Power monitoring system attack detection method and system fusing telemetering time sequence and communication structure characteristics

Abstract

The invention discloses a power monitoring system attack detection method and system fusing telemetering time sequence and communication structure characteristics, and the method comprises the steps: collecting telemetering data and network communication data, inputting the telemetering data into a Transformer encoder based on an attention mechanism, extracting the evolution characteristics of an equipment operation state, and obtaining a first characteristic output vector; coding the structured features of the network communication data to generate a feature matrix, inputting the feature matrix into a multi-channel convolutional neural network to extract local structural features of communication behaviors, and obtaining a second feature output vector; fusing the first feature output vector and the second feature output vector to generate a joint feature representation vector, inputting the joint feature representation vector into a full-connection discrimination network, and outputting the probability that the current system state is in an attack state; according to the invention, reliable identification of the abnormal attack behavior in the power monitoring system can be realized under the condition that the tag is missing or incomplete.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of power monitoring system attack detection, and particularly relates to a power monitoring system attack detection method and system fusing telemetry time sequence and communication structure features. BACKGROUND

[0002] As an important part of the power secondary system, the power monitoring system undertakes key tasks such as state perception of primary equipment, issuance of control instructions and fault linkage response, and its communication network and control logic are highly coupled, being a typical cyber-physical fusion system. Under the background of the in-depth promotion of the industrial internet, more and more field measurement and control devices, substation automation systems and dispatching terminals are connected to the communication network, the system boundary is increasingly expanding, and the attack surface is continuously increasing. Attack detection is an important technical link to ensure the safe operation of the power monitoring system, aiming to identify abnormal operations or malicious behaviors that may exist in the system in a timely manner. As an important part of power dispatching and control, the power monitoring system is highly coupled with the communication link and device state, and the possibility of network attacks continues to rise.

[0003] Prior art document 1 (CN110691100A) discloses a hierarchical network attack identification and unknown attack detection method based on deep learning. Prior art document 2 (CN116032515A) discloses a DDoS attack detection method based on Transformer on SDN. However, prior art document 1 constructs a general network intrusion detection system, and its model architecture and training strategy are designed around general network traffic, without considering the data modality heterogeneity in the power monitoring system, a specific critical information infrastructure field, including but not limited to telemetry time sequence data, communication structure data, and attack mode specialities including but not limited to slow-changing attacks, instruction injection and label scarcity. The double-layer structure of its autoencoder and discriminant model cannot effectively fuse the physical side telemetry behavior and the network side communication behavior, resulting in insufficient attack perception ability specific to the power system and strong concealment. Prior art document 2 is limited to the software-defined network (SDN) environment, and its technical target is single, only used to detect DDoS attacks, and the data source processed by the model is only network communication traffic, completely ignoring the telemetry time sequence data generated by RTU (Remote Terminal Unit), IED (Intelligent Electronic Device) and other devices in the power monitoring system, which contains a large amount of physical state information. The Transformer+CNN (Convolutional Neural Network) model structure adopted by it is designed to process single-mode traffic sequences, and cannot solve the cross-modal attack detection problem of the "communication-physical" coupling in the power system.

[0004] In addition, the prior art also faces the serious challenge of label scarcity at the application deployment level. Traditional supervised learning algorithms highly rely on massive attack samples with fine-grained annotations for model training. However, in real industrial production environments such as power monitoring, attack events are rare events, and it is extremely costly, if not unrealistic, to obtain a large-scale, diverse, and accurately annotated (e.g., accurately annotated attack type, start and end time, and specific process) sample dataset. This makes it difficult for many detection models that perform well on academic datasets to be effectively deployed and applied in real industrial scenarios, greatly reducing their practicality.

[0005] Finally, the attack patterns faced by the power monitoring system are increasingly complex and diverse, and their attack features differ significantly in the time scale. For example, port scanning, denial of service, and other attacks exhibit short-term burst communication anomalies, while low-frequency DDoS attacks, periodic probing, and other behaviors exhibit medium- and long-term periodic or slowly varying characteristics. The feature extraction models used in the prior art (such as single-scale convolutional networks) often have fixed receptive fields, making it difficult to simultaneously capture and cover multi-scale attack features from instantaneous to long-term. In the face of complex coordinated attacks, the limited "field of view" can lead to insufficient perception. SUMMARY

[0006] To address the deficiencies in the prior art, the present application provides a power monitoring system attack detection method and system that fuses telemetry timing and communication structure features, solving the problems of label scarcity, modality fragmentation, and low detection accuracy in the prior art. By fusing key behavior features in telemetry and communication data, reliable identification of abnormal attack behavior in the power monitoring system under conditions of missing or incomplete labels is achieved, reducing false positives and false negatives, and improving attack detection effectiveness.

[0007] The present application employs the following technical solutions.

[0008] The first aspect of the present application provides a power monitoring system attack detection method that fuses telemetry timing and communication structure features, comprising: Collecting telemetry data and network communication data; Inputting the telemetry data into a Transformer encoder based on an attention mechanism to extract the evolution features of the device running state, obtaining a first feature output vector; Encoding the structured features of the network communication data to generate a feature matrix, inputting the feature matrix into a multi-channel convolutional neural network to extract the local structure features of the communication behavior, and obtaining a second feature output vector; The first feature output vector and the second feature output vector are fused to generate a joint feature representation vector, and the joint feature representation vector is input into a full connection discriminant network to output a probability that the current system state is in an attack state; wherein the Transformer, the convolutional neural network and the full connection discriminant network are trained based on a composite loss function; If the probability that the current system state is in an attack state is greater than or equal to a preset confidence threshold, it is determined that the current system is attacked.

[0009] Optionally, a binary classification label is used for training, and the binary classification label includes two types of attack and non-attack.

[0010] Optionally, the composite loss function is calculated as follows:

[0011] Among them, denotes a main loss function, denotes an auxiliary loss function of the Transformer branch, denotes an auxiliary loss function of the convolution branch, denotes a weight coefficient of the auxiliary loss function of the Transformer branch, denotes a weight coefficient of the auxiliary loss function of the convolution branch.

[0012] Optionally, the main loss function is calculated as follows:

[0013]

[0014] Among them, denotes a main loss term corresponding to the i-th sample, denotes a true label of the i-th sample, denotes a predicted attack probability of the model for the i-th sample, denotes a main loss function, and N denotes the number of samples. Optionally, the convolutional neural network includes an embedding layer, a convolutional layer and a pooling layer, the embedding layer is used for dimensionality reduction processing of an input sequence, the convolutional layer is connected to the embedding layer and is used for extracting local structure features of communication behaviors, and the pooling layer is connected to the convolutional layer and is used for compression processing of output features of the convolutional layer. The feature matrix is input into a multi-channel convolutional neural network to extract local structure features of communication behaviors, and the second feature output vector is obtained, including:

[0015] ​​​The feature matrix is input into an embedding layer after integer index mapping to obtain a corresponding fixed dimension vector; The fixed dimension vector is input into a multi-channel convolution layer to extract local structure features of the communication behavior in parallel; The output features of each convolution layer are input into a pooling layer for global average pooling in the sequence dimension to compress into a second feature output vector of a preset length.

[0016] Optionally, each layer of the Transformer encoder is composed of a multi-head attention mechanism and a feedforward network, and the evolution features of the device running state are extracted by inputting the telemetry data into the Transformer encoder based on the attention mechanism to obtain a first feature output vector, including: The telemetry data is linearly transformed and position encoded to form encoder input data; The encoder input data is input into a multi-head self-attention mechanism and then transmitted to a feedforward network to obtain an output vector of the current layer of the Transformer encoder; The output vector of the current layer of the Transformer encoder is input into the next layer of the Transformer encoder to obtain an output vector after multi-layer Transformer encoding, as the first feature output vector.

[0017] Optionally, the method further includes triggering different security response mechanisms according to the attack probability and the preset confidence threshold, specifically: The deviation degree of the attack probability from the preset confidence threshold is calculated according to the attack probability and the preset confidence threshold:

[0018] wherein, represents the attack probability deviation degree from the preset confidence threshold represents the deviation degree adjustment coefficient; When the deviation degree is greater than or equal to a first trigger threshold, a rigid protection strategy is triggered; When the first trigger threshold is greater than the deviation degree and the deviation degree is greater than or equal to a second trigger threshold, a marking strategy is triggered, and an upstream analysis platform is linked to make a judgment; When the deviation degree is less than the second trigger threshold, a monitoring strategy is triggered.

[0019] Optionally, the multi-channel convolutional neural network includes three convolution kernels, and three sets of parallel one-dimensional convolution operations are used to capture attack features of different time scales, and the kernel widths of the three convolution kernels are 3, 5, and 7, respectively.

[0020] ​The second aspect of this application provides a power monitoring system attack detection system that integrates telemetry timing and communication structure characteristics, and runs the above-mentioned power monitoring system attack detection method integrating telemetry timing and communication structure characteristics. The system includes: Multi-source data acquisition module, used to acquire telemetry data and network communication data; The telemetry behavior modeling module is used to input telemetry data into an attention-based Transformer encoder to extract the evolution features of the device's operating state and obtain the first feature output vector. The communication structure modeling module is used to encode the structured features of network communication data to generate a feature matrix. The feature matrix is ​​then input into a multi-channel convolutional neural network to extract local structural features of communication behavior, resulting in a second feature output vector. The Transformer, convolutional neural network, and fully connected discriminant network are trained based on a composite loss function. The feature fusion and joint discrimination module is used to fuse the first feature output vector and the second feature output vector to generate a joint feature representation vector, and input the joint feature representation vector into the fully connected discrimination network to output the probability that the current system state is in an attack state; The attack identification module is used to determine if the probability that the current system is under attack is greater than or equal to a preset confidence threshold.

[0021] A third aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements the aforementioned attack detection method for a power monitoring system that integrates telemetry timing and communication structure characteristics.

[0022] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned attack detection method for a power monitoring system that integrates telemetry timing and communication structure features.

[0023] Compared with the prior art, the beneficial effects of this application include at least the following: Instead of simply applying a general deep learning model to new data, the application initiates a multi-modal fusion double-branch deep modeling architecture for a power monitoring system, including a double-branch feature extraction structure: a communication branch CNN is used to model the spatial structure features of communication data, to mine abnormal patterns in short-term connection behaviors, and to perceive burst anomalies at the network layer; a telemetry branch introduces a Transformer encoder to model the time series evolution process of telemetry sequences, to capture slowly changing anomalies at the control layer, to identify abnormal behaviors such as slow changes or periodic disturbances, and to accurately locate sparse abnormal time steps in long sequences; the Transformer and the CNN branch are complementary, and can model the long-distance physical dependence relationship of attacks, realize comprehensive perception, and unify the coding of the two types of features through a feature fusion module to form a joint representation of attack behaviors, and input the classifier to judge "whether there is an attack" to realize more robust and broad-spectrum recognition ability of attack behaviors, and to improve the overall perception ability of complex attack behaviors. The application adopts a weak label modeling method in the training strategy, and only relies on coarse-grained label attack / non-attack for training, without labeling attack types, positions or processes, thereby enhancing the expression ability of the model for hidden attacks, improving the generalization performance under sparse labels, optimizing the abnormal behavior recognition effect under multi-modal data, and enhancing the usability and scalability of the model in real industrial environments. The strong weak supervision learning ability enables it to adapt to the reality of label scarcity in industrial sites, and significantly improves the practicality and deployability of the model.

[0024] The application realizes high-precision and low-missed detection of attack modes specific to power systems (such as slow data injection, illegal remote control instructions, periodic interference, etc.), solves the problem of general models not being suitable for professional fields, and builds a more comprehensive system security situation awareness capability through cross-modal fusion of physical and network data, thereby improving the robustness of the model to complex and coordinated attacks. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor. Among them: Figure 1 is a power monitoring system attack detection method flowchart provided by an embodiment of the application, which fuses telemetry time series and communication structure features; Figure 2 is a data preprocessing flowchart provided by an embodiment of the application; Figure 3is a schematic diagram of a transformer encoder modeling process provided by an embodiment of the present application. Figure 4 is a schematic diagram of a convolution channel modeling process provided by an embodiment of the present application. Figure 5 is a schematic diagram of a feature fusion and attack discrimination process provided by an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described clearly and completely below in combination with the drawings in the embodiments of the present application. The embodiments described in the present application are only a part of the embodiments of the present application, not all the embodiments. All other embodiments obtained by those skilled in the art without creative labor based on the spirit of the present application are within the protection scope of the present application.

[0027] The existing attack detection methods at present are mostly based on communication layer features for modeling, rely on rule matching or traditional supervised learning algorithms, the communication layer feature modeling method focuses on communication behavior, ignores the time sequence evolution features of telemetry data, and cannot capture the slowly varying attack signals of the control layer; and the rule matching or traditional supervised learning algorithm needs to rely on rich attack labels for classification modeling, which is difficult to obtain in actual industrial scenes, and the communication data and telemetry data are different in source and heterogeneous in structure, and the existing model lacks an effective fusion mechanism. Therefore, when facing problems such as telemetry layer anomaly, attack sample scarcity and complex data dimension, the detection effect is limited, and false negatives or false positives are prone to occur. Therefore, it is urgent to develop a multi-modal attack detection method for power monitoring systems, which can realize high-reliable attack recognition without relying on detailed attack labels.

[0028] In combination with Figure 1 As shown in the figure, an embodiment 1 of the present application provides a power monitoring system attack detection method fusing telemetry time sequence and communication structure features, which uses an algorithm model to identify whether there is abnormal behavior, malicious manipulation or data tampering in the power monitoring system, the goal is to make a timely judgment and response to potential attacks, including the following contents: Step 1: Collect telemetry data and network communication data, and perform data preprocessing.

[0029] It should be noted that the telemetry data referred to in the present application is derived from the station end measurement and control device in the power monitoring system, mainly including RTU and IED. Among them, the RTU is installed in the substation or power plant, responsible for collecting analog and state quantities of power equipment including but not limited to circuit breaker, disconnecting switch, and communicating with the dispatching master station through the remote protocol to execute remote control, remote adjustment and other instructions. Analog quantity includes but is not limited to voltage, current, and state quantity includes opening signal. IED is a new type of power equipment integrated with microprocessor, including but not limited to relay protection device, intelligent measurement and control unit. In addition to the data acquisition and transmission function of RTU, IED focuses more on local protection logic judgment, fault diagnosis and automation control, and can provide more rich event sequence records with time stamp.

[0030] The power monitoring system simultaneously collects telemetry data and network communication data, the telemetry data including telemetry instructions, device operating state information, the device operating state information including but not limited to voltage, current, frequency, opening state and other parameters, having strong time series characteristics, the telemetry data being used to depict device layer dynamic behavior, and the telemetry data mainly reflecting physical operating state, being an important input data source for attack behavior modeling.

[0031] The network communication data includes network log information, the network log information including but not limited to protocol type, source / destination port, connection frequency, etc., and the network communication data mainly reflecting network behavior mode.

[0032] It should be noted that from the system impact path of attack behavior, the attacker initiates intrusion through the communication layer, and finally often has actual impact on the device state layer. The communication flow characteristics can reveal the behavior mode of external connection, such as abnormal port access, protocol usage frequency, connection state switching, etc., but for slow-changing control type, pseudo-command injection type and other attacks, the mutation is not strong, and the communication layer characteristics may not be enough to directly capture. The telemetry data as a continuous time series reflecting the actual operating state of the device has higher behavior stability and evolution trend, and once the attack behavior affects the control logic, it will be reflected in the telemetry record in the form of data offset, frequency fluctuation, state jitter, etc. Therefore, the telemetry sequence is an important representation of the consequences of attack behavior in the physical layer.

[0033] It should be noted that the telemetry data and the network log information are often derived from different devices or systems, and there are differences in sampling frequency, time recording mechanism, data format, etc. If not uniformly processed, it will lead to inconsistent model input structure, time sequence misalignment, and then affect the feature extraction and attack discrimination effect. Therefore, a unified data preprocessing process needs to be completed before modeling, mainly including time stamp alignment, missing value processing, feature normalization and other key steps, as shown in Figure 2 The preprocessing in step 1 includes the following steps: Step 1.1: Timestamp align the telemetry data with the network communication data.

[0034] Specifically, telemetry data is recorded as a sequence. Network communication data is denoted as a sequence. Both need to be mapped to a unified time standard. Let... The timestamp function representing the sample then applies to any time interval. The following alignment conditions must be met:

[0035] in, A timestamp representing network communication data. This is a tolerable time error threshold used to mitigate time drift issues caused by factors such as device log inconsistencies and network latency. This strategy ensures time consistency of data from different sources at the feature level.

[0036] Step 1.2: Use linear interpolation to fill in missing values.

[0037] In industrial telemetry data, there are often instances of missing data in certain time slices. For short-term missing samples, linear interpolation methods are used to fill in the gaps. If within a certain time frame... The missing information occurred at [location], with the time intervals before and after being [times]. and The interpolated estimate is:

[0038] In the formula, This represents the data at time t. This represents the data at time t-1. This represents the data at time t+1; if more than two consecutive time steps are missing, a forward filling strategy is used, i.e., let: .

[0039] The above strategy ensures data continuity while avoiding overfitting or introducing bias.

[0040] Step 1.2: Perform feature normalization processing on the telemetry data and network communication data.

[0041] Because the original features come from different types of devices with significant differences in units (such as voltage, current, and communication frequency), gradient instability can easily occur during model training. Therefore, all features need to be standardized. The z-score standardization method is used uniformly, and the specific calculation formula is as follows:

[0042] in, Indicates the first 3D features normalized values, and respectively represent the mean and standard deviation of the dimensional features. After normalization, the mean of each feature is and the variance is , which can effectively improve the convergence speed and training stability of the model.

[0043] In this embodiment, the collected data is aligned and processed by timestamp to construct a unified input sample, ensuring that the model can be jointly modeled under the premise of modal synchronization.

[0044] Step 2: With the preprocessed telemetry data as input, the long-term dependence between states is modeled through position encoding, multi-head attention mechanism and layer normalization structure, and the evolution features of device running state are extracted to obtain the first feature output vector. It is suitable for capturing gradual abnormal behaviors caused by control layer attacks such as state drift, intermittent injection, illegal instruction disturbance, etc., and outputting high-dimensional representation vectors of telemetry channels.

[0045] The layer normalization structure is a standardization layer that standardizes the input of a certain layer in the neural network, making its mean 0 and variance 1, and then performs affine transformation through learnable scaling parameter γ and translation parameter β to restore the representation ability of the model. This structure is placed after the multi-head attention mechanism and the feedforward network, and is used together with the residual connection to form an "Add&Norm" sub-module, which stabilizes the training process of the deep network, improves the gradient flow and enhances the generalization performance of the model.

[0046] It can be understood that the residual connection adds the input tensor and the output tensor of the current layer of the neural network to obtain a residual vector, and the layer normalization normalizes the residual vector to better transmit information and control the gradient, avoiding the problem of gradient vanishing or explosion, thereby improving the training efficiency and performance of the model.

[0047] As shown in Figure 3 , the telemetry time series data is taken as the input sequence, which is first subjected to linear mapping and position encoding operation to obtain the fused encoder input vector, and then input into the multi-layer Transformer encoder to finally output the vector , which is used for subsequent attack discrimination. The specific steps include: Let the input telemetry time series data be , where represents the number of time steps, represents the dimension of the telemetry time series data. First, perform linear transformation and position encoding on the input vector of each time step to form the encoder input:

[0048] in, Indicates the first The initial hidden representation vector at each time step is the input data of the encoder. It is a learnable linear mapping matrix. For position encoding vectors, The dimension of the initial hidden representation vector is given. The linear mapping matrix includes the weight parameters corresponding to the input vector. The linear mapping matrix is ​​obtained by inputting telemetry data into the model for training, and then optimized using the backpropagation optimization algorithm to minimize the prediction error and obtain the optimal linear mapping matrix.

[0049] Each layer of the Transformer encoder consists of a multi-head self-attention mechanism and a feedforward network. For the 1st layer... Layer Transformer encoder, let the input be Its output is:

[0050] In the formula, Indicates the first The vector output by the layer Transformer encoder. Represents the feedforward network function. This represents a multi-head attention mechanism, where the multi-head attention mechanism is as follows:

[0051]

[0052]

[0053] in, Indicates will The output vectors of the attention heads are concatenated. They represent the first The weight parameter matrix corresponding to the query vector Q, key vector K, and numerical vector V of each attention head. Indicates the output projection matrix. Indicates the number of heads of attention. This represents the dimension of the query vector, used as a scaling factor in attention calculations. This indicates the dimension of the hidden representation vector, which is the length of the vector at each time step of the Transformer's input / output.

[0054] Multi-head attention mechanisms are mechanisms that measure the relative importance of features and can dynamically assign different weights to different input parts. After the Transformer layer encoding, the final representation sequence is obtained. , attack detection modeling for the subsequent discrimination module.

[0055] It can be understood that the telemetry sequence length is still T after passing through the Transformer model. In the Transformer encoder, the multi-head attention mechanism only calculates the correlation weight of each time step, does not change the number of time steps, the feedforward network only does nonlinear transformation on the features of a single time step, and also does not change the number of time steps. The sequence length of the final output time sequence feature F t is kept as T, so as to ensure complete capture of long time sequence dependence relationship of telemetry data.

[0056] Through the above steps, the Transformer model can effectively capture the global dynamic correlation between the telemetry sequence and the communication behavior, has the ability to model complex attack patterns, and is a core structural component in the modeling framework of the application.

[0057] By using the Transformer encoder based on the multi-head self-attention mechanism to model the telemetry time sequence, the time sequence evolution features in the telemetry sequence are extracted, the potential slowly changing or intermittent abnormal signals of the device state are mined, the time step information in the telemetry time sequence that is more critical for abnormal identification is automatically highlighted, which helps to capture slowly changing or intermittent attack patterns and improve the perception ability of the model to key behavior features. Embedding the multi-head self-attention mechanism in the telemetry modeling module dynamically weights the contributions of different time steps of time sequence data, effectively identifies control command injection attacks of slowly changing and disguised types, and improves the perception ability of the model to key time slices.

[0058] The application uses a Transformer network based on a multi-layer encoder to model the preprocessed sequence, obtains long-distance dependence relationship through a self-attention mechanism, constructs a deep learning structure with global dependence modeling capability, fully mines the time sequence correlation and potential patterns between telemetry data and communication behavior, and improves the recognition ability of the model to complex attack behavior.

[0059] Step 3: Encode the structured features of the preprocessed network communication data to generate a two-dimensional feature matrix, input the two-dimensional feature matrix into a multi-channel convolutional neural network to extract local structure patterns in the communication behavior, and obtain a second feature output vector.

[0060] Specifically, the structured features in the network communication data include, but are not limited to, connection protocols, session duration, packet size, source / destination IP and port, etc. After encoding, a two-dimensional feature matrix is generated and input into a multi-channel convolutional neural network. Through multi-scale convolution and pooling operations of the multi-channel convolutional neural network, local structural patterns in the communication behavior are extracted, and burst communication attack behaviors, including but not limited to port scanning, connection flooding, abnormal access, etc., are identified. A high-dimensional structural representation of the communication channel is output.

[0061] It should be noted that, in order to improve the modeling ability of the model for local disturbance features and structural attack patterns, the present application designs a convolutional channel, i.e., a CNN channel, in the feature extraction stage, which is specifically used to process the structural patterns and transient features in the network communication data. CNN is a deep learning structure that is good at extracting spatial features from local areas and capturing local pattern changes of abnormal communication behaviors. Compared with telemetry data, which mainly presents continuous time series, network communication data has stronger discrete and structural features, such as connection initiation frequency, target port distribution, packet frequency fluctuation, etc., which often exhibit burstiness, blockiness, periodicity, etc. The convolutional neural network structure can effectively model the spatial structure and local changes of such features, and is a beneficial supplement to the Transformer channel.

[0062] Figure 4 The overall modeling process of the convolutional channel is described, including embedded representation of communication behavior, multi-scale convolution feature extraction and maximum pooling compression, to finally generate a fixed-length feature vector for subsequent attack discrimination tasks. The structure of the convolutional channel specifically includes: (1) Embedding encoding layer: Network communication data often contains text fields and numerical fields; text fields include but are not limited to IP, port, protocol type; numerical fields include but are not limited to byte size, response time.

[0063] First, the discrete category type field is mapped to an integer index and input into the embedding layer to obtain a consistent low-dimensional vector representation. Let the network communication data sample be , then the embedding process is:

[0064] wherein, represents the tth network event, represents the embedding dimension, represents the dense representation vector of the tth event, represents the dimension of the low-dimensional vector representation output by the embedding layer, is less than , , denotes an embedding layer dimensionality reduction operation.

[0065] It should be noted that T denotes the sequence length, which corresponds to the number of time steps or events in different branches. In the Transformer branch, T denotes the number of time steps of the time series data. In the CNN branch, T denotes the number of network events. Essentially, both represent the length of the input sequence, and different expressions are used for different modal data.

[0066] It can be understood that discrete category type fields, including but not limited to IP, port, and protocol type, are mapped to unique integer IDs, and then input into the embedding layer to obtain a low-dimensional dense vector representation.

[0067] (2) Multi-channel convolution layer: In order to capture local patterns of attack behavior at different granularities, the disclosure embodiment designs multiple groups of convolution kernels with different kernel widths to extract local features in parallel. The convolution kernel widths are matched with attack features at different time scales, such as short-term burst, medium-term session, and long-term periodicity.

[0068] In this embodiment, three groups of one-dimensional convolution operations are used, with kernel widths of , and respectively, to capture local structure patterns at different granularities: kernel width for capturing short-term burst anomalies, including but not limited to single data anomalies, instantaneous connection request bursts, etc.; kernel width for capturing medium-term session-level behavior, including but not limited to port scanning, short-term session hijacking, protocol misuse, etc.; and kernel width for capturing long-term periodic or slowly varying attacks, including but not limited to low-frequency DDoS attacks, periodic probing behavior, etc.

[0069] For each convolution branch, the output feature of the first channel is:

[0070] where L denotes the sequence length after the embedding layer dimensionality reduction operation, denotes the output channel number of the th branch convolution kernel, ReLU is a nonlinear activation function, E denotes the sequence after the embedding layer dimensionality reduction operation, denotes a one-dimensional convolution operation, and denotes the convolution kernel size. Multi-channel parallel convolution helps to focus on multi-scale changes such as short-term burst and medium-term trend at the same time.

[0071] Global average pooling is performed on the sequence dimension to compress it into a fixed-length feature vector : ,

[0072] Then, the three branch obtained after the pooling feature vector , , In the channel dimension, the final multi-scale fusion features are formed by splicing :

[0073] Among them, Indicates the splicing operation along the feature channel dimension.

[0074] In this embodiment, by introducing a plurality of groups of one-dimensional convolution kernels with different kernel widths through multi-branch, synchronous extraction is performed on attack features of short, medium and long time scales, so as to adapt to the capture of diversified attack features such as burst and periodic. Compared with the fixed receptive field of a single scale convolution kernel, it is difficult to capture attack patterns of different time scales such as instantaneous burst, medium-term conversation and long-term periodicity at the same time, which is easy to cause false negatives, and when facing slow-changing control type and low-frequency scanning attacks, the existing convolution structure lacks the perception ability of long-range time dependence, and the detection effect is limited. The present application realizes the synchronous capture of multi-scale attack features by introducing a three-branch parallel structure of k=3, 5 and 7, solves the technical problem that a single scale convolution kernel is difficult to comprehensively capture the multi-scale attack patterns of the power system, and significantly improves the perception breadth and coverage ability of complex attack patterns. Especially, the detection sensitivity to slow-changing and periodic attacks is enhanced, which makes up for the shortcomings of traditional communication layer analysis methods.

[0075] This structure, as the core feature extractor of the communication branch, forms an effective complement with the telemetry time sequence branch, and together builds a more comprehensive system security situation awareness capability.

[0076] Through the above process, the CNN channel mainly processes communication structure behavior data, is good at capturing local attack features and protocol level information, and is especially suitable for identifying attack behaviors with structural patterns such as port scanning and denial of service. After parallel modeling with the Transformer channel, the robustness and feature coverage ability of the overall model can be improved.

[0077] In this embodiment, based on the dual-branch structure design, the time evolution characteristics of the telemetry behavior and the structural characteristics of the communication behavior are modeled synchronously. Compared with the existing technology which generally relies on communication layer features and is difficult to capture slow-changing or gradual attack behaviors of the control layer, there is a risk of missing detection. The application proposes a dual-channel deep neural network structure, which uses Transformer to model the telemetry time series data and extract the time evolution characteristics in the control behavior, and uses CNN to model the communication log data and extract the structural characteristics in the network behavior, thereby realizing the collaborative modeling of the attack characteristics of the control layer and the communication layer, effectively making up for the limitations of single modal perception, enabling the system to have comprehensive perception ability for different attack paths including but not limited to data injection, illegal instructions, abnormal connections, etc., and enhancing the complete modeling ability of attack behaviors from the data dimension.

[0078] Step 4: The first feature output vector obtained in step 2 is spliced and dimensionally aligned with the second feature output vector obtained in step 3 to generate a joint feature representation vector, and the joint feature representation vector is input into a fully connected discriminant network to determine whether the current system state is in an attack state.

[0079] The output vectors of the two sub-modules of Transformer and CNN are spliced and dimensionally aligned in the feature fusion layer to generate a unified joint feature representation. The fused representation vector is input into a fully connected discriminant network to determine whether the current system state is in an attack state.

[0080] To adapt to the label scarcity problem in real industrial scenarios, the present disclosure adopts a weak label modeling strategy, relying only on binary classification labels of "attack / non-attack" for training and prediction, without labeling specific attack types, times or processes, significantly reducing data dependence and labeling costs.

[0081] The present application breaks through the label dependence bottleneck from the supervision dimension, improving the practicability and deployability of the model. The present application adopts a weak label modeling strategy, which can complete model training and reasoning only using coarse-grained labels of whether it is an attack, avoiding dependence on fine-grained labeling of attack types, processes, locations, etc. Compared with the existing technology, obtaining detailed attack labels in an industrial field environment faces high cost and timeliness problems. The present application significantly reduces the training data requirement, improves the model deployment threshold, and adapts to the actual data form in industrial systems.

[0082] After completing the multi-modal feature extraction, the feature representations from the Transformer and CNN modules need to be fused to realize unified discrimination of attack behaviors. Let the time series feature representation output by the Transformer module be , and the local convolutional feature representation output by the CNN module be , where represents the time series length, With are the feature dimensions of two channels respectively. Figure 5 Feature fusion and attack discrimination flowchart, this figure shows the unified discrimination process of the fusion of two types of features, including feature splicing, global pooling and attack probability output, etc. Specific steps include: Firstly, the is replicated and expanded in the time dimension to obtain , then and are spliced along the feature dimension to form the fusion feature: To construct a unified joint feature representation, the following splicing operation is used:

[0083] where represents the splicing operation along the feature dimension. The fused representation retains the timing global information and local fluctuation features, enhancing the model's ability to discriminate attack diversity and burstiness features.

[0084] In the discrimination stage, firstly, the fusion representation is globally averaged and pooled to obtain a fixed-dimensional joint feature representation vector:

[0085] Then, the joint feature representation vector is input into the fully connected discriminator to generate the attack probability score :

[0086] where is the Sigmoid activation function, is the weight matrix of the fully connected discriminator, is the bias term.

[0087] Further, in the model training stage, to solve the technical problems that the proposed dual-branch heterogeneous architecture may have uneven gradient distribution or insufficient training of one branch in end-to-end joint training, a composite loss function is proposed for deep supervision. The composite loss function includes the main loss function and two auxiliary loss functions , .

[0088] The main loss function applied to the final attack probability score , the calculation formula is:

[0089]

[0090] in, Indicates the first The main loss term corresponding to each sample Indicates the first The true label of each sample The model represents the first Predicted attack probability for each sample Let N represent the main loss function, which is the average of the main losses for all samples, and let N represent the number of samples.

[0091] To ensure that both the Transformer and CNN feature extraction branches are effectively trained before fusion, auxiliary discriminators are introduced at the output of each branch to output auxiliary probabilities. and Define the auxiliary loss function:

[0092]

[0093] in, This represents the auxiliary prediction probability output by the auxiliary discriminator from the Transformer branch. This represents the auxiliary prediction probability output by the auxiliary discriminator from the branches of the convolutional neural network. This represents the auxiliary loss function for the Transformer branch. This represents the auxiliary loss function for the convolution branch.

[0094] Ultimately, the weighted combination of the three constitutes the total loss function:

[0095] in, This represents the total value of the composite loss function, used for overall model training and optimization. Represents the main loss function. This represents the auxiliary loss function for the Transformer branch. This represents the auxiliary loss function of the convolution branch. The weight coefficients of the auxiliary loss function for the Transformer branch are represented. The weight coefficients of the auxiliary loss function for the convolutional branch are preferably in the range of 0.2 to 0.4, and are used to balance the contributions of the main loss and auxiliary loss during the training process.

[0096] Through the composite loss function, the gradient can be directly transmitted to the shallow network of the two branches, ensuring that the Transformer encoder and the convolutional neural network are fully optimized, thereby significantly improving the training stability of the model and the final detection accuracy.

[0097] After the model training is completed, online inference and attack recognition can be performed based on the optimized double-branch heterogeneous structure, realizing a complete detection process from feature perception to attack discrimination.

[0098] The above design can adapt to the real conditions of label scarcity in real industrial scenarios, realize high-performance attack detection through weak supervision signals, and significantly reduce data dependence and manual labeling costs. Only through the coarse-grained label of "with or without attack" to complete the training, the discrimination effectiveness of the binary classification task is retained, and the labeling cost and data dependence in the industrial field are greatly reduced. This belongs to the adaptability improvement of the loss function for the scene.

[0099] In the embodiments of the present disclosure, by adopting the dimension alignment and splicing strategy, the heterogeneous features extracted by the Transformer and the CNN are integrated into a unified attack behavior representation vector, which is input into the fully connected discriminator to complete attack risk prediction, thereby enhancing the expression and discrimination ability of the model for complex attack patterns.

[0100] According to the probability that the current system state is in an attack state and the pre-set confidence threshold, it is determined whether the current system is attacked.

[0101] Specifically, the attack probability output by the model is According to actual business requirements, the threshold value can be set for classification and judgment, and when , the system determines that there is a potential attack behavior in the current state.

[0102] Preferably but not limitedly, the optimal pre-set confidence threshold is obtained based on the performance indicators of the verification set.

[0103] The present application designs an adaptive threshold setting method based on the performance indicators of the verification set, which can overcome the poor adaptability and high false alarm rate of static thresholds under different operating conditions. The method is automatically executed before the model is deployed, and the specific implementation steps are as follows: After the model training is completed, the reserved verification set is used for inference, and for each sample in the verification set, the model outputs its attack probability . Determine the candidate confidence threshold, calculate the F1 score of each candidate confidence threshold, and select the candidate confidence threshold corresponding to the maximum F1 score as the optimal pre-set confidence threshold.

[0104] Specifically, sampling is performed in the interval [0, 1] with a step size of 0.01, i.e. θ = 0.00, 0.01, 0.02,..., 1.00, and the sampled values are confidence threshold values. For each candidate confidence threshold value , the following operations are performed: All samples with are predicted as “attack” (positive examples), and samples with are predicted as “normal” (negative examples). According to the true labels of the validation set, the precision (Precision) and recall (Recall) under the current threshold are calculated. The F1 score under the current threshold is calculated:

[0105] The F1 score is the harmonic mean of the precision and the recall, and can comprehensively measure the overall performance of the model.

[0106] The candidate confidence threshold value that maximizes the F1 score is selected as the preset confidence threshold value.

[0107] In this embodiment, by using an automatic search algorithm based on the F1 score of the validation set, the subjectivity and blindness of manually setting the threshold value are avoided, the model is ensured to be in the best working point when it is shipped, and the detection accuracy is significantly improved. By automatically finding the optimal balance point of the precision and the recall, the model can adapt to different data distributions, and the model is ensured to be in the optimal state of comprehensive performance when it is deployed, thereby significantly improving the engineering value and deployability of the scheme.

[0108] Preferably but not limitedly, according to the attack probability and the preset confidence threshold value, different security response mechanisms are triggered.

[0109] According to the attack probability and the confidence thereof, security response mechanisms such as but not limited to device isolation, instruction blocking or linkage control are triggered, thereby enhancing the overall security protection capability of the system against latent and progressive attacks. When an attack is identified, the system can link the security response module and execute corresponding response actions according to the preset policy library.

[0110] Preferably but not limitedly, according to the attack probability and the preset confidence threshold value, different security response mechanisms are triggered, including: According to the attack probability and the preset confidence threshold value, the deviation degree of the attack probability from the preset confidence threshold value is calculated:

[0111] wherein, represents the attack probability , the deviation degree of the attack probability from the preset confidence threshold value , and represents a deviation degree adjustment coefficient. When the deviation degree is greater than or equal to the first trigger threshold, a rigid protection strategy is triggered, including data isolation or instruction blocking; When the first trigger threshold is greater than the deviation degree and is greater than or equal to the second trigger threshold, a marking strategy is triggered, and an upstream analysis platform is linked to make a judgment; When the deviation degree is less than the second trigger threshold, a monitoring strategy is triggered.

[0112] For example, for attack alarms with high attack probability, rigid protection strategies such as data isolation or instruction blocking can be started; for low attack probability or slowly progressive abnormal behaviors including but not limited to slow scanning and data injection, a “suspicious marking” strategy can be triggered, and an upstream security analysis platform is linked to make a further judgment. The system supports linking to upper modules such as SCADA protection systems and situation awareness platforms to realize multi-level protection and linked decision-making.

[0113] It can be understood that a person skilled in the art can set the specific values of the first trigger threshold and the second trigger threshold according to actual applications.

[0114] In addition, to support the actual deployment needs of the industry, the system can output attack detection results in the following three ways: Real-time alarm interface: attack events and probability values are pushed through WebSocket or MQTT.

[0115] Historical log storage: the discrimination results, probability values and original data are written into a database together, for subsequent audit, tracking and model optimization analysis; Report output mechanism: periodically output attack analysis reports, and statistically analyze high-risk equipment, attack frequency trends, model discrimination accuracy evaluation and other indicators.

[0116] Through the above mechanisms, the method not only realizes high-precision attack detection, but also realizes a complete closed loop from perception, decision-making to response, effectively improving the response efficiency and overall security resilience of the power monitoring system to complex network attacks.

[0117] In the embodiments of the present disclosure, after the model outputs the attack probability score, real-time discrimination based on a threshold can be used to link to the peripheral system to execute the corresponding response strategy. At the same time, the detection results can be fed back through interface pushing, log recording and report output, and the like, to realize the closed-loop attack protection capability from identification to disposal.

[0118] The application fuses the global dependence modeling capability of the Transformer and the local structure modeling advantage of the CNN, realizes efficient perception of multiple attack features such as periodic disturbance, sudden connection and slow change control through parallel modeling of multi-scale convolution and attention mechanism, has stronger expression breadth and recognition depth. The feature fusion module integrates heterogeneous modal features, enhances the overall understanding of the attack behavior of the model, and the joint discrimination mechanism supports unified output of attack risk scores, forming a closed-loop detection logic.

[0119] Embodiment 2 of the application provides a power monitoring system attack detection system fusing telemetry timing and communication structure features, which runs the power monitoring system attack detection method fusing telemetry timing and communication structure features as described in Embodiment 1, and the system comprises: a multi-source data acquisition module for acquiring telemetry data and network communication data; a telemetry behavior modeling module for inputting the telemetry data into a Transformer encoder based on an attention mechanism to extract evolution features of device running states, to obtain a first feature output vector; a communication structure modeling module for encoding the structured features of the network communication data to generate a feature matrix, inputting the feature matrix into a multi-channel convolutional neural network to extract local structure features of communication behaviors, to obtain a second feature output vector; wherein the Transformer, the convolutional neural network and the fully connected discrimination network are trained based on a composite loss function; a feature fusion and joint discrimination module for fusing the first feature output vector and the second feature output vector to generate a joint feature representation vector, and inputting the joint feature representation vector into a fully connected discrimination network to output a probability that the current system state is in an attack state; an attack recognition module for determining that the current system is attacked if the probability that the current system state is in an attack state is greater than or equal to a preset confidence threshold.

[0120] As to the system in the above embodiments, the specific manner in which each unit performs operations has been described in detail in the embodiments related to the method, and will not be described in detail here.

[0121] Embodiment 3 of the application provides an electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the computer program, when loaded into the processor, implements the power monitoring system attack detection method fusing telemetry timing and communication structure features as described in Embodiment 1.

[0122] Embodiment 4 of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by a processor to implement the power monitoring system attack detection method of fusing telemetry timing and communication structure characteristics according to embodiment 1.

[0123] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0124] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application rather than limit them, and although the present application has been described in detail with reference to the above embodiments, it should be understood by those skilled in the art that the specific embodiments of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and any modification or equivalent replacement without departing from the spirit and scope of the present application should be covered within the protection scope of the claims of the present application.

Claims

1. A method for attack detection in a power monitoring system that integrates telemetry timing and communication structure characteristics, characterized in that, include: Collect telemetry data and network communication data; Telemetry data is input into an attention-based Transformer encoder to extract the evolution features of the device's operating state, resulting in the first feature output vector. The structured features of network communication data are encoded to generate a feature matrix. The feature matrix is ​​then input into a multi-channel convolutional neural network to extract local structural features of communication behavior, resulting in a second feature output vector. The first feature output vector and the second feature output vector are fused to generate a joint feature representation vector, which is then input into a fully connected discriminant network to output the probability that the current system state is in an attack state. The Transformer, convolutional neural network and fully connected discriminant network are trained based on a composite loss function. If the probability that the current system is under attack is greater than or equal to a preset confidence threshold, the current system is determined to be under attack.

2. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 1, characterized in that: Training is performed using binary classification labels, which include two types: attack and non-attack.

3. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 1, characterized in that: The composite loss function is calculated using the following formula: in, This represents the total value of the composite loss function. Represents the main loss function. This represents the auxiliary loss function for the Transformer branch. This represents the auxiliary loss function of the convolution branch. The weight coefficients of the auxiliary loss function for the Transformer branch are represented. This represents the weight coefficients of the auxiliary loss function for the convolution branch.

4. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 3, characterized in that: The main loss function is calculated using the following formula: in, Indicates the first The main loss term corresponding to each sample Indicates the first The true label of each sample The model represents the first Predicted attack probability for each sample Let N represent the main loss function, which is the average of the main losses for all samples, and let N represent the number of samples.

5. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 1, characterized in that: A convolutional neural network includes an embedding layer, a convolutional layer, and a pooling layer. The embedding layer is used to reduce the dimensionality of the input sequence. The convolutional layer is connected to the embedding layer and is used to extract local structural features of the communication behavior. The pooling layer is connected to the convolutional layer and is used to compress the output features of the convolutional layer. The feature matrix is ​​input into a multi-channel convolutional neural network to extract local structural features of the communication behavior, resulting in a second feature output vector including: After mapping the feature matrix to integer indices, it is input into the embedding layer to obtain the corresponding fixed-dimensional vector. A fixed-dimensional vector is input into a multi-channel convolutional layer to extract local structural features of communication behavior in parallel. The output features of each convolutional layer are input into a pooling layer, where global average pooling is performed along the sequence dimension, compressing them into a second feature output vector of a preset length.

6. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 1, characterized in that: Each Transformer encoder layer consists of a multi-head attention mechanism and a feedforward network. Telemetry data is input into the attention-based Transformer encoder to extract the evolutionary features of the device's operating state, resulting in the first feature output vector, which includes: The telemetry data is linearly transformed and position-encoded to form the encoder input data; The encoder input data is fed into a multi-head self-attention mechanism and then passed to a feedforward network to obtain the output vector of the current layer Transformer encoder. The output vector of the current layer Transformer encoder is input into the next layer Transformer encoder to obtain the output vector after multi-layer Transformer encoding, which is used as the first feature output vector.

7. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 1, characterized in that: The method further includes: triggering different security response mechanisms based on the attack probability and a preset confidence threshold, specifically: The degree of deviation between the attack probability and the preset confidence threshold is calculated based on the attack probability and the preset confidence threshold: in, Indicates the probability of attack. Compared with the preset confidence threshold The degree of deviation, This represents the deviation adjustment coefficient; When the deviation is greater than or equal to the first trigger threshold, the rigid protection strategy is triggered. When the first trigger threshold > deviation degree ≥ second trigger threshold, the marking strategy is triggered, and the upstream analysis platform is linked for analysis; When the deviation is less than the second trigger threshold, the monitoring policy is triggered.

8. The attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics according to claim 1, characterized in that: The multichannel convolutional neural network includes three convolutional kernels and uses three sets of parallel one-dimensional convolutional operations to capture attack features at different time scales. The kernel widths of the three convolutional kernels are 3, 5, and 7, respectively.

9. A power monitoring system attack detection system integrating telemetry timing and communication structure characteristics, comprising the power monitoring system attack detection method integrating telemetry timing and communication structure characteristics as described in any one of claims 1-8, characterized in that, The system includes: Multi-source data acquisition module, used to acquire telemetry data and network communication data; The telemetry behavior modeling module is used to input telemetry data into an attention-based Transformer encoder to extract the evolution features of the device's operating state and obtain the first feature output vector. The communication structure modeling module is used to encode the structured features of network communication data to generate a feature matrix. The feature matrix is ​​then input into a multi-channel convolutional neural network to extract local structural features of communication behavior, resulting in a second feature output vector. The Transformer, convolutional neural network, and fully connected discriminant network are trained based on a composite loss function. The feature fusion and joint discrimination module is used to fuse the first feature output vector and the second feature output vector to generate a joint feature representation vector, and input the joint feature representation vector into the fully connected discrimination network to output the probability that the current system state is in an attack state; The attack identification module is used to determine if the probability that the current system is under attack is greater than or equal to a preset confidence threshold.

10. An electronic device, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the attack detection method for a power monitoring system that integrates telemetry timing and communication structure characteristics according to any one of claims 1-8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the steps of the attack detection method for power monitoring systems that integrates telemetry timing and communication structure characteristics as described in any one of claims 1-8.

Images