DNSAE-based power information physical system abnormity monitoring device and method

Abstract

The invention relates to a DNSAE-based power information physical system abnormity monitoring method. The method comprises the following steps: carrying out data normalization processing; the method comprises the following steps: acquiring current system operation state data of an electric power information physical system, performing normalization processing based on a mapminmax function of an SVM (Support Vector Machine), and processing the current system operation state data into a real number between [0, 1]; the parameter values of the SVM are optimized based on a DNSAE algorithm, the optimal relevant parameters C and g of the SVM are obtained through optimization, and a DNSAE-SVM monitoring model is established; inputting a test data set, performing test analysis based on the monitoring model, and evaluating a prediction result; according to the invention, intrusion abnormity monitoring is realized, the security monitoring situation awareness efficiency is improved, pure data driving is realized, the universality is realized in the aspect of application, and the realization process is simple; through coupling of the SVM and the DNSAE algorithm, good generalization performance and high monitoring rate of the SVM algorithm are fully combined, and the monitoring efficiency and accuracy are improved.

Description

Technical Field

[0001] This invention belongs to the field of intelligent monitoring, and in particular relates to a method and device for anomaly monitoring of power information physical systems based on DNSAE. Background Technology

[0002] Applying the DNSAE method to a monitoring system is of great significance for monitoring the operational status of the power cyber-physical system, monitoring various attack attempts, attack behaviors, or attack results, and ensuring the availability, integrity, and confidentiality of system resources.

[0003] Existing technologies, such as CN115987618A, disclose a method for detecting abnormal intrusions in power CPS based on quantum machine learning, including: data normalization processing; acquiring the current system operating status data of the power CPS, normalizing it based on the mapminmax function of SVM, and processing it into real numbers between [0, 1]; optimizing the parameter values ​​of SVM based on the IQPSO algorithm to obtain the relevant parameters C and g of the optimal SVM, that is, establishing the IQPSO-SVM intrusion detection model; inputting the test dataset, conducting test analysis based on the above intrusion detection model, and evaluating the prediction results; this invention realizes intrusion anomaly detection, improves the efficiency of security monitoring situational awareness, is purely data-driven, has universality in application, and is simple to implement; the implementation is relatively simple, by coupling SVM and IQPSO algorithms, fully combining the good generalization and high detection rate of the SVM algorithm to improve the efficiency and accuracy of intrusion detection.

[0004] Existing technology, CN118233135A, discloses a network traffic anomaly monitoring method based on the Isolation Forest algorithm. Its features include: first, constructing a network flow dataset by reading existing real-time datasets and using feature mapping strategies; preprocessing and feature engineering on the dataset to standardize feature and label encoding, providing prepared input data for model training; subsequently, using the Isolation Forest algorithm to train the model to capture and identify malicious traffic patterns; and finally, comprehensively evaluating model performance on a validation set using metrics such as confusion matrix, classification report, and AUC-ROC (Receiver Operating Characteristic Curve and Area Under the Curve), focusing on key performance indicators such as accuracy and recall. After evaluation, the detected anomaly dataset is output, and resource usage is released.

[0005] The existing technology, CN117353985A, discloses a GNSS generative spoofing attack detection method based on CNN-LSTM, including: 1) performing generative spoofing attacks on GNSS, i.e., misleading GNSS receivers by forging spoofing signals; 2) collecting and preprocessing the collected GNSS data, including normalization and other operations, to prepare a dataset for training and testing the model; 3) constructing a CNN-LSTM network model: constructing a network model using a combination of convolutional neural networks (CNN) and long short-term memory neural networks, optimizing the model parameters through adaptive moment estimation, and applying it to the network model; 4) training the model and evaluating the monitoring effect: using mean squared error and accuracy as evaluation metrics, training the constructed CNN-LSTM network model, and evaluating its effect in monitoring and classifying abnormal signals; 5) attack monitoring: selecting the trained model and applying it to the monitoring of GNSS generative spoofing attacks in real-world scenarios.

[0006] However, the above technologies still have many shortcomings, such as the limitations of active defense functions, high false alarm and false negative rates, and limitations of monitoring methods. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention discloses a method for anomaly monitoring in a power cyber-physical system based on DNSAE, the technical solution of which is as follows:

[0008] A power information physical system anomaly monitoring device based on DNSAE includes: a data preprocessing module, which performs operations such as removing socket information and spaces, data normalization, and label encoding on the raw data, and returns the feature dimensions of the preprocessed data;

[0009] Output the trained abstract data module, use the preprocessed unlabeled data to train DNSAE in an unsupervised manner, and adjust the weights through backpropagation;

[0010] The supervised training and classification module uses DNSAE-SVM to train the abstract data and its corresponding labels obtained after the first two stages. The trained DNSAE-SVM is then used to classify and recognize the test sample data, which has also undergone data reconstruction.

[0011] This invention also discloses a method for monitoring anomalies in a power cyber-physical system based on DNSAE. This method is based on the aforementioned DNSAE-based power cyber-physical system anomaly monitoring device, and includes:

[0012] Step 1: Data preprocessing;

[0013] Step 2: Output the trained abstract data;

[0014] Step 3: Supervised training and classification recognition.

[0015] Preferably, step two further includes the following: optimizing the parameter values ​​of SVM based on the DNSAE algorithm to obtain the relevant parameters C and g of the optimal SVM, that is, establishing the DNSAE-SVM monitoring model;

[0016] A portion of the preprocessed data was selected as training samples for the SVM. The optimal SVM parameter values ​​C and g were obtained by optimizing the SVM parameter values ​​using the DNSAE algorithm.

[0017] Preferably, step three further includes the following: inputting a test dataset, conducting test analysis based on the above-mentioned optimal monitoring model, evaluating the prediction results, and finally verifying the feasibility of the monitoring method based on the DNSAE-SVM algorithm using the KDD CUP99 dataset as an example. --It is recommended to supplement the specific process of step 3; otherwise, it will be unclear or insufficiently disclosed.

[0018] Beneficial effects

[0019] Enhanced proactive defense capabilities, low false alarm and false negative rates, and reliable monitoring methods. Attached Figure Description

[0020] Figure 1 This is a structural diagram of the DNSAE-SVM monitoring model. Detailed Implementation

[0021] See Figure 1 As shown, the anomaly monitoring technology for power information physical systems based on DNSAE is as follows:

[0022] Step 1: Data selection and preprocessing.

[0023] A portion of the KDDCUP dataset was selected as the basis for experimental testing, and multiple records were randomly extracted from the KDDCUP dataset.

[0024] The system acquires the current operating status data of the power information physical system and performs standardization and normalization processing based on the mapminmax function of SVM, converting it into real numbers between [0,1].

[0025] Step 2: Optimize the SVM parameter values ​​based on the DNSAE algorithm to obtain the optimal SVM parameters C and g, thus establishing the DNSAE-SVM monitoring model.

[0026] A portion of the preprocessed data was selected as training samples for the SVM. The SVM parameter values ​​were optimized using the DNSAE algorithm to obtain the optimal SVM parameter values ​​C and g. The optimal parameter values ​​obtained through matching were then used as the optimal parameters for the monitoring method based on the DNSAE-SVM algorithm, thereby establishing the optimal network monitoring model.

[0027] Step 3: Input the test dataset, conduct test analysis based on the above optimal monitoring model, evaluate the prediction results, and finally verify the feasibility of the monitoring method based on the DNSAE-SVM algorithm using the KDD CUP dataset as an example.

[0028] Implementation effect

[0029] The anomaly detection methods were evaluated based on their accuracy, precision, recall, and F1 score, and compared with DBN and S-NDAE models, as shown in Table 1 below.

[0030] Table 1. Parameters and evaluation metrics of the three algorithms

[0031]

[0032] As can be seen from the experimental test results in Table 1, compared with DBN and S-NDAE, the proposed DNSAE has more hidden layer nodes, while the training and monitoring time is less, which can be reduced by about 87% compared with S-NDAE and DBN. Moreover, the proposed method has better balance and stability.

[0033] This invention also discloses a power information physical system anomaly monitoring device based on DNSAE, comprising:

[0034] The data preprocessing module performs operations on the raw data, including removing socket information and spaces, normalizing the data, and encoding labels, and returns the feature dimensions of the preprocessed data.

[0035] Output the trained abstract data module, use the preprocessed unlabeled data to train DNSAE in an unsupervised manner, and adjust the weights through backpropagation;

[0036] The supervised training and classification module uses DNSAE-SVM to train the abstract data and its corresponding labels obtained after the first two stages. The trained DNSAE-SVM is then used to classify and recognize the test sample data, which has also undergone data reconstruction.

[0037] This invention analyzes threat information and assesses security status based on the DNSAE algorithm model, enabling intrusion anomaly detection and improving the efficiency of security monitoring and situational awareness. Compared to other monitoring algorithms such as deep neural network algorithms and support vector machine algorithms, it shows significant improvements in monitoring efficiency, accuracy, false alarm rate, and false negative rate for intrusions in power information physical systems. The method is relatively simple to implement. By improving the SVM kernel function and coupling it with the quantum particle swarm optimization algorithm, it fully leverages the good generalization and high detection rate of the SVM algorithm to improve the monitoring methods and performance of power information physical systems. Furthermore, this method is purely data-driven, requiring no complex prior knowledge related to the actual physical system, making it universally applicable and widely applicable, and its implementation is simple.

[0038] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A power information physical system anomaly monitoring device based on DNSAE, comprising: The data preprocessing module performs operations on the raw data, including removing socket information and spaces, normalizing the data, and encoding labels, and returns the feature dimensions of the preprocessed data. Output the trained abstract data module, use the preprocessed unlabeled data to train DNSAE in an unsupervised manner, and adjust the weights through backpropagation; The supervised training and classification module uses DNSAE-SVM to train the abstract data and its corresponding labels obtained after the first two stages. The trained DNSAE-SVM is then used to classify and recognize the test sample data, which has also undergone data reconstruction.

2. A method for anomaly monitoring of a power cyber-physical system based on DNSAE, the method being based on the power cyber-physical system anomaly monitoring device based on DNSAE as described in claim 1, characterized in that: include: Step 1: Data preprocessing; Step 2: Output the trained abstract data; Step 3: Supervised training and classification recognition.

3. The method for anomaly monitoring of power information physical systems based on DNSAE according to claim 2, characterized in that: Step one further includes the following: A portion of the KDDCUP dataset was selected as the basis for experimental testing. Multiple records were randomly extracted from the KDDCUP dataset. The current system operation status data of the power information physical system was obtained and standardized and normalized based on the mapminmax function of SVM, and processed into real numbers between [0,1].

4. The method for anomaly monitoring of power information physical systems based on DNSAE according to claim 2, characterized in that: Step two further includes the following: optimizing the parameter values ​​of SVM based on the DNSAE algorithm to obtain the relevant parameters C and g of the optimal SVM, that is, establishing the DNSAE-SVM monitoring model; A portion of the preprocessed data was selected as training samples for the SVM. The optimal SVM parameter values ​​C and g were obtained by optimizing the SVM parameter values ​​using the DNSAE algorithm.

5. The method for anomaly monitoring of a power information physical system based on DNSAE according to claim 2, characterized in that: Step three further includes the following: inputting a test dataset, conducting test analysis based on the above-mentioned optimal monitoring model, evaluating the prediction results, and finally verifying the feasibility of the monitoring method based on the DNSAE-SVM algorithm using the KDDCUP dataset as an example.

Images