An access security protection system for a power station network

Abstract

The application relates to an access security protection system of a power station network, belongs to the technical field of power safety monitoring, and solves the problem of low detection precision in the prior art. The system comprises: a network detection device, which is used for detecting network session data transmission of the power station network to an anomaly detection server; the anomaly detection server is used for judging whether a new access device exists based on global network session data, if the new access device exists, performing anomaly detection on the new access device based on network session data of the new access device and the global network session data by using a trained anomaly detection model, if the new access device does not exist, performing anomaly detection on the power station network based on the global network session data by using the trained anomaly detection model, and sending an anomaly detection result to an alarm device; and the alarm device is used for displaying the anomaly detection result and alarming if an abnormal device or an abnormal network session exists. The accuracy and reliability of security protection are improved.

Description

Technical Field

[0001] This invention relates to the field of power safety monitoring technology, and in particular to an access security protection system for power station networks. Background Technology

[0002] With the rapid development of smart grids and industrial internet platforms, the networking and intelligence levels of power plants (such as substations, converter stations, and distribution rooms) are increasing daily. A large number of intelligent terminal devices, sensors, and control units are connected to the internal networks of these plants, enabling functions such as data acquisition, status monitoring, and remote control. However, while this network interconnection improves operational efficiency, it also significantly expands the network attack surface, making power plant networks a key target for cyberattacks.

[0003] Traditional security systems typically lack effective dynamic awareness of device behavior and sessions within the network. Especially when new devices (whether authorized or unauthorized) connect to the network, the system cannot quickly and intelligently determine whether their behavior is abnormal, easily creating security blind spots. Existing systems often analyze device anomalies and network session anomalies separately, lacking the ability to perform contextual analysis of individual devices (especially newly connected devices) from a global network session perspective. This results in high false alarm rates, fragmented alarm information, and difficulty in providing accurate and effective decision support for security operations personnel. Summary of the Invention

[0004] Based on the above analysis, the present invention aims to provide an access security protection system for power station networks to solve the problem of low detection accuracy caused by the existing method of analyzing the behavior of new access devices separately from the global network.

[0005] On one hand, embodiments of the present invention provide an access security protection system for power substation networks, including:

[0006] A network detection device is used to detect network session data of power station networks and send the detected global network session data to an anomaly detection server.

[0007] An anomaly detection server is used to determine whether a new access device exists based on the global network session data. If it exists, the server uses a trained anomaly detection model to detect the new access device based on the network session data of the new access device and the global network session data. If it does not exist, the server uses a trained anomaly detection model to detect anomalies in the power station network based on the global network session data. The anomaly detection result is then sent to the alarm device.

[0008] An alarm device is used to display the results of abnormal detection. If an abnormal device or abnormal network session is detected, an alarm will be triggered.

[0009] Based on further improvements to the above scheme, the anomaly detection server uses a trained anomaly detection model to perform anomaly detection on newly accessed devices based on network session data of the newly accessed devices and global network session data, including:

[0010] The first time-series data is obtained by extracting the network session timing data of the newly accessed device at the target time step and the previous multiple time steps.

[0011] The second time series data is obtained by extracting the network session time series data of the power station network at the target time step and the previous multiple time steps.

[0012] The first feature is obtained by using a first feature extractor to extract features from the first time series data;

[0013] The trained anomaly detection model is used to extract features from the second time series data to obtain global features;

[0014] The first feature and the global feature are fused and then input into the classifier to obtain the anomaly probability.

[0015] Based on a further improvement of the above scheme, the first feature extractor includes a multi-layer gated loop unit; each gated loop unit is used to extract hidden features.

[0016] The input of the first-level gated loop unit is the data of each time step in the first time series data; the hidden features output by the previous-level gated loop unit are the input of the next-level gated loop unit; the last-level gated loop unit outputs the hidden features of each time step; a feedback connection is set between the last-level gated loop unit and the first-level gated loop unit to transmit the hidden features output by the last-level gated loop unit of the previous time step to the first-level gated loop unit of the next time step;

[0017] The hidden feature of the last time step output by the last gated loop unit is the first feature.

[0018] Based on further improvements to the above scheme, the anomaly detection model includes:

[0019] The spatial relationship modeling module is used to model the spatial dependencies at each time step and extract the spatial features of each node at each time step.

[0020] The temporal relationship modeling module is used to capture the temporal variation pattern of each node based on the spatial characteristics of each node at each time step, and obtain the spatiotemporal characteristics of each node;

[0021] The reconstruction module is used to reconstruct the graph features of the target time step based on the spatiotemporal features of each node.

[0022] Based on further improvements to the above scheme, the anomaly detection model is used to obtain the anomaly detection results using the following formula:

[0023] ;

[0024] Where N represents the number of nodes in the graph. An indicator function that indicates whether there is an edge between the i-th node and the j-th node in the graph. This represents the probability predicted by the reconstruction module that there is an edge between the i-th node and the j-th node in the graph. Describes the set of edges in the graph. Representing an edge The true characteristics The edges predicted by the reconstruction module Features Denotes the 2-norm of a matrix. This indicates the number of edges in the set.

[0025] Based on the above scheme, a trained anomaly detection model is obtained using the following method:

[0026] Collect normal historical network session time series data for each site to construct a local training set;

[0027] A global anomaly detection model is constructed, and the global anomaly detection model is pre-trained based on the local training set of all stations to obtain the pre-trained global anomaly detection model.

[0028] A fine-tuning training set is constructed at the target site, and the pre-trained global anomaly detection model is fine-tuned based on the fine-tuning training set to obtain the trained anomaly detection model corresponding to the target site.

[0029] Based on the above scheme, a further improvement is made to the local training set of each site, which includes a support set and a query set; a local anomaly detection model is constructed locally at each site; the local anomaly detection model has the same structure as the global anomaly detection model.

[0030] The first training process of the global anomaly detection model based on the local training sets of all sites includes:

[0031] Randomly select at least one site and update the parameters of the local anomaly detection model of each selected site to the parameters of the global anomaly detection model;

[0032] For each selected site, sample augmentation is performed on the samples in the query set for that site; the local anomaly detection model is trained based on the support set in the local training set, and the parameters of the local anomaly detection model are updated.

[0033] For each selected site, the training loss is calculated on the query set augmented with samples from the local training set based on the updated local anomaly detection model;

[0034] The parameters of the global anomaly detection model are updated based on the training loss of each selected site.

[0035] Based on the above scheme, a further improvement is made to calculate the training loss on the query set after sample augmentation of the local training set, using the following method:

[0036] ;

[0037] in, Indicates the reconstruction loss. Indicates comparative loss, These represent the parameters of the global anomaly detection model. and Represents the weight parameters. Indicates the regularization weight. This represents the 2-norm of a matrix.

[0038] Based on further improvements to the above scheme, the comparison loss is calculated using the following method:

[0039] ;

[0040] in, This represents the spatiotemporal features of the i-th sample in the current training batch. This represents the spatiotemporal features of the augmented sample of the i-th sample in the current training batch. This represents the spatiotemporal features of the j-th sample in the current training batch. This indicates the indicator function, where M represents the number of samples in the current training batch. This represents the similarity function.

[0041] Based on the above scheme, the enhanced sample of the i-th sample is obtained in the following way:

[0042] For the i-th sample, the jitter time corresponding to the sample is randomly generated within the maximum jitter range;

[0043] Based on the jitter time corresponding to the sample, the time range corresponding to the augmented sample is determined, and the network session time series data corresponding to the normal historical network session time series data of the current site within this time range is extracted to construct the augmented sample.

[0044] Compared with existing technologies, this invention collects network session data through a network detection device and uses an anomaly detection server to determine whether a new access device exists. If a new access device exists, a trained anomaly detection model is used to detect anomalies in the new access device based on its network session data and global network session data. If no new access device exists, anomaly detection is performed on the power station network based on global network session data. Thus, when a new access device is present, its network session data is combined with global network session data for analysis. This not only focuses on the behavior of the device itself but also examines it within the context of the entire network environment. This allows for a more accurate identification of whether an isolated anomaly of a single device is a sign of an attack on the entire network, thereby significantly improving the reliability and accuracy of the detection results. An alarm device displays the anomaly detection results and issues an alarm when an abnormal device or abnormal network session is detected, facilitating timely detection of network anomalies and ensuring the security of the power station network.

[0045] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0046] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0047] Figure 1 This is a block diagram of the access security protection system for power station networks according to an embodiment of the present invention. Detailed Implementation

[0048] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0049] A specific embodiment of the present invention discloses an access security protection system for power substation networks, such as... Figure 1 As shown, it includes:

[0050] A network detection device is used to detect network session data of power station networks and send the detected global network session data to an anomaly detection server.

[0051] An anomaly detection server is used to determine whether a new access device exists based on the global network session data. If it exists, the server uses a trained anomaly detection model to detect the new access device based on the network session data of the new access device and the global network session data. If it does not exist, the server uses a trained anomaly detection model to detect anomalies in the power station network based on the global network session data. The anomaly detection result is then sent to the alarm device.

[0052] An alarm device is used to display the results of abnormal detection. If an abnormal device or abnormal network session is detected, an alarm will be triggered.

[0053] During implementation, the network detection device can use existing network traffic detection tools to collect network session data of the entire network in a non-intrusive manner and send it to the anomaly detection server. The collection frequency can be set as needed, for example, every 5 seconds.

[0054] The anomaly detection server stores the received network session data and determines whether there are any new connected devices based on the network session data.

[0055] In practice, the anomaly detection server can determine whether a new device has connected by identifying the device identifier that appears for the first time in the session data. Device identifiers include, for example, MAC addresses and IP addresses.

[0056] During implementation, the trained anomaly detection model is a deep learning model.

[0057] Specifically, the anomaly detection server uses a trained anomaly detection model to perform anomaly detection on newly accessed devices based on network session data of the newly accessed devices and global network session data, including:

[0058] S221. Extract the network session timing data of the newly accessed device at the target time step and the previous multiple steps to obtain the first timing data;

[0059] S222. Extract the network session timing data of the power station network at the target time step and the previous multi-step network session timing data to obtain the second timing data;

[0060] S223. Use a first feature extractor to extract features from the first time series data to obtain a first feature;

[0061] S224. Use the trained anomaly detection model to extract features from the second time series data to obtain global features;

[0062] S225. After fusing the first feature and the global feature, input the result into the classifier to obtain the anomaly probability.

[0063] In implementation, for example, every minute is considered a time step. The timing data of the network sessions at the target time step and preceding multiple steps for newly accessed devices, as well as the timing data of the power station network at the target time step and preceding multiple steps, are extracted to obtain the first timing data and the second timing data, respectively. The data for each time step in the timing data includes information such as the number of bytes transmitted, the minimum, maximum, and average packet size, the minimum, maximum, and average packet interval, the number of ports used, and power protocol characteristics.

[0064] The first time-series data is input into the first feature extractor to extract the first feature of the newly connected device.

[0065] Specifically, the first feature extractor includes multiple gated recurrent units; each gated recurrent unit is used to extract hidden features.

[0066] The input of the first-level gated loop unit is the data of each time step in the first time series data; the hidden features output by the previous-level gated loop unit are the input of the next-level gated loop unit; the last-level gated loop unit outputs the hidden features of each time step; a feedback connection is set between the last-level gated loop unit and the first-level gated loop unit to transmit the hidden features output by the last-level gated loop unit of the previous time step to the first-level gated loop unit of the next time step;

[0067] The hidden feature of the last time step output by the last gated loop unit is the first feature.

[0068] Since network sessions have certain interdependencies in time steps, the first feature extractor of the present invention uses a multi-layer gated loop unit to extract the hidden features of each time step. At the same time, the hidden features output at the end of the previous time step are transmitted to the next time step, thereby extracting more accurate features.

[0069] During implementation, the classifier uses the existing classification head.

[0070] In practice, the trained anomaly detection model is used to detect the anomaly probability of the global network at the target time step. When performing global feature extraction based on the trained anomaly detection model, the features output by the last hidden layer of the anomaly detection model are extracted as global features.

[0071] During implementation, a batch of data can be extracted from the stored historical network session data to construct a first sample set. Each sample in the first sample set includes the first time-series data of the target device, the second time-series data of the global network at the same time, the device characteristics of each device in the network, and a label indicating whether the target device is abnormal.

[0072] The parameters of the trained anomaly detection model are fixed. A first feature extractor and classifier are trained on a first sample set. The classifier predicts whether the behavior of a single device is abnormal. After the first feature extractor and classifier are trained based on the first sample set, the anomaly detection server performs anomaly detection according to steps S21 to S25 above when a new access device is detected.

[0073] If the anomaly detection server determines that no new devices have been connected, it uses a trained anomaly detection model based on global network session data to perform anomaly detection on the power station network.

[0074] Specifically, anomaly detection models include:

[0075] The spatial relationship modeling module is used to model the spatial dependencies at each time step and extract the spatial features of each node at each time step.

[0076] The temporal relationship modeling module is used to capture the temporal variation pattern of each node based on the spatial characteristics of each node at each time step, and obtain the spatiotemporal characteristics of each node;

[0077] The reconstruction module is used to reconstruct the graph features of the target time step based on the spatiotemporal features of each node.

[0078] During implementation, the entire site network is treated as a dynamic heterogeneous information graph, with nodes representing devices within the network and edges representing network sessions between them. By capturing the interactions between devices, threats such as low-rate scanning, lateral movement, and jump server attacks, which cannot be detected in a single session, can be identified.

[0079] For a given data center, if no new devices are added, the nodes are typically stable over a certain period, while the connections between nodes change dynamically. Therefore, the spatial relationship modeling module learns the spatial dependencies of the data center network (i.e., the normal communication patterns between devices) at each time step. The temporal relationship modeling module learns the temporal evolution of each device's communication behavior, thus obtaining the spatiotemporal characteristics of each device. Based on these spatiotemporal characteristics, graph feature reconstruction is performed. A good model should be able to learn well what "normal" data looks like. When abnormal data is input, the model cannot accurately reproduce (reconstruct) it, resulting in high errors.

[0080] Specifically, the spatial relationship modeling module includes multiple graph convolutional layers. Each graph convolutional layer extracts the spatial features of each node in the current layer using the following formula:

[0081] ;

[0082] ;

[0083] ;

[0084] in, This represents the spatial features of the i-th node in the k-th graph convolutional layer. This represents the activation function. This represents the weight matrix of the k-th graph convolutional layer. This represents the concatenation function. This represents the spatial features of the i-th node in the (k-1)-th graph convolutional layer. Let represent the feature corresponding to the set of neighboring nodes of the i-th node. This represents the aggregation function of the k-th graph convolutional layer. Let represent the feature vector consisting of the j-th node and the edge from the j-th node to the i-th node. Let i represent the set of neighboring nodes of the i-th node. This represents the multilayer perceptron corresponding to the k-th graph convolutional layer. This represents the spatial features of the j-th node in the (k-1)-th graph convolutional layer. Let represent the feature vector of the edge pointing from the j-th node to the i-th node.

[0085] During implementation, the spatial relationship modeling module extracts spatial features from the input data at each time step. This module comprises multiple graph convolutional layers; the first graph convolutional layer takes device features and session features as input. (The device characteristics of the device corresponding to the j-th node) (The device characteristics of the device corresponding to the i-th node) and The spatial features of each node output by the last convolutional layer are the spatial features of the node at that time step. For the i-th node, its spatial features at the t-th time step are represented as follows: .

[0086] During implementation, device characteristics include information such as the device's network authentication certificate, MAC address, network location, operating system kernel, hardware serial number, and device power communication protocol content.

[0087] In the aggregation process of this invention, the features of the connecting edges are fused with the features of the neighboring nodes to generate a message vector. Then, aggregation is performed to combine the edge features. The message passing process is dynamically and non-linearly integrated. The model can learn the differences between messages from high-traffic servers and messages from low-traffic clients, which is crucial for accurately modeling network behavior and detecting abnormal traffic. This design allows the model to fully utilize directed edge information in the data, greatly enhancing its performance in network security detection tasks and helping to learn the characteristics of normal data more accurately, thereby improving the ability to detect network anomalies.

[0088] For a node, the spatial features at each time step constitute temporal data. The temporal variation patterns of the node are learned through a temporal relationship modeling module, yielding the node's spatiotemporal features. For the i-th node, its spatiotemporal features are represented as follows: .

[0089] During implementation, the timing relationship modeling module can use existing timing encoders, such as LSTM, GRU, and timing Transformer.

[0090] Specifically, the reconstruction module performs graph feature reconstruction based on the spatiotemporal characteristics of each node.

[0091] In practice, to improve the feature extraction capability of the model, this invention reconstructs graph features from two levels: graph structure reconstruction and edge feature reconstruction.

[0092] Graph structure reconstruction measures a model's ability to reconstruct the connections between nodes in a graph (i.e., which devices should communicate with each other).

[0093] During implementation, the reconstruction module determines the spatiotemporal characteristics of the i-th node. spatiotemporal features of the j-th node The probability of an edge pointing from node i to node j at time step T is predicted, specifically as follows:

[0094] ;

[0095] in, || represents the sigmoid function, and || represents vector concatenation. This represents a multilayer perceptron.

[0096] Edge feature reconstruction measures the ability of a model to reconstruct edge (session) features in a graph.

[0097] During implementation, the reconstruction module integrates the spatiotemporal features of all nodes to predict the features of each edge in the graph at the T-th time step (length of the time step). During implementation, the reconstruction module can use existing regression heads to predict edge features.

[0098] The anomaly detection model is an unsupervised training model, where the reconstruction loss is calculated based on the reconstruction results during training. Update the model parameters, and calculate the reconstruction loss based on the reconstruction results during application (inference). That is, the probability of an anomaly. .

[0099] Specifically, during inference, the trained anomaly detection model uses the following formula to obtain the anomaly detection result:

[0100] ;

[0101] Where N represents the number of nodes in the graph. An indicator function that indicates whether there is an edge between the i-th node and the j-th node in the graph. This represents the probability predicted by the reconstruction module that there is an edge between the i-th node and the j-th node in the graph. Describes the set of edges in the graph. Representing an edge The true characteristics The edges predicted by the reconstruction module Features Denotes the 2-norm of a matrix. This indicates the number of edges in the set.

[0102] Specifically, the trained anomaly detection model is obtained using the following method:

[0103] S211. Collect normal historical network session time series data of each station and construct a local training set;

[0104] S212. Construct a global anomaly detection model. Pre-train the anomaly detection model based on the local training set of all stations to obtain a pre-trained anomaly detection model.

[0105] S213. Construct a fine-tuning training set at the target site, and fine-tune the pre-trained global anomaly detection model based on the fine-tuning training set to obtain the trained anomaly detection model corresponding to the target site.

[0106] The amount of training data that a single power plant can provide is limited, especially in terms of obtaining sufficiently diverse samples. Relying solely on limited positive samples for unsupervised or semi-supervised learning makes it difficult to train a robust and accurate model, easily leading to underfitting and weak detection capability (generalization ability) against unknown novel attacks. Therefore, this application utilizes data from multiple power plants for global model training to improve the model's generalization ability. Then, for a new target power plant, a few fine-tuning steps using a small amount of normal data from the target power plant allow the model to quickly adapt to the new environment, achieving rapid cold start with small or even zero samples, greatly improving the universality and deployment efficiency of the solution.

[0107] During implementation, the local training set of each site is stored locally, and the data is not shared between sites, thereby improving data security.

[0108] It should be noted that the anomaly detection model is trained based on normal samples, meaning that the trained anomaly detection model is a self-supervised model.

[0109] During implementation, for each site, the normal historical network session time series data of this site is collected. The data of each time step in the collected time series data includes network session characteristics and device characteristics.

[0110] Network session characteristics include the number of transmitted data packets, the number of transmitted bytes, the minimum, maximum, and average data packet size, the minimum, maximum, and average data packet interval, the number of ports used, and power protocol characteristics, including but not limited to the following: the entropy value of the function code sequence of the DNP3 protocol, the uniformity of the object variant distribution, the frequency of time synchronization requests, the entropy value of the ASDU type distribution of the IEC-104 protocol characteristics, the COT (transmission reason) sequence change rate, the standard deviation of the information object address distribution, and the proportion of telemetry / remote control requests.

[0111] In practice, for example, if 1 minute is a time step, then for two devices D1 and D2 in the site, the above data of the network session from D1 to D2 within 1 minute is collected as the feature data of the network session from D1 to D2 in that time step, and the above data of the network session from D2 to D1 within 1 minute is collected as the feature data of the network session from D2 to D1 in that time step.

[0112] In practice, a window of length W slides across the time-series data to extract samples and construct a local training set. An overlapping sliding window can be used, with a sliding step size of W / 2.

[0113] During implementation, a global anomaly detection model can be built on the central server. The global anomaly detection model can be pre-trained based on the local training sets of all sites to obtain the pre-trained anomaly detection model.

[0114] In practice, in order to pre-train the global anomaly detection model using the local training set of the distributed stations, a local anomaly detection model is built locally at each station; the local anomaly detection model has the same structure and the same initial parameters as the global anomaly detection model.

[0115] In addition, the local training set of each site is divided into a support set and a query set. The support set is used to train the local anomaly detection model, and the query set is used to calculate the training loss and update the parameters of the global anomaly detection model.

[0116] Specifically, the training process for a global anomaly detection model is as follows:

[0117] S21. Randomly select at least one site and update the parameters of the local anomaly detection model of each selected site to the parameters of the anomaly detection model.

[0118] S22. For each selected site, train the local anomaly detection model based on the support set in the local training set, and update the parameters of the local anomaly detection model.

[0119] S23. For each selected site, perform sample augmentation on the samples in the query set of that site; calculate the training loss on the augmented query set based on the updated local anomaly detection model in the local training set.

[0120] S24. Update the parameters of the global anomaly detection model based on the training loss of each selected site.

[0121] During implementation, for each step of training the global anomaly detection model, at least one field station is randomly selected first. That is, the parameters of the global anomaly detection model are updated once based on the local training set of the selected at least one field station.

[0122] For each selected site, the parameters of the current global anomaly detection model are sent to each selected site, updating the local anomaly detection model of the selected site to the parameters of the current global anomaly detection model. Then, the local anomaly detection model is trained based on the support set in the local training set, updating the parameters of the local anomaly detection model. In implementation, multi-step training can be performed, meaning the parameters of the local anomaly detection model are updated multiple times, with the last updated parameters recorded as... , This represents the parameters of the local anomaly detection model for the i-th data center.

[0123] During implementation, during training on the support set, the gradient is calculated based on the reconstruction loss of the reconstruction module, and the parameters of the local anomaly detection model are updated via backpropagation. The specific reconstruction loss is detailed above.

[0124] Then, the training loss is calculated on the query set of the local training set based on the updated local anomaly detection model.

[0125] The parameters of the global anomaly detection model are updated using the following formula based on the training loss of the selected sites:

[0126] ;

[0127] ;

[0128] in, Indicates total training loss gradient, This represents the total training loss of the K selected sites. This represents the training loss of the i-th selected site. Indicates the learning rate. This represents the parameters before the global anomaly detection model is updated. This represents the updated parameters of the global anomaly detection model.

[0129] Training is stopped when the global anomaly detection model has been trained a preset number of times or the total training loss has reached a preset accuracy. The resulting global anomaly detection model is the pre-trained anomaly detection model.

[0130] Using only reconstruction loss may result in an insufficiently compact feature space, and the representation of normal samples may be scattered, making it easier for abnormal samples to be "mixed in". Therefore, this invention introduces contrastive loss.

[0131] Specifically, for each selected site, the training loss is calculated on the query set augmented from the local training set using the following method:

[0132] ;

[0133] in, Indicates the reconstruction loss. Indicates comparative loss, These represent the parameters of the global anomaly detection model. and Represents the weight parameters. Indicates the regularization weight. This represents the 2-norm of a matrix.

[0134] Specifically, the contrast loss is calculated using the following formula:

[0135] ;

[0136] in, This represents the spatiotemporal features of the i-th sample in the current training batch. This represents the spatiotemporal features of the augmented sample of the i-th sample in the current training batch. This represents the spatiotemporal features of the j-th sample in the current training batch. Indicates an indicator function, The result is 1 if the condition is met, and 0 otherwise. M represents the number of samples in the current training batch. This represents the similarity function.

[0137] In practice, since the training set only contains normal samples, this invention uses data augmentation to create similar sample pairs, that is, to obtain augmented samples of normal samples.

[0138] Specifically, the augmented sample for the i-th sample is obtained in the following way:

[0139] For the i-th sample, the jitter time corresponding to the sample is randomly generated within the maximum jitter range;

[0140] Based on the jitter time corresponding to the sample, the time range corresponding to the augmented sample is determined, and the network session time series data corresponding to the normal historical network session time series data of the current site within this time range is extracted to construct the augmented sample.

[0141] The exact segmentation point of a session within a time window may vary slightly, but this should not affect the model's judgment of the overall behavior. Therefore, to simulate the slight time asynchrony in communication, for the i-th sample in the query set, the jitter time corresponding to the sample is randomly generated within the maximum jitter range, and then an enhanced sample is constructed based on the jitter time.

[0142] For example, if the original sample's time range is [t1, t2], and a jitter time Δt is randomly generated within the maximum jitter range, the corresponding augmented sample is composed of normal historical network session time-series data within the time range [t1+Δt, t2+Δt]. If one minute is considered a time step, then the network session features and device features within [t1+Δt, t1+Δt+1 minute] are the data for the first time step of the augmented sample. And so on.

[0143] The jitter range should be proportional to the natural fluctuation of network traffic. A network with very stable, periodic traffic should have a small jitter range; a network with greater traffic fluctuations can have a larger jitter range.

[0144] Therefore, the maximum jitter range is obtained using the following method:

[0145] The fluctuation coefficient is calculated based on the number of surviving sessions at each time step of the normal historical network session time-series data of the current site.

[0146] The waveform coefficients are mapped to the maximum jitter range.

[0147] The maximum jitter range is different for each site, so the maximum jitter range for each site is calculated separately.

[0148] Specifically, the volatility coefficient is calculated using the following formula:

[0149] ;

[0150] in, This indicates the number of time steps in the normal historical network session time-series data of the current site. This indicates the number of samples at each time step. This represents the number of surviving sessions at the j-th sampling time step (i-th time step). This represents the average number of surviving sessions at the i-th time step.

[0151] In practice, surviving sessions are those that started before the sampling time and have not yet ended at the sampling time. Surviving sessions reflect the load and activity of network connections, and their fluctuations directly reflect the natural rhythm of network traffic. Therefore, for each time step (e.g., 1 minute), the number of surviving sessions at each sampling time (e.g., once per second) is determined, and then the average number of surviving sessions at that time step is calculated. The fluctuation coefficient of the site is then calculated according to the above formula.

[0152] Then, the volatility coefficient is mapped to the maximum jitter range. The mapping relationship needs to satisfy: When the value is 0 (perfectly stationary network), It should also be close to 0. The larger, .

[0153] Specifically, the mapping is performed using the following formula:

[0154] ;

[0155] in, Indicates scaling factor (e.g.) ), used to control the overall intensity of jitter, where T represents the time step length of the sample.

[0156] By adopting an adaptive enhancement strategy, data enhancement is closely linked to the actual physical characteristics of the site, which can generate reasonable similar samples and improve the authenticity of the enhanced samples, thus making the enhancement effect more intelligent and effective.

[0157] In practice, for the i-th sample and its corresponding augmented sample, a positive sample pair is formed, and other samples form a negative sample pair. The core of contrastive loss is to pull in similar samples (positive sample pairs) and push away dissimilar samples (negative sample pairs). Through contrastive loss, the feature representations of normal samples learned by the model will be more compact in the vector space, while the representations of abnormal samples will fall outside this compact cluster, forming a clearer boundary and greatly improving the model's discriminative ability.

[0158] In implementation, after obtaining the pre-trained anomaly detection model, for the target site, normal historical session time-series data of the target site are collected locally. Following the aforementioned sample construction method, a small number of samples are constructed to form a fine-tuning training set. Based on this fine-tuning training set, the pre-trained anomaly detection model is fine-tuned to obtain the trained anomaly detection model corresponding to the target site. The loss from fine-tuning training can be calculated using the aforementioned training loss calculation formula.

[0159] After obtaining the trained anomaly detection model corresponding to the target site, it is deployed in the anomaly detection server of the target site, so that the anomaly detection server can perform anomaly detection on newly connected devices or the global network based on the trained anomaly detection model.

[0160] After receiving the anomaly detection results, the anomaly detection server sends the results to the alarm device. If the anomaly probability exceeds a preset threshold, indicating the presence of an abnormal device or network session, the alarm device will sound an alarm to remind network security maintenance personnel to check in a timely manner.

[0161] Compared with existing technologies, the access security protection system for power station networks provided in this embodiment analyzes the network session data of new access devices in combination with global network session data when new access devices are added. It not only focuses on the behavior of the devices themselves, but also examines them in the context of the entire network environment. This allows for a more accurate identification of whether an isolated anomaly of a single device is a sign of an attack on the entire network, thereby significantly improving the reliability and accuracy of the detection results. The system displays the anomaly detection results through an alarm device and issues an alarm when abnormal devices or abnormal network sessions are present, facilitating timely detection of network anomalies and ensuring the security of the power station network.

[0162] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0163] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A security protection system for access to a power station network, characterized in that, include: A network detection device is used to detect network session data of power station networks and send the detected global network session data to an anomaly detection server. An anomaly detection server is used to determine whether a new access device exists based on the global network session data. If it does, the trained anomaly detection model is used to detect the new access device based on the network session data of the new access device and the global network session data. If not, the trained anomaly detection model is used to detect anomalies in the power station network based on global network session data; the anomaly detection results are then sent to the alarm device. An alarm device is used to display the results of abnormal detection and to trigger an alarm if there is an abnormal device or abnormal network session. The anomaly detection server uses a trained anomaly detection model to perform anomaly detection on newly accessed devices based on network session data of the newly accessed devices and global network session data, including: The first time-series data is obtained by extracting the network session timing data of the newly accessed device at the target time step and the previous multiple time steps. The second time series data is obtained by extracting the network session time series data of the power station network at the target time step and the previous multiple time steps. The first feature is obtained by using a first feature extractor to extract features from the first time series data; The trained anomaly detection model is used to extract features from the second time series data to obtain global features; The first feature and the global feature are fused and then input into the classifier to obtain the anomaly probability.

2. The access security protection system for power station networks according to claim 1, characterized in that, The first feature extractor includes a multi-layer gated recurrent unit; each gated recurrent unit is used to extract hidden features; The input to the first-level gated loop unit is the data of each time step in the first time series data; the hidden features output by the previous-level gated loop unit are the input to the next-level gated loop unit; the last-level gated loop unit outputs the hidden features of each time step. A feedback connection is provided between the last gated loop unit and the first gated loop unit to transmit the hidden features output by the last gated loop unit of the previous time step to the first gated loop unit of the next time step. The hidden feature of the last time step output by the last gated loop unit is the first feature.

3. The access security protection system for power station networks according to claim 1, characterized in that, The anomaly detection model includes: The spatial relationship modeling module is used to model the spatial dependencies at each time step and extract the spatial features of each node at each time step. The temporal relationship modeling module is used to capture the temporal variation pattern of each node based on the spatial characteristics of each node at each time step, and obtain the spatiotemporal characteristics of each node; The reconstruction module is used to reconstruct the graph features of the target time step based on the spatiotemporal features of each node.

4. The access security protection system for power station networks according to claim 3, characterized in that, The anomaly detection model is used to obtain the anomaly detection results using the following formula: ； Where N represents the number of nodes in the graph. An indicator function that indicates whether there is an edge between the i-th node and the j-th node in the graph. This represents the probability predicted by the reconstruction module that there is an edge between the i-th node and the j-th node in the graph. Describes the set of edges in the graph. This indicates the number of edges in the set. Representing an edge The true characteristics The edges predicted by the reconstruction module Features This represents the 2-norm of a matrix.

5. The access security protection system for power station networks according to claim 1, characterized in that, The trained anomaly detection model is obtained using the following method: Collect normal historical network session time series data for each site to construct a local training set; A global anomaly detection model is constructed, and the global anomaly detection model is pre-trained based on the local training set of all stations to obtain the pre-trained global anomaly detection model. A fine-tuning training set is constructed at the target site, and the pre-trained global anomaly detection model is fine-tuned based on the fine-tuning training set to obtain the trained anomaly detection model corresponding to the target site.

6. The access security protection system for power station networks according to claim 5, characterized in that, The local training set for each site includes a support set and a query set; a local anomaly detection model is built locally at each site. The local anomaly detection model has the same structure as the global anomaly detection model. The first training process of the global anomaly detection model based on the local training sets of all sites includes: Randomly select at least one site and update the parameters of the local anomaly detection model of each selected site to the parameters of the global anomaly detection model; For each selected site, sample augmentation is performed on the samples in the query set for that site; the local anomaly detection model is trained based on the support set in the local training set, and the parameters of the local anomaly detection model are updated. For each selected site, the training loss is calculated on the query set augmented with samples from the local training set based on the updated local anomaly detection model; The parameters of the global anomaly detection model are updated based on the training loss of each selected site.

7. The access security protection system for power station networks according to claim 6, characterized in that, The training loss is calculated on the augmented query set from the local training set using the following method: ； in, Indicates the reconstruction loss. Indicates comparative loss, These represent the parameters of the global anomaly detection model. and Represents the weight parameters. Indicates the regularization weight. This represents the 2-norm of a matrix.

8. The access security protection system for power station networks according to claim 7, characterized in that, The contrast loss is calculated using the following method: ； in, This represents the spatiotemporal features of the i-th sample in the current training batch. This represents the spatiotemporal features of the augmented sample of the i-th sample in the current training batch. This represents the spatiotemporal features of the j-th sample in the current training batch. This indicates the indicator function, where M represents the number of samples in the current training batch. This represents the similarity function.

9. The access security protection system for power station networks according to claim 8, characterized in that, The augmented sample of the i-th sample is obtained in the following way: For the i-th sample, the jitter time corresponding to the sample is randomly generated within the maximum jitter range; Based on the jitter time corresponding to the sample, the time range corresponding to the augmented sample is determined, and the network session time series data corresponding to the normal historical network session time series data of the current site within this time range is extracted to construct the augmented sample.

Images