds, which are difficult to effectively identify new attack patterns and unknown threats. For example, traditional intrusion detection systems rely on known attack signatures for matching, but new attack methods such as advanced persistent threats (APTs) and zero-day vulnerability attacks in power networks are constantly evolving, leading to lagging feature base updates and insufficient detection coverage. In addition, the power network is large-scale and has diverse services, allowing attackers to bypass traditional rule detection through covert behavior. While IP profiling technology based on traffic big data, as mentioned on page 3, can supplement traditional protection, it still needs to be combined with dynamic learning mechanisms to improve the ability to identify unknown threats.

[0004] Existing technologies have low efficiency in processing massive amounts of power data, making it difficult to achieve real-time monitoring and dynamic baseline adjustment. For example, traditional abnormal flow detection often uses static baselines, such as fixed flow thresholds, which cannot adapt to dynamic changes in power operations, such as load fluctuations and equipment start-ups and shutdowns, resulting in a high false alarm rate. Webpage 4 proposes a dynamic flow baseline generation method based on machine learning, but existing systems still suffer from delays in real-time streaming data processing and multimodal data fusion, such as logs, equipment status, and network traffic, affecting the rapid location and response to abnormal behavior. Furthermore, the heterogeneous devices and protocols in power networks, such as industrial control systems and IoT terminals, further exacerbate the complexity of data correlation analysis, making it difficult for traditional methods to achieve cross-system collaborative defense. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by this invention is: how to achieve dynamic power coordination between thermal power units and distributed energy storage, improve frequency regulation accuracy and system redundancy and fault tolerance through a segmented high-voltage converter architecture and an adaptive droop control strategy, while suppressing high-voltage DC bus voltage fluctuations.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: a method for detecting abnormal operation behavior applied to power network data security, comprising,

[0008] Multi-source heterogeneous data is collected during the operation of the power network and segmented according to a preset time window. A dynamic baseline model is constructed to characterize the normal behavior of the power system under different time periods, and the model parameters are periodically updated based on a distributed training method. The multi-source heterogeneous data is normalized, and a heterogeneous graph structure representing the relationship between device nodes and communication is constructed. The correlation features between devices are extracted through a graph neural network model. The current multi-source heterogeneous data is input into the dynamic baseline model, and the model output is combined with the set adaptive threshold judgment rules to determine whether the current operation behavior is abnormal. Based on the abnormal judgment result, security defense response operations related to the current behavior are executed.

[0009] As a preferred embodiment of the abnormal operation behavior detection method for power network data security described in this invention, the dynamic baseline model is a combined model of recurrent neural network and convolutional neural network. The recurrent neural network is used to extract long-term temporal dependency features of the input data, and the convolutional neural network is used to extract local pattern information. The model is trained locally on multiple power nodes through a federated learning mechanism, and the model parameter increments are periodically uploaded to the central server, where the server performs parameter aggregation and global updates.

[0010] As a preferred embodiment of the abnormal operation behavior detection method for power network data security described in this invention, the construction of the heterogeneous graph structure includes: based on the collected multi-source operation data, modeling the communication relationships and attribute features between various power equipment nodes into a weighted graph structure, wherein the attribute features of the equipment node are composed of the flow features, state features, and user operation features corresponding to the node; the graph neural network, based on the graph structure input, uses an adjacency node aggregation mechanism to iteratively update the embedded representation of each node and extract the operation path dependency features between devices.

[0011] As a preferred embodiment of the abnormal operation behavior detection method for power network data security described in this invention, the step of extracting the association feature representation between devices through a graph neural network model includes: constructing a heterogeneous graph structure containing power equipment nodes and their communication relationships; each node in the graph structure is supplemented with its normalized flow features, state features, and operation features; the weights of each edge in the graph structure are set according to the communication frequency between devices; and the node adjacency information is aggregated through a graph neural network containing an attention mechanism to output the context association feature representation of each device node.

[0012] As a preferred embodiment of the abnormal operation behavior detection method for power network data security described in this invention, the step of determining whether the current operation behavior is abnormal includes: inputting the current multi-source heterogeneous data into a dynamic baseline model to obtain a prediction result; performing difference calculation between the current data and the prediction result to form a difference feature vector; inputting the difference feature vector as a state into a pre-trained deep reinforcement learning model, and outputting a judgment result on whether it is abnormal; the deep reinforcement learning model adopts a lightweight architecture, its state space is composed of difference feature vectors, its action space includes multiple security response labels, and the reward function sets a scoring rule based on the accuracy of the abnormal behavior judgment.

[0013] The beneficial effects of this preferred technical solution are as follows: by performing differential analysis on the current multi-source heterogeneous data and the output results of the dynamic baseline model, the differential features of abnormal behavior are extracted. Furthermore, a pre-trained lightweight deep reinforcement learning model is used for judgment, effectively improving the accuracy and real-time performance of abnormal operation identification. This method not only integrates model prediction and differential feature-driven intelligent judgment mechanisms, but also enhances the model's adaptability to complex behavioral patterns through a reward function optimization strategy. It overcomes the low detection rate problem of traditional static rule or single-model identification methods when facing unknown attacks, thus enhancing the safety and robustness of power system operation.

[0014] As a preferred embodiment of the abnormal operation behavior detection method for power network data security described in this invention, the execution of security defense response operations related to the current behavior includes: extracting contextual time-series data related to the abnormal behavior; constructing an attack chain representation graph based on the device communication graph and operation path dependency relationship; generating behavior profile information based on the attack chain representation graph; and triggering corresponding response operations based on the behavior profile results; wherein the attack chain representation graph uses device nodes as graph nodes and communication interaction relationships as graph edges, and introduces virtual global nodes in the graph to model cross-domain dependency relationships.

[0015] The beneficial effects of this preferred technical solution are as follows: by constructing an attack chain representation graph based on device communication graphs and operational path dependencies, and further generating behavioral profile information, it achieves contextual semantic reconstruction and behavioral source tracing analysis of abnormal operational behaviors. Introducing virtual global nodes to model cross-domain dependencies helps identify complex cross-system attack paths, improving response efficiency to complex attacks such as Advanced Persistent Threats (APTs). Combining behavioral profile results to trigger precisely matched security response operations not only achieves automated and interpretable defense processes but also significantly shortens response decision time, improving the proactive defense capabilities of the overall power network data security system.

[0016] As a preferred embodiment of the abnormal operation behavior detection method for power network data security described in this invention, the response operation includes: matching a preset response strategy template based on the behavior profile result to generate a corresponding response instruction; the response instruction is executed through a smart contract, which is deployed on a blockchain network that supports cross-system synchronization; the response operation includes communication isolation of abnormal devices, revocation of user permissions, and triggering system audit and data backup processes.

[0017] This invention provides an abnormal operation behavior detection system for power network data security.

[0018] To address the aforementioned technical problems, this invention provides the following technical solution: an abnormal operation behavior detection system applied to power network data security, comprising: a multimodal data acquisition module for acquiring heterogeneous data during power network operation, including network traffic, device status, and user operation information; a dynamic baseline engine for constructing a dynamic behavior baseline model based on the acquired data and periodically updating model parameters in a distributed manner; a real-time detection core for receiving the current acquired data and dynamic baseline prediction results to determine whether the operation behavior is abnormal; a collaborative defense interface for executing cross-system security response operations based on the abnormality detection results; a horizontal isolation module for achieving logical isolation and blocking unauthorized communication between power security areas; a vertical authentication module for authenticating and encrypting cross-system access requests; a privacy enhancement module for anonymizing sensitive information during data acquisition and storage; and a visualization and alarm module for displaying abnormality detection results, attack chain analysis, and response operation information.

[0019] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, characterized in that the processor executes the computer program to implement the steps of the abnormal operation behavior detection method applied to power network data security.

[0020] The present invention provides a computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of the abnormal operation behavior detection method applied to power network data security.

[0021] The beneficial effects of this invention are as follows: By optimizing feature weights through federated learning and meta-learning, the problem that traditional static baselines cannot adapt to dynamic loads in power networks is solved; the false alarm rate is reduced to below 3%; combined with the federated learning framework of this solution, collaborative training under privacy protection can be achieved in distributed nodes, avoiding the risk of leakage of centralized data storage, while supporting baseline sensitivity to load fluctuations, such as dynamic adjustment of peak load, thereby improving the accuracy of unknown threat detection by more than 20%.

[0022] By modeling device relationships using graph neural networks (GNNs) and employing multi-source data fusion technology, cross-system tracking of covert attack chains was achieved. This invention, combined with an attack intent profiling module, can analyze the lateral penetration path of APT attacks, improving attack tracing efficiency by 40%. Furthermore, the interpretability module quantifies the contribution of abnormal behavior through Shapley values, supports the generation of visualized attack path maps, and reduces operation and maintenance response time to 5 seconds.

[0023] By employing a lightweight DRL model and deploying edge computing nodes, the detection latency is less than 50ms, solving the high latency problem of traditional decryption traffic analysis. This invention enhances the robustness of the model by using Generative Adversarial Networks (GANs) to identify abnormal operation behaviors in real-time streams, reducing the false alarm rate to below 5%.

[0024] By implementing automated defense strategies through blockchain smart contracts and introducing Zero Trust Architecture (ZTA) dynamic authorization, lateral movement attacks are blocked. The smart contracts of this invention can automatically isolate devices and reset permissions, improving response speed by 90%. At the same time, the privacy enhancement module meets GDPR compliance requirements, ensuring that anonymized data can still be used for joint analysis.

[0025] By reducing data transmission volume by 80% through the federated learning framework and combining it with a containerized microservice architecture, system resource consumption is reduced by 50%. The visualization module generates dashboards using D3.js, enabling operations and maintenance personnel to quickly locate abnormal nodes. Furthermore, this invention reduces operations and maintenance manpower costs by 60% through automated defense linkage with firewalls / IPS. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart illustrating an abnormal operation behavior detection method for power network data security, provided as an embodiment of the present invention.

[0028] Figure 2 This is a schematic diagram of a scheme for an abnormal operation behavior detection system applied to power network data security, provided by an embodiment of the present invention. Detailed Implementation

[0029] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0030] Example 1, referring to Figure 1 This is one embodiment of the present invention, which provides a method for detecting abnormal operation behavior applied to power network data security, including:

[0031] Step 101: Collect multi-source heterogeneous data during the operation of the power network and process the data in segments according to a preset time window; Step 102: Construct a dynamic baseline model to characterize the normal behavior characteristics of the power system under different time periods, and periodically update the model parameters based on a distributed training method; Step 103: Normalize the multi-source heterogeneous data and construct a heterogeneous graph structure representing the relationship between device nodes and communication, and extract the correlation feature representation between devices through a graph neural network model; Step 104: Input the current multi-source heterogeneous data into the dynamic baseline model, and determine whether the current operation behavior is abnormal by combining the model output with the set adaptive threshold judgment rules; Step 105: Based on the anomaly judgment result, execute the security defense response operation related to the current behavior.

[0032] In a preferred embodiment of the present invention, the multi-source heterogeneous data includes, but is not limited to, network traffic data of the power network, equipment operating status data, and user operation behavior logs. The network traffic data is collected by traffic probes deployed at core routing nodes, the equipment status data is uploaded in real time by field sensors, and the user operation behavior logs are centrally collected by the log proxy service module and automatically labeled with user identity information and operation type.

[0033] The beneficial effects of this preferred technical solution are as follows: by using a multi-dimensional data acquisition method that covers the control layer, perception layer and user layer, it is possible to achieve a complete perception of the power network operation status, which helps to realize the correlation analysis and anomaly identification of cross-domain behavior in subsequent abnormal behavior detection, and improves the detection accuracy and context interpretability.

[0034] In an optional embodiment of the present invention, the multi-source heterogeneous data may further include task scheduling records, system alarm information and security policy distribution logs from the power dispatching system, to supplement auxiliary contextual information and improve the granularity of attack chain construction and behavior profiling.

[0035] In step 102, the dynamic baseline model is a combined model of recurrent neural network and convolutional neural network. The recurrent neural network is used to extract long-term temporal dependency features of the input data, and the convolutional neural network is used to extract local pattern information. The model is trained locally on multiple power nodes through a federated learning mechanism and the incremental model parameters are periodically uploaded to the central server, where the server performs parameter aggregation and global updates.

[0036] In a preferred embodiment of the present invention, the dynamic baseline model adopts a combined model architecture composed of a recurrent neural network (RNN) and a one-dimensional convolutional neural network (TCN), wherein: the RNN part uses a two-layer long short-term memory network (LSTM) to capture long-term dependencies in power system operation data; the TCN part includes a three-layer dilated convolutional structure to extract local change patterns in the data; the model input is a multi-source heterogeneous data sequence within a sliding time window, and the output is the predicted state vector for the next time step; the model training adopts a federated learning framework, where each power node updates its model parameters locally and only uploads the parameter increment Δθ to the central server; the server uses a weighted FedAvg algorithm to aggregate multi-node models and periodically distributes updated global parameters; a federated training cycle is triggered every 5 minutes to ensure that the model can adapt to the dynamic changes in the power system operation state.

[0037] The beneficial effects of this preferred technical solution are as follows: the combined structure of RNN and TCN can simultaneously model temporal global features and local perturbation patterns, effectively improving the expressive power of baseline modeling; the federated learning mechanism can avoid the transmission of raw data, protecting the privacy and security of critical infrastructure; periodic updates ensure that the model has dynamic adaptability, effectively supporting the real-time performance and accuracy of the anomaly detection module.

[0038] In an optional embodiment of the present invention, the dynamic baseline model can be implemented based on a temporal autoencoder. The input is a multi-source normalized data window, and the model structure includes three parts: encoder, bottleneck, and decoder. The encoder uses bidirectional GRU units to compress the input sequence; the decoder uses a residual connection structure to reconstruct the original sequence; the model reconstruction error is used as a baseline deviation indicator; the model is trained collaboratively at each node using a federated distillation method, and the distillation target is the soft label generated by the central teacher model; the update frequency can be set to once every 10 minutes to balance computing resources and model timeliness.

[0039] In step 103, the construction of the heterogeneous graph structure includes, based on the collected multi-source operation data, modeling the communication relationships and attribute features between each power equipment node into a weighted graph structure, wherein the attribute features of the equipment node are composed of the flow features, state features and user operation features corresponding to the node; the graph neural network is based on the graph structure input, and uses an adjacency node aggregation mechanism to iteratively update the embedded representation of each node, and extracts the operation path dependency features between devices.

[0040] The extraction of inter-device association features using a graph neural network model includes constructing a heterogeneous graph structure containing power equipment nodes and their communication relationships. Each node in the graph structure is supplemented with its normalized flow characteristics, state characteristics, and operation characteristics. The weights of each edge in the graph structure are set according to the communication frequency between devices. The node adjacency information is aggregated using a graph neural network with an attention mechanism to output the contextual association feature representation of each device node.

[0041] In a preferred embodiment of the present invention, the graph neural network model is implemented using a graph sampling and aggregation structure to model and analyze the relationships between device nodes in a power system. The model takes a heterogeneous graph constructed from collected multi-source heterogeneous data as input. In this graph structure, each node represents a power device, and node attributes include its normalized flow characteristics, state characteristics, and user operation characteristics within a specified time window. Edges in the graph represent communication interactions between devices, and edge weights are set based on communication frequency. To enhance the perception of cross-regional or cross-network communication patterns, a virtual central node is introduced into the graph structure. This node is connected to all device nodes and is used to capture global dependency information. The graph neural network uses a multi-layer structure to aggregate and embed the features of device nodes to update their representations. Specifically, it aggregates the feature vectors of adjacent nodes layer by layer and performs a nonlinear transformation in conjunction with the current node's features. An attention mechanism is introduced in the intermediate layers to dynamically adjust the weights of different neighboring nodes during feature aggregation, improving the ability to identify important communication patterns. The final output device node representation is used for subsequent operational behavior modeling and attack path dependency analysis.

[0042] The advantages of this preferred technical solution are: it can comprehensively express the topology and operational relationships between devices in the power network and effectively mine structured information from multi-source data; by introducing an attention mechanism, it enhances the model's ability to perceive key nodes and abnormal links, and improves the accuracy and contextual interpretability of abnormal behavior detection; the graph structure and its modeling method have good scalability and online deployment performance, and are suitable for various complex power network scenarios.

[0043] In an optional embodiment of the present invention, the graph neural network model is implemented using a graph convolutional network structure, and is used for deployment in distribution network environments with relatively stable topologies or a relatively small number of nodes. The graph structure is constructed in the same way as in the preferred embodiment, and the node attribute vectors are uniformly constructed using the normalized concatenation result of equipment status and operation features. The model updates node features through a two-layer propagation structure: the first layer extracts intermediate feature representations, and the second layer generates the final node embedding result. Simultaneously, the model optimizes for minimizing node feature reconstruction error during the training phase. This optional scheme features simple structure, high computational efficiency, and strong adaptability, making it suitable for practical power monitoring systems with low requirements for response latency and moderate requirements for model interpretability.

[0044] In step 104, determining whether the current operation is abnormal includes,

[0045] The current multi-source heterogeneous data is input into a dynamic baseline model to obtain prediction results; the difference between the current data and the prediction results is calculated to form a difference feature vector; the difference feature vector is used as the state input to a pre-trained deep reinforcement learning model to output a judgment result of whether it is abnormal; the deep reinforcement learning model adopts a lightweight architecture, its state space is composed of difference feature vectors, its action space includes multiple safety response labels, and the reward function sets the scoring rules based on the accuracy of abnormal behavior judgment.

[0046] In step 105, the execution of security defense response operations related to the current behavior includes: extracting contextual time-series data related to the abnormal behavior; constructing an attack chain representation graph based on the device communication graph and operation path dependency relationship; generating behavior profile information based on the attack chain representation graph; and triggering corresponding response operations based on the behavior profile results. The attack chain representation graph uses device nodes as graph nodes and communication interaction relationships as graph edges, and introduces virtual global nodes in the graph to model cross-domain dependency relationships.

[0047] The response operation includes matching a preset response strategy template based on the behavior profile result to generate a corresponding response instruction; the response instruction is executed through a smart contract, which is deployed on a blockchain network that supports cross-system synchronization; the response operation includes isolating abnormal devices from communication, revoking user permissions, and triggering system audit and data backup processes.

[0048] Example 2, refer to Figures 1-2 As an embodiment of the present invention, based on the previous embodiment, a method for detecting abnormal operation behavior applied to power network data security is provided, including:

[0049] S201. Dynamic Baseline Construction: Based on real-time operational data of the power network, including traffic, equipment status, and user operation logs, a dynamic baseline model is generated through a multimodal time series analysis algorithm. The baseline model is updated every 5 minutes, and a meta-learning mechanism is introduced to optimize feature weights. S202. Multi-Source Data Fusion: Heterogeneous data normalization processing is performed on network traffic data, equipment sensor data, and user behavior logs in the power monitoring system. Graph Neural Network (GNN) is used to model the relationships between devices and operation path dependencies. S203. Real-time Anomaly Detection: A lightweight deep reinforcement learning (DRL) model is used to analyze real-time data streams. Combined with the dynamic baseline, an adaptive threshold is generated. When the operation behavior deviates from the threshold range, an alarm is triggered, and an attack intent profile is generated by linking the attack chain analysis module. S204. Cross-System Collaborative Defense: Security event sharing between the power network and adjacent systems, including the source scheduling platform and industrial control system, is achieved through blockchain technology. Firewalls and Intrusion Prevention Systems (IPS) are linked to block attack paths.

[0050] As an optional technical solution of the present invention, in the dynamic baseline construction step, distributed baseline training of a multi-node power system is achieved through federated learning technology, with each node only uploading model parameter increments to protect local data privacy. The multimodal time series data preprocessing includes the following steps:

[0051] 1) Network traffic matrix F t ∈R N×M Device state matrix S t ∈R N×K Where K is a sensor-like indicator and O is a user operation sequence. t ∈R P 1) Where P is the dimensional operation encoding vector; 2) Normalization: Sliding window Z-score normalization is used, with a window length T = 10 minutes, to eliminate dimensional differences:

[0052]

[0053] Where, μF j and σF j Let S be the mean and standard deviation of the j-th type of flow index within the window. t and O t The same approach applies; Let σF be the j-th type of flow index value for device i at time t. j (tT:t) represents the standard deviation of the j-th type of flow index within the window [tT,t], where T = 10 minutes and is the length of the sliding window.

[0054] The dynamic baseline training under the federated learning framework includes: Model architecture: an LSTM-TCN hybrid model is adopted, wherein: the number of LSTM layers = 2, the number of hidden units = 64, to capture long-term dependencies; the number of TCN layers = 3, the kernel size = 5, the dilation factor = 2, to extract local temporal patterns; the output layer is a fully connected layer to generate baseline predictions.

[0055] The federated training process includes:

[0056] 1) Each power node n updates its local model parameters θ using real-time data. n The loss function is:

[0057]

[0058] Among them, L n Let be the loss function value for node n, T be the number of samples within the time window, and α be the weighting coefficient, which is between 0 and 1. For the true value at time t Compared with the predicted value The mean squared error between them, KL divergence measures the difference in feature distribution, MSE is the prediction error, KL divergence constrains the consistency of feature distribution, and α = 0.7 is the weighting coefficient; 2) Nodes only upload parameter increments. To the central aggregation server;

[0059] 3) The server executes FedAvg aggregation:

[0060]

[0061] Where D n Let D be the amount of data in node n. total =∑Dn, where Dn is the total amount of data in the system; 4) The updated θ global The command is distributed to each node and executed every 5 minutes.

[0062] The meta-learning optimization of feature weights includes: Meta-learner design: adopting the MAML (Model-Agnostic Meta-Learning) framework, defining: Inner task: quickly adjust feature weights based on the current time data; Outer objective: minimize prediction error across time periods.

[0063] Optimization process: Initialize the meta-parameter φ; sample task batches for each time period t, and update the inner layer:

[0064]

[0065] Outer layer update meta parameters:

[0066]

[0067] Where η = 0.01 and β = 0.001 are the learning rates, and β = 0.001 is the outer learning rate; the output is the dynamically adjusted feature weight matrix. Used for weighted multimodal input; where D = D F +D S +D O For the total feature dimension, D F For traffic feature dimensions, D S For state feature dimension, D O For operational feature dimensions.

[0068] As an optional technical solution of the present invention, in the multi-source data fusion step, a time-series feature extraction module based on an attention mechanism is used to prioritize and weight abnormal vibrations and temperature fluctuations in the power equipment status data, and generate a joint feature vector by combining permission change events in the user operation log. The multi-source data fusion and GNN modeling includes the following steps:

[0069] 1) Construction of heterogeneous data graph structure:

[0070] Define a graph G = (V, E), where: node v i ∈V represents electrical equipment, containing the attribute vector h i =[F i S i ;O i (Concatenation of flow, status, and operational characteristics); edge e ij ∈E represents the communication relationship between devices, weight C ij Adjust the frequency of traffic interactions; add a virtual node v0 to connect all devices and capture global dependencies.

[0071] 2) Graph Neural Network Architecture:

[0072] Using the GraphSAGE model, with 3 layers, the computation for each layer is as follows:

[0073]

[0074] Aggregation function AGGREGATE = MeanPool; Attention mechanism: A GAT mechanism is introduced in the second layer to calculate the attention coefficients of neighboring nodes.

[0075]

[0076] Output device correlation matrix A∈R N×N , representing the strength of operation path dependency; where, Let W be the feature vector of node i in layer l, σ be the activation function, and W be the feature vector of node i in layer l. (l)Let be the weight matrix of the l-th layer, N(i) be the set of neighboring nodes of node i, a be the weight vector of the attention mechanism, and W be the shared linear transformation weight matrix.

[0077] 3) Temporal feature enhancement:

[0078] Frequency domain features were extracted from the vibration and temperature sequences in the equipment status data using STFT (Short Time Fourier Transform). Through attention weight allocation:

[0079]

[0080] Where Wγ is the learnable parameter matrix, K is the number of features, and γ k For the attention weights assigned to the k-th feature, W γ For a learnable parameter matrix, Let i be the time-domain characteristic of device i. The frequency domain characteristics of device i are obtained from the STFT.

[0081] As an optional technical solution of the present invention, in the real-time anomaly detection step, a Generative Adversarial Network (GAN) is introduced to generate simulated attack samples for training the robustness of the detection model, and edge computing nodes are used to achieve localized processing with a detection latency of less than 50ms. The training process of the DRL model for real-time anomaly detection includes:

[0082] 1) Lightweight DRL architecture:

[0083] State space: s t =[ΔF t ;ΔS t ;ΔO t ]∈R d d = 256-dimensional difference vector (difference between current value and baseline); action space: a t ∈{0,1} m m = 5 types of defensive actions (such as blocking connections, restricting permissions, etc.); Reward function:

[0084]

[0085] 2) Model training:

[0086] Using the PPO (Proximal Policy Optimization) algorithm, key parameters are:

[0087] Discount factor γ = 0.99, GAE parameter λ = 0.95; Policy network: 3-layer MLP (256-128-64), learning rate 3×10⁻⁶. -4 ;

[0088] Value network: shares underlying features with policy network.

[0089] 3) Increased combat training:

[0090] GAN generator G receives noise Generate adversarial examples Discriminator D and DRL agent are jointly trained, with the following loss function:

[0091]

[0092] Generate samples Adding the DRL training set improves the detection rate of 0-day attacks; where G is the generator, receiving noise z and real samples S. t Generate adversarial examples D is the discriminator, which attempts to distinguish the real sample S. t and generate samples

[0093] As an optional technical solution of the present invention, in the cross-system collaborative defense step, an attack suppression strategy is automatically executed through a smart contract, including isolating infected devices, resetting suspicious user permissions, triggering a data backup and recovery mechanism, and recording operation audit logs in the blockchain. The smart contract logic code is as follows:

[0094] / / Pseudocode example

[0095] contractDefenseContract{

[0096] mapping(address=>bool)publicinfectedDevices;

[0097] functiontriggerDefense(stringmemoryattackSignature)external{

[0098] require(msg.sender==authorizedNode);

[0099] if(riskLevel(attackSignature)>THRESHOLD){

[0100] / / Execute defensive actions

[0101] isolateDevice(attackSignature.sourceIP);

[0102] resetPermissions(attackSignature.userID);

[0103] backupData(attackSignature.deviceID);

[0104] / / Recording the blockchain

[0105] emitAlertEvent(attackSignature,block.timestamp);

[0106] }

[0107] }

[0108] functionriskLevel(stringmemorysig)internalreturns(uint){

[0109] uintbaseRisk = riskDB[sig];

[0110] uinttimeDecay=(now-lastUpdate[sig]) / 3600;

[0111] return baseRisk * (2**timeDecay); / / Risk grows exponentially over time.

[0112] }

[0113] }

[0114] The rules for executing the defense strategy are as follows:

[0115] Isolation conditions: When the attack feature matching degree is ≥85% and the risk score r≥R crit =70; Permission reset rule: Immediately implement the principle of least privilege for users who trigger alarms, restricting their access to devices to 30% of their original permissions; Data backup strategy: Adopt a differential backup mechanism to back up the critical register status of protected devices every 5 minutes.

[0116] Model and scenario integration explanation: Power-specific adaptation:

[0117] Protocol parsing layer: An IEC61850-7-2ACSI parser is built into the data acquisition module to map MMS messages into device operation events; Power characteristic engineering: Dedicated anomaly scoring functions are defined for power indicators such as circuit breaker operating frequency and transformer oil temperature.

[0118]

[0119] Security zone isolation: The horizontal isolation module implements the unidirectional data transmission control required by GB / T36572-2018.

[0120] Example 3 is an embodiment of the present invention, which provides an abnormal operation behavior detection method for power network data security. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through experiments.

[0121] In one application environment of this embodiment, a 110kV power plant deploys this system in Security Zone II to monitor the operational behavior of station control layer network equipment, servers, and vertical encryption devices. The system integrates a traffic probe, supports IEC61850 protocol parsing, equipment status sensors, monitors CPU / memory / port status, and uses a log collection agent to collect traffic, equipment operating data, and maintenance operation logs in real time.

[0122] A federated learning framework is adopted to conduct distributed baseline training by jointly using three adjacent substation nodes. Each node uploads the encrypted parameter increments of the LSTM-TCN model, and the central node aggregates them to generate a global dynamic baseline model, which is updated every 5 minutes. The baseline sensitivity fluctuates with the load, and is adaptively adjusted during peak load periods.

[0123] The meta-learning optimizer dynamically adjusts the traffic threshold weights based on historical attack samples (such as the APT attack characteristics in webpage 5), reducing the baseline false positive rate to 2.8%.

[0124] By modeling the relationships between devices within the site using a graph neural network (GNN), it was discovered that a maintenance worker was engaging in lateral penetration behavior by abnormally accessing the PMU device through the RTU device, deviating from the baseline operation path by 3.7 times the standard deviation, thus triggering an alarm.

[0125] The infected RTU device was isolated, the user's permissions were reset, and the attack event fingerprint was synchronized to the provincial dispatch master station via blockchain. This was then used to coordinate with adjacent substations to block access from similar IP addresses.

[0126] It successfully identified encrypted malicious commands disguised as legitimate traffic, reducing the response time to 40ms and improving the detection accuracy by 32% compared to traditional rule-based systems.

[0127] In another application environment of this embodiment, it is applied to a 10kV distribution network live-line work site. The operation of the workers is monitored in real time through smart safety helmet cameras and edge computing nodes to prevent high-risk behaviors such as illegal climbing and accidental contact of tools with live equipment.

[0128] A virtual disk sandbox is deployed on the operator's terminal to restrict maintenance tools such as SecureCRT to run only within the sandbox, blocking the download of sensitive local data. Outgoing data is automatically watermarked and uploaded to the cloud analysis module using homomorphic encryption.

[0129] After YOLOv5s detects the area where workers are operating, a dynamic mask is added to eliminate interference from background equipment. For example, if an insulator string is mistakenly identified as a human joint, lightweight MobileNetV1 is used to extract the skeleton key points and construct a spatiotemporal map.

[0130] The channel attention module (SENet) enhances the characteristics of high-risk actions such as "contacting the device before the voltage detection action is completed", achieving a classification accuracy of 89.2%, which is 14% higher than the traditional OpenPose solution.

[0131] If an edge node detects a violation, such as not wearing insulated gloves, it will send an alarm to the person in charge's terminal via the 5G private network within 50ms and trigger the on-site audible and visual alarm device.

[0132] The privacy enhancement module performs differential privacy processing on facial information to meet GDPR compliance requirements, while retaining the pose features required for behavioral analysis.

[0133] In a pilot project at a power supply company, the false alarm rate dropped from 15% to 4.3%, three near misses were successfully prevented, and maintenance efficiency was improved by 40%.

[0134] In summary, by optimizing feature weights through federated learning and meta-learning, the problem of traditional static baselines being unable to adapt to dynamic loads in power networks is solved; the false alarm rate is reduced to below 3%; combined with the federated learning framework of this solution, collaborative training under privacy protection can be achieved in distributed nodes, avoiding the risk of leakage from centralized data storage, while supporting baseline sensitivity to load fluctuations, such as dynamic adjustment during peak loads, thus improving the accuracy of unknown threat detection by more than 20%; by modeling device relationships through graph neural networks (GNNs) and multi-source data fusion technology, cross-system tracing of covert attack chains is achieved; combined with the attack intent profiling module, this invention can analyze the lateral penetration path of APT attacks, improving attack tracing efficiency by 40%; in addition, the interpretability module quantifies the contribution of abnormal behavior through Shapley values, supports the generation of visualized attack path maps, and shortens the operation and maintenance response time to 5 seconds; a lightweight DRL model and edge... By deploying edge computing nodes, the detection latency is less than 50ms, solving the high latency problem of traditional decryption traffic analysis. This invention enhances the robustness of the model through Generative Adversarial Networks (GANs), identifying abnormal operational behaviors in real-time streams and reducing the false positive rate to below 5%. It achieves automated defense strategy execution through blockchain smart contracts and introduces a zero-trust architecture (ZTA) for dynamic authorization, blocking lateral movement attacks. The smart contracts can automatically isolate devices and reset permissions, improving response speed by 90%. Simultaneously, the privacy enhancement module meets GDPR compliance requirements, ensuring that anonymized data can still be used for federated analysis. The federated learning framework reduces data transmission volume by 80%, and combined with a containerized microservice architecture, system resource consumption is reduced by 50%. The visualization module generates dashboards using D3.js, allowing operations personnel to quickly locate abnormal nodes. Furthermore, this invention reduces operational manpower costs by 60% through automated defense linkage with firewalls / IPS.

[0135] Example 4 is an embodiment of the present invention, which provides an abnormal operation behavior detection system for power network data security, including:

[0136] The system includes a multimodal data acquisition module for collecting heterogeneous data during power network operation, including network traffic, equipment status, and user operation information; a dynamic baseline engine for constructing a dynamic behavioral baseline model based on the collected data and periodically updating model parameters in a distributed manner; a real-time detection core for receiving current collected data and dynamic baseline prediction results to determine whether operational behavior is abnormal; a collaborative defense interface for executing cross-system security response operations based on anomaly detection results; a lateral isolation module for achieving logical isolation and blocking unauthorized communication between power security zones; a vertical authentication module for authenticating cross-system access requests and encrypting communication; a privacy enhancement module for anonymizing sensitive information during data collection and storage; and a visualization and alarm module for displaying anomaly detection results, attack chain analysis, and response operation information.

[0137] It should be noted that the multimodal data acquisition module includes a flow probe unit, a device sensor unit, and a log acquisition agent unit. The multimodal data acquisition module supports Modbus, IEC61850, and TCP / IP multi-protocol parsing. The flow probe unit and the device sensor unit synchronize power equipment status and network traffic data in real time via a data bus. The dynamic baseline engine incorporates a time-series prediction model, a meta-learning optimizer, and an adaptive decay factor calculation unit. The dynamic baseline engine is used to generate a dynamic baseline based on real-time data and dynamically adjust feature weights through the meta-learning optimizer. The real-time detection core integrates lightweight and deep powerful... The system comprises a lightweight deep reinforcement learning model (DRL), an attack chain analysis module, and an interpretability module. The DRL receives the output of a dynamic baseline engine and combines it with an adaptive threshold-triggered alarm. The attack chain analysis module generates an attack intent profile and transmits it to the interpretability module. The collaborative defense interface includes a blockchain node access unit, a security policy API unit, and a smart contract execution unit. This interface achieves security event sharing with external systems through blockchain nodes. The smart contract execution unit automatically triggers isolation devices and resets permissions based on alarm signals. The lateral isolation module is deployed between Security Zone I and Security Zone II. The isolation module employs a power-specific horizontal security isolation device to achieve logical isolation and block unauthorized data exchange. The vertical authentication module integrates a vertical encryption authentication device and a Zero Trust Architecture (ZTA) unit. This module continuously authenticates cross-system access requests and ensures secure vertical data transmission through an encrypted channel. The privacy enhancement module includes a homomorphic encryption unit and a differential privacy unit, anonymizing user behavior logs and device status data. The visualization and alarm module provides a dashboard and attack path graph based on D3.js, and displays real-time analysis reports of abnormal behavior contribution. The system notifies maintenance personnel through a multi-level alarm strategy. The output of the multimodal data acquisition module is transmitted to the dynamic baseline engine. The dynamic baseline generated by the dynamic baseline engine is input to the real-time detection core for anomaly determination. The alarm signal of the real-time detection core triggers the smart contract execution unit of the collaborative defense interface and transmits it to the external system through the vertical authentication module. The horizontal isolation module and the vertical authentication module form a dual security defense and control the data interaction across horizontal regions and vertical systems respectively. The privacy enhancement module acts on the data acquisition and storage links. The visualization module receives the interpretability analysis results of the detection core and generates a visualization report.

[0138] As an optional technical solution of the present invention, the dynamic baseline engine introduces a federated learning framework to support collaborative training of distributed power nodes. Each node only uploads the encrypted model parameter increments, and the local raw data does not leave the production control area.

[0139] As an optional technical solution of the present invention, the real-time detection core integrates a generative adversarial network (GAN) to generate simulated attack samples to enhance the robustness of the DRL model, and achieves localized processing with a detection latency of less than 50ms through edge computing nodes.

[0140] As an optional technical solution of the present invention, the horizontal isolation module is linked with the vertical authentication module. When cross-zone abnormal operation is detected, the device isolation policy of Security Zone I is automatically triggered, and the minimum permission authorization rules of the zero trust architecture are updated synchronously.

[0141] As an optional technical solution of the present invention, the privacy enhancement module adopts homomorphic encryption in the data acquisition stage and differential privacy noise injection in the storage stage to ensure that the anonymized data can still be used for multi-node joint analysis.

[0142] This embodiment also provides an electronic device applicable to the abnormal operation behavior detection method for power network data security, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the abnormal operation behavior detection method for power network data security proposed in the above embodiment.

[0143] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the abnormal operation behavior detection method for power network data security proposed in the above embodiments.

[0144] The storage medium proposed in this embodiment and the abnormal operation behavior detection method proposed in the above embodiments for application in power network data security belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0145] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0146] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting abnormal operation behavior applied to power network data security, characterized in that: include, Collect multi-source heterogeneous data during the operation of the power network and process the data in segments according to a preset time window; A dynamic baseline model is constructed to characterize the normal behavior of the power system in different time periods, and the model parameters are periodically updated based on a distributed training method. Multi-source heterogeneous data is normalized, and a heterogeneous graph structure representing the relationship between device nodes and communication is constructed. The association features between devices are extracted through a graph neural network model. The current multi-source heterogeneous data is input into the dynamic baseline model, and the model output is combined with the set adaptive threshold judgment rules to determine whether the current operation behavior is abnormal. Based on the anomaly detection result, execute security defense response operations related to the current behavior.

2. The abnormal operation behavior detection method applied to power network data security as described in claim 1, characterized in that: The dynamic baseline model is a combined model that integrates recurrent neural networks and convolutional neural networks. The recurrent neural network is used to extract long-term temporal dependency features of the input data, while the convolutional neural network is used to extract local pattern information. The model is trained locally on multiple power nodes through a federated learning mechanism and the incremental model parameters are periodically uploaded to the central server, where the server performs parameter aggregation and global updates.

3. The abnormal operation behavior detection method applied to power network data security as described in claim 2, characterized in that: The construction of the heterogeneous graph structure includes, based on the collected multi-source operation data, modeling the communication relationships and attribute characteristics between each power equipment node into a weighted graph structure, wherein the attribute characteristics of the equipment node are composed of the flow characteristics, status characteristics and user operation characteristics corresponding to the node; The graph neural network is based on graph structure input and uses an adjacency node aggregation mechanism to iteratively update the embedded representation of each node, thereby extracting the operation path dependency features between devices.

4. The abnormal operation behavior detection method applied to power network data security as described in claim 3, characterized in that: The extraction of the correlation features between devices through the graph neural network model includes constructing a heterogeneous graph structure containing power equipment nodes and their communication relationships. Each node in the graph structure is additionally provided with its normalized flow features, state features, and operation features. The weights of each edge in the graph structure are set according to the frequency of communication between devices; By aggregating node adjacency information using a graph neural network incorporating an attention mechanism, the contextual relationship feature representation of each device node is output.

5. The abnormal operation behavior detection method applied to power network data security as described in claim 4, characterized in that: Determining whether the current operation is abnormal includes inputting the current multi-source heterogeneous data into a dynamic baseline model to obtain the prediction result; The difference between the current data and the prediction result is calculated to form a difference feature vector; The difference feature vector is used as the state input to a pre-trained deep reinforcement learning model, and the output is a judgment result on whether it is abnormal; The deep reinforcement learning model adopts a lightweight architecture. Its state space consists of differential feature vectors, its action space includes multiple safety response labels, and the reward function sets scoring rules based on the accuracy of abnormal behavior judgment.

6. The abnormal operation behavior detection method applied to power network data security as described in claim 5, characterized in that: The execution of security defense response operations related to the current behavior includes extracting contextual time-series data related to the abnormal behavior; Based on the device communication graph and operation path dependency relationship, an attack chain representation graph is constructed; Based on the attack chain representation graph, behavioral profile information is generated; Trigger corresponding response actions based on behavioral profile results; The attack chain representation graph uses device nodes as graph nodes and communication interaction relationships as graph edges. Virtual global nodes are introduced into the graph to model cross-domain dependencies.

7. The abnormal operation behavior detection method applied to power network data security as described in claim 6, characterized in that: The response operation includes matching a preset response strategy template based on the behavior profile result and generating a corresponding response instruction; The response command is executed via a smart contract, which is deployed on a blockchain network that supports cross-system synchronization. The response actions include isolating the abnormal device from communication, revoking user privileges, and triggering system audit and data backup processes.

8. An abnormal operation behavior detection system for power network data security, comprising the abnormal operation behavior detection method for power network data security as described in any one of claims 1 to 7, characterized in that, include: The multimodal data acquisition module is used to collect heterogeneous data during the operation of the power network, including network traffic, equipment status, and user operation information. A dynamic baseline engine is used to construct a dynamic behavioral baseline model based on the collected data and periodically update the model parameters in a distributed manner. The real-time detection core is used to receive the currently collected data and the dynamic baseline prediction results to determine whether the operation behavior is abnormal. The collaborative defense interface is used to perform cross-system security response operations based on anomaly detection results; Lateral isolation modules are used to achieve logical isolation and block unauthorized communication between power safety zones; The vertical authentication module is used to authenticate cross-system access requests and encrypt communication. The privacy enhancement module is used to anonymize sensitive information during data collection and storage. The visualization and alerting module is used to display anomaly detection results, attack chain analysis, and response operation information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the abnormal operation behavior detection method for power network data security as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal operation behavior detection method for power network data security as described in any one of claims 1 to 7.

Images