Anomaly behavior detection method and system for power information communication network

Abstract

The application relates to the technical field of electric power information communication, and discloses an abnormal behavior detection method and system for an electric power information communication network, which comprises the following steps: collecting traffic data and node connection information in real time, adopting a topological mapping algorithm to construct a network topological representation; analyzing data packet timestamps and source address features based on the representation to determine abnormal indexes; extracting relevant data packet sequences, simulating a propagation process through a path tracking algorithm to obtain a preliminary path; cross- verifying in combination with node position data to determine an abnormal initiation position; obtaining adjacent node logs according to the abnormal position and comparing data packet features to determine a propagation expansion direction; and tracking variation records of data packets in a dynamic network to obtain a complete propagation track. The application can realize accurate and complete abnormal behavior tracking and positioning through real-time topological modeling, multi-dimensional feature analysis, path simulation and cross-verification.

Description

Technical Field

[0001] This invention relates to the field of power information communication technology, and in particular to a method and system for detecting abnormal behavior in power information communication networks. Background Technology

[0002] The power information and communication network is the nerve center of modern power system operation, carrying core functions such as power dispatching, equipment monitoring, and data transmission. Its stability and security are directly related to the reliable operation of the power grid and the continuous stability of energy supply. With the rapid development of smart grids, the network scale and complexity have increased significantly, making the detection of abnormal behavior a critical link in ensuring power system security. Abnormal behavior may include unauthorized access, data tampering, or network attacks. If these behaviors are not detected and located in a timely manner, they may lead to power system malfunctions or even large-scale blackouts. Therefore, researching efficient methods for detecting abnormal behavior is not only crucial for the stable operation of the power system but also of great significance to socio-economic development and public safety.

[0003] Currently, methods for detecting abnormal behavior in power information and communication networks mainly rely on traffic monitoring and rule-based detection techniques. While these methods are effective against known attack patterns, they struggle to address increasingly complex and covert new network threats. Especially in dynamically changing network environments, existing methods are often limited to analyzing single nodes or localized networks, lacking the ability to comprehensively track the propagation path and origin of abnormal behavior throughout the entire network.

[0004] In anomaly detection, network topology analysis is a core technical challenge. The complex topology of power information and communication networks involves multiple layers of physical devices and logical connections, making it difficult to accurately pinpoint the origin of anomalies within intricate node relationships. For example, a malicious data packet may propagate through multiple paths in the network, and current technologies struggle to accurately identify its origin and propagation trajectory. More critically, the dynamic changes in network topology prevent detection systems from adapting in real time, leading to delayed or invalid location results. This dynamism further exacerbates the difficulty of data packet path tracing, as it requires real-time analysis of data flow within a complex network, combined with the actual physical network layout, to determine the geographical location of the anomaly. Therefore, accurately locating the origin and propagation path of anomalies in complex and dynamically changing power information and communication networks through network topology analysis and data packet path tracing has become a key issue in anomaly detection. Summary of the Invention

[0005] Therefore, the technical problem to be solved by the present invention is to overcome the problems of existing anomaly detection methods being unable to dynamically adapt to changes in network topology, inaccurate positioning, and incomplete path tracing. The present invention provides an anomaly behavior detection method and system for power information communication networks, which can achieve accurate and complete anomaly behavior tracking and positioning through real-time topology modeling, multi-dimensional feature analysis, path simulation, and cross-validation.

[0006] To address the aforementioned technical problems, this invention provides a method for detecting abnormal behavior in power information communication networks, comprising the following steps:

[0007] By collecting real-time traffic data and node connection information in the power information communication network, and using a topology mapping algorithm to process this data, a current network structure model is constructed to obtain a network topology representation.

[0008] Based on the network topology representation, obtain data packet transmission records and analyze their timestamp and source address characteristics to identify potential abnormal behavior indicators;

[0009] Relevant data packet sequences are extracted based on potential abnormal behavior indicators, and the propagation process is simulated using a path tracing algorithm to obtain the propagation path;

[0010] The obtained propagation path is used in conjunction with the node location data in the network topology representation for cross-validation to determine the location of the anomaly.

[0011] By determining the location where the anomaly originated, obtaining log information from adjacent nodes, and comparing data packet characteristics, the direction of propagation path expansion can be determined.

[0012] Based on the determined propagation path and direction, the variation records of data packets in the dynamically changing network are tracked to obtain the complete propagation trajectory.

[0013] In one embodiment of the present invention, by real-time acquisition of traffic data and node connection information in the power information communication network, and processing of this data using a topology mapping algorithm to construct a current network structure model, a network topology representation is obtained, including:

[0014] Traffic flow data and node connection information are obtained from the power information communication network, and the data is collected using real-time monitoring technology to obtain the raw traffic flow data and node connection status.

[0015] The data is processed using a topology mapping algorithm to obtain a network structure model;

[0016] Based on the network structure model, the traffic distribution and node distribution are analyzed, and a graph theory algorithm is used to generate a network topology representation.

[0017] The network topology representation is updated using real-time monitoring technology to obtain the latest network structure model.

[0018] In one embodiment of the present invention, based on a network topology representation, data packet transmission records are acquired and their timestamps and source address characteristics are analyzed to determine potential abnormal behavior indicators, including:

[0019] Based on the network topology representation, several core nodes with relatively high connectivity are selected, and complete data packet transmission records flowing through these core nodes are retrieved.

[0020] The retrieved data packet transmission records are parsed to extract the arrival timestamp and source address information of each data packet, and then categorized according to the source address.

[0021] For data packet sequences classified with the same source address, calculate the fluctuation of the arrival time interval of consecutive data packets and statistically analyze the frequency distribution of data packets sent to different target nodes.

[0022] Source addresses with time interval fluctuations exceeding the normal range and abnormal target node frequency distribution are marked as suspicious sources;

[0023] The behavioral data of all suspicious sources are aggregated and overlaid with the location information in the network topology representation to generate a set of potential abnormal behavior indicators.

[0024] In one embodiment of the present invention, relevant data packet sequences are extracted for potential abnormal behavior indicators, and the propagation process is simulated using a path tracing algorithm to obtain the propagation path, including:

[0025] Based on the potential abnormal behavior indicators, locate the associated source and destination address sets, and extract all data packet sequences corresponding to the address from historical and real-time traffic;

[0026] The extracted data packet sequences are sorted and aligned according to timestamps, and data packet groups with the same identifier field are identified and divided into independent communication events.

[0027] Based on the network topology representation, starting from the source address of the communication event and ending at the destination address, the forwarding selection of data packets at each hop between nodes is simulated, and all possible transmission paths are recorded.

[0028] Based on the frequency and time sequence of each path in the network appearing in the data packet sequence, the backbone path with the highest probability and possible alternative paths are selected.

[0029] By integrating the main and alternative paths of all communication events, a propagation path diagram of abnormal behavior from initiation to completion is drawn.

[0030] In one embodiment of the present invention, optimizing the propagation path based on the propagation path diagram using traffic monitoring data to determine a unique propagation path includes:

[0031] Accurate traffic monitoring data of the nodes and links involved in the propagation path diagram are obtained in real time from the mirror ports of the core switches and border routers in the network.

[0032] The traffic monitoring data is analyzed to accurately match the actual recorded data packet signatures and their forwarding port numbers within the expected transmission time window of each branch path in the propagation path diagram.

[0033] The actual outgoing port number of the data packet on each node is compared with the expected forwarding port number of each branch path in the propagation path diagram to eliminate alternative path branches that do not have actual traffic evidence to support them.

[0034] For path branches with actual traffic evidence, the logical continuity of the path is verified based on the inheritance and change patterns of their data packet signatures on the path.

[0035] Integrate all path nodes verified by traffic evidence to generate a unique propagation path that perfectly matches the real-time monitoring data.

[0036] In one embodiment of the present invention, the obtained propagation path is used in conjunction with node location data in the network topology representation for cross-validation to determine the location of the anomaly initiation, including:

[0037] Map the propagation path to the network topology representation, and verify one by one whether the connection relationship between adjacent nodes on the path is consistent with the physical connection or logical link recorded in the topology diagram;

[0038] For each hop in the path, check the logical rationality of its forwarding, including verifying whether the hop conforms to the network area division policy and whether it crosses an unauthorized security boundary;

[0039] Locate the first node in the path that has a logically illogical jump, and mark the last logical node before that node as a suspicious origin node;

[0040] Retrieve the device type, service function attributes, and hierarchical position information of the suspicious origin node for comprehensive analysis;

[0041] If the node has the ability to initiate data and its location and function match the characteristics of abnormal behavior, then the node is determined to be an abnormal initiation location.

[0042] In one embodiment of the present invention, by determining the obtained anomaly initiation location, acquiring log information of adjacent nodes and comparing data packet characteristics, the propagation path expansion direction is determined, including:

[0043] Taking the node at the location where the anomaly was initiated as the center, obtain the local connection logs and data packet cache summary information of all its directly connected first-level adjacent nodes during the anomaly period;

[0044] By comparing the data packet reception timestamp sequence recorded in the logs of each adjacent node with the timestamp sequence in the log of the node at the location of the anomaly, a node group with highly coordinated reception timing can be identified.

[0045] Extract the common feature code segment of the data packets received by the node group, and perform incremental comparison with the feature code of the data packets sent by the node at the location of the anomaly initiation to identify the feature inheritance and mutation pattern of the data packets during the propagation process.

[0046] Based on the continuity of feature inheritance and the regularity of variation, determine the actual propagation order of abnormal data streams between nodes.

[0047] Based on this sequence, starting from the node where the anomaly was initiated, the propagation path of the abnormal behavior downstream is reconstructed.

[0048] In one embodiment of the present invention, based on the determined propagation path expansion direction, the variation record of data packets in a dynamically changing network is tracked to obtain a complete propagation trajectory, including:

[0049] Along the propagation path, sequentially visit downstream nodes on the path and obtain their packet processing logs;

[0050] Compare the signatures of data packets forwarded and received between adjacent nodes, identify the jump points where the signatures change during transmission, and record the morphology of the mutated signatures.

[0051] The mutated signature is used as a new tracking identifier to initiate a breadth-first search in the network based on signature matching to find other nodes with data packets containing the same signature.

[0052] The newly discovered nodes are integrated with the original path to determine whether they are new branches or extensions of the path, and the propagation path structure is updated accordingly.

[0053] The process iteratively executes feature comparison, breadth-first search, and path update until no new feature code mutations or unknown nodes with the same feature code are found. Finally, it outputs a complete propagation trajectory map covering all branches and mutation history.

[0054] In one embodiment of the present invention, if the complete propagation trajectory includes geolocation data, then this data is fused with the network topology representation to obtain a precise location and path description of the abnormal behavior, including:

[0055] The device identifier of each node in the complete propagation trajectory is analyzed, and the geographical coordinates of the node are obtained by querying the preset device asset database.

[0056] The logical connection relationships in the network topology representation are overlaid and mapped with the obtained geographic location coordinates of the nodes to generate a fused network view that combines logical connections and geospatial information.

[0057] In the fused network view, the node sequence of the complete propagation trajectory is transformed into a geographic path line with latitude and longitude coordinates;

[0058] Calculate the total length of the geographical path, the number of inflection points, and the key power facility areas it passes through, and generate a quantitative description of the spatiotemporal range and physical impact area of ​​the anomalous behavior propagation;

[0059] The fused network view, geographic path lines, and quantitative descriptions are combined to output a precise location and path analysis report of the abnormal behavior.

[0060] To address the aforementioned technical problems, this invention also provides an abnormal behavior detection system for power information communication networks, used to implement the above method, comprising:

[0061] The data acquisition and topology construction module is used to collect traffic data and node connection information in the power information communication network in real time, process the data using a topology mapping algorithm to construct the current network structure model, and obtain the network topology representation.

[0062] The anomaly indicator analysis module is used to obtain data packet transmission records based on the network topology representation and analyze their timestamp and source address characteristics to determine potential abnormal behavior indicators.

[0063] The propagation path simulation module is used to extract relevant data packet sequences for the potential abnormal behavior indicators, and to simulate the propagation process through a path tracing algorithm to obtain a preliminary propagation path;

[0064] An anomaly location determination module is used to determine the location of the anomaly by cross-validating the obtained preliminary propagation path with the node location data in the network topology representation.

[0065] The path direction determination module is used to determine the propagation path expansion direction by judging the location of the anomaly, obtaining log information of adjacent nodes, and comparing data packet characteristics.

[0066] The trajectory tracing generation module is used to track the variation records of data packets in a dynamically changing network based on the determined propagation path and direction, and obtain the complete propagation trajectory.

[0067] The technical solution of the present invention has the following advantages compared with the prior art:

[0068] This invention discloses an abnormal behavior detection method for power information communication networks. Through dynamic topology modeling, multi-dimensional data analysis, simulation verification, and localized refined tracing, it solves the problems of poor topology adaptation, inaccurate localization, and incomplete path tracing in existing technologies. The beneficial effects include: improved accuracy and real-time performance of anomaly detection, as dynamic modeling and cross-validation reduce the impact of environmental changes; enhanced tracing completeness, thanks to path simulation and mutation record analysis; and good scalability, enabling it to adapt to large-scale network environments without relying on large amounts of historical data or complex models, thereby reducing computational costs and improving reliability in practical applications. Attached Figure Description

[0069] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein:

[0070] Figure 1 This is a flowchart of the abnormal behavior detection method for power information communication networks according to the present invention;

[0071] Figure 2 This is a flowchart illustrating the steps of constructing a network topology representation according to the present invention;

[0072] Figure 3 This is a flowchart of the steps for determining abnormal indicators in this invention;

[0073] Figure 4 This is a flowchart of the steps for obtaining the propagation path diagram according to the present invention;

[0074] Figure 5 This is a flowchart of the steps in this invention to determine a unique propagation path;

[0075] Figure 6 This is a flowchart of the cross-validation steps of the present invention;

[0076] Figure 7 This is a flowchart of the steps in this invention to determine the propagation path and direction;

[0077] Figure 8 This is a flowchart illustrating the steps involved in obtaining the complete propagation trajectory according to the present invention;

[0078] Figure 9 This is a flowchart of the steps to obtain the precise location and path description of abnormal behavior;

[0079] Figure 10 This is a structural framework diagram of the abnormal behavior detection system for the power information communication network of the present invention. Detailed Implementation

[0080] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0081] Reference Figure 1 As shown, this invention provides a method for detecting abnormal behavior in a power information communication network. Its technical solution, through the synergistic effect of multiple steps, fundamentally overcomes the limitations of existing technologies. The method includes the following steps:

[0082] First, by collecting real-time traffic data and node connection information in the power information communication network, a topology mapping algorithm is used to process this data to construct the current network structure model and obtain the network topology representation. In the specific implementation process, raw traffic data (such as packet size, frequency, and protocol type) and connection status information between nodes are continuously captured in the network. This massive and dynamically changing raw data is fed into the topology mapping algorithm for processing. This algorithm can parse the real-time connection relationship between nodes, abstract and construct a digital current network structure model, i.e., the network topology representation.

[0083] This method collects traffic data and node connection information in real time and uses a topology mapping algorithm to construct the current network structure model. This ensures the accuracy and timeliness of the network topology representation, and can dynamically adapt to network changes, laying the foundation for subsequent analysis.

[0084] Secondly, based on the network topology representation, data packet transmission records are obtained and their timestamps and source address characteristics are analyzed to identify potential abnormal behavior indicators. Based on the network topology representation, the associated data packet transmission records are retrieved. Instead of viewing each data packet in isolation, it is analyzed within the context of the entire network structure. By focusing on the timestamp sequence of the data packets (e.g., whether they appear explosively in a very short period of time) and source address characteristics (e.g., whether they come from unconventional or unauthorized nodes), some potential abnormal behavior indicators that deviate from the normal pattern can be preliminarily screened and identified. This completes the transformation from "comprehensive monitoring" to "focused suspicion".

[0085] By analyzing the timestamps and source address characteristics of data packets to determine potential indicators of abnormal behavior, this step combines time and address dimensions, improving the comprehensiveness of anomaly identification and avoiding the shortcomings of single feature analysis.

[0086] Next, relevant data packet sequences are extracted for potential abnormal behavior indicators. The propagation process is simulated using a path tracing algorithm to obtain the propagation path. After identifying suspicious indicators, all data packet sequences related to these indicators are precisely extracted. Subsequently, the path tracing algorithm begins to work: using the network topology as a map and abnormal data packets as clues, the algorithm simulates the possible propagation paths and jump processes of these data packets between network nodes, thereby deriving a preliminary propagation path hypothesis.

[0087] By using path tracing algorithms to simulate the propagation process and obtain preliminary propagation paths, the method can predict the dynamic development of anomalous behavior from a theoretical perspective, rather than relying solely on static data.

[0088] Then, the obtained propagation path is used in conjunction with the node location data in the network topology representation for cross-validation to determine the location of the anomaly. The preliminary simulated path may contain errors, so a cross-validation process is initiated: it compares and verifies the preliminary propagation path obtained by simulation with the precise node geographical locations, logical levels and other static data in the network topology representation. By verifying whether this simulated path is smooth and logical in the real network structure, the true location of the abnormal behavior can be determined with a very high degree of confidence, realizing the leap from "possible" to "certain".

[0089] By cross-validating the initial propagation path with node location data in the network topology, the location of the anomaly can be determined. This cross-validation mechanism enhances the reliability of the location and reduces misjudgments caused by network dynamics.

[0090] Subsequently, by determining the location of the anomaly, log information of adjacent nodes is obtained and data packet characteristics are compared to determine the direction of propagation. After accurately locating the node that initiated the anomaly, the tracking scope is further focused, and detailed log information of the node and all its adjacent nodes is automatically obtained. The specific characteristics of the data packets flowing through these nodes (such as payload content and specific identifiers) are compared in depth. Through this refined feature comparison, it is possible to clearly determine which adjacent node the abnormal data packet originated from and in which direction it may continue to spread, thereby accurately determining the direction of propagation.

[0091] By obtaining log information of adjacent nodes based on abnormal locations and comparing data packet characteristics, the direction of propagation path expansion can be determined. This utilizes local data to refine the tracking and improves the accuracy of path analysis.

[0092] Finally, based on the determined propagation path and direction, the mutation records of the data packets in the dynamically changing network are tracked to obtain the complete propagation trajectory. Along this determined direction, the subsequent transmission records of the abnormal data packets are continuously tracked in the dynamically changing network environment, recording any mutations that may occur in the data packets during propagation (such as content tampering or repackaging). All these scattered trajectory fragments are then linked together to finally depict a complete propagation trajectory from the origin to the final target, covering all intermediate links.

[0093] By tracking the mutation records of data packets in a dynamic network, a complete propagation trajectory can be obtained, thereby enabling monitoring of the entire lifecycle of abnormal behavior.

[0094] Throughout the implementation process, firstly, by constructing and consistently using a real-time network topology model, the entire analysis process is always based on the latest network state, resolving the issue of analysis model failure caused by dynamic network changes and greatly improving the adaptability and accuracy of detection. Secondly, through multi-level, closed-loop verification from macro-topology analysis to micro-data packet feature comparison (such as cross-verification of simulated paths and topology data, and feature comparison of adjacent node logs), the one-sidedness of single data source analysis is effectively avoided, significantly reducing false positives and false negatives, making the results of anomaly localization and path tracing extremely reliable. Finally, the entire solution intelligently reproduces the complete lifecycle of abnormal behavior through a logic of simulation followed by verification, and from point to surface and then concatenation, ultimately achieving a complete and clear characterization of the propagation path, providing network security administrators with unprecedented insights, enabling them to respond quickly and accurately handle security threats.

[0095] In actual implementation, the integrity and real-time nature of data acquisition are difficult to guarantee. Raw network data is usually complex and contains noise, making direct processing inefficient and easily affecting the accuracy of the model. Furthermore, the power information and communication network is a dynamic system with an unchanging topology. If the initially constructed model cannot be continuously updated, it will quickly become invalid and fail to reflect the true state of the network, thus directly affecting the accuracy of subsequent abnormal behavior detection steps.

[0096] To solve the above problems, refer to Figure 2 As shown, the present invention further discloses a method for collecting data and constructing a network topology representation, including: firstly, clarifying the source and method of data acquisition, obtaining traffic data and node connection information from the power information communication network, and using real-time monitoring technology to collect the data. This step ensures the comprehensiveness of the data source and the timeliness of the collection, providing a high-quality data foundation for the entire model construction. Its technical effect is to ensure the authenticity and immediacy of the input information from the source, which is a prerequisite for constructing an accurate network model.

[0097] Next, it is pointed out that a topology mapping algorithm should be used to process the data to obtain a network structure model. The collected raw data is transformed into a preliminary structured model, and network elements (nodes, connections) and their basic relationships are extracted from the messy data. The technical effect is that it realizes the first transformation from data to model, creating conditions for deeper topology analysis.

[0098] Then, based on the network structure model, the traffic distribution and node distribution are analyzed, and a network topology representation is generated using graph theory algorithms. This step not only identifies which nodes and connections exist in the network, but also, by analyzing the importance (distribution) of nodes and the load (traffic distribution) on connections, uses graph theory principles to endow the network structure with dynamic and quantifiable attributes, thereby generating a weighted or directed "network topology representation" rich in more information. The technical effect is that the generated topology graph is no longer a static skeleton diagram, but a dynamic model that reflects the real-time operating status and inherent characteristics of the network. This provides a more accurate and reliable basis for subsequent abnormal behavior indicator judgment and propagation path analysis.

[0099] Finally, updating the network topology representation through real-time monitoring to obtain the latest network structure model completes a closed loop. This ensures that the entire model is not a one-time generation, but a living entity that can continuously iterate and evolve along with changes in network state. Its technical advantage lies in effectively overcoming the model aging problem caused by network dynamism, ensuring that any anomaly detection and analysis based on this model at any given time is based on the latest network conditions, greatly improving the reliability and practicality of the entire method in real-world application environments.

[0100] In actual implementation, the number of data packet transmission records in the power information communication network is enormous. If all data in the entire network is analyzed indiscriminately, it will result in huge consumption of computing resources, low processing efficiency, and the accuracy of anomaly identification will be easily affected by noise data interference.

[0101] To solve this problem, refer to Figure 3 As shown, this invention further discloses a method for analyzing data packet characteristics and determining anomaly indicators, including: intelligent filtering of core nodes based on network topology representation. Network topology representation reflects the connection relationship of nodes. Nodes with high connectivity are often key hubs in the network, and most data flows will pass through these nodes. By filtering out these core nodes and retrieving their data packet transmission records, it is equivalent to grasping the main contradictions in network traffic, avoiding the redundancy and inefficiency caused by collecting data from a massive number of nodes across the entire network, thereby achieving dimensionality reduction at the data source and laying an efficient foundation for subsequent analysis.

[0102] Next, the acquired data packet records are parsed to extract timestamps and source address information and categorize them according to the source address. This step is a structured processing of the raw data, which transforms the chaotic raw data stream into an organization format indexed by the source address, so that the communication behavior of each source address can be observed and analyzed independently, thus preparing for subsequent quantification of behavioral characteristics.

[0103] Then, for each source address's data packet sequence, behavioral characteristics are quantified from both time and space dimensions. In the time dimension, the fluctuation of the arrival time interval of consecutive data packets is calculated, which can identify abnormal patterns such as periodic scanning and burst traffic. In the spatial dimension, the frequency distribution of data packets sent to different target nodes is statistically analyzed, which can detect abnormal behaviors such as port scanning and distributed probing. This two-dimensional analysis mechanism overcomes the limitations of single feature analysis and can capture potential abnormal patterns more comprehensively.

[0104] Based on the above quantitative characteristics, a clear judgment rule was set: source addresses with time interval fluctuations exceeding the normal range and abnormal target node frequency distributions were marked as suspicious sources. This rule requires that the abnormal conditions in both time and space dimensions be met simultaneously, which greatly reduces the false alarm rate caused by normal network fluctuations and improves the accuracy of anomaly identification.

[0105] Finally, the behavioral data of all suspicious sources are aggregated and overlaid with location information in the network topology. This step ensures that the generated set of potential anomalous behavior indicators not only includes behavioral feature data but also incorporates spatial context information. For example, a source address located at the network edge node exhibiting an anomalous access pattern to multiple core nodes has a much higher risk level than a similar communication pattern between two core nodes. This introduction of spatial context makes anomaly assessment more accurate, providing higher-quality input for subsequent path tracing and location analysis.

[0106] Through the aforementioned progressive operations, not only were potential efficiency and accuracy issues resolved, but also the reliability and practicality of abnormal behavior detection were significantly improved through multi-dimensional feature analysis, composite judgment rules, and spatial context association.

[0107] In actual implementation, a core issue is how to accurately reconstruct the hidden and complex propagation trajectory of abnormal behavior from massive, disordered and potentially incomplete network traffic data. Simply extracting data packets and running algorithms may lead to distorted simulation results due to data quality, network dynamics and path ambiguity, and cannot provide reliable and operational input for subsequent cross-validation steps.

[0108] To solve this problem, refer to Figure 4As shown, this invention further discloses a method for simulating the propagation process and obtaining the propagation path, including: precise data location and extraction based on explicit indicators (potential abnormal behavior indicators) generated upstream. This step ensures a high degree of relevance to the analysis target and avoids the huge computational load brought about by full-traffic analysis. Next, by sorting the extracted data packet sequences by timestamp and grouping them according to the identifier field, the chaotic original data is successfully reconstructed into clear, independent communication events. This step lays a solid logical foundation for subsequent analysis. Its technical effect lies in effectively overcoming the interference caused by data disorder and incompleteness, and revealing the hidden communication logic through data reconstruction.

[0109] After the communication event is clearly defined, the theoretical deduction phase begins. Based on the constructed network topology representation, this phase simulates each hop of the data packet forwarding from source to destination, enumerating all theoretically possible transmission paths. This step fully utilizes the value of the network topology model, enabling a structured deduction of the propagation process. However, purely theoretical simulations may not match reality. Therefore, actual observation data is further introduced. Based on the frequency and temporal relationship of each path in historical data packet sequences, theoretical paths are probabilistically filtered to identify the backbone path and alternative paths. The technical effect of this step lies in its ingenious integration of theoretical simulation and empirical data. Through a "simulation-verification" mechanism, it significantly improves the confidence of path inference and effectively mitigates path uncertainty caused by dynamic changes in routing or load balancing.

[0110] Finally, the path analysis results of all communication events are integrated and plotted to generate a complete propagation path diagram. Through this series of meticulous process designs, the final technical effect achieved is to produce a high-quality propagation path analysis result that not only contains the path sequence but also includes path probability weights and spatiotemporal correlations, and can be directly used by subsequent steps, thus laying a reliable foundation for the success of the entire abnormal behavior detection method.

[0111] Specifically, a preliminary propagation path map containing the main path and alternative paths was generated through path simulation and probability filtering. While this method can effectively reconstruct the possible propagation trajectories of abnormal behavior, it is essentially still a model based on theoretical deduction and statistical inference. A core problem exists: due to complex factors in the network environment such as load balancing, redundant routing, or asynchronous logging, relying solely on topology simulation and frequency statistics cannot completely eliminate path ambiguity. This may result in multiple branch paths still existing in the final generated path map, making it impossible to accurately locate the unique and true propagation path. This uncertainty directly affects the accuracy of subsequent anomaly initiation location determination and propagation tracing.

[0112] To resolve the aforementioned path ambiguity issue, refer to Figure 5As shown, this application further provides a path optimization mechanism based on real-time traffic monitoring data. This mechanism eliminates false branches and determines a unique propagation path through empirical data verification. This includes: precise data collection from the physical nodes involved in the preliminary path map; and obtaining real-time traffic monitoring data from the mirror ports of core switches and border routers, ensuring the reliability and integrity of the data source and providing a high-quality data foundation for subsequent verification. The technical advantage of this step lies in its ability to transcend theoretical deduction and directly capture evidence of real data packet flow from the underlying network infrastructure, thus providing objective evidence for path verification.

[0113] After acquiring the raw traffic data, it undergoes deep analysis to extract key verification features. By precisely matching the packet signatures and forwarding port numbers within the time windows corresponding to each branch path in the initial path diagram, the system transforms the abstract logical path into a concrete and verifiable set of data features. The key technology of this analysis process lies in the coordinated matching of time windows and signatures, which ensures the time consistency and packet uniqueness of subsequent comparison operations, avoiding false verifications caused by time deviations or packet confusion.

[0114] Subsequently, the outgoing port number of the data packets actually monitored on each network node is compared with the expected forwarding port number of each branch path in the preliminary path diagram. This step directly verifies the authenticity of the path branches through hardware-level forwarding evidence, effectively identifying and eliminating false path branches that exist in theoretical simulations but lack actual traffic evidence. Its technical advantage lies in using the forwarding behavior of the network devices themselves as a verification standard. This verification method based on underlying hardware behavior is more reliable and accurate than methods based on software logs or statistical inference.

[0115] For path branches that pass port verification, further deep verification is implemented: the logical continuity of the path is examined based on the inheritance and change patterns of data packet signatures during path propagation. This step ensures that the preserved path is not only physically connected but also conforms to the basic laws of network communication in terms of logical transmission behavior by analyzing the evolution patterns of data packet signatures during transmission (such as protocol header updates, checksum changes, etc.). This dual verification mechanism greatly improves the reliability of path verification, and its technical effect lies in ensuring the accuracy of path verification from both the physical and logical layers.

[0116] Ultimately, by integrating all empirically verified path nodes, a unique propagation path is generated that perfectly matches the real-time monitoring data. The technical advantage of this generation process lies in its complete resolution of existing path ambiguity, transforming probabilistic path speculation into definitive path verification, thus providing a solid and reliable foundation for subsequent anomaly localization and propagation tracing. This optimization mechanism based on real-time traffic monitoring not only improves the accuracy of path tracing but also enhances the reliability and practicality of the entire anomaly detection system.

[0117] In the process of detecting abnormal behavior in power information and communication networks, a key issue may be encountered in actual implementation: the propagation path initially obtained is essentially a probabilistic inference based on data packet characteristics and network simulation. It may contain simulation errors or path branches that do not fully conform to the actual network policy constraints. If the source of the anomaly is determined directly based on such a path, it may lead to positioning errors or misjudgments.

[0118] To solve this problem, refer to Figure 6 As shown, this application further provides a method for cross-validation to determine abnormal locations, including mapping and verifying the propagation path with the network topology representation. This step first compares the connection relationships between adjacent nodes in the path one by one with whether they are consistent with the physical or logical links recorded in the topology diagram. Its technical effect is to filter out false connections caused by the limitations of simulation algorithms at the basic connectivity level, ensuring that subsequent analysis is based on real network paths, and laying a reliable data foundation for accurate location.

[0119] After confirming path connectivity, the process delves deeper into the logical rationality review stage. For each hop in the path, it verifies whether it conforms to the established network area division strategy and whether it crosses unauthorized security boundaries. This step elevates the technical verification from a simple "whether connectivity is possible" to a policy-level "whether connectivity is allowed." Its mechanism lies in introducing an external knowledge base—network management policies—for constraint judgments, thereby identifying abnormal hop behaviors that, while physically reachable, violate security rules and revealing hidden policy anomalies within the path.

[0120] Based on the above review results, a backtracking positioning strategy was adopted to accurately identify the first node in the path with a logically illogical jump, and the preceding reasonable node was marked as a suspicious origin node. The technical effect of this step is that it achieves preliminary source tracing of the anomaly. It cleverly utilizes the reasoning logic that the preceding node of the "first anomaly point" is very likely to be the origin of the anomaly, thereby converging the investigation scope from the entire path to specific suspicious nodes, greatly improving the positioning efficiency.

[0121] Subsequently, instead of making a final judgment immediately, the multi-dimensional attribute information of the suspicious node (including device type, service function, and its hierarchical position in the network topology) is retrieved for comprehensive analysis. The technical advantage of this step is that by introducing device function and network context information, a multi-dimensional decision-making model is constructed. Its mechanism is to avoid the risk of misjudgment that may be caused by a single piece of evidence (for example, a pure forwarding node is unlikely to be the source of the data), making the judgment process more comprehensive and robust.

[0122] Ultimately, a node is only identified as an abnormal initiation location if it simultaneously meets both of the necessary conditions: "possessing the ability to initiate data" and "its location and function conforming to abnormal behavior characteristics." The technical effect of this final step is to achieve high-confidence location output. Its mechanism lies in setting dual verification conditions to ensure that the judgment result conforms to both the objective capabilities of the network object and the behavioral patterns of abnormal behavior, thereby significantly improving the accuracy and reliability of the location results and providing a credible basis for subsequent precise handling.

[0123] In the detection of abnormal behavior in power information and communication networks, although the aforementioned steps can locate the origin of the anomaly, a key problem remains: how to accurately determine the direction of the anomaly's spread after its origin. The source node of the anomaly is often connected to multiple adjacent nodes. If the actual propagation path cannot be accurately identified from these connections, the tracing chain will be broken. Existing simple traffic analysis struggles to distinguish whether a data packet is forwarded through the node or merely stops at its destination, easily leading to misjudgments of the path's expansion direction, thus making it impossible to construct a complete attack chain or fault propagation model.

[0124] Therefore, referring to Figure 7 As shown, this invention further provides a refined process based on temporal collaboration and feature evolution to solve the above-mentioned problems, including: firstly, taking the precisely located anomaly initiation node as the center, intelligently acquiring only the local logs and data packet cache summaries of its directly connected first-level adjacent nodes during the anomaly time period. This step limits the analysis scope from both spatial and temporal dimensions, avoiding the processing pressure caused by the flood of data across the entire network, and ensuring the efficiency and targeting of subsequent operations. Its technical effect lies in focusing on the most likely relevant evidence from massive amounts of data.

[0125] Next, the multi-node behavior correlation analysis phase begins. By comparing the data packet reception timestamp sequences in the logs of adjacent nodes and aligning them with the sending timestamps of the node initiating the anomaly, it is possible to identify node groups whose reception behaviors exhibit high temporal coordination. This step leverages the temporal correlation characteristics typically present in anomaly propagation to filter out a suspicious set of nodes with synchronized behavior from among numerous adjacent nodes. The underlying mechanism is that genuine anomaly flows leave traces with temporal logical correlations between adjacent nodes, thus establishing target objects for the next step of in-depth comparison.

[0126] After identifying a suspicious node group, further verification is performed at the internal feature level of the data packets. Common feature segments of the data packets received by this node group are extracted and incrementally compared with the feature codes of the data packets sent by the source node. This process can accurately identify whether data packets remain unchanged during propagation (feature inheritance) or undergo regular changes (feature variation patterns). For example, regular changes in certain protocol header fields or payload content. This step provides internal evidence of data origin, enabling the system to go beyond surface information such as IP addresses and confirm propagation relationships at the core of the data packets. This is crucial for avoiding false positives.

[0127] Based on the above feature comparison conclusions, and according to the coherence of feature inheritance and the regularity of variation, the actual propagation order of abnormal data streams among nodes is logically determined. For example, the order of nodes whose feature codes evolve according to specific rules is logically inferable. This step transforms feature evidence into a propagation timeline, and its technical effect is to establish a propagation sequence chain with strong anti-interference capabilities based on the inherent evolutionary logic of data, effectively overcoming the unreliability of simply sorting based on timestamps due to network latency or clock asynchrony.

[0128] Ultimately, based on this sequence of multiple verifications, the propagation path of the abnormal behavior downstream can be clearly reconstructed, starting from the node where the anomaly originated. The entire implementation process is interconnected: from scope limitation to temporal filtering, and then to feature depth verification and logical sorting, each step provides more precise input for the next step, ultimately expanding a single anomaly source into a clear propagation path.

[0129] In actual implementation, when data packets undergo characteristic changes during transmission (such as protocol conversion, data fragmentation, or malicious obfuscation), the original tracing clues will be interrupted, causing the propagation path to be unable to continue. Ultimately, only partial fragments can be obtained instead of a complete trajectory. In addition, the dynamically changing network environment may cause the path to branch or detour, further increasing the complexity of tracing.

[0130] To solve this problem, refer to Figure 8As shown, this application further provides an adaptive, iterative tracing technology solution, including: sequentially accessing downstream nodes along the known propagation path and obtaining their packet processing logs. This step ensures the targeting and efficiency of tracing, avoiding blind searching across the entire network. Subsequently, by comparing the signature codes of forwarded and received packets between adjacent nodes, the jump points where signature codes change can be accurately identified, and the morphology of the mutated signature codes can be recorded. This mechanism enables tracing to no longer rely on fixed features, but to dynamically capture the evolutionary behavior of data packets, thereby overcoming the problem of clue interruption caused by drastic feature changes.

[0131] Then, the mutated signature is used as the new tracking identifier, and a breadth-first search based on signature matching is initiated in the network. This means that the tracking strategy has shifted from a linear depth-first approach to a hybrid mode combining depth and breadth: on the one hand, it advances along the main path in depth, and on the other hand, it captures possible branch paths caused by mutation through breadth-first search, ensuring that no diffusion direction is missed. When a new node with a data packet of the same signature is found, it is integrated with the original path, and it is intelligently determined whether it is a new branch or path extension, thereby dynamically updating the propagation path structure. This integration capability allows the trajectory model to expand from a single path to a tree-like or network structure, more realistically reflecting the complex propagation situation of abnormal behavior.

[0132] Ultimately, through iterative execution of feature comparison, breadth-first search, and path update processes, the system can continuously adapt to multiple mutations in packet characteristics and dynamic changes in network topology until no new mutations or nodes are found. This iterative termination mechanism ensures the completeness of the tracing, outputting a complete propagation trajectory map covering all branches and mutation history. This map not only includes node connectivity relationships but also records the mutation history of data packets, thus providing valuable contextual information for security analysis.

[0133] From a technical perspective, the solution addresses the issue of interrupted tracking clues through a dynamic feature adaptation mechanism (using mutated feature codes as new identifiers), ensures the integrity of path coverage through a hybrid search strategy (combining sequential access with breadth-based search), and achieves adaptation to network dynamics and behavioral complexity through iterative path reconstruction. The entire solution is based on data-driven principles: logs provide raw data, feature comparison detects changes, breadth-based search expands the scope, path integration ensures structural correctness, and iterative execution guarantees final completeness. Thus, it achieves highly reliable tracking of abnormal behavior throughout its entire lifecycle.

[0134] Reference Figure 9As shown, based on the above embodiments, this application further provides a technical solution for deep integration of network topology and geographic information, including: parsing the device identifier of each node in the complete propagation trajectory, and mapping the abstract node identifier to specific geographic location coordinates by querying a pre-set device asset database. This step establishes a key bridge between virtual network entities and real-world locations, laying a data foundation for subsequent spatial analysis. Its technical effect is to realize the spatial positioning of network elements, enabling each logical node to obtain the spatial attribute of latitude and longitude coordinates.

[0135] Based on the obtained node coordinates, the logical connections in the network topology representation are overlaid and mapped with geographical coordinates to generate a fused network view. This step is no longer a simple data parallelism, but achieves semantic fusion between the logical and physical layers—each connection in the topology map represents both a data link and an actual path in geographic space. Its technical effect lies in constructing a unified spatiotemporal analysis framework, enabling network behavior to be visualized and interpreted within a geographical context, greatly enhancing the intuitiveness of situational awareness.

[0136] Next, supported by the fused view, the node sequence of the propagation trajectory is transformed into a geographic path line with latitude and longitude coordinates. This transformation operation essentially connects discrete network events into a continuous spatial motion trajectory. The technical effect is to concretize the abstract "propagation path" into a measurable and analyzable geographic entity, providing an object for spatial quantitative analysis.

[0137] Based on the generated geographical path, its total length, number of inflection points, and key power facility areas it passes through are further calculated. The total length reflects the spatial span of the anomaly propagation, the number of inflection points indicates the complexity of the path, and identifying the key facilities it passes through directly reveals potential security risk points. The technical effect of this step is to achieve a semantic transformation from geometric features to security threats, and to objectively assess the physical impact range and destructive potential of the anomalous behavior through spatial metrological indicators.

[0138] Ultimately, the network view, geographic path lines, and quantitative descriptions are integrated and output as an analysis report. This is not simply a compilation of information, but rather the formation of a multi-layered output system from basic data (view), spatial representation (path), to decision support (quantitative description). Its technical effect lies in providing security personnel with decision support that combines technical details with geospatial intelligence, achieving a closed loop from cyberspace cognition to physical world action. This enables operations teams not only to know "how anomalies propagate," but also to accurately determine "where to handle them."

[0139] To implement the above method, refer to Figure 10 As shown, this application also provides an abnormal behavior detection system for power information communication networks, including:

[0140] The data acquisition and topology construction module is used to collect traffic data and node connection information in the power information communication network in real time, process the data using a topology mapping algorithm to construct the current network structure model, and obtain the network topology representation.

[0141] The anomaly indicator analysis module is used to obtain data packet transmission records based on the network topology representation and analyze their timestamp and source address characteristics to determine potential abnormal behavior indicators.

[0142] The propagation path simulation module is used to extract relevant data packet sequences for the potential abnormal behavior indicators, and to simulate the propagation process through a path tracing algorithm to obtain a preliminary propagation path;

[0143] An anomaly location determination module is used to determine the location of the anomaly by cross-validating the obtained preliminary propagation path with the node location data in the network topology representation.

[0144] The path direction determination module is used to determine the propagation path expansion direction by judging the location of the anomaly, obtaining log information of adjacent nodes, and comparing data packet characteristics.

[0145] The trajectory tracing generation module is used to track the variation records of data packets in a dynamically changing network based on the determined propagation path and direction, and obtain the complete propagation trajectory.

[0146] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for detecting abnormal behavior in a power information communication network, characterized in that, Includes the following steps: By collecting real-time traffic data and node connection information in the power information communication network, and using a topology mapping algorithm to process this data, a current network structure model is constructed to obtain a network topology representation. Based on the network topology representation, data packet transmission records are acquired and their timestamps and source address characteristics are analyzed to determine potential abnormal behavior indicators. This includes: based on the network topology representation, selecting several core nodes with relatively high connectivity and retrieving complete data packet transmission records flowing through these core nodes; parsing the retrieved data packet transmission records, extracting the arrival timestamp and source address information of each data packet, and classifying them according to the source address; for data packet sequences classified by the same source address, calculating the fluctuation of the arrival time interval of consecutive data packets, and statistically analyzing the frequency distribution of data packets sent to different target nodes; marking source addresses with time interval fluctuations exceeding the normal range and abnormal target node frequency distributions as suspicious sources; aggregating the behavioral data of all suspicious sources and overlaying them with the location information in the network topology representation to generate a set of potential abnormal behavior indicators. Relevant data packet sequences are extracted based on potential abnormal behavior indicators, and the propagation process is simulated using a path tracing algorithm to obtain the propagation path; The obtained propagation path is used in conjunction with the node location data in the network topology representation for cross-validation to determine the location of the anomaly. By determining the location where the anomaly originated, obtaining log information from adjacent nodes, and comparing data packet characteristics, the direction of propagation path expansion can be determined. Based on the determined propagation path and direction, the variation records of data packets in the dynamically changing network are tracked to obtain the complete propagation trajectory.

2. The abnormal behavior detection method for power information communication networks according to claim 1, characterized in that: By collecting real-time traffic data and node connection information from the power information communication network, and processing this data using a topology mapping algorithm to construct a current network structure model, a network topology representation is obtained, including: Traffic flow data and node connection information are obtained from the power information communication network, and the data is collected using real-time monitoring technology to obtain the raw traffic flow data and node connection status. The data is processed using a topology mapping algorithm to obtain a network structure model; Based on the network structure model, the traffic distribution and node distribution are analyzed, and a graph theory algorithm is used to generate a network topology representation. The network topology representation is updated using real-time monitoring technology to obtain the latest network structure model.

3. The abnormal behavior detection method for power information communication networks according to claim 1, characterized in that: Relevant data packet sequences are extracted based on potential abnormal behavior indicators. The propagation process is simulated using a path tracing algorithm to obtain the propagation path, including: Based on the potential abnormal behavior indicators, locate the associated source and destination address sets, and extract all data packet sequences corresponding to the address from historical and real-time traffic; The extracted data packet sequences are sorted and aligned according to timestamps, and data packet groups with the same identifier field are identified and divided into independent communication events. Based on the network topology representation, starting from the source address of the communication event and ending at the destination address, the forwarding selection of data packets at each hop between nodes is simulated, and all possible transmission paths are recorded. Based on the frequency and time sequence of each path in the network appearing in the data packet sequence, the backbone path with the highest probability and possible alternative paths are selected. By integrating the main and alternative paths of all communication events, a propagation path diagram of abnormal behavior from initiation to completion is drawn.

4. The abnormal behavior detection method for power information communication networks according to claim 3, characterized in that: Based on the propagation path diagram, the propagation path is optimized using traffic monitoring data to determine a unique propagation path, including: Accurate traffic monitoring data of the nodes and links involved in the propagation path diagram are obtained in real time from the mirror ports of the core switches and border routers in the network. The traffic monitoring data is analyzed to accurately match the actual recorded data packet signatures and their forwarding port numbers within the expected transmission time window of each branch path in the propagation path diagram. The actual outgoing port number of the data packet on each node is compared with the expected forwarding port number of each branch path in the propagation path diagram to eliminate alternative path branches that do not have actual traffic evidence to support them. For path branches with actual traffic evidence, the logical continuity of the path is verified based on the inheritance and change patterns of their data packet signatures on the path. Integrate all path nodes verified by traffic evidence to generate a unique propagation path that perfectly matches the real-time monitoring data.

5. The abnormal behavior detection method for power information communication networks according to claim 1, characterized in that: By using the obtained propagation path and cross-validating it with node location data in the network topology representation, the location of the anomaly can be determined, including: Map the propagation path to the network topology representation, and verify one by one whether the connection relationship between adjacent nodes on the path is consistent with the physical connection or logical link recorded in the topology diagram; For each hop in the path, check the logical rationality of its forwarding, including verifying whether the hop conforms to the network area division policy and whether it crosses an unauthorized security boundary; Locate the first node in the path that has a logically illogical jump, and mark the last logical node before that node as a suspicious origin node; Retrieve the device type, service function attributes, and hierarchical position information of the suspicious origin node for comprehensive analysis; If the node has the ability to initiate data and its location and function match the characteristics of abnormal behavior, then the node is determined to be an abnormal initiation location.

6. The abnormal behavior detection method for power information communication networks according to claim 1, characterized in that: By determining the location of the anomaly, obtaining log information from adjacent nodes, and comparing data packet characteristics, the propagation path and direction are determined, including: Taking the node at the location where the anomaly was initiated as the center, obtain the local connection logs and data packet cache summary information of all its directly connected first-level adjacent nodes during the anomaly period; By comparing the data packet reception timestamp sequence recorded in the logs of each adjacent node with the timestamp sequence in the log of the node at the location of the anomaly, a node group with highly coordinated reception timing can be identified. Extract the common feature code segment of the data packets received by the node group, and perform incremental comparison with the feature code of the data packets sent by the node at the location of the anomaly initiation to identify the feature inheritance and mutation pattern of the data packets during the propagation process. Based on the continuity of feature inheritance and the regularity of variation, determine the actual propagation order of abnormal data streams between nodes. Based on this sequence, starting from the node where the anomaly was initiated, the propagation path of the abnormal behavior downstream is reconstructed.

7. The abnormal behavior detection method for power information communication networks according to claim 1, characterized in that: Based on the determined propagation path and direction, the mutation records of data packets in the dynamically changing network are tracked to obtain the complete propagation trajectory, including: Along the propagation path, sequentially visit downstream nodes on the path and obtain their packet processing logs; Compare the signatures of data packets forwarded and received between adjacent nodes, identify the jump points where the signatures change during transmission, and record the morphology of the mutated signatures. The mutated signature is used as a new tracking identifier to initiate a breadth-first search in the network based on signature matching to find other nodes with data packets containing the same signature. The newly discovered nodes are integrated with the original path to determine whether they are new branches or extensions of the path, and the propagation path structure is updated accordingly. The process iteratively executes feature comparison, breadth-first search, and path update until no new feature code mutations or unknown nodes with the same feature code are found. Finally, it outputs a complete propagation trajectory map covering all branches and mutation history.

8. The abnormal behavior detection method for power information communication networks according to claim 1, characterized in that: If the complete propagation trajectory includes geolocation data, then this data is fused with the network topology representation to obtain a precise location and path description of the abnormal behavior, including: The device identifier of each node in the complete propagation trajectory is analyzed, and the geographical coordinates of the node are obtained by querying the preset device asset database. The logical connection relationships in the network topology representation are overlaid and mapped with the obtained geographic location coordinates of the nodes to generate a fused network view that combines logical connections and geospatial information. In the fused network view, the node sequence of the complete propagation trajectory is transformed into a geographic path line with latitude and longitude coordinates; Calculate the total length of the geographical path, the number of inflection points, and the key power facility areas it passes through, and generate a quantitative description of the spatiotemporal range and physical impact area of ​​the anomalous behavior propagation; The fused network view, geographic path lines, and quantitative descriptions are combined to output a precise location and path analysis report of the abnormal behavior.

9. An abnormal behavior detection system for a power information communication network, used to implement the method described in any one of claims 1 to 8, characterized in that, include: The data acquisition and topology construction module is used to collect traffic data and node connection information in the power information communication network in real time, process the data using a topology mapping algorithm to construct the current network structure model, and obtain the network topology representation. The anomaly indicator analysis module is used to obtain data packet transmission records and analyze their timestamps and source address characteristics based on the network topology representation to determine potential anomaly behavior indicators. This includes: based on the network topology representation, selecting several core nodes with relatively high connectivity and retrieving complete data packet transmission records flowing through these core nodes; parsing the retrieved data packet transmission records, extracting the arrival timestamp and source address information of each data packet, and classifying them according to the source address; for data packet sequences classified by the same source address, calculating the fluctuation of their consecutive data packet arrival time intervals and statistically analyzing the frequency distribution of data packets sent to different target nodes; marking source addresses with time interval fluctuations exceeding the normal range and abnormal target node frequency distributions as suspicious sources; aggregating the behavioral data of all suspicious sources and overlaying it with the location information in the network topology representation to generate a set of potential anomaly behavior indicators. The propagation path simulation module is used to extract relevant data packet sequences for the potential abnormal behavior indicators, and to simulate the propagation process through a path tracing algorithm to obtain a preliminary propagation path; An anomaly location determination module is used to determine the location of the anomaly by cross-validating the obtained preliminary propagation path with the node location data in the network topology representation. The path direction determination module is used to determine the propagation path expansion direction by judging the location of the anomaly, obtaining log information of adjacent nodes, and comparing data packet characteristics. The trajectory tracing generation module is used to track the variation records of data packets in a dynamically changing network based on the determined propagation path and direction, and obtain the complete propagation trajectory.

Images