A power grid malicious traffic detection method and system based on adaptive integration

Abstract

The application discloses a power grid malicious traffic detection method and system based on adaptive integration, relates to the technical field of power grid network security, and aims to solve the problem that the prior art cannot effectively detect encrypted malicious traffic in a resource-limited power grid edge environment. The application comprises the following steps: a client collects traffic data, monitors its own resource state and performance index, encapsulates the user demand into a request, and sends the request to a server; the server constructs a query feature vector, performs similarity query in a historical strategy library to quickly reuse or fine-tune the strategy, and if no strategy is found, an adaptive integrated decision algorithm is started to generate an optimal integrated learning scheme; the scheme is sent to the client, the client loads and runs the scheme and detects traffic features; and when malicious traffic is detected, the client triggers a security response action. According to the technical scheme, the detection strategy can be dynamically adjusted according to actual resources and demands without decrypting the traffic, and the optimal balance between detection effect and resource consumption can be achieved under the condition of resource limitation.

Description

Technical Field

[0001] This invention relates to the field of power grid network security technology, and in particular to a method and system for detecting malicious traffic in power grids based on adaptive integration. Background Technology

[0002] With the development of smart grids, the interconnection between power grid control systems and external networks is becoming increasingly close, leading to increased cybersecurity risks. As traffic encryption technology continues to advance, malicious attack traffic is gradually shifting from unencrypted to encrypted forms, making it easy to bypass existing network traffic security analysis capabilities. Current malicious traffic detection methods mainly face the following three problems.

[0003] (1) Encrypted traffic is difficult to detect: With the popularization of encryption technologies such as TLS / SSL, most malicious traffic uses encrypted transmission methods, and traditional signature-based detection methods are difficult to identify its content. Decryption-based methods rely on TLS key offloading, which is difficult to extend to the distributed deployment scenario of the power Internet of Things.

[0004] (2) Static models have poor adaptability: Existing systems usually use fixed detection models and lack the ability to dynamically adjust them according to the actual deployment environment and performance requirements. Detection systems based on a single machine learning model are limited by the model itself and are difficult to cope with diverse and ever-changing encryption attack patterns.

[0005] (3) The contradiction between computing resources and detection accuracy: Although existing ensemble learning methods or complex deep learning models can improve detection accuracy, they require a lot of computing resources, which is incompatible with the limited resources in the power grid deployment environment, especially the edge environment. Summary of the Invention

[0006] The technical problem to be solved and the technical task proposed by this invention is to improve and refine existing technical solutions, and to provide a power grid malicious traffic detection method based on adaptive integration. This method aims to achieve optimal detection results under resource-constrained conditions, and to detect and identify malicious traffic through in-depth analysis of traffic metadata and behavioral characteristics without decrypting the traffic. To this end, this invention adopts the following technical solution.

[0007] A method for detecting malicious traffic in power grids based on adaptive integration includes the following steps:

[0008] 1) The client collects power grid flow data and extracts non-load content features from it;

[0009] 2) The client monitors its own resource usage status and service performance indicators in real time, and encapsulates the resource usage status, service performance indicators and user-preset requirement parameters into a request data packet and sends it to the server.

[0010] 3) The server receives the request data packet, and the adaptive integration decision module performs the following operations:

[0011] 31) Construct a query feature vector based on the resource usage status and the user's preset demand parameters, and use it as a similarity query condition;

[0012] 32) Based on the query conditions, perform a similarity query in the historical strategy database. If a similar historical strategy is found, the historical strategy is directly reused or its parameters are fine-tuned to generate the optimal ensemble learning scheme for the current scenario. If no historical strategy that meets the requirements is found, the adaptive ensemble decision algorithm process is started to generate the optimal ensemble learning scheme.

[0013] 4) The server sends the optimal integrated learning scheme to the client in the form of a configuration package;

[0014] 5) After receiving the configuration package, the client loads and runs the optimal ensemble learning scheme to perform malicious traffic detection on the non-payload content class features extracted in step 1).

[0015] 6) In response to the detection of malicious traffic, the client triggers a preset security response action; the security response action includes issuing an alarm, disconnecting the malicious traffic connection and / or isolating the device involved.

[0016] This technical solution can dynamically generate or select the most suitable solution based on the real-time resource status and performance indicators of each client, as well as the specific needs of the user. This enables the system to provide tailored detection capabilities for devices with different performance levels and under different network load conditions, overcoming the limitations of the traditional static model's "one-size-fits-all" approach. By introducing a historical strategy similarity query mechanism, complex model selection and optimization calculations do not need to be performed from scratch in most cases. When encountering requests similar to historical scenarios, existing strategies can be quickly reused or fine-tuned, greatly reducing server-side decision latency and computational overhead. This makes this method suitable for efficient deployment and rapid response in grid edge or IoT environments where computing and power resources are limited. The entire decision-making process is completed on the server side, decoupling complex optimization calculations from the client's real-time detection tasks. This ensures the security of the core algorithm and model library while avoiding placing a heavy computational burden on resource-limited clients, thus achieving a balance between security and efficiency overall. The client updates the detection scheme by receiving and loading the configuration package issued by the server. Without recompiling the client program or restarting the service, the detection strategy can be dynamically switched and hot-updated, ensuring the continuous online and uninterrupted operation of the power grid malicious traffic detection service and meeting the stringent requirements of the power system for high availability.

[0017] As a preferred technical means: In step 1), the non-load content class features include at least one of connection metadata, handshake features, traffic timing features, and behavioral graph features; wherein, connection metadata includes IP address, port, connection duration, session packet size and direction sequence, handshake features include version, encryption suite, certificate chain length and message length, traffic timing features include packet interval time, upload / download traffic ratio and traffic burstiness, and behavioral graph features are the behavioral features of nodes and edges extracted by graph neural network after constructing the traffic session into a graph structure;

[0018] When extracting the non-load content class features, a load-aware dynamic sliding window mechanism is adopted to dynamically adjust the size of the data collection window according to the real-time traffic rate and the number of connections; the window size is reduced during peak traffic periods to ensure real-time performance; and the window size is increased during low traffic periods to accumulate more feature data.

[0019] This technical solution constructs a comprehensive and in-depth traffic behavior profile by comprehensively utilizing four types of multi-dimensional non-load content features: connection metadata, handshake characteristics, traffic timing characteristics, and behavioral graph characteristics. This allows for the effective detection of malicious behavior hidden in encrypted traffic without involving decryption or ensuring communication privacy and legitimacy. Simultaneously, the load-aware dynamic sliding window mechanism enables the system to intelligently adapt to fluctuations in network traffic. During peak periods, it prioritizes real-time detection, while focusing on improving detection accuracy during low-speed periods, ultimately achieving a dynamic balance between detection efficiency and accuracy in the complex and ever-changing power grid network environment.

[0020] As a preferred technical means: in step 2), the resource usage status includes at least one of CPU, memory and GPU usage, the service performance indicators include detection accuracy and detection latency, and the user-preset requirement parameters include minimum detection capability requirements and maximum allowable latency.

[0021] By synchronously monitoring and jointly reporting the real-time resource status of the client (CPU, memory, GPU), actual service performance (detection accuracy, latency), and user-preset business requirements (minimum detection capability, maximum allowable latency), quantitative and comprehensive system status awareness is provided for backend decision-making. This lays the data foundation for realizing resource awareness and demand-driven dynamic optimization, ensuring that the final generated detection strategy can not only meet the bottom-line requirements of business security, but also match the actual load capacity of current computing resources.

[0022] As a preferred technical means: In step 32), the adaptive ensemble decision algorithm selects the optimal ensemble learning scheme by solving a multi-objective optimization problem; wherein, the objective of the multi-objective optimization problem is to maximize the comprehensive utility function, which is the sum of the positive weighted value of detection capability and the negative weighted value of detection latency; the constraints that the multi-objective optimization problem must satisfy include: the resources required by the selected ensemble learning scheme do not exceed the available resources of the client, its detection capability is not lower than the minimum detection capability requirement preset by the user, and its detection latency does not exceed the maximum allowable latency preset by the user.

[0023] This technical solution constructs a multi-objective optimization model with a comprehensive utility function as the objective and client resources and user needs as hard constraints. It systematically unifies the often conflicting objectives of "high detection accuracy," "low response latency," and "low resource consumption" within a rigorous mathematical framework for weighing and solving them. This allows for the selection of the "most balanced" or "most suitable" integrated solution under specific constraints, effectively solving the problem of matching detection performance with actual deployment conditions.

[0024] As a preferred technical means: In step 32), the multi-objective optimization problem is solved using a dynamic algorithm based on the Pareto optimal solution set, including the following steps:

[0025] 321) Select all feasible solutions from the database that meet the resource constraints, detection capability requirements, and latency requirements, and form a subset of feasible solutions;

[0026] 322) Determine a Pareto optimal solution set from the subset of feasible solutions, wherein for any solution in the solution set, there is no other solution that is no less capable than it in detection capability and no more capable in detection latency, and at least one of them is strictly better;

[0027] 323) If the Pareto optimal solution set contains only one scheme, then that scheme is the optimal ensemble learning scheme; if it contains multiple schemes, then the scheme with the largest comprehensive utility function value is selected from the Pareto optimal solution set as the optimal ensemble learning scheme.

[0028] This technical solution employs a dynamic algorithm based on Pareto optimal solution sets. It first filters out feasible solutions that satisfy all hard constraints, then identifies Pareto optimal solutions that balance detection capability and latency and cannot be simultaneously surpassed. This ensures that all candidate solutions are elite solutions under the current constraints. Furthermore, a comprehensive utility function is introduced as a unified benchmark for the final selection, achieving a scientific transformation from "multi-objective trade-offs" to "single decision-making." This process guarantees a comprehensive exploration of complex multi-objective problems while avoiding subjective arbitrariness in decision-making, and systematically outputs an ensemble learning scheme that performs optimally under multiple constraints.

[0029] As a preferred technical means: In step 32), the similarity query uses the kd-tree algorithm to perform nearest neighbor search, and uses Euclidean distance or cosine similarity as the similarity metric to select the historical strategy that is closest to the query feature vector.

[0030] This technical solution employs the kd-tree algorithm to perform nearest neighbor search on historical strategies, supplemented by Euclidean distance or cosine similarity as a similarity metric. This enables the rapid selection of the most suitable validated strategy for the current scenario from massive historical data, compressing strategy decision-making time and achieving rapid response. At the same time, it effectively avoids the resource overhead caused by frequently initiating computationally intensive optimization processes, thereby improving overall response efficiency and resource utilization while ensuring decision quality.

[0031] As a preferred technical approach: the adaptive ensemble decision algorithm is based on a stacking ensemble strategy, which uses a meta-model to fit the optimal weights of the base learners; the training process of the meta-model includes the following steps:

[0032] The labeled power grid flow data is input into multiple heterogeneous base learners, and each base learner outputs a corresponding prediction result vector.

[0033] Collect the prediction vectors of all base learners and their corresponding real traffic labels to construct a meta-model training set;

[0034] The meta-model is trained using the prediction vectors of all base learners as input and the actual traffic labels as output. The meta-model is a linear regression model, a gradient boosting tree model, or a neural network model. The training objective is to minimize the overall prediction error of the ensemble model by learning to assign optimal weights to the predictions of each base learner.

[0035] This technical solution adopts an ensemble strategy based on stacking. By introducing a meta-model, it automatically learns and fits the optimal weight combination of multiple heterogeneous base learners. This approach can deeply explore the complementary advantages of different base learners in power grid flow detection tasks, thereby integrating the predictive strengths of each model to form a strong ensemble model that surpasses the performance of any single base learner. This is beneficial for improving the overall accuracy and generalization ability of malicious flow identification.

[0036] As a preferred technical approach: During the malicious traffic detection process in step 5), for the power grid traffic data collected in each dynamic sliding window, a complexity-aware gating decision mechanism is used in conjunction with the optimal ensemble learning scheme generated by the adaptive ensemble decision algorithm, specifically including the following steps:

[0037] Calculate the information entropy or feature dispersion of traffic characteristics to assess traffic complexity;

[0038] If the traffic complexity is less than or equal to the preset complexity threshold, a lightweight base learner is selected to quickly detect the traffic.

[0039] If the complexity of the traffic exceeds the preset complexity threshold, the complete adaptive ensemble model formed by loading the optimal ensemble learning scheme issued by the server will be used for in-depth analysis.

[0040] This technical solution introduces a complexity-aware gating decision-making mechanism to achieve on-demand dynamic allocation of computing resources during the detection process: for routine traffic with simple features and low complexity, a lightweight base learner is automatically invoked for rapid screening, significantly reducing detection latency and resource consumption; while for abnormal traffic with complex features and high potential risks, a complete integrated model is launched for in-depth analysis to ensure detection accuracy. This effectively solves the inherent contradiction between detection efficiency and detection accuracy, thereby enabling differentiated and refined security detection of massive power grid traffic under resource-constrained conditions.

[0041] As a preferred technical approach, it also includes a dynamic performance awareness mechanism based on proactive testing, including:

[0042] The server periodically sends test traffic to the client's traffic detection module;

[0043] The detection results are compared with the actual labels of the test traffic to obtain the current performance parameters;

[0044] If the performance parameters do not meet the preset requirements, the server is triggered to re-execute the adaptive ensemble decision algorithm to generate a new optimal ensemble learning scheme.

[0045] This technical solution introduces a dynamic performance awareness mechanism based on proactive testing, which can periodically and proactively perform real-time performance evaluation on the detection model deployed on the client. This enables early detection and warning of potential risks such as model detection capability decay or decreased environmental adaptability, and triggers automatic adjustment and updates of the model accordingly. This effectively overcomes the problem of continuous degradation of detection efficiency that may be caused by the inability of traditional static detection systems to perceive their own performance changes, and improves the system's self-maintenance capability and detection reliability during long-term operation.

[0046] Another technical solution of the present invention is: a power grid malicious traffic detection system based on adaptive integration, used to implement the aforementioned method, the system comprising:

[0047] The power grid flow detection module is used to collect and extract non-load content features of power grid flow data, and load and run the optimal integrated learning scheme to detect malicious traffic according to the configuration issued by the server.

[0048] The dynamic monitoring module is used to collect the resource usage status and service performance indicators of the client, and to send a policy update request to the server when there are significant changes.

[0049] The detection and response module is used to trigger alarms and security response measures based on the results of malicious traffic detection.

[0050] The base model management module is used to maintain and provide information on available base learners;

[0051] The integration strategy management module is used to store historical integration strategies and their corresponding client status and performance metrics;

[0052] The adaptive ensemble decision module is used to perform similarity queries or launch multi-objective optimization algorithms based on the status and requirements reported by the client, generate the optimal ensemble learning scheme, and send it to the client.

[0053] This technical solution adopts a client-server distributed architecture, including a client and a server that communicate with each other. The client and server transmit data through an encrypted communication protocol. The client includes a dynamic monitoring module, a power grid traffic detection module, and a detection response module. The server includes a basic model management module, an adaptive integrated decision-making module, and an integrated strategy management module. By constructing a client-server distributed architecture with clearly defined responsibilities, this technical solution centralizes computationally intensive model decision-making and optimization tasks on the server side, while distributing real-time traffic acquisition, feature extraction, and detection tasks on the client side. This achieves a reasonable decomposition of system functions and effective load sharing. The various specialized modules form a closely collaborative organic whole through clear interaction logic. This ensures the security of the model library and decision logic under centralized management on the server side, while fully leveraging the advantages of the client in real-time detection and rapid response. Ultimately, it constructs a power grid malicious traffic detection system that combines centralized intelligence with edge efficiency, is adaptively adjustable, and is stable and reliable.

[0054] Beneficial effects: This technical solution can autonomously select appropriate ensemble learning algorithms according to the deployment environment resources and detection accuracy requirements, thereby achieving the best detection effect under resource-constrained conditions, and without decrypting traffic, it can achieve malicious traffic detection and identification through in-depth analysis of traffic metadata and behavioral characteristics. Attached Figure Description

[0055] Figure 1 This is the system architecture diagram of the present invention.

[0056] Figure 2 This is a flowchart of the historical integration strategy similarity query process of the present invention.

[0057] Figure 3 This is a flowchart of the dynamic algorithm based on Pareto optimal solution set of the present invention. Detailed Implementation

[0058] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0059] Example 1:

[0060] A method for detecting malicious traffic in power grids based on adaptive integration includes the following steps:

[0061] S1: The client collects power grid flow data and extracts non-load content features from it;

[0062] S2: The client monitors its own resource usage status and service performance indicators in real time, and encapsulates the resource usage status, service performance indicators and user-preset demand parameters into a request data packet and sends it to the server.

[0063] S3: The server receives the request data packet, and the adaptive integration decision module performs the following operations:

[0064] S31: Construct a query feature vector based on the resource usage status and the user's preset demand parameters, and use it as a similarity query condition;

[0065] S32: Based on the query conditions, perform a similarity query in the historical strategy database. If a similar historical strategy is found, the historical strategy is directly reused or its parameters are fine-tuned to generate the optimal ensemble learning scheme for the current scenario. If no historical strategy that meets the requirements is found, the adaptive ensemble decision algorithm process is started to generate the optimal ensemble learning scheme.

[0066] S4: The server sends the optimal integrated learning scheme to the client in the form of a configuration package;

[0067] S5: After receiving the configuration package, the client loads and runs the optimal ensemble learning scheme to detect malicious traffic on the non-payload content class features extracted in step S1.

[0068] S6: In response to the detection of malicious traffic, the client triggers a preset security response action; the security response action includes issuing an alarm, disconnecting the malicious traffic connection and / or isolating the device involved.

[0069] This embodiment can autonomously select a suitable ensemble learning algorithm based on the deployment environment resources and detection accuracy requirements, thereby achieving optimal detection results under resource-constrained conditions. Without decrypting the traffic, it can detect and identify malicious traffic through in-depth analysis of traffic metadata and behavioral characteristics.

[0070] The following provides further explanation of some of the content.

[0071] In the adaptive integration decision-making module, a historical strategy similarity query mechanism is designed to quickly respond to requirements and provide integration strategies. For example... Figure 2 As shown, when a client sends a new optimization request, the server does not first calculate the optimal solution from scratch. Instead, it combines the current client resource vector and user demand vector into a query feature vector Q, and uses similarity search algorithms such as the kd-tree algorithm to quickly find the top-K (K is a preset positive integer) historical decision records closest to Q in the historical policy database of the integrated policy management module. Similarity measurement can be based on algorithms such as Euclidean distance and cosine similarity. Subsequently, based on the found historical records, the optimal model combination and parameters in the record are directly reused and fine-tuned, thereby reducing computational overhead and achieving sub-second policy response. Only when the similarity is low or no matching record can be found will the system initiate the complete multi-objective optimization process.

[0072] In ensemble learning, effectively combining base learners is crucial to performance. This embodiment employs a stacking-based ensemble strategy, the core of which is training a meta-model to fit the optimal weights of the base learners. This embodiment uses a training set containing the predictions of the base learners and the ground truth labels to train the meta-model. During training, the client first inputs traffic data into multiple heterogeneous base learners, each generating a prediction vector. The meta-model's input is the predictions of all base learners, and its output is the final prediction. The training objective of the meta-model is to learn how to assign optimal weights to the predictions of each base learner. The meta-model can be a simple linear regression or a more complex gradient boosting tree, neural network, etc. Taking linear regression as an example, the meta-model fitting process can be represented as solving for a weight vector. This makes the predicted label equal to the weight. The predicted vectors of the base learners are used to find an optimal weight combination, thereby minimizing the overall prediction error of the ensemble model.

[0073] This embodiment uses three innovative designs to improve detection efficiency: a complexity-aware gating decision mechanism, a load-aware dynamic sliding window mechanism, and a dynamic performance-aware mechanism based on active testing.

[0074] (1) Complexity-Aware Gating Decision Mechanism: To further enhance the model's adaptability, this embodiment introduces a gating decision mechanism to dynamically adjust the detection process based on the characteristics of real-time traffic, achieving optimal resource allocation. During the dynamic gating phase, the information entropy or feature dispersion of traffic features is calculated to assess traffic complexity in real time. If the traffic features are obvious (i.e., low complexity), the gating network will select a lightweight base learner (such as a decision tree) for rapid detection in real time to save resources. If the traffic complexity is high, such as experiencing suspected malicious encryption traffic or new attack traffic, the gating network will forward the traffic to a complete adaptive ensemble model for in-depth analysis to ensure detection accuracy. This mechanism avoids using computationally intensive ensemble models for all traffic, thereby reducing resource consumption and achieving on-demand detection.

[0075] (2) Dynamic sliding window mechanism for load perception: To cope with the suddenness and time-varying nature of power grid flow, this embodiment adopts a dynamic sliding window mechanism based on the real-time load of flow analysis. The sliding window size for data acquisition is dynamically adjusted according to the real-time flow rate and the number of connections. During peak flow periods, the sliding window is reduced to ensure real-time performance; during low flow periods, the sliding window is increased to accumulate more features, thereby improving detection accuracy. During the detection process, feature extraction and aggregation are performed based on the sliding window, thereby supporting streaming processing, ensuring low latency, and enabling timely capture of short-term, sudden malicious behaviors (such as DDoS attacks or scanning).

[0076] (3) Dynamic Performance Awareness Mechanism Based on Active Testing: To ensure the overall efficiency of traffic detection, this embodiment constructs a dynamic performance awareness mechanism that periodically sends active test traffic to collect the real-time performance of the integrated model, thereby adjusting the parameter structure of the integrated model. During active testing, the system starts a virtual terminal and sends a small amount of test traffic to the traffic detection module on the client. The detection results are then compared with the true values ​​of the traffic labels to understand the current integrated model's detection capabilities and operating efficiency, among other performance parameters. Finally, if the performance parameters do not meet the preset requirements, the integrated model is adjusted, and relevant prompts are sent to the server.

[0077] The adaptive ensemble decision module is responsible for running the ensemble decision algorithm, constructing the optimal ensemble model, and improving detection performance while satisfying resource constraints by solving a multi-objective optimization problem. This dynamic selection strategy overcomes the limitations of traditional static model selection, ensuring continuous operation of the flow analysis task in power grid environments with highly dynamic loads. The optimized model is as follows:

[0078] set up For the set of all possible ensemble learning schemes, where each scheme It includes a base learner combination and an ensemble strategy. User requirements parameters. and These represent the user's requirements for traffic detection capabilities and operational overhead (e.g., latency), respectively. For any given solution... We define the following parameters:

[0079] :plan The detection capability (the higher the better, such as F1-Score) represents the effectiveness of the detection.

[0080] :plan The operational efficiency overhead (the smaller the better, such as detection latency).

[0081] :plan Required resource dimensions [ ],in for Required CPU computing resources for Required memory resources for Required GPU resources.

[0082] The system collects available resources from the client. , ,in For the available CPU computing resources of the client, For available memory resources on the client, Available GPU resources for the client.

[0083] When the above data, as well as user requirement parameters, are collected... and The optimal solution will then be selected by solving the following constrained optimization problem. :

[0084]

[0085]

[0086]

[0087]

[0088]

[0089] in, For the comprehensive utility function, and This is an adjustable weighting parameter used to balance the importance of accuracy and latency. For example, when high real-time requirements are needed, it can be increased. The value of .

[0090] Solving the above optimization problems typically employs heuristic search algorithms or approximation algorithms. As an alternative optimization method, such as... Figure 3 As shown, this embodiment employs a dynamic algorithm based on Pareto optimal solution sets:

[0091] A. Set the maximum number of attempts Number of experiments per session Parameters; perform temporary variable initialization and set the current number of attempts. =0.

[0092] B. Offline performance modeling: If > If the maximum number of attempts is reached, the process ends and returns "No feasible solution found"; otherwise, construct the solution for the current attempt. The new controlled variable experiment, according to the quadruple... Store the performance and resource consumption data of each integration solution in the database.

[0093] C. Online Search and Filtering: Filtering from the database to find a subset of solutions that meet resource constraints and user requirements. If the search results are empty, then execute... = Then return to step B.

[0094] D. In Finding the Pareto Optimal Set in the solution. A solution A solution is considered Pareto optimal if and only if there is no other solution. Make and And at least one inequality sign is true. If It contains multiple solutions, and the system will determine the solution based on preset weights. and Choose the comprehensive utility function The solution with the largest value is taken as the final optimal solution. .

[0095] E. Dynamic Deployment: The system is deployed according to the determined... It dynamically loads the corresponding base learner models and builds an ensemble structure to complete the real-time deployment of the models.

[0096] Example 2:

[0097] This paper provides a power grid malicious traffic detection system based on adaptive integration. When performing encrypted traffic security analysis, this embodiment does not require decryption of the traffic, but instead extracts non-load content features from multiple dimensions. These non-load content features include:

[0098] (1) Connection metadata: such as IP address, port, connection duration, session packet size, direction sequence, etc.

[0099] (2) TLS / SSL handshake features: such as TLS version, cipher suite, certificate chain length, Client Hello message length, Service Name Indicator, etc.

[0100] (3) Traffic timing characteristics: such as data packet interval, upload / download traffic ratio, burstiness, etc.

[0101] (4) Behavioral graph features: The traffic session is constructed as a graph structure, and the behavioral features of nodes and edges are extracted using graph neural networks (GNN).

[0102] This system adopts a server-client distributed architecture, aiming to decouple computationally intensive optimization decisions from resource-constrained edge detection tasks. The client is responsible for executing traffic analysis algorithms and collecting monitoring data in real time to assist in integrated strategy decisions. Historical strategy maintenance and strategy decision-making algorithm execution are performed on the server by default, thereby improving operational efficiency.

[0103] During client-server data interaction, the client first collects its own resource status, service performance metrics, and user demand parameters. This data, along with the client ID, is then encapsulated into a lightweight data packet (format can be JSON or Protocol Buffers) to ensure the complete transmission of critical information. All data packets are transmitted using encrypted communication protocols (such as TLS) to ensure confidentiality and integrity during public network transmission, preventing sensitive information leakage and man-in-the-middle attacks. The client periodically sends heartbeat packets to maintain the connection and periodically sends performance reports to the server. When a critical event is detected (e.g., a surge in resource utilization), the client immediately triggers an asynchronous request to the server for a new integration strategy, ensuring the system can respond quickly to emergencies. The server receives the request, processes it, and then distributes the new strategy to the client as a lightweight configuration package. The client can dynamically load and switch to the new strategy without recompiling or restarting the service, thus achieving hot updates. The system architecture is as follows: Figure 1 As shown.

[0104] (1) Dynamic monitoring module: continuously collects and analyzes the resource usage status of the client (i.e., resource usage status, such as CPU, memory, and GPU utilization) and service performance indicators (such as detection latency and detection accuracy). When it detects significant changes in client resources or performance indicators, it will trigger and send an update request to the adaptive integration decision module to provide the latest environmental data and dynamically trigger the adjustment and update of the integration monitoring strategy.

[0105] (2) Base Model Management Module: Maintains a library containing various machine learning and deep learning models, and provides versions of each model with different parameter scales as base learners for ensemble learning. In terms of interaction, it responds to query requests from the Adaptive Ensemble Decision module, providing a list of available base learners and their details.

[0106] (3) Adaptive Integrated Decision Module: First, it receives client resource and service performance indicators from the dynamic monitoring module. Then, it queries the basic model management module to obtain available base learners, establishes a multi-objective dynamic optimization model, and constructs the optimal ensemble learning algorithm under the premise of meeting client resource constraints and performance requirements. It also supports querying the integrated strategy management module to obtain historical strategy data to assist in decision-making. Finally, the generated optimal strategy is sent to the power grid flow detection module for deployment, and the decision result is recorded in the integrated strategy management module.

[0107] (4) Integration Strategy Management Module: Records each integration strategy generated by the Adaptive Integration Decision Module, along with its corresponding performance and resource data. Receives and stores newly generated strategies; responds to requests from the Adaptive Integration Decision Module by providing historical data to accelerate the generation of new strategies.

[0108] (5) Power Grid Flow Detection Module: Collects power grid flow and extracts unencrypted metadata and behavioral characteristics. Runs the integrated algorithm issued by the adaptive integrated decision module to detect malicious traffic in the encrypted flow. Sends the detection results (such as the discovery of malicious traffic) to the detection response module; at the same time, it feeds back the service performance indicators to the dynamic monitoring module.

[0109] (6) Detection and Response Module: Based on the detection results of the power grid flow detection module, immediately issue an alarm and trigger preset security response measures (e.g., disconnection, isolation of equipment, etc.). At the same time, it can receive malicious flow detection events from the power grid flow detection module and execute corresponding response actions.

[0110] The above-described method and system for detecting malicious power grid traffic based on adaptive integration is a specific embodiment of the present invention, demonstrating the substantial features and progress of the present invention. Equivalent modifications can be made to it according to actual usage needs, under the guidance of the present invention, and all such modifications are within the scope of protection of this solution.

Claims

1. A method for detecting malicious power grid traffic based on adaptive integration, characterized in that... Includes the following steps: 1) The client collects power grid flow data and extracts non-load content features from it; The non-load content features include at least one of connection metadata, handshake features, traffic time-series features, and behavior graph features. When extracting the non-load content features, a load-aware dynamic sliding window mechanism is used to dynamically adjust the data collection window size according to the real-time traffic rate and the number of connections. The window size is reduced during peak traffic periods to ensure real-time performance, and the window size is increased during low traffic periods to accumulate more feature data. 2) The client monitors its own resource usage status and service performance indicators in real time, and encapsulates the resource usage status, service performance indicators and user-preset requirement parameters into a request data packet and sends it to the server. 3) The server receives the request data packet, and the adaptive integration decision module performs the following operations: 31) Construct a query feature vector based on the resource usage status and the user's preset demand parameters, and use it as a similarity query condition; 32) Based on the query conditions, perform a similarity query in the historical strategy database. If a similar historical strategy is found, the historical strategy is directly reused or its parameters are fine-tuned to generate the optimal ensemble learning scheme for the current scenario. If no historical strategy that meets the requirements is found, the adaptive ensemble decision algorithm process is started to generate the optimal ensemble learning scheme. 4) The server sends the optimal integrated learning scheme to the client in the form of a configuration package; 5) After receiving the configuration package, the client loads and runs the optimal ensemble learning scheme to perform malicious traffic detection on the non-load content class features extracted in step 1). For the power grid traffic data collected in each dynamic sliding window, the optimal ensemble learning scheme generated by the adaptive ensemble decision algorithm in conjunction with a complexity-aware gating decision mechanism includes the following steps: Calculate the information entropy or feature dispersion of traffic characteristics to assess traffic complexity; If the traffic complexity is less than or equal to the preset complexity threshold, a lightweight base learner is selected to quickly detect the traffic. If the complexity of the traffic exceeds the preset complexity threshold, the complete adaptive ensemble model formed after loading the optimal ensemble learning scheme issued by the server will be used for in-depth analysis. 6) In response to the detection of malicious traffic, the client triggers a preset security response action; the security response action includes issuing an alarm, disconnecting the malicious traffic connection and / or isolating the device involved.

2. The method for detecting malicious power grid traffic based on adaptive integration according to claim 1, characterized in that: In step 1), the connection metadata includes IP address, port, connection duration, session packet size and direction sequence, the handshake features include version, encryption suite, certificate chain length and message length, the traffic timing features include packet interval time, upload / download traffic ratio and traffic burstiness, and the behavioral graph features are the behavioral features of nodes and edges extracted by graph neural network after the traffic session is constructed into a graph structure.

3. The method for detecting malicious power grid traffic based on adaptive integration according to claim 2, characterized in that: In step 2), the resource usage status includes at least one of CPU, memory and GPU utilization, the service performance indicators include detection accuracy and detection latency, and the user-preset requirement parameters include minimum detection capability requirements and maximum allowable latency.

4. The method for detecting malicious power grid traffic based on adaptive integration according to claim 3, characterized in that: In step 32), the adaptive ensemble decision algorithm selects the optimal ensemble learning scheme by solving a multi-objective optimization problem. The objective of the multi-objective optimization problem is to maximize the comprehensive utility function, which is the sum of the positive weighted value of detection capability and the negative weighted value of detection latency. The constraints that the multi-objective optimization problem must satisfy include: the resources required by the selected ensemble learning scheme do not exceed the available resources of the client, its detection capability is not lower than the minimum detection capability requirement preset by the user, and its detection latency does not exceed the maximum allowable latency preset by the user.

5. The method for detecting malicious power grid traffic based on adaptive integration according to claim 4, characterized in that: In step 32), the multi-objective optimization problem is solved using a dynamic algorithm based on Pareto optimal solution sets, including the following steps: 321) Select all feasible solutions from the database that meet the resource constraints, detection capability requirements, and latency requirements, and form a subset of feasible solutions; 322) Determine a Pareto optimal solution set from the subset of feasible solutions, wherein for any solution in the solution set, there is no other solution that is no less capable than it in detection capability and no more capable in detection latency, and at least one of them is strictly better; 323) If the Pareto optimal solution set contains only one scheme, then that scheme is the optimal ensemble learning scheme; if it contains multiple schemes, then the scheme with the largest comprehensive utility function value is selected from the Pareto optimal solution set as the optimal ensemble learning scheme.

6. The method for detecting malicious power grid traffic based on adaptive integration according to claim 1, characterized in that: In step 32), the similarity query uses the kd-tree algorithm to perform nearest neighbor search, using Euclidean distance or cosine similarity as the similarity metric, to select the historical strategy that is closest to the query feature vector.

7. The method for detecting malicious power grid traffic based on adaptive integration according to claim 1, characterized in that: The adaptive ensemble decision algorithm is based on a stacking ensemble strategy, which uses a meta-model to fit the optimal weights of the base learners; the training process of the meta-model includes the following steps: The labeled power grid flow data is input into multiple heterogeneous base learners, and each base learner outputs a corresponding prediction result vector. Collect the prediction vectors of all base learners and their corresponding real traffic labels to construct a meta-model training set; The meta-model is trained using the prediction vectors of all base learners as input and the actual traffic labels as output. The meta-model is a linear regression model, a gradient boosting tree model, or a neural network model. The training objective is to minimize the overall prediction error of the ensemble model by learning to assign optimal weights to the predictions of each base learner.

8. The method for detecting malicious power grid traffic based on adaptive integration according to claim 1, characterized in that: It also includes a dynamic performance awareness mechanism based on proactive testing, including: The server periodically sends test traffic to the client's traffic detection module; The detection results are compared with the actual labels of the test traffic to obtain the current performance parameters; If the performance parameters do not meet the preset requirements, the server is triggered to re-execute the adaptive ensemble decision algorithm to generate a new optimal ensemble learning scheme.

9. A power grid malicious traffic detection system based on adaptive integration, used to implement the method as described in any one of claims 1-8, characterized in that, The system includes: The power grid traffic detection module is used to collect and extract non-load content features of power grid traffic data, and load and run the optimal integrated learning scheme to detect malicious traffic according to the configuration issued by the server. The non-load content features include at least one of connection metadata, handshake features, traffic time series features, and behavior graph features. When extracting the non-load content features, a load-aware dynamic sliding window mechanism is adopted to dynamically adjust the size of the data collection window according to the real-time traffic rate and the number of connections. The window size is reduced during peak traffic periods to ensure real-time performance, and increased during low traffic periods to accumulate more feature data. For the power grid flow data collected in each dynamic sliding window, an optimal ensemble learning scheme is generated using a complexity-aware gating decision mechanism in conjunction with the aforementioned adaptive ensemble decision algorithm. This specifically includes the following steps: Calculate the information entropy or feature dispersion of traffic characteristics to assess traffic complexity; If the traffic complexity is less than or equal to the preset complexity threshold, a lightweight base learner is selected to quickly detect the traffic. If the complexity of the traffic exceeds the preset complexity threshold, the complete adaptive ensemble model formed after loading the optimal ensemble learning scheme issued by the server will be used for in-depth analysis. The dynamic monitoring module is used to collect the resource usage status and service performance indicators of the client, and to send a policy update request to the server when there are significant changes. The detection and response module is used to trigger alarms and security response measures based on the results of malicious traffic detection. The base model management module is used to maintain and provide information on available base learners; The integration strategy management module is used to store historical integration strategies and their corresponding client status and performance metrics; The adaptive ensemble decision module is used to perform similarity queries or launch multi-objective optimization algorithms based on the status and requirements reported by the client, generate the optimal ensemble learning scheme, and send it to the client.

Images