Electric power security situation prediction method and device based on time sequence fusion and incremental learning

Abstract

The invention provides an electric power security situation prediction method and device based on time sequence fusion and incremental learning, and relates to the field of electric power system network security protection. The method comprises the following steps: acquiring multi-dimensional time series data related to a network security situation, denoising through a wavelet transform denoising module, performing zero mean processing, inputting an ARIMA sub-model to obtain a linear trend prediction result and a residual sequence, inputting the residual sequence into an LSTM sub-model to obtain a residual prediction result, and outputting the residual prediction result. Obtaining a network security situation prediction result through a dynamic weight distribution mechanism; receiving new data through a sliding time window to update related parameters in the sub-model; and decomposing the prediction result through the situation analysis layer and generating defense suggestions. The deep mining of the network security situation and the continuous evolution of the model are realized, the prediction accuracy and real-time performance are obviously improved, and the stable operation of the 5G kite private network in the power monitoring system in the scenes of intelligent power grid dispatching, remote area power monitoring and the like is ensured.

Description

Technical Field

[0001] This invention relates to the field of power system network security protection technology, and in particular to a power security situation prediction method and device based on time-series fusion and incremental learning. Background Technology

[0002] With the deep integration of 5G technology and the Industrial Internet, the 5G kite-based private network, as a dedicated support network, uses ground core nodes as anchor points and aerial mobile relays as extensions. Through dynamic links pulled by kites, it achieves wide-area coverage, providing dedicated access capabilities for scenarios such as power transmission line monitoring and emergency repair communications in remote areas. The power monitoring system, with the power dispatch cloud as its core and edge computing nodes as support, realizes real-time monitoring and precise control of power plants, substations, and transmission lines, playing a crucial role in smart grids and new energy grid integration. However, the system's heterogeneous network topology integrates traditional monitoring and data acquisition systems, intelligent terminal devices, and edge nodes, and includes dynamic link units like the 5G kite-based private network. It is characterized by strong real-time performance and significant susceptibility to power grid load fluctuations, electromagnetic interference, and airspace environment influences. Furthermore, it involves a massive number of connected sensing devices such as telemetry terminals and protection devices. These characteristics make its cybersecurity challenges more complex. Cyberattacks not only manifest in traditional forms such as malware injection and data theft, but also give rise to new threats such as forged command attacks targeting power communication protocols, such as tampering with remote control signals and covert infiltration using link fluctuations. Such attacks, once breaching defenses, can lead to distorted monitoring data, malfunctions in power equipment, and even regional power outages and damage to critical infrastructure, posing a serious threat to energy security and public order. Therefore, developing a cybersecurity situation prediction mechanism that combines accuracy and real-time performance to support a resilient security system, tailored to the dynamic operational characteristics of power monitoring systems, has become a core technological requirement for ensuring their continuous and stable operation.

[0003] In the field of cybersecurity situation prediction, traditional prediction methods mainly include statistical analysis-based methods, machine learning-based methods, and rule-based reasoning methods. Traditional methods have limited adaptability to data characteristics and struggle to effectively handle the complex nonlinear, non-stationary, and high-dimensional characteristics of cybersecurity data in power monitoring systems. This type of data is influenced by various factors such as network topology changes, fluctuations in equipment operating status, and the emergence of new attack methods, exhibiting highly complex characteristics. Traditional methods cannot fully explore the inherent relationships within this data, resulting in limited prediction accuracy and failing to meet the requirements of precise situational awareness for resilient security. Furthermore, traditional methods lack real-time response capabilities to dynamic changes. The cybersecurity situation of power monitoring systems is constantly changing, with new attack patterns and security threats emerging at any time. Traditional prediction methods are typically trained on fixed models and historical data, making it difficult to update models in real time to adapt to new data characteristics and trends. In the face of sudden security incidents, they cannot make timely and accurate predictions and responses, hindering the realization of resilient security in the system. Furthermore, traditional methods have weak generalization capabilities. In practical applications, the network environment and security threats of power monitoring systems are diverse and uncertain. Different power grid scenarios may have different data distributions and characteristics. Models trained by traditional methods are often only well adapted to specific datasets and scenarios. When faced with new and unseen network environments and security threats, their generalization capabilities are insufficient, making it impossible to accurately predict the network security situation and support the system's resilient defense and rapid recovery.

[0004] Therefore, existing technologies face the following technical challenges in network security situation prediction: traditional single models struggle to simultaneously capture both linear trends and nonlinear fluctuations in network situations, such as the periodic changes in device communication and the nonlinear characteristics of sudden attacks in power monitoring systems, leading to limited prediction accuracy; traditional models have fixed parameters after training, making them unable to adapt to the rapid evolution of attack methods in power monitoring systems, such as the continuous emergence of new industrial control protocol attacks; in heterogeneous topologies of power monitoring systems, the data characteristics of dispatch centers and edge nodes differ significantly, and traditional centralized modeling easily overlooks local node-specific attacks; noise interference in network situation data, such as communication jitter data generated by the electromagnetic environment affecting power monitoring systems, results in insufficient stability of prediction results; and traditional prediction methods only output a single situation value, making it difficult to support accurate defense decisions in power monitoring systems. Summary of the Invention

[0005] To address the technical problems of low accuracy in network security situation prediction and insufficient adaptability to emerging threats in 5G kite-style private networks for power monitoring systems in dynamic heterogeneous environments, this invention provides a power security situation prediction method and apparatus based on temporal fusion and incremental learning. The technical solution is as follows:

[0006] On the one hand, a power security situation prediction method based on temporal fusion and incremental learning is provided. This method is implemented by a network security situation dynamic prediction device for a power monitoring system, and includes:

[0007] S1. Obtain multi-dimensional time-series data related to network security status through multi-source data acquisition nodes deployed in the power monitoring system; wherein, the power monitoring system includes a 5G kite private network.

[0008] S2. The wavelet transform denoising module is used to remove noise from the multi-dimensional time series data. The noise-removed time series data is then zero-mean processed to obtain the preprocessed time series data.

[0009] S3. Input the preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module to obtain the linear trend prediction result and the residual sequence. Input the residual sequence into the LSTM sub-model of the time series fusion prediction module to obtain the residual prediction result. Combine the linear trend prediction result and the residual prediction result through a dynamic weight allocation mechanism to obtain the network security situation prediction result.

[0010] S4. Receive new multi-dimensional time series data through a sliding time window and update the parameters in the ARIMA sub-model and LSTM sub-model that are related to the new multi-dimensional time series data.

[0011] S5. By linking the attack signature database and the topology information of the power monitoring system through the situation analysis layer, the network security situation prediction results are decomposed into risk level, attack type and scope of affected nodes, and defense suggestions are generated.

[0012] Optionally, in S3, the preprocessed time series data is input into the ARIMA sub-model of the time series fusion prediction module to obtain linear trend prediction results and residual sequences, including:

[0013] S31. Perform a stationarity test on the preprocessed time series data. For the time series data that are non-stationary according to the test results, perform a difference operation to obtain the stationary time series data corresponding to the non-stationary time series data. Construct an ARIMA sub-model training set based on the stationary time series data and the stationary time series data corresponding to the non-stationary time series data.

[0014] S32. Construct the ARIMA sub-model of the time series fusion prediction module based on the autocorrelation function, partial autocorrelation function and Akaike information content criterion.

[0015] S33. Train the ARIMA sub-model using the ARIMA sub-model training set, obtain the linear trend prediction result based on the trained ARIMA sub-model, and calculate the residual sequence based on the linear trend prediction result; wherein, the residual sequence contains the nonlinear features in the time series data.

[0016] Optionally, the prediction formula for the ARIMA sub-model is shown in equation (1) below: (1)

[0017] In the formula, Indicates at time The predicted value, Indicates at time The actual observed value, Indicates a time index. Represents the autoregressive coefficient. Indicates the order of autoregression. Represents the moving average coefficient. Indicates the order of the moving average. This represents the white noise residual.

[0018] Optionally, in S3, the residual sequence is input into the LSTM sub-model of the time-series fusion prediction module to obtain the residual prediction results, including:

[0019] An LSTM sub-model training set is constructed based on residual sequences and sliding window techniques. The structure of the LSTM sub-model of the time series fusion prediction module is determined. The LSTM sub-model is trained based on the LSTM sub-model training set. The residual prediction results are obtained based on the trained LSTM sub-model.

[0020] The LSTM sub-model consists of an input layer, a 100-unit hidden layer, a 1-unit output layer, a Tanh activation function, and an Adam optimizer.

[0021] Optionally, the ARIMA and LSTM sub-models in S3 are trained locally through edge nodes in the power monitoring system. Based on the trained ARIMA and LSTM sub-models, linear trend prediction results and residual prediction results are extracted and uploaded to the central node for global fusion to obtain network security situation prediction results.

[0022] Optionally, parameters in S4 related to the new multidimensional time series data in the ARIMA and LSTM sub-models are updated, including:

[0023] The autoregressive and moving average coefficients in the ARIMA submodels that are associated with new multidimensional time series data are re-estimated.

[0024] Freeze the parameters of the early layers of the LSTM sub-model, and update the weights of the output layer and the last hidden layer.

[0025] Optionally, S5 decomposes the network security posture prediction results into risk level, attack type, and affected node range, and generates defense recommendations, including:

[0026] The risk level is obtained by comparing the network security situation prediction results with preset thresholds; the attack type is determined based on the residual sequence; the range of affected nodes is obtained based on the topology information of the power monitoring system; the prediction accuracy of the network security situation prediction results is evaluated using root mean square error and mean absolute percentage error, and the parameter update frequency of the ARIMA sub-model and LSTM sub-model is dynamically adjusted based on the evaluation results.

[0027] On the other hand, a power security situation prediction device based on time-series fusion and incremental learning is provided. This device is applied to the power security situation prediction method based on time-series fusion and incremental learning. The device includes:

[0028] The multi-source data acquisition module is used to acquire multi-dimensional time-series data related to network security status through multi-source data acquisition nodes deployed in the power monitoring system; the power monitoring system includes a 5G kite private network.

[0029] The preprocessing module is used to remove noise from multi-dimensional time series data through the wavelet transform denoising module, and then perform zero-mean processing on the noise-removed time series data to obtain preprocessed time series data.

[0030] The time series fusion prediction module is used to input preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module to obtain linear trend prediction results and residual sequences. The residual sequences are then input into the LSTM sub-model of the time series fusion prediction module to obtain residual prediction results. The linear trend prediction results and residual prediction results are combined through a dynamic weight allocation mechanism to obtain network security situation prediction results.

[0031] The incremental learning update module is used to receive new multi-dimensional time series data through a sliding time window and update the parameters in the ARIMA sub-model and LSTM sub-model that are related to the new multi-dimensional time series data.

[0032] The situation analysis module is used to decompose the network security situation prediction results into risk level, attack type and affected node range by associating the attack signature database and power monitoring system topology information through the situation analysis layer, and generate defense suggestions.

[0033] Optionally, the time-series fusion prediction module is further used for:

[0034] S31. Perform a stationarity test on the preprocessed time series data. For the time series data that are non-stationary according to the test results, perform a difference operation to obtain the stationary time series data corresponding to the non-stationary time series data. Construct an ARIMA sub-model training set based on the stationary time series data and the stationary time series data corresponding to the non-stationary time series data.

[0035] S32. Construct the ARIMA sub-model of the time series fusion prediction module based on the autocorrelation function, partial autocorrelation function and Akaike information content criterion.

[0036] S33. Train the ARIMA sub-model using the ARIMA sub-model training set, obtain the linear trend prediction result based on the trained ARIMA sub-model, and calculate the residual sequence based on the linear trend prediction result; wherein, the residual sequence contains the nonlinear features in the time series data.

[0037] Optionally, the prediction formula for the ARIMA sub-model is shown in equation (1) below:

[0038] (1)

[0039] In the formula, Indicates at time The predicted value, Indicates at time The actual observed value, Indicates a time index. Represents the autoregressive coefficient. Indicates the order of autoregression. Represents the moving average coefficient. Indicates the order of the moving average. This represents the white noise residual.

[0040] Optionally, the time-series fusion prediction module is further used for:

[0041] An LSTM sub-model training set is constructed based on residual sequences and sliding window techniques. The structure of the LSTM sub-model of the time series fusion prediction module is determined. The LSTM sub-model is trained based on the LSTM sub-model training set. The residual prediction results are obtained based on the trained LSTM sub-model.

[0042] The LSTM sub-model consists of an input layer, a 100-unit hidden layer, a 1-unit output layer, a Tanh activation function, and an Adam optimizer.

[0043] Optionally, the ARIMA sub-model and LSTM sub-model are trained locally through edge nodes in the power monitoring system. The linear trend prediction results and residual prediction results are extracted from the trained ARIMA sub-model and LSTM sub-model, and then uploaded to the central node for global fusion to obtain the network security situation prediction results.

[0044] Optionally, the incremental learning update module is further used for:

[0045] The autoregressive and moving average coefficients in the ARIMA submodels that are associated with new multidimensional time series data are re-estimated.

[0046] Freeze the parameters of the early layers of the LSTM sub-model, and update the weights of the output layer and the last hidden layer.

[0047] Optionally, the situation analysis module is further used for:

[0048] The risk level is obtained by comparing the network security situation prediction results with preset thresholds; the attack type is determined based on the residual sequence; the range of affected nodes is obtained based on the topology information of the power monitoring system; the prediction accuracy of the network security situation prediction results is evaluated using root mean square error and mean absolute percentage error, and the parameter update frequency of the ARIMA sub-model and LSTM sub-model is dynamically adjusted based on the evaluation results.

[0049] On the other hand, a dynamic prediction device for network security situation of a power monitoring system is provided. The dynamic prediction device for network security situation of a power monitoring system includes: a processor; a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, any one of the above-mentioned methods for predicting power security situation based on time-series fusion and incremental learning is implemented.

[0050] On the other hand, a computer-readable storage medium is provided, wherein at least one instruction is stored in the storage medium, the at least one instruction being loaded and executed by a processor to implement any of the above-described methods for predicting power security situation based on time-series fusion and incremental learning.

[0051] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following:

[0052] The proposed method for dynamic prediction of network security situation based on temporal fusion and incremental learning addresses the dynamic heterogeneity and complex security threats of power monitoring systems. Through multi-dimensional technological innovation, it achieves a comprehensive improvement in prediction accuracy, adaptability, and practicality, providing strong support for resilient security. Specific advantages are as follows:

[0053] 1. Higher Prediction Accuracy, Balancing Linear and Nonlinear Characteristics: Traditional single models such as ARIMA can only capture linear trends, and LSTM is insufficient for fitting linear patterns, making it difficult to handle the mixed linear and nonlinear characteristics in network security situational data. This invention achieves comprehensive analysis of complex situations through deep fusion of ARIMA and LSTM. ARIMA focuses on extracting linear trends, such as the periodic fluctuations in substation communication, while LSTM focuses on learning nonlinear correlations in residuals, such as abrupt changes in abnormal signals from telemetry terminals. The two models work together to achieve comprehensive analysis of complex situations. Experimental results show that the prediction errors (RMSE and MAPE) of the hybrid model are reduced by more than 30% compared to single models, especially performing better in scenarios where load fluctuations and attacks overlap in power monitoring systems, providing a precise basis for situational prediction for resilient security.

[0054] 2. Enhanced Dynamic Adaptability and Real-Time Response to Emerging Threats: Addressing the rapidly evolving attack methods in power monitoring systems, with new industrial control protocol spoofing attacks being a prime example, traditional models require full retraining, resulting in lag. This invention introduces an incremental learning mechanism, receiving new security event data in real-time through a sliding time window. Only parameters associated with new features, such as the output layer weights of LSTM and the moving average coefficients of ARIMA, are updated, without requiring complete model reconstruction. This ensures resilient security's real-time response to dynamic threats.

[0055] 3. Superior robustness and outstanding resistance to noise interference: Power monitoring systems are affected by grid load and electromagnetic environment interference, and the data often contains noise. False alarms due to abnormal traffic caused by communication jitter are common, and traditional models are easily affected by this, leading to prediction bias. This invention introduces wavelet transform denoising during the data preprocessing stage, and combines it with an attention mechanism to dynamically strengthen key features such as the data packet characteristics of control commands during model training, weakening the impact of noise. Especially in complex electromagnetic environments, it can maintain high-precision predictions, providing a stable decision-making basis for resilient security.

[0056] 4. Flexible Deployment, Adaptable to Heterogeneous Network Topologies: Traditional centralized modeling often overlooks specific threats to local nodes, particularly those arising from the heterogeneous topologies of power monitoring system dispatch centers and edge nodes. Malicious code injection risks at substation terminals fall into this category. This invention employs a distributed-centralized two-tier architecture: edge nodes, such as substations, first train sub-models to extract local features, then upload the feature vectors to the central node for fusion, enabling collaborative prediction of both localized sudden attacks and the overall situation. This architecture can dynamically adjust model parameters based on node type, exhibiting significantly better adaptability than traditional unified models, thus enhancing resilient security's local defense capabilities in heterogeneous environments.

[0057] 5. More Precise Decision Support, Outputting Multi-Dimensional Situational Information: Traditional prediction methods only output a single situational value, which is insufficient to support differentiated defense decisions. This invention decomposes the prediction results into multi-dimensional information such as risk level, attack type (e.g., forged commands and covert penetration), and affected equipment scope (e.g., dispatch centers and substations) through a situational analysis layer. It also associates this information with a defense strategy library to generate targeted suggestions such as enhanced authentication for terminal nodes and DDoS mitigation for dispatch networks. This significantly enhances the security protection capabilities of power monitoring systems in scenarios such as smart grids and new energy grid integration, facilitating the efficient implementation of resilient security. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart of a power security situation prediction method based on time-series fusion and incremental learning provided by an embodiment of the present invention;

[0060] Figure 2 This is a flowchart of the network security situation dynamic prediction method provided in the embodiments of the present invention;

[0061] Figure 3 This is an overall architecture diagram of the network security situation dynamic prediction system provided in this embodiment of the invention;

[0062] Figure 4 This is a block diagram of a power security situation prediction device based on time-series fusion and incremental learning provided in an embodiment of the present invention;

[0063] Figure 5 This is a schematic diagram of the structure of a dynamic prediction device for network security status of a power monitoring system provided in an embodiment of the present invention. Detailed Implementation

[0064] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0065] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0066] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0067] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0068] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0069] This invention provides a power security situation prediction method based on temporal fusion and incremental learning. This method can be implemented by a dynamic prediction device for the network security situation of a power monitoring system, which can be a terminal or a server. Figure 1 , Figure 2 The flowchart shown is for a power security situation prediction method based on time-series fusion and incremental learning. The processing flow of this method may include the following steps:

[0070] S1. Obtain multi-dimensional time-series data related to network security status through multi-source data acquisition nodes deployed in the power monitoring system; wherein, the power monitoring system includes a 5G kite private network.

[0071] In one feasible implementation, the present invention constructs a multi-source data acquisition and preprocessing mechanism that covers heterogeneous network nodes of the 5G Kite private network, acquires network security situation-related data and performs purification processing, providing high-quality input for subsequent model training.

[0072] Specifically, multi-source data collection nodes are deployed to cover terrestrial 5G base stations, aerial drone relays, and terminal devices. The collected data includes: network traffic data (such as data packet size and transmission frequency), device operation logs (such as CPU utilization and abnormal alarm records), and attack event records (such as abnormal logins and malicious code detection results).

[0073] S2. The wavelet transform denoising module is used to remove noise from the multi-dimensional time series data. The noise-removed time series data is then zero-mean processed to obtain the preprocessed time series data.

[0074] In one feasible implementation, a wavelet transform denoising module is used to process the original data to eliminate noise caused by meteorological interference and spatial fluctuations. The wavelet transform formula is as follows:

[0075] (1)

[0076] In the formula, Indicates the scale parameter. Indicates the translation parameter. Represents the original data. This represents the wavelet basis function.

[0077] Furthermore, the denoised data is subjected to zero-mean normalization to eliminate dimensional differences, using the following formula:

[0078] (2)

[0079] In the formula, This is the original data. The mean of the data. Standard deviation ( ).

[0080] Furthermore, the preprocessed data is divided into a training set (historical data) and a real-time update set (new data). The training set is used for initial model building, and the real-time update set is used for subsequent incremental learning.

[0081] This invention employs a multi-source heterogeneous data purification mechanism, which differs from traditional simple data filtering methods. Targeting the heterogeneous environment of power monitoring systems, this invention first collects multi-dimensional data, including traffic, logs, and attack records, from dispatch centers, substations, and terminal equipment. Then, it eliminates noise caused by grid load and electromagnetic interference through wavelet transform, and combines zero-mean normalization to achieve data standardization. This provides a high signal-to-noise ratio input for subsequent model training, significantly reducing the impact of environmental interference on prediction accuracy and ensuring the reliability of resilient and safe decision-making.

[0082] Meanwhile, this invention adopts a noise-resistant modeling strategy for complex interference environments. Unlike traditional models that are sensitive to noise, this invention weakens communication jitter noise through wavelet transform in the preprocessing stage and introduces an attention mechanism in LSTM training. By constructing a feature importance scoring matrix, key features such as control commands are assigned weight coefficients that are 3-5 times greater than those of ordinary features. During backpropagation, the connection weights of neurons corresponding to key features are optimized to strengthen the influence of key features. This dual mechanism improves the robustness of the model, enabling the prediction results to remain stable in harsh environments and providing reliable situational support for resilient security.

[0083] S3. Input the preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module to obtain the linear trend prediction result and the residual sequence. Input the residual sequence into the LSTM sub-model of the time series fusion prediction module to obtain the residual prediction result. Combine the linear trend prediction result and the residual prediction result through a dynamic weight allocation mechanism to obtain the network security situation prediction result.

[0084] Optionally, inputting the preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module in S3 to obtain the linear trend prediction result and residual sequence may include the following steps S31-S33:

[0085] S31. Perform a stationarity test on the preprocessed time series data. For the time series data that are non-stationary according to the test results, perform a difference operation to obtain the stationary time series data corresponding to the non-stationary time series data. Construct an ARIMA sub-model training set based on the stationary time series data and the stationary time series data corresponding to the non-stationary time series data.

[0086] Among them, stationary time series data (including stationary data obtained by differentiating original stationary data and non-stationary data) are used to fit the ARIMA sub-model, which captures the linear trend features in the time series data.

[0087] In one feasible implementation, the present invention uses an ARIMA (Autoregressive Integrated Moving Average Model) sub-model to predict the linear trend of network security situation. Through stationarity testing and parameter optimization, it captures the linear features in the data and calculates the residual sequence.

[0088] Specifically, the preprocessed time series data is first tested for stationarity using the Augmented Dickey-Fuller (ADF) unit root test. If the data is non-stationary (ADF test p-value > 0.05), differencing is performed (order of difference). Transform it into a stationary sequence using the difference formula:

[0089] (3)

[0090] In the formula, Indicates at time The original time-series data values.

[0091] S32. Construct the ARIMA sub-model of the time series fusion prediction module based on the autocorrelation function, partial autocorrelation function and Akaike information content criterion.

[0092] In one feasible implementation, the ARIMA model parameters are determined through ACF (Autocorrelation Function) and PACF (Partial Autocorrelation Function) analysis. ): The autoregression order (PACF plot cutoff point). The optimal parameter combination (minimum AIC value) is selected based on the moving average order (ACF plot cutoff point) and the AIC (Akaike Information Criterion) criterion. The prediction formula for the ARIMA model is:

[0093] (4)

[0094] In the formula, Indicates at time The predicted value, Indicates at time The actual observed value, Indicates a time index. Represents the autoregressive coefficient. Indicates the order of autoregression. Represents the moving average coefficient. Indicates the order of the moving average. This represents the white noise residual.

[0095] This invention employs an ARIMA adaptation mechanism for non-stationary data. Unlike traditional ARIMA, which relies on stationary data, this invention uses the ADF test to determine data stationarity, performs differencing operations on non-stationary data and determines the differencing order, and optimizes parameters by combining the ACF, PACF, and AIC criteria. This enables ARIMA to accurately extract the linear trend of the network situation, providing a reliable benchmark for subsequent residual analysis. This solves the problem of linear modeling of non-stationary network data and supports resilient and secure stable prediction.

[0096] S33. Train the ARIMA sub-model using the ARIMA sub-model training set, obtain the linear trend prediction result based on the trained ARIMA sub-model, and calculate the residual sequence based on the linear trend prediction result; wherein, the residual sequence contains the nonlinear features in the time series data.

[0097] In one feasible implementation, the ARIMA model is fitted using the training set to obtain the linear trend prediction result. And calculate the residual sequence The residual sequence contains nonlinear features in the data and is used for subsequent LSTM model training.

[0098] Optionally, the process in S3 of inputting the residual sequence into the LSTM sub-model of the time-series fusion prediction module to obtain the residual prediction result may include:

[0099] An LSTM sub-model training set is constructed based on residual sequences and sliding window techniques. The structure of the LSTM sub-model of the time series fusion prediction module is determined. The LSTM sub-model is trained based on the LSTM sub-model training set. The residual prediction results are obtained based on the trained LSTM sub-model.

[0100] In one feasible implementation, the present invention constructs an LSTM (Long Short-Term Memory Neural Network) sub-model to perform nonlinear feature learning and prediction on the residual sequence, and combines temporal dependencies to capture the complex fluctuations of network security situation.

[0101] Specifically, the residual sequence As input to the LSTM sub-model, a sample set is first constructed using the sliding window technique: let the window size be... (Based on the dynamic setting of the 5G kite private network to 248), then the first... The sample is , tag as The LSTM model structure includes: an input layer (the dimension of which is the window size). The LSTM consists of a hidden layer (100 units), an output layer (1 unit, predicting the residual), and uses Tanh activation and Adam optimizer (learning rate 0.001). The gating mechanism of LSTM is calculated as follows:

[0102] Forgotten Gate: In the formula, This represents the Sigmoid function. Represents the weight matrix. Indicates a hidden state. This indicates the bias term.

[0103] Input Gate: In the formula, Represents the weight matrix. Indicates the bias term. Indicates at time Candidate cell state, Represents the weight matrix. This indicates the bias term.

[0104] Cell state: In the formula, Indicates the cell state.

[0105] Output gate: In the formula, Represents the weight matrix. This indicates the bias term.

[0106] Furthermore, an LSTM model is trained using the training set, and an attention mechanism is introduced during training. This involves constructing a feature attention weight matrix, assigning higher weight coefficients to key security event features such as abnormal data packets of control commands, and optimizing the neuron connection parameters corresponding to these key features during backpropagation. This allows the model to dynamically strengthen the influence of key features during learning, ultimately yielding residual prediction results. .

[0107] This invention employs an LSTM modeling method based on residual sequences. Unlike the traditional approach of directly training LSTM with raw data, this invention uses the residual sequences output by ARIMA as the input to the LSTM. A sample set is constructed using a sliding window with a window size of 248. A 100-unit hidden layer and the Adam optimizer are used, allowing the LSTM to focus on learning nonlinear features. This avoids interference from linear components in the raw data on nonlinear modeling, improves the ability to capture sudden security events, and facilitates rapid response in resilient security.

[0108] Optionally, the ARIMA and LSTM sub-models in S3 are trained locally through edge nodes in the power monitoring system. Based on the trained ARIMA and LSTM sub-models, linear trend prediction results and residual prediction results are extracted and uploaded to the central node for global fusion to obtain network security situation prediction results.

[0109] In one feasible implementation, the present invention adopts a distributed-centralized two-level learning architecture. Unlike traditional centralized modeling that ignores local features, the present invention allows edge nodes, such as substations, to train sub-models to extract local situational features, such as terminal communication anomalies. The central node integrates the features of each edge node to achieve global prediction. This not only preserves local details but also grasps the overall trend, significantly improving the ability to identify local sudden threats in heterogeneous networks and strengthening local defenses for resilient security.

[0110] Furthermore, based on the dynamic weight allocation mechanism, the prediction results of ARIMA and LSTM are fused. By calculating the prediction error of the two models in real time, the reciprocal of the error is used as the basis for weight allocation. The fusion ratio of ARIMA prediction results and LSTM prediction results is dynamically adjusted to generate the final prediction value of network security situation. An incremental learning mechanism is introduced to realize the dynamic updating of the model.

[0111] Specifically, the linear prediction results of ARIMA are fused with the residual prediction results of LSTM to obtain the final predicted value:

[0112] (5)

[0113] In one feasible implementation, the present invention employs a time-series fusion prediction mechanism of ARIMA and LSTM. Unlike traditional single models that can only capture linear or nonlinear features, the present invention extracts linear trends, such as periodic attack patterns, from network security situation using ARIMA, while simultaneously using LSTM to learn nonlinear correlations, such as sudden abnormal traffic, in the ARIMA prediction residuals. The results of the two are fused to form the final prediction, achieving for the first time the collaborative modeling of linear and nonlinear features, significantly improving the prediction accuracy of complex network situations, and providing a precise situational basis for resilient security.

[0114] This invention employs a collaborative extraction strategy of linear and nonlinear features, which differs from the traditional model's singular processing of data features. In this invention, ARIMA focuses on analyzing the linear laws of network situation, such as the fluctuation cycle of substation communication load, while LSTM addresses the residual parts that linear learning ARIMA cannot fit, such as signal mutations in telemetry terminals. Through this hierarchical processing mode of "linear benchmark + nonlinear compensation", the model can grasp both the overall trend and capture detailed fluctuations, solving the problem of insufficient fitting of a single model under complex situations and enhancing the situational awareness capability of resilient security.

[0115] S4. Receive new multi-dimensional time series data through a sliding time window and update the parameters in the ARIMA sub-model and LSTM sub-model that are related to the new multi-dimensional time series data.

[0116] In one feasible implementation, to adapt to the dynamic evolution of attack patterns in the 5G kite private network, a sliding time window (with a window size of 30 days) is introduced to receive new data in real time, and an incremental learning update model is adopted: for the ARIMA model, only the autoregressive coefficients related to the new data are re-estimated. and moving average coefficient For the LSTM model, freeze the parameters of the early layers and only update the weights of the output layer and the last hidden layer, as shown in the formula:

[0117] (6)

[0118] In the formula, Indicates the learning rate. Indicates newly added data The loss gradient on.

[0119] Through incremental learning, the model can adapt to new features without retraining the entire network, reducing computational overhead.

[0120] This invention employs an incremental update mechanism for model parameters, which differs from the inefficient mode of full retraining of traditional models. This invention receives new data through a 30-day sliding window, updates only the coefficients related to new features for ARIMA, and updates only the output layer and the weights of the last hidden layer for LSTM when freezing the early layer parameters. This achieves lightweight dynamic updates of the model, enabling the system to respond quickly to new network attacks, reducing the response time from hours to minutes, and ensuring elastic and secure dynamic adaptability.

[0121] S5. By linking the attack signature database and the topology information of the power monitoring system through the situation analysis layer, the network security situation prediction results are decomposed into risk level, attack type and scope of affected nodes, and defense suggestions are generated.

[0122] In one feasible implementation, a situation analysis layer is constructed to transform the prediction results into multi-dimensional security indicators, providing precise defense decision support for the 5G kite private network.

[0123] Specifically, the situational analysis layer associates the attack signature database (such as attack type and scope of impact) with the private network topology information, and... The analysis is broken down into: risk level (0-10, based on comparison of predicted values ​​with thresholds), possible attack types (such as command forgery attacks and covert penetration, determined through residual feature matching), and affected node range (ground / air nodes, combined with topological correlation analysis). Prediction accuracy is evaluated using RMSE (Root Mean Square Error) and MAPE (Mean Absolute Percentage Error).

[0124] (7)

[0125] (8)

[0126] Furthermore, the evaluation results are periodically fed back to the incremental learning module to dynamically adjust the model update frequency and ensure continuous optimization of prediction accuracy.

[0127] This invention employs a multi-dimensional security situation analysis and presentation mechanism, which differs from the traditional mode that only outputs a single situation value. By associating the attack feature library with the system topology, this invention decomposes the prediction results into risk levels, which are divided into 0-10 levels, attack types (i.e., forged instructions and covert infiltration), and the scope of impact (i.e., dispatch center and substation equipment). This generates a multi-dimensional report that can directly support decision-making, solving the problem of insufficient practicality of traditional prediction results and providing accurate decision-making basis for resilient security.

[0128] Meanwhile, this invention adopts a dynamic evaluation and feedback adjustment mechanism for prediction accuracy. Unlike the static evaluation mode, this invention uses RMSE, MAPE and R2_score to evaluate the prediction effect in real time and feeds the results back to the incremental learning module to dynamically adjust the model update frequency, forming a closed loop of "prediction-evaluation-optimization". This ensures that the model can maintain high accuracy and maintain its elastic and secure continuous effectiveness when the network environment changes.

[0129] To address the issues of low accuracy in network security situation prediction and insufficient adaptability to emerging threats in 5G kite-shaped private networks for power monitoring systems operating in dynamic heterogeneous environments, this invention proposes a dynamic network security situation prediction method based on temporal fusion and incremental learning. Its overall architecture is as follows: Figure 3 As shown, this invention first deploys multi-source data acquisition nodes covering various terminal devices, 5G base stations, and 5G core network elements in the power monitoring system to comprehensively acquire multi-dimensional information such as network traffic data, device operation logs, and attack event records. Then, a wavelet transform denoising module is used to remove noise from power grid load fluctuations, electromagnetic interference, and the airspace environment. Based on a fusion feature selection algorithm using information gain and chi-square test, key security features are selected from the denoised data, including abnormal communication frequencies, protocol field tampering identifiers, and device state change parameters. These selected key security features serve as input data for the time-series fusion prediction module, used for training the ARIMA and LSTM sub-models and subsequent prediction processes. Next, the preprocessed time-series data is input into the time-series fusion prediction module, which includes an ARIMA sub-model and an LSTM sub-model. The former captures linear trends such as the periodicity of network attacks, while the latter learns the nonlinear correlation between new attacks and abnormal features. A dynamic weight allocation mechanism adjusts the weights of both models based on real-time prediction errors, and the resulting fusion yields preliminary prediction results. Simultaneously, an incremental learning and update module is introduced. This module receives new security event data through a sliding time window, updating only the parameters in the model related to the new features. The learning rate and update frequency are adjusted based on prediction error feedback, enabling the model to quickly adapt to the evolution of attack methods and changes in the power monitoring system's network environment. Finally, by linking the attack feature library with the power monitoring system's topology information through the situational analysis layer, the prediction results are decomposed into multi-dimensional information such as risk level, attack type, and impact scope, including substations and transmission line segments. Defense suggestions are generated, and these core modules enable in-depth analysis of the network security situation and continuous model evolution. This significantly improves prediction accuracy and real-time performance, ensuring the stable operation of the 5G Kite private network in power monitoring systems in scenarios such as smart grid dispatching and remote area power monitoring.

[0130] This invention proposes a power security situation prediction method based on temporal fusion and incremental learning to systematically solve the following technical problems:

[0131] (1) In view of the difficulty of traditional single models in capturing both linear trends and nonlinear fluctuations in network situation at the same time, such as the periodic changes in equipment communication and the nonlinear characteristics of sudden attacks in power monitoring systems, which leads to limited prediction accuracy, this invention deeply integrates ARIMA and LSTM. ARIMA focuses on extracting linear patterns in time series data, while LSTM specifically learns nonlinear correlation features. The two work together to model and achieve a comprehensive analysis of complex situation features, thereby improving the prediction accuracy of hybrid attack modes and providing a precise situational basis for resilient security.

[0132] (2) In view of the problem that the parameters of traditional models are fixed after training and cannot adapt to the rapid evolution of attack methods in power monitoring systems, such as the continuous emergence of new industrial control protocol attacks, this invention introduces an incremental learning mechanism. By setting a sliding time window to receive new network security event data in real time, only the parameters in the model associated with the new features are updated. There is no need to retrain the entire model, so as to achieve rapid learning and prediction adaptation to emerging threats, reduce the time and computational overhead of model iteration, and ensure the dynamic response capability of elastic security.

[0133] (3) In view of the significant differences in data characteristics between the dispatch center and edge nodes under the heterogeneous topology of the power monitoring system, and the problem that traditional centralized modeling is prone to ignoring local node-specific attacks, this invention adopts a distributed-centralized two-level learning architecture. The edge nodes first train sub-models based on local data to extract local situation features, such as abnormal communication features of substation terminals, and then upload the feature vectors to the central node for global fusion. This enables collaborative prediction of local sudden attacks and global situation evolution, improves the sensitivity of identifying local threats in heterogeneous networks, and strengthens the local defense capability of elastic security.

[0134] (4) To address the problem of insufficient stability of prediction results caused by noise interference in network situation data, such as communication jitter data generated by the electromagnetic environment affecting the power monitoring system, this invention introduces a wavelet transform denoising module in the data preprocessing stage, and dynamically allocates feature weights in the model training by combining the attention mechanism to strengthen the features of key security events, such as the impact of abnormal data packets of control commands, weaken noise interference, improve the robustness of prediction results, and provide stable decision support for elastic security.

[0135] (5) In view of the problem that traditional prediction methods only output a single situation value, which is difficult to support accurate defense decision-making in power monitoring systems, this invention adds a situation analysis layer after the prediction module. By associating the attack feature library with system topology information, the prediction results are decomposed into risk level, possible attack type and affected equipment range, forming a multi-dimensional situation report. This provides fine-grained reference for the formulation of differentiated defense strategies, enhances the practical value of the prediction results, and helps to implement flexible security efficiently.

[0136] The proposed method for dynamic prediction of network security situation based on temporal fusion and incremental learning addresses the dynamic heterogeneity and complex security threats of power monitoring systems. Through multi-dimensional technological innovation, it achieves a comprehensive improvement in prediction accuracy, adaptability, and practicality, providing strong support for resilient security. Specific advantages are as follows:

[0137] 1. Higher Prediction Accuracy, Balancing Linear and Nonlinear Characteristics: Traditional single models such as ARIMA can only capture linear trends, and LSTM is insufficient for fitting linear patterns, making it difficult to handle the mixed linear and nonlinear characteristics in network security situational data. This invention achieves comprehensive analysis of complex situations through deep fusion of ARIMA and LSTM. ARIMA focuses on extracting linear trends, such as the periodic fluctuations in substation communication, while LSTM focuses on learning nonlinear correlations in residuals, such as abrupt changes in abnormal signals from telemetry terminals. The two models work together to achieve comprehensive analysis of complex situations. Experimental results show that the prediction errors (RMSE and MAPE) of the hybrid model are reduced by more than 30% compared to single models, especially performing better in scenarios where load fluctuations and attacks overlap in power monitoring systems, providing a precise basis for situational prediction for resilient security.

[0138] 2. Enhanced Dynamic Adaptability and Real-Time Response to Emerging Threats: Addressing the rapidly evolving attack methods in power monitoring systems, with new industrial control protocol spoofing attacks being a prime example, traditional models require full retraining, resulting in lag. This invention introduces an incremental learning mechanism, receiving new security event data in real-time through a sliding time window. Only parameters associated with new features, such as the output layer weights of LSTM and the moving average coefficients of ARIMA, are updated, without requiring complete model reconstruction. This ensures resilient security's real-time response to dynamic threats.

[0139] 3. Superior robustness and outstanding resistance to noise interference: Power monitoring systems are affected by grid load and electromagnetic environment interference, and the data often contains noise. False alarms due to abnormal traffic caused by communication jitter are common, and traditional models are easily affected by this, leading to prediction bias. This invention introduces wavelet transform denoising during the data preprocessing stage, and combines it with an attention mechanism to dynamically strengthen key features such as the data packet characteristics of control commands during model training, weakening the impact of noise. Especially in complex electromagnetic environments, it can maintain high-precision predictions, providing a stable decision-making basis for resilient security.

[0140] 4. Flexible Deployment, Adaptable to Heterogeneous Network Topologies: Traditional centralized modeling often overlooks specific threats to local nodes, particularly those arising from the heterogeneous topologies of power monitoring system dispatch centers and edge nodes. Malicious code injection risks at substation terminals fall into this category. This invention employs a distributed-centralized two-tier architecture: edge nodes, such as substations, first train sub-models to extract local features, then upload the feature vectors to the central node for fusion, enabling collaborative prediction of both localized sudden attacks and the overall situation. This architecture can dynamically adjust model parameters based on node type, exhibiting significantly better adaptability than traditional unified models, thus enhancing resilient security's local defense capabilities in heterogeneous environments.

[0141] 5. More Precise Decision Support, Outputting Multi-Dimensional Situational Information: Traditional prediction methods only output a single situational value, which is insufficient to support differentiated defense decisions. This invention decomposes the prediction results into multi-dimensional information such as risk level, attack type (e.g., forged commands and covert penetration), and affected equipment scope (e.g., dispatch centers and substations) through a situational analysis layer. It also associates this information with a defense strategy library to generate targeted suggestions such as enhanced authentication for terminal nodes and DDoS mitigation for dispatch networks. This significantly enhances the security protection capabilities of power monitoring systems in scenarios such as smart grids and new energy grid integration, facilitating the efficient implementation of resilient security.

[0142] Figure 4 This is a block diagram illustrating a power security situation prediction device based on temporal fusion and incremental learning, according to an exemplary embodiment. The device is used in a power security situation prediction method based on temporal fusion and incremental learning. (Refer to...) Figure 4 The device includes a multi-source data acquisition module 310, a preprocessing module 320, a time-series fusion prediction module 330, an incremental learning and update module 340, and a situation analysis module 350. Among them:

[0143] The multi-source data acquisition module 310 is used to acquire multi-dimensional time-series data related to network security status through multi-source data acquisition nodes deployed in the power monitoring system; wherein, the power monitoring system includes a 5G kite private network.

[0144] The preprocessing module 320 is used to remove noise from multi-dimensional time series data through a wavelet transform denoising module, and to perform zero-mean processing on the noise-removed time series data to obtain preprocessed time series data.

[0145] The time series fusion prediction module 330 is used to input the preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module to obtain the linear trend prediction result and the residual sequence. The residual sequence is then input into the LSTM sub-model of the time series fusion prediction module to obtain the residual prediction result. The linear trend prediction result and the residual prediction result are combined through a dynamic weight allocation mechanism to obtain the network security situation prediction result.

[0146] The incremental learning update module 340 is used to receive new multi-dimensional time series data through a sliding time window and update the parameters in the ARIMA sub-model and LSTM sub-model that are related to the new multi-dimensional time series data.

[0147] The situation analysis module 350 is used to decompose the network security situation prediction results into risk level, attack type and affected node range by associating the attack signature database and power monitoring system topology information through the situation analysis layer, and generate defense suggestions.

[0148] The proposed method for dynamic prediction of network security situation based on temporal fusion and incremental learning addresses the dynamic heterogeneity and complex security threats of power monitoring systems. Through multi-dimensional technological innovation, it achieves a comprehensive improvement in prediction accuracy, adaptability, and practicality, providing strong support for resilient security. Specific advantages are as follows:

[0149] 1. Higher Prediction Accuracy, Balancing Linear and Nonlinear Characteristics: Traditional single models such as ARIMA can only capture linear trends, and LSTM is insufficient for fitting linear patterns, making it difficult to handle the mixed linear and nonlinear characteristics in network security situational data. This invention achieves comprehensive analysis of complex situations through deep fusion of ARIMA and LSTM. ARIMA focuses on extracting linear trends, such as the periodic fluctuations in substation communication, while LSTM focuses on learning nonlinear correlations in residuals, such as abrupt changes in abnormal signals from telemetry terminals. The two models work together to achieve comprehensive analysis of complex situations. Experimental results show that the prediction errors (RMSE and MAPE) of the hybrid model are reduced by more than 30% compared to single models, especially performing better in scenarios where load fluctuations and attacks overlap in power monitoring systems, providing a precise basis for situational prediction for resilient security.

[0150] 2. Enhanced Dynamic Adaptability and Real-Time Response to Emerging Threats: Addressing the rapidly evolving attack methods in power monitoring systems, with new industrial control protocol spoofing attacks being a prime example, traditional models require full retraining, resulting in lag. This invention introduces an incremental learning mechanism, receiving new security event data in real-time through a sliding time window. Only parameters associated with new features, such as the output layer weights of LSTM and the moving average coefficients of ARIMA, are updated, without requiring complete model reconstruction. This ensures resilient security's real-time response to dynamic threats.

[0151] 3. Superior robustness and outstanding resistance to noise interference: Power monitoring systems are affected by grid load and electromagnetic environment interference, and the data often contains noise. False alarms due to abnormal traffic caused by communication jitter are common, and traditional models are easily affected by this, leading to prediction bias. This invention introduces wavelet transform denoising during the data preprocessing stage, and combines it with an attention mechanism to dynamically strengthen key features such as the data packet characteristics of control commands during model training, weakening the impact of noise. Especially in complex electromagnetic environments, it can maintain high-precision predictions, providing a stable decision-making basis for resilient security.

[0152] 4. Flexible Deployment, Adaptable to Heterogeneous Network Topologies: Traditional centralized modeling often overlooks specific threats to local nodes, particularly those arising from the heterogeneous topologies of power monitoring system dispatch centers and edge nodes. Malicious code injection risks at substation terminals fall into this category. This invention employs a distributed-centralized two-tier architecture: edge nodes, such as substations, first train sub-models to extract local features, then upload the feature vectors to the central node for fusion, enabling collaborative prediction of both localized sudden attacks and the overall situation. This architecture can dynamically adjust model parameters based on node type, exhibiting significantly better adaptability than traditional unified models, thus enhancing resilient security's local defense capabilities in heterogeneous environments.

[0153] 5. More Precise Decision Support, Outputting Multi-Dimensional Situational Information: Traditional prediction methods only output a single situational value, which is insufficient to support differentiated defense decisions. This invention decomposes the prediction results into multi-dimensional information such as risk level, attack type (e.g., forged commands and covert penetration), and affected equipment scope (e.g., dispatch centers and substations) through a situational analysis layer. It also associates this information with a defense strategy library to generate targeted suggestions such as enhanced authentication for terminal nodes and DDoS mitigation for dispatch networks. This significantly enhances the security protection capabilities of power monitoring systems in scenarios such as smart grids and new energy grid integration, facilitating the efficient implementation of resilient security.

[0154] Figure 5 This is a schematic diagram of the structure of a dynamic prediction device for network security status in a power monitoring system provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the network security situation dynamic prediction device for the power monitoring system may include the above-mentioned... Figure 4 The illustrated device is a power security situation prediction device based on time-series fusion and incremental learning. Optionally, the power monitoring system network security situation dynamic prediction device 410 may include a first processor 2001.

[0155] Optionally, the power monitoring system network security situation dynamic prediction device 410 may also include a memory 2002 and a transceiver 2003.

[0156] The first processor 2001, memory 2002, and transceiver 2003 can be connected via a communication bus.

[0157] The following is combined with Figure 5 A detailed introduction to each component of the power monitoring system network security situation dynamic prediction device 410 is provided below:

[0158] The first processor 2001 is the control center of the power monitoring system network security situation dynamic prediction device 410. It can be a single processor or a collective term for multiple processing elements. For example, the first processor 2001 can be one or more central processing units (CPUs), application-specific integrated circuits (ASICs), or one or more integrated circuits configured to implement the embodiments of the present invention, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0159] Optionally, the first processor 2001 can perform various functions of the power monitoring system network security situation dynamic prediction device 410 by running or executing software programs stored in the memory 2002 and calling data stored in the memory 2002.

[0160] In a specific implementation, as one example, the first processor 2001 may include one or more CPUs, for example... Figure 5 CPU0 and CPU1 are shown in the diagram.

[0161] In a specific implementation, as one example, the power monitoring system network security situation dynamic prediction device 410 may also include multiple processors, for example... Figure 5 The first processor 2001 and the second processor 2004 are shown in the diagram. Each of these processors can be a single-core processor or a multi-core processor. Here, a processor can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0162] The memory 2002 is used to store the software program that executes the present invention, and is controlled by the first processor 2001 to execute it. The specific implementation method can be referred to the above method embodiment, and will not be repeated here.

[0163] Optionally, the memory 2002 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory 2002 may be integrated with the first processor 2001 or may exist independently, and may be connected via the interface circuit of the power monitoring system network security situation dynamic prediction device 410. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0164] The transceiver 2003 is used to communicate with network devices or with terminal devices.

[0165] Alternatively, transceiver 2003 may include a receiver and a transmitter. Figure 5 (Not shown separately). The receiver is used to implement the receiving function, and the transmitter is used to implement the transmitting function.

[0166] Optionally, the transceiver 2003 can be integrated with the first processor 2001, or it can exist independently, and can be connected to the interface circuit of the power monitoring system network security situation dynamic prediction device 410. Figure 5 (Not shown in the image) is coupled to the first processor 2001, and this embodiment of the invention does not specifically limit this.

[0167] It should be noted that, Figure 5 The structure of the power monitoring system network security situation dynamic prediction device 410 shown in the figure does not constitute a limitation on the router. The actual knowledge structure identification device may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0168] Furthermore, the technical effect of the power monitoring system network security situation dynamic prediction device 410 can be referred to the technical effect of the power security situation prediction method based on time-series fusion and incremental learning described in the above method embodiments, and will not be repeated here.

[0169] It should be understood that the first processor 2001 in the embodiments of the present invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0170] It should also be understood that the memory in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous DRAM (DDR SDRAM), enhanced synchronous DRAM (ESDRAM), synchronous linked DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0171] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of the present invention are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0172] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0173] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0174] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0175] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0176] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0177] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0178] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0179] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0180] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0181] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A power security situation prediction method based on temporal fusion and incremental learning, characterized in that, The method includes: S1. Obtain multi-dimensional time-series data related to network security status through multi-source data acquisition nodes deployed in the power monitoring system; wherein, the power monitoring system includes a 5G kite private network; S2. The multi-dimensional time series data is denoised by the wavelet transform denoising module. The denoised time series data is then zero-mean processed to obtain the pre-processed time series data. S3. Input the preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module to obtain the linear trend prediction result and the residual sequence. Input the residual sequence into the LSTM sub-model of the time series fusion prediction module to obtain the residual prediction result. Combine the linear trend prediction result and the residual prediction result through a dynamic weight allocation mechanism to obtain the network security situation prediction result. S4. Receive new multi-dimensional time series data through a sliding time window and update the parameters related to the new multi-dimensional time series data in the ARIMA sub-model and LSTM sub-model. S5. By linking the attack signature database and the topology information of the power monitoring system through the situation analysis layer, the network security situation prediction results are decomposed into risk level, attack type and scope of affected nodes, and defense suggestions are generated.

2. The power security situation prediction method based on time-series fusion and incremental learning according to claim 1, characterized in that, In step S3, the preprocessed time series data is input into the ARIMA sub-model of the time series fusion prediction module to obtain linear trend prediction results and residual sequences, including: S31. Perform a stationarity test on the preprocessed time series data, and perform a difference operation on the time series data with non-stationary test results to obtain the stationary time series data corresponding to the non-stationary time series data. Construct an ARIMA sub-model training set based on the stationary time series data with test results and the stationary time series data corresponding to the non-stationary time series data. S32. Construct an ARIMA sub-model for the time series fusion prediction module based on the autocorrelation function, partial autocorrelation function, and Akaike information content criterion; S33. Train the ARIMA sub-model using the ARIMA sub-model training set, obtain the linear trend prediction result based on the trained ARIMA sub-model, and calculate the residual sequence based on the linear trend prediction result; wherein, the residual sequence contains the nonlinear features in the time series data.

3. The power security situation prediction method based on time-series fusion and incremental learning according to claim 2, characterized in that, The prediction formula of the ARIMA sub-model is shown in equation (1) below: （1） In the formula, Indicates at time The predicted value, Indicates at time The actual observed value, Indicates a time index. Represents the autoregressive coefficient. Indicates the order of autoregression. Represents the moving average coefficient. Indicates the order of the moving average. This represents the white noise residual.

4. The power security situation prediction method based on time-series fusion and incremental learning according to claim 1, characterized in that, In step S3, the residual sequence is input into the LSTM sub-model of the time-series fusion prediction module to obtain the residual prediction result, including: LSTM sub-model training set is constructed based on residual sequence and sliding window technique. The structure of LSTM sub-model of temporal fusion prediction module is determined. LSTM sub-model is trained based on LSTM sub-model training set. Residual prediction results are obtained based on trained LSTM sub-model. The LSTM sub-model consists of an input layer, a 100-unit hidden layer, a 1-unit output layer, a Tanh activation function, and an Adam optimizer.

5. The power security situation prediction method based on time-series fusion and incremental learning according to claim 1, characterized in that, The ARIMA and LSTM sub-models in S3 are trained locally through edge nodes in the power monitoring system. Linear trend prediction results and residual prediction results are extracted from the trained ARIMA and LSTM sub-models, and then uploaded to the central node for global fusion to obtain the network security situation prediction results.

6. The power security situation prediction method based on time-series fusion and incremental learning according to claim 1, characterized in that, The S4 step involves updating the parameters in the ARIMA and LSTM sub-models that are related to the new multi-dimensional time series data, including: Re-estimate the autoregressive and moving average coefficients in the ARIMA sub-model that are associated with new multidimensional time series data; Freeze the parameters of the early layers of the LSTM sub-model, and update the weights of the output layer and the last hidden layer.

7. The power security situation prediction method based on time-series fusion and incremental learning according to claim 1, characterized in that, The S5 process decomposes the network security situation prediction results into risk level, attack type, and affected node range, and generates defense recommendations, including: The risk level is obtained by comparing the network security situation prediction results with preset thresholds; the attack type is determined based on the residual sequence; the range of affected nodes is obtained based on the topology information of the power monitoring system; the prediction accuracy of the network security situation prediction results is evaluated using root mean square error and mean absolute percentage error, and the parameter update frequency of the ARIMA sub-model and LSTM sub-model is dynamically adjusted based on the evaluation results.

8. A power security situation prediction device based on temporal fusion and incremental learning, wherein the power security situation prediction device based on temporal fusion and incremental learning is used to implement the power security situation prediction method based on temporal fusion and incremental learning as described in any one of claims 1-7, characterized in that, The device includes: The multi-source data acquisition module is used to acquire multi-dimensional time-series data related to network security status through multi-source data acquisition nodes deployed in the power monitoring system; the power monitoring system includes a 5G kite private network. The preprocessing module is used to remove noise from multi-dimensional time series data through the wavelet transform denoising module, and to perform zero-mean processing on the noise-removed time series data to obtain preprocessed time series data. The time series fusion prediction module is used to input preprocessed time series data into the ARIMA sub-model of the time series fusion prediction module to obtain linear trend prediction results and residual sequences. The residual sequences are then input into the LSTM sub-model of the time series fusion prediction module to obtain residual prediction results. The linear trend prediction results and residual prediction results are combined through a dynamic weight allocation mechanism to obtain network security situation prediction results. The incremental learning update module is used to receive new multi-dimensional time series data through a sliding time window and update the parameters in the ARIMA sub-model and LSTM sub-model that are related to the new multi-dimensional time series data. The situation analysis module is used to decompose the network security situation prediction results into risk level, attack type and affected node range by associating the attack signature database and power monitoring system topology information through the situation analysis layer, and generate defense suggestions.

9. A dynamic prediction device for network security status in a power monitoring system, characterized in that, The power monitoring system network security situation dynamic prediction device includes: processor; A memory storing computer-readable instructions that, when executed by the processor, implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium contains program code that can be invoked by a processor to execute the method as described in any one of claims 1 to 7.

Images