Training Method and System for Communication Replay Attack Detection Model Based on Deep Learning

Abstract

This invention provides a training method and system for a communication replay attack detection model based on deep learning, relating to the field of facility communication security technology. The method includes: collecting data packet features under normal communication conditions, including instruction transmission time intervals, data packet temporal correlation, and the matching degree between instructions and real-time power grid load; converting the collected data packet features into a multi-dimensional feature vector set and constructing a baseline reference domain within the feature space; structurally dividing the baseline reference domain according to the distribution characteristics of the feature vectors to obtain multiple sub-regions; analyzing the distribution of feature vectors in each sub-region to obtain analysis results; obtaining adaptive calibration coefficients based on the analysis results; and optimizing and enhancing the original data packet features using the calibration coefficients to obtain optimized and enhanced data packet features. This invention solves the problems of low accuracy in detecting communication replay attacks and difficulty in adapting to complex communication environments in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of facility communication security technology, and in particular to a training method and system for a communication replay attack detection model based on deep learning. Background Technology

[0002] In smart grid communication, a typical communication replay attack occurred. The attacker monitored the communication link for a long time and obtained a large number of data packets in normal communication state, including data packets of key instructions for controlling the start and stop of power equipment and adjusting power distribution. During the peak load period of the power grid, the attacker replayed the previously intercepted data packets, interfering with normal power dispatch instructions. The replayed data packets caused some substation equipment to misinterpret the instructions and incorrectly adjust the power output, causing voltage fluctuations in local areas and affecting the normal power consumption of a large number of surrounding users.

[0003] Traditional detection methods revealed their shortcomings in this case. Because they rely heavily on simple rule matching and timestamp verification, they are unable to accurately identify complex anomalies in replayed data packets. For example, when an attacker cleverly alters the timestamp of a data packet to place it within a normal time window, traditional detection methods cannot effectively identify it, resulting in replay attacks going undetected for a long time and seriously threatening the security and stable operation of smart grid communications. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a training method and system for a communication replay attack detection model based on deep learning, thereby solving the problems of low accuracy and difficulty in adapting to complex communication environments in the prior art.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] Firstly, a method for training a communication replay attack detection model based on deep learning, the method comprising:

[0007] Collect data packet characteristics under normal communication conditions. Data packet characteristics include command sending time interval, data packet timing correlation, and the matching degree between commands and real-time power grid load.

[0008] The collected data packet features are converted into a multi-dimensional feature vector set, and a reference domain is constructed in the feature space. The reference domain is structurally divided according to the distribution characteristics of the feature vectors to obtain multiple sub-regions. The distribution of feature vectors in each sub-region is analyzed to obtain the analysis results. Adaptive calibration coefficients are obtained based on the analysis results, and the original data packet features are optimized and enhanced using the calibration coefficients to obtain the optimized and enhanced data packet features.

[0009] Based on the optimized and enhanced packet features, a deep learning training dataset is constructed, which includes normal communication samples and labeled replay attack samples.

[0010] Based on the constructed training dataset, a deep learning model is trained, in which the deep learning model learns the temporal patterns of normal communication through an LSTM (Long Short-Term Memory) network.

[0011] The labeled replay attack samples are input into the pre-trained deep learning model to obtain the predicted feature vector. The geometric distance between the predicted feature vector and the real feature vector and the average geometric distance between the predicted feature vector and the nearest real sample are calculated. With the goal of minimizing the distance, the model parameters are optimized and adjusted so that the optimized deep learning model can identify replay attacks in real time, and the final detection model is obtained.

[0012] Furthermore, data packet characteristics are collected under normal communication conditions. These characteristics include command transmission time intervals, data packet timing correlation, and the matching degree between commands and real-time grid load, including:

[0013] A continuous stream of raw instruction data is obtained by parsing the communication logs;

[0014] Based on the obtained original instruction data stream, the time difference between the arrival of adjacent instructions is calculated to obtain the instruction transmission time interval characteristics;

[0015] Based on the obtained instruction data stream and its type and content sequence, and combined with the obtained instruction sending time interval characteristics, the logical dependencies and state transition relationships between instructions are analyzed, thereby constructing the data packet temporal correlation characteristics;

[0016] Based on the characteristics of instruction sending time interval and data packet timing correlation, the real-time load monitoring interface of the power grid is called to compare the received instruction content and context characteristics with the current real-time load data to obtain the matching degree characteristics between the instruction and the real-time load of the power grid.

[0017] Furthermore, the collected data packet features are converted into a multi-dimensional feature vector set, and a benchmark reference domain is constructed within the feature space. Based on the distribution characteristics of the feature vectors, the benchmark reference domain is structurally divided to obtain multiple sub-regions, including:

[0018] Based on the collected multidimensional data packet features, all features of each data packet are normalized and combined into a unified multidimensional feature vector to obtain a multidimensional feature vector set.

[0019] Based on the obtained multidimensional feature vector set, a benchmark reference domain covering all normal communication features is constructed in the feature space through density clustering or grid partitioning methods.

[0020] Statistical analysis is performed on the feature vector distribution characteristics in the constructed benchmark reference domain to identify high-density and low-density regions in the feature space, so as to obtain the distribution characteristic analysis results.

[0021] Based on the distribution characteristics analysis results, an adaptive threshold is used to structurally divide the reference domain, ultimately obtaining multiple sub-regions that characterize different distribution characteristics.

[0022] Furthermore, the distribution of feature vectors in each sub-region is analyzed to obtain analysis results; based on the analysis results, adaptive calibration coefficients are obtained, and the original data packet features are optimized and enhanced using these calibration coefficients to obtain optimized and enhanced data packet features, including:

[0023] Based on the obtained multiple sub-regions, the distribution density and variance characteristics of the feature vectors in each sub-region are statistically analyzed to obtain the distribution characteristics analysis results of each sub-region;

[0024] Based on the obtained distribution characteristic analysis results, the corresponding adaptive calibration coefficients are calculated for different sub-regions;

[0025] The obtained adaptive calibration coefficients are applied to the features of the acquired raw data packets, and the features are optimized and enhanced through weighting and scaling operations.

[0026] The optimized and enhanced packet features are normalized to obtain the final optimized and enhanced packet features.

[0027] Furthermore, based on the optimized and enhanced packet features, a deep learning training dataset is constructed. The training dataset includes normal communication samples and labeled replay attack samples, including:

[0028] Based on the optimized and enhanced data packet features obtained, all feature vectors under normal communication conditions are extracted to form a normal communication sample set.

[0029] By simulating the replay attack process, attack features are injected and sequences are reconstructed into normal communication samples to obtain replay attack samples containing attack features.

[0030] Based on the obtained replay attack samples, manual or automated annotation is performed to mark the attack type and attack time characteristics of the replay attack samples;

[0031] The normal communication sample set and the labeled replay attack sample set are merged according to a preset ratio, and the data is shuffled to finally construct the deep learning training dataset.

[0032] Furthermore, based on the constructed training dataset, a deep learning model is trained. This deep learning model learns the temporal patterns of normal communication through an LSTM (Long Short-Term Memory) network, including:

[0033] Based on the constructed deep learning training dataset, feature sequences of training samples are extracted as model input, and the initial structure and parameters of the LSTM network are configured based on the dimension of the input features.

[0034] The temporal features of the input are modeled using a sliding window method through a configured LSTM network. The temporal patterns and feature dependencies under normal communication conditions are learned through memory units and gating mechanisms to obtain the modeled output results.

[0035] Based on the modeled output, the difference between the model's predicted output and the true label is calculated using the backpropagation algorithm, and the weight parameters of the LSTM network are iteratively optimized using the gradient descent method.

[0036] The model performance during the optimization process is monitored in real time using a validation set. When the model's accuracy on the validation set reaches a stable state, the network parameters and model structure at this point are saved to obtain the pre-trained deep learning model.

[0037] The labeled replay attack samples are input into the initially trained deep learning model to obtain predicted feature vectors. The geometric distance between the predicted feature vectors and the true feature vectors, as well as the average geometric distance between the predicted feature vectors and their nearest real neighbors, are calculated. The model parameters are optimized to minimize these distances, enabling the optimized deep learning model to identify replay attacks in real time, resulting in the final detection model, which includes:

[0038] The labeled replay attack samples are input into the pre-trained deep learning model, and the corresponding predicted feature vectors are obtained through forward propagation of the LSTM network.

[0039] Based on the obtained predicted feature vectors, calculate the Euclidean distance between them and the true feature vectors, as well as the average geometric distance between them and the K nearest neighbor true sample feature vectors in the normal training sample set.

[0040] With the goal of minimizing the calculated Euclidean distance and average geometric distance, the parameters of the LSTM network are finely adjusted through the backpropagation algorithm to enhance the model's ability to identify anomalous features.

[0041] The optimization process is repeated until the model's replay attack detection accuracy on the validation set reaches a preset threshold, ultimately resulting in a deep learning detection model that can identify replay attacks in real time.

[0042] Secondly, a deep learning-based communication replay attack detection model training system includes:

[0043] The acquisition module is used to collect data packet characteristics under normal communication conditions. The data packet characteristics include instruction sending time interval, data packet timing correlation, and the matching degree between the instruction and the real-time load of the power grid.

[0044] The enhancement module is used to convert the collected data packet features into a multi-dimensional feature vector set and construct a reference domain in the feature space; the reference domain is structurally divided according to the distribution characteristics of the feature vectors to obtain multiple sub-regions; the distribution of feature vectors in each sub-region is analyzed to obtain the analysis results; adaptive calibration coefficients are obtained based on the analysis results, and the original data packet features are optimized and enhanced using the calibration coefficients to obtain the optimized and enhanced data packet features;

[0045] The training module is used to construct a deep learning training dataset based on the optimized and enhanced packet features. The training dataset includes normal communication samples and labeled replay attack samples. Based on the constructed training dataset, a deep learning model is trained, in which the deep learning model learns the temporal patterns of normal communication through an LSTM (Long Short-Term Memory) network.

[0046] The optimization module is used to input the labeled replay attack samples into the pre-trained deep learning model to obtain the predicted feature vector; calculate the geometric distance between the predicted feature vector and the real feature vector and the average geometric distance between the predicted feature vector and the nearest real sample, and optimize and adjust the model parameters with the goal of minimizing the distance, so that the optimized deep learning model can identify replay attacks in real time and obtain the final detection model.

[0047] Thirdly, a computing device includes:

[0048] One or more processors;

[0049] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0050] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0051] The above-described solution of the present invention has at least the following beneficial effects:

[0052] By collecting multi-dimensional data packet features, including command sending time intervals, data packet temporal correlation, command matching degree with real-time power grid load, and constructing and adaptively enhancing the feature space reference domain, this method overcomes the technical problems of traditional detection methods that rely on simple rule matching and timestamp verification, are difficult to identify replay attacks with timestamp tampering, have low detection accuracy, and cannot adapt to complex communication environments. This approach achieves the goals of capturing communication data temporal anomalies, effectively identifying replay attacks, and improving detection accuracy. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating the training method for a deep learning-based communication replay attack detection model provided in an embodiment of the present invention.

[0054] Figure 2 This is a schematic diagram of a deep learning-based communication replay attack detection model training system provided in an embodiment of the present invention. Detailed Implementation

[0055] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0056] like Figure 1 As shown, embodiments of the present invention propose a deep learning-based method for training a communication replay attack detection model, the method comprising the following steps:

[0057] Step 1: Collect data packet characteristics under normal communication conditions. Data packet characteristics include command sending time interval, data packet timing correlation, and the matching degree between commands and real-time power grid load.

[0058] Step 2: Convert the collected data packet features into a multi-dimensional feature vector set and construct a reference domain in the feature space; divide the reference domain into multiple sub-regions according to the distribution characteristics of the feature vectors; analyze the distribution of feature vectors in each sub-region to obtain the analysis results; obtain adaptive calibration coefficients based on the analysis results; optimize and enhance the original data packet features using the calibration coefficients to obtain the optimized and enhanced data packet features.

[0059] Step 3: Based on the optimized and enhanced packet features, construct a deep learning training dataset. The training dataset includes normal communication samples and labeled replay attack samples.

[0060] Step 4: Train a deep learning model based on the constructed training dataset. The deep learning model learns the temporal patterns of normal communication through an LSTM (Long Short-Term Memory) network.

[0061] Step 5: Input the labeled replay attack samples into the pre-trained deep learning model to obtain the predicted feature vector; calculate the geometric distance between the predicted feature vector and the true feature vector, and the average geometric distance between the predicted feature vector and the nearest neighbor true sample. Optimize and adjust the model parameters with the goal of minimizing the distance, enabling the optimized deep learning model to identify replay attacks in real time, thus obtaining the final detection model. In this embodiment of the invention, by collecting multi-dimensional data packet features such as instruction sending time interval, data packet timing correlation, and the matching degree between instructions and real-time power grid load, a feature space benchmark reference domain is constructed. Adaptive calibration coefficient optimization features are obtained through sub-region distribution analysis. Based on the optimized features, a training dataset containing normal and labeled replay attack samples is constructed. An LSTM network is used to learn communication timing patterns. Then, by calculating the geometric distance between the predicted and true feature vectors and the average distance to the nearest neighbor sample, the model parameters are optimized. Therefore, this overcomes the technical problems of traditional detection methods that rely solely on simple rule matching and timestamp verification, cannot identify replay attacks with timestamp tampering, have low detection accuracy, and are difficult to adapt to complex communication environments. This achieves comprehensive capture of abnormal communication data features, effective identification of various replay attack behaviors, and improved detection accuracy.

[0062] In a preferred embodiment of the present invention, step 1 above may include:

[0063] Step 1.1 involves parsing communication logs to obtain a continuous stream of raw instruction data. This includes: firstly, comprehensively collecting all communication logs generated during the operation of the smart grid. These logs contain instruction records transmitted between all devices. Then, using specialized log parsing tools, the collected logs are parsed line by line according to the standardized format of the smart grid communication protocol. During parsing, irrelevant and redundant information, such as invalid device status messages and duplicate empty instruction records, is removed, extracting meaningful instruction data. The extracted instruction data is then arranged in the order of transmission in the communication link, ultimately forming a continuous and complete stream of raw instruction data.

[0064] Step 1.2: Based on the obtained raw instruction data stream, calculate the time difference between adjacent instructions to obtain the instruction transmission time interval characteristic. Specifically, after acquiring the continuous raw instruction data stream, first determine the specific position of each instruction in the raw instruction data stream and its corresponding generation time information. The time information is accurate to the millisecond level to ensure accurate reflection of the instruction transmission sequence. Then, starting from the first instruction in the raw instruction data stream, calculate the difference in generation time between adjacent instructions sequentially, i.e., the generation time of the later instruction minus the generation time of the earlier instruction. During the calculation process, perform preliminary screening for abnormal time differences, such as time jumps caused by log recording errors. By comparing with the time interval range of historical normal communication periods, eliminate abnormal values ​​that clearly do not conform to normal communication patterns. Organize all the time differences between adjacent instructions after screening to form a series of ordered time interval data, which together constitute the instruction transmission time interval characteristic.

[0065] Step 1.3: Based on the obtained instruction data stream and its type and content sequence, and combined with the obtained instruction sending time interval characteristics, analyze the logical dependencies and state transition relationships between instructions, thereby constructing the data packet temporal correlation characteristics. Specifically, this includes: first, classifying each instruction in the original instruction data stream, determining the instruction type according to the instruction's functional attributes, such as device start instruction, load adjustment instruction, and status query instruction, and extracting the specific content information contained in each instruction, such as the corresponding device number and adjustment parameter value, thus forming a clear instruction type and content sequence; then, combining the obtained instruction sending time interval characteristics, analyzing the time dimension of different types of instructions. The study focuses on the following scenarios: for example, the typical transmission interval range of a certain type of instruction in normal communication; based on this, the study focuses on the logical relationship between two consecutive instructions, determining whether the latter instruction is a reasonable follow-up instruction after the former, such as whether a load monitoring instruction should follow a device start instruction, and whether the state transitions during instruction execution conform to the operating logic of the smart grid, such as whether the transition from standby state to operating state corresponds to a specific instruction sequence. Through the analysis of the logical relationships of a large amount of instruction data, the study summarizes the logical dependency patterns and state transition rules between instructions under normal communication conditions, and then constructs a data packet time sequence correlation feature that can reflect the time sequence correlation characteristics of communication data.

[0066] Step 1.4: Based on the instruction sending interval characteristics and data packet timing correlation characteristics, the real-time load monitoring interface of the power grid is invoked. The received instruction content and context characteristics are compared with the current real-time load data to obtain the matching degree characteristics between the instruction and the real-time load of the power grid. Specifically, this includes: first, establishing a connection with the smart grid real-time load monitoring; by invoking the provided real-time load monitoring interface, obtaining the actual load data of each region and time period of the power grid in real time. The data includes key load parameters such as current, voltage, and power, and the data update frequency is consistent with the instruction transmission frequency to ensure the time synchronization of load data and instruction data; then, combining the obtained instruction sending interval characteristics and data packet timing correlation characteristics, determining the sending time of each instruction. The system takes into account the corresponding power grid operating context, such as the type and time interval information of adjacent instructions before and after the instruction is sent. Then, it compares the content information of each instruction, such as the adjustment target value in the load adjustment instruction, with the real-time load data of the power grid at the time the load adjustment instruction is sent to determine whether the instruction requirements are consistent with the actual power grid load demand. For example, it determines whether it is reasonable to send a load reduction instruction during a period of high power grid load, and whether the adjustment parameters in the instruction match the current load deviation. Based on the comparison results, a quantitative scoring method is used to evaluate the matching degree between each instruction and the real-time load of the power grid. The scoring range is from 0 to 100 points, with a higher score indicating a higher matching degree. The matching degree scores of all instructions are compiled to form the matching degree feature between the instruction and the real-time load of the power grid.

[0067] In this embodiment of the invention, the original instruction data stream is obtained by parsing the communication log, the transmission time interval feature is extracted by calculating the time difference between adjacent instructions, and the logical dependency is analyzed by combining instruction type, content sequence and time interval to construct time-series correlation features. Then, the matching degree feature is obtained by calling the real-time load interface of the power grid to compare the consistency between instructions and load. Therefore, it overcomes the technical problems of traditional feature collection that only focuses on a single timestamp or instruction content, ignores the logical correlation between instructions and the matching of power grid load, resulting in a single feature dimension and inability to reflect the deep rules of communication data. Thus, it achieves the comprehensive collection of multi-dimensional key features of communication data, captures the time rules, logical correlations and the adaptation relationship with power grid load of normal communication.

[0068] In a preferred embodiment of the present invention, step 2 above may include:

[0069] Step 2.1: Based on the collected multidimensional data packet features, normalize all features of each data packet and combine them into a unified multidimensional feature vector to obtain a multidimensional feature vector set. Specifically, this includes clarifying that the collected multidimensional data packet features include three types of features: instruction sending time interval, data packet temporal correlation, and the matching degree between the instruction and the real-time load of the power grid. Since the numerical ranges of different features vary—for example, the instruction sending time interval may fluctuate between 0.1 and 10 seconds, while the matching degree between the instruction and the real-time load of the power grid varies between 0 and 100 percentages—these magnitude differences can interfere with feature analysis and model training. Therefore, it is necessary to normalize all features of each data packet and combine them into a unified multidimensional feature vector set. When normalizing all features of a packet, for each type of feature, the maximum and minimum values ​​of each feature in all data packets are calculated. Then, a linear transformation is used to map the value of each feature to the range of 0 to 1, ensuring that all types of features are of the same magnitude. After normalization, the normalized instruction sending time interval feature value, data packet timing correlation feature value, and instruction matching degree feature value with real-time load of the power grid corresponding to each data packet are arranged in a fixed order and combined into a feature vector containing three dimensions. The above operation is performed on all collected normal communication data packets, and finally a multidimensional feature vector set composed of a large number of such multidimensional feature vectors is formed.

[0070] Step 2.2: Based on the obtained multidimensional feature vector set, a benchmark reference domain covering all normal communication features is constructed in the feature space using density clustering or grid partitioning methods. Specifically, based on the obtained multidimensional feature vector set as the data source, a suitable method is selected to construct the benchmark reference domain in the three-dimensional feature space composed of instruction sending time interval, data packet timing correlation, and instruction and real-time load matching degree of the power grid. If density clustering is selected, a reasonable clustering radius and minimum sample number parameter are first set. Each multidimensional feature vector in the feature space is traversed, and vectors whose distance from the multidimensional feature vector is less than the clustering radius and whose sample number reaches the minimum sample number are grouped into the same cluster. Multiple clusters are formed through multiple iterations. The clusters together cover all normal communication feature vectors, thus forming the benchmark reference domain. If grid partitioning is selected, the three-dimensional feature space is divided into several equally sized grid cells according to the normalized numerical range of the three types of features. The number of multidimensional feature vectors contained in each grid cell is counted. Grid cells containing feature vectors are retained, and blank grid cells without feature vectors are removed. All retained grid cells together constitute the benchmark reference domain covering all normal communication features.

[0071] Step 2.3 involves statistically analyzing the distribution characteristics of feature vectors in the constructed benchmark reference domain to identify high-density and low-density regions in the feature space, thereby obtaining the distribution characteristic analysis results. Specifically, this includes: using statistical analysis methods to study the distribution characteristics of feature vectors within the constructed benchmark reference domain. If the benchmark reference domain is composed of clusters formed by density clustering, the number of feature vectors within each cluster is calculated, and then combined with the volume occupied by the cluster in the feature space, the density of each cluster is obtained. The density value is the ratio of the number of feature vectors within the cluster to the cluster volume. By comparing the density values ​​of different clusters, high-density cluster regions and low-density cluster regions are distinguished. If the benchmark reference domain is composed of grid cells, the number of multidimensional feature vectors contained in each grid cell is directly counted. Grid cells with a number of vectors exceeding a preset density threshold are classified as high-density regions, and grid cells with a number of vectors below the preset density threshold are classified as low-density regions. During the statistical process, the specific location, size, and numerical distribution of feature vectors in the feature space of high-density and low-density regions are recorded simultaneously. For example, the concentration range of instruction sending time intervals and common values ​​of data packet timing correlation in high-density regions are recorded. The information is then organized and summarized to form a complete distribution characteristic analysis result.

[0072] Step 2.4: Based on the distribution characteristic analysis results, an adaptive threshold is used to structurally divide the benchmark reference domain, ultimately obtaining multiple sub-regions representing different characteristic distributions. Specifically, this includes: determining the adaptive threshold for dividing the benchmark reference domain based on the obtained distribution characteristic analysis results. The adaptive threshold is not a fixed value, but is dynamically set by considering the density difference and range size between high-density and low-density regions. For example, the average of the lowest density value in the high-density region and the highest density value in the low-density region is used as the core threshold reference. At the same time, the numerical dispersion of feature vectors in different regions is considered, and the threshold is fine-tuned. If the benchmark reference domain is a cluster structure, clusters with similar densities and adjacent positions are merged into one based on the adaptive threshold. Sub-regions are created by dividing clusters with significant density differences or large geographical distances into different sub-regions to ensure a relatively uniform distribution of feature vector density within each sub-region. If the reference domain is a grid cell structure, adjacent high-density grid cells are integrated into high-density sub-regions and adjacent low-density grid cells are integrated into low-density sub-regions according to an adaptive threshold. At the same time, transitional grid cells located between high-density and low-density regions are processed and assigned to the corresponding sub-regions based on the density of their surrounding areas and the number of their own feature vectors. Through the above division operations, the reference domain is finally divided into multiple sub-regions, each of which can represent a specific feature distribution characteristic, such as a high-density, highly concentrated sub-region or a low-density, discrete sub-region.

[0073] In this embodiment of the invention, by normalizing the features of multidimensional data packets and combining them into a unified multidimensional feature vector set, a reference domain covering all normal communication features is constructed based on the multidimensional feature vector set through density clustering or grid partitioning. The distribution characteristics of feature vectors within the reference domain are statistically analyzed to identify high-density and low-density regions. Then, based on the analysis results, an adaptive threshold is used to divide multiple sub-regions representing different distribution characteristics. Therefore, this method overcomes the problems of traditional feature processing, such as the lack of feature standardization leading to interference from differences in feature magnitude, the lack of definition of the reference range for normal communication features, and the inability to distinguish feature distribution differences. This achieves the goal of unifying feature magnitude to eliminate interference between features, clarifying the reference boundary of normal communication features, and capturing the distribution patterns of different regions within the feature space.

[0074] In a preferred embodiment of the present invention, step 2 above may include:

[0075] Step 2.5: Based on the obtained multiple sub-regions, the distribution density and variance characteristics of the feature vectors in each sub-region are statistically analyzed to obtain the distribution characteristic analysis results of each sub-region. Specifically, this includes: First, determining each divided sub-region, and for each sub-region, counting the number of all feature vectors contained therein, while measuring the volume range occupied by the sub-region in the feature space. Dividing the number of feature vectors by the volume of the sub-region yields the distribution density of feature vectors in each sub-region, thus reflecting the density of feature vectors in the region. Next, for each dimension of the feature vectors in each sub-region, such as the instruction sending time interval dimension, the data packet timing correlation dimension, and the instruction and real-time load matching degree dimension, the average value of all feature vector values ​​under the load matching degree dimension is calculated. Then, each feature vector value is subtracted from the average value and squared, and the average of all squared values ​​is calculated to obtain the variance of each dimension. The variance reflects the dispersion of feature vector values ​​under that dimension. The distribution density data and variance data of each dimension of each sub-region are organized and summarized to clarify the differences in density and dispersion among different sub-regions, forming a complete distribution characteristic analysis result for each sub-region.

[0076] Step 2.6: Based on the obtained distribution characteristic analysis results, calculate the corresponding adaptive calibration coefficients for different sub-regions. Specifically, this includes: First, based on the obtained distribution characteristic analysis results for each sub-region, determine the distribution density of each sub-region. For sub-regions with high distribution density, the normal communication feature vectors are more concentrated, representing the core region of the normal communication mode. A higher calibration coefficient weight should be set to strengthen the representativeness of the high-density sub-region features for the normal communication mode. For sub-regions with low distribution density, the normal communication feature vectors are more dispersed, with more edge features or potential interference features. A relatively lower calibration coefficient weight should be set to avoid over-amplifying interference information. Simultaneously, considering the variance characteristics of each sub-region, for sub-regions with small variance, the feature vector values ​​fluctuate less and are more stable. The adjustment range of the calibration coefficient should be smaller to maintain feature stability. For sub-regions with large variance, the feature vector values ​​are more dispersed and less stable. The adjustment range of the calibration coefficient should be larger to optimize feature consistency. Taking into account both density and variance factors, calculate a dedicated adaptive calibration coefficient for each sub-region.

[0077] Step 2.7: Apply the obtained adaptive calibration coefficients to the features of the collected raw data packets. Optimize and enhance the features through weighting and scaling operations. Specifically, this includes: first, identifying the sub-region to which each feature of the collected raw data packets belongs; then, determining which sub-region it falls into by comparing the position of the feature vector corresponding to the feature in the feature space; and finally, matching the adaptive calibration coefficient corresponding to that sub-region. For each dimension of the raw data packet features, multiply the original feature value of the dimension with the corresponding adaptive calibration coefficient to complete the weighting operation. This weighting highlights the importance of core sub-region features and weakens the interference of edge sub-region features. After the weighting operation, scale the weighted feature values ​​according to the distribution range of each sub-region feature. For feature dimensions with generally large values, reduce the feature values ​​according to the proportion corresponding to the calibration coefficient to better conform to the reasonable range of normal communication features; for feature dimensions with generally small values, enlarge the feature values ​​according to the proportion corresponding to the calibration coefficient to improve the recognizability of the features with generally small values. Through the coordinated operation of weighting and scaling, the features of the raw data packets are optimized and enhanced.

[0078] Step 2.8 involves normalizing the optimized and enhanced data packet features to obtain the final optimized and enhanced data packet features. Specifically, after feature optimization and enhancement, the maximum and minimum values ​​of all optimized and enhanced data packet features in each dimension are calculated to clarify the fluctuation range of feature values ​​in each dimension. For each optimized and enhanced data packet feature, for each dimension, the feature value of each dimension is subtracted from the minimum value of that dimension, and then divided by the difference between the maximum and minimum values ​​of that dimension. Through this process, the feature values ​​of each dimension are uniformly mapped to the range of 0 to 1, eliminating interference that may be caused by differences in magnitude between different dimensions. During the normalization process, if all feature values ​​in a certain dimension are the same, resulting in equal maximum and minimum values, all feature values ​​in that dimension are directly set to 0.5 to ensure the effectiveness of the normalization operation. The above normalization process is performed on all optimized and enhanced data packet features to finally obtain optimized and enhanced data packet features with a unified numerical range and more accurate feature representation.

[0079] In this embodiment of the invention, the distribution density and variance of feature vectors are statistically analyzed based on the division of multiple sub-regions to obtain distribution characteristics. Dedicated adaptive calibration coefficients are calculated for different sub-regions, and these calibration coefficients are applied to the original data packet features through weighting and scaling operations. Finally, the optimized features are normalized again. This overcomes the technical problems of traditional feature processing, which uses a uniform enhancement strategy for all regions, cannot adapt to the differences in feature distribution among different sub-regions, leads to over- or under-enhancement of features in some regions, and affects the accuracy of feature representation. Thus, it achieves the goals of matching the feature distribution patterns of each sub-region, specifically enhancing effective feature information, suppressing irrelevant interference features, and improving the ability of feature vectors to represent normal communication modes.

[0080] In a preferred embodiment of the present invention, step 3 above may include:

[0081] Step 3.1: Based on the obtained optimized and enhanced data packet features, extract all feature vectors under normal communication conditions to form a normal communication sample set. Specifically, this includes: first, screening out all data packets collected from the normal communication state of the smart grid, which are not affected by replay attacks and conform to the communication patterns during normal grid scheduling; then, retrieving the obtained optimized and enhanced data packet features, and extracting the corresponding feature vectors according to the identifier of each normal communication data packet. These feature vectors have undergone adaptive calibration and normalization processing and can reflect the characteristic patterns of normal communication; classifying and organizing all extracted normal communication feature vectors, and arranging them in an orderly manner according to the data packet collection time sequence or the corresponding grid operation scenario to ensure that the feature vectors in the sample set can fully cover the communication characteristics under different normal operating conditions of the smart grid, ultimately forming a complete normal communication sample set.

[0082] Step 3.2 involves simulating a replay attack process by injecting attack features and reconstructing sequences into normal communication samples to obtain replay attack samples containing attack features. Specifically, this includes: first, simulating the actual occurrence of a replay attack in a smart grid communication link; referring to the attacker's behavior of listening to the communication link, intercepting normal data packets, and replaying them at a specific time period in the background technology; building an attack simulation environment; randomly selecting a portion of normal communication feature vectors from the constructed normal communication sample set as the original data for the simulated attack; injecting replay attack features into the selected normal feature vectors, such as deliberately changing the instruction sending time interval to make it inconsistent with the normal time pattern of the corresponding time period of the power grid, or disrupting the temporal correlation of data packets to destroy the logical dependency between instructions, or adjusting the matching degree between instructions and the real-time load of the power grid so that the instruction content does not match the preset power grid load state, simulating the attacker's behavior of tampering with data packet features; and reconstructing the data packet sequence after injecting attack features, rearranging and combining the tampered feature vectors according to the attacker's possible replay strategies to form a new data packet sequence. The data packet sequence has typical features of a replay attack, and finally, a large number of replay attack samples containing attack features are obtained.

[0083] Step 3.3 involves manually or automatically labeling the obtained replay attack samples to identify their attack type and timing characteristics. Specifically, for each generated replay attack sample, manual review is conducted to determine whether it is a timestamp tampering replay attack, a sequence scrambling replay attack, or a load mismatch replay attack, based on common types of smart grid replay attacks. The specific attack type is then labeled. If the number of samples is large, automated labeling tools can be introduced, with pre-defined attack type judgment rules. For example, if the instruction sending time interval in the sample deviates from the normal range by more than a preset threshold, it is automatically labeled as a timestamp tampering attack; if the data packet timing correlation does not conform to normal logical rules, it is automatically labeled as a sequence scrambling attack. The automated labeling results are then manually sampled and verified to ensure labeling accuracy. Simultaneously, the attack time characteristics, such as the attack initiation time and duration, are recorded for each replay attack sample. For example, if the labeled sample simulates an attack initiated during peak grid load periods, the time interval from start to end of the attack is recorded.

[0084] Step 3.4: Merge the normal communication sample set and the labeled replay attack sample set according to a preset ratio, and perform data shuffling to finally construct the deep learning training dataset. Specifically, this includes: setting a preset ratio of normal communication samples to labeled replay attack samples based on the sample balance requirements for deep learning model training. Typically, this is configured with normal samples accounting for 70% to 80% and attack samples accounting for 20% to 30%, ensuring that the model can fully learn normal communication patterns and effectively identify attack features during training. According to the set ratio, a corresponding number of samples are extracted from the normal communication sample set. This method extracts a corresponding number of samples from the labeled replay attack sample set and merges the two types of samples into the same dataset. To avoid the sample order interfering with model training, a random shuffling method is used to process the merged sample set. By randomly generating sequence numbers, all samples in the sample set are rearranged to ensure that normal samples and attack samples are evenly distributed in the dataset, breaking the original sample order. After the shuffling is completed, the dataset is checked for integrity to ensure that the feature information and labeling information of all samples are complete and error-free. Finally, a deep learning training dataset that meets the training requirements of deep learning models is constructed.

[0085] In this embodiment of the invention, a normal sample set is constructed by extracting normal communication feature vectors from the optimized and enhanced data packet features. Replay attack samples are generated by simulating attack injection features and reconstructing sequences. Attack samples are labeled with attack type and time features. Then, normal and labeled attack samples are merged and shuffled according to a preset ratio. Therefore, this method overcomes the technical problems of scarce attack samples, incomplete sample labeling, and imbalance or disordered distribution of normal and attack samples in traditional dataset construction, which lead to low quality of model training data and poor generalization ability. This method enriches the types of attack samples, clarifies sample feature labels, and ensures the balance and randomness of the sample set, providing high-quality and highly adaptable training data for deep learning models and improving the model's generalization ability to identify replay attacks.

[0086] In a preferred embodiment of the present invention, step 4 above may include:

[0087] Step 4.1: Based on the constructed deep learning training dataset, extract the feature sequences of the training samples as model input, and configure the initial structure and parameters of the LSTM network based on the dimensions of the input features. Specifically, this includes: First, extracting the optimized and enhanced multi-dimensional feature vectors corresponding to each training sample from the constructed deep learning training dataset according to the time order of the samples. Arranging the optimized and enhanced multi-dimensional feature vectors in chronological order to form a continuous feature sequence, which is used as the model input of the LSTM network to ensure that the input data can reflect the temporal characteristics of smart grid communication. Then, analyzing the dimensions of the input feature sequence to clarify the number of features contained in each feature vector, such as the instruction sending time interval and the temporal correlation of data packets. The LSTM network is configured based on three dimensions: the matching degree between instructions and the real-time load of the power grid. The input feature dimension is three. The initial structure of the LSTM network is configured according to these three dimensions, setting the number of neurons in the input layer to match the feature dimension, and setting an appropriate number of neurons in the hidden layer to ensure the model's learning ability. The number of neurons in the output layer is also determined; if used for binary classification, normal communication, or replay attacks, the output layer is set to one neuron. Furthermore, initial network parameters are configured, including the learning rate, number of iterations, and batch size. The learning rate is set to a relatively small value to ensure the stability of parameter optimization. The number of iterations is set according to the dataset size, and the batch size is determined based on the performance of the computing device, ensuring that the initial structure and parameters are suitable for the training requirements of smart grid communication data.

[0088] Step 4.2: Using the configured LSTM network, the input temporal features are modeled using a sliding window approach. The model learns the temporal patterns and feature dependencies under normal communication conditions through memory units and gating mechanisms to obtain the modeled output. Specifically, this includes: first, setting the sliding window size, which is determined by the transmission frequency of smart grid communication commands. For example, if commands are sent on average every 10 seconds, and the temporal patterns within one minute need to be captured, then the sliding window size is set to 6, meaning each window contains 6 consecutive feature vectors; then, data segments are extracted from the input feature sequence using the sliding window approach, with the window sliding one feature vector position at a time, sequentially acquiring all window data segments, and processing each window data segment... The data segment is input into the configured LSTM network. The network stores historical feature information through memory units, such as remembering the instruction transmission time interval patterns of the previous few time steps. The input gate controls the entry of current feature information and determines whether the current feature needs to be included in memory. The forget gate decides whether to discard outdated historical information in the memory unit, such as discarding historical time sequence patterns that are irrelevant to the current communication scenario. The output gate controls how the information in the memory unit is output, forming the network output of the current time step. Through the gating mechanism, the LSTM network gradually learns the time sequence features such as the timing pattern of instruction transmission under normal communication conditions and the logical dependencies between different instructions. After modeling each window data segment, it outputs the corresponding modeling result.

[0089] Step 4.3: Based on the modeled output, the difference between the model's predicted output and the true label is calculated using the backpropagation algorithm. The gradient descent method is then used to iteratively optimize the weight parameters of the LSTM network. Specifically, this includes: comparing the obtained LSTM network modeling output with the true labels corresponding to the training samples. The true labels are labeled according to the sample type: normal communication samples are labeled as 0, and replay attack samples are labeled as 1. Using the backpropagation algorithm, the loss value of the LSTM network output layer is first calculated. The cross-entropy loss function is used to calculate the loss value of a single sample. The formula is described as: the loss value of a single sample is equal to the negative [true label multiplied by the natural logarithm (model predicted output value) plus (1 minus true label) multiplied by the natural logarithm (1 minus model predicted output value)]. If there are multiple training samples in the current batch, the total loss value of the batch is equal to the average of the loss values ​​of all single samples in the batch. The total loss value reflects the overall deviation of the current batch's sample prediction.

[0090] The gradient is calculated starting from the output layer. The gradient reflects the rate of change of the loss value with respect to the output layer parameters and is the core basis for parameter adjustment. First, the partial derivative of the loss value with respect to the output value of the output layer neurons is calculated. The partial derivative of the output value is equal to (the model's predicted output value minus the true label) divided by the number of training samples. Next, the partial derivative of the loss value with respect to the output layer weights is calculated. The output layer weights connect the hidden layer output and the output layer input. The partial derivative of the weights is equal to the partial derivative of the loss value with respect to the output layer neuron output value multiplied by the hidden layer output value. The partial derivative of the loss value with respect to a certain weight in the output layer is equal to (the partial derivative of the loss value with respect to the output layer output value) multiplied by (the hidden layer neuron output value corresponding to that weight). At the same time, the partial derivative of the loss value with respect to the output layer bias is calculated. The partial derivative is equal to the partial derivative of the loss value with respect to the output layer neuron output value, since the input of the bias is always 1.

[0091] The hidden layers of LSTM networks exhibit temporal dependencies, with the hidden state at the current time step being influenced by the previous time step. Therefore, gradient calculation needs to be propagated backward along time, deriving from the current time step t back to the initial time step 1. First, the partial derivative of the loss value with respect to the hidden layer output value at the current time step t is calculated. The partial derivative of the output value is equal to (the partial derivative of the loss value with respect to the output layer weights multiplied by the output layer weights) plus (the partial derivative of the loss value with respect to the hidden layer output value at the next time step multiplied by the hidden layer self-connection weights). The next time step corresponds to time step t+1, reflecting the gradient propagation along the temporal dimension.

[0092] Next, combining the LSTM gating mechanism, the input gate, forget gate, and output gate calculate the gradient of the internal state. First, the partial derivative of the loss value with respect to the internal state of the hidden layer at the current time step t is calculated. The partial derivative of the internal state is equal to (the partial derivative of the loss value with respect to the output value of the hidden layer at the current time step t) multiplied by (the activation value of the output gate) multiplied by (the derivative of the activation function of the internal state). Then, the gradient of the internal state at the previous time step t-1 is derived in reverse. The partial derivative of the loss value with respect to the internal state at time step t-1 is equal to (the partial derivative of the loss value with respect to the internal state at time step t) multiplied by (the activation value of the forget gate) multiplied by (the derivative of the activation function of the internal state), thus realizing the backward propagation of the gradient along the time steps.

[0093] Finally, the partial derivative of the loss value with respect to the hidden layer weights is calculated, including the weights from the input layer to the hidden layer and the self-connection weights from the hidden layer to the hidden layer. The partial derivative of the loss value with respect to a certain hidden layer weight is equal to (the partial derivative of the loss value at the current time step with respect to the internal state of the hidden layer) multiplied by (the input activation value of the corresponding gate). The partial derivatives of all time steps are summed to obtain the total gradient of the weight over the entire time series.

[0094] The gradients of all parameters in the output and hidden layers, including output layer weights, output layer biases, hidden layer input weights, and hidden layer self-connection weights, are summarized to ensure that each parameter has a corresponding gradient value. These gradient values ​​are directly used as the basis for adjusting the weight parameters by gradient descent. The parameters are updated in the opposite direction of the gradient, i.e., the direction in which the loss value decreases. The updated parameter value is equal to the original parameter value minus (learning rate multiplied by the gradient value of the updated parameter). The learning rate is used to control the magnitude of parameter adjustment, avoiding excessively large gradients that cause parameter oscillations or excessively small gradients that lead to slow convergence. Through the above gradient calculation process, the backpropagation algorithm completes the derivation from the loss value to the gradients of each layer's parameters.

[0095] After each parameter adjustment, the next batch of training samples is input into the network, and the process of forward propagation modeling and backpropagation loss calculation and parameter adjustment is repeated. Through multiple iterations of optimization, the network loss value is gradually reduced, the deviation between the model's predicted output and the true label is continuously reduced, and the model's ability to distinguish between normal communication and replay attack samples is gradually improved.

[0096] Step 4.4 involves real-time monitoring of model performance during the optimization process using a validation set. When the model's accuracy on the validation set reaches a stable state, the network parameters and model structure are saved to obtain the pre-trained deep learning model. Specifically, this includes: when constructing the deep learning training dataset, pre-dividing the dataset into training and validation sets, typically with the validation set accounting for 20% to 30% of the total dataset. The validation set samples must cover normal communication samples and replay attack samples from different time periods and of different types to ensure comprehensive testing of model performance. During the iterative optimization of model parameters, the validation set is updated after a certain number of iterations. Input samples into the LSTM network in the current training state, calculate the model's prediction accuracy on the validation set, which is the proportion of samples whose predictions match the true labels to the total number of samples in the validation set. Record the accuracy data for each validation in real time and observe the trend of accuracy changes. If the validation set accuracy no longer improves after multiple iterations and the fluctuation range is controlled within a small range, it indicates that the model performance has reached a stable state. Continuing to iterate at this time may lead to model overfitting. Once the model performance is confirmed to be stable, save all weight parameters and network structure configuration information of the current LSTM network to form a pre-trained deep learning model.

[0097] In this embodiment of the invention, feature sequences are extracted from the training dataset as input, and the initial structure and parameters of the LSTM network are configured according to the feature dimensions. Temporal features are modeled by combining a sliding window with LSTM memory units and a gating mechanism. The backpropagation algorithm is used to calculate the prediction difference, and the network weights are iteratively optimized using the gradient descent method. At the same time, the performance is monitored in real time using a validation set, and stable state parameters are saved. Therefore, this invention overcomes the technical problems of traditional models, such as difficulty in capturing the temporal patterns of communication data, large blindness in network parameter optimization, and lack of performance monitoring during training, which can easily lead to overfitting or underfitting of the model and thus the inability to learn normal communication patterns. As a result, this invention achieves the technical effect of efficiently learning the temporal correlation and feature dependency of smart grid communication data, optimizing network parameters, effectively avoiding overfitting and underfitting, and finally obtaining a preliminary deep learning model that can stably represent normal communication patterns.

[0098] In a preferred embodiment of the present invention, step 5 above may include:

[0099] Step 5.1: Input the labeled replay attack samples into the pre-trained deep learning model. Calculate the corresponding predicted feature vectors through the forward propagation of the LSTM network. This involves: First, selecting labeled replay attack samples covering common replay attack types in smart grids, including timestamp tampering and sequence reconstruction, with complete labeling information. Organize the replay attack samples according to a defined feature sequence format to ensure the input format matches the input requirements of the pre-trained deep learning model. Then, input the organized replay attack samples one by one into the pre-trained LSTM network, initiating the network's forward propagation calculation process. During the calculation, the network processes the input attack sample features based on learned normal communication timing patterns. Memory units store the timing information of the attack samples, and a gating mechanism judges the differences between the attack sample features and normal features. Finally, the output layer generates the predicted feature vector corresponding to each replay attack sample.

[0100] Step 5.2: Based on the obtained predicted feature vectors, calculate the Euclidean distance between them and the true feature vectors, and the average geometric distance between them and the K nearest real sample feature vectors in the normal training sample set. Specifically, this includes: first, obtaining the true feature vector corresponding to each replay attack sample. The true feature vector is the standard feature vector formed after injecting attack features during the simulated replay attack, which contains clear attack feature information. For each obtained predicted feature vector, calculate the Euclidean distance between it and the corresponding true feature vector. By measuring the straight-line distance between the two vectors in the feature space, quantify the degree of deviation between the model prediction result and the true attack feature. Next, from the constructed normal training sample set, select the K nearest real normal sample feature vectors in the feature space to the current predicted feature vector. The value of K is set according to the size of the normal sample set, usually between 5 and 10, to ensure the representativeness of the calculation results. Calculate the geometric distance between the predicted feature vector and each of these K normal sample feature vectors, and then sum these distance values ​​and divide by K to obtain the average geometric distance. The average geometric distance reflects the degree of difference between the predicted attack feature and the normal feature.

[0101] Step 5.3, with the goal of minimizing the calculated Euclidean distance and average geometric distance, fine-tunes the parameters of the LSTM network using the backpropagation algorithm to enhance the model's ability to identify anomalous features. Specifically, this involves using the calculated Euclidean distance and average geometric distance as the objective function for model optimization, clearly defining the optimization direction as minimizing these two distance values, initiating the backpropagation algorithm, starting from the output layer of the LSTM network, and calculating the influence of each layer's neuron parameters on the loss value based on the loss value of the objective function (i.e., the combined reflection of the two distance values), determining the direction and magnitude of parameter adjustment. For the weight parameters in the network, including the weights from the input layer to the hidden layer and from the hidden layer to the hidden layer, gradient descent is used for fine-tuning, prioritizing parameters that have a greater impact on attack feature identification, such as weights related to timestamp features and load matching features. Through parameter adjustment, the network's sensitivity to anomalous features in replay attacks, such as tampered timestamps and abnormal load matching, is enhanced, enabling the model to more accurately capture attack features in prediction, reducing prediction bias, and improving the ability to identify replay attacks.

[0102] Step 5.4: Repeat the optimization process until the model's replay attack detection accuracy on the validation set reaches a preset threshold, ultimately obtaining a deep learning detection model capable of real-time replay attack identification. This includes: pre-setting a replay attack detection accuracy threshold on the validation set, determined according to smart grid communication security requirements, typically set above 95% to ensure the model can effectively identify the vast majority of replay attacks; repeating steps 5.1 to 5.3, i.e., each time an labeled replay attack sample is input into the currently optimized model, distance is calculated, parameters are adjusted, and one optimization iteration is completed. After a certain number of iterations, replay attack samples from the validation set are input into the model, and the proportion of correctly identified attack samples to the total number of attack samples in the validation set is calculated to obtain the current detection accuracy. Compare the current accuracy with the preset threshold. If the accuracy does not reach the threshold, continue the optimization process; if the accuracy reaches or exceeds the threshold, it indicates that the model has sufficient replay attack identification capability, and optimization stops. At this point, the final network parameters and model structure are saved, resulting in a deep learning detection model capable of real-time replay attack identification in smart grid communication scenarios.

[0103] In this embodiment of the invention, a targeted replay attack sample is input into the initial training model to obtain a predicted feature vector. The Euclidean distance between the feature vector and the true feature vector and the average geometric distance between the feature vector and the K nearest neighbors in the normal sample set are calculated. The parameters of the LSTM network are finely adjusted through backpropagation with the goal of minimizing these two distances. This optimization is repeated until the attack detection accuracy on the validation set reaches a preset threshold. Therefore, this method overcomes the technical problems of insufficient sensitivity of the initial training model to identify abnormal features of replay attacks, lack of targeted focus on the differences in attack samples in parameter optimization, and difficulty in accurately distinguishing complex attack behaviors such as tampering with timestamps. This achieves the technical effect of improving the model's accuracy in identifying replay attacks, strengthening the model's ability to capture abnormal features, and finally obtaining a deep learning detection model that can identify replay attacks in smart grid communication in real time and accurately.

[0104] like Figure 2 As shown, embodiments of the present invention also provide a deep learning-based communication replay attack detection model training system, comprising:

[0105] The acquisition module is used to collect data packet characteristics under normal communication conditions. The data packet characteristics include instruction sending time interval, data packet timing correlation, and the matching degree between the instruction and the real-time load of the power grid.

[0106] The enhancement module is used to convert the collected data packet features into a multi-dimensional feature vector set and construct a reference domain in the feature space; the reference domain is structurally divided according to the distribution characteristics of the feature vectors to obtain multiple sub-regions; the distribution of feature vectors in each sub-region is analyzed to obtain the analysis results; adaptive calibration coefficients are obtained based on the analysis results, and the original data packet features are optimized and enhanced using the calibration coefficients to obtain the optimized and enhanced data packet features;

[0107] The training module is used to construct a deep learning training dataset based on the optimized and enhanced packet features. The training dataset includes normal communication samples and labeled replay attack samples. Based on the constructed training dataset, a deep learning model is trained, in which the deep learning model learns the temporal patterns of normal communication through an LSTM (Long Short-Term Memory) network.

[0108] The optimization module is used to input the labeled replay attack samples into the pre-trained deep learning model to obtain the predicted feature vector; calculate the geometric distance between the predicted feature vector and the real feature vector and the average geometric distance between the predicted feature vector and the nearest real sample, and optimize and adjust the model parameters with the goal of minimizing the distance, so that the optimized deep learning model can identify replay attacks in real time and obtain the final detection model.

[0109] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for training a deep learning-based communication replay attack detection model, characterized in that, The method comprises: Collecting data packet features in normal communication state, the data packet features including instruction sending time interval, data packet time sequence correlation, and matching degree of instruction and real-time load of power grid, wherein the data packet time sequence correlation is constructed by analyzing logical dependency and state transition relationship between preceding and subsequent instructions based on obtained instruction data stream, type and content sequence thereof, and combining obtained instruction sending time interval feature; Converting the collected data packet features into a multi-dimensional feature vector set, and constructing a benchmark reference domain in the feature space; dividing the benchmark reference domain into a plurality of sub-regions according to distribution characteristics of the feature vectors, including: Based on the collected multi-dimensional data packet features, normalizing and combining all features of each data packet into a unified multi-dimensional feature vector to obtain a multi-dimensional feature vector set; Based on the obtained multi-dimensional feature vector set, a benchmark reference domain covering all normal communication features is constructed in the feature space by density clustering or grid division method; Statistically analyzing the distribution characteristics of the feature vectors in the constructed benchmark reference domain to identify high-density regions and low-density regions in the feature space, thereby obtaining distribution characteristic analysis results; According to the distribution characteristic analysis results, the benchmark reference domain is divided into a plurality of sub-regions according to adaptive threshold values, thereby obtaining a plurality of sub-regions representing different feature distribution characteristics; Analyzing the distribution of the feature vectors in each sub-region to obtain analysis results; obtaining adaptive calibration coefficients according to the analysis results; and optimizing and enhancing the original data packet features by using the calibration coefficients, thereby obtaining optimized and enhanced data packet features, including: Based on the obtained plurality of sub-regions, the distribution density and variance characteristics of the feature vectors in each sub-region are respectively counted to obtain distribution characteristic analysis results of each sub-region; According to the obtained distribution characteristic analysis results, adaptive calibration coefficients are respectively calculated for different sub-regions; Applying the obtained adaptive calibration coefficients to the collected original data packet features to optimize and enhance the features by weighting and scaling operations; Normalizing the optimized and enhanced data packet features to finally obtain the optimized and enhanced data packet features; Based on the optimized and enhanced data packet features, a deep learning training data set is constructed, including normal communication samples and labeled replay attack samples; According to the constructed training data set, a deep learning model is trained, wherein the deep learning model learns the time sequence rules of normal communication through an LSTM long short-term memory network; The labeled replay attack samples are input into the preliminarily trained deep learning model to obtain predicted feature vectors; the geometric distance between the predicted feature vectors and the real feature vectors, and the average geometric distance between the predicted feature vectors and the nearest neighbor real samples are calculated; the model parameters are optimized and adjusted to minimize the distance, so that the optimized deep learning model can identify replay attacks in real time, thereby obtaining a final detection model. 2.The deep learning based communication replay attack detection model training method of claim 1, wherein, Collecting data packet features in normal communication state, the data packet features including instruction sending time interval, data packet time sequence correlation, and matching degree of instruction and real-time load of power grid, including: The continuous original instruction data stream is obtained by analyzing the communication log; Based on the obtained original instruction data stream, the time difference value of adjacent instructions is calculated to obtain the instruction sending time interval feature; Based on the instruction sending time interval feature and the data packet time sequence correlation feature, the power grid real-time load monitoring interface is called, the received instruction content and context feature are compared with the current real-time load data for consistency, and finally the matching degree feature of the instruction and the power grid real-time load is obtained. 3.The deep learning based communication replay attack detection model training method of claim 2, wherein, Based on the optimized and enhanced data packet features, a deep learning training data set is constructed, including normal communication samples and labeled replay attack samples, including: Based on the obtained optimized and enhanced data packet features, all feature vectors in the normal communication state are extracted to form a normal communication sample set; Through simulating the replay attack process, the normal communication samples are attacked by feature injection and sequence reconstruction to obtain replay attack samples containing attack features; Based on the obtained replay attack samples, artificial or automatic labeling is performed to mark the attack type and attack time feature of the replay attack samples; The normal communication sample set and the labeled replay attack sample set are merged according to the preset proportion, and data shuffling processing is performed to finally construct a deep learning training data set. 4.The deep learning based communication replay attack detection model training method of claim 3, wherein, According to the constructed training data set, a deep learning model is trained, wherein the deep learning model learns the time sequence rules of normal communication through LSTM long short-term memory network, including: Based on the constructed deep learning training data set, the feature sequence of the training sample is extracted as the model input, and the initial structure and parameters of the LSTM network are configured based on the dimension of the input features; Through the configured LSTM network, the input time sequence features are modeled in a sliding window manner, and the time sequence rules and feature dependency relationships in the normal communication state are learned through memory cells and gating mechanisms to obtain the output results after modeling; Based on the output results after modeling, the difference between the model prediction output and the true label is calculated through the back propagation algorithm, and the gradient descent method is used to iteratively optimize the weight parameters of the LSTM network; Through the validation set, the model performance in the optimization process is monitored in real time, and when the accuracy of the model on the validation set reaches a stable state, the network parameters and model structure at this time are saved to obtain a preliminarily trained deep learning model. 5.The deep learning based communication replay attack detection model training method of claim 4, wherein, The labeled replay attack samples are input into the preliminarily trained deep learning model to obtain the predicted feature vectors; the geometric distance between the predicted feature vectors and the true feature vectors, and the average geometric distance between the predicted feature vectors and the nearest neighbor true samples are calculated to minimize the distance, and the model parameters are optimized and adjusted, so that the optimized deep learning model can identify replay attacks in real time to obtain a final detection model, including: The labeled replay attack samples are input into the obtained preliminarily trained deep learning model, and the corresponding predicted feature vectors are obtained through the forward propagation calculation of the LSTM network; Based on the obtained predicted feature vectors, the Euclidean distance between them and the true feature vectors, and the average geometric distance between them and the nearest neighbor K true sample feature vectors in the normal training sample set are calculated respectively; The parameters of the LSTM network are fine-tuned through a back propagation algorithm to minimize the calculated Euclidean distance and average geometric distance, thereby enhancing the model's ability to identify abnormal features; The optimization process is repeated until the replay attack detection accuracy of the model on the validation set reaches a preset threshold, and a deep learning detection model for real-time identification of replay attacks is finally obtained.

6. A deep learning-based communication replay attack detection model training system, which implements the method according to any one of claims 1 to 5, characterized in that, The method comprises the following steps: The acquisition module is configured to collect packet features in a normal communication state, wherein the packet features include instruction transmission time intervals, packet time sequence correlation, and matching degrees of instructions and real-time loads of a power grid. The enhancement module is configured to convert the collected packet features into a set of multi-dimensional feature vectors and construct a reference domain in a feature space. The reference domain is structurally divided according to the distribution characteristics of the feature vectors to obtain a plurality of sub-regions. The distribution of the feature vectors in each sub-region is analyzed to obtain an analysis result, and an adaptive calibration coefficient is obtained according to the analysis result. The training module is configured to construct a deep learning training data set based on the optimized and enhanced packet features, wherein the training data set includes normal communication samples and labeled replay attack samples. The optimization module is configured to input the labeled replay attack samples into the preliminarily trained deep learning model to obtain predicted feature vectors.

7. A computing device, comprising: The optimization module is configured to calculate geometric distances between the predicted feature vectors and real feature vectors and average geometric distances between the predicted feature vectors and nearest neighbor real samples. The optimization module is configured to optimize and adjust the model parameters to enable the optimized deep learning model to identify replay attacks in real time and obtain a final detection model. The method comprises the following steps:

8. A computer-readable storage medium, characterized in that, One or more processors; A storage device is configured to store one or more programs, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the method of any one of claims 1 to 5. The computer readable storage medium stores a program which is executed by a processor to implement the method of any one of claims 1 to 5.

Images