Adaptive cross-protocol privacy enhancement method for power data communication

Abstract

The invention discloses a self-adaptive cross-protocol privacy enhancement method for power data communication, and relates to the technical field of network communication privacy protection. The method comprises the following steps: establishing an electric power communication protocol message unified description model, and carrying out formalized modeling on a protocol message format, a conversion rule and a state transition mechanism; collecting a target protocol flow sample, selecting a representative sample through state difference measurement, and constructing a target protocol state machine; selecting a target state with the highest matching degree with the source protocol based on a minimum cost matching principle; state-driven message format privacy enhancement is executed, and message conversion is realized; and constructing a cost-income evaluation model, and evaluating the privacy enhancement effect from five dimensions of time delay cost, bandwidth cost, message state consistency, format state matching degree and characteristic state similarity. According to the method, cross-protocol privacy protection of power data communication can be realized under controllable cost, traffic recognition attack based on deep learning is effectively resisted, and technical support is provided for power system security and privacy protection.

Description

Technical Field

[0001] This invention relates to the field of network communication privacy protection technology, and in particular to an adaptive cross-protocol privacy enhancement method for power data communication. Background Technology

[0002] With the deepening of the digital transformation of the power system, power data communication carries an increasing amount of sensitive data in scenarios such as smart grid dispatch and control, electricity consumption information collection, distribution network automation, and new energy grid connection. This data includes user electricity consumption behavior patterns, real-time grid operating parameters, and dispatch and control commands. Once leaked or maliciously identified, it will pose a serious threat to the safe and stable operation of the power system and the protection of user privacy.

[0003] In recent years, deep learning-based network traffic identification technology has developed rapidly. Attackers can accurately identify communication protocol types and services without decryption by analyzing session-level characteristics (such as message exchange order and direction sequence), packet-level characteristics (such as message format and field distribution), and flow-level statistical characteristics (such as packet length distribution and inter-packet delay distribution) of encrypted traffic. This allows them to infer communication content and user behavior patterns. This poses a serious challenge to the privacy protection of power data communication.

[0004] Existing traffic privacy enhancement technologies mainly include: (1) Traffic obfuscation methods based on random perturbation: These methods alter traffic statistics by adding random padding to data packets, introducing random delays, or modifying packet length distribution. While simple to implement, these methods are costly in terms of bandwidth and latency, making them unsuitable for power communication scenarios with stringent real-time requirements. Furthermore, they offer limited protection against deep learning-based identification methods.

[0005] (2) Privacy protection methods based on traffic masquerading: These methods attempt to disguise target traffic as other types of traffic. However, existing methods are mostly designed for specific protocols and lack universality. Furthermore, they have not established a systematic protocol description framework and cost-benefit evaluation model, which makes it difficult to achieve cross-protocol masquerading and control costs.

[0006] (3) Privacy protection methods based on encrypted tunnels: encapsulating the original traffic through technologies such as VPN, Tor, and SSH tunnels. The problem with this type of method is that the traffic characteristics of the encrypted tunnel itself are obvious, making it easy to identify and block, and it introduces additional protocol overhead, increasing latency and bandwidth costs.

[0007] A comprehensive analysis of existing technologies reveals the following main problems: a lack of a unified protocol description framework; a lack of quantitative basis for privacy enhancement strategies; a single defense dimension, with most methods only focusing on privacy enhancement from the perspective of flow-level statistical features; and a lack of optimization in state decision-making, as the matching relationship between the source and target protocol states is not fully considered during cross-protocol transitions.

[0008] Therefore, there is an urgent need for a method for protecting privacy in power data communication that can systematically describe protocol characteristics, quantitatively evaluate cost-benefit, and achieve multi-dimensional cross-protocol privacy enhancement at a controllable cost. Summary of the Invention

[0009] To address the aforementioned problems in existing technologies, this invention provides an adaptive cross-protocol privacy enhancement method for power data communication.

[0010] The method of the present invention includes the following steps:

[0011] Formal modeling of power communication protocols is performed, and the model includes message format description, format conversion rules, and state transition mechanism.

[0012] The message format is described as follows:

[0013] Among them, fields . Field semantic types are divided into five categories: These represent the identifier field, parameter field, length field, separator field, and load field, respectively. The field length can be a fixed value or a variable. The starting position of a field determines the order between fields. Total number of fields Indicates the identifier field. Indicates parameter field, This indicates the length field. Indicates the delimiter field. This indicates the load field.

[0014] Format conversion rules include three types of operations: Encryption operation in For the source field, For encrypted fields, For encryption key, This represents an algorithm function that uses the key to encrypt data; it converts plaintext fields into ciphertext, changes field content and length characteristics, and supports symmetric encryption algorithms such as AES-128-CBC, AES-128-GCM, and ChaCha20-Poly1305.

[0015] Encoding operations in For the target encoding format, This function represents an encoding function that converts data according to a specified format; it changes the representation of fields and supports formats such as UTF-8, ASCII, Base64, and URL encoding.

[0016] Header update operation ;in The source message format, For the updated message format, To add a new header field set, This function represents an update function that merges newly added header fields into the message header; it adds or modifies message header fields to achieve protocol-level spoofing.

[0017] Protocol state is defined as:

[0018] in, For communication direction, This represents the maximum allowed data length for this state. The sequence of header field lengths. This represents the number of header fields.

[0019] The protocol state set is divided into: ,in Establish a state set for the connection. For data transmission state set, This is the set of states for connection closure.

[0020] For a set of session traffic samples of the target protocol, calculate the mean of the state difference metric for each sample:

[0021] The measure of state differences is calculated based on the Kolmogorov-Smirnov test:

[0022] in, These are the KS test statistics for the message direction vector, header field length vector, and maximum payload length vector, respectively. The KS test statistic is defined as the maximum difference between two cumulative distribution functions:

[0023] Select the sample with the smallest mean of the difference measure as the representative sample of the target protocol:

[0024] Construct a target protocol state machine based on representative samples. For the current state of the source protocol, select the state with the minimum matching cost from the set of successor states of the target state:

[0025] Step 3: State-Driven Message Format Privacy Enhancement Based on the message format corresponding to the target state, perform stream-level privacy enhancement operations, including encryption, encoding, and header update operations.

[0026] Perform packet-level privacy enhancement operations: New Packet Operation: Creates additional control packets or handshake packets according to the requirements of the target protocol state machine.

[0027] Fill operation: Execute when the target field length is greater than the source field length. ,in The filling method adopts the PKCS#7 filling standard.

[0028] Slicing operation: Execute when the source field length exceeds the target maximum length limit. Number of slices .

[0029] Field mapping rules ensure data integrity: all fields in the source message are mapped to components of the payload or parameter fields in the target message; missing identifier and parameter fields in the target format are added according to the target format specification through header update operations; missing length and delimiter fields in the target format are added according to the target format specification through padding operations.

[0030] Calculate latency cost:

[0031] Calculate bandwidth cost:

[0032] Calculate the normalized total cost:

[0033] Calculate the message state consistency benefit:

[0034] in, This represents the rate of accuracy reduction of the deep learning recognition model based on session features before and after privacy enhancement.

[0035] Calculate the payoff for format matching:

[0036] Calculate the benefit of eigenstate similarity:

[0037] The characteristic state difference measure is calculated based on the packet number distribution, packet length distribution, and inter-packet delay distribution:

[0038] Calculate the weighted total return:

[0039] Compared with the prior art, the present invention has the following beneficial effects: 1. Unified Protocol Description Framework: Through a unified message description model, a formal description of different power communication protocols is achieved. It is applicable to multiple protocols such as HTTP, HTTPS, MQTT, Modbus / TCP, IEC 60870-5-104, and DNP3. When adding support for new protocols, only the description model needs to be extended, which is easy to deploy.

[0040] 2. Quantitative cost-benefit assessment: A systematic cost-benefit measurement model was established to quantitatively assess the privacy enhancement effect from five dimensions: latency cost, bandwidth cost, message state consistency, format state matching degree, and feature state similarity, providing a scientific basis for the formulation of privacy enhancement strategies.

[0041] 3. Multi-dimensional privacy enhancement: Privacy enhancement is systematically implemented from three dimensions: message state, format state, and feature state, which can effectively resist deep learning recognition methods based on session features, packet-level features, and stream-level features.

[0042] Optimal State Decision: By using a target state decision method based on minimum cost matching, the cost is minimized while ensuring privacy enhancement, and the target state with the minimum matching cost is selected, thereby reducing unnecessary privacy enhancement operations.

[0043] Real-time performance guarantee: By optimizing state decision-making and lightweight privacy-enhancing operations, the system controls latency costs while ensuring privacy protection, thus meeting the real-time requirements of power data communication. Attached Figure Description

[0044] Figure 1 Flowchart of an adaptive cross-protocol privacy enhancement method for power data communication; Detailed Implementation

[0045] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0046] The adaptive cross-protocol privacy enhancement method for power data communication provided by this invention achieves efficient and systematic privacy protection for power data communication by establishing a unified message description model, state decision based on minimum cost matching, state-driven message format privacy enhancement, and quantitative cost-benefit assessment.

[0047] Example 1

[0048] like Figure 1 The present invention proposes an adaptive cross-protocol privacy enhancement method for power data communication, the method comprising the following steps: Step 1: Establish a unified description model for power communication protocol messages Formal modeling of power communication protocols is performed, and the model includes message format description, format conversion rules, and state transition mechanism; (1) The message format is described as follows:

[0049] in, Indicates the first Protocol fields, For field semantic type, For field length, This is the starting position of the field. Total number of fields; Field semantic types are divided into five categories:

[0050] in, Represents the identifier field Indicates parameter field, This indicates the length field. Indicates the delimiter field. Represents the load field; (2) Format conversion rules include: Encryption operation: ,in For the source field, For encrypted fields, For encryption key, This represents the algorithm function that uses the key to encrypt the data; Encoding operations: ,in For the target encoding format, This refers to an encoding function that converts data according to a specified format. Header update operation: ,in The source message format, For the updated message format, To add a new header field set, This indicates an update function that merges newly added header fields into the message header; (3) The protocol state is defined as follows:

[0051] in, For communication direction, This represents the maximum allowed data length for this state. The sequence of header field lengths. Number of header fields; The protocol state set is divided into: ,in Establish a state set for the connection. For data transmission state set, For connection closed state set; Step 2: Target state decision based on minimum cost matching (1) Session traffic sample set for the target protocol Calculate the mean of the state difference measure for each sample:

[0052] in, Total number of samples, state difference measure The calculation method is as follows:

[0053] in, These are the weighting coefficients for message direction features, header length features, and payload length features, respectively. These are the Kolmogorov-Smirnov test statistics for the corresponding features; The Kolmogorov-Smirnov test statistic is defined as:

[0054] in, and Let be the cumulative distribution functions of the two samples, respectively. Indicates all The value is taken as supremum; (2) Select the sample with the smallest mean difference measure as the representative sample of the target protocol:

[0055] (3) Based on representative samples Construct the target protocol state machine and extract the state sequence and state transition relationships; (4) Current state of the source protocol The set of successor states of the target state Choose the state with the lowest matching cost:

[0056] in, The current target state The set of reachable successor states, Candidate target state; Step 3: State-Driven Message Format Privacy Enhancement (1) Based on the target state Corresponding message format Perform stream-level privacy enhancement operations: Encryption operation: Performed on the payload field or parameter field. ; Encoding operation: Perform on the field ; Header update operation: Execute ; (2) Perform packet-level privacy enhancement operations: New packet operation: Creates additional control packets or handshake packets according to the requirements of the target protocol state machine; Fill operation: Execute when the target field length is greater than the source field length. ,in Indicates generating a specified length A function that randomly or specifically fills in the data. For the fill length, For the target field length, For the length of the source field, This represents a string concatenation operation; Slicing operation: Execute when the source field length exceeds the target maximum length limit. ,in Number of slices; Step 4: Cost-Benefit Assessment of Privacy Enhancement (1) Calculate the delay cost:

[0057] in, For the first Data transmission time after privacy enhancement in this test For the first The original data transmission time in this test Number of tests; (2) Calculate bandwidth cost:

[0058] in, For the first The amount of data transmitted after privacy enhancement in this test For the first The amount of original data transmitted in this test; (3) Calculate the normalized total cost:

[0059] in, As the reference delay, This serves as the baseline data volume; (4) Calculate message state consistency benefits:

[0060] Among them, performance degradation rate These are the rates of decline in accuracy, precision, recall, and F1 score, respectively, calculated as follows:

[0061] in, To measure the accuracy of the deep learning recognition model based on session features on the raw traffic, To improve the accuracy of traffic after privacy enhancement; (5) Calculate the format matching degree benefit:

[0062] in, The values ​​represent the decrease rate of accuracy, precision, recall, and F1 score for the deep learning recognition model based on package-level features. (6) Calculate the eigenstate similarity gain:

[0063] in, For source protocol traffic, Enhanced privacy for traffic, For target protocol traffic, characteristic state difference measurement The calculation method is as follows:

[0064] in, Let be the packet number distribution vector. Let be the packet length distribution vector. Let be the time delay distribution vector of the private room. These are the weighting coefficients; (7) Calculate the weighted total return:

[0065] in, These are the weighting coefficients for the three types of returns.

[0066] Feature vector normalization includes: (1) Sequence length normalization: Fill feature vectors of different lengths with zero values ​​to a uniform length. ; (2) Element value normalization: Z-Score normalization method is used.

[0067] in, These are the original eigenvalues. These are the normalized eigenvalues. The mean of the eigenvectors, Standard deviation is the length of the feature vector.

[0068] The fill operation uses the PKCS#7 fill standard, with a fill length of [missing information]. The range of values ​​is ,in The block size is the encryption algorithm's block size, and the padding content consists of repeated padding length values.

[0069] The state transition function used in this method is defined as follows: Returns the set of reachable successor states of the current state, where Represents a set of states The power set.

[0070] Encryption operations support symmetric encryption algorithms AES-128-CBC, AES-128-GCM, and ChaCha20-Poly1305, and the key... Generates via Diffie-Hellman or ECDH key negotiation protocol.

[0071] The method for calculating the number of slices in a slicing operation is as follows:

[0072] in, For the length of the source field, The maximum allowed data length for the target state. This indicates rounding up to the nearest integer.

[0073] The method supports power communication protocols including HTTP, HTTPS, MQTT, SOCKS5, Modbus / TCP, IEC60870-5-104, DNP3, and OPC UA.

[0074] The initial values ​​of the weighting coefficients are set as follows:

[0075] It can be adjusted according to the actual application scenario through grid search or Bayesian optimization methods.

[0076] Example 2

[0077] Formal modeling of the power communication protocol is performed. The message format is described as follows: , where the fields .

[0078] For example, for the HTTP protocol, a request message can be described as:

[0079] The format conversion rules define how to convert the source format to the target format through encryption, encoding, and header update operations.

[0080] Protocol state is defined as For example, the TLS handshake phase state of HTTPS is:

[0081] Step 2: Target state decision based on minimum cost matching Collect session traffic samples of the target protocol (such as HTTPS) For each sample, extract the message direction sequence, header field length sequence, and maximum payload length sequence to construct a feature vector.

[0082] Calculate the mean of the state difference measure for each sample:

[0083] Calculation of state difference measure:

[0084] The initial value of the weighting coefficient is set to .

[0085] Select the sample with the smallest mean of the difference measure as the representative sample:

[0086] Construct a target protocol state machine based on representative samples to identify state sequences and state transition relationships.

[0087] During the privacy enhancement implementation phase, the current state of the source protocol is... The set of successor states of the target state Choose the state with the lowest matching cost:

[0088] Step 3: State-Driven Message Format Privacy Enhancement According to the target state Corresponding message format Perform privacy enhancement operations.

[0089] Stream-level operations: Encryption operation: The HTTP message body is encrypted using AES-128-GCM, and the key is generated through ECDH negotiation. Encoding operation: Perform URL encoding on the URI Header update operation: Add HTTPS TLS record layer header Package-level operations: Creating a new packet: Creating a TLS handshake packet (ClientHello, ServerHello, etc.) Padding operation: Pads short data packets to meet the block alignment requirements of TLS records. Padding length ,use Filling Standard Slicing operation: Performs slicing on data larger than 16KB, number of slices

[0090] Field mapping rules: All HTTP fields (request method, URI, headers, message body) are used as the TLS record layer payload for HTTPS; add TLS record layer header fields (content type, version number, length).

[0091] Step 4: Cost-Benefit Assessment of Privacy Enhancement Calculate latency cost: For the same data transmission task, test the transmission time before and after privacy enhancement, repeat the test 30 times, and calculate the average latency cost.

[0092] Calculate bandwidth cost: Analyze data transmission volume before and after privacy enhancement, and calculate the average bandwidth cost.

[0093] Calculate the normalized total cost and the baseline delay. Set to 1 second, baseline data volume Set to 1MB:

[0094] Calculate message state consistency gains: Using an LSTM-based session feature recognition model, trained on raw HTTP traffic and tested on privacy-enhanced traffic, calculate the rate of decrease in accuracy, precision, recall, and F1 score.

[0095] Calculate message state revenue:

[0096] Calculate the format matching benefit: Use a CNN-based packet-level feature recognition model, and evaluate it using the same method as for message format benefit.

[0097] Calculate the feature-state similarity gain: Extract features such as packet number distribution, packet length distribution, and inter-packet delay distribution, and perform Z-Score normalization.

[0098] Calculate the characteristic state difference measure:

[0099] The weighting coefficient is set to .

[0100] Calculate the characteristic state payoff:

[0101] Calculate the weighted total return, with the weighting coefficients set to... :

[0102] The method of this invention can be applied to various power communication scenarios, such as enhancing the privacy of HTTP traffic to HTTPS traffic, enhancing the privacy of Modbus / TCP traffic to MQTT traffic, and enhancing the privacy of plaintext protocol traffic to SOCKS5 tunnel protocol traffic. By reasonably selecting the target protocol and optimizing the privacy enhancement strategy, costs can be controlled while ensuring the effectiveness of privacy protection, and the real-time requirements of power data communication can be met.

[0103] The method has been validated in an experimental environment for its effectiveness and feasibility. It can significantly reduce the recognition accuracy of deep learning-based traffic identification models while maintaining acceptable latency and bandwidth costs, and has good prospects for industrial applications.

[0104] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of protection of the present invention.

Claims

1. An adaptive cross-protocol privacy enhancement method for power data communication, characterized in that, The method includes the following steps: Step 1: Establish a unified description model for power communication protocol messages Formal modeling of power communication protocols is performed, and the model includes message format description, format conversion rules, and state transition mechanism; (1) The message format is described as follows: ； in, Indicates the first Protocol fields, For field semantic type, For field length, This is the starting position of the field. Total number of fields; Field semantic types are divided into five categories: ； in, Indicates the identifier field. Indicates parameter field, This indicates the length field. Indicates the delimiter field. Represents the load field; (2) Format conversion rules include: Encryption operation: ,in For the source field, For encrypted fields, For encryption key, This represents the algorithm function that uses the key to encrypt the data; Encoding operations: ,in For the target encoding format, This refers to an encoding function that converts data according to a specified format. Header update operation: ,in The source message format, For the updated message format, To add a new header field set, This indicates an update function that merges newly added header fields into the message header; (3) The protocol state is defined as follows: ； in, For communication direction, This represents the maximum allowed data length for this state. The sequence of header field lengths. Number of header fields; The protocol state set is divided into: ,in Establish a state set for the connection. For data transmission state set, For the connection closed state set; Step 2: Target state decision based on minimum cost matching (1) Session traffic sample set for the target protocol Calculate the mean of the state difference measure for each sample: ； in, Total number of samples, state difference measure The calculation method is as follows: ； in, These are the weighting coefficients for message direction features, header length features, and payload length features, respectively. These are the Kolmogorov-Smirnov test statistics for the corresponding features; The Kolmogorov-Smirnov test statistic is defined as: ； in, and Let be the cumulative distribution functions of the two samples, respectively. Indicates all The value is taken as supremum; (2) Select the sample with the smallest mean difference measure as the representative sample of the target protocol: ； (3) Based on representative samples Construct the target protocol state machine and extract the state sequence and state transition relationships; (4) Current state of the source protocol The set of successor states of the target state Choose the state with the lowest matching cost: ； in, The current target state The set of reachable successor states, Candidate target state; Step 3: State-Driven Message Format Privacy Enhancement (1) Based on the target state Corresponding message format Perform stream-level privacy enhancement operations: Encryption operation: Performed on the payload field or parameter field. ; Encoding operation: Perform on the field ; Header update operation: Execute ; (2) Perform packet-level privacy enhancement operations: New packet operation: Creates additional control packets or handshake packets according to the requirements of the target protocol state machine; Fill operation: Execute when the target field length is greater than the source field length. ,in Indicates generating a specified length Functions for random or specific padding data For the fill length, For the target field length, For the length of the source field, This represents a string concatenation operation; Slicing operation: Execute when the source field length exceeds the target maximum length limit. ,in Number of slices; Step 4: Cost-Benefit Assessment of Privacy Enhancement (1) Calculate the delay cost: ； in, For the first Data transmission time after privacy enhancement in this test For the first The original data transmission time in this test Number of tests; (2) Calculate bandwidth cost: ； in, For the first The amount of data transmitted after privacy enhancement in this test For the first The amount of original data transmitted in this test; (3) Calculate the normalized total cost: ； in, As the reference delay, This serves as the baseline data volume; (4) Calculate message state consistency benefits: ； Among them, performance degradation rate These are the rates of decline in accuracy, precision, recall, and F1 score, respectively, calculated as follows: ； in, To measure the accuracy of the deep learning recognition model based on session features on the raw traffic, To improve the accuracy of traffic after privacy enhancement; (5) Calculate the payoff for format matching: ; in, The values ​​represent the decrease rate of accuracy, precision, recall, and F1 score for the deep learning recognition model based on package-level features. (6) Calculate the eigenstate similarity gain: ； in, For source protocol traffic, Enhanced privacy for traffic, For target protocol traffic, characteristic state difference measurement The calculation method is as follows: ； in, This is the packet number distribution vector. Let be the packet length distribution vector. Let be the time delay distribution vector of the private room. These are the weighting coefficients; (7) Calculate the weighted total return: ； in, These are the weighting coefficients for the three types of returns.

2. The method according to claim 1, characterized in that, The feature vector normalization process includes: (1) Sequence length normalization: Fill feature vectors of different lengths with zero values ​​to a uniform length. ; (2) Element value normalization: Z-Score normalization method is used. ； in, These are the original eigenvalues. These are the normalized eigenvalues. The mean of the eigenvectors, Standard deviation, is the length of the feature vector.

3. The method according to claim 1, characterized in that, The filling operation adopts the PKCS#7 filling standard, and the filling length is... The range of values ​​is ,in The block size is the encryption algorithm's block size, and the padding content consists of repeated padding length values.

4. The method according to claim 1, characterized in that, The state transition function used in this method is defined as follows: Returns the set of reachable successor states of the current state, where Represents a set of states The power set.

5. The method according to claim 1, characterized in that, The encryption operation supports the symmetric encryption algorithms AES-128-CBC, AES-128-GCM, and ChaCha20-Poly1305, and the key... Generates via Diffie-Hellman or ECDH key negotiation protocol.

6. The method according to claim 1, characterized in that, The method for calculating the number of slices in the slicing operation is as follows: ； in, For the length of the source field, The maximum allowed data length for the target state. This indicates rounding up to the nearest integer.

7. The method according to claim 1, characterized in that, The power communication protocols supported by the method include HTTP, HTTPS, MQTT, SOCKS5, Modbus / TCP, IEC 60870-5-104, DNP3, and OPC UA.

8. The method according to claim 1, characterized in that, The initial value of the weighting coefficient is set as follows: ； It can be adjusted according to the actual application scenario through grid search or Bayesian optimization methods.

Images