Attack behavior analysis engine construction method based on deep learning

Abstract

The invention discloses an attack behavior analysis engine construction method and system based on deep learning, and belongs to the technical field of power system network security. The method comprises the following steps of: firstly, performing deep syntax tree analysis on an electric power industrial control protocol by constructing a multilayer feature extraction module for business semantic decoupling, and realizing semantic mapping from a network message to a business operation intention and generating a three-dimensional feature tensor in combination with a pre-constructed electric power business knowledge graph; secondly, designing a dynamic adversarial training mechanism, synthesizing a high-simulation adversarial sample by adopting a Wasserstein generative adversarial network obeying power business logic constraints, and continuously optimizing the robustness of the detection model; and finally, establishing a topology-aware graph neural network attack detection model, converting an equipment connection relationship of physical scenes such as a transformer substation into a graph structure, and analyzing a cross-node attack propagation chain by using a graph convolutional network. According to the method, the detection precision and the response speed of complex attacks such as advanced persistent threats are remarkably improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system network security, and more particularly to a deep learning-based attack behavior analysis engine construction method and system. BACKGROUND

[0002] The power system is a key information infrastructure related to the national economy and people's livelihood, and its stable operation highly depends on a complex industrial control system ICS, usually referred to as a supervisory control and data acquisition SCADA system. In recent years, with the deep integration of informatization and industrialization, the power ICS network has evolved from being closed to being open, with a large number of general-purpose TCP / IP protocols and commercial hardware devices being adopted. While this has improved efficiency, it has also introduced unprecedented network security risks. Network attacks on the power system, especially advanced persistent threats APT, have become a major global security challenge, with their attack methods becoming increasingly covert, complex, and customized.

[0003] Currently, attack detection technologies for protecting the power ICS network mainly have the following deficiencies: First, the feature extraction dimension is single, and the semantic understanding ability is poor. Traditional network intrusion detection systems NIDS mainly rely on analysis of shallow features of network packets, such as IP five-tuple, packet length, and fixed payload signature codes. However, industrial control protocols in the power system have strong domain-specificity, and attackers can carefully construct attack packets that are completely compliant in syntax but malicious in business logic. Such attacks can easily bypass syntax and signature-based detection, and existing technologies lack the ability to understand the real intent behind power business operations and context-related analysis.

[0004] Second, the model is static and fixed, with poor robustness and adaptability. To deal with unknown attacks, some research has begun to introduce machine learning, especially deep learning technology. However, research has shown that deep learning models themselves are vulnerable and can be easily attacked by adversarial samples. Attackers only need to make minor, imperceptible perturbations to malicious traffic to deceive the model and cause it to misjudge abnormal traffic as normal. In addition, existing models are mostly offline trained, and once deployed, the model parameters are fixed and cannot be changed. In the face of APT attacks with evolving attack methods, the model cannot quickly adapt and learn new attack patterns.

[0005] Third, the analysis perspective is isolated, and there is a lack of global insight into coordinated attacks. Current attack detection systems usually analyze a single network session or a single device as a unit, and examine its traffic or log data in isolation. This kind of analysis method, which only looks at a part of the picture, cannot effectively deal with complex, cross-device, multi-stage coordinated attacks. APT attacks often present a clear attack chain, and at each link of the attack chain, the attacker's behavior may be very slight and scattered, making it difficult for a single node detector to discover the relevance.

[0006] Fourthly, data collection faces the challenge of integrity and real-time performance. The performance of deep learning models is highly dependent on the quality of input data. The power SCADA network carries a large amount of real-time monitoring data at high speed. When facing high throughput or traffic bursts, the traditional software packet capture method is prone to data packet loss. The loss of data packets will destroy the integrity of the industrial control protocol interaction and seriously affect the accuracy of subsequent deep learning model analysis.

[0007] Therefore, there is an urgent need for a new attack behavior analysis method that can deeply understand the semantics of power business, has dynamic adaptation and robustness against attacks, and can discover coordinated attacks from a global topology perspective, in order to effectively deal with complex network threats to modern power systems. SUMMARY

[0008] In view of the above technical deficiencies, the present application discloses a deep learning-based attack behavior analysis engine construction method and system. The method deeply integrates power business domain knowledge and advanced deep learning models to construct an integrated attack detection framework with business semantic decoupling, dynamic adversarial training, and topology-aware analysis capabilities, aiming to significantly improve the recognition accuracy and response capability of complex and hidden attack behaviors in power industrial control systems.

[0009] In order to achieve the above technical effects, the present application adopts the technical solutions of claims 1-9: A deep learning-based attack behavior analysis engine construction method, comprising: Step 1, business semantic decoupling and multi-layer feature extraction, the real-time captured power system network traffic is parsed, the business instructions are understood and contextually associated based on the pre-constructed power business knowledge graph, and a three-dimensional feature tensor containing protocol layer, business layer and operation layer information is generated; Step 2, dynamic adversarial training and model robustness enhancement, using a generative adversarial network, generating high-similarity adversarial attack samples according to the power system business logic and state transition constraints, continuously improving the generalization ability and defense capability of the detection model against unknown attacks through adversarial training; Step 3, topology awareness and attack chain analysis, modeling the power system physical devices and their connection relationships as a topology graph structure, using a graph convolution network to learn the propagation and association rules of network traffic features between device nodes, thereby realizing the identification and tracing of cross-device, multi-stage coordinated attack chains.

[0010] As a further embodiment of the present application, the business semantic decoupling and multi-layer feature extraction step specifically comprises: S1, original network traffic capture and filtering; S2, protocol syntax tree deep parsing; S3, power business knowledge graph construction and association; S4, three-dimensional feature tensor generation.

[0011] As a further embodiment of the application, the dynamic adversarial training and model robustness enhancement step specifically comprises: M1, constructing a generator and discriminator based on a long short-term memory network (LSTM); M2, defining a loss function that conforms to power business constraints; M3, implementing constraint sample generation; M4, performing alternating iterative training; and M5, implementing a dynamic update mechanism based on meta-learning.

[0012] As a further embodiment of the application, the topology awareness and attack chain analysis step specifically comprises: L1, constructing a substation device graph model; L2, defining edge weights of the graph; L3, constructing a graph convolution network (GCN) model; and L4, introducing a time causal convolution module.

[0013] The application also provides an attack behavior analysis engine system, comprising: a data acquisition module, a protocol decoupling module, an adversarial training module, a topology analysis module, and a multi-modal alarm fusion unit. The output end of the data acquisition module is connected to the input end of the protocol decoupling module; the output end of the protocol decoupling module is connected to the input end of the adversarial training module, the topology analysis module, and the multi-modal alarm fusion unit; the output end of the topology analysis module is connected to the input end of the multi-modal alarm fusion unit, and the multi-modal alarm fusion unit further has an interface for receiving external information to gather multi-source alarms from inside and outside the system.

[0014] The application has the following beneficial effects: 1. The application converts the original bit stream of network packets into semantic vectors with clear business meanings by constructing a protocol syntax tree and a power business knowledge graph, so that the engine can understand "who performed what operation on which device at what time". This deep feature extraction method based on business semantics can effectively identify attacks that are grammatically correct but logically malicious, such as malicious closing operations disguised as normal remote control instructions, thereby significantly reducing the high false positive rate and false negative rate caused by the inability of traditional detection techniques to understand the business context.

[0015] 2. The dynamic adversarial training mechanism designed in the application can generate high-quality and high-simulation adversarial samples by introducing a Wasserstein GAN that conforms to the power business logic constraints, forcing the detection model to learn a more robust decision boundary and significantly improving its survival ability in a real adversarial environment. At the same time, combined with the online update strategy of meta-learning, the engine can quickly learn from newly discovered attack samples, realize the continuous self-evolution of the model, and solve the problem that traditional static models are helpless in the face of new attacks.

[0016] 3, The application creatively introduces the power grid physical topology into the attack detection model, and correlates the isolated device node alarm in the topology relationship of the whole network by constructing a topology-aware analysis module based on a graph convolution network. This enables the engine to track and trace the horizontal moving track of the attacker in the network, discover multi-step and cooperative attack chains such as "penetration from the dispatch terminal to the relay protection device", realize the promotion from "point" defense to "surface" defense, and greatly shorten the discovery and response time of complex attacks such as APT.

[0017] 4, The application clearly proposes to use a hardware acceleration card based on FPGA and a DPDK framework to build a data acquisition module, which ensures the line speed and non-packet loss capture of high-throughput power network traffic from the physical layer. This design ensures the integrity and timing accuracy of the data input to the deep learning model from the source, provides a solid and reliable data foundation for all subsequent fine semantic analysis and behavior modeling, and avoids the performance degradation caused by data quality problems. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 The overall architecture schematic diagram of the attack behavior analysis engine based on deep learning of the application; Figure 2 The hardware deployment architecture schematic diagram of the data acquisition module of the application; Figure 3 The working method flowchart of the business semantic decoupling and feature extraction module of the application; Figure 4 The IEC 104 protocol message analysis and three-dimensional feature tensor construction example diagram of the application; Figure 5 The entity relationship model schematic diagram of the power business knowledge graph of the application; Figure 6 The working method flowchart of the dynamic adversarial training module of the application; Figure 7 The working method flowchart of the topology-aware attack chain detection module of the application; Figure 8 The substation device graph convolution network model schematic diagram of the application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0020] Embodiment One In specific embodiments, referring to Figure 1 As shown in the figure, the attack behavior analysis engine system based on deep learning of the application comprises a data acquisition module 100, a protocol decoupling module 200, an adversarial training module 300, a topology analysis module 400, and a multi-modal alarm fusion unit 600.

[0021] The data acquisition module 100 is deployed on the key link of the power system network, and is responsible for capturing network traffic in real time and losslessly. The output end thereof is connected with the input end of the protocol decoupling module 200.

[0022] The protocol decoupling module 200 is responsible for deep analysis and feature engineering of the captured original traffic. The output structured feature data thereof is sent to the adversarial training module 300 for offline training and updating of the model, and is sent to the topology analysis module 400 for real-time attack detection.

[0023] The adversarial training module 300 is an offline or nearline running module, which is responsible for generating and maintaining a high-performance and high-robustness attack detection model, and providing the trained model parameters to the topology analysis module 400 for use.

[0024] The topology analysis module 400 is the core online analysis unit of the system, which uses the latest detection model to analyze and judge the real-time input feature data, and identify the abnormal behavior of a single node and the attack chain across nodes.

[0025] The output alarm information of the topology analysis module 400, together with the underlying protocol abnormal alarm possibly generated by the protocol decoupling module 200 and the physical state alarm from the external device state monitoring system, are fed into the multi-modal alarm fusion unit 500.

[0026] The multi-modal alarm fusion unit 500 makes comprehensive decisions on multi-source information, and outputs the final attack alarm with high confidence.

[0027] In specific embodiments, referring to Figure 2 As shown in the figure, the hardware deployment architecture of the data acquisition module 100 is described in detail. To solve the data acquisition integrity and real-time challenge mentioned in the background art, the data acquisition module 100 of the application is constructed by using a high-performance hardware platform.

[0028] First, network traffic collection point 110. On the core communication link between the power dispatch center and each substation, traffic mirroring is performed by deploying a hardware network shunt Network TAP 111. Compared with the SPAN or mirror port on the switch, the TAP is a completely passive hardware device that can guarantee 100% traffic visibility and will not cause any performance impact or introduce fault points to the original network communication.

[0029] Second, data collection server 120. This is a high-performance rack-mounted server, whose hardware configuration is specially optimized to meet the needs of mass data processing.

[0030] Third, hardware acceleration card 130. One or more field programmable gate array (FPGA) based smart network cards (Smart NIC) are inserted into the data collection server 120. The smart network card supports 100Gbps or higher Ethernet rate, and its core advantage is that it can realize line-speed capture and preliminary processing of network data packets at the hardware level, completely bypassing the host CPU and operating system kernel protocol stack, thereby realizing zero-packet capture.

[0031] To achieve the most efficient data path, the application uses the data plane development kit (DPDK) framework 131 to drive the smart network card. DPDK allows applications to directly access the memory buffer of the network card through user-mode drivers, polling mode, large page memory, etc., realizing "zero-copy" transmission of data packets from the network card to the application memory, greatly reducing the processing delay.

[0032] Embodiment two In a specific embodiment, please refer to Figure 3 The working method flow of the protocol decoupling module 200 described in the application is as follows: Step S201, receiving raw traffic and performing protocol identification, the module receives raw network traffic data stream from the data collection module 100. By quickly matching the TCP or UDP port number and the starting byte of the message, the messages belonging to IEC104 or other target industrial control protocol are identified and filtered out.

[0033] Step S202, performing protocol syntax tree depth analysis, for each IEC 104 message identified, structured analysis is performed according to the IEC60870-5-104 standard specification. The core of this step is to accurately analyze the ASDU and decompose it into a hierarchical syntax tree. Please refer to Figure 4 As shown in the figure, an ASDU 410 is decomposed into multiple key fields, including type identifier 411, variable structure qualifier 412, transmission reason 413, ASDU public address 414 and information body address 415, etc.

[0034] Step S203, constructing and associating the power business knowledge graph. In order to truly understand the business meaning of the parsed fields, the application constructs a power business knowledge graph PB-KG 500. Please refer to Figure 5 As shown in the figure, the knowledge graph is a semantic network, the node entity 510 of which includes various elements in the power grid, and the edge relationship 520 defines the complex connection between the entities. The data of the knowledge graph is mainly automatically constructed and filled in through parsing the SCD file of IEC 61850, importing the power grid GIS topological data and asset account, etc. In the process of message parsing, the module will associate and query the extracted CASDU and IOA with the knowledge graph. The entity and relationship type defined in the knowledge graph are shown in the following table 1.

[0035] Table 1: Examples of entities and relationship types of power business knowledge graph Step S204, generating a three-dimensional feature tensor. This step integrates the information obtained in the previous two steps to generate a multi-dimensional feature representation for each business operation in the time window. Please refer to Figure 4 As shown in the figure, a three-dimensional feature tensor 420 is finally generated. The first dimension is the protocol layer feature Dp, the second dimension is the business layer feature Db, and the third dimension is the operation layer feature Do. This three-dimensional feature tensor completely describes the “protocol specification, business logic, behavior pattern” of a business operation, providing rich and high-quality input for subsequent deep learning models. The specific composition is shown in the following table 2.

[0036] Table 2: Composition example of three-dimensional feature tensor Embodiment three In specific embodiments, please refer to Figure 6 As shown in the figure, the adversarial training module 300 of the application adopts an improved WGAN-GP framework, and combines meta-learning for dynamic updating. Its working method flow is as follows: Step M301, defining the network structure of the generator and the discriminator. Considering the time series nature of the power system network traffic, the application adopts LSTM as the core construction module of the generator and the discriminator to effectively capture the dependence of data on time series.

[0037] Step M302, defining the WGAN-GP loss function and training target. In order to solve the problem of unstable training and easy mode collapse of standard GAN, the application adopts the loss function of WGAN-GP.

[0038] Step M303, an alternating iterative training is implemented, and the training process adopts an alternating optimization strategy. In one training iteration, the parameters of the generator 310 are first fixed, and the discriminator 320 is updated for multiple times. After the discriminator is updated, the parameters of the discriminator 320 are fixed, and the generator 310 is updated for 1 time.

[0039] Step M304, a business logic constraint is introduced. In order to make the generated adversarial samples more realistic and targeted, the application introduces a power business logic constraint in the training process of the generator 310.

[0040] Step M305, meta-learning is applied for model incremental update. When the engine captures a sample confirmed by an artificial attack as a new type of attack in actual operation, the system will start the meta-learning update process. The process regards the new attack sample as a new learning task, and uses algorithms such as model-agnostic meta-learning MAML to update the last few layers of the model through a few gradient descent updates based on the frozen topology analysis module 400 to detect the backbone network parameters of the model, thereby quickly obtaining the ability to identify new types of attacks without destroying the original knowledge system.

[0041] Embodiment four The implementation of the topology-aware attack chain detection module. In specific embodiments, please refer to Figure 7 The core of the topology analysis module 400 described in the application is a deep learning model based on a graph convolutional network GCN, which is specially used for attack behavior analysis on the topology structure of the power system. Its working method is as follows: Step L401, build a substation device graph model. This step aims to convert the real power system physical and communication topology into a graph structure that can be processed by a machine learning model. Please refer to Figure 8 As shown in the figure, a substation is modeled as a graph G=V, E, W 800. The vertex set V 810 of the graph represents all key devices participating in information interaction in the substation. The edge set E 820 of the graph represents the connection relationship between these devices. The weight W of the edge quantifies the closeness of the association between the nodes.

[0042] Step L402, build a graph convolutional network GCN model. The application uses a GCN model to learn the propagation and aggregation mode of node features on the graph structure. The core idea of GCN is that the new features of each node are aggregated from its own old features and the old features of all neighbor nodes.

[0043] Step L403, introduce a time series analysis module, in order to capture the evolution pattern of the attack in the time dimension, the application further introduces a time causal convolutional network TCN after the output of the GCN model. The TCN can process the node state time series of the GCN output, effectively capture the long-time span dependence relationship through causal convolution and dilated convolution, so as to identify the attack chain with specific time sequence pattern.

[0044] In this way, the topology analysis module 400 can associate and converge the seemingly isolated low-risk events scattered on different devices on the graph model, and when these events form a threatening path or pattern in topology, the system can identify the potential APT attack chain with higher confidence.

[0045] Embodiment five The overall workflow of the system, in a specific embodiment, the overall working method of the attack behavior analysis engine based on deep learning of the application can be summarized as the following steps: H1, system initialization, when the system starts, load the detection model parameters generated by the latest adversarial training module 300 to the topology analysis module 400. At the same time, please refer to Figure 5 As shown, load the power business knowledge graph into the memory, and prepare for real-time association.

[0046] H2, real-time traffic collection and distribution, the data collection module 100 continuously captures network traffic from the power grid TAP 111, and uses the DPDK framework 131 to efficiently distribute data packets to the protocol decoupling module 200.

[0047] H3, business semantic analysis and feature extraction, the protocol decoupling module 200 performs real-time syntax tree analysis and knowledge graph association on the received message, and generates a three-dimensional feature tensor for each device in each time window.

[0048] H4, real-time inference of node state, the topology analysis module 400 receives the feature tensor of each node, and takes it as the input of the GCN model to calculate the abnormal probability of each device node in real time.

[0049] H5, attack chain analysis and alarm generation, the TCN module in the topology analysis module 400 performs time series analysis on the node state sequence output by the GCN, and generates a high-priority alarm as soon as it finds a sequence of events that conforms to the predefined attack chain pattern, indicating the attack path and the involved device nodes.

[0050] H6, model dynamic update, the adversarial training module 300 runs periodically in the background, and re-trains the model using newly collected data and generated adversarial samples. When the online system triggers the meta-learning update mechanism, this module is responsible for completing the rapid fine-tuning of the model, and pushing the updated model parameters to the topology analysis module 400.

[0051] H7, alarm fusion and visual presentation, the multi-modal alarm fusion unit 500 performs Bayesian fusion on the alarms from each module, calculates the final attack confidence, and visually displays the influence range and severity of the attack in the form of a heat map or the like on a GIS map or network topology map, thereby providing decision support for operation and maintenance personnel.

[0052] Embodiment six Performance verification and comparison, in order to verify the effectiveness and advancement of the method described in the application, an experimental environment is built, and performance comparison is made with two kinds of mainstream existing technologies. The experimental data is derived from the real historical traffic of a provincial power grid dispatching center, and mixed with public ICS attack data sets such as CRIS-2022. The comparison methods include: Method one, a traditional network intrusion detection system NIDS based on Snort rule signature.

[0053] Method two, a general LSTM deep learning detection model without business semantic decoupling and topology awareness.

[0054] The method of the application, that is, the complete technical solution described in the application, the evaluation indexes include accuracy Accuracy, precision Precision, recall Recall, false positive rate False Positive Rate, FPR, and the recognition rate of the adversarial attack samples generated by the slight disturbance. The experimental results are shown in Table 3 below.

[0055] Table 3 Performance comparison of different detection methods From the experimental results in Table 3 above, it can be seen that: Method one has a very low recall rate for unknown attacks and transformed attacks due to its dependence on known attack features, and due to its inability to understand the business context, it is easy to misjudge some unusual normal operations as attacks, resulting in a high false positive rate.

[0056] Method two, although it applies deep learning, is better than traditional NIDS in overall indicators, but its lack of understanding of business semantics makes it difficult to distinguish malicious behavior at the logic level, and its performance declines sharply when facing adversarial attacks, with a recognition rate of only 15.4%.

[0057] The method has significant advantages in all key indicators, the accuracy, precision and recall rate are all more than 99%, the false positive rate is less than 0.5%, which benefits from the deep feature understanding ability brought by business semantic decoupling; especially, since the dynamic adversarial training mechanism is adopted, the method has high robustness to adversarial attack samples, and the recognition rate is as high as 96.2%. At the same time, the topology perception module enables it to successfully detect multiple cross-device collaborative attack scenarios designed in the data set, and the first two methods cannot find them.

[0058] In summary, compared with the prior art, the method has a qualitative improvement in the accuracy, comprehensiveness, robustness and insight into complex attacks, and has significant positive beneficial effects.

[0059] Although the specific embodiments of the present application are described above, those skilled in the art should understand that these specific embodiments are only illustrative, and those skilled in the art can make various omissions, substitutions and changes to the details of the above method and system without departing from the principles and essence of the present application. For example, the above method steps are combined, or other deep learning models with equivalent functions are used, such as replacing GCN with graph attention network GAT, as long as the essence is to perform the same function to achieve the same result according to the same method, it belongs to the protection scope of the present application. Therefore, the protection scope of the present application is only limited by the appended claims.

Claims

1. A method for constructing an attack behavior analysis engine based on deep learning, characterized in that, Include: Step 1, the business semantic decoupling and multi-layer feature extraction, involves parsing the real-time captured power system network traffic, performing semantic understanding and contextual association of business instructions based on a pre-built power business knowledge graph, and generating a three-dimensional feature tensor containing protocol layer, business layer and operation layer information. Step 2: Dynamic adversarial training and model robustness enhancement. The dynamic adversarial training and model robustness enhancement steps adopt generative adversarial networks to generate highly realistic adversarial attack samples based on the power system business logic and state transition constraints. Through adversarial training, the generalization ability and defense capability against unknown attacks of the detection model are continuously improved. Step 3, Topology Awareness and Attack Chain Analysis: This step models the physical devices of the power system and their connections as a topology graph structure. It uses graph convolutional networks to learn the propagation and correlation patterns of network traffic characteristics between device nodes, thereby enabling the identification and tracing of cross-device, multi-stage collaborative attack chains.

2. The method for constructing an attack behavior analysis engine based on deep learning according to claim 1, characterized in that: The business semantic decoupling and multi-layer feature extraction steps specifically include: S1. Raw network traffic capture and filtering: Using hardware acceleration cards deployed at key network nodes, all network packets are captured at line speed and without loss, and background traffic unrelated to power industry control protocols is initially filtered out. S2. Deep parsing and semantic association analysis of protocol syntax tree. This step includes two levels. First, for the industrial control protocols commonly used in power systems, a deterministic finite state automaton based on the protocol specification is used for efficient basic syntax parsing. The application service data unit (ASDU) of each message is decomposed into a structured protocol syntax tree, and each key field is accurately extracted. S3. Power Business Knowledge Graph Construction and Association: A knowledge graph containing entities such as power system equipment, communication links, protection settings, and operating procedures, as well as their interrelationships, is pre-constructed. During message parsing, the extracted information body address, IOA, and other identifiers are associated with specific equipment entities in the knowledge graph to achieve the mapping from network address to physical asset. S4. Generation of 3D Feature Tensor: The parsed protocol layer features, business layer semantic features obtained through knowledge graph association, and operation layer features such as timestamp differences based on historical operation sequences are integrated into a 3D feature tensor, which serves as the input for subsequent deep learning models.

3. The method for constructing an attack behavior analysis engine based on deep learning according to claim 1, characterized in that, In the business semantic decoupling and multi-layer feature extraction steps, after completing the basic syntax parsing, in order to further mine semantic information, a BidirectionalAttention LSTM model with an integrated bidirectional attention mechanism is used to perform in-depth analysis on the extracted key field sequences for the ASDU structure, so as to capture the long-distance dependencies between fields within the ASDU, and to focus on the potential semantic association between the type identifier TI and the information body address IOA.

4. The method for constructing an attack behavior analysis engine based on deep learning according to claim 1, characterized in that, In the steps of business semantic decoupling and multi-layer feature extraction, the method for constructing the power business knowledge graph includes: Define entity types, which include physical devices, logical nodes, network assets, and abstract concepts; Define relationship types, including physical connection relationships, logical control relationships, communication dependency relationships, and business dependency relationships; Entities and relationships are extracted from heterogeneous data sources using automated tools. These heterogeneous data sources include substation configuration description (SCD) files, network topology diagrams, asset management databases, and operating procedure documents. The extracted information is then populated into a graph database to form a knowledge graph.

5. The method for constructing an attack behavior analysis engine based on deep learning according to claim 1, characterized in that: The dynamic adversarial training and model robustness enhancement steps specifically include: M1. Construct a generator and discriminator based on a Long Short-Term Memory (LSTM) network. The generator is used to receive a random noise vector and output a message sequence simulating a real power service operation. The discriminator is used to receive a message sequence and output a scalar value to evaluate the authenticity of the sequence. M2. Define a loss function that conforms to the constraints of power business, using Wasserstein distance as the basic loss function, and introduce a gradient penalty term to satisfy the Lipshitz continuity constraint. M3. Implement constraint sample generation. In the process of generating adversarial samples, the business operation sequence must conform to the SCADA system state transition probability derived from historical data statistics, and the sending time interval of control instruction messages must conform to the constraints of the Poisson distribution model. M4. Perform alternating iterative training. During the training process, fix the generator parameters and iteratively train the discriminator. Then fix the discriminator parameters and train the generator. Repeat this alternation until the model converges. M5 uses a meta-learning framework for online updates. When the system detects a new type of attack or a false alarm during actual operation, the sample is treated as a new task. The meta-learning framework is used to freeze the parameters of the backbone network of the detection model while only making rapid fine adjustments to the last few layers of the model.

6. The method for constructing an attack behavior analysis engine based on deep learning according to claim 5, characterized in that: During the training process, the discriminator's loss function also includes a classification loss term, which is used to determine whether the input sequence belongs to normal behavior or a certain known attack category.

7. The method for constructing an attack behavior analysis engine based on deep learning according to claim 1, characterized in that: The topology awareness and attack chain analysis steps specifically include: L1. Construct a graph model of substation equipment, taking all key information equipment in the substation as the vertex set V of the graph, and the physical communication links or logical control relationships between the equipment as the edge set E of the graph, thus forming a graph G=V,E. L2. Define the edge weights of the graph and assign a weight We to each edge e∈E. The weights are a weighted fusion of the physical distance between devices, the bandwidth utilization of the communication link, and the attack propagation probability based on historical alarm data statistics. L3. Construct a Graph Convolutional Network (GCN) model. Design a GCN model containing multiple layers of graph convolutional layers to learn the aggregation and propagation rules of node features. L4 introduces a temporal causal convolutional module. After the output layer of GCN, a temporal causal convolutional network is connected to capture attack sequence patterns across device nodes in the time dimension.

8. The method for constructing an attack behavior analysis engine based on deep learning according to claim 7, characterized in that: The input node feature H0 of the graph convolutional network model is a two-dimensional feature vector obtained by dimensionality reduction and compression of the three-dimensional feature tensor corresponding to each device node generated in the business semantic decoupling and multi-layer feature extraction steps through a fully connected layer.

9. An attack behavior analysis engine system, characterized in that, Include: The data acquisition module is deployed in the aggregation layer or core layer of the power system network and uses a hardware acceleration card to achieve lossless capture of network traffic. A protocol decoupling module, which is connected to the output of the data acquisition module, is used to implement the business semantic decoupling and multi-layer feature extraction functions as described in any one of claims 2 to 4. An adversarial training module, which is connected to the output of the protocol decoupling module, is used to implement the dynamic adversarial training and model robustness enhancement functions as described in claim 5 or 6. A topology analysis module receives the feature tensor generated by the protocol decoupling module and performs real-time analysis using the detection model generated by the adversarial training module, thereby realizing the topology awareness and attack chain analysis function as described in claim 7 or 8. The multimodal alarm fusion unit has its input terminals connected to the output terminals of the topology analysis module and the protocol decoupling module, respectively. It is used to perform comprehensive analysis and decision-making on multi-source alarm information and output a high-confidence final attack alarm. The multi-source alarm information may optionally include third-party alarm information from outside the system.

Images