Power measurement terminal application behavior identification method and device based on variational encoder and Gaussian mixture model, and computer equipment

Abstract

The invention relates to the technical field of application program security management, and provides a power measurement terminal application program behavior identification method and device based on a variational encoder and a Gaussian mixture model, and computer equipment. The method comprises the following steps: judging a variational encoder model of a network and side channel characteristic data when an application program generates a target behavior according to a behavior category to obtain a potential variable; judging a Gaussian mixture model of the network according to the behavior category to obtain the probability that the potential variable belongs to each cluster; when the maximum probability value corresponding to the potential variable is greater than a preset probability threshold value, or the reconstruction error of the variational encoder model is smaller than a preset error threshold value, if the data volume of the cluster corresponding to the maximum probability value is maximum, determining the target behavior as a normal behavior; if the data volume is not maximum, determining the target behavior as a sensitive behavior; and if the maximum probability value is less than a preset probability threshold and the reconstruction error is greater than a preset error threshold, determining the target behavior as a malicious behavior. By adopting the method, the accuracy of behavior recognition is improved.

Description

Technical Field

[0001] This application relates to the field of application security management technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for identifying the behavior of an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model. Background Technology

[0002] With the rapid development of information technology, the prevalence of applications in various fields is constantly increasing. In the power system, the use of power measurement terminal applications is becoming increasingly widespread. To ensure the safety of residential electricity use, it is necessary to identify the behavior of power measurement terminal applications to determine whether they exhibit sensitive behaviors, and to take different countermeasures based on different sensitive behaviors to prevent damage to power grid infrastructure and disruption to power supply.

[0003] Traditional methods involve training a deep learning classification model using a residual encoder to identify and classify the behavior of power measurement terminal applications. However, these methods may involve tampering with the underlying system framework or using hook tools to monitor internal Application Programming Interface (API) calls, posing security risks and potentially negatively impacting the operation of the power measurement terminal application, leading to economic losses. Furthermore, traditional methods can only identify pre-defined sensitive behaviors—those corresponding to the training dataset—and struggle to identify sensitive or malicious behaviors not included in the training dataset, affecting the accuracy of the identification results. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for behavior recognition of an electric force measurement terminal application based on a variational encoder and a Gaussian mixture model to address the above-mentioned technical problems.

[0005] In a first aspect, this application provides a method for behavior recognition in an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model, including:

[0006] Based on the variational encoder model of the behavior category determination network, the side channel feature data of the electric force measurement terminal application when the target behavior occurs is reduced in dimensionality to obtain latent variables;

[0007] Based on the behavior category determination network's Gaussian mixture model, the probability that the latent variable belongs to each cluster in the Gaussian mixture model is obtained;

[0008] When the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest, then the target behavior of the power measurement terminal application is determined as normal behavior; the maximum probability value corresponding to the latent variable is the maximum value among the probabilities of the latent variable belonging to each cluster.

[0009] When the maximum probability value corresponding to the latent variable is greater than the preset probability threshold, or the reconstruction error of the variational encoder model is less than the preset error threshold, if the amount of clustering data corresponding to the maximum probability value of the latent variable is not the maximum, then the target behavior of the electric power measurement terminal application is determined as a sensitive behavior.

[0010] When the maximum probability value corresponding to the latent variable is less than a preset probability threshold, and the reconstruction error of the variational encoder model is greater than a preset error threshold, the target behavior of the power measurement terminal application is determined to be malicious behavior.

[0011] In one embodiment, before performing dimensionality reduction on the side-channel feature data of the electric power measurement terminal application when the target behavior occurs, based on the variational encoder model of the behavior category determination network, to obtain latent variables, the method further includes:

[0012] When the training is in the (k+1)th iteration, the unsupervised clustering model obtained after the kth iteration is obtained; the unsupervised clustering model obtained after the kth iteration includes the variational encoder sample model obtained after the kth iteration and the Gaussian mixture sample model obtained after the kth iteration.

[0013] Input the side channel feature data samples from the training dataset into the variational encoder sample model obtained after the kth iteration to obtain the latent variable samples of the (k+1)th iteration and the reconstruction error samples of the (k+1)th iteration.

[0014] The latent variable samples of the (k+1)th iteration are input into the Gaussian mixture sample model obtained after the kth iteration. According to the expectation-maximization algorithm, the probability of the side channel feature data sample belonging to each cluster sample is calculated, and the mean and variance of each cluster sample in the (k+1)th iteration are obtained.

[0015] The loss value for the (k+1)th iteration is obtained by summing the reconstruction error sample and the KL divergence sample of the (k+1)th iteration.

[0016] If the loss value of the (k+1)th iteration is greater than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than the preset change threshold, then the variational encoder sample model obtained after the k-th iteration is updated, and the Gaussian mixture sample model obtained after the k-th iteration is not updated, so as to obtain the unsupervised clustering model after the (k+1)th iteration.

[0017] If the loss value of the (k+1)th iteration is less than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is greater than the preset change threshold, then the variational encoder sample model obtained after the k-th iteration is not updated, and the Gaussian mixture sample model obtained after the k-th iteration is updated to obtain the unsupervised clustering model after the (k+1)th iteration.

[0018] If the loss value of the (k+1)th iteration is less than a preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than a preset change threshold, then the unsupervised clustering model obtained after the kth iteration will be used as the behavior category determination network.

[0019] In one embodiment, the step of inputting side-channel feature data samples from the training dataset into the variational encoder sample model obtained after the k-th iteration to obtain the latent variable samples of the (k+1)-th iteration and the reconstruction error samples of the (k+1)-th iteration includes:

[0020] The side-channel feature data samples from the training dataset are input into the variational encoder sample model obtained after the k-th iteration. The encoder of the variational encoder sample model obtained after the k-th iteration maps the side-channel feature data samples to the mean and variance of the latent space, and performs reparameterization to obtain the latent variable samples of the (k+1)-th iteration. The mean and variance of the latent space of the variational encoder sample model obtained after the k-th iteration come from the mean and variance of each cluster sample of the Gaussian mixture sample model obtained after the k-th iteration.

[0021] The decoder of the variational encoder sample model obtained after the k-th iteration restores the latent variable sample of the (k+1)-th iteration from the low dimension back to the original dimension, thus obtaining the reconstruction error sample of the (k+1)-th iteration.

[0022] In one embodiment, the method further includes:

[0023] Acquire side-channel characteristic data samples of the power measurement terminal application under sensitive behaviors;

[0024] Acquire side-channel characteristic data samples of the power measurement terminal application under normal behavior;

[0025] The training dataset is obtained based on the side-channel feature data samples of the power measurement terminal application under sensitive behavior and the side-channel feature data samples of the power measurement terminal application under normal behavior.

[0026] In one embodiment, after identifying the target behavior of the power measurement terminal application as a sensitive behavior, the method further includes:

[0027] If the time period during which the target behavior of the power measurement terminal application occurs is within the time period during which normal sensitive behavior occurs, and the number of times the target behavior of the power measurement terminal application occurs is less than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application is determined to be a normal sensitive behavior.

[0028] If the time period during which the target behavior of the power measurement terminal application occurs is not within the time period during which normal sensitive behavior occurs, or if the number of times the target behavior of the power measurement terminal application occurs is greater than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application is identified as an abnormal sensitive behavior.

[0029] In one embodiment, after determining that the target behavior of the power measurement terminal application is malicious, the method further includes:

[0030] Terminate the process of the power measurement terminal application.

[0031] Secondly, this application also provides a behavior recognition device for an electric force measurement terminal application based on a variational encoder and a Gaussian mixture model, comprising:

[0032] The latent variable acquisition module is used to determine the variational encoder model of the network based on the behavior category, and to reduce the dimensionality of the side channel feature data when the electric power measurement terminal application performs the target behavior to obtain latent variables.

[0033] The probability acquisition module is used to determine the Gaussian mixture model of the network based on the behavior category, and to obtain the probability that the latent variable belongs to each cluster in the Gaussian mixture model.

[0034] The normal behavior determination module is used to determine the target behavior of the power measurement terminal application as normal behavior when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest; the maximum probability value corresponding to the latent variable is the maximum value among the probabilities of the latent variable belonging to each cluster.

[0035] The sensitive behavior determination module is used to determine the target behavior of the electric power measurement terminal application as a sensitive behavior when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold.

[0036] The malicious behavior determination module is used to determine the target behavior of the power measurement terminal application as malicious behavior when the maximum probability value corresponding to the latent variable is less than a preset probability threshold and the reconstruction error of the variational encoder model is greater than a preset error threshold.

[0037] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the above-described method.

[0038] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, the computer program being executed by a processor using the methods described above.

[0039] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that is executed by a processor using the methods described above.

[0040] The aforementioned method, apparatus, computer equipment, computer-readable storage medium, and computer program product for behavior recognition in electric power measurement terminal applications based on variational encoders and Gaussian mixture models (GJMs) reduce the dimensionality of side-channel feature data when a target behavior occurs in the electric power measurement terminal application using the variational encoder model of the behavior category determination network to obtain latent variables; based on the Gaussian mixture model of the behavior category determination network, the probability of each latent variable belonging to each cluster in the Gaussian mixture model is obtained; when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest... If the probability value of a latent variable is greater than a preset probability threshold, or if the reconstruction error of the variational encoder model is less than a preset error threshold, and the data volume of the cluster corresponding to the maximum probability value of the latent variable is not the maximum, then the target behavior of the power measurement terminal application is determined to be a sensitive behavior; if the maximum probability value of a latent variable is less than a preset probability threshold, and the reconstruction error of the variational encoder model is greater than a preset error threshold, then the target behavior of the power measurement terminal application is determined to be a malicious behavior. This application uses a behavior category determination network composed of a variational autoencoder model and a Gaussian mixture model to identify the behavior of an electric power measurement terminal application. When the maximum probability value corresponding to a latent variable is less than a preset probability threshold, and the reconstruction error of the variational encoder model is greater than a preset error threshold, the target behavior of the electric power measurement terminal application is identified as malicious behavior. This does not involve tampering with the underlying system framework or using hooking tools to monitor the calls to the internal application programming interface. It does not affect the operation of the electric power measurement terminal application, and can detect sudden sensitive behaviors outside the training dataset, thereby improving the accuracy of the behavior recognition results of the electric power measurement terminal application. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is an application environment diagram of a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model in one embodiment.

[0043] Figure 2This is a flowchart illustrating a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model in one embodiment.

[0044] Figure 3 This is a schematic diagram of the structure of a variational encoder model in one embodiment;

[0045] Figure 4 This is a schematic diagram of the overall framework of a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model in one embodiment.

[0046] Figure 5 This is a flowchart illustrating a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model, as described in another embodiment.

[0047] Figure 6 This is a schematic diagram of the clustering results of a Gaussian mixture model in one embodiment;

[0048] Figure 7 This is a structural block diagram of an electric force measurement terminal application behavior recognition device based on a variational encoder and a Gaussian mixture model in one embodiment.

[0049] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0051] The behavior recognition method for electric power measurement terminal applications based on variational encoders and Gaussian mixture models provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on other network servers. Terminal 102 can determine the network based on behavior categories and identify the category of the target behavior of the power measurement terminal application. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. Server 104 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0052] In one exemplary embodiment, such as Figure 2As shown, a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model is provided, which is then applied to... Figure 1 Taking terminal 102 as an example, the explanation includes the following steps S201 to S205. Wherein:

[0053] Step S201: Based on the variational encoder model of the behavior category determination network, the side-channel feature data of the electric force measurement terminal application when the target behavior occurs is reduced in dimensionality to obtain latent variables.

[0054] Unsupervised clustering models, including Variational Autoencoder (VAE) models and Gaussian Mixture Model (GMM) models, can be trained to obtain a behavior category determination network. This network is used to identify the categories of behaviors in power measurement terminal applications (Apps). The power measurement terminal application refers to an application on a power device.

[0055] The structure of the variational encoder model is as follows: Figure 3 As shown, the algorithm consists of an encoder, a decoder, and latent variables. It is used to reduce the dimensionality of side-channel feature data to obtain latent variables, and then restore the data dimensionality using these latent variables. The Gaussian mixture model, formed by the superposition of multiple Gaussian distributions, is used for clustering the side-channel feature data.

[0056] When the power measurement terminal application behaves, its system resource calls exhibit a specific change pattern. This system resource call change information is selected as the source of side-channel data. In this application, the side-channel characteristic data may include the central processing unit (CPU) status, storage information, file-level free space information, and the amount of data transmitted and received.

[0057] Side-channel feature data can be collected at a frequency of 20Hz from the power measurement terminal application when target behaviors occur, according to the data acquisition program. Each collected side-channel feature data can undergo data preprocessing, including data cleaning, differential processing, and slicing. Based on the variational encoder model of the behavior category determination network, the dimensionality of the preprocessed side-channel feature data can be reduced to obtain latent variables.

[0058] Latent variables generally refer to hypotheses or inferences about some implicit variables in the data generation process after the data observation process. They represent the potential characteristics of the input data. In this application, latent variables are the low-dimensional representations of side-channel feature data.

[0059] Step S202: Determine the Gaussian mixture model of the network based on the behavior category, and obtain the probability that the latent variable belongs to each cluster in the Gaussian mixture model.

[0060] The Gaussian mixture model of the network can be determined based on the behavior category, and the Expectation Maximization Algorithm (EMA) can be used to obtain the probability that the latent variable belongs to each cluster in the Gaussian mixture model.

[0061] Step S203: When the maximum probability value corresponding to the latent variable is greater than the preset probability threshold, or the reconstruction error of the variational encoder model is less than the preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest, then the target behavior of the power measurement terminal application is determined as normal behavior; the maximum probability value corresponding to the latent variable is the maximum value among the probabilities of the latent variable belonging to each cluster.

[0062] The maximum probability among the probabilities of a latent variable belonging to each cluster can be taken as the maximum probability value of the latent variable.

[0063] You can set preset probability thresholds and preset error thresholds according to the actual situation.

[0064] When the maximum probability value corresponding to a latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, the target behavior characterizing the power measurement terminal application belongs to either normal behavior or sensitive behavior included in the training dataset. Sensitive behavior typically refers to operations involving user privacy, data security, or system security during the operation of the power measurement terminal application. These behaviors may pose potential risks to users' personal information, sensitive data, or the integrity of the system.

[0065] Since the amount of data corresponding to normal behavior is much larger than that corresponding to sensitive behavior in the training dataset, the cluster with the largest amount of data can be identified as the cluster to which normal behavior belongs. Therefore, if the cluster corresponding to the maximum probability value of a latent variable has the largest amount of data, then the cluster corresponding to the maximum probability value of that latent variable is the cluster to which normal behavior belongs. In this case, the target behavior of the power measurement terminal application can be identified as normal behavior.

[0066] Step S204: When the maximum probability value corresponding to the latent variable is greater than the preset probability threshold, or the reconstruction error of the variational encoder model is less than the preset error threshold, if the amount of clustering data corresponding to the maximum probability value of the latent variable is not the maximum, then the target behavior of the power measurement terminal application is determined as a sensitive behavior.

[0067] When the maximum probability value corresponding to the latent variable is greater than the preset probability threshold, or the reconstruction error of the variational encoder model is less than the preset error threshold, the target behavior of the electric power measurement terminal application is characterized as normal behavior or sensitive behavior included in the training dataset.

[0068] If the data volume of the cluster corresponding to the maximum probability value of the latent variable is not the maximum, it indicates that the cluster corresponding to the maximum probability value of the latent variable is not the cluster to which the normal behavior belongs. In this case, the target behavior of the power measurement terminal application can be identified as a sensitive behavior.

[0069] Step S205: When the maximum probability value corresponding to the latent variable is less than the preset probability threshold and the reconstruction error of the variational encoder model is greater than the preset error threshold, the target behavior of the power measurement terminal application is determined to be malicious behavior.

[0070] When the maximum probability value corresponding to the latent variable is less than the preset probability threshold, and the reconstruction error of the variational encoder model is greater than the preset error threshold, the probability that the target behavior of the electric power measurement terminal application belongs to the normal or sensitive behavior included in the training dataset is very small, and the internal structure of the side channel feature data when the electric power measurement terminal application performs the target behavior is significantly different from that of the side channel feature data samples in the training dataset. In this case, the target behavior of the electric power measurement terminal application can be identified as malicious behavior.

[0071] In the above-mentioned method for recognizing the behavior of an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model, the behavior of the electric power measurement terminal application is identified by a behavior category determination network composed of a variational autoencoder model and a Gaussian mixture model. When the maximum probability value corresponding to the latent variable is less than a preset probability threshold, and the reconstruction error of the variational encoder model is greater than a preset error threshold, the target behavior of the electric power measurement terminal application is identified as malicious behavior. This method does not involve tampering with the underlying framework of the system or using hooking tools to monitor the calling of the internal application programming interface. It does not affect the operation of the electric power measurement terminal application, and can detect sudden sensitive behaviors outside the training dataset, thereby improving the accuracy of the behavior recognition results of the electric power measurement terminal application.

[0072] In one embodiment, before the variational encoder model of the behavior category determination network performs dimensionality reduction on the side-channel feature data of the power measurement terminal application when the target behavior occurs to obtain latent variables, the method provided in this application further includes: when the current training performs the (k+1)th iteration, obtaining the unsupervised clustering model obtained after the k-th iteration; the unsupervised clustering model obtained after the k-th iteration includes the variational encoder sample model obtained after the k-th iteration and the Gaussian mixture sample model obtained after the k-th iteration; inputting the side-channel feature data samples in the training dataset into the variational encoder sample model obtained after the k-th iteration to obtain the latent variable samples of the (k+1)th iteration and the reconstruction error samples of the (k+1)th iteration; inputting the latent variable samples of the (k+1)th iteration into the Gaussian mixture sample model obtained after the k-th iteration, calculating the probability that the side-channel feature data samples belong to each cluster sample according to the expectation-maximization algorithm, and obtaining the mean and variance of each cluster sample in the (k+1)th iteration; based on the reconstruction error samples of the (k+1)th iteration... The sum of the KL divergence samples from the k+1th iteration is used to obtain the loss value for the k+1th iteration. If the loss value for the k+1th iteration is greater than a preset loss threshold and the change in the mean and variance of each cluster sample in the k+1th iteration is less than a preset change threshold, then the variational encoder sample model obtained after the k-th iteration is updated, but the Gaussian mixture sample model obtained after the k-th iteration is not updated, to obtain the unsupervised clustering model after the k+1th iteration. If the loss value for the k+1th iteration is less than a preset loss threshold and the change in the mean and variance of each cluster sample in the k+1th iteration is greater than a preset change threshold, then the variational encoder sample model obtained after the k-th iteration is not updated, but the Gaussian mixture sample model obtained after the k-th iteration is updated, to obtain the unsupervised clustering model after the k+1th iteration. If the loss value for the k+1th iteration is less than a preset loss threshold and the change in the mean and variance of each cluster sample in the k+1th iteration is less than a preset change threshold, then the unsupervised clustering model obtained after the k-th iteration is used as the behavior category determination network.

[0073] When the training is in the (k+1)th iteration, the unsupervised clustering model obtained after the kth iteration is obtained; the unsupervised clustering model obtained after the kth iteration includes the variational encoder sample model obtained after the kth iteration and the Gaussian mixture sample model obtained after the kth iteration.

[0074] The side-channel feature data samples from the training dataset can be input into the variational encoder sample model obtained after the k-th iteration to obtain the latent variable samples of the (k+1)-th iteration and the reconstruction error samples of the (k+1)-th iteration.

[0075] The latent variable samples from the (k+1)th iteration can be input into the Gaussian mixture model obtained after the kth iteration. Using the expectation-maximization algorithm, the probability that a side-channel feature data sample belongs to each cluster is calculated, yielding the mean and variance of each cluster in the (k+1)th iteration. The loss value for the (k+1)th iteration can be obtained by summing the reconstruction error samples and the KL divergence samples from the (k+1)th iteration.

[0076] If the loss value of the (k+1)th iteration is greater than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than the preset change threshold, then the variational encoder sample model obtained after the k-th iteration is updated, but the Gaussian mixture sample model obtained after the k-th iteration is not updated, to obtain the unsupervised clustering model after the (k+1)th iteration; if the loss value of the (k+1)th iteration is less than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is greater than the preset change threshold, then the variational encoder sample model obtained after the k-th iteration is not updated, but the Gaussian mixture sample model obtained after the k-th iteration is updated, to obtain the unsupervised clustering model after the (k+1)th iteration; if the loss value of the (k+1)th iteration is less than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than the preset change threshold, then the unsupervised clustering model obtained after the k-th iteration is used as the behavior category determination network.

[0077] The above iterative process can be referred to as the mutual learning process between the variational encoder sample model and the Gaussian mixture sample model.

[0078] The principle of parameter update for the variational encoder sample model is as follows:

[0079] First, the probability distribution of the side-channel feature data sample x is shown in formula (1):

[0080] (1)

[0081] (2)

[0082] Equation (1) can be transformed into Equation (2). Here, P(x) represents the probability distribution of the side-channel feature data sample x, and P(z) represents the probability distribution of the latent variable sample z. This can be understood as an encoder, that is, the mapping relationship between the input side-channel feature data sample x and the latent variable sample z. However, It is not a real mapping relationship, but a mapping that is artificially assumed. This is the true mapping relationship. (Introduced here) The reason is Difficult to solve. Because of the use of... Approximation Therefore, it is desirable to minimize the KL divergence (which describes the difference between the two distributions), i.e. As small as possible. Because... It's just a hypothetical encoder mapping, so The value and It's irrelevant, so it needs to be achieved. Make it as small as possible As large as possible. The transformation is shown in formula (3).

[0083] (3)

[0084] Therefore, maximize Meaning minimize and maximizing .in They generally follow a standard normal distribution. It follows a Gaussian distribution, and the mean and variance of the distribution are derived from the mean and variance of each cluster sample in the Gaussian mixture sample model. This describes the similarity between the input side-channel feature data samples and the reconstructed data; maximizing this similarity implies minimizing the reconstruction error. Therefore, the loss value (loss function) of the variational encoder sample model is the sum of the reconstruction error and the similarity between the input side-channel feature data samples and the reconstructed data. The sum of (KL divergences). Backpropagation can be performed based on the loss value to update the parameters of the variational encoder sample model.

[0085] In this embodiment, after multiple iterations of training, when the loss value of the (k+1)th iteration is less than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than the preset change threshold, the unsupervised clustering model obtained after the kth iteration is used as the behavior category determination network, and a behavior category determination network with better performance can be obtained.

[0086] In one embodiment, side-channel feature data samples from the training dataset are input into the variational encoder sample model obtained after the k-th iteration to obtain the latent variable samples and reconstruction error samples of the (k+1)-th iteration. The specific steps are as follows: The side-channel feature data samples from the training dataset are input into the variational encoder sample model obtained after the k-th iteration. The encoder of the variational encoder sample model obtained after the k-th iteration maps the side-channel feature data samples to the mean and variance of the latent space and performs reparameterization to obtain the latent variable samples of the (k+1)-th iteration. The mean and variance of the latent space of the variational encoder sample model obtained after the k-th iteration are derived from the mean and variance of each cluster sample of the Gaussian mixture sample model obtained after the k-th iteration. The decoder of the variational encoder sample model obtained after the k-th iteration restores the latent variable samples of the (k+1)-th iteration from the low dimension back to the original dimension to obtain the reconstruction error samples of the (k+1)-th iteration.

[0087] The mean and variance of the latent space of the variational encoder sample model obtained after the k-th iteration are derived from the mean and variance of each cluster sample of the Gaussian mixture sample model obtained after the k-th iteration. Specifically, the mean and variance of each cluster sample output by the Gaussian mixture sample model can be sent to the variational encoder sample model as the distribution of the latent space of the variational encoder sample model, i.e. The latent space is a low-dimensional space representing the data, which captures the intrinsic structure and features of the original side-channel feature data samples. Similar side-channel feature data samples are located closer together in the space.

[0088] The side-channel feature data samples in the training dataset can be input into the variational encoder sample model obtained after the k-th iteration. Through the encoder of the variational encoder sample model obtained after the k-th iteration, the side-channel feature data samples are mapped to the mean and variance of the latent space and reparameterized to obtain the latent variable samples of the (k+1)-th iteration, which are beneficial to the updating of model parameters.

[0089] The latent variable samples of the k+1th iteration can be restored from the low dimension to the original dimension using the decoder of the variational encoder sample model obtained after the k-th iteration. Based on the difference between the latent variable samples of the k+1th iteration after restoration to the original dimension and the side channel feature data samples, the reconstruction error samples of the k+1th iteration are obtained.

[0090] In this embodiment, the encoder of the variational encoder sample model obtained after the kth iteration is used to obtain the latent variable sample of the k+1th iteration; the decoder of the variational encoder sample model obtained after the kth iteration is used to obtain the reconstruction error sample of the k+1th iteration, so as to train the model.

[0091] In one embodiment, the method provided by this application further includes: acquiring side-channel feature data samples of the power measurement terminal application under sensitive behavior; acquiring side-channel feature data samples of the power measurement terminal application under normal behavior; and obtaining a training dataset based on the side-channel feature data samples of the power measurement terminal application under sensitive behavior and the side-channel feature data samples of the power measurement terminal application under normal behavior.

[0092] The data acquisition program can collect side-channel characteristic data samples of the power measurement terminal application under sensitive behaviors. These sensitive behaviors can include local communication behaviors, meter reading behaviors, and uplink communication behaviors.

[0093] According to the data acquisition program, side-channel characteristic data samples of the power measurement terminal application under normal behavior (also known as non-sensitive behavior) can be collected.

[0094] A training dataset can be obtained based on the side-channel feature data samples of the power measurement terminal application under sensitive behaviors and the side-channel feature data samples of the power measurement terminal application under normal behaviors. This training dataset contains side-channel feature data samples corresponding to three sensitive behaviors and one normal behavior.

[0095] In this embodiment, a training dataset is obtained based on the side-channel feature data samples of the power measurement terminal application under sensitive behavior and the side-channel feature data samples of the power measurement terminal application under normal behavior, so as to prepare data for the training of the behavior category determination network.

[0096] In one embodiment, after identifying the target behavior of the power measurement terminal application as a sensitive behavior, the method provided in this application further includes: if the time period during which the target behavior of the power measurement terminal application occurs is within the time period during which normal sensitive behavior occurs, and the number of times the target behavior of the power measurement terminal application occurs is less than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application is identified as a normal sensitive behavior; if the time period during which the target behavior of the power measurement terminal application occurs is not within the time period during which normal sensitive behavior occurs, or the number of times the target behavior of the power measurement terminal application occurs is greater than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application is identified as an abnormal sensitive behavior.

[0097] Once the target behavior of the power measurement terminal application is identified as a sensitive behavior, it is necessary to further determine whether the sensitive behavior is an abnormally sensitive behavior.

[0098] If the time period during which the target behavior of the power measurement terminal application occurs is within the time period during which normal sensitive behavior occurs, and the number of times the target behavior of the power measurement terminal application occurs is less than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application can be determined to conform to the specification, and the target behavior of the power measurement terminal application is determined to be normal sensitive behavior.

[0099] If the time period during which the target behavior of the power measurement terminal application occurs is outside the time period during which normal sensitive behavior occurs, or if the number of times the target behavior of the power measurement terminal application occurs is greater than the number of times normal sensitive behavior occurs, it can be determined that the target behavior of the power measurement terminal application does not conform to the specification. In this case, the target behavior of the power measurement terminal application is identified as an abnormal sensitive behavior, triggering an alarm and generating an event report related to this abnormal sensitive behavior. The report may include information such as the time when the abnormal sensitive behavior occurred, the system memory changes when the abnormal sensitive behavior occurred, and the central processing unit status, so that relevant personnel can view the occurrence and take action.

[0100] In this embodiment, based on whether the time period of the target behavior of the power measurement terminal application is within the time period of normal sensitive behavior, and the relationship between the number of times the target behavior of the power measurement terminal application occurs and the number of times normal sensitive behavior occurs, it is further determined whether the target behavior of the power measurement terminal application is an abnormal sensitive behavior, which can improve the accuracy of the behavior recognition results of the power measurement terminal application.

[0101] In one embodiment, after the target behavior of the power measurement terminal application is determined to be malicious, the method provided in this application further includes terminating the process of the power measurement terminal application.

[0102] Once the target behavior of the power measurement terminal application is determined to be malicious, the application process can be terminated to prevent damage to the power grid infrastructure and disruption of power supply.

[0103] To better understand the above method, the following describes in detail an application example of the behavior recognition method for an electric power measurement terminal application based on variational encoder and Gaussian mixture model.

[0104] With the rapid development of information technology, applications are becoming increasingly prevalent across various fields, especially on mobile devices and in cloud computing environments, where users are increasingly reliant on them. However, this also brings with it growing concerns about data security and privacy. Many applications generate sensitive behaviors closely related to security, but this does not necessarily mean that such behaviors are malicious. Normal application operations may also involve sensitive actions; for example, map navigation applications may need to access the device's location information. However, malicious behavior is generally composed of sensitive actions, making the detection of these sensitive behaviors in applications of paramount importance.

[0105] In practical engineering systems, sensitive behaviors of applications require even greater attention, as a single malicious action by an application can cause unimaginable economic losses. In power systems, the application of power measurement terminals (also known as smart measurement terminals) is becoming increasingly widespread. To ensure the safety of residential electricity use, it is necessary to monitor in real time whether the power measurement terminal applications on these terminals exhibit sensitive behaviors, and to take different countermeasures based on different types of sensitive behaviors (normal and abnormal) to prevent damage to the power grid infrastructure and disruption to power supply.

[0106] Traditional methods involve training a deep learning classification model using a residual encoder to identify and classify the behavior of an electrical force measurement terminal application. However, these methods suffer from two major drawbacks:

[0107] (1) It involves tampering with the underlying framework of the system or using hook tools to monitor the calling of the internal application programming interface, which poses certain security risks and may have a negative impact on the operation of the power measurement terminal application, causing economic losses.

[0108] (2) It can only identify known sensitive behaviors, that is, sensitive behaviors corresponding to the training dataset of the model. Although the identification accuracy of sensitive behaviors of power measurement terminal applications based on supervised learning is relatively high, it is limited to identifying known sensitive behaviors, that is, various sensitive behaviors that exist in the training dataset. As the number of application software increases, the types of sensitive behaviors and even malicious behaviors also increase. For sensitive / malicious behaviors not included in the training dataset, the identification effect of the supervised learning classification model is not ideal.

[0109] To address the aforementioned issues, this embodiment proposes a dynamic identification method for power measurement terminals in power systems. This method detects sudden sensitive behaviors outside the training dataset without affecting the operation of the terminal's application. The key to this method is an unsupervised clustering model composed of a Variational Autoencoder (VAE) model and a Gaussian Mixture Model (GMM). Input data is used to train the unsupervised clustering model. The trained model is then used to detect abnormal sensitive behaviors in the power measurement terminal application in real time. Further judgment of sensitive behaviors is made based on actual specifications, effectively ensuring the normal operation of power equipment and guaranteeing the safe supply of power.

[0110] The technical solution provided in this embodiment, namely the behavior recognition method for electric power measurement terminal applications based on variational encoders and Gaussian mixture models, has the following overall framework: Figure 4 As shown, its core is an unsupervised clustering model composed of a Variational Autoencoder (VAE) model and a Gaussian Mixture Model (GMM), which can be called a VAE+GMM unsupervised clustering model. For power system power measurement terminals, when various power measurement terminal applications exhibit sensitive behaviors, it is often accompanied by changes in system resource calls. A data acquisition program can be developed based on the actual power system power measurement terminals. This program is used to collect system-wide side-channel characteristic data when the power measurement terminal applications exhibit various behaviors.

[0111] Figure 4The method for behavior recognition in an electric power measurement terminal application based on variational encoders and Gaussian mixture models is mainly divided into a model training part and a real-time monitoring part. In the model training part, the VAE+GMM unsupervised clustering model is trained using training data. This training data is obtained by collecting side-channel feature data from the electric power measurement terminal application (App) using a self-developed data acquisition program at a frequency of 20Hz, i.e., collecting side-channel feature data every 50ms. The collected side-channel feature data is then preprocessed, including data cleaning, differencing, and slicing, to obtain the training dataset. In the real-time monitoring part, the data acquisition program collects side-channel feature data from the electric power measurement terminal application at a frequency of 20Hz. Each collected side-channel feature data is also preprocessed, including data cleaning, differencing, and slicing. The preprocessed side-channel feature data is then fed into the behavior category determination network, which calls the pre-trained VAE+GMM unsupervised clustering model. The preprocessed side-channel feature data is fed into a VAE to obtain latent variables. These latent variables are then fed into a GMM (Geometry Model), where the probability of data belonging to each behavior category (one of the four clusters used in model training) is calculated. Based on the probability of belonging to a behavior category, a sensitive behavior determination is performed to identify whether the corresponding power measurement terminal application behavior is abnormally sensitive. Finally, based on the behavior type of the power measurement terminal application, the terminal device responds, including issuing an alarm, terminating the application process, and generating an event report.

[0112] The process of the behavior recognition method for electric power measurement terminal application based on variational encoder and Gaussian mixture model is as follows: Figure 5 As shown, the corresponding detailed steps are as follows:

[0113] Step 1: Prepare model training data to obtain the training dataset. Side-channel characteristic data of the power measurement terminal application under three sensitive behaviors (local communication, meter reading, and uplink communication) and side-channel characteristic data under no sensitive behaviors (denoted as normal behavior) can be collected as model training data, i.e., as the training dataset. The training dataset contains only the side-channel characteristic data corresponding to the three sensitive behaviors and one normal behavior.

[0114] Step 2: Train the behavior category determination network. The behavior category determination network mainly consists of a Variational Autoencoder (VAE) model and a Gaussian Mixture Model (GMM). The structure of the Variational Autoencoder model is as follows: Figure 3As shown, the encoder, decoder, and latent variables are used to reduce the dimensionality of the side-channel feature data to obtain latent variables and then restore the data dimensionality using the latent variables. The Gaussian mixture model, formed by the superposition of multiple Gaussian distributions, is used to cluster the side-channel feature data.

[0115] A behavior category determination network can be obtained by training a model using variational encoder sample models, Gaussian mixture model sample models, and a training dataset. The key to achieving unsupervised clustering during model training is the mutual learning process between the variational encoder sample models and the Gaussian mixture model sample models. This mutual learning process is as follows:

[0116] The input side-channel feature data samples are first fed into the variational encoder sample model. The variational encoder sample model maps each side-channel feature data sample to two parameters in the latent space: the mean and variance. Then, reparameterization is performed to obtain latent variable samples z that are beneficial for model parameter updates. Finally, the decoder restores the latent variable samples z from the low-dimensional model to the original dimension, and the variational encoder sample model sends the latent variable samples z into the Gaussian mixture sample model. The principle of parameter updates in the variational encoder sample model is as follows:

[0117] First, the probability distribution of the side-channel feature data sample x is shown in formula (1):

[0118] (1)

[0119] (2)

[0120] Equation (1) can be transformed into Equation (2). Here, P(x) represents the probability distribution of the side-channel feature data sample x, and P(z) represents the probability distribution of the latent variable sample z. This can be understood as an encoder, that is, the mapping relationship between the input side-channel feature data sample x and the latent variable sample z. However, It is not a real mapping relationship, but a mapping that is artificially assumed. This is the true mapping relationship. (Introduced here) The reason is Difficult to solve. Because of the use of... Approximation Therefore, it is desirable to minimize the KL divergence (which describes the difference between the two distributions), i.e. As small as possible. Because... It's just a hypothetical encoder mapping, so The value and It's irrelevant, so it needs to be achieved. Make it as small as possible As large as possible. The transformation is shown in formula (3).

[0121] (3)

[0122] Therefore, maximize Meaning minimize and maximizing .in They generally follow a standard normal distribution. It follows a Gaussian distribution, and the mean and variance of the distribution are derived from the mean and variance of each cluster sample in the Gaussian mixture sample model. This describes the similarity between the input side-channel feature data samples and the reconstructed data; maximizing this similarity implies minimizing the reconstruction error. Therefore, the loss value (loss function) of the variational encoder sample model is the sum of the reconstruction error and the similarity between the input side-channel feature data samples and the reconstructed data. The sum of (KL divergences). Backpropagation can be performed based on the loss value to update the parameters of the variational encoder sample model.

[0123] After receiving the latent variable samples z from the variational encoder sample model, the Gaussian mixture sample model (GaMJM) uses the Expectation Maximization Algorithm (EMA) to infer the mean and variance of each cluster. First, the E algorithm is used to calculate the probability that each side-channel feature data sample belongs to each cluster. Then, the M algorithm is performed, updating the parameters of the GaMJM based on the probabilities calculated in the E algorithm, including the mean and variance of each cluster. Finally, the mean and variance of each cluster estimated by the GaMJM are sent to the variational encoder sample model as the distribution of the latent space of the variational encoder sample model. .

[0124] Step 3: Real-time Monitoring. During real-time monitoring of the power measurement terminal application's behavior, a data acquisition program is used to collect side-channel characteristic data at 20Hz when the application performs actions. Each collected side-channel characteristic data point is preprocessed, including data cleaning, differential processing, and slicing, before being fed into the behavior category determination network.

[0125] Step 4: Determine the behavior of the power measurement terminal application. Each side-channel feature data is fed into the variational encoder model of the behavior category determination network and mapped to a latent variable. Then, for each cluster in the Gaussian mixture model of the behavior category determination network, the probability of the latent variable under that cluster is calculated, and finally the latent variable is assigned to the cluster with the highest probability.

[0126] To determine whether the behavior of the power measurement terminal application belongs to the four types of behavior mentioned in step 1 (denoted as malicious behavior), it can be judged from two perspectives: (1) the maximum probability value corresponding to the latent variable is less than the preset probability threshold; (2) the reconstruction error of the variational encoder model is greater than the preset error threshold. (1) This indicates that the probability of the side channel feature data belonging to the four types of behavior is very small, and (2) This indicates that the internal structure of the side channel feature data and the side channel feature data samples in the training dataset is significantly different. If both conditions are met, the behavior of the power measurement terminal application can be reasonably judged as malicious behavior. If the behavior of the power measurement terminal application is malicious, the process of the power measurement terminal application is terminated, and step 7 is skipped; if the behavior of the power measurement terminal application is not malicious, it indicates that the behavior of the power measurement terminal application belongs to the four types of behavior mentioned in step 1, and at this time, it can be further judged whether the behavior of the power measurement terminal application is normal behavior.

[0127] Since the amount of data corresponding to normal behavior in the training dataset is much larger than that corresponding to the other three sensitive behaviors, the cluster with the largest amount of data can be found based on the model training results and designated as the cluster to which normal behavior belongs. Then, in real-time monitoring, the category determined by the input side-channel feature data is compared with the category to which normal behavior belongs to determine whether the behavior of the power measurement terminal application is normal. If it is normal behavior, no special processing is performed, and the process returns to step 3 to continue monitoring; otherwise, the process jumps to step 5.

[0128] Figure 6 The data was generated from four known Gaussian distributions. The data order was shuffled, meaning the distribution of each data point was unknown. A Gaussian mixture model (GaJM) was then used for clustering. The left image shows the original data distribution; the middle image shows the data distribution before shuffling, with different color shades representing different Gaussian distributions (at this point, the distribution of the data was known); the right image shows the clustering results from the Gaussian mixture model after shuffling the data, when the distribution of the data was unknown. Based on the amount of data in each cluster, the cluster category of normal behavior can be determined. Then, category comparisons can be performed to determine whether the corresponding behavior is normal.

[0129] Step 5: Determine if the sensitive behavior is abnormal. If the sensitive behavior conforms to the protocol, it is determined to be a normal sensitive behavior, and no special handling is required. Return to Step 3 to continue monitoring. Otherwise, determine that the behavior of the power measurement terminal application is abnormal sensitive behavior, trigger an alarm, and jump to Step 6. The aforementioned protocol refers to the time when normal sensitive behaviors occur in the intelligent measurement equipment of the power system and the number of times sensitive behaviors occur within that time.

[0130] Step 6: Generate an event report. If the power measurement terminal application's behavior is determined to be abnormally sensitive, an event report is generated containing information about this abnormally sensitive behavior. The report includes the time the abnormally sensitive behavior occurred, system memory changes at the time of the abnormally sensitive behavior, and the CPU status, etc., for relevant personnel to review and take appropriate action. Then, based on actual needs, decide whether to continue monitoring the power measurement terminal application's behavior. If yes, return to Step 3 to continue monitoring the power measurement terminal application's behavior; otherwise, proceed to Step 7.

[0131] Step 7: End. Terminate the real-time monitoring of the power measurement terminal application and terminate all the above operations.

[0132] In summary, the technical solution provided in this embodiment identifies the behavior of an electric power measurement terminal application based on a behavior category determination network composed of a variational autoencoder model and a Gaussian mixture model. When the maximum probability value corresponding to a latent variable is less than a preset probability threshold, and the reconstruction error of the variational encoder model is greater than a preset error threshold, the target behavior of the electric power measurement terminal application is identified as malicious behavior. This does not involve tampering with the underlying system framework or using hooking tools to monitor the calls to the internal application programming interface. It does not affect the operation of the electric power measurement terminal application and can identify malicious behavior outside the training dataset, thus broadening the range of identifiable behaviors and improving the accuracy of the behavior identification results of the electric power measurement terminal application.

[0133] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0134] Based on the same inventive concept, this application also provides a device for implementing the above-described method for recognizing the behavior of a power measurement terminal application based on a variational encoder and a Gaussian mixture model. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations of one or more embodiments of the device for recognizing the behavior of a power measurement terminal application based on a variational encoder and a Gaussian mixture model provided below can be found in the limitations of the method for recognizing the behavior of a power measurement terminal application based on a variational encoder and a Gaussian mixture model described above, and will not be repeated here.

[0135] In one exemplary embodiment, such as Figure 7 As shown, a behavior recognition device for an electric force measurement terminal application based on a variational encoder and a Gaussian mixture model is provided, wherein:

[0136] The latent variable acquisition module 701 is used to determine the variational encoder model of the network according to the behavior category, and to reduce the dimensionality of the side channel feature data when the electric power measurement terminal application performs the target behavior to obtain latent variables.

[0137] The probability acquisition module 702 is used to determine the Gaussian mixture model of the network based on the behavior category, and obtain the probability that the latent variable belongs to each cluster in the Gaussian mixture model.

[0138] The normal behavior determination module 703 is used to determine the target behavior of the power measurement terminal application as normal behavior when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest; the maximum probability value corresponding to the latent variable is the maximum value among the probabilities of the latent variable belonging to each cluster.

[0139] The sensitive behavior determination module 704 is used to determine the target behavior of the power measurement terminal application as a sensitive behavior when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold.

[0140] The malicious behavior determination module 705 is used to determine the target behavior of the power measurement terminal application as malicious behavior when the maximum probability value corresponding to the latent variable is less than a preset probability threshold and the reconstruction error of the variational encoder model is greater than a preset error threshold.

[0141] In one embodiment, the apparatus further includes a model training module, configured to: when the current training is performing the (k+1)th iteration, obtain an unsupervised clustering model obtained after the k-th iteration; the unsupervised clustering model obtained after the k-th iteration includes a variational encoder sample model obtained after the k-th iteration and a Gaussian mixture sample model obtained after the k-th iteration; input side-channel feature data samples from the training dataset into the variational encoder sample model obtained after the k-th iteration to obtain latent variable samples and reconstruction error samples for the (k+1)th iteration; input the latent variable samples for the (k+1)th iteration into the Gaussian mixture sample model obtained after the k-th iteration, calculate the probability that the side-channel feature data samples belong to each cluster sample according to the expectation-maximization algorithm, and obtain the mean and variance of each cluster sample for the (k+1)th iteration; and obtain the loss of the (k+1)th iteration based on the sum of the reconstruction error samples and the KL divergence samples for the (k+1)th iteration. If the loss value of the (k+1)th iteration is greater than a preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than a preset change threshold, then the variational encoder sample model obtained after the k-th iteration is updated, and the Gaussian mixture sample model obtained after the k-th iteration is not updated, to obtain the unsupervised clustering model after the (k+1)th iteration; if the loss value of the (k+1)th iteration is less than a preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is greater than a preset change threshold, then the variational encoder sample model obtained after the k-th iteration is not updated, and the Gaussian mixture sample model obtained after the k-th iteration is updated, to obtain the unsupervised clustering model after the (k+1)th iteration; if the loss value of the (k+1)th iteration is less than a preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than a preset change threshold, then the unsupervised clustering model obtained after the k-th iteration is used as the behavior category determination network.

[0142] In one embodiment, the model training module is further configured to: input side-channel feature data samples from the training dataset into the variational encoder sample model obtained after the k-th iteration; map the side-channel feature data samples to the mean and variance of the latent space through the encoder of the variational encoder sample model obtained after the k-th iteration, and perform reparameterization to obtain the latent variable samples of the (k+1)-th iteration; the mean and variance of the latent space of the variational encoder sample model obtained after the k-th iteration are derived from the mean and variance of each cluster sample of the Gaussian mixture sample model obtained after the k-th iteration; and restore the latent variable samples of the (k+1)-th iteration from the low dimension to the original dimension through the decoder of the variational encoder sample model obtained after the k-th iteration to obtain the reconstruction error samples of the (k+1)-th iteration.

[0143] In one embodiment, the apparatus further includes a training dataset acquisition module, configured to: acquire side-channel feature data samples of the power measurement terminal application under sensitive behavior; acquire side-channel feature data samples of the power measurement terminal application under normal behavior; and obtain a training dataset based on the side-channel feature data samples of the power measurement terminal application under sensitive behavior and the side-channel feature data samples of the power measurement terminal application under normal behavior.

[0144] In one embodiment, the device further includes a sensitive behavior classification module, configured to: determine the target behavior of the power measurement terminal application as a normal sensitive behavior if the time period during which the target behavior occurs is within the time period during which normal sensitive behavior occurs, and the number of times the target behavior occurs is less than the number of times normal sensitive behavior occurs; and determine the target behavior of the power measurement terminal application as an abnormal sensitive behavior if the time period during which the target behavior occurs is not within the time period during which normal sensitive behavior occurs, or the number of times the target behavior occurs is greater than the number of times normal sensitive behavior occurs.

[0145] In one embodiment, the apparatus further includes a process termination module for terminating the process of the power measurement terminal application.

[0146] The modules in the above-mentioned behavior recognition device for electric force measurement terminal application based on variational encoders and Gaussian mixture models can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0147] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores data from embodiments of a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a behavior recognition method for an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model.

[0148] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0149] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0150] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0151] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0152] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0153] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0154] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0155] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for behavior recognition in an electric power measurement terminal application based on a variational encoder and a Gaussian mixture model, characterized in that, The method includes: Based on the variational encoder model of the behavior category determination network, the side channel feature data of the electric force measurement terminal application when the target behavior occurs is reduced in dimensionality to obtain latent variables; Based on the behavior category determination network's Gaussian mixture model, the probability that the latent variable belongs to each cluster in the Gaussian mixture model is obtained; When the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest, then the target behavior of the power measurement terminal application is determined as normal behavior; the maximum probability value corresponding to the latent variable is the maximum value among the probabilities of the latent variable belonging to each cluster. When the maximum probability value corresponding to the latent variable is greater than the preset probability threshold, or the reconstruction error of the variational encoder model is less than the preset error threshold, if the amount of clustering data corresponding to the maximum probability value of the latent variable is not the maximum, then the target behavior of the electric power measurement terminal application is determined as a sensitive behavior. When the maximum probability value corresponding to the latent variable is less than a preset probability threshold, and the reconstruction error of the variational encoder model is greater than a preset error threshold, the target behavior of the power measurement terminal application is determined to be malicious behavior.

2. The method according to claim 1, characterized in that, Before reducing the dimensionality of the side-channel feature data of the electric power measurement terminal application when the target behavior occurs, and obtaining the latent variables, the method further includes: When the training is in the (k+1)th iteration, the unsupervised clustering model obtained after the kth iteration is obtained; the unsupervised clustering model obtained after the kth iteration includes the variational encoder sample model obtained after the kth iteration and the Gaussian mixture sample model obtained after the kth iteration. Input the side channel feature data samples from the training dataset into the variational encoder sample model obtained after the kth iteration to obtain the latent variable samples of the (k+1)th iteration and the reconstruction error samples of the (k+1)th iteration. The latent variable samples of the (k+1)th iteration are input into the Gaussian mixture sample model obtained after the kth iteration. According to the expectation-maximization algorithm, the probability of the side channel feature data sample belonging to each cluster sample is calculated, and the mean and variance of each cluster sample in the (k+1)th iteration are obtained. The loss value for the (k+1)th iteration is obtained by summing the reconstruction error sample and the KL divergence sample of the (k+1)th iteration. If the loss value of the (k+1)th iteration is greater than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than the preset change threshold, then the variational encoder sample model obtained after the k-th iteration is updated, and the Gaussian mixture sample model obtained after the k-th iteration is not updated, so as to obtain the unsupervised clustering model after the (k+1)th iteration. If the loss value of the (k+1)th iteration is less than the preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is greater than the preset change threshold, then the variational encoder sample model obtained after the k-th iteration is not updated, and the Gaussian mixture sample model obtained after the k-th iteration is updated to obtain the unsupervised clustering model after the (k+1)th iteration. If the loss value of the (k+1)th iteration is less than a preset loss threshold and the change in the mean and variance of each cluster sample in the (k+1)th iteration is less than a preset change threshold, then the unsupervised clustering model obtained after the kth iteration will be used as the behavior category determination network.

3. The method according to claim 2, characterized in that, The step of inputting side-channel feature data samples from the training dataset into the variational encoder sample model obtained after the k-th iteration yields latent variable samples for the (k+1)-th iteration and reconstruction error samples for the (k+1)-th iteration, including: The side-channel feature data samples from the training dataset are input into the variational encoder sample model obtained after the k-th iteration. The encoder of the variational encoder sample model obtained after the k-th iteration maps the side-channel feature data samples to the mean and variance of the latent space, and performs reparameterization to obtain the latent variable samples of the (k+1)-th iteration. The mean and variance of the latent space of the variational encoder sample model obtained after the k-th iteration come from the mean and variance of each cluster sample of the Gaussian mixture sample model obtained after the k-th iteration. The decoder of the variational encoder sample model obtained after the k-th iteration restores the latent variable sample of the (k+1)-th iteration from the low dimension back to the original dimension, thus obtaining the reconstruction error sample of the (k+1)-th iteration.

4. The method according to claim 2, characterized in that, The method further includes: Acquire side-channel characteristic data samples of the power measurement terminal application under sensitive behaviors; Acquire side-channel characteristic data samples of the power measurement terminal application under normal behavior; The training dataset is obtained based on the side-channel feature data samples of the power measurement terminal application under sensitive behavior and the side-channel feature data samples of the power measurement terminal application under normal behavior.

5. The method according to claim 1, characterized in that, After identifying the target behavior of the power measurement terminal application as a sensitive behavior, the method further includes: If the time period during which the target behavior of the power measurement terminal application occurs is within the time period during which normal sensitive behavior occurs, and the number of times the target behavior of the power measurement terminal application occurs is less than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application is determined to be a normal sensitive behavior. If the time period during which the target behavior of the power measurement terminal application occurs is not within the time period during which normal sensitive behavior occurs, or if the number of times the target behavior of the power measurement terminal application occurs is greater than the number of times normal sensitive behavior occurs, then the target behavior of the power measurement terminal application is identified as an abnormal sensitive behavior.

6. The method according to claim 1, characterized in that, After determining that the target behavior of the power measurement terminal application is malicious, the method further includes: Terminate the process of the power measurement terminal application.

7. A behavior recognition device for an electric force measurement terminal application based on a variational encoder and a Gaussian mixture model, characterized in that, The device includes: The latent variable acquisition module is used to determine the variational encoder model of the network based on the behavior category, and to reduce the dimensionality of the side channel feature data when the electric power measurement terminal application performs the target behavior to obtain latent variables. The probability acquisition module is used to determine the Gaussian mixture model of the network based on the behavior category, and to obtain the probability that the latent variable belongs to each cluster in the Gaussian mixture model. The normal behavior determination module is used to determine the target behavior of the power measurement terminal application as normal behavior when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold, if the data volume of the cluster corresponding to the maximum probability value of the latent variable is the largest; the maximum probability value corresponding to the latent variable is the maximum value among the probabilities of the latent variable belonging to each cluster. The sensitive behavior determination module is used to determine the target behavior of the electric power measurement terminal application as a sensitive behavior when the maximum probability value corresponding to the latent variable is greater than a preset probability threshold, or the reconstruction error of the variational encoder model is less than a preset error threshold. The malicious behavior determination module is used to determine the target behavior of the power measurement terminal application as malicious behavior when the maximum probability value corresponding to the latent variable is less than a preset probability threshold and the reconstruction error of the variational encoder model is greater than a preset error threshold.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images