Power network threat detection method and device based on artificial intelligence, equipment and storage medium

Abstract

The invention discloses a power network threat detection method, device and equipment based on artificial intelligence and a storage medium, and belongs to the technical field of power security, and the method comprises the steps: collecting and combining network flow data, equipment operation parameters and security logs of a power network in real time, and obtaining combined data; inputting the combined data into a threat detection model to enable the threat detection model to execute the following steps: extracting a plurality of local features from the combined data according to a preset feature index; respectively capturing long-term and short-term dependence on each local feature to obtain a plurality of corresponding bidirectional time sequence context features; performing weighting processing on each bidirectional time sequence context feature to obtain a context vector; performing linear transformation on the context vector, and outputting a threat level of the power network; and generating a control instruction of the power network based on the threat level. Therefore, by implementing the method and the device, the problem of low power network threat detection efficiency in the prior art can be solved.

Description

Technical Field

[0001] This invention relates to the field of power security technology, and in particular to a method, apparatus, equipment, and storage medium for detecting power network threats based on artificial intelligence. Background Technology

[0002] As the power system transforms towards digitalization and intelligence, traditional power network security faces challenges. The deep integration of industrial control systems (ICS) and power dispatch data networks breaks down physical isolation boundaries, allowing advanced persistent threats (APTs) to penetrate traditional firewalls through supply chain attacks, insider manipulation, and other means.

[0003] Current threat detection methods involve collecting various types of data from the power grid, extracting features from each data set, and then using neural networks for threat detection. However, extracting features from all data types requires processing a large volume of data, leading to excessively long attack attribution and impact assessment times—far exceeding the critical window for power system fault handling—thus compromising power grid security. Summary of the Invention

[0004] This invention provides an artificial intelligence-based method, apparatus, device, and storage medium for power network threat detection, which can solve the problem of low efficiency in power network threat detection in the prior art.

[0005] To address the aforementioned technical problems, this invention provides an artificial intelligence-based power grid threat detection method, comprising:

[0006] Real-time collection of network traffic data, equipment operating parameters, and safety logs from the power grid;

[0007] The network traffic data, the device operating parameters, and the security logs are combined and processed to obtain the combined data.

[0008] The combined data is input into the threat detection model, causing the threat detection model to perform the following steps:

[0009] Based on preset feature indicators, several local features are extracted from the combined data; wherein, the preset feature indicators are obtained by analyzing the historical threats to the power network;

[0010] By capturing the long-term and short-term dependencies of each of the local features, several corresponding bidirectional temporal context features are obtained;

[0011] The bidirectional temporal context features are weighted to obtain a context vector.

[0012] Perform a linear transformation on the context vector to output the threat level of the power network;

[0013] Based on the threat level, control commands for the power network are generated.

[0014] As a preferred embodiment, the preset characteristic indicators are derived by analyzing the historical threats to the power grid, specifically as follows:

[0015] Several model training samples are obtained from the historical power data of the power network; wherein, the historical power data includes historical network traffic data, historical equipment operating parameters, and historical security logs;

[0016] Construct a pre-built threat detection model architecture; wherein the pre-built threat detection model architecture includes an input layer, a CNN module, a BiLSTM module, an Attention module, and an output layer;

[0017] Several training samples of the model are input from the input layer to the pre-built threat detection model architecture to train the CNN module to extract several historical local features, and train the BiLSTM module to capture long-short-term dependencies of each historical local feature to obtain several corresponding historical bidirectional temporal context features. The Attention module is also trained to perform weighted processing on each historical bidirectional temporal context feature to obtain a historical context vector. The historical context vector is then linearly transformed from the output layer to obtain the output threat level of the power network.

[0018] Based on the output threat level, the contribution of each of the historical local features is calculated respectively;

[0019] Historical local features with a contribution greater than a preset threshold are identified as preset feature indicators;

[0020] The pre-built threat detection model architecture, which has been trained, and the preset feature indicators are combined to form a threat detection model.

[0021] As a preferred embodiment, obtaining several model training samples from historical power data of the power network specifically involves:

[0022] Acquire several historical network traffic data, several historical equipment operating parameters, and several historical security logs of the power network;

[0023] The historical network traffic data, historical device operating parameters, and historical security logs at the same time are combined to form several historical combined data.

[0024] The historical combination data are normalized to form several model training samples.

[0025] As a preferred embodiment, the calculation of the contribution of each of the historical local features based on the output threat level is specifically as follows:

[0026] For each historical local feature, determine the feature change path from the basic feature value to the historical local feature value;

[0027] Calculate the sensitivity of the output threat level to changes at each position along the feature change path;

[0028] Accumulate the sensitivity of changes at each location to obtain the total sensitivity from the basic feature value to the historical local feature value;

[0029] Calculate the feature difference between the basic feature value and the historical local feature value;

[0030] The contribution of the historical local features is calculated based on the total sensitivity and the feature difference.

[0031] As a preferred embodiment, the process of combining the pre-built threat detection model architecture that has been trained with the preset feature indicators to form a threat detection model specifically involves:

[0032] The pre-built threat detection model architecture that has been trained is pruned to form a simplified model architecture; wherein, model pruning includes removing redundant convolutional kernels and reducing the number of LSTM hidden units;

[0033] By combining the simplified model architecture and the preset feature indicators, a threat detection model is formed.

[0034] As a preferred embodiment, the weighted processing of each of the bidirectional temporal context features to obtain a context vector is specifically as follows:

[0035] Based on the preset weight matrix, preset bias matrix, and preset attention score vector, the attention score of each bidirectional temporal context feature is calculated.

[0036] The sum of attention scores for all bidirectional temporal context features is determined as the total attention score.

[0037] The attention weight of each bidirectional temporal context feature is determined based on the attention score of each bidirectional temporal context feature and the sum of the attention scores.

[0038] Based on the attention weights of each bidirectional temporal context feature, the context vector is calculated by weighted summation of each bidirectional temporal context feature.

[0039] As a preferred embodiment, the linear transformation of the context vector to output the threat level of the power network specifically involves:

[0040] Based on the output layer linear transformation matrix and output layer bias of the threat detection model, a linear transformation is performed on the context vector to obtain the linear transformation result.

[0041] Convert the linear transformation result into a threat probability value;

[0042] The threat level of the power network is determined based on the threat probability value and the preset threat level table.

[0043] Accordingly, the present invention provides an artificial intelligence-based power network threat detection device, comprising: a data acquisition module, a data combination module, a threat detection module, and a control command generation module;

[0044] The data acquisition module is used to collect network traffic data, equipment operating parameters, and safety logs of the power network in real time.

[0045] The data combination module is used to perform data combination processing on the network traffic data, the device operating parameters and the security log to obtain the combined data;

[0046] The threat detection module is used to input the combined data into the threat detection model, so that the threat detection model performs the following steps:

[0047] Based on preset feature indicators, several local features are extracted from the combined data; wherein, the preset feature indicators are obtained by analyzing the historical threats to the power network;

[0048] By capturing the long-term and short-term dependencies of each of the local features, several corresponding bidirectional temporal context features are obtained;

[0049] The bidirectional temporal context features are weighted to obtain a context vector.

[0050] Perform a linear transformation on the context vector to output the threat level of the power network;

[0051] The control command generation module is used to generate control commands for the power network based on the threat level.

[0052] The present invention also provides a terminal device, comprising: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the steps of the power network threat detection method based on artificial intelligence of the present invention.

[0053] The present invention also provides a computer-readable storage medium item, comprising: a stored computer program, which, when the computer program is running, controls the device where the computer-readable storage medium is located to perform the steps of the power grid threat detection method based on artificial intelligence of the present invention.

[0054] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0055] This invention provides an artificial intelligence-based power network threat detection method. It involves real-time collection of power network traffic data, equipment operating parameters, and security logs; combining these data to obtain combined data; and inputting the combined data into a threat detection model, which then performs the following steps: extracting several local features from the combined data based on preset feature indicators; capturing long-term and short-term dependencies for each local feature to obtain several corresponding bidirectional temporal context features; weighting each bidirectional temporal context feature to obtain a context vector; performing a linear transformation on the context vector to output the power network threat level; and generating power network control commands based on the threat level. This invention, after acquiring power network traffic data, equipment operating parameters, and security logs, extracts features from the collected real-time data based on preset feature indicators derived from analyzing historical threats to the power network. This reduces the number of extracted features, thereby reducing the amount of data processed. By detecting the threat level using the extracted local features and generating power network control commands based on the threat level, it effectively improves the efficiency of threat detection, thereby enhancing the security of the power network. Attached Figure Description

[0056] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0057] Figure 1 This is a flowchart illustrating an embodiment of the artificial intelligence-based power network threat detection method provided by the present invention.

[0058] Figure 2 A schematic diagram illustrating an application process of the threat detection model provided by this invention;

[0059] Figure 3 This is a schematic diagram of one embodiment of the artificial intelligence-based power network threat detection device provided by the present invention. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0062] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0063] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0064] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0065] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0066] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0067] See Figure 1 To address the low efficiency of power grid threat detection in existing technologies, an embodiment of the present invention provides an artificial intelligence-based power grid threat detection method, which includes steps 101 to 104, each step of which is detailed below:

[0068] Step 101: Collect network traffic data, equipment operating parameters, and safety logs of the power network in real time.

[0069] In this embodiment of the invention, a data acquisition agent deployed on a power terminal can acquire real-time network traffic data of the power network, including TCP / UDP packet headers and Modbus / DNP3 protocol frames; power network equipment operating parameters, including transformer oil temperature, circuit breaker status, and PMU synchronization phasor data; and power network security logs, including firewall alarms and abnormal login records. The time window length for data acquisition can be set to T = 500 (5 seconds, based on a 10-second sliding window with a sampling frequency of 50Hz, with several sub-windows formed within the window by sliding in 2-second increments).

[0070] In this embodiment of the invention, after real-time collection of network traffic data, device operating parameters and security logs, a standardized dataset can be generated by using timestamp alignment (accuracy ≤ 1ms) and 3σ criterion for noise reduction.

[0071] Step 102: Combine the network traffic data, the device operating parameters, and the security log to obtain the combined data.

[0072] In this embodiment of the invention, the collected network traffic data, device operating parameters, and security logs are combined to obtain combined data, which serves as input data for the threat detection model. Assuming the network traffic data is F1, the device operating parameters are F2, and the security logs are F3, the combined data X is: X∈R^{T×F}, where F=F1+F2+F3. Then, the data X is standardized using z-score normalization, denoted as X0. norm ∈R^{T×F}.

[0073] Step 103: Input the combined data into the threat detection model so that the threat detection model performs the following steps 201 to 204, each step as follows:

[0074] Step 201: Extract several local features from the combined data according to preset feature indicators; wherein, the preset feature indicators are obtained by analyzing the historical threats to the power network.

[0075] In this embodiment of the invention, after the combined data is input into the threat detection model, local features corresponding to preset feature indicators are first extracted. The module for extracting local features in the threat detection model is a CNN module, which consists of three convolutional and pooling layers. The first layer of the CNN module includes a convolutional layer 1 and a pooling layer 1. The input of the convolutional layer 1 is the combined data, the output is C1, the kernel size is K1, the stride is S1, the output length is T1 = T - K1 + 1, and the output feature tensor is A1 ∈ R^{T1 × C1}. The pooling layer 1 has a size of P1, an output length of T1p = floor((T1) / P1), and the output is A1p ∈ R^{T1p × C1}. The second layer of the CNN module includes a convolutional layer 2 and a pooling layer 2. The input of convolutional layer 2 is C1, the output is C2, the kernel size is K2, the stride is S2, the output length is T2 = T1p - K2 + 1, and the output feature tensor is A2 ∈ R^{T2 × C2}. Pooling layer 2 has a size of P2, an output length of T2p = floor((T2) / P2), and an output of A2p ∈ R^{T2p × C2}. The third layer of the CNN module includes convolutional layer 3. The input of convolutional layer 3 is C2, the output is C3, the kernel size is K3, the stride is S3, the output length is T3 = T2p - K3 + 1, and the output feature tensor is A3 ∈ R^{T3 × C3}. The CNN module transmits local features to the next module in sequence for subsequent processing. The sequence length is L = T3, and the input dimension is D_in = C3. The local feature sequence extracted by the CNN module is X_CNN ∈ R^{L × D_in}.

[0076] As a preferred embodiment, the preset feature index is obtained by analyzing the historical threats to the power network, specifically:

[0077] Several model training samples are obtained from the historical power data of the power network; wherein, the historical power data includes historical network traffic data, historical equipment operating parameters, and historical security logs;

[0078] Construct a pre-built threat detection model architecture; wherein the pre-built threat detection model architecture includes an input layer, a CNN module, a BiLSTM module, an Attention module, and an output layer;

[0079] Several training samples of the model are input from the input layer to the pre-built threat detection model architecture to train the CNN module to extract several historical local features, and train the BiLSTM module to capture long-short-term dependencies of each historical local feature to obtain several corresponding historical bidirectional temporal context features. The Attention module is also trained to perform weighted processing on each historical bidirectional temporal context feature to obtain a historical context vector. The historical context vector is then linearly transformed from the output layer to obtain the output threat level of the power network.

[0080] Based on the output threat level, the contribution of each of the historical local features is calculated respectively;

[0081] Historical local features with a contribution greater than a preset threshold are identified as preset feature indicators;

[0082] The pre-built threat detection model architecture, which has been trained, and the preset feature indicators are combined to form a threat detection model.

[0083] In this embodiment of the invention, the preset feature indicators are derived by analyzing historical threats to the power network. Specifically, a threat detection model is trained based on historical threat data of the power network. During the training process, the detection results of the model are made interpretable, and the contribution of each local feature is evaluated. Based on the contribution, several preset feature indicators are selected. These preset feature indicators are local features that contribute highly to the detection results. Therefore, when the model is subsequently applied to extract local features, only the local features corresponding to these preset feature indicators can be extracted, thereby improving the model's operating efficiency.

[0084] As a preferred embodiment, several model training samples are obtained from the historical power data of the power network, specifically:

[0085] Acquire several historical network traffic data, several historical equipment operating parameters, and several historical security logs of the power network;

[0086] The historical network traffic data, historical device operating parameters, and historical security logs at the same time are combined to form several historical combined data.

[0087] The historical combination data are normalized to form several model training samples.

[0088] In this embodiment of the invention, training the threat detection model requires obtaining model training samples from historical power data of the power network. Specifically, by acquiring multiple historical network traffic data, historical equipment operating parameters, and historical security logs of the power network, combining the historical network traffic data, historical equipment operating parameters, and historical security logs at the same time, and normalizing the resulting historical combined data, multiple model training samples can be obtained.

[0089] As a preferred embodiment, based on the output threat level, the contribution of each of the historical local features is calculated, specifically as follows:

[0090] For each historical local feature, determine the feature change path from the basic feature value to the historical local feature value;

[0091] Calculate the sensitivity of the output threat level to changes at each position along the feature change path;

[0092] Accumulate the sensitivity of changes at each location to obtain the total sensitivity from the basic feature value to the historical local feature value;

[0093] Calculate the feature difference between the basic feature value and the historical local feature value;

[0094] The contribution of the historical local features is calculated based on the total sensitivity and the feature difference.

[0095] In this embodiment of the invention, the contribution of each historical local feature is calculated by first determining the basic feature value. Generally, the basic feature value is set to zero or the average of the historical local feature values. Based on the historical local feature values ​​and the basic feature value, the contribution of the historical local feature values ​​is calculated using the following formula:

[0096]

[0097] In the formula, x i x is the i-th historical local feature; i ′ represents the basic feature value; F(·) represents the probability of the contribution level corresponding to the model output; IG i denoted as , where is the contribution of the i-th historical local feature; 'a' is the path parameter.

[0098] In the above formula, 'a' is a path parameter, used to describe the feature change path from the basic feature value to the historical local feature value, and its value range is a∈[0,1]. When a=0, the input is the basic feature value x. i When a = 1, the input is the historical local feature value x. i Therefore, the intermediate inputs on the path can be represented as: x′+a(xx′).

[0099] Then, the model output F(·) with respect to the intermediate input x is calculated. i The partial derivative of ′: The physical meaning of this partial derivative is: the sensitivity of the model output to changes in input features along the feature change path from basic eigenvalues ​​to historical local eigenvalues. The larger the partial derivative, the stronger the impact of feature changes on the model output.

[0100] Then integrate the partial derivative over the range of values ​​of a [0,1]: The purpose of integration is to accumulate the sensitivity of changes at each position along the feature change path, and obtain the total sensitivity from the basic feature value to the historical local feature value.

[0101] The feature difference between the basic eigenvalue and the historical local eigenvalue is x. i -x i Multiplying this by the total sensitivity calculated above yields the contribution IG of this historical local feature. i .

[0102] When IG i If IG > 0, it means that the i-th historical local feature increases the probability of the corresponding risk level, that is, the i-th historical local feature is a contributing factor to the risk; when IG i If the value is less than 0, it means that the i-th historical local feature reduces the probability of the corresponding risk level, that is, the i-th historical local feature is a risk-inhibiting factor.

[0103] As a preferred embodiment, a threat detection model is formed by combining the trained pre-built threat detection model architecture and the preset feature indicators, specifically as follows:

[0104] The pre-built threat detection model architecture that has been trained is pruned to form a simplified model architecture; wherein, model pruning includes removing redundant convolutional kernels and reducing the number of LSTM hidden units;

[0105] By combining the simplified model architecture and the preset feature indicators, a threat detection model is formed.

[0106] In this embodiment of the invention, after the pre-built threat detection model architecture is trained, it needs to be deployed to edge computing nodes (e.g., industrial gateways, substation edge servers) to achieve low-latency threat detection of real-time streaming data. To meet the constraint of inference latency <200ms, the pre-built threat detection model architecture needs to be pruned to remove redundant convolutional kernels and reduce the number of LSTM hidden units, thereby reducing computational load and memory consumption.

[0107] Step 202: Capture the long-term and short-term dependencies of each of the local features to obtain several corresponding bidirectional temporal context features.

[0108] In this embodiment of the invention, the local features extracted by the CNN module are used by the BiLSTM module to capture long-short-term dependencies, thereby deriving corresponding bidirectional temporal context features. The BiLSTM module is used to capture long-short-term dependencies, such as the time interval between consecutive failed logins and the occurrence pattern of abnormal tripping instructions. The first layer of the BiLSTM module includes two LSTM branches in opposite directions: a forward LSTM and a backward LSTM, used to capture the forward and reverse temporal information of the input sequence, respectively. The forward LSTM processes the data according to the natural order of the input sequence, learning the past-to-present dependencies in the sequence. The backward LSTM processes the data in reverse order of the input sequence, learning the future-to-present dependencies in the sequence. Through these two branches, the bidirectional LSTM can simultaneously capture the forward and reverse context information of the sequence, thereby gaining a more comprehensive understanding of the overall meaning of the sequence. The second layer of the BiLSTM module concatenates the outputs of the forward and backward LSTMs in the first layer to form a new input. Then, using gating logic similar to that of the first layer, the forward and reverse sequences are calculated again, ultimately obtaining bidirectional temporal context features that simultaneously contain both forward and reverse temporal context information. This feature sequence will serve as input to the attention layer, providing more comprehensive temporal information support for subsequent processing.

[0109] Step 203: Perform weighted processing on each of the bidirectional temporal context features to obtain the context vector.

[0110] As a preferred embodiment, the bidirectional temporal context features are weighted to obtain a context vector, specifically:

[0111] Based on the preset weight matrix, preset bias matrix, and preset attention score vector, the attention score of each bidirectional temporal context feature is calculated.

[0112] The sum of attention scores for all bidirectional temporal context features is determined as the total attention score.

[0113] The attention weight of each bidirectional temporal context feature is determined based on the attention score of each bidirectional temporal context feature and the sum of the attention scores.

[0114] Based on the attention weights of each bidirectional temporal context feature, the context vector is calculated by weighted summation of each bidirectional temporal context feature.

[0115] In this embodiment of the invention, the bidirectional temporal context features output by the BiLSTM module are used as input to the Attention module. The Attention module performs weighted processing on the bidirectional temporal context features to generate a context vector as its output. Specifically, the Attention module assigns weights to the hidden representations H_t at L time steps to form a context vector, emphasizing the contribution of key features (such as the abnormal frequency of tripping commands, consecutive failed login events, etc.). First, based on the preset weight matrix W_h, the preset bias matrix b_h, and the preset attention score vector v^T, the attention score of each bidirectional temporal context feature H_t is calculated:

[0116] e_t=v^T tanh(W_h H_t+b_h)

[0117] In the formula, e_t is the attention score; v^T is the preset attention score vector; W_h is the preset weight matrix; H_t is the bidirectional temporal context feature; and b_h is the preset bias matrix.

[0118] Then, the sum of the attention scores of all bidirectional temporal context features is determined as the total attention score, and based on the attention scores of each bidirectional temporal context feature and the total attention score, the attention weight of each bidirectional temporal context feature is determined:

[0119]

[0120] In the formula, a_t is the attention weight of the bidirectional temporal context feature; L is the number of bidirectional temporal context features.

[0121] Based on the attention weights of each bidirectional temporal context feature, the context vector is calculated by weighted summation of each bidirectional temporal context feature:

[0122]

[0123] In the formula, c is the context vector.

[0124] Step 204: Perform a linear transformation on the context vector to output the threat level of the power network.

[0125] As a preferred embodiment, the context vector is linearly transformed to output the threat level of the power network, specifically as follows:

[0126] Based on the output layer linear transformation matrix and output layer bias of the threat detection model, a linear transformation is performed on the context vector to obtain the linear transformation result.

[0127] Convert the linear transformation result into a threat probability value;

[0128] The threat level of the power network is determined based on the threat probability value and the preset threat level table.

[0129] In this embodiment of the invention, the context vector output by the Attention module is linearly transformed based on the output layer of the threat detection model to obtain the linear transformation result:

[0130] y_hat = Softmax(W_o × c + b_o)

[0131] In the formula, y_hat represents the linear transformation result; W_o is the output layer linear transformation matrix, used to map the context vector to the output space, and can be preset to a Gaussian distributed random value with a mean of 0; b_o is the output layer bias, used to adjust the distribution position of the final mapped value, and can also be preset to a Gaussian distributed random value with a mean of 0. Converting the linear transformation result into a threat probability value allows the determination of the power network's threat level based on a preset threat level table. For example, the preset threat level table includes four threat levels: low risk, medium risk, high risk, and emergency risk, along with corresponding threat probability ranges for each level. Once the threat probability value is determined, it is matched with the four threat probability ranges to derive the corresponding threat level.

[0132] See Figure 2 This is a schematic diagram illustrating an application process of the threat detection model provided by this invention. The input to the threat detection model is standardized data X_norm. The standardized data X_norm is processed by a CNN module with 3 layers of convolution and pooling to extract local features, and the convolution outputs a feature tensor A1. The output of the CNN module is processed by a 2-layer bidirectional network of a BiLSTM module to capture temporal dependencies. The output of the BiLSTM module uses an attention mechanism to calculate weights a_t and generate a context vector c. Finally, the output layer is used for softmax classification to output the threat level probability.

[0133] Step 104: Generate control commands for the power network based on the threat level.

[0134] In this embodiment of the invention, control commands for the power network can be generated based on the threat level. For example, assuming a low-risk threat level, the control command for the power network is to log and mark suspicious traffic; assuming a medium-risk threat level, the control command is to isolate the source IP (by issuing flow tables via the OpenFlow protocol); assuming a high-risk threat level, the control command is to disconnect critical links (by coordinating with the SDN controller); assuming an emergency threat level, the control command is to activate the backup system and trigger a manual intervention process (by notifying the administrator via SMS / email). The execution latency of the power network control commands must be less than or equal to 5 seconds.

[0135] Implementing the above embodiments has the following effects:

[0136] This invention provides an artificial intelligence-based power network threat detection method. It involves real-time collection of power network traffic data, equipment operating parameters, and security logs; combining these data to obtain combined data; and inputting the combined data into a threat detection model, which then performs the following steps: extracting several local features from the combined data based on preset feature indicators; capturing long-term and short-term dependencies for each local feature to obtain several corresponding bidirectional temporal context features; weighting each bidirectional temporal context feature to obtain a context vector; performing a linear transformation on the context vector to output the power network threat level; and generating power network control commands based on the threat level. This invention, after acquiring power network traffic data, equipment operating parameters, and security logs, extracts features from the collected real-time data based on preset feature indicators derived from analyzing historical threats to the power network. This reduces the number of extracted features, thereby reducing the amount of data processed. By detecting the threat level using the extracted local features and generating power network control commands based on the threat level, it effectively improves the efficiency of threat detection, thereby enhancing the security of the power network.

[0137] like Figure 3 As shown, based on the above method embodiments, corresponding apparatus embodiments are provided;

[0138] One embodiment of the present invention provides an artificial intelligence-based power network threat detection device, comprising:

[0139] The module includes a data acquisition module, a data combination module, a threat detection module, and a control command generation module.

[0140] The data acquisition module is used to collect network traffic data, equipment operating parameters, and safety logs of the power network in real time.

[0141] The data combination module is used to perform data combination processing on the network traffic data, the device operating parameters and the security log to obtain the combined data;

[0142] The threat detection module is used to input the combined data into the threat detection model, so that the threat detection model performs the following steps:

[0143] Based on preset feature indicators, several local features are extracted from the combined data; wherein, the preset feature indicators are obtained by analyzing the historical threats to the power network;

[0144] By capturing the long-term and short-term dependencies of each of the local features, several corresponding bidirectional temporal context features are obtained;

[0145] The bidirectional temporal context features are weighted to obtain a context vector.

[0146] Perform a linear transformation on the context vector to output the threat level of the power network;

[0147] The control command generation module is used to generate control commands for the power network based on the threat level.

[0148] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement the artificial intelligence-based power network threat detection method provided by any of the above-described method embodiments of the present invention.

[0149] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0150] Based on the above embodiments of the artificial intelligence-based power grid threat detection method, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the artificial intelligence-based power grid threat detection method of any embodiment of the present invention.

[0151] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0152] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0153] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0154] Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the artificial intelligence-based power network threat detection method described in any of the above-described method embodiments of the present invention.

[0155] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0156] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A power grid threat detection method based on artificial intelligence, characterized in that, include: Real-time collection of network traffic data, equipment operating parameters, and safety logs from the power grid; The network traffic data, the device operating parameters, and the security logs are combined and processed to obtain the combined data. The combined data is input into the threat detection model, causing the threat detection model to perform the following steps: Based on preset feature indicators, several local features are extracted from the combined data; wherein, the preset feature indicators are obtained by analyzing the historical threats to the power network; By capturing the long-term and short-term dependencies of each of the local features, several corresponding bidirectional temporal context features are obtained; The bidirectional temporal context features are weighted to obtain a context vector. Perform a linear transformation on the context vector to output the threat level of the power network; Based on the threat level, control commands for the power network are generated.

2. The power grid threat detection method based on artificial intelligence according to claim 1, characterized in that, The preset characteristic indicators are derived by analyzing the historical threats to the power network, specifically: Several model training samples are obtained from the historical power data of the power network; wherein, the historical power data includes historical network traffic data, historical equipment operating parameters, and historical security logs; Construct a pre-built threat detection model architecture; wherein the pre-built threat detection model architecture includes an input layer, a CNN module, a BiLSTM module, an Attention module, and an output layer; Several training samples of the model are input from the input layer to the pre-built threat detection model architecture to train the CNN module to extract several historical local features, and train the BiLSTM module to capture long-short-term dependencies of each historical local feature to obtain several corresponding historical bidirectional temporal context features. The Attention module is also trained to perform weighted processing on each historical bidirectional temporal context feature to obtain a historical context vector. The historical context vector is then linearly transformed from the output layer to obtain the output threat level of the power network. Based on the output threat level, the contribution of each of the historical local features is calculated respectively; Historical local features with a contribution greater than a preset threshold are identified as preset feature indicators; The pre-built threat detection model architecture, which has been trained, and the preset feature indicators are combined to form a threat detection model.

3. The power grid threat detection method based on artificial intelligence according to claim 2, characterized in that, The process of obtaining several model training samples from historical power data of the power grid specifically involves: Acquire several historical network traffic data, several historical equipment operating parameters, and several historical security logs of the power network; The historical network traffic data, historical device operating parameters, and historical security logs at the same time are combined to form several historical combined data. The historical combination data are normalized to form several model training samples.

4. The power grid threat detection method based on artificial intelligence according to claim 3, characterized in that, The contribution of each historical local feature is calculated based on the output threat level, specifically as follows: For each historical local feature, determine the feature change path from the basic feature value to the historical local feature value; Calculate the sensitivity of the output threat level to changes at each position along the feature change path; Accumulate the sensitivity of changes at each location to obtain the total sensitivity from the basic feature value to the historical local feature value; Calculate the feature difference between the basic feature value and the historical local feature value; The contribution of the historical local features is calculated based on the total sensitivity and the feature difference.

5. The power grid threat detection method based on artificial intelligence according to claim 4, characterized in that, The threat detection model is formed by combining the pre-built threat detection model architecture that has been trained and the preset feature indicators, specifically as follows: The pre-built threat detection model architecture that has been trained is pruned to form a simplified model architecture; wherein, model pruning includes removing redundant convolutional kernels and reducing the number of LSTM hidden units; By combining the simplified model architecture and the preset feature indicators, a threat detection model is formed.

6. The power grid threat detection method based on artificial intelligence according to claim 5, characterized in that, The weighted processing of each of the bidirectional temporal context features to obtain the context vector is specifically as follows: Based on the preset weight matrix, preset bias matrix, and preset attention score vector, the attention score of each bidirectional temporal context feature is calculated. The sum of attention scores for all bidirectional temporal context features is determined as the total attention score. The attention weight of each bidirectional temporal context feature is determined based on the attention score of each bidirectional temporal context feature and the sum of the attention scores. Based on the attention weights of each bidirectional temporal context feature, the context vector is calculated by weighted summation of each bidirectional temporal context feature.

7. The power grid threat detection method based on artificial intelligence according to claim 6, characterized in that, The linear transformation of the context vector to output the threat level of the power network is specifically as follows: Based on the output layer linear transformation matrix and output layer bias of the threat detection model, a linear transformation is performed on the context vector to obtain the linear transformation result. Convert the linear transformation result into a threat probability value; The threat level of the power network is determined based on the threat probability value and the preset threat level table.

8. A power grid threat detection device based on artificial intelligence, characterized in that, include: The module includes a data acquisition module, a data combination module, a threat detection module, and a control command generation module. The data acquisition module is used to collect network traffic data, equipment operating parameters, and safety logs of the power network in real time. The data combination module is used to perform data combination processing on the network traffic data, the device operating parameters and the security log to obtain the combined data; The threat detection module is used to input the combined data into the threat detection model, so that the threat detection model performs the following steps: Based on preset feature indicators, several local features are extracted from the combined data; wherein, the preset feature indicators are obtained by analyzing the historical threats to the power network; By capturing the long-term and short-term dependencies of each of the local features, several corresponding bidirectional temporal context features are obtained; The bidirectional temporal context features are weighted to obtain a context vector. Perform a linear transformation on the context vector to output the threat level of the power network; The control command generation module is used to generate control commands for the power network based on the threat level.

9. A terminal device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements the artificial intelligence-based power grid threat detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the artificial intelligence-based power grid threat detection method as described in any one of claims 1-7.

Images