Security threat model optimization system and method based on online self-learning

Abstract

The invention relates to the technical field of data processing, in particular to a security threat model optimization system and method based on online self-learning, and the system comprises a data collection module which eliminates the electromagnetic interference of a power grid, dynamically adjusts the sampling frequency, and improves the data quality; the feature processing module extracts statistical features and topological features by adopting a dual-channel parallel architecture, and dynamically selects a dimension reduction strategy based on an anomaly detection confidence index to compress and calculate a load; the threat detection module is combined with an electric power knowledge graph to identify an attack mode and reversely trigger feature reconstruction; the model optimization module selects a Bayesian optimization, model distillation or federated learning local update strategy according to the data drift index and the resource state, and reduces the parameter adjustment amount; and the feedback enhancement module positions data defects through the misinformation knowledge graph and injects adversarial samples. According to the invention, each module significantly reduces resource consumption and response delay through the cooperation of data flow closed-loop linkage, feature compression, intelligent updating and data optimization.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to an online self-learning-based security threat model optimization system and method. BACKGROUND

[0002] The security threat environment continues to dynamically change, and the existing static security model relies on predefined rules and historical data, making it difficult to effectively identify and respond to new unknown attacks; the online self-learning-based security threat model continuously analyzes new input data in the running process by real-time monitoring of network traffic or system behavior, dynamically adjusts the detection strategy and updates the internal threat knowledge base, thereby achieving active adaptation and defense against zero-day attacks and variant threats, and ultimately improving the resilience and real-time response capability of the security system.

[0003] The online self-learning-based security threat model faces the technical pain point of excessive consumption of computing resources in the optimization process, because the model needs to continuously process real-time data streams and dynamically adjust internal parameters to adapt to new threats, which increases the system processing burden, leading to response delay and potential security risks; in the power scenario, for example, the intelligent power grid monitoring system, when the model analyzes massive sensor data based on online learning to detect network attacks, frequent parameter updates consume a large amount of computing resources and prolong the threat identification time, thereby missing the critical attack window and endangering the stable operation of the power grid. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application provides an online self-learning-based security threat model optimization system and method, which solves the technical problem that the online self-learning-based security threat model needs to continuously and dynamically adjust parameters to adapt to new threats, resulting in excessive consumption of computing resources in the power real-time monitoring system and thus causing threat response delay.

[0005] To solve the above technical problems, the specific technical content of the present application is as follows: In a first aspect, the present application provides an online self-learning-based security threat model optimization system, comprising: A data acquisition module configured to acquire power system network traffic, device operation logs and voltage phase fluctuation signals in real time, perform noise elimination and dynamic normalization processing, and output preprocessed data with time-frequency labels to a feature processing module; A feature processing module configured to receive preprocessed data transmitted by the data acquisition module, and run a conventional feature extraction channel and a graph topology feature generation channel in parallel, receive an anomaly detection confidence index transmitted by the threat detection module, perform automatic encoder dimensionality reduction when the confidence index exceeds a threshold, and perform spectral clustering algorithm to select a key feature subset when the confidence index does not exceed the threshold, and generate a compressed feature tensor transmitted to the threat detection module; The threat detection module is configured to receive the feature tensor transmitted by the feature processing module, generate a threat report by performing an anomaly score, calculate a data distribution change to generate a data drift index, transmit the threat report and the data drift index to the model optimization module, and feed back the confidence index to the feature processing module; The model optimization module is configured to receive the threat report and the data drift index transmitted by the threat detection module, start a Bayesian optimizer when the data drift index exceeds a threshold, activate a model distillation process when the threat report marks a zero-day threat, perform a federated learning local update protocol when the data drift index does not exceed the threshold, and generate neural network weight parameters to replace original parameters and output to the threat detection module; The feedback enhancement module is configured to receive alarm logs and safety annotation data transmitted by the power grid dispatching system, generate an adversarial sample to input training data of the model optimization module, and generate a resampling instruction to transmit to the data acquisition module when the false positive rate exceeds 15%.

[0006] Further, the data acquisition module of the online self-learning-based security threat model optimization system comprises: The phase-sensitive probe is directly connected to the power grid communication bus to capture protocol packets, and the protocol packets are converted into digital signal format and transmitted to the first input port of the quantum noise filter; The voltage waveform acquisition unit acquires original phase fluctuation signals through a sensor, and converts the original phase fluctuation signals into standard voltage range signals and transmits the standard voltage range signals to the second input port of the quantum noise filter; The quantum noise filter receives protocol packets in digital signal format through the first input port, receives standard voltage range signals through the second input port, performs electromagnetic interference elimination processing on the two types of signals, and outputs unified format noise reduction signals to the adaptive sliding window processor; The adaptive sliding window processor receives the noise reduction signals output by the quantum noise filter, detects network traffic peak to dynamically determine the sampling window size, performs normalization processing on the noise reduction signals, and outputs preprocessed data with millisecond-level time stamps to the feature processing module.

[0007] Further, the feature processing module of the online self-learning-based security threat model optimization system is configured to: Receive preprocessed data transmitted by the data acquisition module, and trigger the regular feature extraction channel and the graph topology feature generation channel to start at the same time; The regular feature extraction channel calculates the Wasserstein distance of data packets as a distribution feature, analyzes the periodicity of session time series, and outputs a 128-dimensional statistical feature vector; The graph topology feature generation channel constructs a 32x32 adjacency matrix based on device communication relationships, and outputs a 256-dimensional topology feature vector; The 128-dimensional statistical feature vector and the 256-dimensional topological feature vector are spliced in the feature dimension to generate a 384-dimensional initial feature tensor; The anomaly detection confidence index transmitted by the threat detection module is received, and when the confidence index is greater than 0.85, the 384-dimensional feature tensor is reduced to 64 dimensions by using a 3-layer autoencoder; When the confidence index is less than or equal to 0.85, the top 50 key features are selected from the 384-dimensional feature tensor by using a spectral clustering algorithm; The feature tensor after dimension reduction or selection is converted into an FP16 floating point format and transmitted to the threat detection module through a DMA channel.

[0008] Further, the online self-learning-based security threat model optimization system disclosed by the application further comprises: The 128-dimensional feature importance vector sent by the threat detection module through the message queue is received every 60 seconds, and the vector element value range is [0, 1]; The average value of the 65th-128th elements in the feature importance vector is calculated as a topological feature weight ratio, and when the ratio exceeds 0.7, the convolution layer depth of the graph topological feature generation channel is increased from 3 layers to 5 layers, and when the ratio is less than 0.3, the convolution layer depth is reduced from 3 layers to 1 layer; The average value of the 1st-64th elements in the feature importance vector is calculated as a statistical feature weight ratio, and when the ratio exceeds 0.6, the LSTM time step of the regular feature extraction channel is adjusted from 10 steps to 20 steps, and when the ratio is less than 0.4, the time step is adjusted from 10 steps to 5 steps; The topological feature weight ratio and the statistical feature weight ratio are added, and when the sum is greater than 1.2, the confidence index threshold of the autoencoder dimension reduction is raised from 0.85 to 0.9, and when the sum is less than 0.8, the threshold is lowered from 0.85 to 0.8.

[0009] Further, the threat detection module of the online self-learning-based security threat model optimization system disclosed by the application is configured to: Receive the FP16 format feature tensor transmitted by the feature processing module, and when the anomaly score output by the isolation forest algorithm exceeds 0.95, mark it as an abnormal data point; For each abnormal data point, extract its corresponding device communication path in the graph topological feature generation channel, the path including a source device ID, a target device ID and a timestamp triplet; The extracted communication path is subjected to dynamic time warping (DTW) similarity calculation with 20 pre-stored APT behavior templates in the power attack knowledge base, each template including 5-10 typical attack steps; When the DTW similarity score of any template exceeds 0.8, generate a reconstruction instruction in JSON format, including the attack path node list and the similarity score, and send it to the feature processing module through the message queue; The trigger graph topology feature generation channel adds attack association edges in the original 32*32 adjacency matrix according to the node list in the reconstruction instruction, and outputs the updated 256-dimensional topology feature vector to the feature processing channel.

[0010] Further, the online self-learning-based security threat model optimization system disclosed by the application further comprises: Receive the data drift index and threat report transmitted by the threat detection module through the gRPC protocol every 5 minutes, the data drift index value range is [0, 2], and the threat report includes a threat type label and a confidence score; When the data drift index is greater than 1.2 and the system CPU utilization is less than 70%, start the Bayesian optimizer to perform 50 rounds of hyperparameter search, and generate the first type of update parameters including the learning rate, batch size and network depth; When the threat report is marked as a zero-day threat and the memory occupancy rate exceeds 80%, activate the three-layer teacher-student model distillation process, compress the original model parameter quantity by 60%, and generate the second type of update parameters; When the data drift index is less than or equal to 1.2 and no zero-day threat is detected, execute the federated learning local update protocol, and only update the fully connected layer parameters to generate the third type of update parameters; After verifying the validity of the update parameters through the version control mechanism, deploy the new parameters to the threat detection module in an incremental update manner, and keep the backup of the previous three versions of parameters.

[0011] Further, the feedback enhancement module of the online self-learning-based security threat model optimization system disclosed by the application is configured to receive the JSON format alarm log and XML format security expert annotation data transmitted by the power grid dispatching system through the RESTful API; Use regular expressions to parse the device ID, timestamp and alarm type fields in the alarm log, associate the false alarm label in the expert annotation, and construct a knowledge graph including device nodes, false alarm edges and area attributes in the Neo4j graph database; When the proportion of false alarm events associated with the same physical area code (AreaCode) in the knowledge graph exceeds 15%, generate a Protobuf format instruction including the area code and the target sampling frequency, and transmit it to the data collection module through the message queue; Generate a 500-dimensional adversarial sample vector based on the contrastive learning algorithm framework, the sample includes a perturbation amplitude parameter, and inject the training data buffer queue of the model optimization module through the gRPC streaming interface.

[0012] Further, the online self-learning-based security threat model optimization system provided by the present application further comprises: Every 15 minutes, all confidence scores in the threat report output by the threat detection module are obtained, and the confidence value range is [0, 1]; On the basis of the average F1-score in the last 24 hours, the decay rate of the current F1-score is calculated, and the decay rate is (reference value-current value) / reference value*100%; When the decay rate exceeds 10%, a Protobuf format instruction including the model ID and the emergency level is generated, and the instruction is transmitted to the model optimization module through the gRPC protocol; The model optimization module interrupts the updating process being executed, starts a complete model retraining of 200 epochs, and after the training is completed, the new model parameters are deployed to the threat detection module.

[0013] Further, the online self-learning-based security threat model optimization system provided by the present application further comprises: When the dynamic time warping (DTW) similarity score in the threat detection module is lower than 0.3 and the threat type is not registered in the power attack knowledge base, it is determined as a new attack mode; A Protobuf format federated learning activation instruction including the attack feature hash value and the emergency level is generated, and the instruction is transmitted to the model optimization module through the gRPC protocol to trigger a multi-node parameter exchange protocol; A Protobuf format high-frequency sampling instruction including the target sampling rate 20 kHz is synchronously generated, and the instruction is transmitted to the data acquisition module through the message queue; The model optimization module receives the high-frequency data collected by the data acquisition module in a 50 ms window, performs local parameter updating once every 5 seconds, and only updates the convolution kernel weight parameters; The updated parameters are packaged as an incremental model, identified by a version number, and deployed to the threat detection module to replace the corresponding convolution kernel weight.

[0014] In a second aspect, the present application provides an online self-learning-based security threat model optimization method, which is applied to the online self-learning-based security threat model optimization system and comprises the following steps: Step 1, real-time acquisition of power system network traffic, device operation logs and voltage phase fluctuation signals, execution of noise elimination and dynamic normalization processing, and output of preprocessed data with time-frequency labels to step 2; Step 2, receiving the preprocessed data transmitted by step 1, parallel running of a conventional feature extraction channel and a graph topology feature generation channel, receiving the abnormal detection confidence index transmitted by step 3, executing automatic encoder dimension reduction when the confidence index exceeds a threshold value, executing a spectral clustering algorithm to select a key feature subset when the confidence index does not exceed the threshold value, and transmitting the compressed feature tensor to step 3; Step 3, receiving the feature tensor transmitted in step 2, performing anomaly score generation threat report, calculating data distribution change to generate data drift index, transmitting the threat report and data drift index to step 4, and feeding back the confidence index to step 2; Step 4, receiving the threat report and data drift index transmitted in step 3, starting the Bayesian optimizer when the data drift index exceeds the threshold, activating the model distillation process when the threat report marks a zero-day threat, and performing the federated learning local update protocol when the data drift index does not exceed the threshold, generating neural network weight parameter output to replace the original parameters in step 3; Step 5, receiving the alarm log and security annotation data transmitted by the power grid dispatching system, generating an adversarial sample input to the training data stream of step 4, and generating a resampling instruction when the false positive rate exceeds 15% and transmitting it to step 1.

[0015] The present application has the following beneficial effects: The security threat model optimization system provided by the present application has the following beneficial effects: in the data acquisition stage, quantum noise filtering technology is applied to eliminate power electromagnetic interference, and the sampling frequency is dynamically adjusted by combining an adaptive sliding window, thereby improving data quality from the source and reducing subsequent invalid data processing burden; in the feature processing stage, statistical features and topological features are extracted by using a double-channel parallel architecture, and an autoencoder dimension reduction or spectral clustering feature selection strategy is dynamically selected based on an anomaly detection confidence index, thereby significantly reducing feature dimension compression computing load; the threat detection module quickly locates abnormal points by using an isolation forest algorithm, identifies attack patterns by combining a power knowledge graph, and reversely triggers a feature reconstruction mechanism when detecting advanced persistent threats, thereby avoiding full data reprocessing; in the model update link, a Bayesian optimization, model distillation or federated learning local update strategy is intelligently selected according to a data drift index and system resource state, thereby greatly reducing parameter adjustment amount and iteration period; the feedback enhancement module constructs a false positive knowledge graph to locate data defects, increases the sampling frequency and injects an adversarial sample, thereby enhancing model robustness while reducing invalid iterations; when identifying a new attack, a cross-module emergency response mechanism is started, millisecond-level incremental updates are realized by high-frequency sampling and a federated learning framework, and each module shares state parameters such as feature importance vectors and data drift indexes to form a technical closed loop, thereby ultimately significantly reducing power monitoring system resource consumption and response delay while maintaining a high threat detection rate. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed in the embodiments. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on the drawings.

[0017] Figure 1A flowchart of the online self-learning-based security threat model optimization method provided by the embodiment of the present application is shown. DETAILED DESCRIPTION

[0018] In order to make the technical solutions of the present application clearer, the present application will be described in detail below with reference to the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application. The present application provided by the embodiments of the present application will be described in detail below with reference to the drawings. For the purpose of better understanding the present application, the present application will be further described in detail below.

[0019] In a first aspect, the present application provides an online self-learning-based security threat model optimization system, comprising: A data acquisition module configured to acquire power system network traffic, device operation logs and voltage phase fluctuation signals in real time, perform noise elimination and dynamic normalization processing, and output preprocessed data with time-frequency labels to a feature processing module; A feature processing module configured to receive preprocessed data transmitted by the data acquisition module, run a conventional feature extraction channel and a graph topology feature generation channel in parallel, receive an anomaly detection confidence index transmitted by a threat detection module, perform automatic encoder dimension reduction when the confidence index exceeds a threshold, perform a spectral clustering algorithm to select a key feature subset when the confidence index does not exceed the threshold, and transmit a compressed feature tensor to the threat detection module; A threat detection module configured to receive a feature tensor transmitted by the feature processing module, perform anomaly scoring to generate a threat report, calculate data distribution changes to generate a data drift index, transmit the threat report and the data drift index to a model optimization module, and feed back the confidence index to the feature processing module; A model optimization module configured to receive a threat report and a data drift index transmitted by the threat detection module, start a Bayesian optimizer when the data drift index exceeds a threshold, activate a model distillation process when the threat report marks a zero-day threat, and perform a federated learning local update protocol when the data drift index does not exceed the threshold, to generate neural network weight parameters and output them to the threat detection module to replace the original parameters; A feedback enhancement module configured to receive alarm logs and security annotation data transmitted by a power grid dispatching system, generate adversarial samples as training data for the model optimization module, and generate a resampling instruction and transmit it to the data acquisition module when the false positive rate exceeds 15%.

[0020] The online self-learning-based security threat model optimization system involves the cooperative operation of multiple modules, aiming to solve the problem of resource consumption in dynamic security threat detection. The system starts with a data acquisition module that captures network traffic, device operation logs, and voltage phase fluctuation signals in real time from the power system. Noise elimination filters electromagnetic interference, and dynamic normalization processing adjusts the dimension based on real-time data flow to generate preprocessed data with time-frequency labels, which are output to the feature processing module. This step provides standardized input for subsequent processing, eliminates environmental noise, and improves data quality at the source.

[0021] After receiving the preprocessed data transmitted by the data acquisition module, the feature processing module starts the regular feature extraction channel and the graph topology feature generation channel in parallel. The regular feature extraction channel analyzes the data packet distribution characteristics and session periodic behavior to generate a statistical feature vector; the graph topology feature generation channel constructs an adjacency matrix of device interaction relationships to generate a topology feature vector. The two types of feature vectors are combined to form an initial feature tensor, and the module dynamically selects a dimension reduction strategy based on the anomaly detection confidence index transmitted by the threat detection module: in high confidence scenarios, an autoencoder is used to compress the feature dimension, and in low confidence scenarios, a spectral clustering algorithm is used to select a key feature subset. The generated compressed feature tensor is transmitted to the threat detection module, significantly reducing the computational complexity and forming a closed loop of feature extraction and detection feedback.

[0022] The threat detection module receives the feature tensor transmitted by the feature processing module, performs anomaly scoring to locate suspicious data points, and combines the power attack knowledge base to perform threat type matching and new attack identification. The anomaly scoring process marks abnormal points, and the threat reasoning step compares predefined behavior templates to identify advanced persistent threats. The system generates a threat report with a credibility weight and a data drift index, which are transmitted to the model optimization module, and the anomaly detection confidence index is fed back to the feature processing module. This analysis process provides the basis for decision-making and optimizes the feature extraction mechanism in reverse.

[0023] Based on the threat report and data drift index transmitted by the threat detection module, the model optimization module starts a lightweight update strategy in combination with the system resource state. When the data drift index exceeds the standard, the Bayesian optimizer is activated to search for a combination of hyperparameters; when the threat report marks a zero-day threat, the model distillation process is performed to compress the model; in a regular scenario, the local update protocol of federated learning is used. The generated neural network weight parameters are output to the threat detection module to replace the original parameters, realizing model self-adaptive adjustment and reducing the amount of parameter iteration.

[0024] The feedback enhancement module receives the alarm log and safety annotation data transmitted by the power grid dispatching system, and constructs a false alarm knowledge graph to locate data defects. When the false alarm rate exceeds the standard, a resampling instruction is generated and transmitted to the data acquisition module to improve the sampling frequency; at the same time, an adversarial sample is injected into the training data stream of the model optimization module to enhance the robustness of the model. This mechanism forms a data quality correction loop to reduce invalid model iterations.

[0025] Each module is connected through a data stream: the data acquisition module outputs driving features; the feature processing outputs support threat detection; the threat detection outputs model optimization and feedback enhancement; the feedback enhancement outputs data acquisition and model optimization. Feature compression, lightweight update and data quality improvement work together to reduce resource consumption from the source.

[0026] Specifically, the data acquisition module of the online self-learning-based security threat model optimization system comprises: A phase-sensitive probe directly accesses the power grid communication bus to capture protocol packets, and converts the protocol packets into digital signal format and transmits them to the first input port of the quantum noise filter; A voltage waveform acquisition unit acquires original phase fluctuation signals through a sensor, converts the original phase fluctuation signals into standard voltage range signals, and transmits the standard voltage range signals to the second input port of the quantum noise filter; A quantum noise filter receives protocol packets in digital signal format through the first input port, receives standard voltage range signals through the second input port, performs electromagnetic interference elimination processing on the two types of signals, and outputs a unified format of noise reduction signals to the adaptive sliding window processor; An adaptive sliding window processor receives the noise reduction signals output by the quantum noise filter, detects network traffic peak to dynamically determine the sampling window size, performs normalization processing on the noise reduction signals, and outputs preprocessed data with millisecond-level time stamps to the feature processing module.

[0027] The data acquisition module of the online self-learning-based security threat model optimization system forms a technical closed loop with four processing units. The phase-sensitive probe captures original protocol packets by physically accessing the power grid communication bus, and converts the packets into digital signal format conforming to the industrial bus standard using analog-to-digital conversion technology. This conversion eliminates protocol differences and adapts the signal to the input specification requirements of the quantum noise filter.

[0028] The voltage waveform acquisition unit is deployed with high-precision voltage sensors to directly capture original phase fluctuation signals in power lines. The signal conditioning circuit adjusts the amplitude of the original signal to the standard voltage range, eliminating the level difference between devices. Standardization processing ensures the compatibility of different types of signals in subsequent processing.

[0029] The quantum noise filter is configured with a double-input port architecture: the first input port receives protocol packets in a digital signal format, and the second input port receives a standard voltage range signal. The filter core uses quantum tunneling principles to construct a noise cancellation matrix, which performs wide-band electromagnetic interference cancellation on the two types of input signals in parallel. The output is a denoised signal in floating-point array format, establishing a standardized intermediate data representation.

[0030] The adaptive sliding window processor monitors network traffic peak changes in real time and dynamically adjusts the sampling window size based on a preset traffic threshold. The denoised signal is normalized using a sliding average within the adjusted time window, eliminating the influence of amplitude fluctuations. The final output data is attached with millisecond-level precise timestamps, forming a spatiotemporally aligned preprocessed data set.

[0031] Specifically, the feature processing module of the online self-learning based security threat model optimization system is configured to: Receive preprocessed data transmitted by the data acquisition module, and trigger the simultaneous start of the regular feature extraction channel and the graph topology feature generation channel; The regular feature extraction channel calculates the Wasserstein distance of the data packet as a distribution feature, analyzes the periodicity of the session time series, and outputs a 128-dimensional statistical feature vector; The graph topology feature generation channel constructs a 32x32 adjacency matrix based on device communication relationships and outputs a 256-dimensional topology feature vector; Concatenate the 128-dimensional statistical feature vector and the 256-dimensional topology feature vector in the feature dimension to generate a 384-dimensional initial feature tensor; Receive the anomaly detection confidence index transmitted by the threat detection module. When the confidence index is greater than 0.85, use a 3-layer autoencoder to reduce the 384-dimensional feature tensor to 64 dimensions; When the confidence index is less than or equal to 0.85, use a spectral clustering algorithm to select the top 50 key features from the 384-dimensional feature tensor; Convert the reduced or selected feature tensor to FP16 floating-point format and transmit it to the threat detection module through the DMA channel.

[0032] The feature processing module uses a dual-channel parallel architecture to process preprocessed data transmitted by the data acquisition module. The module is initialized to simultaneously activate the regular feature extraction channel and the graph topology feature generation channel, establishing a parallel computing pipeline. The regular feature extraction channel analyzes the distribution characteristics of the data packet, measures the distribution difference using the Wasserstein distance, and simultaneously detects the time periodicity pattern of the session behavior, outputting a feature vector representing statistical characteristics.

[0033] The graph topology feature generation channel analyzes the communication relationship between the devices, and constructs a device interaction adjacency matrix to map the network topology structure. The adjacency matrix generation process captures the device connection relationship, and outputs a feature vector representing the topology structure. The two channel output vectors perform a splicing operation in the feature dimension, combining the statistical characteristics and topology characteristics to form a high-dimensional initial feature tensor, which preserves the multi-modal information of the original data.

[0034] The module receives the anomaly detection confidence index transmitted by the threat detection module, and selects a feature compression strategy according to the index value. When the anomaly detection confidence index exceeds the preset threshold, the autoencoder is activated to perform feature dimension reduction, and the key feature representation is extracted through the encoding and decoding structure. When the anomaly detection confidence index does not exceed the threshold, switch to the spectral clustering algorithm to select the most discriminative feature subset. The dimension reduction or feature selection operation generates a low-dimensional feature tensor, which significantly reduces the data dimension.

[0035] In the final stage, the processed feature tensor is converted to FP16 floating point format and transmitted to the threat detection module through a direct memory access channel. The floating point format conversion reduces the data storage overhead, and the direct memory access channel realizes zero-copy data transmission, eliminating the consumption of processor resources.

[0036] Specifically, the online self-learning-based security threat model optimization system provided by the present application further comprises: Every 60 seconds, a 128-dimensional feature importance vector is received from the threat detection module through the message queue, and the vector element value range is [0, 1]; The average value of the 65th-128th elements in the feature importance vector is calculated as the topology feature weight ratio, and when the ratio exceeds 0.7, the convolution layer depth of the graph topology feature generation channel is increased from 3 layers to 5 layers, and when the ratio is less than 0.3, the convolution layer depth is reduced from 3 layers to 1 layer; The average value of the 1st-64th elements in the feature importance vector is calculated as the statistical feature weight ratio, and when the ratio exceeds 0.6, the LSTM time step of the regular feature extraction channel is adjusted from 10 steps to 20 steps, and when the ratio is less than 0.4, the time step is adjusted from 10 steps to 5 steps; The topology feature weight ratio and the statistical feature weight ratio are added, and when the sum is greater than 1.2, the confidence index threshold of the autoencoder dimension reduction is raised from 0.85 to 0.9, and when the sum is less than 0.8, the threshold is lowered from 0.85 to 0.8.

[0037] The feature processing module periodically receives the feature importance vector transmitted by the threat detection module, and establishes a feature weight feedback mechanism. The feature importance vector is transmitted through the message queue at regular intervals, the vector dimension is consistent with the feature space, and the element value range reflects the contribution of the feature to the detection result. The vector receiving process maintains a fixed time interval, forming a stable feedback control loop.

[0038] The module parses the feature importance vector, and divides the vector dimension range corresponding to different feature types. The topology feature weight ratio calculation process extracts the average value of the specific dimension interval of the vector, and quantifies the relative importance of the topology feature in the current detection model. When the weight ratio exceeds the preset upper limit, the convolution layer depth of the graph topology feature generation channel is increased; when the weight ratio is lower than the preset lower limit, the convolution layer depth is reduced. The layer depth adjustment changes the feature extraction capability and adapts to the threat mode change.

[0039] The statistical feature weight ratio calculation extracts the average value of another dimension interval of the vector, and measures the key degree of the statistical feature. When the ratio exceeds the set threshold, the time step of the LSTM network of the conventional feature extraction channel is expanded; when the ratio is lower than the set threshold, the time step is shortened. The step length adjustment optimizes the time series feature capture range and improves the periodic threat recognition accuracy.

[0040] The module fuses the topology feature weight ratio and the statistical feature weight ratio to generate a comprehensive weight evaluation value. When the evaluation value exceeds the critical point, the confidence index threshold of the automatic encoder dimension reduction is floated up; when the evaluation value is lower than the critical point, the confidence index threshold is sunk. The threshold dynamically adjusts the balance between feature compression intensity and information retention demand to form a closed-loop optimization mechanism.

[0041] Specifically, the threat detection module of the online self-learning based security threat model optimization system described in the application is configured to: Receive the FP16 format feature tensor transmitted by the feature processing module, and mark it as an abnormal data point when the abnormal score output by the isolation forest algorithm exceeds 0.95; For each abnormal data point, extract its corresponding device communication path in the graph topology feature generation channel, which includes a triple of source device ID, target device ID and timestamp; Perform dynamic time warping (DTW) similarity calculation on the extracted communication path and the 20 pre-stored APT behavior templates in the power attack knowledge base, each template including 5-10 typical attack steps; When the DTW similarity score of any template exceeds 0.8, generate a reconstruction instruction in JSON format, which includes an attack path node list and a similarity score, and send it to the feature processing module through a message queue; Trigger the graph topology feature generation channel to add attack association edges in the original 32x32 adjacency matrix according to the node list in the reconstruction instruction, and output the updated 256-dimensional topology feature vector to the feature processing channel.

[0042] The threat detection module receives the FP16 format feature tensor transmitted by the feature processing module, and adopts a floating point compression format to reduce data transmission delay. The isolation forest algorithm performs unsupervised anomaly detection on the feature tensor, marks high abnormality data points according to the data point split path length, and forms a preliminary threat candidate set.

[0043] A channel for generating topology features of a backtracking marked abnormal data point is generated, and a device communication path triple structure is extracted. The path information includes a source device identifier, a target device identifier and an accurate timestamp, and completely records the space-time trajectory of abnormal behavior. The path extraction process establishes a mapping relationship between the abnormal point and the device interaction behavior.

[0044] The power attack knowledge base stores a high-level persistent threat behavior template, and each template defines a typical attack step sequence. The dynamic time warping algorithm calculates the time sequence similarity between the extracted path and the behavior template, and eliminates the influence of time sequence stretching and contraction difference. The similarity evaluation quantifies the association strength between the abnormal behavior and the known attack mode.

[0045] When the similarity score exceeds a set threshold, a structured reconstruction instruction is generated. The instruction encapsulates the attack path key node list and the matching score, and uses the JSON format to ensure cross-platform compatibility. The message queue transmission mechanism realizes asynchronous sending of the instruction to the feature processing module.

[0046] After the feature processing module receives the reconstruction instruction, the graph topology feature generation channel updates the device associated adjacency matrix. The newly added attack associated edge strengthens the expression of the abnormal path, and the network topology representation space is reconstructed. The updated topology feature vector is output to the feature processing channel to form a closed-loop feedback from the detection result to the feature optimization. This mechanism realizes the bidirectional optimization of threat detection and feature extraction: the feature tensor drives abnormal detection in the forward process, and the detection result guides feature reconstruction in the reverse process. The dynamic update of the topology feature enhances the adaptability of the system to new attack modes, and constitutes the core technical features of the self-optimizing security protection system.

[0047] Specifically, the online self-learning based security threat model optimization system disclosed by the application further comprises: The data drift index and the threat report transmitted by the threat detection module through the gRPC protocol are received once every 5 minutes, the data drift index value domain is [0, 2], and the threat report includes a threat type label and a confidence score; When the data drift index is greater than 1.2 and the system CPU utilization is less than 70%, the Bayesian optimizer is started to perform 50 rounds of hyperparameter search, and the first type of update parameter including the learning rate, the batch size and the network depth is generated; When the threat report is marked as a zero-day threat and the memory occupancy rate exceeds 80%, the three-layer teacher and student model distillation process is activated, the original model parameter quantity is compressed by 60%, and the second type of update parameter is generated; When the data drift index is less than or equal to 1.2 and no zero-day threat is detected, a federated learning local update protocol is executed to update only the fully connected layer parameters, generating the third type of update parameters. After verifying the validity of the update parameters through the version control mechanism, the new parameters are deployed to the threat detection module in an incremental update manner, and the first three versions of the parameters are backed up.

[0048] The model optimization module periodically receives the data drift index and threat report transmitted by the threat detection module through the gRPC protocol. The data drift index quantifies the degree of real-time data distribution deviation, and the threat report includes threat type labels and confidence scores. The fixed time interval transmission mechanism establishes the basis for model update decisions, forming the input source for resource-aware optimization.

[0049] When the data drift index exceeds the set threshold and the system CPU utilization is in a low load state, the Bayesian optimizer is activated to perform the hyperparameter search process. The optimizer performs multiple iterations in the parameter space to explore the optimal combination of learning rate, batch size, and network depth, generating the first type of update parameters. This strategy realizes accurate tuning of the model when system resources are abundant.

[0050] When the threat report labels a zero-day threat and the memory occupancy rate exceeds the critical point, a three-layer teacher-student model distillation framework is started. The teacher model guides the lightweight student model to learn key feature representations, compressing the original model parameter magnitude, and generating the second type of update parameters. The distillation mechanism maintains model effectiveness in resource-constrained scenarios.

[0051] When the data drift index does not exceed the threshold and there is no zero-day threat, the federated learning local update protocol is executed. The protocol limits the parameter update range to the fully connected layer, exchanges model gradients through a distributed collaboration mechanism, and generates the third type of update parameters. Local updates reduce computational overhead and adapt to regular operating states.

[0052] The version control mechanism performs integrity checks on newly generated parameters, and after verifying the validity of the parameters, it starts the incremental update process. The update process only replaces the model weights of the threat detection module, and the historical version parameter backups are preserved. This mechanism supports update rollback, ensuring system stability.

[0053] The module establishes a resource-adaptive update decision tree: when data drift is significant, trigger Bayesian optimization, when there is a zero-day threat, activate model distillation, and in regular states, use federated learning. The three-level strategy dynamically switches according to system load, forming a balance mechanism between computational resources and model accuracy. Versioned incremental deployment enables seamless model switching, eliminating the risk of service interruption.

[0054] Specifically, the feedback enhancement module of the online self-learning-based security threat model optimization system is configured to receive JSON format alarm logs and XML format security expert annotation data transmitted by the power grid dispatching system through a RESTful API; The device ID, timestamp and alarm type fields in the alarm logs are parsed using regular expressions, the false alarm marks in the expert annotations are associated, and a knowledge graph including device nodes, false alarm edges and area attributes is constructed in a Neo4j graph database. When the proportion of false alarm events associated with the same physical area code (AreaCode) in the knowledge graph exceeds 15%, a Protobuf format instruction including the area code and the target sampling frequency is generated and transmitted to the data collection module through a message queue. Based on the comparative learning algorithm framework, a 500-dimensional adversarial sample vector is generated, including a perturbation amplitude parameter, which is injected into the training data buffer queue of the model optimization module through a gRPC streaming interface.

[0055] The feedback enhancement module receives alarm logs and security expert annotation data transmitted by the power grid dispatching system through a RESTful API interface. The alarm logs are encapsulated in JSON format to record device alarm events, and the security expert annotation data is stored in XML format to store false alarm verification information. The API interface realizes cross-system data integration and provides standardized input sources.

[0056] The module applies a regular expression parsing engine to process alarm logs, extracting device identifiers, precise timestamps and alarm type key fields. The parsing process matches log text patterns, associates false alarm marks in security expert annotations, and establishes a mapping relationship between device events and manual verification. The field association mechanism eliminates data ambiguity.

[0057] The parsing results are input into a Neo4j graph database to construct a knowledge graph. The graph structure defines device node entities, false alarm edge relationships and area attributes, including physical area code identifiers. The graph construction process models the spatial distribution relationship of device false alarm events, supporting regional analysis.

[0058] The knowledge graph calculates the proportion of false alarm events associated with the same physical area code. When the proportion exceeds the set threshold, a Protobuf format instruction data packet is generated. The instruction encapsulates the physical area code and the target sampling frequency parameter and is transmitted asynchronously to the data collection module through a message queue. The instruction transmission mechanism triggers dynamic adjustment of the data source sampling strategy.

[0059] The module generates an adversarial sample vector based on a contrastive learning algorithm framework. The framework builds positive and negative sample pairs, learns feature representation differences, and generates a high-dimensional vector including a perturbation amplitude control parameter. The vector is injected into the training data buffer queue of the model optimization module through a gRPC streaming interface. The injection process enhances the robustness of the model and improves the ability to resist adversarial noise interference.

[0060] The processing flow forms a closed loop: data input drives atlas analysis, analysis results generate control instructions to optimize data acquisition, and adversarial samples are injected to enhance model training. Instruction transmission and sample injection are performed in parallel to cooperatively improve the system's anti-interference ability and data quality.

[0061] Specifically, the online self-learning-based security threat model optimization system described in the present application further comprises: Every 15 minutes, all confidence scores in the threat report output by the threat detection module are obtained, and the confidence value range is [0, 1]; The decay rate of the current F1-score is calculated based on the average F1-score in the last 24 hours, and the decay rate is (baseline value-current value) / baseline value*100%; When the decay rate exceeds 10%, a Protobuf format instruction including the model ID and the emergency level is generated and transmitted to the model optimization module through the gRPC protocol; The model optimization module triggers an interrupt to the ongoing update process and starts a complete model retraining of 200 epochs. After the training is completed, the new model parameters are deployed to the threat detection module.

[0062] The feedback enhancement module establishes a periodic performance monitoring mechanism and periodically collects the confidence data of the threat report output by the threat detection module. The collection process maintains a fixed time interval, and all confidence scores in the report are obtained to form an evaluation data set. The confidence value range is standardized to a unified dimension to provide a basis for model state evaluation.

[0063] The module calculates the F1-score performance indicator of the current evaluation period, and the average F1-score of the historical time span is used as the reference value. The performance decay rate is quantified by the relative change rate of the reference value and the current value. The formula calculation reflects the degree of model performance degradation. The decay rate indicator objectively reflects the trend of detection accuracy.

[0064] When the performance decay rate exceeds the set critical point, a structured control instruction is generated. The instruction encapsulates the model identifier and the emergency level parameter, and is encoded in Protobuf format to ensure transmission efficiency. The gRPC protocol realizes real-time transmission of the instruction to the model optimization module, establishing a low-latency response channel.

[0065] After receiving the emergency instruction, the model optimization module interrupts the ongoing update process. The system starts a complete model retraining process, and the training process performs a fixed number of iterations. After retraining, a new model parameter set is generated, and the deployment process replaces the original parameters of the threat detection module.

[0066] The mechanism constitutes an emergency response chain for performance degradation: monitoring data collection → performance degradation calculation → emergency instruction generation → training process interruption → full model retraining → parameter deployment. The closed-loop design timely corrects model degradation problems and maintains the stability of system detection accuracy.

[0067] The present application realizes the self-repairing ability of the model performance through the five-stage closed loop of monitoring, analysis, instruction, training and deployment. The performance evaluation adopts a historical benchmark comparison mechanism, the instruction transmission adopts an efficient binary protocol, and the training process adopts a complete iteration strategy, realizing the comprehensive optimization of the degraded model.

[0068] Specifically, the online self-learning based security threat model optimization system described in the present application further comprises: When the dynamic time warping (DTW) similarity score in the threat detection module is less than 0.3 and the threat type is not registered in the power attack knowledge base, it is determined as a new attack mode; Generate a Protobuf format federated learning activation instruction including attack feature hash value and emergency level, and transmit it to the model optimization module through the gRPC protocol to trigger the multi-node parameter exchange protocol; Synchronously generate a Protobuf format high-frequency sampling instruction including a target sampling rate of 20kHz, and transmit it to the data acquisition module through the message queue; The model optimization module receives the high-frequency data collected by the data acquisition module in a 50ms window, performs local parameter update every 5 seconds, and only updates the convolution kernel weight parameters; The updated parameters are packaged as an incremental model, identified by a version number, and deployed to the threat detection module to replace the corresponding convolution kernel weight.

[0069] The online self-learning based security threat model optimization system establishes a new attack emergency response mechanism. The threat detection module calculates the behavior pattern similarity through the dynamic time warping algorithm, and determines the attack mode type in combination with the registration status of the power attack knowledge base. When the similarity is lower than the set threshold and the attack mode is not registered in the knowledge base, the system identifies it as a new attack mode, triggering the cross-module collaborative response process.

[0070] The system generates structured instructions including attack feature hash values and emergency levels, and encapsulates instruction content in a Protobuf binary format. The federated learning activation instruction is transmitted in real time to the model optimization module through the gRPC remote call protocol to start the parameter exchange protocol between distributed nodes. High-frequency sampling control instructions are generated synchronously, which specify target sampling rate parameters and are transmitted asynchronously to the data acquisition module through a message queue to realize dynamic adjustment of the sampling strategy.

[0071] The model optimization module receives a high-frequency sampling data stream, and the data acquisition window uses a millisecond-level time scale. The module performs a periodic local parameter update process, which limits the range of convolution kernel weights to maintain the stability of the model main structure. The parameter update frequency is coordinated with the data acquisition rate to form a fast response mechanism.

[0072] The updated convolution kernel weight parameters are encapsulated as an incremental model package, and the model package is attached with version identification information. The deployment process injects the incremental model into the threat detection module to replace the corresponding convolution kernel weight parameters. The versioned deployment mechanism supports update rollback functions to maintain system operation continuity.

[0073] This mechanism realizes a four-stage closed loop of new attack response: attack pattern recognition, instruction collaborative transmission, local parameter update, and incremental model deployment. The federated learning protocol guarantees knowledge fusion of multiple nodes, high-frequency sampling realizes data timeliness, local convolution kernel update balances response speed and system stability, and the version control mechanism provides security deployment guarantee. The technical solution builds a defense system for unknown threats through the synergistic effect of identification, transmission, update, and deployment.

[0074] In a second aspect, referring to Figure 1 The online self-learning-based security threat model optimization method provided by the application is applied to the online self-learning-based security threat model optimization system, and includes the following steps. Step 1, real-time acquisition of power system network traffic, device operation logs, and voltage phase fluctuation signals, execution of noise elimination and dynamic normalization processing, and output of preprocessed data with time-frequency labels to step 2; Step 2, receiving the preprocessed data transmitted by step 1, parallel running of a conventional feature extraction channel and a graph topology feature generation channel, receiving the anomaly detection confidence index transmitted by step 3, performing automatic encoder dimension reduction when the confidence index exceeds a threshold, performing a spectral clustering algorithm to select a key feature subset when the confidence index does not exceed the threshold, and transmitting the compressed feature tensor to step 3; Step 3, receiving the feature tensor transmitted by step 2, executing anomaly scoring to generate a threat report, calculating a data distribution change to generate a data drift index, transmitting the threat report and the data drift index to step 4, and feeding back the confidence index to step 2; Step 4, receive the threat report and data drift index transmitted in step 3, start the Bayesian optimizer when the data drift index exceeds the threshold, activate the model distillation process when the threat report marks a zero-day threat, perform the federated learning local update protocol when the data drift index does not exceed the threshold, generate neural network weight parameter output to replace the original parameters in step 3; Step 5, receive the alarm log and security annotation data transmitted by the power grid dispatching system, generate an adversarial sample input into the training data stream of step 4, and generate a resampling instruction when the false positive rate exceeds 15% and transmit it to step 1.

[0075] The security threat model optimization method provided by the application starts from step 1, and real-time captures power system network traffic, device operation logs and voltage phase fluctuation signals. The noise elimination process filters environmental electromagnetic interference, and dynamically normalizes the signal dimension based on the real-time data characteristics to generate preprocessed data with time-frequency labels. The output data is transmitted to step 2 through a standardized interface to realize the quality consistency of the data source, and provides a basic input for subsequent feature engineering.

[0076] Step 2 receives the preprocessed data transmitted in step 1, and simultaneously starts the regular feature extraction channel and the graph topology feature generation channel. The regular feature extraction channel analyzes the data packet distribution characteristics and session time periodicity to generate a statistical feature vector; the graph topology feature generation channel constructs a device communication adjacency matrix to generate a topology feature vector. The two vectors are spliced to form an initial feature tensor, and the module receives the anomaly detection confidence index transmitted in step 3. When the index exceeds the threshold, the automatic encoder dimension reduction is performed, otherwise the spectral clustering algorithm is switched to select a key feature subset. The compressed feature tensor is transmitted to step 3 to realize feature dimension reduction and reduce the calculation load, and a closed-loop logic of feature extraction and detection feedback is formed.

[0077] Step 3 receives the feature tensor transmitted in step 2, performs anomaly scoring to locate suspicious data points, and combines the power attack knowledge base to perform threat type reasoning and new attack identification. The anomaly scoring process marks the abnormal points, and the threat reasoning step matches the pre-defined behavior template to generate a threat report with a credibility weight and a data drift index. The report and index are transmitted to step 4, and the anomaly detection confidence index is fed back to step 2. This step provides the basis for threat decision, and the feedback mechanism is used to optimize the feature processing process in the reverse direction, and the detection accuracy and adaptability are enhanced.

[0078] Step 4 receives the threat report and data drift index transmitted in step 3, selects a lightweight update strategy according to the index value and threat type. When the data drift index exceeds the threshold, start the Bayesian optimizer to search for the combination of hyperparameters; when the threat report marks a zero-day threat, activate the model distillation process; in a regular scenario, execute the federated learning local update protocol. Generate neural network weight parameters and output to step 3 to replace the original parameters, realize dynamic adjustment of model parameters and resource optimization, form the core mechanism of model self-adaptation.

[0079] Step 5 receives the alarm log and safety annotation data transmitted by the power grid dispatching system, parses the log field associated with expert annotations, and constructs a false alarm knowledge graph. When the false alarm rate exceeds the threshold, generate a resampling instruction and transmit it to step 1 to improve the data collection frequency; at the same time, generate adversarial samples based on the contrastive learning algorithm framework and inject them into the training data stream in step 4. This step reduces invalid iterations through data quality correction and model robustness enhancement, forming a feedback-driven closed-loop optimization.

[0080] Step 1 outputs to drive step 2; step 2 outputs to support step 3; step 3 outputs to guide step 4 and feedback to step 2; step 5 outputs to adjust step 1 and step 4. The overall process establishes a collaborative mechanism for collection, feature processing, detection, optimization, and feedback. Feature compression reduces computational load, lightweight update reduces parameter adjustment, and data quality improvement avoids invalid iterations, all of which work together to solve the problems of resource consumption and response delay.

[0081] The online self-learning-based security threat model optimization system solves the problems of resource consumption and response delay caused by dynamic model updates in the power monitoring scenario through a three-level collaborative mechanism. In the data collection stage, quantum noise filtering technology is used to eliminate electromagnetic interference in the power grid, and an adaptive sliding window is used to dynamically adjust the data sampling frequency, generating preprocessed data streams with high signal-to-noise ratio. This operation controls data quality from the source, reduces the burden of subsequent invalid calculations, and avoids resource waste caused by redundant data processing.

[0082] In the feature processing stage, a dual-channel parallel architecture is used to extract statistical features and topological features simultaneously. The key innovation is the introduction of a dynamic dimension reduction strategy: the system intelligently selects feature compression methods based on the anomaly detection confidence index feedback from the threat detection module. When the confidence is high, activate the autoencoder to perform dimension reduction; when the confidence is insufficient, switch to the spectral clustering algorithm to select a key feature subset. This decision mechanism significantly reduces the dimension of the feature tensor, reduces the computational burden of the downstream, and solves the problem of excessive computational load in existing feature processing.

[0083] When the threat detection module performs multi-modal analysis based on the compressed feature tensor, a feedback reconstruction mechanism is established. When a high-level persistent threat is detected, the system triggers the feature processing module to reconstruct the device topology graph, generating an enhanced topology feature vector. This local reconstruction strategy avoids full data reprocessing, reduces computational load, and improves adaptability to new threats.

[0084] The model updating link adopts a resource-aware strategy decision tree: when the data drift index exceeds the standard, the Bayesian optimizer is started to search for super parameters; when a zero-day threat appears, the model distillation process is activated to compress the parameter quantity; and in a regular scenario, the federal learning local update protocol is executed. The three-level strategy dynamically selects according to the CPU utilization and memory occupancy of the system, greatly reduces the parameter adjustment quantity and iteration period, and solves the resource bottleneck problem caused by frequent global updates.

[0085] The feedback enhancement module constructs a false positive knowledge graph to locate data defects, and increases the sampling frequency of the corresponding data source when the false positive rate in a specific area rises. At the same time, the model robustness is strengthened by injecting the adversarial samples generated by contrastive learning. This data quality intervention reduces the number of invalid model iterations from the root. When a new attack pattern is identified, the system starts a cross-module emergency response: synchronously increases the data sampling rate and activates the federal learning framework, so that the threat detection module quickly completes the incremental update of the convolution kernel weight.

[0086] The modules form a closed loop through data flow: the feature processing module outputs to support the threat detection module; the threat detection module outputs to guide the model optimization module and feeds back to the feature processing module; the feedback enhancement module outputs to adjust the data acquisition module and the model optimization module. Feature compression reduces the computational load of single processing, lightweight update strategy reduces the parameter adjustment frequency, and data quality improvement avoids invalid iteration. The three work together to shorten the response delay of the power monitoring system while maintaining a high threat detection rate, solving the problem of high computational resource consumption and response delay caused by dynamic model updating.

[0087] The specific implementation of the security threat model optimization system based on online self-learning solves the problems of high computational resource consumption and response delay caused by dynamic model updating in the power monitoring scene through a three-level collaborative mechanism. The system is deployed in the intelligent power grid monitoring center server cluster, connecting the power dispatching network and the substation terminal equipment. The implementation process starts with the data acquisition module, the phase-sensitive probe is connected to the power grid communication bus to capture Modbus / TCP protocol packets, and the voltage waveform acquisition unit is installed in the substation bus duct to acquire phase fluctuation signals. The quantum noise filter uses a quantum annealing chip to eliminate electromagnetic interference, and the adaptive sliding window processor dynamically adjusts the sampling window size according to the network traffic load, outputting preprocessed data with millisecond-level timestamps. This process improves data quality from the source and eliminates the burden of invalid data processing.

[0088] After the feature processing module receives the preprocessed data, the dual-channel parallel processing architecture is synchronously started. The conventional feature extraction channel calculates the Wasserstein distance of the data packet distribution, and combines the LSTM network to analyze the session period mode. The graph topology feature generation channel constructs the device interaction adjacency matrix. After the dual-path feature vector is spliced to form a high-dimensional feature tensor, a dimension reduction strategy is dynamically selected according to the abnormal detection confidence index fed back by the threat detection module: when the confidence exceeds the threshold, a three-order auto-encoder is activated to perform dimension compression, otherwise a spectral clustering algorithm is switched to select a key feature subset. This intelligent decision reduces the feature dimension, significantly reducing the downstream computing pressure.

[0089] The threat detection module performs multi-modal analysis on the compressed feature tensor, and after the isolation forest algorithm marks the abnormal points, the device communication path is extracted and the APT behavior template of the power knowledge base is matched for DTW similarity. When detecting advanced threats, generate reconstruction instructions and feed back to the feature processing module to trigger the graph topology feature generation channel to update the adjacency matrix. This local reconstruction mechanism avoids full data reprocessing and optimizes feature expression.

[0090] The model optimization module starts resource-aware updating based on the data drift index and threat type: when the data drift is significant, the Bayesian optimizer is called to search for hyperparameters; when a zero-day threat occurs, a three-layer teacher-student model is distilled to compress the parameter quantity; and in a regular scenario, a federated learning local update protocol is used. The three-level strategy dynamically switches according to CPU utilization and memory occupancy, reducing the parameter adjustment quantity compared to global updating. The updated parameters are incrementally deployed to the threat detection module after version verification, realizing seamless switching of the model.

[0091] The feedback enhancement module constructs a false positive knowledge graph, and when the false positive rate in a specific area exceeds the standard, it increases the sampling frequency and injects the adversarial samples generated by contrastive learning. When identifying new attack patterns, the system starts emergency response: the federated learning activation instruction and the high-frequency sampling instruction are issued synchronously, the model optimization module receives the millisecond-level sampling data to update the convolution kernel weights, and the incremental model deployment realizes millisecond-level response. The modules are linked through a data flow closed loop: feature compression reduces the single computing amount, intelligent updating reduces the iteration frequency, and data optimization eliminates invalid training, which solves the problems of resource consumption and delay.

[0092] The technical feature names involved in the present application are explained as follows: The data acquisition module is responsible for capturing network traffic, device operation logs and voltage phase fluctuation signals from the power system in real time. The phase-sensitive probe directly accesses the power grid communication bus to capture protocol packets, and the voltage waveform acquisition unit acquires the original phase fluctuation signal through a sensor. The quantum noise filter processes the two types of input signals to eliminate electromagnetic interference, and the adaptive sliding window processor dynamically adjusts the sampling window based on network traffic and outputs preprocessed data with time-frequency markers. This module realizes the purity of the original signal, laying a foundation for subsequent analysis.

[0093] The feature processing module initiates dual-channel processing after receiving the pre-processed data: the regular feature extraction channel calculates the packet distribution distance and analyzes the session periodicity, outputting a statistical feature vector; the graph topology feature generation channel constructs a device correlation adjacency matrix to generate a topology feature vector. The initial feature tensor is spliced from the two types of vectors, and the module dynamically selects automatic encoder dimension reduction or spectral clustering algorithm feature selection according to the anomaly detection confidence index transmitted by the threat detection module, and finally outputs a compressed feature tensor. The feature importance vector feedback mechanism dynamically adjusts channel parameters, such as adjusting the depth of the convolutional layer or the time step of the LSTM, to optimize the feature extraction process.

[0094] The threat detection module processes the compressed feature tensor, marks abnormal data points through the isolation forest algorithm, extracts device communication path triples, and performs dynamic time warping similarity calculation with APT behavior templates in the power attack knowledge base. When the similarity exceeds the threshold, a reconstruction instruction is generated to trigger the feature processing module to update the adjacency matrix, while calculating the data drift index and generating a threat report. This module realizes the closed loop of anomaly detection and feature optimization, improving the threat recognition accuracy.

[0095] The model optimization module selects an update strategy based on the data drift index and the threat report: the Bayesian optimizer searches for a combination of hyperparameters, the model distillation process compresses the parameter amount, or the federated learning local update protocol. The updated parameters are verified through the version control mechanism and then incrementally deployed to the threat detection module. The federated learning activation instruction and the high-frequency sampling instruction cooperate to trigger cross-module responses. This mechanism reduces resource occupation and realizes model real-time performance.

[0096] The feedback enhancement module receives alarm logs and security annotation data, constructs a false alarm knowledge graph to locate data defects. When the false alarm rate exceeds the standard, a resampling instruction is generated to adjust data collection, and an adversarial sample generated by contrastive learning is injected to strengthen model training. The performance monitoring mechanism calculates the F1-score decay rate to trigger full-model retraining to maintain system performance. The modules form a closed-loop linkage through data flow, feature compression reduces computational complexity, lightweight updates reduce iteration overhead, data quality optimization avoids invalid processing, and the modules cooperate to solve resource consumption and response delay problems.

Claims

1. A security threat model optimization system based on online self-learning, characterized in that, include: The data acquisition module is configured to acquire power system network traffic, equipment operation logs and voltage phase fluctuation signals in real time, perform noise cancellation and dynamic normalization processing, and output preprocessed data with time and frequency markers to the feature processing module. The feature processing module is configured to receive preprocessed data transmitted by the data acquisition module, run the regular feature extraction channel and the graph topology feature generation channel in parallel, receive the anomaly detection confidence index transmitted by the threat detection module, execute the autoencoder dimensionality reduction when the confidence index exceeds the threshold, and execute the spectral clustering algorithm to select key feature subsets when the confidence index does not exceed the threshold, and generate a compressed feature tensor to be transmitted to the threat detection module. The threat detection module is configured to receive feature tensors transmitted by the feature processing module, perform anomaly scoring to generate a threat report, calculate data distribution changes to generate a data drift index, transmit the threat report and data drift index to the model optimization module, and feed back the confidence index to the feature processing module. The model optimization module is configured to receive threat reports and data drift indices transmitted by the threat detection module. When the data drift index exceeds a threshold, the Bayesian optimizer is started. When the threat report marks a zero-day threat, the model distillation process is activated. When the data drift index does not exceed the threshold, the federated learning local update protocol is executed to generate neural network weight parameters and output them to the threat detection module to replace the original parameters. The feedback enhancement module is configured to receive alarm logs and safety labeling data transmitted from the power grid dispatching system, generate an adversarial sample input model optimization module training data stream, and generate a resampling instruction when the false alarm rate exceeds 15%, which is then transmitted to the data acquisition module.

2. The security threat model optimization system based on online self-learning according to claim 1, characterized in that, The data acquisition module includes: A phase-sensitive probe is directly connected to the power grid communication bus to capture protocol messages, converts the protocol messages into digital signal format, and transmits them to the first input port of the quantum noise filter. The voltage waveform acquisition unit acquires the original phase fluctuation signal through a sensor, converts the original phase fluctuation signal into a standard voltage range signal, and transmits it to the second input port of the quantum noise filter. The quantum noise filter receives protocol messages in digital signal format through the first input port and standard voltage range signals through the second input port. It performs electromagnetic interference cancellation processing on the two types of signals and outputs a noise-reduced signal in a unified format to the adaptive sliding window processor. The adaptive sliding window processor receives the denoised signal output from the quantum noise filter, dynamically determines the sampling window size by detecting network traffic peaks, performs normalization processing on the denoised signal, and outputs preprocessed data with millisecond-level timestamps to the feature processing module.

3. The security threat model optimization system based on online self-learning according to claim 2, characterized in that, The feature processing module is configured as follows: Upon receiving preprocessed data transmitted from the data acquisition module, the conventional feature extraction channel and the graph topology feature generation channel are simultaneously activated. The conventional feature extraction channel calculates the Wasserstein distance of data packets as a distribution feature, analyzes the periodicity of the session time series, and outputs a 128-dimensional statistical feature vector. The graph topology feature generation channel constructs a 32×32 adjacency matrix based on device communication relationships and outputs a 256-dimensional topology feature vector. The 128-dimensional statistical feature vector and the 256-dimensional topological feature vector are concatenated along the feature dimension to generate a 384-dimensional initial feature tensor. Receive the anomaly detection confidence index transmitted by the threat detection module. When the confidence index is greater than 0.85, use a 3-layer autoencoder to reduce the 384-dimensional feature tensor to 64-dimensional. When the confidence index is less than or equal to 0.85, the spectral clustering algorithm is used to select the top 50 key features from the 384-dimensional feature tensor. The reduced or selected feature tensors are converted into FP16 floating-point format and transmitted to the threat detection module via the DMA channel.

4. The security threat model optimization system based on online self-learning according to claim 3, characterized in that, Also includes: Every 60 seconds, the threat detection module sends a 128-dimensional feature importance vector via a message queue. The vector element values ​​range from [0,1]. The average value of the 65th to 128th dimensions of the feature importance vector is used as the topological feature weight ratio. When the ratio exceeds 0.7, the convolutional layer depth of the graph topological feature generation channel is increased from 3 to 5 layers. When the ratio is less than 0.3, the convolutional layer depth is reduced from 3 to 1 layer. The average value of the first 64 elements in the feature importance vector is used as the statistical feature weight ratio. When the ratio exceeds 0.6, the LSTM time step of the regular feature extraction channel is adjusted from 10 steps to 20 steps. When the ratio is less than 0.4, the time step is adjusted from 10 steps to 5 steps. The topological feature weight ratio and the statistical feature weight ratio are added together. When the sum is greater than 1.2, the confidence index threshold for dimensionality reduction of the autoencoder is increased from 0.85 to 0.

9. When the sum is less than 0.8, the threshold is decreased from 0.85 to 0.

8.

5. The security threat model optimization system based on online self-learning according to claim 4, characterized in that, The threat detection module is configured as follows: The feature tensor in FP16 format transmitted by the feature processing module is received, and when the anomaly score output by the isolated forest algorithm exceeds 0.95, it is marked as an anomaly data point. For each anomalous data point, extract its corresponding device communication path in the graph topology feature generation channel. The path includes the source device ID, the target device ID, and a timestamp triplet. The extracted communication paths are compared with 20 pre-stored APT behavior templates in the power attack knowledge base using dynamic time warping (DTW). Each template includes 5-10 typical attack steps. When the DTW similarity score of any template exceeds 0.8, a reconstruction instruction in JSON format is generated. The instruction includes a list of attack path nodes and a similarity score, and is sent to the feature processing module via a message queue. The trigger graph topology feature generation channel adds attack-related edges to the original 32×32 adjacency matrix based on the node list in the reconstruction instruction, and outputs the updated 256-dimensional topology feature vector to the feature processing channel.

6. The security threat model optimization system based on online self-learning according to claim 5, characterized in that, Also includes: Every 5 minutes, the threat detection module receives a data drift index and a threat report transmitted via the gRPC protocol. The data drift index has a value range of [0,2], and the threat report includes a threat type label and a confidence score. When the data drift index is greater than 1.2 and the system CPU utilization is less than 70%, the Bayesian optimizer is started to perform 50 rounds of hyperparameter search to generate the first type of update parameters, including learning rate, batch size and network depth. When a threat report is marked as a zero-day threat and memory usage exceeds 80%, the three-tier teacher and student model distillation process is activated to compress the original model parameters by 60% and generate the second type of updated parameters. When the data drift index is less than or equal to 1.2 and no zero-day threat is detected, the federated learning local update protocol is executed, only the fully connected layer parameters are updated, and the third type of update parameters are generated; After verifying the validity of the updated parameters through the version control mechanism, the new parameters are deployed to the threat detection module in an incremental update manner, while retaining backups of the first three versions of parameters.

7. The security threat model optimization system based on online self-learning according to claim 6, characterized in that, The feedback enhancement module is configured to receive alarm logs in JSON format and safety expert annotation data in XML format transmitted by the power grid dispatching system via a RESTful API. Regular expressions are used to parse the device ID, timestamp, and alarm type fields in the alarm log, and false alarm markers are associated with expert annotations. A knowledge graph including device nodes, false alarm edges, and region attributes is constructed in the Neo4j graph database. When the proportion of false alarm events associated with the same physical area code in the knowledge graph exceeds 15%, a Protobuf format instruction including the area code and the target sampling frequency is generated and transmitted to the data acquisition module through a message queue. A 500-dimensional adversarial sample vector is generated based on the contrastive learning algorithm framework. The sample includes perturbation amplitude parameters and is injected into the training data buffer queue of the model optimization module through the gRPC streaming interface.

8. The security threat model optimization system based on online self-learning according to claim 7, characterized in that, Also includes: Every 15 minutes, the threat detection module outputs all confidence scores from the threat report, with the confidence score range being [0,1]. Using the average F1-score of the most recent 24 hours as a benchmark, calculate the current F1-score attenuation rate: Attenuation rate = (benchmark value - current value) / benchmark value × 100%; When the decay rate exceeds 10%, a Protobuf format instruction including the model ID and urgency level is generated and transmitted to the model optimization module via the gRPC protocol; The model optimization module is triggered to interrupt the ongoing update process and start a full model retraining for 200 epochs. After training is completed, the new model parameters are deployed to the threat detection module.

9. The security threat model optimization system based on online self-learning according to claim 8, characterized in that, Also includes: When the Dynamic Time Warping (DTW) similarity score in the threat detection module is less than 0.3 and the threat type is not registered in the power attack knowledge base, it is judged as a new attack mode. Generate a Protobuf-formatted federated learning activation instruction that includes attack signature hash values ​​and urgency levels, and transmit it to the model optimization module via the gRPC protocol to trigger a multi-node parameter exchange protocol. High-frequency sampling instructions in Protobuf format with a target sampling rate of 20kHz are generated synchronously and transmitted to the data acquisition module via a message queue. The model optimization module receives high-frequency data collected by the data acquisition module in a 50ms window, performs local parameter updates every 5 seconds, and only updates the convolution kernel weight parameters; The updated parameters are encapsulated into an incremental model, identified by the version number, and deployed to the threat detection module to replace the corresponding convolutional kernel weights.

10. A security threat model optimization method based on online self-learning, applied to the security threat model optimization system based on online self-learning as described in any one of claims 1 to 9, characterized in that, include: Step 1: Acquire power system network traffic, equipment operation logs and voltage phase fluctuation signals in real time, perform noise cancellation and dynamic normalization processing, and output preprocessed data with time and frequency markers to Step 2; Step 2: Receive the preprocessed data transmitted in Step 1, run the regular feature extraction channel and the graph topology feature generation channel in parallel, receive the anomaly detection confidence index transmitted in Step 3, execute the autoencoder dimensionality reduction when the confidence index exceeds the threshold, and execute the spectral clustering algorithm to select key feature subsets when the confidence index does not exceed the threshold, and generate a compressed feature tensor to be transmitted to Step 3. Step 3: Receive the feature tensor transmitted in Step 2, perform anomaly scoring to generate a threat report, calculate data distribution changes to generate a data drift index, transmit the threat report and data drift index to Step 4, and feed back the confidence index to Step 2. Step 4: Receive the threat report and data drift index transmitted in Step 3. When the data drift index exceeds the threshold, start the Bayesian optimizer. When the threat report marks a zero-day threat, activate the model distillation process. When the data drift index does not exceed the threshold, execute the federated learning local update protocol to generate neural network weight parameters and output them to Step 3 to replace the original parameters. Step 5: Receive alarm logs and safety labeling data transmitted from the power grid dispatching system, generate adversarial examples to input the training data stream of Step 4, and generate a resampling instruction when the false alarm rate exceeds 15% and transmit it to Step 1.

Images