Power network attack identification method, system and device based on quantum convolutional neural network, and storage medium

Abstract

The invention relates to the technical field of quantum computing, in particular to a power network attack recognition method, system and device based on a quantum convolutional neural network and a storage medium. According to the method, power network attack event data is acquired, a standardized data set is constructed, a feature optimization model is constructed by applying a genetic algorithm, network attack features are dynamically screened based on a fitness evaluation strategy, and an optimal feature combination is obtained; constructing a quantum convolutional neural network classification model, and taking the quantum convolutional neural network classification model as a classification performance evaluation module in the fitness evaluation strategy; performing feature extraction and classification identification through a quantum convolutional neural network classification model in combination with the optimal feature combination to obtain attack type probability distribution; and based on the attack type probability distribution, determining a power network attack type and generating security early warning information. The parallelism and entanglement characteristics of quantum calculation are fully utilized, and the technical problems of a traditional method in the aspects of high-dimensional feature selection and complex attack recognition are solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of quantum computing, and in particular to a power network attack identification method, system, device and storage medium based on a quantum convolutional neural network. BACKGROUND

[0002] With the rapid development and wide application of smart grid technology, power networks are facing increasingly complex network security threats. Traditional power systems are gradually transforming into digital and networked systems, and the large-scale access of various communication protocols and intelligent devices significantly expands the attack surface of the power grid system. Network attackers exploit system vulnerabilities to carry out malicious behaviors such as denial-of-service attacks and false data injection attacks, which seriously threaten the safe and stable operation of the power system.

[0003] Currently, power network security protection mainly relies on traditional machine learning methods for attack detection. Support vector machine algorithm realizes binary classification by constructing a split hyperplane, but its classification effect is heavily dependent on kernel function selection, and it is difficult to train in high-dimensional complex data scenarios. Although the decision tree algorithm has good interpretability, it is easily affected by non-representative samples, resulting in overfitting problems and insufficient model generalization ability. Deep learning methods such as LSTM network can handle time series data, but there are still limitations in feature selection and computational efficiency.

[0004] Existing attack detection methods generally have high feature redundancy, cannot effectively handle high-dimensional nonlinear data, and have large computational complexity. Traditional methods have difficulty in accurately distinguishing between normal traffic and abnormal traffic when facing mixed attack types, resulting in high false positive and false negative rates. At the same time, most existing algorithms perform statistical analysis in the time domain, lacking consideration of network attack continuity and autocorrelation characteristics, affecting detection accuracy and real-time performance. SUMMARY

[0005] In view of the problems existing in the prior art, the present application is proposed.

[0006] Therefore, the problem to be solved by the present application is how to solve the technical problems of inaccurate feature selection, low computational efficiency, and insufficient multi-type attack recognition capability in existing power network attack detection technology. By introducing a genetic algorithm to optimize the feature selection process and combining the parallel computing advantages of quantum convolutional neural networks, efficient and accurate identification of power network attacks is achieved, and the level of power grid security protection is improved.

[0007] To solve the above technical problems, the present application provides the following technical solutions:

[0008] In a first aspect, the embodiments of the present application provide a power network attack identification method based on a quantum convolutional neural network, which comprises: acquiring power network attack event data and constructing an attack event dataset, constructing a feature optimization model through a genetic algorithm, dynamically screening network attack features based on an adaptability evaluation strategy, and obtaining an optimal feature combination;

[0009] constructing a quantum convolutional neural network classification model and taking the quantum convolutional neural network classification model as a classification performance evaluation module in the adaptability evaluation strategy;

[0010] combining the optimal feature combination, performing feature extraction and classification identification through the quantum convolutional neural network classification model, and obtaining an attack type probability distribution;

[0011] determining a power network attack type and generating security warning information based on the attack type probability distribution.

[0012] As a preferred scheme of the power network attack identification method based on the quantum convolutional neural network, the acquiring of the power network attack event data and the construction of the standardized dataset comprises: collecting attack event data in real time from network traffic monitoring, behavior analysis and intrusion detection systems; extracting network features, protocol features and behavior features; and performing numerical coding and format standardization processing on the extracted features.

[0013] As a preferred scheme of the power network attack identification method based on the quantum convolutional neural network, the constructing of the feature optimization model through the genetic algorithm comprises: randomly generating an initial population, and representing each individual as a feature selection scheme in a binary coding manner; constructing a comprehensive adaptability function based on classification accuracy, feature redundancy and feature quantity; and performing iterative evolution through selection, crossover and mutation operations to screen out a feature combination with the highest adaptability.

[0014] The preferred technical scheme has the beneficial effects that: the genetic algorithm is used to construct the feature optimization model, thereby solving the technical problems of low search efficiency and easy falling into local optimization in a high-dimensional feature space in the early feature selection stage. The binary coding manner can flexibly represent any feature combination scheme, thereby providing sufficient search space for the algorithm; the design of the comprehensive adaptability function simultaneously considers three key dimensions of classification accuracy, feature redundancy and feature quantity, thereby ensuring that the screened feature combination has high discriminability and avoids the interference of redundant features, and improving the training efficiency of a subsequent classification model; in the optimization process, the iterative evolution mechanism of the selection, crossover and mutation operations can continuously improve the quality of the feature combination; and in the final output stage, the obtained optimal feature combination provides a simplified input for the quantum neural network, thereby greatly reducing the computational complexity.

[0015] As a preferred scheme of the power network attack identification method based on the quantum convolutional neural network, the quantum convolutional neural network classification model is constructed, and the classical feature data is converted into a quantum state through a quantum coding method.

[0016] The quantum convolutional layer is constructed, the quantum entanglement and nonlinear transformation between features are realized by using the parameterized quantum circuit, the quantum pooling layer is set, the quantum state dimension reduction is realized by the controlled measurement operation, and the quantum fully connected layer is configured to map the extracted quantum features and adjust the feature distribution.

[0017] As a preferred scheme of the power network attack identification method based on the quantum convolutional neural network, the fitness evaluation strategy includes three evaluation dimensions of classification performance, feature redundancy and feature quantity.

[0018] The beneficial effects of the preferred technical scheme are that: by constructing the quantum convolutional neural network classification model, the quantum coding method is used to convert the classical feature data into a quantum state in the early data processing stage, realizing the quantization of data representation; in the feature extraction process, the quantum convolutional layer realizes the quantum entanglement and nonlinear transformation between features through the parameterized quantum circuit, fully utilizes the quantum superposition and entanglement characteristics to capture complex nonlinear relationships, and improves the recognition ability of mixed attack types; the quantum pooling layer realizes the quantum state dimension reduction through the controlled measurement operation, reduces the calculation complexity while retaining the key information; in the final classification decision stage, the quantum fully connected layer realizes the global mapping and distribution adjustment of the quantum features, ensuring the accuracy and stability of the classification results.

[0019] As a preferred scheme of the power network attack identification method based on the quantum convolutional neural network, the fitness evaluation strategy includes three evaluation dimensions of classification performance, feature redundancy and feature quantity.

[0020] As a preferred scheme of the power network attack identification method based on the quantum convolutional neural network, the fitness evaluation strategy includes three evaluation dimensions of classification performance, feature redundancy and feature quantity.

[0021] In a second aspect, the embodiments of the present application provide a power network attack identification system based on a quantum convolutional neural network, which comprises a data acquisition module for acquiring power network attack event data and constructing a standardized data set.

[0022] a feature optimization module, configured to construct a feature optimization model through a genetic algorithm, dynamically screen network attack features based on a fitness evaluation strategy, and obtain an optimal feature combination;

[0023] a classification and identification module, configured to construct a quantum convolutional neural network classification model, perform feature extraction and classification and identification in combination with the optimal feature combination, and obtain an attack type probability distribution;

[0024] a warning generation module, configured to determine a power network attack type based on the attack type probability distribution and generate security warning information.

[0025] In a third aspect, an embodiment of the present application provides a computer device, including a memory and a processor, and the memory stores a computer program, wherein the computer program instructions are executed by the processor to implement the steps of the power network attack identification method based on the quantum convolutional neural network.

[0026] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, wherein the computer program instructions are executed by the processor to implement the steps of the power network attack identification method based on the quantum convolutional neural network.

[0027] The present application has the following beneficial effects: in the early data processing stage, through multi-source data fusion and standardized preprocessing, the technical problems of scattered power network attack data sources and non-uniform formats are solved; in the feature optimization stage, the introduction of the genetic algorithm breaks through the limitations of traditional feature selection methods, automatically selects the most discriminative feature combination through the evolutionary search mechanism, avoids feature redundancy, and improves the model training efficiency and classification accuracy; in the core classification stage, the quantum convolutional neural network fully utilizes the parallelism and entanglement characteristics of quantum computing, can handle high-dimensional nonlinear feature relationships that are difficult to solve by traditional methods, and has much higher recognition ability for complex mixed attack types than traditional machine learning methods; in the warning decision stage, the hierarchical response mechanism and intelligent threshold setting ensure the differential processing of attacks with different damage levels, and improve the pertinence and efficiency of emergency response. BRIEF DESCRIPTION OF DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0029] Figure 1 Flowchart of the power network attack identification method based on the quantum convolutional neural network;

[0030] Figure 2 A computer device diagram for a power network attack identification method based on a quantum convolutional neural network;

[0031] Figure 3 Another flowchart for a power network attack identification method based on a quantum convolutional neural network;

[0032] Figure 4 A quantum convolutional neural network classification model construction diagram for a power network attack identification method based on a quantum convolutional neural network. DETAILED DESCRIPTION

[0033] In order to make the above objectives, features and advantages of the present application more apparent, specific embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0034] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, but the present application can also be implemented in other ways different from the description, and those skilled in the art can make similar generalizations without departing from the spirit of the present application, so the present application is not limited to the specific embodiments disclosed below.

[0035] Secondly, the "one embodiment" or "embodiment" referred to herein means that the specific features, structures or characteristics can be included in at least one implementation of the present application. "In one embodiment" appearing in different places in the specification does not mean the same embodiment, nor does it mean an embodiment that is separate or selectively excluded from other embodiments.

[0036] Embodiment 1

[0037] Reference Figure 1 - Figure 4 For the first embodiment of the present application, the embodiment provides a power network attack identification method based on a quantum convolutional neural network, comprising,

[0038] S100: Obtain power network attack event data and construct an attack event data set, construct a feature optimization model through a genetic algorithm, dynamically filter network attack features based on an adaptability evaluation strategy, and obtain an optimal feature combination;

[0039] S200: Construct a quantum convolutional neural network classification model, and use the quantum convolutional neural network classification model as a classification performance evaluation module in the adaptability evaluation strategy;

[0040] S300: Combine the optimal feature combination, perform feature extraction and classification identification through the quantum convolutional neural network classification model, and obtain an attack type probability distribution;

[0041] S400: Determine the power network attack type based on the attack type probability distribution and generate security warning information.

[0042] It should be noted that the security of the power network as a key infrastructure is directly related to social stability and economic development. Under the environment of smart grid, traditional network attack detection methods face challenges such as high data dimension, complex attack types, strict real-time requirements, etc. Existing machine learning methods are prone to dimension disaster when dealing with high-dimensional features, while deep learning methods can automatically extract features, but still have deficiencies in feature selection accuracy and computational efficiency. The parallelism and quantum entanglement characteristics of quantum computing provide a new way to solve these problems, which can improve the computational efficiency while ensuring the detection accuracy.

[0043] Therefore, in view of the above-mentioned problems of power network attack detection, through the steps of S100-S400, a complete attack identification system is constructed. First, the global search ability of genetic algorithm is used to select the most discriminative feature combination from the massive network features, avoiding the local optimal problem of traditional feature selection methods; then the quantum parallelism and entanglement characteristics of quantum convolutional neural network are used to realize efficient modeling of complex nonlinear relationship and improve the recognition ability of mixed attack types; finally, through the probability distribution output and threshold determination, the accurate identification and timely warning of power network attacks are realized.

[0044] Embodiment 2

[0045] Reference Figure 2 - Figure 4 This is the second embodiment of the present application.

[0046] In this embodiment, the acquisition of power network attack event data and the construction of standardized data set in step S100 include the following steps A1-A2:

[0047] A1: Collect attack event data in real time from network flow monitoring, behavior analysis and intrusion detection system; extract network features, protocol features and behavior features; perform numerical encoding and format standardization processing on the extracted features.

[0048] Specifically, using network traffic monitoring, behavior analysis and intrusion detection system (IDS) and other technologies, attack event data is collected in real time from network traffic logs, system logs and alarm information of security devices, and stored in an attack event database, which contains attack time, source IP, destination IP, protocol type, port information, attack category and other key information to ensure the comprehensiveness of the data. Then the data format needs to be standardized, and data from different sources needs to be converted to a unified CSV format for subsequent processing operations. In addition, key features are preliminarily selected from attack traffic logs and system behavior records, including network features (packet size, connection duration, traffic rate), protocol features (TCP flag, HTTP request mode, DNS query record), and behavior features (multiple failed login attempts, port scanning behavior). Finally, in order to make the data available for subsequent model processing, the extracted features are numerically valued and encoded. For numerical features (such as traffic size, connection number), normalization (such as Min-Max Scaling) is used to map them to the [0, 1] interval. For categorical features (such as protocol type, attack type), One-Hot encoding is used to convert different categories into binary vectors. Finally, all features are converted to fixed-length vector format suitable for calculation and processing, and the preprocessed data is stored in a standardized database to provide data support for subsequent network attack identification.

[0049] A2: Constructing a feature optimization model by genetic algorithm includes randomly generating an initial population, each individual representing a feature selection scheme in binary encoding; constructing a comprehensive fitness function based on classification accuracy, feature redundancy and feature number; iterating evolution through selection, crossover and mutation operations to select the highest fitness feature combination.

[0050] Specifically, after data collection and preprocessing, genetic algorithm (GA) is used to select features from attack event data to optimize the performance of the classification model. The goal of genetic algorithm is to select a group of most representative features from a large number of network attack features that can distinguish different attack types to improve classification accuracy while reducing redundant features and computational overhead. First, an initial population is randomly generated, and each individual represents a feature selection scheme in binary encoding, where 1 represents the feature is selected and 0 represents the feature is not selected. The features in the individual may include packet size, traffic direction, traffic rate, TCP flag, etc.

[0051] Then a fitness function is defined to measure the survival advantage of each individual in the population, the higher the fitness value, the more adaptive the individual to the environment, the more likely to be retained for the next generation of genetic, so as to select the most characteristic combination of features reflecting the characteristics of different attack types, in the design of fitness function, the classification performance, feature redundancy and feature number are considered. Among them, the classification performance is evaluated by training the classification model and calculating the classification accuracy; the feature redundancy is measured by calculating the Pearson correlation coefficient to measure the correlation between features, and the individuals with larger redundancy are punished; the feature number is to prevent the model from being too complex by imposing constraints on the total number of selected features. The fitness function is expressed as follows:

[0052] Fitness = a x classification score - b x redundancy score - g x feature score

[0053] Among them, classification score represents the classification performance score, redundancy score represents the feature redundancy penalty, feature score represents the feature number penalty, a, b, g are weight coefficients, controlling the influence of different parts on the function.

[0054] In the evolution process of genetic algorithm, there are three processes selection, crossover and mutation. First, the Roulette Wheel Selection method is used to select individuals with higher fitness as parents, then Single Point Crossover operation is performed, that is, a random crossover point is selected to exchange part of the features to generate new individuals and enhance the diversity of the population, and random mutation is applied to the individuals after crossover to flip some gene positions (i.e. feature selection state) with a certain probability to enhance the diversity of the population and avoid local optimum; after multiple iterations, the individual with the highest fitness is obtained, that is, the optimal feature subset, and the feature index corresponding to the subset is extracted as the input of the subsequent attack recognition model to improve the classification accuracy and reduce the computational overhead, ensuring the efficiency and scalability of the detection system.

[0055] In an optional embodiment, in step S100, the power network attack event data is acquired and the standardized data set is constructed, and a protocol anomaly detection mechanism is established based on the communication mode of industrial control protocols such as MODBUS, DNP3, IEC61850, etc., combined with deep packet detection technology, attack features at the protocol level are extracted, such as abnormal function code, register address access mode, communication frequency anomaly, etc., a special attack feature library for power industrial control protocols is constructed, and it is suitable for more accurate power system attack detection scenarios.

[0056] In another optional embodiment, in step S100, the power network attack event data is acquired and the standardized data set is constructed, and a distributed data fusion method of federated learning is used to share knowledge under the premise of protecting data privacy by using historical attack data of multiple power enterprises, such as intrusion logs, security event records, and threat intelligence information of different regional power grids, to construct a more comprehensive attack event data set and improve the generalization ability of the model to unknown attack types.

[0057] In the embodiment, in step S200, the quantum convolutional neural network classification model is constructed, including the following steps B1-B2:

[0058] B1: converting classical feature data into quantum states by a quantum encoding method;

[0059] constructing a quantum convolutional layer to realize quantum entanglement and nonlinear transformation between features by using a parameterized quantum circuit;

[0060] setting a quantum pooling layer to realize quantum state dimension reduction by a controlled measurement operation;

[0061] configuring a quantum fully connected layer to map the extracted quantum features and adjust the feature distribution.

[0062] Specifically, the quantum convolutional neural network (Quantum Convolutional Neural Network, QCNN) is a model combining quantum computing and deep learning, which aims to use the parallelism and quantum entanglement characteristics of quantum computing to improve feature extraction and classification performance. QCNN mainly consists of an input layer, a quantum convolutional layer, a quantum pooling layer, a quantum fully connected layer, and an output layer. First, in the input layer, a quantum encoding (Quantum Encoding) method is used to convert traditional data into quantum states, that is, given a feature vector An angle encoding (Angle Encoding) method is used to map it to a quantum state:

[0063]

[0064] where x iis the input feature, |i> is the computational basis state; in the quantum convolution layer, a parameterized quantum circuit (PQC) is constructed, which realizes the nonlinear transformation of data by quantum gates and the entanglement between features by controlled gates. The quantum convolution operation can be expressed as:

[0065]

[0066] where R y (θ i ) is a rotation gate, and CNOT(i, i+1) is connected to the entanglement between the quantum bits, capturing the complex correlation between features; then in the quantum pooling layer, dimensionality reduction is performed by discarding part of the quantum bits, and controlled measurement operation is applied:

[0067]

[0068] where M represents the measurement value after pooling, and only specific quantum bit states are retained to reduce the amount of calculation; then in the quantum fully connected layer, the extracted features are mapped by additional quantum gate operations, and the feature distribution is further adjusted by the parameterized rotation gate; finally, in the output layer, the measurement operation is performed to convert the quantum state into a classical probability distribution, and the cross-entropy loss function is used for optimization:

[0069]

[0070] where C represents the number of categories, y i is the true label, is the predicted probability value. In the training process, the gradient descent is used to optimize the parameters of the quantum circuit. Therefore, the quantum convolutional neural network, as a model that can evaluate the classification performance of different feature combinations in the fitness function design, inputs the initial population into the model, and outputs the classification accuracy of different feature combinations, which is used as the classification performance score of the fitness function of the genetic algorithm.

[0071] B2: The fitness evaluation strategy includes comprehensive consideration of three evaluation dimensions of classification performance, feature redundancy and feature number.

[0072] Specifically, the classification performance evaluation adopts multi-index comprehensive evaluation, including accuracy, precision, recall, F1 score and AUC value. To ensure the reliability of the evaluation, stratified k-fold cross-validation method is adopted to ensure the consistency of the proportion of each type of sample in each fold. The feature redundancy evaluation is realized by constructing a feature correlation matrix to calculate the linear and nonlinear correlation between features. The linear correlation adopts the Pearson correlation coefficient, and the nonlinear correlation adopts the mutual information and distance correlation coefficient. For the feature pairs with element values exceeding the threshold value in the correlation matrix, a quadratic penalty is imposed in the fitness function. The feature number control is realized by a piecewise linear function. When the number of features is within a reasonable range, the fitness function remains stable; when the number of features is too large, the fitness value decays exponentially.

[0073] The weight parameters of the fitness function adopt an adaptive adjustment strategy, which dynamically adjusts the weights according to the distribution characteristics of the population in the evolution process. In the early stage of evolution, the weight of diversity preservation is increased to promote the exploration of the population; in the later stage of evolution, the weight of convergence is increased to accelerate the algorithm to approach the optimal solution. A statistical monitoring mechanism of fitness value is established to track the trend of optimal value, average value and variance, providing a basis for parameter adjustment.

[0074] In an optional implementation, in the step S200 of constructing the quantum convolutional neural network classification model, a variational quantum feature mapping mechanism can also be introduced to map the classical feature space to a high-dimensional quantum Hilbert space through a trainable quantum parameterized circuit, capture nonlinear feature relationships using quantum kernel methods, combine the classification boundary optimization strategy of classical support vector machines, and construct a hybrid quantum-classical classifier to improve the stability of classification decisions while maintaining the advantages of quantum computing.

[0075] In another optional implementation, in the step S200 of constructing the quantum convolutional neural network classification model, a hierarchical design strategy of quantum circuits can also be adopted, shallow quantum circuits are used for local feature extraction, and deep quantum circuits are used for global feature fusion. Gradient distillation technology is used to transfer the knowledge of deep networks to shallow networks to reduce the demand for quantum resources while maintaining model performance, which is suitable for the actual deployment of current medium-scale quantum devices in the presence of noise.

[0076] In the embodiment, in the step S300 of combining the optimal feature combination, feature extraction and classification recognition are performed through the quantum convolutional neural network classification model, including the following steps C1-C3:

[0077] C1: input the optimal feature combination into the quantum convolutional neural network classification model for forward propagation;

[0078] C2: use an activation function to calculate the probability distribution of each attack type at the output layer;

[0079] C3: determining an attack type classification result according to the probability distribution.

[0080] Specifically, the forward propagation process first normalizes the input optimal feature combination to ensure that the numerical ranges of the features are consistent. The feature vector is converted into a quantum state through a quantum encoding layer, and each feature value corresponds to a rotation angle of a quantum bit. The quantum convolution layer transforms the quantum state through a parameterized quantum circuit, which includes parallel processing of multiple convolution kernels. Each convolution kernel corresponds to a different combination of quantum gates and can extract different levels of feature patterns. The convolution operation uses a sliding window mechanism, and the window size is adaptively adjusted according to the feature type. For time series features, a larger window size is used to capture long-term dependencies, while for instantaneous features, a smaller window size is used to preserve detailed information.

[0081] The operation of the quantum pooling layer includes two modes: local optimal selection and random sampling. Local optimal selection selects the state with the highest probability as the pooling result by measuring the probability amplitude of the quantum state. Random sampling randomly measures according to the probability distribution of the quantum state, increasing the randomness and generalization ability of the model. The quantum fully connected layer realizes global feature fusion through a sequence of multiple quantum gates. Each layer includes a rotation gate array and an entanglement gate network. The rotation gate is responsible for local feature transformation, and the entanglement gate is responsible for modeling the interaction between features.

[0082] The output layer uses a Softmax activation function to convert the quantum measurement result into a probability distribution. The calculation formula of the Softmax function is:

[0083] P(yi|x) = exp(zi) / ∑j exp(zj),

[0084] where zi is the output score of the i-th class, and P(yi|x) is the probability that sample x belongs to the i-th class. To improve numerical stability, the output score is normalized before calculating the exponential function to prevent exponential overflow. The output of the probability distribution contains the confidence of all possible attack types, providing rich information for subsequent decision-making.

[0085] In an optional implementation, in step S300, feature extraction and classification identification are combined with the optimal feature combination. A time sequence attention mechanism can also be established based on the time sequence dependence characteristics of attack behavior, such as the order and duration pattern of each stage in the attack chain, to capture the long-term dependencies of the attack sequence. Through the time evolution modeling of the quantum gate, the dynamic change process of the attack behavior is modeled, and the recognition ability of the multi-stage composite attack is improved.

[0086] In another alternative embodiment, the feature extraction and classification recognition in step S300 in combination with the optimal feature combination can also be enhanced by the adversarial training method, using the generative adversarial network to construct the adversarial perturbation of the attack sample, inputting the perturbed sample into the quantum classification model for training, optimizing and improving the resistance ability of the model to malicious sample disguise and escape attack through minimax game, and ensuring the detection reliability in complex attack environment.

[0087] In the present embodiment, the determination of the power network attack type and the generation of the security warning information in step S400 based on the attack type probability distribution include the following steps D1-D2:

[0088] D1: Set a classification threshold, and determine the attack type of the network traffic according to the maximum probability category;

[0089] Specifically, in B1, the quantum convolutional neural network is trained as an evaluation model in the fitness function of A2. The unknown network attack data is input into the genetic algorithm, and the optimal solution is output by iteratively selecting appropriate features. The output feature combination is input into the trained quantum convolutional neural network. In the input stage, the feature data is first standardized to ensure that features with different numerical ranges have consistent scales when input into the model, and then the standardized data is mapped to the input layer of the QCNN, so that it can fully utilize the optimized feature combination for attack recognition; in the forward propagation process, the model processes the input data, and finally uses the Softmax activation function in the output layer to calculate the probability distribution of each type of attack:

[0090]

[0091] where z i is the output score of the i-th class, and the Softmax function ensures that the sum of the probabilities of all classes is 1, so as to output the probability distribution of each type of attack; by setting a proper classification threshold, the model can classify the network traffic data according to the maximum probability category, realize the recognition of network intrusion attacks, ensure that the detection system can accurately distinguish between normal traffic and abnormal traffic, and effectively identify different types of attacks, and improve the network security protection capability.

[0092] D2: Generate corresponding security warning information based on the attack type determination result.

[0093] Specifically, the generation of security warning information adopts a hierarchical response mechanism, and the warning level is determined according to the attack type, the influence range and the emergency degree. The first-level warning corresponds to high-risk attacks and system-level threats, which need to be responded immediately and start the emergency plan; the second-level warning corresponds to medium-risk attacks and local threats, which need to be responded within 15 minutes; the third-level warning corresponds to low-risk abnormalities and potential threats, which need to be handled within 1 hour. The warning information contains attack detection time, attack type, confidence, affected devices, suggested measures and other key elements, and is output in a structured format for automatic processing.

[0094] The propagation of the warning information adopts a multi-channel release mechanism, and different notification methods are selected according to the warning level and the receiving object. High-level warning is sent to security management personnel and system operation personnel through SMS, email and instant messaging tools at the same time; medium-level warning is sent through email and system push; low-level warning is recorded in system logs and summarized in regular reports. A confirmation and feedback mechanism for warning information is established, which requires the receiving personnel to confirm the receipt within a specified time and report the processing progress.

[0095] A knowledge base and a disposal plan base of attack events are constructed to provide standardized countermeasures for each attack type. The warning information is automatically matched with the corresponding disposal plan during generation to provide operation guidance for security personnel. The knowledge base uses ontology modeling method to construct the semantic association between attack types, vulnerability information and protection measures, supporting intelligent reasoning and knowledge discovery. The disposal plan base includes operation processes of attack isolation, system recovery, evidence preservation and impact assessment.

[0096] In an optional implementation, the determination of the attack type and the generation of the security warning information in step S400 can also combine the operation state information of the power system, such as load distribution, power flow calculation results and device operation parameters, to establish an attack impact assessment model, quantify the threat degree of different attack types to the stability of the power grid, dynamically adjust the warning threshold according to the system vulnerability, and increase the security protection level during the key operation period to ensure the safe operation of the power grid.

[0097] In another optional implementation, the determination of the attack type and the generation of the security warning information in step S400 can also be integrated with attack tracing technology, use graph neural network to model the attack path propagation relationship, and conduct attack attribution analysis combined with threat intelligence database to identify key information such as attack source, attack tool and attack intention, provide decision support for security event investigation and defense strategy formulation, and realize the transition from passive defense to active defense.

[0098] In summary, in the data acquisition and preprocessing link, the distributed data acquisition architecture and multi-level data cleaning mechanism ensure the integrity and accuracy of the data, the Z-score standardization and hybrid coding strategy solves the fusion problem of multi-source heterogeneous data, in the feature optimization link, the hierarchical random initialization strategy and diversified evolution operation design improve the convergence speed and solution quality of the genetic algorithm, the adaptive weight adjustment mechanism of the fitness function enables the algorithm to dynamically balance exploration and development according to the search progress, the elite reservation strategy ensures the inheritance of excellent genes, and the multi-objective optimization method provides flexible feature selection schemes for different application scenarios. In the construction of quantum neural network, the hierarchical design of parameterized quantum circuit and the quantum natural gradient optimization method improve the expression ability and training stability of the model, and the quantum attention mechanism and hybrid architecture design further enhance the model's ability to identify key features. In the attack identification and early warning stage, the integrated learning and online learning strategy improves the robustness and adaptability of the model, and the hierarchical early warning mechanism and situation awareness platform realize the transformation from passive defense to active protection.

[0099] Embodiment 3

[0100] The above is an illustrative scheme of a power network attack identification method based on a quantum convolutional neural network. It should be noted that the technical scheme of the power network attack identification system based on the quantum convolutional neural network is the same as the technical scheme of the power network attack identification method based on the quantum convolutional neural network described above. The technical scheme of the power network attack identification system based on the quantum convolutional neural network in this embodiment is not described in detail, and can be referred to the description of the technical scheme of the power network attack identification method based on the quantum convolutional neural network.

[0101] The embodiment also provides a power network attack identification system based on a quantum convolutional neural network, comprising:

[0102] A data acquisition module is configured to acquire power network attack event data and construct a standardized data set.

[0103] A feature optimization module is configured to construct a feature optimization model by using a genetic algorithm, dynamically filter network attack features based on a fitness evaluation strategy, and obtain an optimal feature combination.

[0104] A classification and identification module is configured to construct a quantum convolutional neural network classification model, perform feature extraction and classification identification in combination with the optimal feature combination, and obtain an attack type probability distribution.

[0105] An early warning generation module is configured to determine a power network attack type based on the attack type probability distribution and generate security early warning information.

[0106] The embodiment also provides an electronic device suitable for the case of power network attack identification based on a quantum convolutional neural network, including a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions to realize the method for power network attack identification based on a quantum convolutional neural network proposed in the above embodiment.

[0107] The embodiment also provides a storage medium having a computer program stored thereon, and the computer program is executed by a processor to realize the method for power network attack identification based on a quantum convolutional neural network proposed in the above embodiment.

[0108] The storage medium proposed in the embodiment and the method for power network attack identification based on a quantum convolutional neural network proposed in the above embodiment belong to the same inventive concept, and the technical details not described in the embodiment can be referred to the above embodiment, and the embodiment has the same beneficial effects as the above embodiment.

[0109] From the above description about the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary universal hardware, and of course can also be realized by hardware. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product can be stored in a computer readable storage medium, such as a floppy disk, a ROM, a RAM, a FLASH, a hard disk or an optical disk, and includes a number of instructions to make a computer device (which can be a personal computer, a server or a network device, etc.) execute the methods of various embodiments of the present application.

[0110] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A method for identifying power network attacks based on quantum convolutional neural networks, characterized in that: This includes acquiring power grid attack event data and constructing an attack event dataset, building a feature optimization model through a genetic algorithm, dynamically filtering network attack features based on a fitness evaluation strategy, and obtaining the optimal feature combination. A quantum convolutional neural network classification model is constructed, and the quantum convolutional neural network classification model is used as the classification performance evaluation module in the fitness evaluation strategy; By combining the optimal feature combination, feature extraction and classification are performed using the quantum convolutional neural network classification model to obtain the attack type probability distribution; Based on the probability distribution of the attack types, the types of power network attacks are determined and security warning information is generated.

2. The power network attack identification method based on quantum convolutional neural networks as described in claim 1, characterized in that: The process of acquiring power grid attack event data and constructing a standardized dataset includes: collecting attack event data in real time from network traffic monitoring, behavior analysis, and intrusion detection systems; and extracting network features, protocol features, and behavioral features. The extracted features are numerically encoded and format-standardized.

3. The power network attack identification method based on quantum convolutional neural networks as described in claim 2, characterized in that: The feature optimization model constructed using a genetic algorithm includes: randomly generating an initial population, with each individual representing a feature selection scheme in binary encoding; constructing a comprehensive fitness function based on classification accuracy, feature redundancy, and feature quantity; and iteratively evolving through selection, crossover, and mutation operations to select the feature combination with the highest fitness.

4. The power network attack identification method based on quantum convolutional neural networks as described in claim 3, characterized in that: The construction of the quantum convolutional neural network classification model includes converting classical feature data into quantum states using quantum encoding methods; A quantum convolutional layer is constructed to realize quantum entanglement and nonlinear transformation between features using parameterized quantum circuits; a quantum pooling layer is set up to achieve quantum state dimensionality reduction through controlled measurement operations; and a quantum fully connected layer is configured to map the extracted quantum features and adjust the feature distribution.

5. The power network attack identification method based on quantum convolutional neural networks as described in claim 4, characterized in that: The fitness evaluation strategy includes a comprehensive consideration of three evaluation dimensions: classification performance, feature redundancy, and feature quantity.

6. The power network attack identification method based on quantum convolutional neural networks as described in claim 5, characterized in that: Combining the optimal feature combination, feature extraction and classification are performed using the quantum convolutional neural network classification model, including: inputting the optimal feature combination into the quantum convolutional neural network classification model for forward propagation; and using an activation function in the output layer to calculate the probability distribution of each attack type. The attack type classification result is determined based on the probability distribution.

7. The power network attack identification method based on quantum convolutional neural networks as described in claim 6, characterized in that: Based on the probability distribution of the attack types, the attack types of the power network are determined and security warning information is generated, including setting a classification threshold, determining the attack type of network traffic according to the most probable category, and generating corresponding security warning information based on the attack type determination results.

8. A power grid attack identification system based on quantum convolutional neural networks, based on the power grid attack identification method based on quantum convolutional neural networks according to any one of claims 1 to 7, characterized in that: It also includes a data acquisition module, used to acquire power grid attack event data and build a standardized dataset; The feature optimization module is used to construct a feature optimization model through a genetic algorithm, dynamically filter network attack features based on a fitness evaluation strategy, and obtain the optimal feature combination. The classification and recognition module is used to construct a quantum convolutional neural network classification model, and combine the optimal feature combination to perform feature extraction and classification recognition to obtain the attack type probability distribution; The early warning generation module is used to determine the power network attack type and generate security early warning information based on the probability distribution of the attack type.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the power network attack identification method based on quantum convolutional neural networks as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the power network attack identification method based on quantum convolutional neural networks as described in any one of claims 1 to 7.

Images