A network security situation awareness method for a power distribution network station

Abstract

The application relates to a network security situation awareness method of a power distribution network station, and belongs to the technical field of network security, which solves the problem of coarse abnormality awareness granularity in the prior art. The method comprises the following steps: acquiring target time steps and multi-step network session time sequence data before the target time steps of a target power distribution network station; inputting the network session time sequence data into a trained abnormality detection model for abnormality detection to obtain a first abnormality score of each session in the target time steps; obtaining a second abnormality score of each session based on the clustering type of each session in the target time steps; and obtaining an abnormality detection result of each session in the target time steps based on the first abnormality score and the second abnormality score of each session. The method realizes fine and accurate security situation awareness.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network security situation awareness method for a power distribution network site. BACKGROUND

[0002] With the deepening of the construction of smart grids, the intelligence and networking level of power distribution network sites (such as substations, distribution stations, etc.) has been significantly improved. These sites frequently communicate with the master station system through a large number of intelligent terminal devices (such as RTUs, FTUs, DTUs, etc.) to achieve remote monitoring, fault diagnosis, and automatic control. However, this high level of interconnection also makes power distribution network sites important targets for network attacks. Attackers may launch denial-of-service attacks, malicious instruction injection, data theft, etc. by hacking network sessions, seriously threatening the safe and stable operation of the power distribution network.

[0003] Traditional network security protection methods for power distribution networks mainly rely on border protection technologies such as firewalls, intrusion detection systems (IDS), etc. These technologies mostly match and detect based on rule libraries or signature libraries of known attack characteristics, and have limited detection capabilities for new and complex attack behaviors such as zero-day attacks and advanced persistent threats (APT).

[0004] With the development of artificial intelligence technologies such as deep learning and reinforcement learning, intelligent algorithms are increasingly being applied in network security situation awareness. However, existing intelligent algorithms mainly focus on overall network anomaly analysis, with a coarse abnormality perception granularity that cannot pinpoint individual network sessions. SUMMARY

[0005] In view of the above analysis, the embodiments of the present application aim to provide a network security situation awareness method for a power distribution network site to solve the problem of coarse abnormality perception granularity that cannot accurately locate abnormalities.

[0006] In one aspect, the embodiments of the present application provide a network security situation awareness method for a power distribution network site, comprising the following steps:

[0007] Obtain the target time step and the multi-step network session time series data before it of the target power distribution network site; input the network session time series data into a trained anomaly detection model for anomaly detection to obtain the first abnormality score of each session within the target time step;

[0008] Obtain the second abnormality score of each session based on the clustering type of each session within the target time step;

[0009] Obtain the anomaly detection result of each session within the target time step based on the first abnormality score and the second abnormality score of each session.

[0010] Based on further improvements to the above scheme, a second anomaly score for each session is obtained based on the clustering type of each session within the target time step, including:

[0011] The clustering type for each session within the target time step is determined based on self-evolutionary clustering.

[0012] If the clustering type of the session is a known abnormal class, then the second abnormality score of the session is obtained based on the degree of danger of the known abnormal class;

[0013] If the clustering type of the session is unknown, then the second anomaly score of the session is calculated based on the session’s temporal characteristics, distribution characteristics, and the size of the clustering type.

[0014] Based on further improvements to the above scheme, the second anomaly score of the session is calculated using the following formula, based on the session's temporal characteristics, distribution characteristics, and cluster type:

[0015] ;

[0016] in, This represents the second abnormal score of session s. This represents the distance between session s and the nearest known normal cluster center. Indicates the time period during which session s occurs. Indicates the time period The probability of a session occurring. This indicates the number of events in session s. This represents the average number of events in a normal historical session. This indicates the number of sessions in the cluster type to which session s belongs. Indicates the attenuation coefficient. , and This represents the weighting parameter.

[0017] Based on the above scheme, a further improvement is made to determine the clustering type of each session within the target time step based on self-evolutionary clustering, including:

[0018] For each session within the target time step, construct the session feature vector for that session;

[0019] Calculate the local aggregation degree of the session feature vector and the distance to each formal cluster center;

[0020] If the distance between the session and the nearest formal cluster center is less than a distance threshold, and the local aggregation degree of the session is less than that of the nearest formal cluster center, then the session is assigned to the formal cluster type corresponding to the nearest formal cluster center; otherwise:

[0021] If no temporary cluster type exists or no temporary cluster center is located less than the distance threshold for the session, the session is assigned to a new temporary cluster type; otherwise, the session is assigned to the temporary cluster type corresponding to the nearest temporary cluster center; if a temporary cluster type exists with a data volume exceeding the first threshold, the temporary cluster type exceeding the first threshold is used as a new formal cluster type.

[0022] Based on the above scheme, a trained anomaly detection model is obtained using the following method:

[0023] Collect normal historical network session time series data for each site to construct a local training set;

[0024] A global spatiotemporal graph neural network model is constructed, and the global spatiotemporal graph neural network model is pre-trained based on the local training set of all stations to obtain a pre-trained anomaly detection model;

[0025] A fine-tuning training set is constructed at the target site, and the pre-trained anomaly detection model is fine-tuned based on the fine-tuning training set to obtain the trained anomaly detection model corresponding to the target site.

[0026] Based on further improvements to the above scheme, the global spatiotemporal graph neural network model includes:

[0027] The spatial relationship modeling module is used to model the spatial dependencies of the samples at each time step and extract the spatial features of each node at each time step.

[0028] The temporal relationship modeling module is used to capture the temporal variation pattern of each node based on the spatial characteristics of each node at each time step, and obtain the spatiotemporal characteristics of each node;

[0029] The reconstruction module is used to reconstruct graph features based on the spatiotemporal characteristics of each node.

[0030] Based on the above scheme, a further improvement is made to the local training set of each site, which includes a support set and a query set; a local spatiotemporal graph neural network model is constructed locally at each site; the local spatiotemporal graph neural network model has the same structure as the global spatiotemporal graph neural network model.

[0031] The first training process of the global spatiotemporal graph neural network model based on the local training sets of all stations includes:

[0032] Randomly select at least one station, and update the parameters of the local graph neural network model of each selected station to the parameters of the global spatiotemporal graph neural network model;

[0033] For each selected site, the local spatiotemporal graph neural network model is trained based on the support set in the local training set, and the parameters of the local spatiotemporal graph neural network model are updated.

[0034] For each selected site, sample augmentation is performed on the samples in the query set of that site; the training loss is calculated on the augmented query set based on the updated local spatiotemporal graph neural network model on the local training set;

[0035] The parameters of the global spatiotemporal graph neural network model are updated based on the training loss of each selected site.

[0036] Based on the above scheme, a further improvement is made to calculate the training loss on the query set after sample augmentation of the local training set using the following method:

[0037] ;

[0038] in, Indicates the reconstruction loss. Indicates comparative loss, The parameters represent the global spatiotemporal graph neural network model. and Represents the weight parameters. Indicates the regularization weight. This represents the 2-norm of a matrix.

[0039] Based on further improvements to the above scheme, the comparison loss is calculated using the following method:

[0040] ;

[0041] in, This represents the spatiotemporal features of the i-th sample in the current training batch. This represents the spatiotemporal features of the augmented sample of the i-th sample in the current training batch. This represents the spatiotemporal features of the j-th sample in the current training batch. This indicates the indicator function, where M represents the number of samples in the current training batch. This represents the similarity function.

[0042] Based on the above scheme, the enhanced sample of the i-th sample is obtained in the following way:

[0043] For the i-th sample, the jitter time corresponding to the sample is randomly generated within the maximum jitter range;

[0044] Based on the jitter time corresponding to the sample, the time range corresponding to the augmented sample is determined, and the network session time series data corresponding to the normal historical network session time series data of the current site within this time range is extracted to construct the augmented sample.

[0045] Compared with existing technologies, this invention uses a trained anomaly detection model to detect time-step anomalies, thereby obtaining time-step level anomaly results based on temporal characteristics. For each session within the target time step, a second anomaly score is obtained based on its clustering type, resulting in fine-grained anomaly detection results. The final detection result for each session is obtained through the first and second anomaly scores, locating the anomaly to a single session, making the detection results more refined and accurate, facilitating timely anomaly detection, and improving network security and stability.

[0046] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0047] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0048] Figure 1 This is a flowchart of a network security situation awareness method for power distribution network substations according to an embodiment of the present invention. Detailed Implementation

[0049] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0050] A specific embodiment of the present invention discloses a method for network security situation awareness at power distribution network substations, such as... Figure 1 As shown, it includes the following steps:

[0051] S1. Obtain the target time step and the network session timing data of the target distribution network station and the previous multiple steps; input the network session timing data into the trained anomaly detection model to perform anomaly detection and obtain the first anomaly score of each session within the target time step.

[0052] S2. Obtain the second anomaly score for each session based on the clustering type of each session within the target time step;

[0053] S3. Obtain the anomaly detection results for each session within the target time step based on the first and second anomaly scores for each session.

[0054] In implementation, the anomaly detection model takes network session time-series data from multiple time steps as input and outputs the probability of an anomaly in the network session at the last time step. The first anomaly score for each session in that time step is the anomaly probability output by the model. That is, the first anomaly score is the same for each session within the target time step.

[0055] For each session within the target time step, a second anomaly score is obtained based on its cluster type. The anomaly detection result for each session is obtained by combining the first and second anomaly scores.

[0056] Specifically, the trained anomaly detection model is obtained using the following method:

[0057] S11. Collect normal historical network session time-series data of each distribution network substation and construct a local training set;

[0058] S12. Construct a global spatiotemporal graph neural network model. Pre-train the global spatiotemporal graph neural network model based on the local training set of all stations to obtain a pre-trained anomaly detection model.

[0059] S13. Construct a fine-tuning training set at the target distribution network station, and fine-tune the pre-trained anomaly detection model based on the fine-tuning training set to obtain the trained anomaly detection model corresponding to the target distribution network station.

[0060] During implementation, the local training set of each distribution network station is stored locally, and the stations do not share data, thereby improving data security.

[0061] It should be noted that the anomaly detection model is trained based on normal samples, meaning that the trained anomaly detection model is a self-supervised model.

[0062] In implementation, a global spatiotemporal graph neural network (GSMNN) model is constructed by building a local training set at each low-voltage distributed power station. This GSMNN model is then pre-trained using the local training sets from all stations to obtain a meta-model for anomaly detection. A fine-tuning training set is then built at the target power station, and the pre-trained anomaly detection model is fine-tuned based on this set to obtain a trained anomaly detection model for the target power station. This initialization of the GSMNN model's parameters, without sharing the original training samples, is based on the training sets from all stations. The GSMNN model can extract general features, which can then be fine-tuned at the target power station. Only a small number of samples are needed to train an anomaly detection model suitable for that station. The model exhibits stronger generalization ability and faster adaptation speed when facing complex and ever-changing network threats in power monitoring systems. By performing a few fine-tuning steps using a small amount of normal data from the target power station, the model can quickly adapt to new environments, achieving rapid cold starts with small or even zero samples, greatly improving the versatility and deployment efficiency of the solution.

[0063] During implementation, for each site, the normal historical network session time series data of this site is collected. The data of each time step in the collected time series data includes network session characteristics and device characteristics.

[0064] Network session characteristics include the number of transmitted data packets, the number of transmitted bytes, the minimum, maximum, and average data packet size, the minimum, maximum, and average data packet interval, the number of ports used, and power protocol characteristics. Power protocol characteristics include, but are not limited to, the following: the entropy value of the function code sequence of the DNP3 protocol, the uniformity of the object variant distribution, the frequency of time synchronization requests, the entropy value of the ASDU type distribution of the IEC-104 protocol characteristics, the COT (transmission reason) sequence change rate, the standard deviation of the information object address distribution, and the proportion of telemetry / remote control requests.

[0065] In practice, for example, if 5 minutes is a time step, then for two devices D1 and D2 in the site, the above data of the network session from D1 to D2 within 5 minutes is collected as the feature data of the network session from D1 to D2 in that time step, and the above data of the network session from D2 to D1 within 5 minutes is collected as the feature data of the network session from D2 to D1 in that time step.

[0066] Device characteristics include information such as the device's network authentication certificate, MAC address, network location, operating system kernel, hardware serial number, and device power communication protocol content.

[0067] In practice, a window of length W slides across the time-series data to extract samples and construct a local training set. An overlapping sliding window can be used, with a sliding step size of W / 2.

[0068] During implementation, a global spatiotemporal graph neural network model can be built on the central server. The global spatiotemporal graph neural network model can be pre-trained based on the local training sets of all stations to obtain a pre-trained anomaly detection model.

[0069] Specifically, the constructed global spatiotemporal graph neural network model includes:

[0070] The spatial relationship modeling module is used to model the spatial dependencies of the samples at each time step and extract the spatial features of each node at each time step.

[0071] The temporal relationship modeling module is used to capture the temporal variation pattern of each node based on the spatial characteristics of each node at each time step, and obtain the spatiotemporal characteristics of each node;

[0072] The reconstruction module is used to reconstruct graph features based on the spatiotemporal characteristics of each node.

[0073] During implementation, the entire site network is treated as a dynamic heterogeneous information graph, with nodes representing devices within the network and edges representing network sessions between them. By capturing the interactions between devices, threats such as low-rate scanning, lateral movement, and jump server attacks, which cannot be detected in a single session, can be identified.

[0074] For a given data center, the nodes are typically constant across different time steps, while the connections between nodes change dynamically. Therefore, a spatial relationship modeling module learns the spatial dependencies of the data center network (i.e., the normal communication patterns between devices) at each time step. A temporal relationship modeling module learns the temporal evolution of each device's communication behavior, thus obtaining the spatiotemporal characteristics of each device. Based on these spatiotemporal characteristics, graph feature reconstruction is performed. A good model should be able to learn well what "normal" data looks like. When abnormal data is input, the model cannot accurately reproduce (reconstruct) it, resulting in high errors.

[0075] Specifically, the spatial relationship modeling module includes multiple graph convolutional layers. Each graph convolutional layer extracts the spatial features of each node in the current layer using the following formula:

[0076] ;

[0077] ;

[0078] ;

[0079] in, This represents the spatial features of the i-th node in the k-th graph convolutional layer. This represents the activation function. This represents the weight matrix of the k-th graph convolutional layer. This represents the concatenation function. This represents the spatial features of the i-th node in the (k-1)-th graph convolutional layer. Let represent the feature corresponding to the set of neighboring nodes of the i-th node. This represents the aggregation function of the k-th graph convolutional layer. Let represent the feature vector consisting of the j-th node and the edge pointing from the j-th node to the i-th node. Let i represent the set of neighboring nodes of the i-th node. This represents the multilayer perceptron corresponding to the k-th graph convolutional layer. This represents the spatial features of the j-th node in the (k-1)-th graph convolutional layer. Let represent the feature vector of the edge pointing from the j-th node to the i-th node.

[0080] During implementation, the spatial relationship modeling module extracts spatial features from the data at each time step of the sample. The spatial relationship modeling module includes multiple graph convolutional layers. The input to the first graph convolutional layer is device features and session features, i.e. (The device characteristics of the device corresponding to the j-th node) (The device characteristics of the device corresponding to the i-th node) and The spatial features of each node output by the last convolutional layer are the spatial features of the node at that time step. For the i-th node, its spatial features at the t-th time step are represented as follows: .

[0081] In the aggregation process of this invention, the features of the connecting edges are fused with the features of the neighboring nodes to generate a message vector. Then, aggregation is performed to combine the edge features. The table dynamically and non-linearly incorporates the message passing process. The model can learn the differences between "a message from a high-traffic server" and "a message from a low-traffic client," which is crucial for accurately modeling network behavior and detecting abnormal traffic. This design allows the model to fully utilize directed edge information in the data, greatly enhancing its performance in network security situational awareness tasks and helping to learn the characteristics of normal data more accurately, thereby improving the ability to detect network anomalies.

[0082] For a node, the spatial features at each time step constitute temporal data. The temporal variation patterns of the node are learned through a temporal relationship modeling module, yielding the node's spatiotemporal features. For the i-th node, its spatiotemporal features are represented as follows: .

[0083] During implementation, the timing relationship modeling module can use existing timing encoders, such as LSTM, GRU, and timing Transformer.

[0084] Specifically, the reconstruction module performs graph feature reconstruction based on the spatiotemporal characteristics of each node.

[0085] In practice, to improve the feature extraction capability of the model, this invention reconstructs graph features from two levels: graph structure reconstruction and edge feature reconstruction.

[0086] Graph structure reconstruction measures a model's ability to reconstruct the connections between nodes in a graph (i.e., which devices should communicate with each other).

[0087] During implementation, the reconstruction module determines the spatiotemporal characteristics of the i-th node. spatiotemporal features of the j-th node The probability of an edge pointing from node i to node j at time step T is predicted, specifically as follows:

[0088] ;

[0089] in, || represents the sigmoid function, and || represents vector concatenation. This represents a multilayer perceptron.

[0090] Edge feature reconstruction measures the ability of a model to reconstruct edge (session) features in a graph.

[0091] During implementation, the reconstruction module integrates the spatiotemporal features of all nodes to predict the features of each edge in the graph at the T-th time step. During implementation, the reconstruction module can use existing regression heads to predict edge features.

[0092] In practice, in order to pre-train the global spatiotemporal graph neural network model using the local training set of the distributed stations, a local spatiotemporal graph neural network model is built locally at each station; the local spatiotemporal graph neural network model has the same structure and the same initial parameters as the global spatiotemporal graph neural network model.

[0093] In addition, the local training set of each site is divided into a support set and a query set. The support set is used to train the local spatiotemporal graph neural network model, and the query set is used to calculate the training loss and update the parameters of the global spatiotemporal graph neural network model.

[0094] Specifically, the training process for a global spatiotemporal graph neural network model is as follows:

[0095] S121. Randomly select at least one station and update the parameters of the local graph neural network model of each selected station to the parameters of the global spatiotemporal graph neural network model.

[0096] S122. For each selected site, train the local spatiotemporal graph neural network model based on the support set in the local training set, and update the parameters of the local spatiotemporal graph neural network model.

[0097] S123. For each selected site, perform sample augmentation on the samples in the query set of that site; calculate the training loss on the sample-augmented query set based on the updated local spatiotemporal graph neural network model on the local training set.

[0098] S124. Update the parameters of the global spatiotemporal graph neural network model based on the training loss of each selected site.

[0099] During implementation, for each step of training the global spatiotemporal graph neural network model, at least one field station is randomly selected first. That is, the parameters of the global spatiotemporal graph neural network model are updated once based on the local training set of the selected at least one field station.

[0100] For each selected site, the parameters of the current global spatiotemporal graph neural network model are sent to each selected site, updating the local spatiotemporal graph neural network model of the selected site to match the parameters of the current global spatiotemporal graph neural network model. Then, the local spatiotemporal graph neural network model is trained based on the support set in the local training set, updating its parameters accordingly. In practice, multi-step training can be performed, meaning the parameters of the local spatiotemporal graph neural network model are updated multiple times, with the last updated parameter recorded as... , This represents the parameters of the local spatiotemporal graph neural network model for the i-th data center.

[0101] During implementation, during training on the support set, the gradient is calculated based on the reconstruction loss of the reconstruction module, and the parameters of the local spatiotemporal graph neural network model are updated via backpropagation. The specific reconstruction loss is detailed below.

[0102] Then, the training loss is calculated on the query set of the local training set based on the updated local spatiotemporal graph neural network model.

[0103] The parameters of the global spatiotemporal graph neural network model are updated using the following formula based on the training loss of the selected sites:

[0104] ;

[0105] ;

[0106] in, Indicates total training loss gradient, This represents the total training loss of the K selected sites. This represents the training loss of the i-th selected site. Indicates the learning rate. This represents the parameters of the global spatiotemporal graph neural network model before the update. This represents the updated parameters of the global spatiotemporal graph neural network model.

[0107] Training is stopped when the global spatiotemporal graph neural network model has been trained a preset number of times or when the total training loss has reached a preset accuracy. The resulting global spatiotemporal graph neural network model is a pre-trained anomaly detection model.

[0108] Specifically, for each selected site, the training loss is calculated on the query set augmented from the local training set using the following method:

[0109] ;

[0110] in, Indicates the reconstruction loss. Indicates comparative loss, The parameters represent the global spatiotemporal graph neural network model. and Represents the weight parameters. Indicates the regularization weight. This represents the 2-norm of a matrix.

[0111] Specifically, the reconstruction loss is calculated using the following formula:

[0112] ;

[0113] in, The loss represents the edge feature reconstruction loss. This represents the graph structure reconstruction loss. and This represents the weighting parameter.

[0114] During implementation, for each edge, the mean square error (MSE) between the features reconstructed by the reconstruction module and the true features of the edge is calculated. Then, the average mean square error of all edges is calculated to obtain the edge feature reconstruction loss.

[0115] Specifically, the graph structure reconstruction loss is calculated using the following formula:

[0116] ;

[0117] Where N represents the number of nodes in the graph. An indicator function that indicates whether there is an edge between the i-th node and the j-th node in the graph. This represents the probability predicted by the reconstruction module that there is an edge between the i-th node and the j-th node in the graph.

[0118] This is an indicator function that indicates whether there is an edge between node i and node j in the graph. If an edge actually exists between node i and node j at time step T, then... ,otherwise, .

[0119] Using only reconstruction loss may result in an insufficiently compact feature space, leading to scattered representations of normal samples and making it easier for outliers to be "mixed in." Therefore, this invention introduces contrastive loss. Specifically, the contrastive loss is calculated using the following formula:

[0120] ;

[0121] in, This represents the spatiotemporal features of the i-th sample in the current training batch. This represents the spatiotemporal features of the augmented sample of the i-th sample in the current training batch. This represents the spatiotemporal features of the j-th sample in the current training batch. Indicates an indicator function, The result is 1 if the condition is met, and 0 otherwise. M represents the number of samples in the current training batch. This represents the similarity function.

[0122] In practice, since the training set only contains normal samples, this invention uses data augmentation to create similar sample pairs, that is, to obtain augmented samples of normal samples, thereby augmenting the samples in the query set.

[0123] Specifically, the augmented sample for the i-th sample is obtained in the following way:

[0124] For the i-th sample, the jitter time corresponding to the sample is randomly generated within the maximum jitter range;

[0125] Based on the jitter time corresponding to the sample, the time range corresponding to the augmented sample is determined, and the network session time series data corresponding to the normal historical network session time series data of the current site within this time range is extracted to construct the augmented sample.

[0126] The exact segmentation point of a session within a time window may vary slightly, but this should not affect the model's judgment of the overall behavior. Therefore, to simulate the slight time asynchrony in communication, for the i-th sample in the query set, the jitter time corresponding to the sample is randomly generated within the maximum jitter range, and then an enhanced sample is constructed based on the jitter time.

[0127] For example, if the original sample's time range is [t1, t2], and a jitter time Δt is randomly generated within the maximum jitter range, the corresponding augmented sample is composed of normal historical network session time-series data within the time range [t1+Δt, t2+Δt]. If 5 minutes is considered a time step, then the network session features and device features within [t1+Δt, t1+Δt+5 minutes] are the data for the first time step of the augmented sample. And so on.

[0128] The jitter range should be proportional to the natural fluctuation of network traffic. A network with very stable, periodic traffic should have a small jitter range; a network with greater traffic fluctuations can have a larger jitter range.

[0129] Therefore, the maximum jitter range is obtained using the following method:

[0130] The fluctuation coefficient is calculated based on the number of surviving sessions at each time step of the normal historical network session time-series data of the current site.

[0131] The waveform coefficients are mapped to the maximum jitter range.

[0132] The maximum jitter range is different for each site, so the maximum jitter range for each site is calculated separately.

[0133] Specifically, the volatility coefficient is calculated using the following formula:

[0134] ;

[0135] in, This indicates the number of time steps in the normal historical network session time-series data of the current site. This indicates the number of samples at each time step. This represents the number of surviving sessions at the j-th sampling time step (i-th time step). This represents the average number of surviving sessions at the i-th time step.

[0136] In practice, surviving sessions are those that started before the sampling time and have not yet ended at the sampling time. Surviving sessions reflect the load and activity of network connections, and their fluctuations directly reflect the natural rhythm of network traffic. Therefore, for each time step (e.g., 5 minutes), the number of surviving sessions at each sampling time (e.g., once per second) is determined, and then the average number of surviving sessions for that time step is calculated. The fluctuation coefficient of the site is then calculated according to the above formula.

[0137] Then, the volatility coefficient is mapped to the maximum jitter range. The mapping relationship needs to satisfy: When the value is 0 (perfectly stationary network), It should also be close to 0. The larger, .

[0138] Specifically, the mapping is performed using the following formula:

[0139] ;

[0140] in, Indicates scaling factor (e.g.) ), used to control the overall intensity of jitter, where T represents the time step length of the sample.

[0141] By adopting an adaptive enhancement strategy, data enhancement is closely linked to the actual physical characteristics of the site, which can generate reasonable similar samples and improve the authenticity of the enhanced samples, thus making the enhancement effect more intelligent and effective.

[0142] In practice, for the i-th sample and its corresponding augmented sample, a positive sample pair is formed, and other samples form a negative sample pair. The core of contrastive loss is to pull in similar samples (positive sample pairs) and push away dissimilar samples (negative sample pairs). Through contrastive loss, the feature representations of normal samples learned by the model will be more compact in the vector space, while the representations of abnormal samples will fall outside this compact cluster, forming a clearer boundary and greatly improving the model's discriminative ability.

[0143] In implementation, after obtaining the pre-trained anomaly detection model, for a new distribution network substation, i.e., the target distribution network substation, normal historical session time-series data of the target distribution network substation are collected. A small number of samples are constructed locally on the target substation using the aforementioned sample construction method to form a fine-tuning training set. Based on this fine-tuning training set, the pre-trained anomaly detection model is fine-tuned to obtain the trained anomaly detection model corresponding to the target distribution network substation. The loss from fine-tuning training can be calculated using the aforementioned training loss calculation formula.

[0144] After obtaining the trained anomaly detection model corresponding to the target distribution network station, the network session time series data of the target station at T time steps are input into the anomaly detection model, and the reconstruction loss is calculated as the first anomaly score.

[0145] The second anomaly score for each session is obtained based on the clustering type of each session within the target time step, including:

[0146] The clustering type for each session within the target time step is determined based on self-evolutionary clustering.

[0147] If the clustering type of the session is a known abnormal class, then the second abnormality score of the session is obtained based on the degree of danger of the known abnormal class;

[0148] If the clustering type of the session is unknown, then the second anomaly score of the session is calculated based on the session’s temporal characteristics, distribution characteristics, and the size of the clustering type.

[0149] During implementation, historical sessions from the target distribution network substations are collected, and a feature vector is constructed for each historical session. The collection includes characteristic data of historical sessions, such as the number of transmitted data packets, the number of transmitted bytes, the minimum, maximum, and average data packet size, the minimum, maximum, and average data packet interval, the number of ports used, and power protocol characteristics. These power protocol characteristics include, but are not limited to, the following: DNP3 protocol function code sequence entropy, object variant distribution uniformity, time synchronization request frequency, IEC-104 protocol ASDU type distribution entropy, COT (transmission reason) sequence change rate, information object address distribution standard deviation, and telemetry / remote control request ratio. Each historical session is considered a cluster sample.

[0150] Historical sessions are initially clustered, and the resulting clusters are considered formal cluster types, with their cluster centers becoming formal cluster centers. For each formal cluster type, it can be manually classified as either a normal or abnormal class by experts. For each abnormal class, an anomaly score is determined based on the severity of the attack.

[0151] After obtaining the initial clusters, for each session within the target time step, the cluster type for each session within the target time step is determined based on self-evolutionary clustering. Specifically, this includes:

[0152] For each session within the target time step, construct the session feature vector for that session;

[0153] Calculate the local aggregation degree of the session feature vector and the distance to each formal cluster center;

[0154] If the distance between the session and the nearest formal cluster center is less than a distance threshold, and the local aggregation degree of the session is less than that of the nearest formal cluster center, then the session is assigned to the formal cluster type corresponding to the nearest formal cluster center; otherwise:

[0155] If no temporary cluster type exists or no temporary cluster center is located less than the distance threshold for the session, the session is assigned to a new temporary cluster type; otherwise, the session is assigned to the temporary cluster type corresponding to the nearest temporary cluster center; if a temporary cluster type exists with a data volume exceeding the first threshold, the temporary cluster type exceeding the first threshold is used as a new formal cluster type.

[0156] During implementation, for each session within the target time step, the session's feature data is collected in the manner described above, and a session feature vector is constructed.

[0157] Calculate the local aggregation degree of this session and its distance to each current formal cluster center. In practice, Euclidean distance can be calculated.

[0158] In implementation, the local aggregation degree of a session is calculated as follows: The clustering fusion radius is calculated using the session feature vector as the center. The number of data points within the session represents the local aggregation degree of that session.

[0159] During implementation, the fusion radius is calculated as follows:

[0160] ;

[0161] ;

[0162] in, Indicates fusion radius The value of the i-th dimension The set of session feature vectors representing historical sessions. This represents the value of the i-th dimension of the session feature vector x. This represents the value of the i-th dimension of the historical session feature vector y. The standard deviation of the i-th dimension of the session feature vector representing historical sessions. Let represent the mean of the i-th dimension of the session feature vector of historical sessions. and This represents the weighting parameter.

[0163] If the distance between a session and the nearest formal cluster center is less than a distance threshold, and the local aggregation degree of the session is less than the local aggregation degree of the nearest formal cluster center, then the session is assigned to the cluster type corresponding to the nearest formal cluster center. If the above conditions are not met, it is necessary to determine whether the session belongs to an existing temporary type or a completely new type.

[0164] If no temporary cluster type exists, or if no temporary cluster center exists that is less than the distance threshold from the session, then the session is treated as a data point in a new temporary cluster type.

[0165] If there is a temporary cluster center that is less than the distance threshold to the session, then the session is assigned to the temporary cluster type corresponding to the nearest temporary cluster center.

[0166] After a new temporary clustering type is established, it is not immediately used as a formal clustering type. Instead, a stability assessment is conducted, and it is only used as a new formal clustering type when the amount of data reaches a certain level.

[0167] The clustering type is obtained by clustering each session within the target time step as described above.

[0168] For a session, if its cluster type belongs to a known normal class, its second anomaly score is 0. If its cluster type belongs to a known abnormal class, the anomaly score corresponding to the cluster type is the second anomaly score of the session. If the cluster type of the session is unknown, i.e., belongs to a temporary cluster type, the second anomaly score of the session is calculated based on the session's temporal characteristics, distribution characteristics, and the size of the cluster type.

[0169] Specifically, the second abnormality score of the session is calculated using the following formula:

[0170] ;

[0171] in, This represents the second abnormal score of session s. This represents the distance between session s and the nearest known normal cluster center. Indicates the time period during which session s occurs. Indicates the time period The probability of a session occurring. This indicates the number of events in session s. This represents the average number of events in a normal historical session. This indicates the number of sessions in the cluster type to which session s belongs. Indicates the attenuation coefficient. , and This represents the weighting parameter.

[0172] If a temporary cluster contains very few sessions, it indicates a newly emerging and very rare pattern, with a high degree of anomalousness. In implementation, a decay coefficient is added to control the rate at which the impact of cluster size on outlier scores decays.

[0173] In practice, the degree of anomalousness of a session is measured by comparing it with the clustering centers of known normal clusters. The greater the distance, the greater the difference between the session's behavior and the known normal pattern, and the higher its anomalousness score.

[0174] During implementation, This can be calculated from a time histogram of historical data, for example, by estimating the probability value based on the frequency of occurrence of all historical sessions in each hour. If a session occurs in a very rare time period ( If the probability of an anomaly is lower, then the probability of it being abnormal is higher.

[0175] Furthermore, session anomalies are assessed by measuring the deviation of the number of events in a session from the number of events in a normal session. Session events include, for example, connection requests and connection error events.

[0176] After obtaining the first score and the second anomaly score for each session, the two scores can be weighted and summed to obtain the overall anomaly score, thus obtaining the anomaly detection result for each session.

[0177] The network security situation awareness method for distribution network substations provided in this invention has the following advantages: It achieves accurate identification of time-step anomalies through a trained anomaly detection model and outputs time-step-level anomaly detection results based on temporal features; furthermore, for each session within the target time step, a corresponding second anomaly score is calculated based on its clustering type, thereby completing anomaly discrimination at a finer granularity. By fusing the first and second anomaly scores, the final anomaly determination result for each session is obtained, locating the anomaly to the specific session level. This method effectively improves the granularity and accuracy of anomaly detection, helps to discover potential threats early, and enhances the security and operational stability of the distribution network substation.

[0178] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0179] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for network security situation awareness at power distribution network substations, characterized in that, Includes the following steps: Acquire the target time step and the network session timing data of the target distribution network station and the previous multiple steps; input the network session timing data into the trained anomaly detection model to perform anomaly detection, and obtain the first anomaly score of each session within the target time step; The second anomaly score for each session is obtained based on the clustering type of each session within the target time step; The anomaly detection results for each session within the target time step are obtained based on the first and second anomaly scores for each session. The second anomaly score for each session is obtained based on the clustering type of each session within the target time step, including: The clustering type for each session within the target time step is determined based on self-evolutionary clustering. If the clustering type of the session is a known abnormal class, then the second abnormality score of the session is obtained based on the degree of danger of the known abnormal class; If the clustering type of the session is unknown, the second anomaly score of the session is calculated based on the session's temporal characteristics, distribution characteristics, and the size of the clustering type. The second anomaly score for a session is calculated using the following formula, based on the session's temporal characteristics, distribution characteristics, and the size of the cluster type: ； in, This represents the second abnormal score of session s. This represents the distance between session s and the nearest known normal cluster center. Indicates the time period during which session s occurs. Indicates the time period The probability of a session occurring. This indicates the number of events in session s. This represents the average number of events in a normal historical session. This indicates the number of sessions in the cluster type to which session s belongs. Indicates the attenuation coefficient. , and Indicates the weighting parameter; The trained anomaly detection model is obtained using the following method: Collect normal historical network session time series data for each site to construct a local training set; A global spatiotemporal graph neural network model is constructed, and the global spatiotemporal graph neural network model is pre-trained based on the local training set of all stations to obtain a pre-trained anomaly detection model; A fine-tuning training set is constructed at the target site, and the pre-trained anomaly detection model is fine-tuned based on the fine-tuning training set to obtain the trained anomaly detection model corresponding to the target site.

2. The network security situation awareness method for power distribution network substations according to claim 1, characterized in that, The clustering type for each session within the target time step is determined based on self-evolutionary clustering, including: For each session within the target time step, construct the session feature vector for that session; Calculate the local aggregation degree of the session feature vector and the distance to each formal cluster center; If the distance between the session and the nearest formal cluster center is less than a distance threshold, and the local aggregation degree of the session is less than that of the nearest formal cluster center, then the session is assigned to the formal cluster type corresponding to the nearest formal cluster center; otherwise: If no temporary cluster type exists or no temporary cluster center is located less than the distance threshold for the session, the session is assigned to a new temporary cluster type; otherwise, the session is assigned to the temporary cluster type corresponding to the nearest temporary cluster center; if a temporary cluster type exists with a data volume exceeding the first threshold, the temporary cluster type exceeding the first threshold is used as a new formal cluster type.

3. The network security situation awareness method for distribution network substations according to claim 1, characterized in that, The global spatiotemporal graph neural network model includes: The spatial relationship modeling module is used to model the spatial dependencies of the samples at each time step and extract the spatial features of each node at each time step. The temporal relationship modeling module is used to capture the temporal variation pattern of each node based on the spatial characteristics of each node at each time step, and obtain the spatiotemporal characteristics of each node; The reconstruction module is used to reconstruct graph features based on the spatiotemporal characteristics of each node.

4. The network security situation awareness method for distribution network substations according to claim 3, characterized in that, The local training set for each site includes a support set and a query set; a local spatiotemporal graph neural network model is constructed locally at each site; the local spatiotemporal graph neural network model has the same structure as the global spatiotemporal graph neural network model; The first training process of the global spatiotemporal graph neural network model based on the local training sets of all stations includes: Randomly select at least one station, and update the parameters of the local graph neural network model of each selected station to the parameters of the global spatiotemporal graph neural network model; For each selected site, the local spatiotemporal graph neural network model is trained based on the support set in the local training set, and the parameters of the local spatiotemporal graph neural network model are updated. For each selected site, sample augmentation is performed on the samples in the query set of that site; the training loss is calculated on the augmented query set based on the updated local spatiotemporal graph neural network model on the local training set; The parameters of the global spatiotemporal graph neural network model are updated based on the training loss of each selected site.

5. The network security situation awareness method for distribution network substations according to claim 4, characterized in that, The training loss is calculated on the augmented query set from the local training set using the following method: ； in, Indicates the reconstruction loss. Indicates comparative loss, The parameters represent the global spatiotemporal graph neural network model. and Represents the weight parameters. Indicates the regularization weight. This represents the 2-norm of a matrix.

6. The network security situation awareness method for power distribution network substations according to claim 5, characterized in that, The contrast loss is calculated using the following method: ； in, This represents the spatiotemporal features of the i-th sample in the current training batch. This represents the spatiotemporal features of the augmented sample of the i-th sample in the current training batch. This represents the spatiotemporal features of the j-th sample in the current training batch. This indicates the indicator function, where M represents the number of samples in the current training batch. This represents the similarity function.

7. The network security situation awareness method for power distribution network substations according to claim 6, characterized in that, The augmented sample of the i-th sample is obtained in the following way: For the i-th sample, the jitter time corresponding to the sample is randomly generated within the maximum jitter range; Based on the jitter time corresponding to the sample, the time range corresponding to the augmented sample is determined, and the network session time series data corresponding to the normal historical network session time series data of the current site within this time range is extracted to construct the augmented sample.

Images