Power monitoring system network security threat identification method and system based on domain self-adaption

Abstract

The invention relates to the field of power monitoring system network security threat identification, in particular to a domain self-adaption-based power monitoring system network security threat identification method and system. Obtaining to-be-identified measurement data in the power monitoring system, and inputting the to-be-identified measurement data into a pre-trained domain adaptive threat identification model to obtain a threat identification result; according to the method, the nonlinear oscillation modes in the measurement data of the source domain and the target domain are captured through Koopman modal decomposition, and feature representation more suitable for cross-domain adaptation is provided. According to the introduced self-supervised prototype learning method, through learning discriminative feature representation in a target domain, excessive dependence on source domain supervision is reduced, the problem that detection performance is reduced in a domain offset scene is effectively solved, and the accuracy and robustness of power monitoring system network security threat identification are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of attack detection in power monitoring systems, and specifically to a method and system for identifying network security threats in power monitoring systems based on domain adaptation. Background Technology

[0002] With the rapid development of power communication and digital technologies, traditional power systems are gradually transforming into new information-based and intelligent power systems. Power monitoring systems are moving from closed to open systems, leading to a high dependence on advanced technologies such as sensing, control, and communication, making them more vulnerable to cyberattacks. Malicious cyberattacks exploit vulnerabilities at the physical and network layers, such as spoofing attacks, replay attacks, and denial-of-service attacks, potentially infiltrating critical infrastructure, manipulating control systems, and causing significant economic losses and widespread power outages. Therefore, establishing an effective cybersecurity threat identification mechanism is crucial for ensuring the security of smart grids.

[0003] With the rapid development of phasor measurement units (PMUs) and advanced metrology infrastructure, a large amount of high-dimensional, time-synchronized measurement data has been collected, which is beneficial for the application of data-driven technologies in cybersecurity threat identification. Machine learning-based data-driven methods utilize historical measurement data to learn threat patterns and have demonstrated high efficiency in cybersecurity threat identification due to their powerful feature extraction capabilities and flexible scalability. However, these methods typically follow the fundamental assumption that the data distribution is the same during the training and deployment phases, which may not hold true in many scenarios.

[0004] In practical applications, the dimensionality and distribution of measurement data change when system configuration changes (such as modifications to meters, generators, and loads) or when a trained threat identification model is deployed to a new power grid with different topology information. In such cases, domain offset exists between the training and deployment systems, and directly using a pre-trained identification model may lead to a significant reduction in threat identification performance. Furthermore, collecting and labeling measurement data for the deployment domain is a time-consuming and labor-intensive process. This highlights the importance of domain adaptation, which aims to transfer knowledge from the labeled source domain to the unlabeled target domain. Domain adaptation methods are more practical in smart grid applications because they eliminate the need for extensive data labeling and enable threat identification models to adapt to deployments in different scenarios.

[0005] While domain adaptation holds great promise, its core challenge lies in minimizing cross-domain distributional discrepancies while reducing the lower bound of the target error; that is, finding a feature space that allows the distributions of samples from the source and target domains to align well. Many existing methods align marginal distributions using statistical measures such as maximum mean difference. Some researchers have attempted to learn domain-invariant features through domain discriminator networks. While these methods have been successful in reducing global domain shifts, they often neglect instance-level feature alignment, which better preserves class-specific information. Furthermore, current mainstream methods focus on aligning feature representations across domains to enable the model to generalize to the target domain. However, over-reliance on source domain supervision during representation learning can lead to neglecting discriminative representations within the target domain. Recent studies have used partially labeled target data for fine-tuning to achieve better recognition performance, but this requires manual annotation and ignores the use of intrinsic target information. Additionally, transient changes in the system due to attacks cause the system dynamics model to exhibit high nonlinearity, posing an additional challenge to the generalization ability of data-driven methods. Summary of the Invention

[0006] To address the problems mentioned in the prior art, this invention proposes a method and system for identifying network security threats in power monitoring systems based on domain adaptation. This method can effectively address the distribution differences between the source and target domains and achieve good identification accuracy on unlabeled target domain data.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: This invention proposes a domain-adaptive-based method for identifying network security threats in power monitoring systems, comprising the following steps: Acquire the measurement data to be identified in the power monitoring system, input the measurement data to be identified into a pre-trained domain adaptive threat identification model, and obtain the threat identification result of the measurement data to be identified. The training process of the domain-adaptive attack detection model is as follows: Acquire measurement data from a power monitoring system, the measurement data including labeled source domain measurement data and unlabeled target domain measurement data; Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features. Joint optimization is achieved based on contrastive learning and self-supervised learning, including classifying source domain features to obtain source domain classification loss; performing self-supervised learning on target domain features to obtain self-supervised learning loss; and performing global distribution alignment and instance-level feature alignment on source domain features and target domain features respectively to obtain global distribution alignment loss and instance-level feature alignment loss. The source domain classification loss, self-supervised learning loss, global distribution alignment loss, and instance-level feature alignment loss are weighted and summed to obtain the joint optimization objective function. The parameters of the adaptive threat identification model are updated by minimizing the joint optimization objective function to obtain the trained domain adaptive threat identification model.

[0008] As a further improvement of this invention, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data based on Koopman mode decomposition to obtain source domain features and target domain features, including: The process of Koopman mode decomposition for both the labeled source domain measurement data and the unlabeled target domain measurement data is the same: Construct a learning window, L= ,in, Indicates the current time step. Indicates the prediction window size. Indicates the size of the learning window; Measurement data is captured through a learning window, and an empirical Koopman operator is constructed based on the measurement sequence. ; Based on experience, the Koopman operator Calculate the measurement values ​​within the prediction window; Extracting the Koopman mode, its expression is:

[0009] In the formula: These are Koopman eigenvalues; It is a Koopman mode; Based on the measured values ​​and actual values ​​within the prediction window, an error sequence is obtained, and the Koopman mode is extracted from the error sequence. Koopman mode The input is fed into the encoder to obtain source domain features or target domain features.

[0010] As a further improvement of the present invention, the source domain feature classification processing is performed to obtain the source domain classification loss, including: obtaining the source domain classification loss through the following formula. :

[0011] In the formula: Indicates the number of samples in the source domain; Indicates the first The true labels of the source domain samples; Represents a classifier; Indicates the first Individual source domain features.

[0012] As a further improvement of this invention, self-supervised learning is performed on the target domain features to obtain a self-supervised learning loss, including: Inter-class separability optimization is performed on the target domain features and prototype vectors to obtain the inter-class separability loss; Intra-class consistency optimization is performed on the target domain features and nearest neighbor samples to obtain intra-class consistency loss; Combining the inter-class separability loss with the intra-class consistency loss yields the self-supervised learning loss.

[0013] As a further improvement to the present invention, the inter-class separability loss We obtain it from the following formula:

[0014] In the formula: Indicates the batch size of the target domain samples; Indicates the number of prototype vectors; Represents the soft-assignment matrix element, representing the first element. The target domain feature is assigned to the first... The probability of a prototype; Indicates the first Each target domain feature; Indicates the first One prototype vector; For temperature parameters, ; The intra-class consistency loss We obtain it from the following formula:

[0015] In the formula: This indicates the first item retrieved from the memory queue. The nearest neighbor features of each target domain feature; Indicates the first One prototype vector; This represents the elements of the extended soft-assignment matrix.

[0016] As a further improvement of this invention, global distribution alignment and instance-level feature alignment are performed on the source domain features and target domain features respectively, resulting in global distribution alignment loss and instance-level feature alignment loss, including: The global distribution alignment loss is obtained using the following formula. :

[0017] In the formula: The cost matrix; , representing the absolute distance between source domain features and target domain features; Represents the optimal transmission plan matrix; and These represent the number of samples in the source and target domains, respectively. The first element of the optimal transmission plan matrix represents the... One element; Indicates feature dimension; The instance-level feature alignment loss is obtained using the following formula. :

[0018] In the formula: and These are the number of features in the target domain and the number of features in the source domain, respectively. For temperature parameters, ; Indicates the first Target domain features Nearest neighbor features in the source domain; Indicates the first Individual source domain features; For temperature parameters, .

[0019] As a further improvement to the present invention, a joint optimization objective function is obtained, including: The joint optimization objective function is obtained through the following formula. :

[0020] In the formula: The source domain classification loss; The loss is the global distribution alignment loss. The loss is for instance-level feature alignment. Loss due to self-supervised learning; , and This is a hyperparameter.

[0021] A domain-adaptive power monitoring system network security threat identification system includes: The acquisition module is used to acquire the measurement data to be identified in the power monitoring system; The detection module is used to input the measurement data to be identified into a pre-trained domain adaptive threat identification model to obtain the threat identification result of the measurement data to be identified. The training process of the domain-adaptive attack detection model is as follows: Acquire measurement data from a power monitoring system, the measurement data including labeled source domain measurement data and unlabeled target domain measurement data; Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features. Joint optimization is achieved based on contrastive learning and self-supervised learning, including classifying source domain features to obtain source domain classification loss; performing self-supervised learning on target domain features to obtain self-supervised learning loss; and performing global distribution alignment and instance-level feature alignment on source domain features and target domain features respectively to obtain global distribution alignment loss and instance-level feature alignment loss. The source domain classification loss, self-supervised learning loss, global distribution alignment loss, and instance-level feature alignment loss are weighted and summed to obtain the joint optimization objective function. The parameters of the adaptive threat identification model are updated by minimizing the joint optimization objective function to obtain the trained domain adaptive threat identification model.

[0022] A domain-adaptive power monitoring system network security threat identification device includes a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the domain-adaptive power monitoring system network security threat identification method described above.

[0023] A computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the domain-adaptive power monitoring system network security threat identification method described above.

[0024] Compared with the prior art, the present invention achieves the following technical effects: This invention utilizes Koopman mode decomposition to capture nonlinear oscillation modes in source and target domain measurement data, providing feature representations more suitable for cross-domain adaptation. The proposed hierarchical feature alignment strategy combines global distribution alignment and instance-level feature alignment, reducing the distributional differences between the source and target domains while preserving class-specific information, avoiding the problem of focusing only on edge distribution alignment while neglecting conditional distribution. Furthermore, the self-supervised prototype learning method introduced in this invention reduces over-reliance on source domain supervision by learning discriminative feature representations within the target domain, effectively addressing the performance degradation problem in domain offset scenarios, and significantly improving the accuracy and robustness of network security threat identification in power monitoring systems. Attached Figure Description

[0025] Figure 1 This is a flowchart illustrating the network security threat identification process according to an embodiment of the present invention.

[0026] Figure 2 This is a topology diagram of the IEEE 68-node standard test system according to an embodiment of the present invention. Detailed Implementation

[0027] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, the accompanying drawings show only the parts relevant to the present invention, and not all of the structures.

[0028] See Figure 1 This invention proposes a domain-adaptive-based method for identifying network security threats in power monitoring systems, comprising the following steps: Acquire the measurement data to be identified in the power monitoring system, input the measurement data to be identified into a pre-trained domain adaptive threat identification model, and obtain the threat identification result of the measurement data to be identified. The training process of the domain-adaptive attack detection model is as follows: Acquire measurement data from a power monitoring system, the measurement data including labeled source domain measurement data and unlabeled target domain measurement data; Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features. Joint optimization is achieved based on contrastive learning and self-supervised learning, including classifying source domain features to obtain source domain classification loss; performing self-supervised learning on target domain features to obtain self-supervised learning loss; and performing global distribution alignment and instance-level feature alignment on source domain features and target domain features respectively to obtain global distribution alignment loss and instance-level feature alignment loss. The source domain classification loss, self-supervised learning loss, global distribution alignment loss, and instance-level feature alignment loss are weighted and summed to obtain the joint optimization objective function. The parameters of the adaptive threat identification model are updated by minimizing the joint optimization objective function to obtain the trained domain adaptive threat identification model.

[0029] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments: Step 1: Obtain measurement data from the power monitoring system. The measurement data includes labeled source domain measurement data and unlabeled target domain measurement data.

[0030] Step 2: Predict using the empirical Koopman operator and select the learning window size. Constructing a learning window L= ,in Indicates the current time step. This indicates the size of the prediction window.

[0031] Learning Window Capture Measurement Sequence ,and .

[0032] Constructing the empirical Koopman operator Its expression is as follows:

[0033] In the formula: , , express The false rebellion.

[0034] Based on experience, the Koopman operator Calculate the prediction window The measurement values ​​in the prediction window can be obtained using the following formula:

[0035] Extracting the Koopman mode, its expression is:

[0036] In the formula: These are Koopman eigenvalues; It is a Koopman mode; it satisfies .

[0037] The error sequence is calculated by the difference between the predicted and actual values. Experienced Koopman modality It can be obtained from the error sequence.

[0038] The source domain features in the embodiment are The obtained Koopman mode Input to encoder To obtain, that is ,in This represents the Koopman mode extracted from the error sequence of the source domain.

[0039] The source domain features in the embodiment are The obtained Koopman mode Input to encoder To obtain, that is ,in This represents the Koopman mode extracted from the error sequence of the target domain.

[0040] Step 3: In this embodiment, Sinkhorn divergence is used for distribution alignment. Sinkhorn divergence is an entropy-regularized optimal transport (OT) distance used to measure the difference between two probability distributions.

[0041] To make it clear, and These represent the encoders from the source and destination domains, respectively. The learned representation will be a vector and The sample can be viewed as coming from two discrete probability distributions. The formula for global feature alignment is:

[0042]

[0043] In the formula: It is a cost matrix, elements It measures the absolute distance between features in the source and target domains; Indicates a uniform margin and The set of joint probability distributions, It is the entropy regularization term, with a coefficient of . Based on the known facts of optimal transport theory, the optimization problem has a unique solution. ,in Scaling factor vector and\ Obtained through fixed-point iteration: , ,in This represents element division.

[0044] Globally distributed alignment loss in the example For optimal transmission plan The total transmission cost is obtained by the following formula:

[0045] In the formula: The cost matrix; , representing the absolute distance between source domain features and target domain features; Represents the optimal transmission plan matrix; and These represent the number of samples in the source and target domains, respectively. The first element of the optimal transmission plan matrix represents the... One element; Indicates the feature dimension.

[0046] This embodiment builds upon global alignment by implementing fine-grained alignment, matching samples of the same category between the source and target domains. Specifically, it uses KM features to pair each target domain sample with its most similar corresponding sample in the source domain. This is achieved by minimizing the instance-level feature alignment loss. To achieve feature alignment, the expression is as follows:

[0047] In the formula: and These are the number of features in the target domain and the number of features in the source domain, respectively. For temperature parameters, ; Indicates the first Target domain features Nearest neighbor features in the source domain; Indicates the first Individual source domain features; For temperature parameters; .

[0048] To learn discriminative feature representations within the target domain while reducing reliance on source domain supervision, a self-supervised prototype learning method is proposed.

[0049] First, inter-class separability is achieved by treating the mapping between target domain features and prototype vectors as an optimal transfer problem. Given a set of target domain features... A group prototype vectors As the representation center, the cosine similarity matrix between features and prototypes. The calculation is as follows:

[0050] in, Indicates from the memory queue Nearest neighbor retrieval is performed by solving the cost matrix. Obtaining the soft allocation matrix for the OT problem The row and column boundary constraints are set as follows: and .

[0051] This problem is solved using the Sinkhorn-Knopp algorithm. To enhance inter-class separability, the inter-class separability loss is minimized. :

[0052] In the formula: Indicates the batch size of the target domain samples; Indicates the number of prototype vectors; Represents the soft-assignment matrix element, representing the first element. The target domain feature is assigned to the first... The probability of a prototype; Indicates the first Each target domain feature; Indicates the first One prototype vector; For temperature parameters, .

[0053] Intra-class consistency is promoted by exchanging predictions between target features and their nearest neighbors retrieved from the memory queue, for each feature. from Find its nearest neighbor Therefore, the intra-class consistency loss is defined as:

[0054] In the formula: This indicates the first item retrieved from the memory queue. The nearest neighbor features of each target domain feature; Indicates the first One prototype vector; This represents the elements of the extended soft-assignment matrix.

[0055] The overall goal of target domain representation learning is a combination of inter-class separability loss and intra-class consistency loss, as shown in the following equation:

[0056] It can help to effectively adapt to the target domain and improve the accuracy and reliability of attack detection.

[0057] The example performs source domain feature classification processing, and the source domain classification loss is obtained by the following formula. :

[0058] In the formula: Indicates the number of samples in the source domain; Indicates the first The true labels of the source domain samples; Represents a classifier; Indicates the first Individual source domain features.

[0059] The framework of this invention optimizes by minimizing the following objective function:

[0060] in, , and It is a hyperparameter that controls the contribution of each component.

[0061] This invention comprises two phases: a training phase that optimizes the overall objective function containing multiple loss terms, and an inference phase that only requires the trained encoder. and classifier To achieve efficient predictions, a learnable prototype is defined by a single-layer classifier without bias terms. accomplish.

[0062] Once the trained domain-adaptive threat identification model is obtained, the measurement data to be identified is input into the trained encoder. and classifier The system performs cybersecurity threat identification and obtains the identification results.

[0063] join Figure 2 This invention presents a topology diagram of the IEEE 68-node standard test system according to an embodiment of the invention. The experiment uses the GridSTAGE (SpatioTemporal Adversarial Scenario GEneration) framework to generate measurement data. GridSTAGE can model the network physical system of power grids and generate multivariate spatiotemporal data by simulating adversarial scenarios. In the experiment, a ramp attack was chosen to verify the effectiveness of the method of the invention. A ramp attack gradually modifies the original PMU measurement data by adding a linearly increasing or decreasing ramp function over the attack duration until a predetermined maximum deviation is reached. Specifically, the deviation is set to 0.7%, and it is assumed that the attacker can access and manipulate all PMU measurement data.

[0064] In this embodiment, the following domain offset scenario is constructed: Both the source and target domain data come from the IEEE 68-node test system, but the resistance and reactance of the default line parameters in the target domain have been modified within the range of 0 to 2%, and the attack parameters such as the attack location and the number of attack nodes vary randomly in the source and target domains.

[0065] In this scenario, the source domain dataset contains 3000 training samples and 700 validation samples, while the target domain dataset contains 3000 training samples and 700 test samples. The proportions of normal and attacked measurements are balanced across all data subsets. Each data point is a multivariate time series collected within an 8-second window at a sampling rate of 50Hz. Notably, all data in the source domain are labeled, while all data in the target domain are unlabeled.

[0066] The method of this invention is compared with the following benchmark methods: Supervised learning (SL): The model is trained on source domain data and applied directly to the target domain without any adaptation. It is used to demonstrate how domain offset affects recognition accuracy. DANN: An unsupervised domain adaptive method that uses a domain discriminator to learn domain-invariant features; The accuracy metric is used to intuitively measure overall recognition performance. The formula for calculating the accuracy metric is as follows:

[0067] Wherein, TP, TN, FP, and FN represent correctly classified attacked samples, correctly classified normal samples, incorrectly classified normal samples, and incorrectly classified attacked samples, respectively.

[0068] Table 1

[0069] Table 1 shows the experimental results of the recognition accuracy of the proposed method and the baseline methods. It can be seen that the proposed method significantly outperforms all benchmark methods in the domain-shift scenario. Traditional supervised learning (SL) methods exhibit severe performance degradation when directly applied to the target domain, with an accuracy decrease of 25% compared to the source domain. This indicates that domain shift poses a challenge to the generalization ability of cybersecurity threat identification models in smart grids. Domain adaptation methods show improved results compared to SL, with DANN showing a 15.2% decrease in accuracy compared to the source domain, while the proposed method maintains the smallest accuracy decrease, at only 6.5%.

[0070] Table 2

[0071] Table 2 shows the ablation experiments of the proposed method. It can be seen that removing any single component leads to a performance degradation. These results verify that the combination of all proposed components in this invention achieves optimal performance, with each component making a significant contribution to domain adaptation and recognition accuracy.

[0072] Based on the same inventive concept, this invention also provides a domain-adaptive power monitoring system network security threat identification system. Since the principle of this domain-adaptive power monitoring system network security threat identification system is similar to that of the aforementioned domain-adaptive power monitoring system network security threat identification method, the implementation of this domain-adaptive power monitoring system network security threat identification system can refer to the implementation of the domain-adaptive power monitoring system network security threat identification method, and the repeated parts will not be described again.

[0073] In practical implementation, the acquisition module is used to acquire the measurement data to be identified in the power monitoring system; The detection module is used to input the measurement data to be identified into a pre-trained domain adaptive threat identification model to obtain the threat identification result of the measurement data to be identified. The training process of the domain-adaptive attack detection model is as follows: Acquire measurement data from a power monitoring system, the measurement data including labeled source domain measurement data and unlabeled target domain measurement data; Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features. Joint optimization is achieved based on contrastive learning and self-supervised learning, including classifying source domain features to obtain source domain classification loss; performing self-supervised learning on target domain features to obtain self-supervised learning loss; and performing global distribution alignment and instance-level feature alignment on source domain features and target domain features respectively to obtain global distribution alignment loss and instance-level feature alignment loss. The source domain classification loss, self-supervised learning loss, global distribution alignment loss, and instance-level feature alignment loss are weighted and summed to obtain the joint optimization objective function. The parameters of the adaptive threat identification model are updated by minimizing the joint optimization objective function to obtain the trained domain adaptive threat identification model.

[0074] Accordingly, this embodiment of the invention also provides a domain-adaptive power monitoring system network security threat identification device, including a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the domain-adaptive power monitoring system network security threat identification method provided by this embodiment of the invention.

[0075] For more detailed information on the above methods, please refer to the relevant content disclosed in the foregoing embodiments, which will not be repeated here.

[0076] Accordingly, embodiments of the present invention also provide a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the above-described domain-adaptive power monitoring system network security threat identification method provided in the embodiments of the present invention.

[0077] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems, devices, and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0078] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0079] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0080] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0081] The foregoing has provided a detailed description of the network security threat identification method, system, device, and storage medium for a domain-adaptive power monitoring system provided by this invention. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

Claims

1. A method for identifying network security threats in a power monitoring system based on domain adaptation, characterized in that, Includes the following steps: Acquire the measurement data to be identified in the power monitoring system, input the measurement data to be identified into a pre-trained domain adaptive threat identification model, and obtain the threat identification result of the measurement data to be identified. The training process of the domain-adaptive attack detection model is as follows: Acquire measurement data from a power monitoring system, the measurement data including labeled source domain measurement data and unlabeled target domain measurement data; Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features. Joint optimization is achieved based on contrastive learning and self-supervised learning, including classifying source domain features to obtain source domain classification loss; performing self-supervised learning on target domain features to obtain self-supervised learning loss; and performing global distribution alignment and instance-level feature alignment on source domain features and target domain features respectively to obtain global distribution alignment loss and instance-level feature alignment loss. The source domain classification loss, self-supervised learning loss, global distribution alignment loss, and instance-level feature alignment loss are weighted and summed to obtain the joint optimization objective function. The parameters of the adaptive threat identification model are updated by minimizing the joint optimization objective function to obtain the trained domain adaptive threat identification model.

2. The method for identifying network security threats in a power monitoring system based on domain adaptation according to claim 1, characterized in that, Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features, including: The process of Koopman mode decomposition for both the labeled source domain measurement data and the unlabeled target domain measurement data is the same: Construct a learning window, L= ,in, Indicates the current time step. Indicates the prediction window size. Indicates the size of the learning window; Measurement data is captured through a learning window, and an empirical Koopman operator is constructed based on the measurement sequence. ; Based on experience, the Koopman operator Calculate the measurement values ​​within the prediction window; Extracting the Koopman mode, its expression is: In the formula: These are Koopman eigenvalues; It is a Koopman mode; Based on the measured values ​​and actual values ​​within the prediction window, an error sequence is obtained, and the Koopman mode is extracted from the error sequence. Koopman mode The input is fed into the encoder to obtain source domain features or target domain features.

3. The method for identifying network security threats in a power monitoring system based on domain adaptation as described in claim 1, characterized in that, The source domain features are classified to obtain the source domain classification loss, which is calculated using the following formula: : In the formula: Indicates the number of samples in the source domain; Indicates the first The true labels of the source domain samples; Represents a classifier; Indicates the first Individual source domain features.

4. The method for identifying network security threats in a power monitoring system based on domain adaptation according to claim 1, characterized in that, Self-supervised learning is performed on the features of the target domain to obtain the self-supervised learning loss, including: Inter-class separability optimization is performed on the target domain features and prototype vectors to obtain the inter-class separability loss; The intra-class consistency optimization is performed on the target domain features and nearest neighbor samples to obtain the intra-class consistency loss. Combining the inter-class separability loss with the intra-class consistency loss yields the self-supervised learning loss.

5. The method for identifying network security threats in a power monitoring system based on domain adaptation according to claim 4, characterized in that, The inter-class separability loss We obtain it from the following formula: In the formula: Indicates the batch size of the target domain samples; Indicates the number of prototype vectors; Represents the soft-assignment matrix element, representing the first element. The target domain feature is assigned to the first... The probability of a prototype; Indicates the first Each target domain feature; Indicates the first One prototype vector; For temperature parameters, ; The intra-class consistency loss We obtain it from the following formula: In the formula: This indicates the first item retrieved from the memory queue. The nearest neighbor features of each target domain feature; Indicates the first One prototype vector; This represents the elements of the extended soft-assignment matrix.

6. The method for identifying network security threats in a power monitoring system based on domain adaptation according to claim 1, characterized in that, Global distribution alignment and instance-level feature alignment are performed on source domain features and target domain features respectively, resulting in global distribution alignment loss and instance-level feature alignment loss, including: The global distribution alignment loss is obtained using the following formula. : In the formula: The cost matrix; , representing the absolute distance between source domain features and target domain features; Represents the optimal transmission plan matrix; and These represent the number of samples in the source domain and the target domain, respectively. The first element of the optimal transmission plan matrix represents the... One element; Indicates the feature dimension; The instance-level feature alignment loss is obtained using the following formula. : In the formula: and These are the number of features in the target domain and the number of features in the source domain, respectively. For temperature parameters, ; Indicates the first Target domain features Nearest neighbor features in the source domain; Indicates the first Individual source domain features; For temperature parameters, .

7. The method for identifying network security threats in a power monitoring system based on domain adaptation according to claim 1, characterized in that, The joint optimization objective function is obtained, including: The joint optimization objective function is obtained through the following formula. : In the formula: The source domain classification loss; The loss is the global distribution alignment loss. The loss is for instance-level feature alignment. Loss due to self-supervised learning; , and This is a hyperparameter.

8. A domain-adaptive power monitoring system network security threat identification system, characterized in that, include: The acquisition module is used to acquire the measurement data to be identified in the power monitoring system; The detection module is used to input the measurement data to be identified into a pre-trained domain adaptive threat identification model to obtain the threat identification result of the measurement data to be identified. The training process of the domain-adaptive attack detection model is as follows: Acquire measurement data from a power monitoring system, the measurement data including labeled source domain measurement data and unlabeled target domain measurement data; Based on Koopman mode decomposition, feature extraction is performed on labeled source domain measurement data and unlabeled target domain measurement data to obtain source domain features and target domain features. Joint optimization is achieved based on contrastive learning and self-supervised learning, including classifying source domain features to obtain source domain classification loss; performing self-supervised learning on target domain features to obtain self-supervised learning loss; and performing global distribution alignment and instance-level feature alignment on source domain features and target domain features respectively to obtain global distribution alignment loss and instance-level feature alignment loss. The source domain classification loss, self-supervised learning loss, global distribution alignment loss, and instance-level feature alignment loss are weighted and summed to obtain the joint optimization objective function. The parameters of the adaptive threat identification model are updated by minimizing the joint optimization objective function to obtain the trained domain adaptive threat identification model.

9. A network security threat identification device for a power monitoring system based on domain adaptation, characterized in that, It includes a processor and a memory, wherein the processor executes a computer program stored in the memory to implement the domain-adaptive power monitoring system network security threat identification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store a computer program, wherein the computer program, when executed by a processor, implements the domain-adaptive power monitoring system network security threat identification method as described in any one of claims 1 to 7.

Images