Multi-modal attack identification method fusing BMama and difference to guide trans-attention

Abstract

The invention discloses a multi-modal attack identification method fusing BMama and difference to guide trans-attention, which comprises the following steps: simulating a false data injection attack, a denial of service attack, an address resolution protocol spoofing attack and a domain name system spoofing attack, collecting physical layer sensor data and network layer flow data, and preprocessing multi-modal data; bMama is constructed to perform dynamic time modeling on multi-modal data, a graph neural network is combined to adversariate a variational auto-encoder, features of a power grid system topology and a communication topology structure are fused, and robustness of potential representation is enhanced through adversarial training; the method comprises the following steps of: guiding feature complementary fusion by using modal difference through a difference guide iteration cross-attention fusion mechanism, improving the capability of distinguishing complex attacks, finally carrying out attack detection and classification on fused modals, and executing end-to-end optimization according to a weighted combination of loss of each part. The method can effectively detect and classify the multi-modal attack in the smart power grid, and enhances the safety and reliability of a complex system.

Description

Technical Field

[0001] This invention belongs to the technical field of power system network security, and mainly relates to a multimodal attack identification method that integrates BMamba and differentially guided cross-attention. Background Technology

[0002] With the rapid development of smart grids, power systems are increasingly characterized by high interconnectivity, digitalization, and networking. The close coupling between physical layer power equipment, control systems, and communication networks means that while smart grids improve operational efficiency, they also face higher cybersecurity risks. Multi-source heterogeneous attacks originating from both the physical and network layers are constantly emerging. Attackers can disrupt the normal operation of power systems by tampering with sensor data or network communication traffic, even triggering power outages or large-scale blackouts, causing severe economic losses and social impacts.

[0003] Existing attack detection and classification methods primarily focus on single-modal data analysis. One type of method relies on physical layer data, such as using state estimation residual analysis to achieve sensor anomaly detection and attack identification. Another type of method is based on network layer traffic characteristics, such as utilizing communication protocol behavior or deep packet inspection to achieve attack detection and classification. These methods can play a certain role at their respective layers, but they have significant shortcomings when dealing with cross-modal attacks.

[0004] To overcome the limitations of single-modal methods, some studies have proposed multimodal fusion strategies, utilizing data from both physical and network layers to improve detection and classification performance. However, existing multimodal methods generally suffer from the following prominent problems: First, their ability to extract temporal features is insufficient, relying heavily on traditional convolutional or recurrent structures, making it difficult to capture the complex long-term temporal dependencies in power system operation; second, their multimodal fusion methods are relatively crude, typically employing direct concatenation or simple attention mechanisms, failing to effectively utilize the differences and complementarities between physical and network layers, thus limiting detection and classification performance. Summary of the Invention

[0005] This invention addresses the problems existing in existing technologies by providing a multimodal attack identification method that integrates BMamba and differentially guided cross-attention. It simulates spoofing attacks, denial-of-service attacks, Address Resolution Protocol (ARP) spoofing attacks, and Domain Name System (DNS) spoofing attacks, collecting physical layer sensor data and network layer traffic data for preprocessing the multimodal data. A BMamba model is constructed to dynamically time-model the multimodal data, combined with a graph neural network adversarial variational autoencoder, fusing features of the power grid system topology and communication topology. Adversarial training enhances the robustness of the latent representation. A differentially guided iterative cross-attention fusion mechanism utilizes modal differences to guide complementary feature fusion, and adversarial learning is used for optimization to improve the ability to distinguish complex attacks. Finally, the fused modalities are used for attack detection and classification, and end-to-end optimization is performed based on a weighted combination of the losses of each component. This invention can effectively detect and classify multimodal attacks in smart grids, enhancing the security and reliability of complex systems.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: a multimodal attack identification method that integrates BMamba and difference-guided cross-attention, comprising the following steps:

[0007] S1: Simulate a fake data injection attack model and a denial-of-service attack model. Collect physical layer sensor data and network layer traffic data of the power system under various attacks by using the Address Resolution Protocol and Domain Name System spoofing attack model to construct cross-modal samples.

[0008] S2: Construct a BMamba time series model and use a bidirectional selective scanning mechanism to extract long-term temporal dependency features of physical layer and network layer data in step S1;

[0009] S3: Based on the graph neural network adversarial variational autoencoder model and combined with temporal features, extract the structural awareness features of the physical layer topology and network layer communication topology of the power system, and construct a multimodal global graph representation;

[0010] S4: Based on a difference-guided cross-attention fusion mechanism, the difference features of each modality relative to another modality are calculated. The cross-modal representation is gradually enhanced through an iterative update mechanism to obtain unified fusion features. A discriminator is introduced to perform adversarial training, optimize the latent representation distribution and enhance robustness.

[0011] S5: Input the fusion representation optimized in step S4 into the anomaly detection module and the attack classification module. Perform end-to-end optimization based on the weighted combination of reconstruction loss, adversarial loss, detection loss and classification loss to achieve the detection and classification of anomaly attacks.

[0012] As an improvement to the present invention, in step S1, the fake data injection attack is modeled as a random process following a Bernoulli distribution:

[0013] ,

[0014] in Indicates in The control variable for whether a fake data injection attack is launched at any given time, and the probability of such an attack. ;when At that time, the attacker will randomly add a Gaussian perturbation variable. Injected into the original measurement Measurement after the attack for

[0015] ,

[0016] in and These represent the deviation and standard deviation of the attack amplitude, respectively; when At that time, the system was not subjected to a spoofed data injection attack, and the sensor data remained intact. ;

[0017] The denial-of-service attack is modeled as a stochastic process following a Bernoulli distribution:

[0018] ,

[0019] in Indicates in The control variable for whether a denial-of-service attack is launched at any given time, and the probability of such an attack. ;when At that time, the attacker Constantly launching denial-of-service attacks, ;when At that time, the system is safe and the sensor data remains intact. .

[0020] As an improvement to the present invention, in step S2, the BMamba model is a model established by introducing a bidirectional selective scanning mechanism and a hardware awareness algorithm on the basis of Mamba. The bidirectional selective scanning mechanism specifically involves: at each time step... The model performs both forward and backward scans simultaneously, aggregating past and future information respectively. The final fused output is represented as follows:

[0021] ,

[0022] ,

[0023] ,

[0024] in and At time step The output features are obtained by aggregating forward and backward scans. Indicates fused output. It is the radius of the scanning window. It is the offset relative to the time step. and Inputs The dynamic convolution weights to be designed in the forward and backward scanning directions. This indicates element-wise multiplication.

[0025] As another improvement of the present invention, in step S2, the original input features of the physical layer and the network layer are... and Each is mapped to a unified high-dimensional space:

[0026] ,

[0027] ,

[0028] in Representation layer normalization to stabilize feature distribution, It is a projection operation with linear transformation;

[0029] Introducing depthwise separable convolution To enhance the interaction between channels within a mode, a nonlinear transformation is performed using the SiLU activation function to obtain a representation for each mode:

[0030] ;

[0031] Based on the BMamba model, Time-enhanced physical layer features and network layer features The calculation is as follows:

[0032] ,

[0033] .

[0034] As another improvement of the present invention, step S3 specifically includes the following steps:

[0035] S31: In the graph construction phase, a graph structure is established between physical modes based on the topology of the smart grid system. In the graph structure, nodes are buses, edges represent the power connection relationship between buses, and each node is associated with time-aligned multi-dimensional sensor features and used as input to the graph neural network.

[0036] S32: Global Graph Structure Generation Node Feature Matrix and adjacency matrix The input is fed into a graph neural network variational autoencoder model to extract latent representations. The graph neural network encoder applies multiple... Layers, generating potential means and logarithmic variance The latent representation is sampled as

[0037] .

[0038] As another improvement of the present invention, in step S4, the differential-guided cross-attention feature fusion mechanism specifically refers to: using physical modality features Main modality, network modality features For the auxiliary modality, the fused cross-attention features are obtained according to the following formula. :

[0039] ,

[0040] ,

[0041] ,

[0042] ,

[0043] in For key-value pairs, and It is a learnable parameter matrix. Indicates modal difference features The query vector mapped in the middle, It is the corresponding query projection matrix. and These are learnable residual weighting coefficients. and It is a learnable fusion coefficient. It is a feedforward network consisting of two fully connected layers. express The output weight matrix before the layer;

[0044] The enhanced iterative update mechanism for cross-modal representations is as follows: Let the number of iterations be... Then the first The output of the wheel is represented as:

[0045] ,

[0046] in and These represent the iterative cross-modal feature enhancement function and the difference-guided cross-attention feature fusion function, respectively. and This indicates the characteristics after fusion.

[0047] As another improvement of the present invention, in step S4, during the adversarial training of the discriminator, the reconstruction loss is specifically as follows:

[0048] ,

[0049] in and These are weighting coefficients. and These are the reconstructed node features and the adjacency matrix, respectively.

[0050] The specific losses incurred in combat are as follows:

[0051] ,

[0052] in The sample representation distribution obtained from the encoder's adversarial training. For the potential representation after fusion, For discrimination;

[0053] The final loss of the graph neural network adversarial variational autoencoder is:

[0054] ,

[0055] in The weighting coefficients are used to balance the effects of regularization.

[0056] As a further improvement of the present invention, in step S5, the detection loss specifically includes:

[0057] ,

[0058] in, The prediction output of the main detection head. To assist the detection head in predicting output, For real labels, To assist in detecting the binary cross-entropy of the branch, Consistency regularization of primary and secondary detection results and For the corresponding weights;

[0059] The classification loss is specifically as follows:

[0060] ,

[0061] in, The prediction output of the main classification head. To assist the prediction output of the classification head, Represents cross-entropy loss, Supervise the main category head, Provide auxiliary guidance, Consistency regularization of primary and secondary classification results. Represents cross-entropy loss, and For the corresponding weights.

[0062] Compared with existing technologies, this invention offers the following advantages: It employs BMamba time-series modeling, a graph neural network adversarial variational autoencoder, and a difference-guided cross-attention fusion mechanism to achieve multimodal attack detection and classification. The bidirectional selective scanning mechanism of the BMamba model effectively captures long-term temporal dependency features in power system operation. The graph neural network adversarial variational autoencoder not only extracts structure-aware features of the physical layer topology and network layer communication topology but also optimizes the latent representation distribution through adversarial training, enhancing the robustness and generalization ability of the representation. The difference-guided cross-attention mechanism utilizes intermodal differences for attention guidance, avoiding the problems of simple splicing or coarse fusion in existing methods, and achieving more efficient cross-modal information interaction. This invention significantly improves the detection accuracy and classification robustness of complex attacks in smart grids, enhancing the security and reliability of the system. Attached Figure Description

[0063] Figure 1 This is a flowchart of the steps of the method of the present invention;

[0064] Figure 2 This is a multimodal attack detection and evaluation diagram from the test examples of this invention;

[0065] Figure 3 This is a multimodal attack classification confusion matrix diagram in the test examples of this invention. Detailed Implementation

[0066] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0067] Example 1

[0068] A multimodal attack identification method that integrates BMamba and difference-guided cross-attention, such as Figure 1 As shown, it includes the following steps:

[0069] Step S1: Simulate fake data injection attacks, denial-of-service attacks, address resolution protocol spoofing attacks, and domain name system spoofing attacks, collect physical layer sensor data and network layer traffic data of the power system under various attacks, and construct cross-modal samples.

[0070] Fake data injection attack model: Fake data injection attacks are modeled as random processes following a Bernoulli distribution.

[0071] ,

[0072] in Indicates in The control variable for whether a fake data injection attack is launched at any given time, and the probability of such an attack. Consider an attacker launching a fake data injection attack in the sensor-to-controller communication channel: when At that time, the attacker will randomly add a Gaussian perturbation variable. Injected into the original measurement Measurement after the attack for

[0073] ,

[0074] in and These represent the deviation and standard deviation of the attack amplitude, respectively; when At that time, the system was not subjected to a spoofed data injection attack, and the sensor data remained intact. ;

[0075] Denial-of-Service Attack Model: Denial-of-service attacks are modeled as stochastic processes following a Bernoulli distribution.

[0076] ,

[0077] in Indicates in The control variable for whether a denial-of-service attack is launched at any given time, and the probability of such an attack. Consider an attacker launching a denial-of-service attack in the sensor-to-controller communication channel: when At that time, the attacker Constantly launching denial-of-service attacks, causing communication between the sensor and the controller to be blocked, i.e. ;when At that time, the system is safe and the sensor data remains intact, that is... ;

[0078] Address Resolution Protocol (ARP) spoofing attack model: Attackers forge ARP messages to replace the MAC address corresponding to the target IP address with their own MAC address, thereby intercepting or tampering with network traffic. When an attacker launches an ARP spoofing attack, the attacker claims to be a gateway or other legitimate device and sends fake ARP response messages to the target device, causing the target device to incorrectly route traffic to the attacker's host.

[0079] Domain Name System (DNS) spoofing attack model: Attackers forge DNS response packets to resolve specific domain names to IP addresses controlled by the attackers, thereby hijacking users' access to target services; when the target device initiates a DNS query, the attacker intercepts the query request and returns a spoofed response, mapping the target domain to a forged IP address. The attacked device sends traffic based on the incorrect DNS resolution, redirecting communication to a malicious endpoint, resulting in data theft.

[0080] Finally, physical layer sensor data and network layer traffic data are collected, and the multimodal data is preprocessed.

[0081] Step S2: Construct a BMamba time series model and use a bidirectional selective scanning mechanism to extract long-term temporal dependency features of physical layer and network layer data.

[0082] Mamba is a novel sequence modeling approach based on the state-space model. It introduces a bidirectional selective scanning mechanism and hardware-aware algorithms on top of Mamba to construct BMamba, thereby enhancing the model's ability to comprehensively model contextual information.

[0083] The state-space model is a dynamic time-domain model that can be represented in continuous form:

[0084] ,

[0085] ,

[0086] in These represent the system's state, input, and output, respectively. It is the model system matrix.

[0087] The projection matrix is ​​represented; a zero-order hold method is used for discretization to adapt to the training mechanism of the neural network.

[0088] ,

[0089] ,

[0090] in These represent the system state, input, and output in discrete time, respectively. For discrete time steps, These are the discrete-time system matrix, input matrix, and output projection matrix, respectively. This is a time-scale parameter.

[0091] Bidirectional selective scanning mechanism: at each time step The model performs both forward and backward scans simultaneously, aggregating past and future information respectively. The final fused output is represented as follows:

[0092] ,

[0093] ,

[0094] ,

[0095] in and At time step The output features are obtained by aggregating forward and backward scans. Indicates fused output. It is the radius of the scanning window. It is the offset relative to the time step. and Inputs The dynamic convolution weights to be designed in the forward and backward scanning directions. This indicates element-wise multiplication.

[0096] The raw input features of the physical layer and the network layer and Each is mapped to a unified high-dimensional space:

[0097] ,

[0098] ,

[0099] in Representation layer normalization to stabilize feature distribution, It is a projection operation with linear transformation.

[0100] Introducing depthwise separable convolution To enhance the interaction between channels within a mode, a nonlinear transformation is performed using the SiLU activation function to obtain a representation for each mode:

[0101] ;

[0102] Constructing BMamba models enhances the ability to comprehensively model contextual information. Time-enhanced physical layer features and network layer features The calculation is as follows:

[0103] ,

[0104] .

[0105] Step S3: Based on the graph neural network adversarial variational autoencoder model and combined with temporal features, extract the structural awareness features of the physical layer topology and network layer communication topology of the power system, and construct a multimodal global graph representation.

[0106] S31: In the graph construction phase, a graph structure is established between physical modes based on the topology of the smart grid system, where nodes are buses and edges represent the power connection relationships between buses. Each node is associated with time-aligned multi-dimensional sensor features and serves as the input to the graph neural network.

[0107] The network layer communication graph consists of nodes representing PLC control units, with the last node representing a potential attacker. The attacker node is connected to other nodes in the topology in the same way, avoiding the risk of structured information leakage and requiring the model to proactively identify potential threats through feature learning.

[0108] A timestamp-based cross-modal alignment mechanism is introduced to achieve joint modeling of physical and network modalities: First, timestamp sequences are extracted from sensor and network data and converted into standard UNIX time with second-level resolution. Then, a time window is defined, and the closest timestamp alignment is found for each sample in the modality. Finally, the matched pairs are used as cross-modal edges in the global graph to connect the time-corresponding nodes of each modality, maintaining the structural and temporal consistency of the global graph.

[0109] S32: Global Graph Structure Generation Node Feature Matrix and adjacency matrix The input is fed into a graph neural network variational autoencoder model to extract latent representations. The graph neural network encoder applies multiple... Layers, generating potential means and logarithmic variance The latent representation is sampled as

[0110] .

[0111] Step S4: Design a difference-guided cross-attention fusion mechanism, calculate the difference features of each modality relative to another modality, gradually enhance the cross-modal representation through an iterative update mechanism, and obtain unified fusion features; introduce a discriminator to perform adversarial training, optimize the latent representation distribution and enhance robustness.

[0112] Differential-guided cross-attention feature fusion mechanism: A difference-driven cross-attention mechanism is designed to simulate the complementarity and disalignment between modalities, guiding the master modality to absorb discriminative difference features from the auxiliary modality; using physical modality features... Main modality, network modality features Taking the auxiliary modality as an example, the fused cross-attention features are obtained according to the following formula. :

[0113] ,

[0114] ,

[0115] ,

[0116] ,

[0117] in For key-value pairs, and It is a learnable parameter matrix. Indicates modal difference features The query vector mapped in the middle, It is the corresponding query projection matrix. and These are learnable residual weighting coefficients. and It is a learnable fusion coefficient. It is a feedforward network consisting of two fully connected layers. express The output weight matrix before the layer.

[0118] Similarly, network modal features are constructed based on the above formula. Main, physical modal characteristics A secondary enhancement method is used to obtain the fused features. .

[0119] Iterative cross-modal feature enhancement mechanism with parameter sharing: Let the number of iterations be... Then the first The output of the wheel can be expressed as

[0120] ,

[0121] in and These represent the iterative cross-modal feature enhancement function and the difference-guided cross-attention feature fusion function, respectively. and Indicates the characteristics after fusion;

[0122] The fused latent representation The input is fed into the graph decoder to reconstruct node features and the adjacency matrix:

[0123] ;

[0124] Reconstruction loss is defined as

[0125] ,

[0126] in and It is the weighting coefficient.

[0127] Introducing an adversarial regularization mechanism promotes the regularity of the latent space and improves the robustness of anomaly detection and classification; the fused latent representation Input to discriminator In this process, the discriminator is trained to distinguish between latent vectors and those derived from standard Gaussian priors. The extracted samples are used to optimize the discriminator by maximizing the binary classification objective.

[0128] ,

[0129] in The sample representation distribution obtained by the encoder during adversarial training; simultaneously, the encoder misleads the discriminator by minimizing the adversarial loss:

[0130] ;

[0131] The final loss of the graph neural network adversarial variational autoencoder is:

[0132] ,

[0133] in The weighting coefficients are used to balance the effects of regularization.

[0134] Step S5: Input the adversarial-optimized fusion representation into the anomaly detection module and the attack classification module. Perform end-to-end optimization based on the weighted combination of reconstruction loss, adversarial loss, detection loss and classification loss to achieve the detection and classification of anomaly attacks.

[0135] Attack detection: for each potential representation Multi-head attention is used to capture cross-modal contextual dependencies, and enhanced features are input into the main detection head with anomaly probability scores:

[0136] ,

[0137] in This represents the main detection module, which consists of multiple layers of sensors. It uses the sigmoid activation function; additionally, an auxiliary detection head is introduced during training. Provides regularization and enhances stability.

[0138] The total detection loss is:

[0139] ,

[0140] in The prediction output of the main detection head. To assist the detection head in predicting output, For real labels, To assist in detecting the binary cross-entropy of the branch, Consistency regularization of primary and secondary detection results and For the corresponding weights.

[0141] Attack Classification: In Shared Latent Representation A two-branch mechanism was established, including a main classification head and an auxiliary classification head, to enhance the generalization ability and robustness under semi-supervised management; the main classification head... It is a two-layer fully connected network that generates the probability distribution of attack categories; auxiliary classification head. Provide auxiliary supervision during training; apply the softmax function to the outputs of the two classification heads to obtain the predicted probabilities:

[0142] ;

[0143] The total classification loss is:

[0144] ,

[0145] in The prediction output of the main classification head. To assist the prediction output of the classification head, Represents cross-entropy loss, Supervise the main category head, Provide auxiliary guidance, Consistency regularization of primary and secondary classification results. and For the corresponding weights;

[0146] Optimization: Optimize the following overall objective function:

[0147] .

[0148] Example 2

[0149] This embodiment considers the potential for spoofed data injection attacks, denial-of-service attacks, Address Resolution Protocol (ARP) spoofing attacks, and Domain Name System (DNS) spoofing attacks on the IEEE 14-bus system. A multimodal attack detection and classification method for smart grids, integrating BMamba and differentially guided cross-attention approaches, is presented, with the following specific steps:

[0150] Step S1: Simulate fake data injection attacks, denial-of-service attacks, address resolution protocol spoofing attacks, and domain name system spoofing attacks, collect physical layer sensor data and network layer traffic data of the IEEE 14-bus system under the four types of attacks, and construct cross-modal samples;

[0151] Fake data injection attack model: Fake data injection attacks are modeled as a stochastic process following a Bernoulli distribution, with the attack probability chosen... Gaussian random additive perturbation variable ;

[0152] Denial-of-Service Attack Model: Denial-of-service attacks are modeled as stochastic processes following a Bernoulli distribution, with the attack probability chosen... ;

[0153] Address Resolution Protocol (ARP) spoofing attack model: Attackers periodically send forged ARP response messages to the target device, causing it to incorrectly route data traffic to the attacker's host, thereby intercepting or tampering with network traffic;

[0154] Domain Name System (DNS) spoofing attack model: Attackers periodically send forged DNS response messages to resolve specific domain names to malicious IP addresses, thereby hijacking users' access to target services;

[0155] The above steps were performed, with a total simulation duration of 2100 seconds and a sampling interval of 1 second. Different types of attacks were prioritized according to their impact on the operation of the power system. Denial-of-service attacks were prioritized higher than spoofed data injection attacks because they could cause communication disruptions and system failures.

[0156] Collect physical layer sensor data, extracting features including voltage amplitude and phase angle, active and reactive power of generators, loads and transmission lines, and power loss of each bus transmission line; preprocess physical layer data: remove invalid values, normalize timestamps and measurements, and mark data subject to denial-of-service attacks as 0.

[0157] Collect network layer traffic data. Each captured data contains the following fields: timestamp, source IP address, destination IP address, source port number, destination port number, protocol, and information. Preprocess the network layer traffic data: normalize the timestamp and port number, map the IP address to an integer, use the information field for keyword identification, and use numerical encoding for the protocol type.

[0158] Step S2: Construct a BMamba time series model and use a bidirectional selective scanning mechanism to extract long-term temporal dependency features of physical layer and network layer data. This includes the following steps:

[0159] Step S21: As described in Example 1, construct the BMamba model and select... , , , , , ;

[0160] Step S22: Combine the original input features of the physical layer and the network layer and Each is mapped to a unified high-dimensional space; SiLU activation function and depthwise separable convolution are used. Perform a nonlinear transformation to calculate the representation of each mode, and calculate in Physical layer features enhanced by the BMamba model at all times and network layer features .

[0161] Step S3: Based on the graph neural network adversarial variational autoencoder model and combined with temporal features, extract the structure-aware features of the physical layer topology and network layer communication topology of the power system, and construct a multimodal global graph representation, which specifically includes the following steps:

[0162] Step S31: In the graph construction phase, a graph structure is established between physical modes based on the IEEE 14-bus system topology, where nodes are buses, edges represent the power connection relationships between buses, each node is associated with time-aligned multidimensional sensor features, and serves as the input to the graph neural network; the last node of the network layer communication graph represents a potential attacker, and the attacker node is connected to other nodes in the topology in the same way.

[0163] A timestamp-based cross-modal alignment mechanism is used to achieve joint modeling of physical and network modalities: First, timestamp sequences are extracted from sensor and network data and converted into standard UNIX time with second-level resolution. Then, a time window is defined, and the closest timestamp alignment is found for each sample in the modality. Finally, the matched pairs are used as cross-modal edges in the global graph to connect the time-corresponding nodes of each modality, maintaining the structural and temporal consistency of the global graph.

[0164] Step S32: Generate node feature matrix for global graph structure and adjacency matrix The input is fed into a graph neural network variational autoencoder model to extract latent representations. The graph neural network encoder applies multiple... Layer, calculate the potential mean and logarithmic variance .

[0165] Step S4: Design a difference-guided cross-attention fusion mechanism, calculate the difference features of each modality relative to another modality, gradually enhance the cross-modal representation through an iterative update mechanism, and obtain unified fusion features; introduce a discriminator to perform adversarial training, optimize the latent representation distribution and enhance robustness, specifically including the following steps:

[0166] Step S41: Differential-guided cross-attention feature fusion mechanism: using physical modality features Main modality, network modality features Taking the auxiliary modality as an example, we obtain the fused cross-attention features. ;

[0167] Similarly, constructing network modal features Main, physical modal characteristics A secondary enhancement method is used to obtain the fused features. ;

[0168] Step S42: Iterative cross-modal feature enhancement mechanism with parameter sharing: Let the number of iterations be... Calculate the first Wheel output ;

[0169] Step S43: Combine the fused latent representations The data is input into the graph decoder to reconstruct node features and adjacency matrices, calculate the reconstruction loss, and select weight coefficients. ;

[0170] Introducing an adversarial regularization mechanism promotes the regularity of the latent space and improves the robustness of anomaly detection and classification; the fused latent representation Input to discriminator In this process, the discriminator is trained to distinguish between latent vectors and those derived from standard Gaussian priors. The extracted samples are used to optimize the discriminator by maximizing the binary classification objective; simultaneously, the encoder misleads the discriminator by minimizing the adversarial loss, calculating the final loss of the graph neural network adversarial variational autoencoder, and selecting weighting coefficients. .

[0171] Step S5: Input the adversarial-optimized fusion representation into the anomaly detection module and the attack classification module. Perform end-to-end optimization based on the weighted combination of reconstruction loss, adversarial loss, detection loss, and classification loss to achieve the detection and classification of anomaly attacks.

[0172] Attack detection: for each potential representation Multi-head attention is used to capture cross-modal contextual dependencies, and enhanced features are input into a main detection head with anomaly probability scores; the total detection loss is calculated, and weight coefficients are selected. ;

[0173] Attack Classification: Input the detected data into the main classification head and the auxiliary classification head. Apply the softmax function to the outputs of the two classification heads to obtain the corresponding predicted probabilities. Calculate the total classification loss and select the weighting coefficients. ;

[0174] Optimization: Optimize the overall objective function.

[0175] Figure 2 This is the multimodal attack detection evaluation graph for this example. The results show that the method of the present invention has high detection accuracy. The score was 0.9825, the detection accuracy was 98.49%, the precision was 99.65%, and the recall was 96.29%. Figure 3 This is the multimodal attack classification confusion matrix diagram of this example. The method of this invention achieves high classification performance. The higher the concentration of correct classifications on the diagonal, the stronger the recognition ability across attack types. In terms of error distribution, the misclassification of the method of this invention is limited and mainly occurs between semantically similar attack types, highlighting the effectiveness of its multimodal fusion and cross-attention design.

[0176] In summary, this invention integrates BMamba temporal modeling, graph neural network adversarial variational autoencoders, and differentially guided cross-attention mechanisms to achieve deep joint modeling of multimodal data at the physical and network layers. Compared with existing methods, it can more accurately detect and classify complex attacks, effectively improving detection accuracy and classification robustness. It is suitable for large-scale smart grid security protection and has strong practical value and promotion significance.

[0177] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A multimodal attack identification method integrating BMamba and difference-guided cross-attention, characterized in that, Includes the following steps: S1: Simulate a fake data injection attack model and a denial-of-service attack model. Collect physical layer sensor data and network layer traffic data of the power system under various attacks by using the Address Resolution Protocol and Domain Name System spoofing attack model to construct cross-modal samples. S2: Construct a BMamba time series model and use a bidirectional selective scanning mechanism to extract long-term temporal dependency features of physical layer and network layer data in step S1; S3: Based on the graph neural network adversarial variational autoencoder model and combined with temporal features, extract the structural awareness features of the physical layer topology and network layer communication topology of the power system, and construct a multimodal global graph representation; S4: Based on a difference-guided cross-attention fusion mechanism, the difference features of each modality relative to another modality are calculated, and the cross-modal representation is gradually enhanced through an iterative update mechanism to obtain unified fusion features; A discriminator is introduced to perform adversarial training, which optimizes the latent representation distribution and enhances robustness; S5: Input the fusion representation optimized in step S4 into the anomaly detection module and the attack classification module. Perform end-to-end optimization based on the weighted combination of reconstruction loss, adversarial loss, detection loss and classification loss to achieve the detection and classification of anomaly attacks.

2. The multimodal attack identification method integrating BMamba and differentially guided cross-attention as described in claim 1, characterized in that: In step S1, the fake data injection attack is modeled as a random process following a Bernoulli distribution: ； in Indicates in The control variable for whether a fake data injection attack is launched at any given time, and the probability of such an attack. ;when At that time, the attacker will randomly add a Gaussian perturbation variable. Injected into the original measurement Measurement after the attack for ； in and These represent the deviation and standard deviation of the attack amplitude, respectively; when At that time, the system was not subjected to a spoofed data injection attack, and the sensor data remained intact. ; The denial-of-service attack is modeled as a stochastic process following a Bernoulli distribution: ； in Indicates in The control variable for whether a denial-of-service attack is launched at any given time, and the probability of such an attack. ;when At that time, the attacker Constantly launching denial-of-service attacks, ;when At that time, the system is safe and the sensor data remains intact. .

3. The multimodal attack identification method fusing BMamba and differentially guided cross-attention as described in claim 1 or 2, characterized in that: In step S2, the BMamba model is a model built on top of Mamba by introducing a bidirectional selective scanning mechanism and a hardware awareness algorithm. Specifically, the bidirectional selective scanning mechanism involves: at each time step... The model performs both forward and backward scans simultaneously, aggregating past and future information respectively. The final fused output is represented as follows: ； ； ； in and At time step The output features are obtained by aggregating forward and backward scans. Indicates fused output. It is the radius of the scanning window. It is the offset relative to the time step. and Inputs The dynamic convolution weights to be designed in the forward and backward scanning directions. This indicates element-wise multiplication.

4. The multimodal attack identification method integrating BMamba and differentially guided cross-attention as described in claim 3, characterized in that: In step S2, the original input features of the physical layer and the network layer are... and Each is mapped to a unified high-dimensional space: ； ； in Representation layer normalization to stabilize feature distribution, It is a projection operation with linear transformation; Introducing depthwise separable convolution To enhance the interaction between channels within a mode, a nonlinear transformation is performed using the SiLU activation function to obtain a representation for each mode: ； Based on the BMamba model, Time-enhanced physical layer features and network layer features The calculation is as follows: ； 。 5. The multimodal attack identification method integrating BMamba and differentially guided cross-attention as described in claim 1, characterized in that... Step S3 specifically includes the following steps: S31: In the graph construction phase, a graph structure is established between physical modes based on the topology of the smart grid system. In the graph structure, nodes are buses, edges represent the power connection relationship between buses, and each node is associated with time-aligned multi-dimensional sensor features and used as input to the graph neural network. S32: Global Graph Structure Generation Node Feature Matrix and adjacency matrix The input is fed into a graph neural network variational autoencoder model to extract latent representations. The graph neural network encoder applies multiple... Layers, generating potential means and logarithmic variance The latent representation sampling is: 。 6. The multimodal attack identification method integrating BMamba and differentially guided cross-attention as described in claim 1, characterized in that: In step S4, the differential-guided cross-attention feature fusion mechanism specifically involves: using physical modality features Main modality, network modality features For the auxiliary modality, the fused cross-attention features are obtained according to the following formula. : ； ； ； ； in For key-value pairs, and It is a learnable parameter matrix. Indicates modal difference features The query vector mapped in the middle, It is the corresponding query projection matrix. and These are learnable residual weighting coefficients. and It is a learnable fusion coefficient. It is a feedforward network consisting of two fully connected layers. express The output weight matrix before the layer; The enhanced iterative update mechanism for cross-modal representations is as follows: Let the number of iterations be... Then the first The output of the wheel is represented as: ； in and These represent the iterative cross-modal feature enhancement function and the difference-guided cross-attention feature fusion function, respectively. and This indicates the characteristics after fusion.

7. The multimodal attack identification method integrating BMamba and differentially guided cross-attention as described in claim 6, characterized in that: In step S4, during the adversarial training of the discriminator, the reconstruction loss is specifically as follows: ； in and These are weighting coefficients. and These are the reconstructed node features and the adjacency matrix, respectively. The specific losses incurred in combat are as follows: ； in The sample representation distribution obtained from the encoder's adversarial training. For the potential representation after fusion, For discrimination; The final loss of the graph neural network adversarial variational autoencoder is: ； in The weighting coefficients are used to balance the effects of regularization.

8. The multimodal attack identification method integrating BMamba and differentially guided cross-attention as described in claim 7, characterized in that: In step S5, the loss detection specifically involves: ； in, The prediction output of the main detection head. To assist the detection head in predicting output, For real labels, To assist in detecting the binary cross-entropy of the branch, Consistency regularization of primary and secondary detection results and For the corresponding weights; The classification loss is specifically as follows: ； in, The prediction output of the main classification head. To assist the prediction output of the classification head, Represents cross-entropy loss, Supervise the main category head, Provide auxiliary guidance, Consistency regularization of primary and secondary classification results. and For the corresponding weights.

Images