Feature selection stacking ensemble learning method, system and device for power network attack detection, and medium

Abstract

The invention relates to the technical field of power digital airspace network attack detection, and discloses a power network attack detection-oriented feature selection stacking ensemble learning method, system and device, and a medium, and the method comprises the steps: carrying out the data cleaning and feature normalization of an original data set; carrying out combined feature selection on the high-dimensional features, and selecting a feature subset by adopting a multi-feature selection combined method; processing the obtained feature subsets through a mixed stacking ensemble learning mode, learning a multi-feature subset after joint feature selection by using a base learner, then integrating the results, and learning and making final prediction through a meta classifier; and detecting the power digital airspace network attack by using the hybrid stacking integration model. According to the invention, a hybrid stacking ensemble learning detection framework based on joint feature selection and ET-CNN is provided, the generalization ability, the detection accuracy and the processing ability to different features of the detection model are improved, and various attacks in the power digital spatial network can be more effectively perceived.

Description

Technical Field

[0001] This invention relates to the field of power digital airspace network attack detection technology, and in particular to a feature selection stacking integrated learning method, system, device and medium for power network attack detection. Background Technology

[0002] As power industrial control systems gradually evolve into complex cyber-physical systems, the impact of cyber-side attacks is increasingly significant. In recent years, hackers have been attacking power digital spatial domain networks (DSMs) via cyber-side attacks. However, power industrial control systems are designed with a focus on the reliability, security, and efficiency of the physical side, with insufficient consideration given to cyber-side security, and lack detection and response mechanisms against network attacks. Therefore, it is necessary to research effective detection methods for power DSMs based on the data characteristics and attack methods of the cyber-side of power industrial control systems.

[0003] Data from the power digital spatial domain network is characterized by high dimensionality, strong correlation, and redundancy. Directly processing the raw data can lead to high computational complexity, model overfitting, and noise interference. Employing effective feature selection methods can reduce data dimensionality, eliminate redundancy, and improve the model's generalization ability and detection accuracy. Furthermore, the data sources in the power digital spatial domain network are diverse, exhibiting nonlinear dependencies and complex interaction effects. Learning-based detection methods can effectively capture these complex patterns and relationships, ensuring the accuracy and effectiveness of detection.

[0004] While single feature selection methods can reduce dimensionality, their generalization ability is limited, making them difficult to adapt to different or unknown data. By employing joint feature selection strategies, combining multiple methods to select feature subsets, the generalization ability and robustness of the model can be enhanced. Furthermore, hybrid heterogeneous ensemble methods that integrate machine learning and deep learning can effectively address complex data relationships, improve model performance in new threats and changing environments, and reduce the risk of false positives and false negatives.

[0005] Therefore, proposing an attack detection method and system that combines joint feature selection and hybrid heterogeneous integration is of significant innovative importance. Summary of the Invention

[0006] In view of the aforementioned existing problems, the present invention is proposed.

[0007] Therefore, this invention provides a feature selection stacking ensemble learning method for power network attack detection, which can solve the problems of how to improve the accuracy of power digital airspace network attack detection and how to improve the generalization ability and stability of detection methods and systems.

[0008] To address the aforementioned technical problems, this invention provides the following technical solution: a feature selection stacked ensemble learning method for power grid attack detection, comprising: collecting power digital spatial domain security monitoring data and performing data preprocessing and data format conversion; selecting feature subsets using a multi-feature selection joint method, selecting different feature subsets through an embedding method based on optimized threshold adjustment and a wrapping method based on optimized bidirectional search; processing the obtained feature subsets using a hybrid stacked ensemble learning model, learning multiple feature subsets through a base learner, and then learning the ensemble result through a meta-classifier to make a final prediction.

[0009] As a preferred embodiment of the feature selection stacking ensemble learning method for power grid attack detection described in this invention, the step of collecting power digital spatial security monitoring data and performing data preprocessing includes:

[0010] Collect power digital airspace safety monitoring data and divide the monitoring data into training sample set and test sample set according to a set ratio;

[0011] The data preprocessing includes data cleaning to detect missing and infinite values; if they exist, the data is predicted and filled using column averages; and feature normalization is used to scale the data to a set range using the Min-Max method to obtain the transformed data.

[0012] As a preferred embodiment of the feature selection stacking ensemble learning method for power grid attack detection described in this invention, the optimal feature combination is selected using the embedding method with optimized threshold adjustment, including training the model using the random forest algorithm to obtain the importance score of each feature.

[0013] Plot the learning curve to find the initial optimal threshold;

[0014] The final threshold is obtained by adjusting the initial optimal threshold using an iterative method.

[0015] By setting a final threshold, combinations of important features are selected.

[0016] As a preferred embodiment of the feature selection stacking ensemble learning method for power grid attack detection described in this invention, the optimal feature combination is selected using the optimized bidirectional search wrapping method, including determining the contribution of each individual feature to the model performance through pre-sorting based on feature importance scores.

[0017] Based on the pre-sorting results, a bidirectional search algorithm is used to refine the selection of feature subsets.

[0018] As a preferred embodiment of the feature selection stacked ensemble learning method for power grid attack detection described in this invention, the step of using a hybrid stacked ensemble learning model to process the feature subsets obtained above includes learning different feature subsets by using a base classifier with a machine learning model extreme random tree and a deep learning model convolutional neural network, wherein the deep learning model convolutional neural network is optimized before learning different feature subsets.

[0019] The classifier predictions are stacked and integrated, and the meta-classifier learns from an extreme random tree to complete the final prediction.

[0020] As a preferred embodiment of the feature selection stacking ensemble learning method for power grid attack detection described in this invention, the optimization of the deep learning model convolutional neural network includes optimization using L2 regularization, and limiting the size of the weights by adding a term proportional to the square of the weights to the loss function, specifically:

[0021]

[0022] Where L(θ) is the total loss function after regularization, L0(θ) is the original loss function, θ represents the model parameters, and λ is the regularization coefficient. i is a single weight in the model, and n is the total number of weights.

[0023] As a preferred embodiment of the feature selection stacking ensemble learning method for power grid attack detection described in this invention, the optimization of the deep learning model convolutional neural network further includes using the SE block attention mechanism to compress feature information by performing global average pooling, and weighting the compressed features through a fully connected layer, which is divided into two operations: squeezing and activation.

[0024] The squeezing operation, global average pooling, compresses the H×W×C feature map to 1×1×C, that is, it averages the features of each channel:

[0025]

[0026] Where z is the compressed vector, z c It is the c-th element, x ijc H is the feature value of the c-th channel at position (i,j), where H represents the height of the feature map, W represents the width of the feature map, and C represents the number of channels in the feature map.

[0027] The activation operation involves learning the weights of each channel through a fully connected layer, and then adjusting the weights using an activation function.

[0028] s c =σ(g(z,W))=σ(W2δ(W1z))

[0029] Where W1 and W2 are the weights of the fully connected layer, δ is the ReLU activation function, and σ is the sigmoid activation function; c It is the adjusted importance weight of the c-th channel.

[0030] Original feature map x ijc Weights s of the corresponding channels c Multiplying the features allows for recalibration, resulting in an adjusted feature map.

[0031] To address existing problems, this invention proposes a power digital airspace network attack detection method based on joint feature selection and hybrid stacked ensemble learning. This method, based on power digital airspace security monitoring data, achieves power digital airspace network attack detection through data preprocessing, joint feature selection, and hybrid stacked ensemble learning, and effectively improves the accuracy and generalization ability of the detection model.

[0032] This invention provides a feature selection stacked integrated learning system for power grid attack detection.

[0033] As a preferred embodiment of the feature selection stacked ensemble learning system for power grid attack detection described in this invention, it includes: a data preprocessing module, a feature selection module, an ensemble learning module, and a detection module.

[0034] The data preprocessing module is used to collect power digital airspace security monitoring data and convert the data into a form suitable for subsequent model processing through data cleaning and feature normalization preprocessing operations.

[0035] The feature selection module employs a combination of multiple feature selection methods to select important feature combinations, reduce data dimensionality, and improve the model's accuracy, processing speed, and generalization ability.

[0036] The ensemble learning module is used to input a subset of features into a hybrid stacked ensemble learning model, iteratively optimize the model's internal parameters, learn attack types, and complete attack prediction.

[0037] The detection module is used to perform power digital airspace network attack detection using the final hybrid stacked integration model.

[0038] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of a feature selection stacked ensemble learning method for power grid attack detection.

[0039] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of a feature selection stacked ensemble learning method for power grid attack detection.

[0040] The beneficial effects of this invention are as follows: The joint feature selection method is used to select feature subsets, which not only selects important feature combinations, improving the accuracy and processing speed of the model, but also ensures that there are certain differences between feature combinations, which is conducive to improving the robustness and stability of the model.

[0041] A hybrid stacked ensemble learning approach is adopted, which consists of two model layers. First, a base learner learns multiple feature subsets, and then a meta-classifier learns the ensemble results and makes the final prediction. The base learner employs both machine learning and deep learning models, which are integrated through stacking, enhancing the model's prediction accuracy and stability, improving its ability to capture complex data patterns, and generalizing to diverse data. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of a feature selection stacking ensemble learning method for power grid attack detection provided in one embodiment of the present invention.

[0044] Figure 2 This is a schematic diagram of the working modules of a feature selection stacked integrated learning system for power grid attack detection provided in one embodiment of the present invention. Detailed Implementation

[0045] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0046] Example 1, referring to Figure 1 This is the first embodiment of the present invention, which provides a feature selection stacked ensemble learning method for power grid attack detection, including:

[0047] S1: Collect power digital airspace security monitoring data, perform data preprocessing, and convert the data format.

[0048] S2: A multi-feature selection method is used to select feature subsets, and different feature subsets are selected by embedding method based on optimized threshold adjustment and wrapping method based on optimized bidirectional search.

[0049] S3: The feature subsets obtained by the hybrid stacked ensemble learning model are processed, and multiple feature subsets are learned through the base learner. Then, the ensemble result is learned through the meta-classifier and the final prediction is made.

[0050] It should be noted that, in order to address the shortcomings of existing power digital spatial network attack detection methods, such as insufficient detection accuracy, inadequate generalization ability, and difficulty in adapting to emerging new attacks, a joint feature selection approach was adopted. Two efficient feature selection methods were chosen: an embedding method based on optimized threshold adjustment and a wrapping method based on optimized bidirectional search, to select the optimal feature subset. This step not only selects important feature combinations, improving the model's accuracy and processing speed, but also ensures that the feature combinations have a certain degree of diversity, which is beneficial to improving the model's robustness and stability.

[0051] This embodiment designs a hybrid stacked ensemble learning framework. First, a base learner learns a multi-feature subset after joint feature selection. Then, a meta-classifier learns the ensemble result and makes a final prediction. The base learner employs both machine learning and deep learning models, which are integrated through stacking, enhancing the model's ability to capture complex data patterns and generalize to diverse data.

[0052] Example 2 is an embodiment of the present invention. Based on the above embodiment, a feature selection stacked ensemble learning method for power grid attack detection is provided.

[0053] Furthermore, in this embodiment of the application, step S1 involves collecting power digital airspace security monitoring data and performing data preprocessing and data format conversion, specifically including the following steps A1-A2:

[0054] A1: Collect power digital airspace security monitoring data and divide the monitoring data into training sample set and test sample set in an 8:2 ratio; perform data preprocessing on the original dataset, including data cleaning and feature normalization, to obtain filtered data, providing a more suitable form for subsequent model analysis.

[0055] A2: Data preprocessing is performed through data cleaning and feature normalization, specifically as follows:

[0056] In the data cleaning section, missing and infinite values ​​are detected. If they are found, the column average is used to predict and fill them, so as to maximize the integrity and accuracy of the data.

[0057] In the feature normalization part, the Min-Max method is used to scale the data to the [0,1] interval.

[0058] Furthermore, in this embodiment, data preprocessing is achieved through data cleaning and feature normalization;

[0059] In an optional embodiment, data preprocessing can also be achieved through Z-Score normalization and median imputation. Specifically, in the data cleaning part, missing values ​​and outliers are detected, and missing values ​​are imputed using the column median. In the feature normalization part, Z-Score normalization is used to scale the data to a distribution with a mean of 0 and a standard deviation of 1, the mean and standard deviation of each column of data are calculated, and each feature value is transformed.

[0060] In another alternative embodiment, data preprocessing can also be achieved through quantile scaling and mode imputation. Specifically, in the data cleaning part, missing values ​​are detected for categorical features or discrete numerical features, and missing values ​​are imputed with the mode. In the feature scaling part, quantile scaling is used to scale the data to the interval between the first quartile (Q1) and the third quartile (Q3).

[0061] Furthermore, in this embodiment, step S2 employs a multi-feature selection joint method to select feature subsets. Different feature subsets are selected using an embedding method based on optimized threshold adjustment and a wrapping method based on optimized bidirectional search. Specifically, this includes the following steps B1-B4:

[0062] B1: Train the model using the random forest algorithm to obtain the importance score for each feature; plot the learning curve to find the initial optimal threshold; further, use an iterative method based on performance feedback to adjust the initial optimal threshold to obtain the final threshold; filter by setting this threshold to select features that make significant contributions to the model.

[0063] B2: The threshold setting process is to first obtain the maximum value of feature importance, max_importance, and then set the threshold to 20 points between 0 and max_importance. Based on the cross-validation score of the random forest for the model, a learning curve is plotted, and the highest point of the curve is found as the initial optimal threshold.

[0064] Further, an iterative method based on performance feedback is used to adjust the threshold. A maximum number of iterations and a performance improvement threshold are set. The iteration is terminated when the maximum number of iterations is reached or the performance no longer improves significantly. The threshold obtained at this point is the optimal threshold, and setting this threshold allows for the selection of feature combinations.

[0065] Furthermore, in this embodiment, the embedding method is based on the optimization threshold adjustment, which automatically evaluates the importance of features during the model training process and selects different feature subsets by optimizing the threshold;

[0066] In an optional embodiment, when the feature importance distribution is uneven, different feature subsets can be selected by a dynamic threshold of quantiles. Specifically, a random forest model is used for training to obtain the importance scores of all features, the distribution of feature importance is analyzed, an initial threshold is set, the model performance of different quantiles is tested on the validation set, and the quantile with the highest AUC / F1 is selected as the final threshold. The optimal feature subset can be determined through a small number of quantile experiments.

[0067] In another optional embodiment, when there is a clear stratification of feature importance, different feature subsets can be selected through feature grouping thresholds in cluster analysis. Specifically, K-Means clustering is performed on the importance scores of all features, automatically dividing them into high / medium / low importance groups. The group of features with the highest centroids in the clustering results is directly retained as the filtered subset. Cross-validation is performed on the feature subsets in the clustering results. If the performance is insufficient, the number of clusters can be adjusted and the groups can be regrouped.

[0068] B3: Feature selection is performed using a wrapper method based on optimized bidirectional search. First, based on feature importance scores, a heuristic feature ranking is used to pre-determine the contribution of each individual feature to the model performance. Then, based on this pre-ranking, a bidirectional search algorithm is used to gradually refine the selection of feature subsets.

[0069] This embodiment combines the advantages of forward selection and backward elimination. It starts with no features and gradually adds the features that have the most significant impact on the model. When adding a new feature no longer significantly improves model performance, it removes the features that contribute the least to performance. If removing a feature causes a decrease in model performance, the removal process stops. Furthermore, the bidirectional search algorithm is optimized by using heuristic feature ranking before the search to provide an initial reference for model scoring, thus accelerating subsequent search efficiency. Simultaneously, the forward selection and backward elimination processes are dynamically adjusted, increasing or decreasing the currently selected features based on the model's feedback on feature performance, further enhancing the model's adaptability and feature selection accuracy.

[0070] Furthermore, in this embodiment, feature selection is performed based on the advantages of the optimized bidirectional search wrapping method, which combines forward selection and backward elimination, and the feature subset is dynamically adjusted to optimize model performance.

[0071] In an optional embodiment, the wrapping method can also be implemented through alternating direction searches. Specifically, a fixed-period switching is used, where after every two forward additions, a forced backward elimination is performed to avoid over-reliance on a single direction. If two consecutive forward additions fail to improve performance, backward elimination is immediately switched to. This is based on performance stagnation assessment.

[0072] In another alternative embodiment, the wrapping method can also be implemented through a flexible bidirectional search. Specifically, the search direction preference is adjusted according to the current subset size: when the subset is small, forward addition is emphasized, and when the subset is large, backward elimination is emphasized. If forward addition is consecutively successful, the number of features added in a single instance is increased; otherwise, it is decreased. The process stops when the subset size is stable and there is no performance improvement.

[0073] B4: Using joint feature selection, the embedding method based on learning curves and performance feedback iteration and the wrapping method based on optimization bidirectional search are applied to the same dataset to obtain two sets of feature subsets with complementary capabilities. Different classifiers are used to independently learn different feature subsets, and their results are integrated to achieve the ensemble effect of the joint feature selection method.

[0074] Furthermore, in this embodiment of the application, the feature subset obtained by the hybrid stacked ensemble learning model in step S3 is processed, multiple feature subsets are learned through the base learner, and then the ensemble result is learned through the meta-classifier to make the final prediction. Specifically, it includes the following steps C1-C3:

[0075] C1: Using Extremely Random Trees (ET) machine learning model and Convolutional Neural Networks (CNN) deep learning model as base classifiers to learn different feature subsets, then stacking and integrating them, and finally learning and making predictions through another Extremely Random Trees model as a meta-classifier, in order to improve the detection and recognition effect.

[0076] C2: In this embodiment, the main improvements to the CNN model include the introduction of L2 regularization and SE block attention mechanism. L2 regularization limits the size of the weights by adding a term proportional to the square of the weights to the loss function, thereby reducing the risk of overfitting and improving its generalization ability when handling unknown data. The process is shown in the formula:

[0077]

[0078] Where L(θ) is the total loss function after regularization; L0(θ) is the original loss function; θ represents the model parameters; λ is the regularization coefficient; θ i is a single weight in the model; n is the total number of weights.

[0079] Furthermore, in this embodiment, by setting a regularization coefficient λ, the original loss function and weight constraints are balanced, thereby optimizing the deep learning model convolutional neural network.

[0080] In an optional embodiment, when the amount of data is small or the model has many layers, a Dropout layer can be inserted after the fully connected or convolutional layers of the CNN, randomly discarding some neuron outputs during training. During the inference phase, Dropout is turned off, and all neurons are used for prediction, thus optimizing the deep learning model's convolutional neural network.

[0081] In another alternative embodiment, when the training data and validation set distributions are consistent, the validation set loss or accuracy can be calculated in real time during CNN training. If the validation set performance does not improve for N consecutive epochs (e.g., 5 epochs), training is stopped, the current optimal weights are retained, and the deep learning model convolutional neural network is then optimized.

[0082] C3: The SE block attention mechanism compresses feature information by performing global average pooling and then weights the compressed features through subsequent fully connected layers. It consists of two operations: "Squeeze" and "Excitation".

[0083] Squeeze: Global average pooling compresses the H×W×C feature map to 1×1×C, that is, it averages the features of each channel.

[0084]

[0085] Where z is the compressed vector, z c It is its c-th element; x ijc It is the feature value of the c-th channel at position (i,j).

[0086] Excitation: Next, the weights for each channel are learned through a fully connected layer, and then these weights are adjusted using an activation function.

[0087] s c =σ(g(z,W))=σ(W2δ(W1z))

[0088] Where W1 and W2 are the weights of the fully connected layer; δ is the ReLU activation function, and σ is the sigmoid activation function; s c It is the adjusted importance weight of the c-th channel.

[0089] Finally, the original feature map x ijc The weights s of its corresponding channels c Multiplication is performed to recalibrate the features, resulting in an adjusted feature map. The use of SE blocks enhances the network's dynamic understanding and adjustment of the importance of feature channels, improving the model's flexibility and accuracy in processing different features.

[0090] Example 3 is the third embodiment of the present invention, which differs from the previous two embodiments in that:

[0091] This embodiment also provides a feature selection stacked ensemble learning system for power grid attack detection, including: a data preprocessing module, a feature selection module, an ensemble learning module, and a detection module.

[0092] The data preprocessing module is used to collect power digital airspace security monitoring data and convert the data into a form suitable for subsequent model processing through data cleaning and feature normalization preprocessing operations.

[0093] The feature selection module employs a combination of multiple feature selection methods to select important feature combinations, reduce data dimensionality, and improve the model's accuracy, processing speed, and generalization ability.

[0094] The ensemble learning module is used to input a subset of features into a hybrid stacked ensemble learning model, iteratively optimize the model's internal parameters, learn attack types, and complete attack prediction.

[0095] The detection module is used to perform power digital airspace network attack detection using the final hybrid stacked integration model.

[0096] This embodiment also provides an electronic device suitable for online health monitoring of high-temperature pipelines, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the online health monitoring method for high-temperature pipelines as proposed in the above embodiment.

[0097] This embodiment also provides a storage medium storing a computer program, which, when executed by a processor, implements the method for online health monitoring of high-temperature pipelines as proposed in the above embodiments.

[0098] The storage medium proposed in this embodiment belongs to the same inventive concept as the method for online health monitoring of high-temperature pipelines proposed in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0099] Based on the above description of the implementation methods, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0100] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A feature selection stacking ensemble learning method for power grid attack detection, characterized by: include, Collect power digital airspace safety monitoring data, and perform data preprocessing and data format conversion; A multi-feature selection joint method is adopted to select feature subsets, and different feature subsets are selected by embedding method based on optimized threshold adjustment and wrapping method based on optimized bidirectional search. The feature subsets obtained by the hybrid stacked ensemble learning model are processed, and multiple feature subsets are learned through the base learner. Then, the ensemble result is learned through the meta-classifier and the final prediction is made.

2. The feature selection stacked ensemble learning method for power grid attack detection as described in claim 1, characterized in that: The process of collecting and preprocessing power digital airspace security monitoring data includes: Collect power digital airspace safety monitoring data and divide the monitoring data into training sample set and test sample set according to a set ratio; The data preprocessing includes cleaning the data, detecting whether there are missing or infinite values, and if so, using column averages to predict and fill them. By normalizing features and using the Min-Max method, the data is scaled to a set range to obtain the transformed data.

3. The feature selection stacking ensemble learning method for power grid attack detection as described in claim 2, characterized in that: Using the optimized threshold adjustment embedding method, the best feature combination is selected, including training the model using the random forest algorithm to obtain the importance score of each feature; Plot the learning curve to find the initial optimal threshold; The final threshold is obtained by adjusting the initial optimal threshold using an iterative method. By setting a final threshold, combinations of important features are selected.

4. The feature selection stacking ensemble learning method for power grid attack detection as described in claim 3, characterized in that: Using the optimized bidirectional search wrapper method, the best feature combination is selected. This includes determining the contribution of each individual feature to the model performance through pre-sorting based on feature importance scores; Based on the pre-sorting results, a bidirectional search algorithm is used to refine the selection of feature subsets.

5. The feature selection stacking ensemble learning method for power grid attack detection as described in claim 4, characterized in that: The process of using a hybrid stacked ensemble learning model to process the feature subsets obtained above includes learning different feature subsets by using a base classifier with an extreme random tree machine learning model and a deep learning model convolutional neural network, wherein the deep learning model convolutional neural network is optimized before learning different feature subsets; The classifier predictions are stacked and integrated, and the meta-classifier learns from an extreme random tree to complete the final prediction.

6. The feature selection stacking ensemble learning method for power grid attack detection as described in claim 5, characterized in that: The optimization of the deep learning model convolutional neural network includes optimization using L2 regularization, which limits the size of the weights by adding a term proportional to the square of the weights to the loss function. Specifically: Where L(θ) is the total loss function after regularization, L0(θ) is the original loss function, θ represents the model parameters, and λ is the regularization coefficient. i is a single weight in the model, and n is the total number of weights.

7. The feature selection stacked ensemble learning method for power grid attack detection as described in claim 6, characterized in that: The optimization of the deep learning model convolutional neural network also includes using the SE block attention mechanism to compress feature information by performing global average pooling, and weighting the compressed features through a fully connected layer, which is divided into two operations: squeezing and activation. The squeezing operation, global average pooling, compresses the H×W×C feature map to 1×1×C, that is, it averages the features of each channel: Where z is the compressed vector, z c It is the c-th element, x ijc H is the feature value of the c-th channel at position (i,j), where H represents the height of the feature map, W represents the width of the feature map, and C represents the number of channels in the feature map. The activation operation involves learning the weights of each channel through a fully connected layer, and then adjusting the weights using an activation function. s c =σ(g(z,W))=σ(W2δ(W1z)) Where W1 and W2 are the weights of the fully connected layer, δ is the ReLU activation function, and σ is the sigmoid activation function; c It is the adjusted importance weight of the c-th channel. Original feature map x ijc Weights s of the corresponding channels c Multiplying the features allows for recalibration, resulting in an adjusted feature map.

8. A feature selection stacked ensemble learning system for power grid attack detection, employing the feature selection stacked ensemble learning method for power grid attack detection as described in any one of claims 1 to 7, characterized in that... include: The data preprocessing module is used to collect power digital airspace security monitoring data and transform the data into a form suitable for subsequent model processing through data cleaning and feature normalization preprocessing operations. The feature selection module employs a combination of multiple feature selection methods to select important feature combinations, reduce data dimensionality, and improve the model's accuracy, processing speed, and generalization ability. The ensemble learning module is used to input a subset of features into a hybrid stacked ensemble learning model, iteratively optimize the model's internal parameters, learn attack types, and complete attack prediction. The detection module is used to perform power digital airspace network attack detection using the final hybrid stacked integration model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the feature selection stacked ensemble learning method for power grid attack detection as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the feature selection stacked ensemble learning method for power grid attack detection as described in any one of claims 1 to 7.

Images