Electric power industrial control system safety detection method and device

Abstract

The embodiment of the invention provides an electric power industrial control system security detection method and device, and the method comprises the steps: obtaining network traffic and log data, extracting traffic features and log features, predicting the weight of each expert model through employing an expert weight prediction model according to the extracted features, and predicting the detection task probability through employing a task prediction model, performing enhancement processing on the weight of each expert model by using a preset attention weight to obtain an enhanced weight of each expert model, calculating an expert matching degree according to the detection task probability and a preset expert ability matrix, calculating a correction weight of each expert model according to the expert matching degree and the enhanced weight of each expert model, and obtaining a correction result of each expert model; and based on the correction weight of each expert model, selecting a predetermined number of expert models, and performing detection by using the selected expert models to obtain a detection result. According to the method, the accuracy and the dynamic adaptability of routing decision and the accuracy and the integrity of a detection result of a multi-expert system in a complex electric power industrial control scene can be improved.

Description

Technical Field

[0001] This application relates to the field of power technology, and in particular to a method and apparatus for safety detection of power industrial control systems. Background Technology

[0002] With the intelligent upgrading of new power systems, the data generated by power industrial control systems exhibits multi-source heterogeneous characteristics, posing multiple challenges to anomaly detection. These challenges include: the inability of a single model to simultaneously process multimodal heterogeneous data; low feature extraction efficiency; insufficient semantic understanding of industrial control protocols; inability to detect covert attacks such as protocol field tampering; reliance on historical attack feature databases; high false alarm rate for attack variants; and insufficient dynamic detection and adjustment capabilities. Furthermore, multi-expert models based on static routing cannot dynamically adjust expert allocation strategies, resulting in low detection accuracy and completeness. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide a method and apparatus for safety detection of power industrial control systems.

[0004] To achieve the above objectives, this application provides a method for security detection of a power industrial control system, comprising: Obtain network traffic and log data; Extract traffic features from the network traffic and extract log features from the log data; Based on the traffic characteristics and log characteristics, the weights of each expert model in the expert pool are predicted using a pre-built expert weight prediction model. The weights of each expert model are enhanced by using preset attention weights to obtain the enhanced weights of each expert model. Based on the traffic and log characteristics, the probability of detection tasks is predicted using a pre-built task prediction model. Calculate the expert matching degree based on the detection task probability and the preset expert ability matrix; Based on the expert matching degree and the enhancement weights of each expert model, calculate the corrected weights of each expert model; Based on the corrected weights of each expert model, a predetermined number of expert models are selected from the expert pool. The selected expert model is used to perform detection based on the traffic features and log features to obtain the detection results.

[0005] Optionally, the attention weights are calculated based on a preset attention parameter vector and the traffic features and log features; The process of enhancing the weights of each expert model using preset attention weights to obtain enhanced weights for each expert model includes: In the attention weights, the weight value with the largest value is retained according to a predetermined proportion, and the other weight values ​​are set to zero to obtain the enhanced attention weights; The enhanced weights of each expert model are obtained by multiplying the weights of each expert model element by element with the enhanced attention weights.

[0006] Optionally, the expert matching degree is calculated based on the detection task probability and a preset expert ability matrix, using the following method: ; Among them, S ( x , i ) as a feature x With expert models i Expert matching degree p [ j ]for x Belongs to the detection task j The probability, E [ i ][ j [For expert models] i In the detection task j Historical average indicators m To detect the number of task types.

[0007] Optionally, based on the expert matching degree and the enhancement weights of each expert model, the corrected weights of each expert model are calculated, using the following method: ; in, For expert models i Correction weights, Expert models i, j Enhanced weights, k This represents the number of expert models.

[0008] Optionally, based on the adjusted weights of each expert model, a predetermined number of expert models are selected from the expert pool, including: When the system load exceeds the preset load threshold, the expert model with the largest correction weight is selected. When the system load is less than or equal to the load threshold, at least two expert models with the largest correction weights are selected.

[0009] Optionally, the expert model includes a protocol parsing model; the detection based on the traffic features and log features using the selected expert model includes: The protocol sequence is obtained by using the protocol parsing model based on the traffic and log features; The protocol sequence is verified against preset protocol syntax rules to obtain the verification result.

[0010] Optionally, the protocol sequence includes multiple protocol fields; the protocol syntax rules include protocol transition logic consisting of multiple protocol states; The protocol sequence is verified against preset protocol syntax rules to obtain the verification result, including: According to the protocol transfer logic, the corresponding protocol fields in the protocol sequence are verified. If the current protocol field is successfully verified, the process jumps to the next protocol state. When jumping to the protocol state of a custom protocol, the custom protocol in the protocol field is verified against the read custom protocol. If the verification is successful, the process jumps to the next protocol state. If all protocol state checks are successful, the protocol sequence is grammatically compliant; if any protocol state check fails, the protocol sequence is grammatically abnormal.

[0011] Optionally, the method further includes: When the verification result is a syntax error, the error level is output; When the anomaly level is the first level, the current connection is blocked, the weight of the protocol parsing model is increased to a predetermined weight value, and the expert capability matrix is ​​updated. When the anomaly level is the second level, an anomaly log is recorded.

[0012] Optionally, the protocol syntax rules include fixed specifications that satisfy the protocol specification and custom specifications; The protocol sequence is validated against preset protocol syntax rules, including: The first processor is used to validate the protocol fields of the fixed specifications, and the second processor is used to perform fine-grained validation of the protocol fields of the custom specifications.

[0013] This application embodiment also provides a safety detection device for a power industrial control system, including: The acquisition module is used to acquire network traffic and log data; The extraction module is used to extract traffic features from the network traffic and log features from the log data; The weight prediction module is used to predict the weight of each expert model in the expert pool based on the traffic characteristics and log characteristics using a pre-built expert weight prediction model. The weight enhancement module is used to enhance the weights of each expert model using preset attention weights, so as to obtain the enhanced weights of each expert model. The task prediction module is used to predict the probability of detection tasks based on the traffic characteristics and log characteristics using a pre-built task prediction model. The matching module is used to calculate the expert matching degree based on the detection task probability and the preset expert ability matrix; The weight correction module is used to calculate the corrected weight of each expert model based on the expert matching degree and the enhancement weight of each expert model. The selection module is used to select a predetermined number of expert models from the expert pool based on the corrected weights of each expert model. The detection module is used to perform detection based on the traffic features and log features using the selected expert model, and obtain the detection results.

[0014] As can be seen from the above, the power industrial control system security detection method and apparatus provided in this application include acquiring network traffic and log data, extracting traffic features and log features, predicting the weights of each expert model using an expert weight prediction model based on the extracted features, predicting the probability of detection tasks using a task prediction model, enhancing the weights of each expert model using preset attention weights to obtain enhanced weights for each expert model, calculating the expert matching degree based on the detection task probability and a preset expert capability matrix, calculating the corrected weights of each expert model based on the expert matching degree and the enhanced weights of each expert model, selecting a predetermined number of expert models based on the corrected weights of each expert model, and using the selected expert models for detection to obtain detection results. This application can improve the accuracy, dynamic adaptability, and accuracy and completeness of detection results of multi-expert systems in complex power industrial control scenarios. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a schematic diagram of the method flow of an embodiment of this application; Figure 2 This is a schematic diagram of the overall framework of an embodiment of this application; Figure 3 This is a schematic diagram of the overall framework of another embodiment of this application; Figure 4 This is a schematic diagram of the protocol syntax matching process in an embodiment of this application; Figure 5 This is a schematic diagram of the protocol syntax matching process according to another embodiment of this application; Figure 6 This is a schematic diagram of the overall process of yet another embodiment of this application; Figure 7 This is a block diagram of the device structure according to an embodiment of this application; Figure 8This is a block diagram of the electronic device structure according to an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this disclosure clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0018] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this disclosure pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0019] In related technologies, power industrial control systems contain multi-source heterogeneous data sources such as network traffic and log data from various protocols. Security detection methods based on a single model suffer from problems such as difficulty in processing unified features of multi-source heterogeneous data, low detection accuracy, high computational complexity, poor model interpretability, imbalanced sample data, and insufficient cross-environment migration capabilities, resulting in unsatisfactory detection performance. Multi-expert models based on static routing predefine the professional fields and responsibilities of each expert model and make routing decisions based on the displayed characteristics of the input data (e.g., data type, source). This hard routing mechanism assigns specific tasks to fixed experts, failing to dynamically adjust expert allocation strategies, potentially leading to uneven expert load. Furthermore, it does not consider the dynamic matching relationship between data characteristics and experts in power industrial control scenarios. When task boundaries are unclear, fixed task allocation may result in incomplete processing and decreased detection accuracy. For example, when the multi-source heterogeneous data in the system simultaneously includes DNP3 protocol traffic and abnormal login logs, static routing may assign it to a single expert, causing protocol attack features to be ignored.

[0020] In view of this, embodiments of this application provide a security detection method for power industrial control systems. This method extracts traffic and log features from real-time acquired network traffic and log data. Based on the extracted features, it predicts the weights of each expert model and the probability of detection tasks. An attention mechanism is used to enhance the weights. Expert matching degree is calculated based on the detection task probability and an expert capability matrix based on prior knowledge. The weights are then corrected by combining the enhanced weights and the expert matching degree to achieve dynamic routing adjustment, ensuring that the most suitable expert model receives a higher weight. Based on the corrected weights of each expert model, a suitable expert model is selected to execute the detection task. This method can significantly improve the accuracy, dynamic adaptability, and accuracy and completeness of detection results of multi-expert systems in complex power industrial control scenarios.

[0021] The technical solution of this application will be further described in detail below through specific embodiments.

[0022] like Figure 1 , 2 As shown in the figure, this application provides a safety detection method for a power industrial control system, including: S101: Obtain network traffic and log data; In this embodiment, all network traffic of the system is captured, and log data recorded in the system, including but not limited to system logs and Windows event logs, is obtained using log collection tools. All acquired network traffic and log data are preprocessed, filtering out traffic corresponding to non-industrial control protocols (e.g., HTTP) from all network traffic, retaining network traffic corresponding to industrial control protocols (including DNP3, IEC 61850, etc.), and processing all log data into a unified log format, such as CEF format.

[0023] S102: Extract traffic features from network traffic and extract log features from log data; In this embodiment, after preprocessing the acquired network traffic and log data, traffic-related features are extracted from the preprocessed network traffic, including but not limited to session duration, packet long variance, protocol instruction sequence (such as the function code sequence of the DNP3 protocol, etc.), and log-related features are extracted from the preprocessed log data, including key event records, etc.

[0024] In some ways, such as Figure 2As shown, a feature extraction layer for extracting traffic features is constructed based on a Convolutional Neural Network (CNN), and a feature extraction layer for extracting log features is constructed based on the BERT (Bidirectional Encoder Representations from Transformers) model. Semantic information is understood from the log data, and key event codes corresponding to key event records are extracted. These key event codes are obtained by weighting using TF-IDF; for example, "user permission change" in the log data is encoded as EVT-107. The above is merely an illustrative example, and the models and methods used for feature extraction are not specifically limited.

[0025] S103: Based on traffic characteristics and log characteristics, use a pre-built expert weight prediction model to predict the weights of each expert model in the expert pool; In this embodiment, the expert weight prediction model adopts a gating network based on a multilayer perceptron (MLP) and attention mechanism. The extracted traffic features and log features are input into the gating network, which processes the input features and outputs the weights of each expert model in the expert pool.

[0026] In some approaches, the expert pool used for power control system testing includes protocol parsing models, semantic understanding models, and behavioral analysis models. The protocol parsing model is used to parse industrial control protocols such as DNP3 and IEC 61850; the semantic understanding model is used for log analysis; and the behavioral analysis model is used to detect APT attack chains. Depending on the actual application scenario and testing requirements, other expert models can be added to achieve corresponding testing tasks; the specific number and functionality of the expert models are not limited.

[0027] In some implementations, the input to the gating network is a multimodal feature vector composed of fused traffic features and log features. , d The dimension of the multimodal feature vector is a real number vector, and the multimodal feature vector includes session duration t, packet variance, etc. The multimodal feature vectors include: protocol instruction sequence encoding (seq, such as one-hot encoding of the function code sequence in the DNP3 protocol), key event encoding vector (log_tfidf), timestamp encoding (ts_emb), device type (dev_type, such as substation remote terminal unit (RTU), dispatch server), and network partition (zone, such as production control zone, management information zone). Optional dimensions of the multimodal feature vectors are also included. d The feature size is 512, meaning that 512-dimensional features are extracted from network traffic and log data for detection.

[0028] Based on the input multimodal feature vector, a multilayer perceptron is used to extract the weights of the expert model. The multilayer perceptron consists of a first hidden layer, a second hidden layer, and an output layer. The method for extracting weights using the multilayer perceptron is as follows: (1) (2) (3) in, h 1 corresponds to the first hidden layer. h 2 corresponds to the second hidden layer. W 1. W 2. W 3 represents the trainable weight parameters. b 1. b 2. b 3 is the bias term. z These are the weights output by the output layer. Optional. h The dimension of 1 is 256. h The dimension of 2 is 128. When the number of expert models is 3, z The dimension is 3. , The slope of the LeakyReLU activation function This is used to alleviate the gradient vanishing problem.

[0029] S104: Enhance the weights of each expert model using preset attention weights to obtain the enhanced weights of each expert model. In this embodiment, considering that different protocols have different priorities in the power scenario (e.g., the DNP3 protocol field has a high priority in the power scenario), which has a key impact on routing decisions, attention weights are introduced to enhance the weights of each expert model output by the multilayer perceptron, in order to strengthen the influence of high-priority features on the selection of expert models.

[0030] The attention weights are calculated based on a preset attention parameter vector and traffic and log features, using the following method: (4) in, The attention parameter vector can be optimized through training. a l For input multimodal features x Features l Importance weights are determined by combining multimodal features with attention parameters. Perform a dot product operation to calculate the correlation between the two, and then obtain the attention weight distribution through Softmax normalization. a .

[0031] In some embodiments, the weights of each expert model are enhanced using preset attention weights to obtain enhanced weights for each expert model, including: In the attention weights, the largest weight value is retained according to a predetermined proportion, and the other weight values ​​are set to zero to obtain the enhanced attention weights; The enhanced weights of each expert model are obtained by multiplying the weights of each expert model element by element with the enhanced attention weights.

[0032] In this embodiment, after calculating the attention weights of each feature in the multimodal features, the order of the attention weights of each feature is determined according to the weight values ​​from largest to smallest. A certain proportion of the larger weight values ​​at the top are retained, and the remaining weight values ​​are set to zero. For the weights of each expert model, the weight is multiplied element-wise with the retained attention weights to obtain the enhancement weight of the corresponding expert model, expressed as: (5) Among them, MLP ( x The output of the multilayer perceptron (i.e., in Equation 3) is the result of the multilayer perceptron. z ), This is the Hadamard product (i.e., element-wise multiplication). From normalized attention weights a In this approach, the weights of the feature dimensions with the largest values ​​in the top f% are retained, while the weights of other feature dimensions are reset to 0 to strengthen high-priority features. Optionally, f can be 30.

[0033] According to formula (5), the attention weight vector focuses on high-priority features. Adjusting the weights of the multilayer perceptron output z The resulting enhanced weight vector z' can more strongly reflect the influence of features judged as important by the attention mechanism on the selection of expert models. The enhancement weight vector z' is normalized using the Softmax function and transformed into a probability distribution. W The weight distribution of the expert model is obtained. , is represented as: (6) in, W i To be assigned to expert models i The normalized augmented weights satisfy = 1. For expert models i Enhanced weights.

[0034] S105: Based on traffic characteristics and log characteristics, use a pre-built task prediction model to predict the probability of detection tasks; In this embodiment, a task prediction model is implemented based on a lightweight CNN network. Multimodal features are input into the task prediction model, and the model predicts the detection task probability matrix corresponding to the features. , m To detect the number of task types.

[0035] In some approaches, the number of typical detection task types in power control systems can be taken as... m =10, the detection task types include DNP3 function code anomaly detection, IEC61850MMS message tampering detection, brute-force log identification, Modbus / TCP abnormal function code and register access detection, industrial control malware and attack platform behavior detection, industrial network abnormal traffic and communication relationship detection, critical operation sequence anomaly and "skip step" attack detection, privileged account abnormal operation and permission abuse detection, industrial control asset abnormal status and data integrity detection, and unauthorized external connection and data leakage detection. The above is only an illustrative example, and the type and number of detection tasks can be adjusted and determined according to the actual application scenario. This application does not impose specific limitations.

[0036] S106: Calculate the expert matching degree based on the detection task probability and the preset expert ability matrix; In this embodiment, considering that determining the weight of an expert model based solely on data features is not comprehensive enough and does not take into account the expert model's ability to handle tasks, knowledge of the expert's historical task handling capabilities is introduced to ensure that highly capable experts receive higher weights when handling tasks they are good at.

[0037] To quantify the processing capabilities of each expert model for different detection tasks, prior knowledge was statistically calculated based on the performance of each expert model in historical detection tasks, and an expert capability matrix was constructed based on the prior knowledge. Where matrix element E[i][j] represents the expert model i In the detection task j Historical average metrics. In some approaches, the historical average metric for expert models can be the F1-score, which is a comprehensive metric that measures the precision and recall of a classification model. The value ranges from [0, 1]. The higher the value, the stronger the expert's ability in the detection task.

[0038] In some embodiments, the expert matching degree is calculated based on the detection task probability and the expert ability matrix, using the following method: (7) Among them, S ( x , i () is a multimodal feature x With expert modelsi Expert matching degree p [ j ]for x Belongs to the detection task j The probability, .

[0039] According to equation (7), the expert matching degree is the probability of the detection task. p and expert capabilities E[ i The weighted dot product reflects the expert model. i In the current input multimodal features x The comprehensive capability of the expert model in terms of the most likely detection task type. i Based on multimodal features x If the predicted high-probability detection task has strong capabilities (i.e., a high E-value), then the expert matching degree is relatively high; conversely, if the expert model has poor capabilities, then the expert matching degree is relatively low. i Based on multimodal features x If the predicted high-probability detection task has weak capabilities (i.e., low E value), then the expert matching degree is small.

[0040] S107: Calculate the corrected weights of each expert model based on the expert matching degree and the enhancement weights of each expert model; In this embodiment, after determining the expert matching degree and the enhancement weights of each expert model, the weights of each expert model are corrected to obtain the final optimized corrected weights. The method is as follows: (8) in, W i , W j Expert models i, j Normalized enhanced weights, k This refers to the number of expert models. That is, for each expert model... i Increase its weight W i Multiplying by its expert matching degree with the current input multimodal features as the numerator, and then multiplying all expert models ( The summation is used as the denominator to calculate the normalized result, thus obtaining the expert model. i Correction weights .

[0041] The corrected weights integrate data-driven (corresponding to augmentation weights) and knowledge-driven (corresponding to expert matching degree) information. If the expert model has high augmentation weights and high expert matching degree, it means that it is favored by the gating network and is good at handling the current detection task, so its corrected weights will be significantly increased. If the expert model has high augmentation weights but low expert matching degree, it means that the gating network may misjudge its applicability, so its corrected weights will be lowered. If the expert model has high expert matching degree, that is, it is very good at the current detection task, even if its augmentation weights are not high, its corrected weights may be increased. For example, when the input multimodal features are identified as DNP3 abnormal traffic, the corresponding detection task prediction probability is high, and the protocol parsing model has a high historical detection capability E[1][j] on the detection task, then the expert matching degree will be close to 1. Even if the augmentation weights output by the gating network are not very high, the calculated corrected weights will be significantly increased, ensuring that the most suitable expert model takes the lead.

[0042] S108: Select a predetermined number of expert models from the expert pool based on the corrected weights of each expert model; S109: Detection is performed using the selected expert model based on traffic features and log features to obtain detection results.

[0043] In this embodiment, after determining the correction weights of each expert model, the most suitable expert model is selected based on these correction weights to perform the detection task based on traffic and log features. Considering both system load and detection accuracy, a suitable number of expert models are selected, including: When the system load exceeds the preset load threshold, the expert model with the largest correction weight is selected. When the system load is less than or equal to the load threshold, select at least two expert models with the largest adjustment weights.

[0044] In this embodiment, considering system load factors, when the system processor utilization is greater than the load threshold, only the expert model with the largest correction weight is selected to execute the detection task, sacrificing some accuracy to ensure system real-time performance; when the system load is less than or equal to the load threshold, at least two expert models with the largest correction weights are selected to execute the detection task in parallel, ensuring detection accuracy while satisfying real-time performance, as expressed as: (9) The load threshold was set to 80%, and a GPU processor was used.

[0045] like Figure 6As shown, in some methods, to balance detection accuracy and computational efficiency, a Top-k (k=2) expert selection mechanism is adopted. When the system load is lower than the load threshold, the two expert models with the highest weights are selected to perform the detection task in parallel based on multimodal features. The outputs of the two expert models are then weighted and fused to generate the final detection result, as shown below: (10) Where y represents the final detection result, y i For expert models i The output detection result vector, c represents the number of threat type tags. For example, when c=5, the corresponding 5 threat tags are: normal, protocol attack, malicious login, APT behavior, and unknown anomaly.

[0046] The power control system security detection method provided in this embodiment predicts the weights of each expert model and the probability of detection tasks based on real-time extracted multimodal features. It uses an attention mechanism to enhance the influence of high-priority features on the selection of expert models, thereby enhancing the weights of each expert model. It combines the detection task probability and the expert capability matrix to determine the expert matching degree, and integrates the data-driven enhanced weights with the knowledge-driven expert matching degree to obtain a modified weight with high robustness and accuracy. This enables dynamic routing adjustment, ensuring that the expert best suited to handle the current detection task receives a higher weight. Based on the modified weights of each expert model and combined with the system load, an appropriate number of expert models are selected to execute the detection task. This method can significantly improve the accuracy of routing decisions, dynamic adaptability, and accuracy of detection results of multi-expert systems in complex power control scenarios.

[0047] In some specific implementations, the method of this application is applied to threat detection in substation equipment business scenarios. The specific process is as follows: Network traffic and log data from substation RTU devices are collected. Network traffic includes DNP3 protocol traffic containing the abnormal function code 0x80, and log data includes login failure logs for the same device. Feature extraction is performed on the network traffic and log data to obtain traffic features and log features. Multimodal features are obtained through feature fusion, including 0x80 function code encoding and keyword encoding vectors corresponding to login failures.

[0048] Multimodal features are input into the task prediction model, and the model outputs the detection task probability p=[p1,..., p5,...,p 10= [0.7, 0.05, 0.01, 0.01, 0.2, 0.01, 0.005, 0.005, 0.005, 0.005], where the probability of detection task 1 corresponding to DNP3 protocol attack is 70%, and the probability of detection task 5 corresponding to brute-force attack is 20%.

[0049] Calculate the expert matching degree based on the detection task probability and the expert ability matrix:

[0050]

[0051]

[0052] Based on the calculated enhancement weights W=[0.5, 0.3, 0.2], calculate the correction weights: = 0.5 × 0.794 = 0.397 = 0.3 × 0.566 = 0.1698 = 0.2 × 0.36 = 0.072 The denominator is:

[0053] The corrected weights for each expert model are then:

[0054] Using the Top-2 selection mechanism, expert model 1 and expert model 2 were chosen, i.e., the protocol parsing model and the semantic understanding model were selected for detection, and the corresponding detection results are as follows: Expert Model 1: y1=[0,1,0,0,0] → Protocol attack detected Expert Model 2: y2=[0,0,0,0,1] → Unknown anomaly detected (login anomaly) The detection results of the two expert models are fused to obtain the final detection result: y=[0,0.621×1,0,0,0.266×1]=[0,0.621,0,0,0.266] Based on the detection results, the confidence level of the protocol attack is 65%, and the confidence level of the login anomaly is 28%.

[0055] In some methods, the effectiveness of the proposed method was verified using the IEEE 39-node system dataset (containing 100,000 normal data entries and 50,000 attack samples). Experimental results show that the proposed method achieves a routing accuracy of 92.3%, i.e., the proportion of correctly assigned data to the optimal expert, which is 37% higher than that of a static routing multi-expert system; the computational resource utilization (i.e., the average expert load rate) is increased from 61% to 89%, and the inference speed reaches 5000 entries / second in a single-processor environment; when 30% of the attack samples are mixed with new attacks (attacks without historical features), the F1-score of dynamic routing remains at 88.5%, while the F1-score of the static routing multi-expert system is 72.1%. The proposed method significantly improves the dynamic routing performance and the system's generalization ability.

[0056] In some implementations, the training objective of the gated network is to minimize the weighted sum of the detection loss and the routing regularization loss, and the constructed loss function is: (11) Among them, detection loss L detect Cross-entropy loss is used to measure the detection results of the fusion. y The difference from the actual label ensures the accuracy of the test results; These are hyperparameters used to control the strength of routing regularization, for example, =0.01; Routing regularization loss L route The formula used to enforce sparsity in the weight distribution and avoid resource waste is as follows: (12) In this embodiment, a dynamic weight allocation and Top-k selection mechanism is employed. Based on the input data, the weights of each expert model are dynamically calculated. After weight adjustment, the expert model with the highest weight is selected to handle the task. This allows multiple expert models to be mobilized to handle complex tasks, and the most suitable expert model can be dynamically selected based on changing input data, avoiding the problem of some expert models being overloaded and resource imbalance due to fixed task types. Simultaneously, an entropy regularization term is introduced into the loss function for training the gating network. L route When training a gating network to handle input data, it concentrates high weights on 1-2 of the most suitable expert models, rather than distributing them evenly across all expert models. This avoids wasting resources by having each expert model participate only slightly in the computation, thus improving overall utilization efficiency. Furthermore, when high system load is detected, the K value is dynamically adjusted to reduce the number of experts involved in the computation, preventing system overload and achieving system resource load balancing.

[0057] In some embodiments, for the feature extraction layer, to address the issue of poor adaptability of general-purpose large models in power industrial control scenarios, an incremental pre-training optimization mechanism is adopted. This mechanism employs a two-stage training process involving feature extraction and domain adaptation, combined with low-rank adaptation (LoRA) technology, to reduce computational costs while maintaining model performance. Specifically, the first stage freezes the bottom-level parameters of the feature extraction layer model, fine-tuning only the top-level parameters; the second stage performs full parameter fine-tuning to quickly adapt to domain features.

[0058] Specifically, an improved Transformer architecture is used as the feature extraction layer, with a 12-layer encoder containing 8 attention heads and a hidden layer dimension of 768. Byte-level BPE segmentation is employed, supporting mixed encoding of protocol fields and log text. Training data includes the CIC-IDS2017 general dataset (containing 600,000 traffic records), the ELK log dataset (containing 1 million system log records), and the WikiText-103 dataset. An incremental training scheduler dynamically adjusts the ratio of general data to power data (e.g., 3:7) to improve the model's generalization ability on scarce attack samples. The pre-training task combines a Masked Language Model (MLM) and a Traffic Log Matching (TLM) task to enhance the model's understanding of multimodal data. The pre-training task is set as follows: randomly mask 15% of the input tokens, predict the original values, and given traffic features, predict the corresponding log event type (multi-class classification task).

[0059] The LoRA technique is employed to achieve efficient parameter fine-tuning by inserting a low-rank matrix into the attention layer of the Transformer. Let the original weight matrix be... , d =768, during fine-tuning only updates the low-rank matrix. W = W 0+ BA ,in, B Let be the lower projection matrix. r =16, rank is much smaller than d A is the upper projection matrix. The training parameters are B and A, and the total number of parameters is... d × r + r × d =2×768×16=24,576, which is only 0.02% of the total parameters, significantly reducing computation and storage costs and avoiding overfitting. Moreover, the LoRA adapter can be loaded and updated independently, supporting dynamic upgrades of edge devices without the need to redeploy the complete model.

[0060] Output of attention layerh for: (13) in, Q, K, V These are the query, key, and value vectors, respectively. LoRA only modifies the attention weights and does not affect other parts of the model.

[0061] In some specific embodiments, the model performance of this application was verified on the IEEE 39-node system dataset (containing 50,000 power control system samples). On a GPU processor, fine-tuning using LoRA technology requires only 8 hours, saving 92% of the training time compared to full-parameter fine-tuning (more than 100 hours), significantly improving training efficiency. In the power control system threat detection task, the F1-score reached 89.7%, an improvement of 15.2% compared to the 74.5% of the general feature extraction layer model, effectively improving model performance. In the extreme data scarcity scenario with only 5% attack samples, fine-tuning using LoRA technology reduced the overfitting rate to 3.2% (compared to 18.7% for full-parameter fine-tuning). In the detection of attacks using three protocols: DNP3, IEC 61850, and Modbus, the average accuracy reached 87.3%, significantly enhancing domain adaptability.

[0062] In some implementations, after two stages of incremental pre-training of the feature extraction layer, the gating network and expert models are initialized based on the trained feature extraction layer. First, the parameters of the expert models are frozen, and only the gating network is trained. Without changing the expertise of each expert, the router learns to command. After the gating network is trained, the gating network and each expert model are jointly trained, enabling the router and experts to adapt to each other and collaboratively optimize, achieving optimal overall performance. Specifically, during the training phase of the gating network, public datasets (such as CSE-CIC-IDS2018 and the IEEE 39-node system attack dataset) and an industrial control log dataset from a power company (containing 2000 labeled APT attack chain samples) are used for training.

[0063] In some embodiments, detection is performed using selected expert models based on traffic and log features, including: The protocol sequence is obtained by using a protocol parsing model based on traffic and log features for detection. The protocol sequence is matched against the preset protocol syntax rules to obtain the matching result.

[0064] In this embodiment, when a protocol parsing model is selected to perform the detection task, the protocol parsing model outputs the protocol sequence related to the industrial control protocol based on multimodal feature detection. Considering that the industrial control protocols of power systems have strong syntactic constraints—for example, the function codes of the protocol have a defined range, and object combinations have a defined format—such as… Figure 3As shown, a protocol syntax constraint layer is added. The protocol syntax constraint layer is used to match the protocol sequence output by the protocol parsing model according to the set protocol syntax rules to determine whether there are any abnormalities in the protocol that do not conform to the syntax.

[0065] The protocol parsing expert is a data-driven model that detects known or similar protocol attacks by learning patterns. However, it cannot identify all anomalies that violate protocol specifications, especially constructed "syntactically correct but semantically malicious" messages or unknown attacks that directly violate hard syntax rules. Therefore, based on the protocol sequence output by the protocol parsing expert, a protocol syntax constraint layer is further employed. This layer performs "zero false positive" compliance checks based on explicit protocol specifications, providing a deterministic and interpretable defense mechanism. Through the mutual complementarity and verification between the protocol parsing expert and the protocol syntax constraint layer, a comprehensive and thorough detection of protocol security is achieved. For example, the protocol parsing expert might fail to identify a novel attack and classify it as "normal," while the protocol syntax constraint layer might detect an illegal function code and mark it as a "protocol attack." Alternatively, the protocol parsing expert model might detect a known attack pattern, while the protocol syntax constraint layer verifies that the attack does indeed violate the protocol syntax.

[0066] In some implementations, the protocol sequence includes multiple protocol fields; the protocol syntax rules include protocol transition logic consisting of multiple protocol states; The protocol sequence is validated against preset protocol syntax rules to obtain the validation results, including: According to the protocol transition logic, the corresponding protocol fields in the protocol sequence are validated. If the current protocol field is validated successfully, the process jumps to the next protocol state. When jumping to the protocol state of a custom protocol, the custom protocol in the protocol field is validated against the read custom protocol. If the validation is successful, the process jumps to the next protocol state. If all protocol state checks are successful, the protocol sequence is grammatically correct; if any protocol state check fails, the protocol sequence is grammatically incorrect.

[0067] In this embodiment, the protocol sequence output by the protocol parsing model includes multiple protocol fields obtained after protocol parsing. For example, for the DNP3 protocol, the protocol sequence output by the model is I = {start_flag, len, ver, func_code, obj_group, data, crc}, where start_flag is the start-of-frame character, len is the frame length, ver is the version number, func_code is the function code, obj_group is the group number, data is the data field, and crc is the checksum. The above is merely an illustrative example; different protocols can parse different protocol sequences, and the specific form of the protocol sequence is not limited.

[0068] For different types of protocols, corresponding protocol transition logic is constructed according to the relevant protocol specifications. This protocol transition logic consists of multiple protocol states, and the compliance of each protocol field in the protocol sequence is verified through the state transitions of the protocol states. If the value of the currently verified protocol field conforms to the corresponding syntax rules, the process jumps to the next protocol state and continues to verify the next protocol field. If it does not conform to the syntax rules, the state transition stops and an exception is marked.

[0069] For example, for the DNP3 protocol, construct the protocol transition logic of a finite state machine, with the state set S = {S0, S1, S2, S3, S4, S...}. err}, where state S0 is the initial state, used to verify the start-of-frame character; state S1 is the frame header verification state, used to verify the frame length and version number; state S2 is the function code verification state, used to verify the function code range; state S3 is the object group number verification state, used to verify the group number format; state S4 is the data field verification state, used to verify the data length and type; state S... err This is an abnormal state used to record the exception code corresponding to the verification exception, such as function code exception, group number exception, etc.

[0070] The verification begins from the initial state. In the initial state S0, the value of the start-of-frame character is checked to see if it is the start-of-frame character 0x05 of the DNP3 protocol. If it is, the process jumps to state S1 to continue verifying the frame header, which is represented as... (S0, start_flag=0x05) = S1; In state S1, check if the frame length is within the compliance range. If it is, jump to state S2 to continue checking the function code, which is represented as... (S1, len [6, 255]) = S2; In state S2, check if the function code is valid. If it is, jump to state S3 to continue checking the group number, which is represented as (S2, func_code [0x00, 0x7F]) = S3; In state S3, check if the group number is valid. If it is, jump to state S4 to continue checking the data field, which is represented as (S3, obj_group [0x0000, 0xFFFF]) = S4; During the verification process, if any state fails the verification, the process jumps to the abnormal state S. err For example, if the function code is invalid, an abnormal state will be entered, which is represented as (S2, func_code [0x00, 0x7F]) = S err The above verification process can be represented as: (14) This embodiment achieves zero false alarms in protocol compliance detection by hard-coding the protocol specification into protocol transfer logic and verifying the value of each protocol field sequentially according to the protocol transfer logic. This improves the accuracy and comprehensiveness of detection, while also providing interpretability and determinism of the model.

[0071] In some implementations, to improve processing efficiency and meet real-time requirements, the protocol syntax constraint layer implements protocol syntax validation based on a dual-processor architecture. The protocol syntax rules include two parts: fixed specifications and custom specifications in the protocol specification. During validation, the first processor validates the protocol fields of the fixed specifications in the protocol specification; the second processor performs fine-grained validation of the protocol fields of the custom specifications in the protocol specification. Custom specifications include customizable protocol fields (e.g., custom group numbers), complex data fields (e.g., variable-length data types), etc.

[0072] In some methods, when using the first processor for verification, if multiple conditions exist for the corresponding protocol field in a protocol state, the first processor can perform parallel verification. That is, each condition is verified in parallel, and the process only proceeds to the next protocol state if all conditions pass verification. For example, in the function code verification state, it is necessary to determine whether the function code's range is valid, whether it is in the preset list of valid function codes, and whether the current device supports the function corresponding to the function code. The first processor can perform range comparisons, table lookups, and other parallel operations to verify the above three conditions. Only if all conditions pass verification will the process proceed to the next protocol state; otherwise, it will proceed to an abnormal state.

[0073] like Figure 4 , 5 As shown, in some methods, the first processor is implemented based on an FPGA chip, and the second processor is implemented based on a CPU. Using the FPGA to verify fixed-specification protocol fields such as start symbols, frame headers, and function code ranges improves verification efficiency, achieving approximately 70% of the total verification workload. The verification latency of protocol fields is reduced to the microsecond level, meeting the millisecond-level real-time requirements of power control systems. Using the CPU to verify custom protocol fields and data fields improves verification flexibility and accuracy. Through dual-processor collaborative verification, processing efficiency is effectively improved.

[0074] In some implementations, during verification, the first processor loads the protocol transfer logic to quickly verify the protocol fields of the fixed specification. When the state jumps to the protocol field corresponding to the custom specification, the first processor sends the content of the corresponding protocol field to the second processor. The second processor queries the pre-built metadata database based on the content of the received protocol field to verify whether the query content is consistent with the saved dynamic rules. For example, it queries whether the custom group number matches the custom rule corresponding to the device model. If they match, the verification passes and the process continues to jump to the next protocol state.

[0075] In some implementations, the metadata database stores structured information of protocol fields that conform to the protocol specification. It adopts a relational database (MySQL) and memory cache (Redis) architecture. The database mainly stores a protocol basic information table, a field constraint table, and a state transition rule table. Some of the contents of the tables are shown in Tables 1-3.

[0076] Table 1. Basic Protocol Information

[0077] Table 2 Protocol Field Constraints

[0078] Table 3 State Transition Rules

[0079] In some implementations, considering the existence of multiple protocol versions with differing specifications (e.g., the function code range differs between DNP3 version V1 and version V2), a version field is set in the metadata database to ensure compatibility with multi-version protocol verification. The rules for the corresponding version are read through the protocol field, improving the system's compatibility and applicability in heterogeneous power environments. For example, for a device with the Schneider RTU model, which supports the DNP3 protocol version V1, the processor loads the function code range `func_code` from version V1 when verifying function codes. [0x00,0x60]; For devices with the ABB RTU model, which support the V2 version of the DNP protocol, when verifying function codes, the processor loads the V2 version function code range func_code. [0x00,0x7F].

[0080] In some implementations, the effectiveness of protocol syntax verification is verified through experiments. A test set containing 20,000 protocol attack samples (covering DNP3 function code injection, IEC 61850 MMS service type anomalies, etc.) was used. Test results show that the accuracy of this application in detecting DNP3 attacks reaches 95.3%, a significant improvement over traditional feature-based methods. Simultaneously, the average latency of protocol verification is 3.2ms, meeting real-time requirements. The adaptation success rate for 10 different protocol versions is 100%, with no false positives due to version incompatibility.

[0081] In some embodiments, the detection method further includes: When the validation result is a syntax error, the error level is output; When the anomaly level is Level 1, the current connection is blocked, the weight of the protocol parsing model is increased to the predetermined weight value, and the expert capability matrix is ​​updated. When the exception level is level 2, an exception log is recorded.

[0082] In this embodiment, the protocol sequence is validated according to the protocol transfer logic to obtain the validation result. If all protocol fields pass the validation, the data packet is transmitted normally. If any protocol field fails the validation, the corresponding exception code is recorded using the exception state record, and alarm information including the exception code, device identifier, and timestamp is generated.

[0083] The anomaly code defines the anomaly level. When the anomaly level is Level 1, the firewall is invoked to block the current connection operation of the device experiencing the anomaly. Simultaneously, the weight of the protocol parsing model is forcibly increased to a predetermined weight value (e.g., 0.9). The protocol parsing model is then used to prioritize processing subsequent network traffic from that device. The expert capability matrix is ​​updated by adding the historical average index value of experts handling this type of detection task to the matrix. In this way, by triggering expert weight updates through protocol syntax anomaly detection and dynamically adjusting routes to improve expert detection capabilities, combined with firewall actions, a closed-loop control is formed, enhancing the system's dynamic response capability to persistent attacks and improving system security.

[0084] When the anomaly level is Level 2, only the corresponding log content needs to be recorded. Optionally, Level 1 includes behaviors that affect system security, such as function code attacks, while Level 2 includes behaviors that pose little threat to system security, such as abnormal data field lengths.

[0085] In this embodiment, multiple expert models work together to process the task, and the detection results of each expert model are fused to obtain the final detection result. This can simultaneously discover multi-dimensional threat indicators, establish correlations, and initially reconstruct the attack chain. At the same time, when the protocol syntax constraint layer detects an anomaly, the system forces an increase in the weight of subsequent traffic from the same device by the protocol parsing expert through feedback. This allows the system to continuously monitor ongoing attack events, thereby fully capturing the entire attack chain and improving the attack chain reconstruction capability.

[0086] Optionally, reinforcement learning algorithms can be used, with detection accuracy as the reward function, to dynamically learn the allocation strategy of the expert model. In the protocol syntax validation stage, a configurable rule engine can be used to validate each protocol field, and protocol syntax rules can be flexibly configured through the interface; the specific implementation method is not limited.

[0087] The power control system security detection method provided in this application extracts multimodal features based on real-time acquired network traffic and log data. It predicts the weights of each expert model and the probability of detection tasks based on these features, enhances the weights of expert models using attention parameters of each feature, and increases the influence of high-priority features on the selection of expert models. It determines the expert matching degree based on the correlation between the detection task probability and the expert capability matrix, and uses the expert matching degree to correct the enhanced weights of the expert models. Based on the corrected weights, it selects the most suitable expert, implementing a dynamic routing strategy that can efficiently and accurately allocate experts and improve expert resource utilization. By performing syntax-level constraint verification on the protocol, it can improve detection accuracy and comprehensiveness. When anomalies are detected, it further adjusts the weights of the expert models and dynamically adjusts the routing strategy, improving dynamic adaptability. By comprehensively considering the system load, it selects an appropriate number of expert models, ensuring detection accuracy while meeting the millisecond-level real-time requirements of the power control system.

[0088] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0089] It should be noted that the above description describes specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims may be performed in a different order than that shown in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0090] like Figure 7 As shown in the figure, this application embodiment also provides a safety detection device for a power industrial control system, including: The acquisition module is used to acquire network traffic and log data; The extraction module is used to extract traffic features from network traffic and log features from log data. The weight prediction module is used to predict the weights of each expert model in the expert pool based on traffic characteristics and log characteristics using a pre-built expert weight prediction model. The weight enhancement module is used to enhance the weights of each expert model using preset attention weights, so as to obtain the enhanced weights of each expert model. The task prediction module is used to predict the probability of detection tasks based on traffic and log characteristics using a pre-built task prediction model. The matching module is used to calculate the expert matching degree based on the detection task probability and the preset expert ability matrix; The weight correction module is used to calculate the corrected weights of each expert model based on the expert matching degree and the enhancement weights of each expert model. The selection module is used to select a predetermined number of expert models from the expert pool based on the corrected weights of each expert model. The detection module is used to perform detection based on traffic and log features using the selected expert model, and obtain the detection results.

[0091] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing the embodiments of this application, the functions of each module can be implemented in one or more software and / or hardware.

[0092] The apparatus described above is used to implement the corresponding methods in the foregoing embodiments and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0093] Figure 8 This embodiment illustrates a more specific hardware structure of an electronic device. The device may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0094] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0095] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0096] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0097] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0098] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0099] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0100] The electronic devices described above are used to implement the corresponding methods in the foregoing embodiments and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0101] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0102] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this disclosure (including the claims) is limited to these examples; within the framework of this disclosure, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0103] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this disclosure, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0104] Although this disclosure has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0105] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this disclosure.

Claims

1. A safety detection method for a power industrial control system, characterized in that, include: Obtain network traffic and log data; Extract traffic features from the network traffic and extract log features from the log data; Based on the traffic characteristics and log characteristics, the weights of each expert model in the expert pool are predicted using a pre-built expert weight prediction model. The weights of each expert model are enhanced by using preset attention weights to obtain the enhanced weights of each expert model. Based on the traffic and log characteristics, the probability of detection tasks is predicted using a pre-built task prediction model. Calculate the expert matching degree based on the detection task probability and the preset expert ability matrix; Based on the expert matching degree and the enhancement weights of each expert model, calculate the corrected weights of each expert model; Based on the corrected weights of each expert model, a predetermined number of expert models are selected from the expert pool. The selected expert model is used to perform detection based on the traffic features and log features to obtain the detection results.

2. The method according to claim 1, characterized in that, The attention weight is calculated based on a preset attention parameter vector and the traffic features and log features; The process of enhancing the weights of each expert model using preset attention weights to obtain enhanced weights for each expert model includes: In the attention weights, the weight value with the largest value is retained according to a predetermined proportion, and the other weight values ​​are set to zero to obtain the enhanced attention weights; The enhanced weights of each expert model are obtained by multiplying the weights of each expert model element by element with the enhanced attention weights.

3. The method according to claim 1, characterized in that, Based on the detection task probability and the preset expert ability matrix, the expert matching degree is calculated as follows: ; Among them, S ( x , i ) as a feature x With expert models i Expert matching degree p [ j ]for x Belongs to the detection task j The probability, E [ i ][ j [For expert models] i In the detection task j Historical average indicators m To detect the number of task types.

4. The method according to claim 3, characterized in that, Based on the expert matching degree and the enhancement weights of each expert model, the corrected weights of each expert model are calculated as follows: ; in, For expert models i Correction weights, Expert models i, j Enhanced weights, k This represents the number of expert models.

5. The method according to claim 1, characterized in that, Based on the adjusted weights of each expert model, a predetermined number of expert models are selected from the expert pool, including: When the system load exceeds the preset load threshold, the expert model with the largest correction weight is selected. When the system load is less than or equal to the load threshold, at least two expert models with the largest correction weights are selected.

6. The method according to claim 1, characterized in that, The expert model includes a protocol parsing model; the detection based on the traffic features and log features using the selected expert model includes: The protocol sequence is obtained by using the protocol parsing model based on the traffic and log features; The protocol sequence is verified against preset protocol syntax rules to obtain the verification result.

7. The method according to claim 6, characterized in that, The protocol sequence includes multiple protocol fields; the protocol syntax rules include protocol transition logic consisting of multiple protocol states; The protocol sequence is verified against preset protocol syntax rules to obtain the verification result, including: According to the protocol transfer logic, the corresponding protocol fields in the protocol sequence are verified. If the current protocol field is successfully verified, the process jumps to the next protocol state. When jumping to the protocol state of a custom protocol, the custom protocol in the protocol field is verified against the read custom protocol. If the verification is successful, the process jumps to the next protocol state. If all protocol state checks are successful, the protocol sequence is grammatically compliant; if any protocol state check fails, the protocol sequence is grammatically abnormal.

8. The method according to claim 7, characterized in that, Also includes: When the verification result is a syntax error, the error level is output; When the anomaly level is the first level, the current connection is blocked, the weight of the protocol parsing model is increased to a predetermined weight value, and the expert capability matrix is ​​updated. When the anomaly level is the second level, an anomaly log is recorded.

9. The method according to claim 7, characterized in that, The protocol syntax rules include fixed specifications and custom specifications that conform to the protocol specification; The protocol sequence is validated against preset protocol syntax rules, including: The first processor is used to validate the protocol fields of the fixed specifications, and the second processor is used to perform fine-grained validation of the protocol fields of the custom specifications.

10. A safety detection device for a power industrial control system, characterized in that, include: The acquisition module is used to acquire network traffic and log data; The extraction module is used to extract traffic features from the network traffic and log features from the log data; The weight prediction module is used to predict the weight of each expert model in the expert pool based on the traffic characteristics and log characteristics using a pre-built expert weight prediction model. The weight enhancement module is used to enhance the weights of each expert model using preset attention weights, so as to obtain the enhanced weights of each expert model. The task prediction module is used to predict the probability of detection tasks based on the traffic characteristics and log characteristics using a pre-built task prediction model. The matching module is used to calculate the expert matching degree based on the detection task probability and the preset expert ability matrix; The weight correction module is used to calculate the corrected weight of each expert model based on the expert matching degree and the enhancement weight of each expert model. The selection module is used to select a predetermined number of expert models from the expert pool based on the corrected weights of each expert model. The detection module is used to perform detection based on the traffic features and log features using the selected expert model, and obtain the detection results.

Images