Energy industry internet protocol state transition adaptive learning method and device

Abstract

The invention discloses an energy industry internet protocol state transition adaptive learning method and device. The method comprises the following steps: collecting total data including a protocol state conversion behavior in the energy industry Internet; cleaning and feature extraction are carried out on the collected total data, and a structured sample set for protocol state transition learning is constructed; based on the structured sample set, a protocol format and a dynamic field switching rule are learned through a bidirectional long-short-term memory network, and a state conversion knowledge graph is constructed through learning an inter-protocol switching rule; in combination with the state transition knowledge graph, complete session identification, extraction and restoration are carried out on industrial control network interaction flow, and a restoration result containing a protocol type sequence and state transition node information is output; and based on the real business scene of the energy industry, verifying the business matching degree of the restoration result and the standard business process and the coverage rate of the key steps, and determining the validity of the restoration result.

Description

Technical Field

[0001] This invention relates to the field of energy industrial internet technology, and more specifically, to an adaptive learning method and apparatus for state transitions in energy industrial internet protocols. Background Technology

[0002] The Industrial Internet of Energy (IIoT) is a core support for infrastructure in critical energy sectors such as electricity, oil, and natural gas. Its industrial control networks rely on protocols such as Modbus, IEC60870-5-104 (IEC104), and S7Comm to achieve device interaction and command transmission. However, energy industrial control scenarios involve numerous protocol format variations (such as vendor-specific field extensions) and protocol switching (such as Modbus and IEC104 collaborative control), resulting in a lack of publicly available state transition rule documents. This makes it difficult for existing traffic analysis technologies to fully identify industrial control interaction sessions, thus hindering the detection of subsequent abnormal behaviors.

[0003] Existing technologies mostly focus on parsing fields of a single protocol or constructing static state mechanisms, failing to design adaptive learning mechanisms for the multi-protocol collaboration and dynamic field switching characteristics of the energy industrial internet. This leads to fragmented session reconstruction (such as missing message sequences after protocol switching) and low accuracy in state transition identification (such as misjudging field format changes as abnormal). As energy industrial control systems upgrade towards intelligence and networking, the reliance on complete session reconstruction for control flow anomaly analysis has significantly increased. Therefore, there is an urgent need for an adaptive learning technology for protocol state transitions to lay the foundation for traffic behavior feature modeling and anomaly detection. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides an adaptive learning method and apparatus for state transitions in the Energy Industrial Internet protocol.

[0005] According to one aspect of the present invention, an adaptive learning method for state transitions in an energy industrial internet protocol is provided, comprising:

[0006] Collect all data containing protocol state transition behaviors from the energy industrial internet;

[0007] The collected data is cleaned and features are extracted to construct a structured sample set for protocol state transition learning;

[0008] Based on a structured sample set, a bidirectional long short-term memory network is used to learn the protocol format and dynamic field switching rules, and a state transition knowledge graph is constructed by learning the switching rules between protocols.

[0009] By combining state transition knowledge graphs, complete sessions of industrial control network interaction traffic are identified, extracted, and reconstructed, and the reconstruction results containing protocol type sequences and state transition node information are output.

[0010] Based on real-world business scenarios in the energy industry, the business matching degree and key step coverage of the restored results with standard business processes are verified to determine the validity of the restored results.

[0011] According to another aspect of the present invention, an adaptive learning device for state transitions of an energy industrial internet protocol is provided, comprising:

[0012] The data acquisition module is used to collect all data containing protocol state transition behaviors in the energy industrial internet.

[0013] The extraction module is used to clean and extract features from the collected full data to construct a structured sample set for protocol state transition learning;

[0014] The module is used to learn protocol formats and dynamic field switching rules based on structured sample sets through bidirectional long short-term memory networks, and to build a state transition knowledge graph by learning the switching rules between protocols.

[0015] The restoration module is used to identify, extract, and restore the complete session of industrial control network interaction traffic by combining the state transition knowledge graph, and output the restoration result containing the protocol type sequence and state transition node information.

[0016] The verification module is used to verify the business matching degree and key step coverage of the restoration results with the standard business process based on real business scenarios in the energy industry, and to determine the validity of the restoration results.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing a computer program for performing the methods described in any of the above aspects of the present invention.

[0018] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the method described in any of the preceding aspects of the present invention.

[0019] Therefore, this invention proposes an adaptive learning method for state transitions in the energy industrial internet protocol. It integrates a temporal deep learning model with a business layer verification mechanism, breaking through the dependence of existing technologies on static rules and single protocols. This method enables adaptive learning of protocol state transition characteristics and complete session reconstruction. Compared with existing technologies, this invention does not rely on predefined rules or single protocol features. It can adaptively learn the complex state transition behaviors of energy industrial control scenarios, and improve the session reconstruction integrity to over 95%. This provides high-quality data support for subsequent traffic behavior feature modeling and anomaly detection. Attached Figure Description

[0020] Exemplary embodiments of the present invention can be more fully understood by referring to the following figures:

[0021] Figure 1 This is a flowchart illustrating an exemplary embodiment of the adaptive learning method for state transitions in the energy industrial internet protocol provided by the present invention.

[0022] Figure 2 This is a schematic diagram of the structural flow of the adaptive learning method for state transition of the Energy Industrial Internet protocol provided in an exemplary embodiment of the present invention;

[0023] Figure 3 This is a schematic diagram of the structure of an adaptive learning device for state transition of the Energy Industrial Internet protocol provided in an exemplary embodiment of the present invention;

[0024] Figure 4 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. Detailed Implementation

[0025] Hereinafter, exemplary embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments described herein.

[0026] It should be noted that, unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of the invention.

[0027] Those skilled in the art will understand that the terms "first," "second," etc., in the embodiments of the present invention are only used to distinguish different steps, devices, or modules, and do not represent any specific technical meaning, nor do they indicate a necessary logical order between them.

[0028] It should also be understood that in the embodiments of the present invention, "multiple" can refer to two or more, and "at least one" can refer to one, two or more.

[0029] It should also be understood that any component, data or structure mentioned in the embodiments of the present invention can generally be understood as one or more unless explicitly defined or given contrary instructions in the context.

[0030] Furthermore, the term "and / or" in this invention is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this invention generally indicates that the preceding and following related objects have an "or" relationship.

[0031] It should also be understood that the description of the various embodiments in this invention emphasizes the differences between the various embodiments, and the similarities or similarities can be referred to each other. For the sake of brevity, they will not be described in detail.

[0032] At the same time, it should be understood that, for ease of description, the dimensions of the various parts shown in the accompanying drawings are not drawn according to actual scale.

[0033] The following description of at least one exemplary embodiment is merely illustrative and is in no way intended to limit the invention or its application or use.

[0034] Techniques, methods, and equipment known to those skilled in the art may not be discussed in detail, but where appropriate, they should be considered part of the specification.

[0035] It should be noted that similar labels and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be discussed further in subsequent figures.

[0036] The embodiments of this invention can be applied to electronic devices such as terminal devices, computer systems, and servers, and can operate together with a wide range of other general-purpose or special-purpose computing system environments or configurations. Well-known examples of terminal devices, computing systems, environments, and / or configurations suitable for use with electronic devices such as terminal devices, computer systems, and servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments including any of the above systems, etc.

[0037] Electronic devices such as terminal devices, computer systems, and servers can be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. Typically, program modules can include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers can be implemented in distributed cloud computing environments, where tasks are executed by remote processing devices linked through communication networks. In distributed cloud computing environments, program modules can reside on local or remote computing system storage media, including storage devices.

[0038] Exemplary methods

[0039] Figure 1This is a flowchart illustrating an adaptive learning method for state transitions in an energy industrial internet protocol, provided by an exemplary embodiment of the present invention. This embodiment can be applied to electronic devices, such as… Figure 1 As shown, the adaptive learning method 100 for state transitions in the Energy Industrial Internet protocol includes the following steps:

[0040] Step 101: Collect all data containing protocol state transition behaviors from the energy industrial internet;

[0041] Step 102: Clean and extract features from the collected full data to construct a structured sample set for protocol state transition learning;

[0042] Step 103: Based on the structured sample set, learn the protocol format and dynamic field switching rules through a bidirectional long short-term memory network, and construct a state transition knowledge graph by learning the switching rules between protocols;

[0043] Step 104: Combining the state transition knowledge graph, identify, extract and reconstruct the complete session of the industrial control network interaction traffic, and output the reconstruction result containing the protocol type sequence and state transition node information;

[0044] Step 105: Based on real business scenarios in the energy industry, verify the business matching degree and key step coverage of the restoration results with the standard business process, and determine the validity of the restoration results.

[0045] Specifically, addressing the technical problems existing in the background technology, this invention proposes an adaptive learning method for state transitions in the energy industrial internet protocol. This method integrates a temporal deep learning model (BiLSTM-Transformer) with a business layer verification mechanism, breaking through the dependence of existing technologies on static rules and single protocols. It achieves adaptive learning of protocol state transition characteristics and complete session reconstruction. The core innovations are as follows:

[0046] 1. Two-dimensional adaptive learning for protocol state transitions: For protocol format / field switching, a field time-series feature learning module (BiLSTM) is designed to automatically capture the dynamic change patterns of field length and type (such as the field extension conditions of IEC104 in the power industry); For switching between protocols, a switching trigger feature extraction module (Transformer attention mechanism) is built to learn switching trigger conditions such as ports, handshake messages, and business instructions (such as the port linkage features of Modbus to IEC104 switching in the petroleum industry), without the need for manual rule definition;

[0047] 2. Session restoration based on state transition logic: With adaptive learning of state transition rules as the core, combined with IP / port and message timing relationships, a session restoration engine driven by both state transition and message association is constructed to solve the session breakage problem caused by protocol switching and field changes, and to fully restore the industrial control interaction process of command issuance, state transition and response feedback.

[0048] 3. Business layer verification closed-loop design: Introduce standard business processes from actual business scenarios in the energy industry (such as power remote control and oil pump control), compare the restored session with the business process template (such as remote control pre-command → execution command → status feedback) to verify the integrity and correctness of the session, and ensure that the restoration results conform to the actual business logic;

[0049] Compared to existing technologies, this invention does not rely on predefined rules or single protocol features. It can adaptively learn the complex state transition behaviors of energy industrial control scenarios, improve session restoration integrity to over 95%, and provide high-quality data support for subsequent traffic behavior feature modeling and anomaly detection.

[0050] In a specific embodiment of the present invention, Figure 2 The diagram below illustrates the overall technical solution. The specific steps are detailed below, with core steps including: data collection → dataset processing → adaptive learning of protocol state transitions → session recognition, extraction, and reconstruction → business layer verification → model optimization → application deployment. The function and implementation details of each step are as follows:

[0051] 1. Data Collection (laying the foundation for learning, obtaining data related to state transitions)

[0052] Objective: To collect full data on protocol state transition behaviors in the energy industrial internet, covering scenarios of "multi-protocol switching and dynamic field changes," and to ensure that the data sources are highly compatible with the actual business scenarios of the energy industry.

[0053] Specific implementation:

[0054] Protocol document collection: Obtain commonly used standard protocol documents for energy industrial control (Modbus, IEC104, S7Comm) and vendor proprietary protocol documents (such as China Southern Power Grid's proprietary Modbus extended protocol and Siemens S7Comm variant protocol), focusing on extracting descriptions involving "field interaction" and "protocol conversion", and supplementing the document information related to dynamic field conversion that is not covered by existing technology;

[0055] Flow probe deployment: Deploy industrial-grade flow probes (model: NP6300 industrial probe, supporting wide operating temperature range of -40℃ to 70℃) in power SCADA systems (substation monitoring networks, focusing on monitoring ports 502 / 2404) and oil DCS systems (oil pump control networks, covering Modbus→IEC104 switching scenarios). Real-time flow is captured using Wireshark and Zeek tools, with a focus on collecting message data containing protocol state transitions (such as power remote control "pre-command → execution command" field switching messages, and oil "start / stop command → parameter adjustment" protocol switching messages). Single-scenario collection time is ≥72 hours, ensuring a data volume of ≥100,000 records, including at least 600 complete multi-protocol switching session data.

[0056] Business process annotation: In collaboration with technical personnel from energy companies, annotate the energy industry business processes corresponding to the collected traffic (such as "pre-command → execution command → status feedback" for power remote control closing, and "start / stop command → parameter adjustment → status feedback" for oil pumps), clarify the necessary state transition steps for the business, and provide business-level references for subsequent state transition learning and session reconstruction.

[0057] 2. Dataset processing (data cleansing, constructing protocol state transition learning samples)

[0058] Objective: Remove redundant data, extract key features of protocol state transitions, and divide the dataset into training, validation, and test sets.

[0059] Specific implementation:

[0060] Data cleaning: The collected PCAP / PCAPNG files are parsed, and redundant low-level TCP / IP data (such as duplicate ACK packets and empty payload packets) is filtered using a three-dimensional correlation of "IP + port + protocol type." Packets containing protocol state transition characteristics are prioritized for retention (such as packets with abrupt field length changes and packets where protocol type changes are accompanied by port switching). To address field noise caused by electromagnetic interference in the industrial environment, a strategy of "static field anchoring (such as protocol version number, fixed function code) + dynamic field tracking (such as real-time parameter values, switching flags)" is used to separate valid data. After cleaning, the data purity is ≥98%.

[0061] Feature extraction: Focus on extracting features related to protocol state transitions to form structured samples.

[0062] Dynamic field change characteristics: record field length (e.g., 4 bytes → 8 bytes for the "telemetry field" in IEC104 power system), data type (e.g., numeric → character), and the time and triggering conditions for changes in the value range (e.g., field length expansion when telemetry value > 1000);

[0063] Multi-protocol switching features: Records port changes before and after protocol switching (e.g., Modbus port 502 → IEC104 port 2404), handshake message sequence (e.g., IEC104 start frame, Modbus function code 0x06 switching instruction), and service instruction association (e.g., the timing interval between "preparation instruction" and "execution instruction").

[0064] Dataset partitioning: The processed data is divided into training, validation, and test sets in a 7:1:2 ratio and stored in JSON format. The training set is used for BiLSTM-Transformer model learning, the validation set for parameter tuning, and the test set for performance evaluation. Each sample contains three elements: "message features - state transition label - business scenario." The initial batch size is set to B0 = 32 (this is a preset value, set to balance the memory capacity and training efficiency of edge devices in the energy industry; the data volume per batch is approximately 4-8KB, adapting to the real-time processing needs of the edge).

[0065] 3. Adaptive learning of protocol state transitions (ensuring state transition rules are learned)

[0066] Objective: To adaptively acquire state transition rules for "multi-protocol switching and dynamic field changes" in the energy industrial internet through collaborative learning of two modules.

[0067] Specific implementation:

[0068] 3.1 Learning about Protocol Format / Field Switching (BiLSTM Module)

[0069] Model construction: A BiLSTM network is used. The input is "dynamic field time series (field length, value, change time) + business instruction label" (such as "pre-order verification" label for power and "parameter adjustment" label for petroleum). The output is the field dynamic conversion probability and triggering conditions.

[0070] Training process:

[0071] The dynamic field sequences in the training set are sorted according to the time sequence of the energy industry business process (time window = 8ms, set according to the "telemetry data transmission cycle" of the power IEC104 protocol and the "command response cycle" of the oil Modbus protocol to ensure coverage of the necessary state transition steps of the business). The time window is a preset value, set according to the typical response time of the energy industry protocol interaction (such as the telemetry data transmission cycle of the power IEC104 protocol is usually 5~10ms, and the command response cycle of the oil Modbus protocol is ≤8ms).

[0072] Randomly cover 10%-15% of the dynamic field status (such as covering the switching threshold of the "pre-command verification" field of power remote control) to allow the model to predict the status of the covered field and whether it will trigger a protocol switch.

[0073] The loss function is defined as the sum of the field state prediction error and the handover decision error, as shown in the following formula:

[0074]

[0075] Among them, y len This is the actual field length. To predict the length, y switch To truly switch labels (0 = no switching, 1 = switching), To predict the switching probability, α = 0.6 and β = 0.4 are weighting coefficients, and CrossEntropy(·) is used for cross-entropy calculation;

[0076] Iterative training continues until the loss function converges (loss value ≤ 0.05, a preset value set based on the performance of the BiLSTM model in energy protocol parsing), outputting dynamic field conversion rules (e.g., "when the power telemetry value > 1000, the field length switches from 4 bytes to 8 bytes"). The rules do not need to be pre-configured, and the unknown conversion conditions are learned adaptively.

[0077] 3.2 Inter-protocol switching learning (Transformer attention module)

[0078] Model construction: A Transformer encoder is used, with the input being "protocol type sequence + port association sequence + service instruction sequence" (such as "Modbus→IEC104+502→2404+oil pump start / stop instruction"). The triggering features of multi-protocol switching are captured through a self-attention mechanism.

[0079] Training process:

[0080] For multi-protocol handover samples in the training set, extract the triplet "pre-handover protocol-trigger feature-post-handover protocol" (e.g., Modbus-port 502→2404+instruction 'prepare'-IEC104);

[0081] Attention weights are calculated, focusing on strong correlations between triggering features and protocol switching (e.g., attention scores ≥ 0.8 for port changes and command sequences). The score threshold is a preset value, derived from statistical data on protocol switching in typical applications such as remote power control closing and oil pump control. The formula for calculating attention weights is as follows:

[0082]

[0083] Among them, Q i To trigger feature query vectors (such as port change vectors), K j For protocol switching key vectors (such as protocol type identifier vectors), d k =64 is the scaling factor to avoid distraction;

[0084] The protocol switching probability is dynamically output through the fully connected layer, and the loss function uses cross-entropy loss.

[0085]

[0086] Among them, y i Switch labels to the actual protocol. To predict probabilities and ensure adaptive learning capabilities for unknown protocol switching conditions;

[0087] The training achieves a protocol switching recognition accuracy of ≥95%, and outputs a multi-protocol state transition rule base (such as "Modbus command 'Prepare' + port 502 → 2404 → trigger IEC104 switching"). The rules support dynamic updates without manual intervention.

[0088] 3.3 Construction of State Transition Knowledge Graph

[0089] By integrating the dynamic field rules output by the BiLSTM module and the protocol switching rules output by the Transformer module, a state transition knowledge graph is constructed:

[0090] Node definition: "Protocol type - Dynamic field status - Business instruction" (e.g., "Modbus - Telemetry field 4 bytes - Oil pump start / stop instruction" "IEC104 - Telemetry field 8 bytes - Oil pump status feedback");

[0091] Edge definition: Protocol state transition relationship, including transition trigger conditions (such as "field value > 1000" "port 502 → 2404"), time interval (such as switch response time ≤ 50ms), and business association tags (such as "oil pump control" "power remote control");

[0092] The knowledge graph supports real-time updates, and newly discovered protocol switching rules (such as dynamic field switching of private protocols from unknown vendors) can be automatically added to the node and edge relationships.

[0093] 4. Complete session identification, extraction, and reconstruction of industrial control network interactive traffic (based on learning results, ensuring session continuity).

[0094] Objective: To achieve complete session reconstruction in protocol state transition scenarios by combining state transition knowledge graphs.

[0095] Specific implementation:

[0096] Session identification: A dual-drive strategy based on IP / port association and state transition knowledge graph.

[0097] Basic association: Initially aggregate packets through IP connection relationships and port mapping;

[0098] Deep association: Message association is established based on the state transition rules in the knowledge graph (such as "port 502→2404 accompanied by field length 4→8 bytes, which is determined to be a protocol switch"). When a protocol state transition is detected, the session association window is automatically extended (e.g., from the usual 100ms to 200ms) to ensure that the complete transition process message is included.

[0099] Session extraction: For the identified sessions, extract the key message sequence of "command issuance - state transition - response feedback", mark the state transition behavior of each stage (such as "step 1: Modbus command issuance (port 502); step 2: telemetry field 4 → 8 byte switching; step 3: IEC104 status feedback (port 2404)"), to ensure that no necessary transition steps for the service are missed;

[0100] Session Reconstruction: Outputs the reconstruction results, including session ID, device IP / port, protocol type sequence, state transition node information, and business scenario tag. Example format:

[0101] {“Session ID”:“S001”,“Device IP”:“192.168.1.100”,“Protocol Sequence”:“Modbus→IEC104”,“State Transition Node”:“Telemetry Field 4 bytes → 8 bytes (Trigger Threshold 1000)”,“Business Scenario”:“Oil Pump Control”}.

[0102] IEC 104 (IEC 60870-5-104, Remote Control and Monitoring Protocol for Power Systems), Modbus (Modbus Communication Protocol, a commonly used serial communication protocol in industrial control), BiLSTM (Bidirectional Long Short-Term Memory), Transformer (Transformer Neural Network, a neural network model based on self-attention mechanism), PCAP (Packet Capture), PCAPNG (Packet Capture Next Generation), SCADA (Supervisory Control and Data Acquisition), DCS (Distributed Control System), S7Comm (Siemens S7 Communication Protocol).

[0103] Session Restoration: Concatenates discrete industrial control messages into a complete interactive sequence of "command issuance - state transition - response feedback" based on IP / port, state transition logic, and other relationships; Energy Industrial Internet (EII): An industrial internet for the power, oil, and natural gas sectors, enabling interconnection and intelligent control of equipment in energy production, transmission, and consumption; Protocol State Transition: State changes that occur during the interaction of energy industrial control protocols, such as changes in protocol format / fields (e.g., field length expansion) and protocol type switching (e.g., Modbus → IEC 104).

[0104] 5. Business layer verification (ensuring the restoration results are compatible with actual business operations in the energy industry)

[0105] Objective: To verify the effectiveness of protocol state transition learning and session restoration based on real-world business scenarios in the energy industry (such as remote power switching and oil pump control).

[0106] Specific implementation:

[0107] Validation metric definition:

[0108] Business matching degree: The matching degree between the restoration session and the business process of the energy industry (such as remote power closing and oil pump control) must be ≥95%;

[0109] Key step coverage: The coverage of essential state transition steps (such as "pre-command verification" for power remote control and "parameter adjustment confirmation" for petroleum) must be ≥98%.

[0110] Verification process:

[0111] One hundred typical business scenario sessions (50 each for power remote control and oil pump control) were selected from the test set, covering key scenarios such as "field switching" and "multi-protocol switching".

[0112] The restored session is compared with the standard business process template provided by the energy company. If the business matching degree is less than 95% or the key step coverage is less than 98%, the state transition learning module is backtracked, the BiLSTM time window is adjusted (e.g., optimized from 8ms to 6ms) or the Transformer attention weights are adjusted, and the rules are relearned until the indicator requirements are met.

[0113] 6. Model optimization and adaptive tuning (improving learning accuracy and robustness)

[0114] Objective: To dynamically adjust the model hyperparameters to ensure adaptation to fluctuations in the industrial environment.

[0115] Specific implementation:

[0116] Training monitoring: Real-time monitoring of the loss curves of the BiLSTM and Transformer models, and calculation of the rate of change of loss, using the following formula:

[0117]

[0118] in, L represents the rate of change of loss. t L is the model loss value at time step t. t-1 Let be the model loss value at time step t-1, where t is the current training time step and t-1 is the previous training time step. If If the rate of change is ≤0.001, the model converges; if the loss fluctuation is >10% (e.g., electromagnetic interference in the industrial environment causes a sudden increase in field recognition error), adaptive tuning is triggered.

[0119] Hyperparameter tuning:

[0120] Learning rate optimization: The initial learning rate η0 = 0.001. If convergence is too slow (e.g., loss decreases by less than 10% after 50 iterations), then η0 = 0.001. t+1 =η t ×1.2; If the fluctuation is too large (loss difference > 0.1), then η t+1 =η t ×0.8;

[0121] Batch size optimization: Initial batch size B0 = 32. If the training data complexity is high (dynamic field switching sample ratio > 40%), then B0... t+1 =B t ×0.5 (reduced to 16), improving training stability and reducing single-batch memory usage; if data complexity is low (static fields account for >70%), then B t+1 =B t ×1.5 (increased to 48), speeding up training.

[0122] The initial batch size is a preset value, not a fixed value. It is determined based on a combination of the characteristics of the energy industrial internet protocol data and model training efficiency: Data complexity adaptation: In the energy industrial protocol data, a single protocol message contains fixed fields (such as protocol version number, function code) + dynamic fields (such as telemetry values, switching flags). The data size of a single message is approximately 128–256 bytes, and the batch data size of 32 messages is approximately 4–8KB. This is suitable for the memory processing capabilities of industrial-grade servers (such as Huawei Atlas 500 Pro) (single batch memory usage ≤ 10KB), avoiding memory overflow.

[0123] Balancing training efficiency and accuracy: Referring to the batch processing efficiency threshold for interactive behavior modeling in CN110098959A (Modeling method, device, system and storage medium for interactive behavior of industrial control protocols), when the batch size is ≤32, the model's recognition accuracy for dynamic field switching is ≥92%; if the batch size is >32, although the training speed is increased by 15%, the recognition accuracy for the temporal correlation of field switching drops to below 85%. Therefore, 32 is selected as the initial preset value to balance training efficiency and accuracy.

[0124] Hardware adaptation for industrial scenarios: For edge devices commonly used in the energy industry (such as Schneider EV1220 edge gateway), the initial batch size of 32 ensures real-time training of the model at the edge (single batch training time ≤50ms), which meets the industrial-grade real-time requirements (latency ≤100ms).

[0125] Incremental learning: When accessing new vendor protocols or new business scenarios, there is no need to retrain the entire model. Instead, the state transition knowledge graph is fine-tuned using only new samples (≥1000) to achieve rapid rule updates.

[0126] 7. Deploy and apply (implementing in energy industry scenarios to support actual business needs)

[0127] Objective: To deploy the optimized protocol state transition learning model and session restoration engine to the energy industry environment, providing complete data support for anomaly detection.

[0128] Specific implementation:

[0129] Model Export: Use TensorFlowLite to export the BiLSTM-Transformer fusion model as an inference format, compressing the size to ≤100MB, supporting deployment on industrial servers (such as Huawei Atlas500Pro) and edge devices (such as Schneider EV1220 edge gateway), and adapting to a wide industrial temperature environment of -40℃~70℃.

[0130] Deployment architecture: Adopts an edge + cloud collaborative architecture.

[0131] Edge devices (local equipment in substations / oil pumping stations): Deploy flow probes and lightweight models to collect and preprocess protocol data in real time (such as field switching identification and simple protocol conversion), with a latency of ≤50ms;

[0132] Cloud-based (Energy Security Monitoring Platform): Deploys a complete model and session management system, uses a state transition knowledge graph to maintain the continuity of multi-protocol sessions, and outputs protocol parsing reports, complete session data, and anomaly warning suggestions to meet the actual needs of anomaly detection in the energy industry;

[0133] Application support: Provides complete session data for subsequent anomaly detection (such as identifying anomalies such as missing necessary state transition steps when switching services using unauthorized protocols).

[0134] In summary, the present invention has the following beneficial technical effects:

[0135] 1. Improve the adaptive learning capability of protocol state transitions.

[0136] This invention utilizes the BiLSTM-Transformer dual-dimensional learning module to adaptively learn protocol format / field switching and inter-protocol switching conditions without predefined rules, thereby improving the missed identification rate and meeting the complex state transition learning needs of energy industrial control scenarios.

[0137] 2. Improve the integrity of industrial control session restoration

[0138] This invention employs a "dual-drive" session restoration strategy based on a state transition knowledge graph. By combining IP / port association with state transition logic, it addresses session interruptions caused by protocol switching and field changes. Test results show high session restoration integrity and accuracy, providing complete and accurate session data for subsequent traffic behavior feature modeling.

[0139] 3. The reduction results align with the actual needs of the energy industry.

[0140] This invention verifies the business compliance of session restoration results by comparing them with standard business process templates in the energy industry, thus avoiding the problem of the restored session being disconnected from the business. In scenarios such as remote power switching and oil pump speed adjustment, it ensures that the restored session can directly support subsequent abnormal behavior analysis.

[0141] 4. The model has strong generalization ability and robustness.

[0142] This invention enables the model to adapt to new vendor protocols and new business scenarios through dynamic hyperparameter tuning and incremental learning mechanisms, without the need for full retraining. The model has stable performance and is compatible with multiple scenarios and protocol variants.

[0143] Compared with existing technologies, this invention breaks through the limitations of traditional technologies, such as "reliance on preset rule matching, manual annotation configuration, weak session association, and insufficient business adaptation". It constructs a more intelligent, adaptive, and energy industry-specific protocol state transition learning and session restoration scheme, which can be widely applied to protocol analysis, industrial control network security monitoring, and multi-protocol heterogeneous data processing in the energy industrial internet, providing core technical support for the safe and stable operation of industrial control systems.

[0144] Exemplary device

[0145] Figure 3This is a schematic diagram of the structure of an adaptive learning device for state transitions in an energy industrial internet protocol provided in an exemplary embodiment of the present invention. Figure 3 As shown, the device 300 includes:

[0146] The acquisition module 310 is used to acquire all data containing protocol state transition behaviors in the energy industrial internet.

[0147] The extraction module 320 is used to clean and extract features from the collected full data to construct a structured sample set for protocol state transition learning;

[0148] Module 330 is used to learn protocol formats and dynamic field switching rules through a bidirectional long short-term memory network based on a structured sample set, and to build a state transition knowledge graph by learning the switching rules between protocols.

[0149] The restoration module 340 is used to combine the state transition knowledge graph to identify, extract and restore the complete session of the industrial control network interaction traffic, and output the restoration result containing the protocol type sequence and state transition node information.

[0150] The verification module 350 is used to verify the business matching degree and key step coverage of the restoration results with the standard business process based on real business scenarios in the energy industry, and to determine the validity of the restoration results.

[0151] Exemplary electronic devices

[0152] Figure 4 This is the structure of an electronic device provided in an exemplary embodiment of the present invention. For example... Figure 4 As shown, the electronic device 40 includes one or more processors 41 and a memory 42.

[0153] The processor 41 may be a central processing unit (CPU) or other form of processing unit with data processing and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions.

[0154] The memory 42 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 41 may execute the program instructions to implement the methods of the software programs of the various embodiments of the present invention described above, and / or other desired functions. In one example, the electronic device may also include an input device 43 and an output device 44, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown).

[0155] In addition, the input device 43 may also include, for example, a keyboard, a mouse, etc.

[0156] The output device 44 can output various information to the outside. The output device 44 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0157] Of course, for the sake of simplicity, Figure 4 Only some of the components of this electronic device relevant to the present invention are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device may include any other suitable components depending on the specific application.

[0158] Exemplary computer program products and computer-readable storage media

[0159] In addition to the methods and apparatus described above, embodiments of the present invention may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the steps in the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0160] The computer program product can be written in any combination of one or more programming languages ​​to perform the operations of the embodiments of the present invention. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0161] Furthermore, embodiments of the present invention may also be computer-readable storage media storing computer program instructions thereon, which, when executed by a processor, cause the processor to perform the steps of the methods according to various embodiments of the present invention described in the "Exemplary Methods" section above.

[0162] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0163] The basic principles of the present invention have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in the present invention are merely examples and not limitations, and should not be considered as essential features of each embodiment of the present invention. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the present invention to the necessity of employing the aforementioned specific details.

[0164] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For system embodiments, since they largely correspond to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0165] The block diagrams of devices, systems, devices, and systems involved in this invention are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, systems, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0166] The methods and systems of the present invention may be implemented in many ways. For example, they may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the methods is for illustrative purposes only, and the steps of the methods of the present invention are not limited to the order specifically described above unless otherwise specifically stated. Furthermore, in some embodiments, the present invention may also be implemented as a program recorded on a recording medium, the program comprising machine-readable instructions for implementing the methods according to the present invention. Thus, the present invention also covers recording media storing programs for performing the methods according to the present invention.

[0167] It should also be noted that in the systems, apparatus, and methods of the present invention, the components or steps can be disassembled and / or recombined. These disassemblies and / or recombinations should be considered equivalents of the present invention. The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the invention. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of the invention. Therefore, the invention is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0168] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of the invention to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations thereof.

Claims

1. An adaptive learning method for state transitions in an energy industrial internet protocol, characterized in that, include: Collect all data containing protocol state transition behaviors from the energy industrial internet; The collected full data is cleaned and features are extracted to construct a structured sample set for protocol state transition learning; Based on the structured sample set, a bidirectional long short-term memory network is used to learn the protocol format and dynamic field switching rules, and a state transition knowledge graph is constructed by learning the switching rules between protocols. Based on the state transition knowledge graph, complete sessions of industrial control network interaction traffic are identified, extracted, and reconstructed, and the reconstruction results containing protocol type sequences and state transition node information are output. Based on real-world business scenarios in the energy industry, the business matching degree and key step coverage of the restored results with standard business processes are verified to determine the validity of the restored results.

2. The method according to claim 1, characterized in that, The structured sample set includes: dynamic field change features and multi-protocol conversion features, wherein... The field dynamic change feature records the time and triggering conditions for changes in field length, data type, and value range; The multi-protocol switching feature records the port changes, handshake message sequences, and business instruction associations before and after the protocol switching.

3. The method according to claim 1, characterized in that, Based on the structured sample set, the protocol format and dynamic field switching rules are learned through a bidirectional long short-term memory network, including: The dynamic field sequence in the training set divided by the structured sample set is sorted according to the time sequence of the energy industry business process to obtain the dynamic field time sequence. The dynamic field time sequence, which randomly covers 10%-15% of the field, is used by the bidirectional long short-term memory network to predict the state of the covered fields and whether a protocol switch is triggered. The loss function of the bidirectional long short-term memory network is a weighted sum of the field state prediction error and the switching judgment error. Through iterative training, the loss value converges to a preset threshold, and the network outputs dynamic field transformation rules that include trigger conditions without the need for pre-configuration.

4. The method according to claim 3, characterized in that, The expression for the loss function of the bidirectional long short-term memory network is: In the formula, y len This is the actual field length. To predict the length, y switch To realistically switch tags, To predict the switching probability, α = 0.6 and β = 0.4 are weighting coefficients, and CrossEntropy(·) is the cross-entropy operation.

5. The method according to claim 1, characterized in that, A state transition knowledge graph is constructed by learning the switching rules between protocols, including: Extract the triplet of pre-switching protocol-trigger feature-post-switching protocol from the multi-protocol switching samples in the training set of the structured sample set; Based on the triples, attention weights are calculated to focus on the strong correlation between triggering features and protocol switching; Based on the strong correlation between the triggering features and protocol switching, the dynamic protocol switching probability is output through a fully connected layer and trained with cross-entropy loss until the protocol switching recognition accuracy reaches the preset requirement. Then, a multi-protocol state transition rule base that supports dynamic updates is output, and the state transition knowledge graph is constructed.

6. The method according to claim 5, characterized in that, The attention weight A ij The calculation expression is: In the formula, Q i To trigger the feature query vector, K j For protocol switching key vectors, d k =64 is the scaling factor, and T is the transpose sign.

7. The method according to claim 1, characterized in that, The definition of the state transition knowledge graph is as follows: Node definition: "Protocol type - Dynamic field status - Business instruction"; Edge definition: Protocol state transition relationship, including transition trigger conditions, time interval, and business association tags, where... The state transition knowledge graph supports real-time updates, and newly discovered protocol switching rules can be automatically added to the node and edge relationships.

8. The method according to claim 1, characterized in that, Based on the aforementioned state transition knowledge graph, complete session identification, extraction, and reconstruction are performed on the industrial control network interaction traffic. The reconstruction result, including protocol type sequences and state transition node information, is output, including: A dual-drive strategy of IP / port association and state transition knowledge graph is adopted for session identification to obtain session messages of the complete transition process; Extract the key message sequence of instruction issuance, state transition, and response feedback from the session messages; Mark the state transition behavior of each stage in the key message sequence to obtain session information that does not omit the necessary transition steps for the service; The session is reconstructed based on the session information to obtain the reconstruction result, wherein the reconstruction result includes session ID, device IP / port, protocol type sequence, state transition node information and business scenario tag.

9. The method according to claim 8, characterized in that, A dual-drive strategy of IP / port association and state transition knowledge graph is adopted for session identification to obtain the session message of the complete transition process, including: By initially aggregating packets based on IP connection relationships and port mappings, preliminary session packets are obtained; Message associations are established based on the state transition rules in the knowledge graph. When a protocol state transition is detected, the initial session message association window is automatically extended to obtain the session message of the complete transition process.

10. The method according to claim 1, characterized in that, Also includes: Real-time monitoring of the loss curves of the bidirectional long short-term memory module network and the Transformer attention module, and calculation of the loss change rate; The hyperparameters of the bidirectional long short-term memory module network and the Transformer attention module are dynamically adjusted according to the loss change rate, and incremental learning is performed on new protocols or new business scenarios to update the state transition knowledge graph.

11. The method according to claim 10, characterized in that, The formula for calculating the rate of change of loss is: In the formula, L represents the rate of change of loss. t L is the model loss value at time step t. t-1 This represents the model loss value at time step t-1, where t is the current training time step and t-1 is the previous training time step.

12. The method according to claim 10, characterized in that, The hyperparameter adjustment scheme is as follows: Learning rate optimization: Initial learning rate η0 = 0.

001. If convergence is less than the first threshold, then η... t+1 =η t ×1.2; If the fluctuation is greater than the second threshold, then η t+1 =η t ×0.8, η t η t+1 The learning rates at time t and time t+1 are respectively. Batch size optimization: Initial batch size B0 = 32. If the complexity of the training data exceeds the third threshold, then B0... t+1 =B t ×0.5; If the data complexity is greater than the fourth threshold, then B t+1 =B t ×1.5, B t B t+1 These represent the batch sizes at time t and time t+1, respectively.

13. An adaptive learning device for state transitions in an energy industrial internet protocol, characterized in that, include: The data acquisition module is used to collect all data containing protocol state transition behaviors in the energy industrial internet. The extraction module is used to clean and extract features from the collected full data to construct a structured sample set for protocol state transition learning; The construction module is used to learn the protocol format and dynamic field switching rules through a bidirectional long short-term memory network based on the structured sample set, and to learn the switching rules between protocols through a Transformer attention module, and to integrate the field switching rules and the switching rules between protocols to construct a state transition knowledge graph. The restoration module is used to identify, extract, and restore the complete session of the industrial control network interaction traffic by combining the state transition knowledge graph, and output the restoration result containing the protocol type sequence and state transition node information. The verification module is used to verify the business matching degree and key step coverage of the restoration results with the standard business process based on real business scenarios in the energy industry, and to determine the validity of the restoration results.

14. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for performing the method described in any one of claims 1-12.

15. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the method described in any one of claims 1-12.

Images