Network security data set construction method for large power management information area

Abstract

The invention discloses a power management information region-oriented network security data set construction method, and relates to the field of power network security, and the method comprises the steps: collecting multi-source network security data, and outputting a structured security event sequence through a business operation semantic analysis model and a data quality self-evaluation algorithm; generating an annotation event set by adopting a hybrid intelligent annotation algorithm driven by a large language model; multi-modal fusion is carried out, and a cross-domain event graph is generated in combination with a structural causal model; carrying out attack chain reconstruction, and outputting a complete attack chain set; identifying an attack sample scarcity category, generating a supplementary sample by adopting a conditional generative adversarial network, and obtaining an enhanced annotation event set; and performing multi-dimensional quality evaluation, and performing optimization according to an evaluation result and external threat intelligence to generate a network security data set. According to the method, the industry adaptability and the labeling automation degree of the data set are improved, and a reliable and structured data basis is provided for a safety detection model in an electric power scene.

Description

Technical Field

[0001] This invention relates to the field of power network security, and more specifically to a method for constructing a network security dataset for a large area of ​​power management information. Background Technology

[0002] In the field of power network security, the management information zone, as a key area connecting production control and information management, has a security dataset that is an important foundation for accurate threat detection and response.

[0003] Currently, publicly available cybersecurity datasets primarily originate from the general internet environment, lacking coverage of protocols and business processes specific to the power industry. Specifically, existing datasets typically fail to semantically characterize critical business operations within the power management information system, making it difficult to represent important behaviors such as critical configuration changes and business control operations. Furthermore, they cannot reflect cross-system attack chains formed by attackers moving laterally between different business systems within the management information system, stealing sensitive information, or tampering with critical configurations. Consequently, security models trained on such datasets have limited applicability in the power sector.

[0004] Secondly, in the data annotation stage, existing technologies mainly rely on manual analysis by security experts or automated scripts based on fixed rules. Manual annotation is inefficient and costly when dealing with massive amounts of multi-source power security data, and it is difficult to ensure the consistency of annotations. While rule-based automated methods can handle some known attacks, their generalization ability is weak, and they are powerless against complex multi-stage combined attacks. They cannot automatically generate structured semantic tags that describe the attack stages and entity relationships, which restricts the training of subsequent advanced threat analysis models.

[0005] Furthermore, existing technical solutions typically handle single-point security incidents in isolation, lacking the ability to deeply correlate and causally infer network attack events at the information technology layer with anomalies at the critical business system layer of the management information region. At the same time, the constructed datasets are often static, lacking targeted supplementation mechanisms for rare attack samples, and cannot achieve continuous evolution and updates of the datasets through linkage with external threat intelligence, making it difficult to cope with the rapidly changing cybersecurity threat landscape.

[0006] Therefore, how to design a method for constructing a cybersecurity dataset for a large power management information region, which can achieve effective annotation of attack semantics and structured reconstruction of attack chains based on multi-source data fusion, so as to generate a high-quality cybersecurity dataset that better meets the needs of the power scenario, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of this, the present invention provides a method for constructing a cybersecurity dataset for power management information regions. It aims to solve the problems of existing cybersecurity datasets lacking power industry characteristics, high cost of manual annotation, and difficulty in forming structured attack chain data. Through automated collection, intelligent annotation, fusion and reconstruction of multi-source data and continuous enhancement, a high-quality and evolvable dataset that can support the training of cybersecurity models in the power industry is generated.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: A method for constructing a cybersecurity dataset for a large power management information region includes the following steps: S1. Collect multi-source network security data in the power management information area, and output a structured security event sequence through a business operation semantic parsing model and a data quality self-assessment algorithm; S2. For the structured security event sequence, a hybrid intelligent annotation algorithm driven by a large language model is used to generate an annotated event set with attack type, attack stage, entity relationship and confidence level. S3. Perform multimodal fusion on the labeled event set based on semantic similarity, and evaluate the causal association weights between events through a structural causal model to generate a cross-domain event graph; S4. Based on the cross-domain event graph, combined with power security partitioning and business process constraints, the attack chain is reconstructed, and a complete attack chain set is output. S5. Based on the complete attack chain set, identify the scarce categories of attack samples, and use a conditional generative adversarial network to generate supplementary samples to obtain an enhanced labeled event set. S6. Perform multi-dimensional quality assessment on the enhanced labeled event set, and optimize it based on the assessment results and external threat intelligence to generate a cybersecurity dataset.

[0009] Preferably, S1 includes: Data such as network traffic mirroring, firewall logs, intrusion detection alarms, audit logs, key operation records of business systems, and bastion host operation records are acquired to form the original multimodal data set; Using a business operation semantic parsing model, the key operation records of the business system are parsed to extract the operation type, target device and instruction parameters, and generate a business operation semantic vector. Based on integrity, consistency and cross-source alignability, real-time quality scoring is performed on various types of data, and an autoencoder based on a long short-term memory network is used to identify abnormal data. Anomaly thresholds are adaptively adjusted through a sliding time window for cleaning. The cleaned data is then integrated into a structured security event record based on timestamps, forming the structured security event sequence. .

[0010] Preferably, S2 includes: S21. For each event in the structured security event sequence We construct prompt templates retrieved from the MITREATT&CK knowledge base, input them into a large language model, and obtain preliminary attack type annotations. Attack phase annotation Entity Relationship Annotation and the corresponding first confidence level ; S22, Regarding the satisfaction The event is labeled using different weakly supervised labeling functions, and the outputs of each function are fused through a label aggregation model to generate probabilistic attack type labels. Attack phase annotation Entity Relationship Annotation and the corresponding second confidence level ; S23. Construct a process tree based on audit logs, and reconstruct local attack chain fragments along the parent process chain for process nodes marked as malicious, and correct and complete the attack stage markings and entity relationship markings of related events. S24. For each event ,like If the result is correct, the annotation result of S21 is used; otherwise, the annotation result of S22 is used. Furthermore, the correction and completion results from S23 are combined to form a set of annotation events. , This represents the integrated labeled quadruple.

[0011] Preferably, in step S22, the label aggregation model will include the set of labeling functions. The output tags are weighted and aggregated as follows:

[0012] in, This represents the result of the i-th sample after being weighted and aggregated by all weakly supervised labeling functions. The reliability weights of the k-th labeling function obtained based on the expectation-maximization algorithm are: This indicates the number of weakly supervised annotation functions. Preferably, in step S23, the attack behaviors in the local attack chain segment are mapped to the technical numbers of the MITREATT&CK framework, and the technical numbers are used as a supplementary or corrective basis for the labeling of the attack stages of related events.

[0013] Preferably, S3 includes: S31. For each event in the labeled event set, extract the modal feature vector according to its data type. ; S32, For any two events and Calculate the fusion weights :

[0014] in, Representing the eigenvector and cosine similarity, and Here, λ is the event timestamp, and λ is the time decay coefficient. S33. Using all events as nodes, merge weights. As edge weights, an initial cross-modal association graph is constructed; S34. Based on the structural causal model, the intervention analysis calculates the average causal effect strength from the event node in the information technology layer to the event node in the business system layer, which is used as the causal association weight. The weights of the corresponding edges in the initial cross-modal association graph are updated to generate a cross-domain event graph that combines the causal weights.

[0015] Preferably, S31 includes: Extract statistical time-series features from events whose data type is network traffic mirroring; For events whose data types are firewall logs, intrusion detection alarms, audit logs, or bastion host operation records, use a security domain pre-trained model to extract the semantic vector of their text; For events whose data type is a record of key operations in the business system, extract the semantic vector of the operation and the features of the state change.

[0016] Preferably, S4 includes: Based on the timestamp sequence of the original security logs and the reachability relationship of the network topology, an unauthorized event structure graph is constructed. ; event structure diagram Cross-domain event graph The events are merged to generate a weighted event cause-effect graph. ; Based on weighted event causality graph A priority-driven path search strategy is adopted to generate candidate attack paths starting from malicious event nodes with high confidence or high causal weight. By combining power security zoning and key business operation processes, each candidate attack path is verified, paths that violate security zoning or business logic are eliminated, and a complete attack chain set is output.

[0017] Preferably, S5 includes: Identify attack categories whose sample count in the complete attack chain set is below a set threshold as scarce categories; For each attack type in the aforementioned scarce category, a generative adversarial network is constructed with noise vector z and attack type label c as conditions to generate synthetic attack samples that conform to the semantics of the power scenario. ; For the synthetic attack sample Perform protocol field format validation and statistical distribution consistency verification; The qualified synthetic attack samples are added to the labeled event set to generate an enhanced labeled event set.

[0018] Preferably, S6 includes: Construct a multi-dimensional quality assessment system that includes annotation accuracy, annotation consistency, attack type coverage, and sample balance, evaluate the enhanced annotation event set, and generate a quality assessment report; By comparing the attack types covered by the current dataset with those in an external threat intelligence database, the identification results of the uncovered attack types are obtained. Based on the quality assessment report and the results of identifying uncovered attack types, specific types of security data are collected in a targeted manner, or supplementary samples of specific types are generated through a conditional generative adversarial network, and added to the enhanced labeled event set to generate a cybersecurity dataset.

[0019] As can be seen from the above technical solution, compared with the prior art, the technical solution of the present invention has the following beneficial effects: 1. This method collects and parses key business operation instructions, extracts key business semantics, and performs cross-domain causal correlation and fusion between information technology layer logs and key operation instructions of business system layer. The resulting dataset can cover cross-system attack behavior patterns from information network penetration to the business system layer of management information area, overcoming the limitation of general security datasets that cannot reflect the cross-system attack characteristics of power enterprise information system environment.

[0020] 2. A large language model is used for zero-sample initial screening, and combined with weakly supervised annotation aggregation and process tree backtracking analysis. While reducing the reliance on manual annotation by security experts, it not only annotates the attack type of the event, but also generates structured semantic tags with attack stages, entity relationships and confidence levels, and provides a high-quality annotation foundation for subsequent automated reconstruction of the attack chain.

[0021] 3. Based on semantics and causal relationships, discrete security events are automatically reconstructed into attack chains that conform to the logic of power business. The dataset contains the context and evolution path of threats. Furthermore, targeted data augmentation is performed by identifying scarce samples in the attack chain, and quality assessment and closed-loop optimization are carried out in combination with external threat intelligence. The dataset can continuously cover new attack methods and evolve from a static data set into a dynamic dataset that can continuously evolve. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0023] Figure 1 A flowchart illustrating a method for constructing a network security dataset for a large power management information region, as provided in this embodiment of the invention; Figure 2 This is a schematic diagram illustrating the implementation process of the network security dataset construction method in the application scenario provided by the embodiments of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] like Figure 1 As shown in the figure, this embodiment provides a method for constructing a network security dataset for a large power management information region, including the following steps: S1. Collect multi-source network security data in the power management information area, and output a structured security event sequence through a business operation semantic parsing model and a data quality self-assessment algorithm; S2. For the structured security event sequence, a hybrid intelligent annotation algorithm driven by a large language model is used to generate an annotated event set with attack type, attack stage, entity relationship and confidence level. S3. Perform multimodal fusion on the labeled event set based on semantic similarity, and evaluate the causal association weights between events through a structural causal model to generate a cross-domain event graph; S4. Based on the cross-domain event graph, combined with power security partitioning and business process constraints, the attack chain is reconstructed, and a complete attack chain set is output. S5. Based on the complete attack chain set, identify the scarce categories of attack samples, and use a conditional generative adversarial network to generate supplementary samples to obtain an enhanced labeled event set. S6. Perform multi-dimensional quality assessment on the enhanced labeled event set, and optimize it based on the assessment results and external threat intelligence to generate a cybersecurity dataset.

[0026] This method operates on a cloud-edge collaborative hardware architecture, where distributed acquisition probes are deployed at county-level nodes to perform data acquisition and preliminary cleaning; a hybrid intelligent annotation algorithm driven by a large language model, a multimodal fusion strategy, a structural causal model, and an attack chain intelligent reconstruction algorithm are deployed at provincial cloud platforms or prefecture-level edge nodes; data transmission between nodes at all levels is conducted through encrypted communication channels, and timestamp consistency is ensured through a time synchronization protocol.

[0027] By collecting and parsing key power business operation instruction data, and combining intelligent annotation with large language model and cross-domain causal fusion, this method constructs a high-quality cybersecurity dataset that can accurately characterize the unique attack patterns of the power industry, automatically reconstruct attack chains, and continuously evolve and update. This method significantly improves the industry adaptability and annotation automation of the dataset, providing a reliable, structured, and dynamically optimized data foundation for training security detection models specifically for power scenarios.

[0028] The following provides a further detailed explanation of each step in the above method; In this embodiment S1, multi-source network security data is collected in the power management information area, and a structured security event sequence is output through a business operation semantic parsing model and a data quality self-assessment algorithm; including: Data such as network traffic mirroring, firewall logs, intrusion detection alarms, audit logs, key operation records of business systems, and bastion host operation records are acquired to form the original multimodal data set; The business operation semantic parsing model is used to parse the key operation records of the business system, extract the operation type, target device and instruction parameters, and generate business operation semantic vectors. The business operation semantic parsing model adopts a BERT-based sequence labeling architecture and is fine-tuned by power dispatch operation logs and equipment control instruction sets. It can identify structured fields such as operation type, device identifier and parameter value. Based on integrity, consistency and cross-source alignability, real-time quality scoring is performed on various types of data, and an autoencoder based on a long short-term memory network is used to identify abnormal data. Anomaly thresholds are adaptively adjusted through a sliding time window for cleaning. The cleaned data is then integrated into a structured security event record based on timestamps, forming the structured security event sequence. .

[0029] In this step, integrity refers to checking whether the necessary fields of the data records are missing; consistency refers to assessing whether there are logical conflicts in the key information of the same security event in logs from different sources; cross-source alignability refers to determining whether data from different acquisition probes or systems can be accurately correlated and aligned through common key fields; the autoencoder based on the Long Short-Term Memory network learns to reconstruct the normal pattern of the input event sequence by training on a large amount of normal historical data; during the cleaning process, real-time data is input into the network, its reconstruction error is calculated, and data that deviates significantly from the normal pattern is identified as potential anomalies.

[0030] It collects multi-source security data by deploying distributed probes or related collection modules. Malicious code probes, host log proxies, and network traffic mirroring ports can all be used as collection probes. Furthermore, by leveraging semantic parsing of key business operations and adaptive cleaning based on LSTM autoencoders, it transforms the raw multimodal data into structured security event sequences, providing standardized data input with controllable quality and enhanced semantics for subsequent intelligent annotation and fusion analysis.

[0031] In this embodiment S2, a hybrid intelligent annotation algorithm driven by a large language model is used to generate an annotated event set with attack type, attack stage, entity relationship, and confidence level for the structured security event sequence; including: S21. For each event in the structured security event sequence We construct prompt templates retrieved from the MITREATT&CK knowledge base, input them into a large language model, and obtain preliminary attack type annotations. Attack phase annotation Entity Relationship Annotation and the corresponding first confidence level The large model here is a pre-trained language model based on the Transformer architecture, and it has been fine-tuned under supervision for log semantics and ATT&CK tactical description in the power field, so that it has domain adaptability for power security event classification and relation extraction. S22, Regarding the satisfaction The event is labeled using different weakly supervised labeling functions, and the outputs of each function are fused through a label aggregation model to generate probabilistic attack type labels. Attack phase annotation Entity Relationship Annotation and the corresponding second confidence level ; The value was set to 0.7–0.8, based on evaluating the consistency between the large model annotation results and human annotations on a large-scale validation set. S23. Construct a process tree based on audit logs, and reconstruct local attack chain fragments along the parent process chain for process nodes marked as malicious, and correct and complete the attack stage markings and entity relationship markings of related events. S24. For each event ,like If the result is correct, the annotation result of S21 is used; otherwise, the annotation result of S22 is used. Furthermore, the correction and completion results from S23 are combined to form a set of annotation events. , This represents the integrated labeled quadruple.

[0032] Furthermore, in S22, the label aggregation model will label the set of functions. The output tags are weighted and aggregated as follows:

[0033] in, This represents the result of the i-th sample after being weighted and aggregated by all weakly supervised labeling functions. The reliability weights of the k-th labeling function obtained based on the expectation-maximization algorithm are: This indicates the number of weakly supervised annotation functions; weakly supervised annotation functions include rule-based annotation functions based on predefined security rules, knowledge base-based annotation functions based on feature pattern matching, etc. Here, the expectation-maximization algorithm treats the true reliability of the annotation source as a latent variable. In the E-step, it estimates the probability contribution of each annotation function to each event annotation based on the current weights, and in the M-step, it updates the weights to maximize the overall annotation likelihood. It can adaptively learn the confidence differences of different annotation sources in the power safety data scenario without relying on prior fixed weights, thereby improving the accuracy and robustness of label aggregation for low-confidence samples and ultimately ensuring the quality of the annotated event set.

[0034] Furthermore, in S23, the attack behaviors in the local attack chain segment are mapped to the technical numbers of the MITREATT&CK framework, and the technical numbers are used as a supplement or correction basis for the annotation of the attack stages of related events.

[0035] This step generates structured semantic labels for each security event by integrating zero-sample annotation of large language models, weakly supervised label aggregation, and attack chain fragment completion based on process trees. The resulting labeled event set not only improves annotation efficiency and consistency, but also provides a highly reliable semantic foundation for subsequent causal association and attack chain reconstruction.

[0036] In this embodiment S3, multimodal fusion is performed on the labeled event set based on semantic similarity, and the causal association weights between events are evaluated through a structural causal model to generate a cross-domain event graph; including: S31. For each event in the labeled event set, extract the modal feature vector according to its data type. Specifically, this includes: extracting statistical time-series features for events whose data type is network traffic mirroring; extracting semantic vectors from the text of events whose data type is firewall logs, intrusion detection alarms, audit logs, or bastion host operation records using a security domain pre-trained model; and extracting operation semantic vectors and state change features for events whose data type is key operation records of business systems. The security domain pre-trained model here adopts the ELECTRA model, which is further pre-trained on a large number of firewall logs and IDS alarm texts. Power protocol-specific terms have been added to the vocabulary to improve the domain relevance of the log semantic vector representation. S32, For any two events and Calculate the fusion weights :

[0037] in, Representing the eigenvector and cosine similarity, and λ is the event timestamp, and λ is the time decay coefficient, with a value of 0.01–0.05. S33. Using all events as nodes, merge weights. As edge weights, an initial cross-modal association graph is constructed; here, nodes are classified into information technology layer nodes and business system layer nodes: event nodes whose data type belongs to network traffic mirroring, firewall logs, intrusion detection alarms, audit logs, or bastion host operation records are classified as information technology layer nodes; event nodes whose data type belongs to business system key operation records are classified as business system layer nodes. S34. Based on the structural causal model, the intervention analysis calculates the average causal effect strength from the event node in the information technology layer to the event node in the business system layer, which is used as the causal association weight. The weights of the corresponding edges in the initial cross-modal association graph are updated to generate a cross-domain event graph that combines the causal weights.

[0038] In this step, the cross-domain event causal graph uses security events as nodes and is divided into information technology layer nodes and management information regional business system layer nodes according to the source and data type of the events. The candidate associations between nodes are initially screened based on the time sequence of events, network topology reachability, and business process constraints. Historical observation data is used to calculate the causal intervention effect to determine the strength of the causal association, thereby constructing an event causal graph that reflects the cross-system attack transmission relationship.

[0039] Specifically, on the initial cross-modal association graph, for each directed edge from an event node p in the information technology layer to an event node q in the business system layer, the causal intervention effect is calculated multiple times using historical observation data. ,in This represents the probability that the event corresponding to node j is in a certain state, given that intervention is performed on the event corresponding to node p. This represents the probability that the event corresponding to node j is in a certain state without any intervention in the event corresponding to node p; Subsequently, the statistical average of all calculated intervention effect values ​​is taken as the final causal association weight on the directed edge. The averaging process can effectively smooth the random fluctuations of a single estimate, improve the robustness and reliability of the causal association weight, and thus more accurately quantify the potential causal impact of information technology layer security events on abnormal states of the business system layer.

[0040] It extracts heterogeneous features based on the data type of events and constructs an initial cross-modal association graph by integrating semantic similarity and temporal proximity through a non-aligned matching strategy. Then, by calculating the causal intervention effect from information technology layer events to business system layer events, it assigns quantified causal weights to the edges in the graph, and finally generates a cross-domain event causal graph that can reveal the potential attack propagation paths between different security domains or key business systems within the management information area.

[0041] In this embodiment S4, based on the cross-domain event graph and combined with power security partitioning and business process constraints, the attack chain is reconstructed, and a complete attack chain set is output; including: Based on the timestamp sequence of the original security logs and the reachability relationship of the network topology, an unauthorized event structure graph is constructed. ; event structure diagram Cross-domain event graph The events are merged to generate a weighted event cause-effect graph. ; Based on weighted event causality graph A priority-driven path search strategy is adopted to generate candidate attack paths starting from malicious event nodes with high confidence or high causal weight. By combining power security zoning and key power business processes, each candidate attack path is verified, paths that violate security zoning or business logic are eliminated, and a complete set of attack chains is output.

[0042] It integrates an event structure graph with a cross-domain event graph with causal weights to form a weighted event causal graph, and performs heuristic search under the constraints of power safety rules on this graph. Its output is a complete set of attack chains verified by business logic and security partitions, realizing the automated reconstruction from discrete alarms to explainable and traceable attack scenarios.

[0043] In this embodiment, S5, based on the complete attack chain set, scarce attack sample categories are identified, and supplementary samples are generated using a conditional generative adversarial network to obtain an enhanced labeled event set; including: Identify attack categories whose sample count in the complete attack chain set is below a set threshold as scarce categories; For each attack type in the aforementioned scarce category, a generative adversarial network is constructed with noise vector z and attack type label c as conditions to generate synthetic attack samples that conform to the semantics of the power scenario. ; For the synthetic attack sample Perform protocol field format validation and statistical distribution consistency verification; The qualified synthetic attack samples are added to the labeled event set to generate an enhanced labeled event set.

[0044] To address the scarce sample categories revealed by attack chain analysis, a conditional generative adversarial network is used to synthesize attack samples that conform to the behavioral characteristics of the power industry scenario. After verification by protocol format and statistical distribution, this process effectively alleviates the problem of insufficient key threat samples in the dataset and generates a more balanced set of enhanced labeled events.

[0045] In this embodiment, S6, a multi-dimensional quality assessment is performed on the enhanced labeled event set, and optimization is carried out based on the assessment results and external threat intelligence to generate a cybersecurity dataset; including: A multi-dimensional quality assessment system, including annotation accuracy, annotation consistency, attack type coverage, and sample balance, is constructed to evaluate the enhanced annotated event set and generate a quality assessment report. Annotation accuracy measures the consistency between automatically annotated results and manually verified samples; annotation consistency assesses the stability of annotation results for the same attack events across different data sources; attack type coverage statistically analyzes the proportion of covered attack categories in the known attack type set; and sample balance measures the uniformity of the sample distribution across attack categories. By comparing the attack types covered by the current dataset with those in an external threat intelligence database, the identification results of the uncovered attack types are obtained. Based on the quality assessment report and the results of identifying uncovered attack types, specific types of security data are collected in a targeted manner, or supplementary samples of specific types are generated through a conditional generative adversarial network, and added to the enhanced labeled event set to generate a cybersecurity dataset.

[0046] By constructing a multi-dimensional quality assessment system to quantitatively evaluate the dataset and combining it with external threat intelligence to identify blind spots, targeted data supplementation and model iteration optimization are driven, ultimately forming a cybersecurity dataset with continuous evolution capabilities. This ensures that the quality, timeliness, and business relevance of the output dataset can continuously meet the dynamically evolving protection needs.

[0047] like Figure 2 As shown, this example uses a provincial power company's Management Information System (MIS) region as an application scenario to further illustrate the network security dataset construction method in this embodiment. The company has already established a three-tiered network architecture at the provincial, prefectural, and county levels, and has pre-configured data collection capabilities at key nodes. The specific implementation steps include: 1) Multi-source data acquisition and structured processing; Probes or log collection modules are deployed at the provincial, prefectural, and county levels to simultaneously collect network traffic, various logs, and key business operation instructions. At the prefectural level, the semantics of instructions are extracted using a power business operation semantic parsing module. Then, through a quality assessment and anomaly cleaning model based on an LSTM autoencoder, the multi-source data is integrated into a structured security event sequence in a unified format according to timestamps.

[0048] 2) Hybrid intelligent annotation driven by large language models; At the provincial platform, event sequences are labeled. First, key information for each event, such as log summary, source IP, and protocol type, is combined with relevant tactical descriptions retrieved in real time from the MITRE ATT&CK knowledge base to construct cue words. Then, high-confidence events are automatically labeled using a large language model. For low-confidence events, multiple weakly supervised labeling results, such as rule matching and feature library queries, are aggregated, and the weight of each labeling source is dynamically determined using the expectation-maximization algorithm. Meanwhile, a process tree is automatically constructed from the audit logs. When a process is marked as malicious, the system automatically traces back its parent process and sibling processes to form a local attack chain fragment of process A (malicious) - process B (suspicious) - system service C. This fragment is used to correct and complete the stage and entity relationship labels of related events, and finally outputs a set of labeled events with high confidence labels and preliminary attack chain semantics.

[0049] 3) Cross-domain event fusion and causal relationship analysis; For the labeled event set, statistical, semantic and status features are extracted from network traffic, log text and key business operation instructions respectively. By fusing semantic similarity and temporal proximity, an initial cross-modal association graph is constructed. In the graph, events are clearly divided into two types of nodes: nodes from the information technology layer and nodes from the critical business system layer. Using an intervention analysis method based on a causal graph model, the average causal effect strength of each edge in the graph pointing from the information technology layer node to the critical business system layer node is quantitatively calculated. For example, it assesses the extent to which the occurrence of a specific web attack event increases the probability of subsequent abnormal value modification instructions. This causal strength is then updated to the final weight of the corresponding edge, thereby generating a cross-domain causal event graph that reveals how IT attacks can potentially lead to anomalies in critical business systems.

[0050] 4) Reconstruction of the attack chain under the constraints of power business; The causal event graph obtained in the previous step is merged with the structure graph constructed based on the original log time sequence and network topology to form a weighted event causal graph. On this graph, starting from the high-confidence malicious node, possible paths to the critical business system node are searched to generate candidate attack chains. Each candidate chain must pass automatic verification by power security partitioning rules and key power business processes. For example, it checks whether the path violates the security partitioning boundary within the management information area or whether it contains instruction sequences that do not conform to substation operating procedures. Non-compliant paths are eliminated, and the final output is a complete set of attack chains that conforms to the logic of the power scenario.

[0051] 5) Data augmentation for rare attack types; By analyzing the attack chain set, we can identify attack categories with scarce samples, such as business operation instructions. For these categories, we use conditional generative adversarial networks to generate synthetic attack samples that conform to the behavioral characteristics of the power scenario. The generated samples need to pass protocol format verification and statistical distribution verification. Qualified samples are added to the labeled event set, thereby effectively balancing the dataset and improving the coverage of rare threats.

[0052] 6) Quality assessment and continuous optimization; The enhanced dataset is automatically evaluated from multiple dimensions, including annotation accuracy, consistency, attack type coverage, and sample balance. At the same time, the latest attack methods information is obtained from public vulnerability databases and industry threat intelligence platforms, compared with the current dataset, and a list of uncovered attack types is generated. Based on the quality assessment report and the list of uncovered data, optimization actions are triggered as follows: First, instructions are issued to the data collection probes to focus on collecting network traffic and logs related to the uncovered types over a subsequent period of time; second, the conditional generative adversarial network is restarted to generate simulation data for these missing types in a targeted manner; ultimately, a continuous optimization loop for the dataset is formed to ensure its timeliness and practicality.

[0053] Furthermore, the completed cybersecurity dataset will be used as training data to input into the intelligent security detection model. During the model training phase, the labeled event set in the dataset provides the model with samples containing attack semantics, enabling it to learn to identify various threats. The cross-domain event graph and causal weights are used to train the model to understand the transmission pattern of attacks between the information technology layer and the critical business system layer. The complete attack chain set serves as a high-level label, which can supervise the model to learn and reconstruct multi-stage attack scenarios. Once trained, the model is deployed in a real power network environment and can analyze newly generated security event streams in real time. It can not only perform high-precision attack classification and alarms, but also use the learned causal and chain patterns to correlate discrete alarms, infer attack intent, and reconstruct potential attack links, thereby achieving intelligent detection and tracing of complex cross-domain attacks such as advanced persistent threats.

[0054] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0055] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for constructing a network security dataset for a large-scale power management information system, characterized in that, Includes the following steps: S1. Collect multi-source network security data in the power management information area, and output a structured security event sequence through a business operation semantic parsing model and a data quality self-assessment algorithm; S2. For the structured security event sequence, a hybrid intelligent annotation algorithm driven by a large language model is used to generate an annotated event set with attack type, attack stage, entity relationship and confidence level. S3. Perform multimodal fusion on the labeled event set based on semantic similarity, and evaluate the causal association weights between events through a structural causal model to generate a cross-domain event graph; S4. Based on the cross-domain event graph, combined with power security partitioning and business process constraints, the attack chain is reconstructed, and a complete attack chain set is output. S5. Based on the complete attack chain set, identify the scarce categories of attack samples, and use a conditional generative adversarial network to generate supplementary samples to obtain an enhanced labeled event set. S6. Perform multi-dimensional quality assessment on the enhanced labeled event set, and optimize it based on the assessment results and external threat intelligence to generate a cybersecurity dataset.

2. The method for constructing a network security dataset for a large power management information region according to claim 1, characterized in that, S1 includes: Data such as network traffic mirroring, firewall logs, intrusion detection alarms, audit logs, key operation records of business systems, and bastion host operation records are acquired to form the original multimodal data set; Using a business operation semantic parsing model, the key operation records of the business system are parsed to extract the operation type, target device and instruction parameters, and generate a business operation semantic vector. Based on integrity, consistency and cross-source alignability, real-time quality scoring is performed on various types of data, and an autoencoder based on a long short-term memory network is used to identify abnormal data. Anomaly thresholds are adaptively adjusted through a sliding time window for cleaning. The cleaned data is then integrated into a structured security event record based on timestamps, forming the structured security event sequence. .

3. The method for constructing a network security dataset for a large power management information region according to claim 1, characterized in that, S2 includes: S21. For each event in the structured security event sequence We construct prompt templates retrieved from the MITREATT&CK knowledge base, input them into a large language model, and obtain preliminary attack type annotations. Attack phase annotation Entity Relationship Annotation and the corresponding first confidence level ; S22, Regarding the satisfaction The event is labeled using different weakly supervised labeling functions, and the outputs of each function are fused through a label aggregation model to generate probabilistic attack type labels. Attack phase annotation Entity Relationship Annotation and the corresponding second confidence level ; S23. Construct a process tree based on audit logs, and reconstruct local attack chain fragments along the parent process chain for process nodes marked as malicious, and correct and complete the attack stage markings and entity relationship markings of related events. S24. For each event ,like If the result is correct, the annotation result of S21 is used; otherwise, the annotation result of S22 is used. Furthermore, the correction and completion results from S23 are combined to form a set of annotation events. , This represents the integrated labeled quadruple.

4. The method for constructing a network security dataset for a large power management information region according to claim 3, characterized in that, In step S22, the label aggregation model will label the set of functions. The output tags are weighted and aggregated as follows: in, This represents the result of the i-th sample after being weighted and aggregated by all weakly supervised labeling functions. The reliability weights of the k-th labeling function obtained based on the expectation-maximization algorithm are: This indicates the number of weakly supervised annotation functions.

5. The method for constructing a network security dataset for a large power management information region according to claim 3, characterized in that, In step S23, the attack behaviors in the local attack chain segment are mapped to the technical numbers of the MITREATT&CK framework, and the technical numbers are used as a supplement or correction basis for the annotation of the attack stages of related events.

6. The method for constructing a network security dataset for a large power management information region according to claim 1, characterized in that, S3 includes: S31. For each event in the labeled event set, extract the modal feature vector according to its data type. ; S32, For any two events and Calculate the fusion weights : in, Representing the eigenvector and cosine similarity, and Here, λ is the event timestamp, and λ is the time decay coefficient. S33. Using all events as nodes, merge weights. As edge weights, an initial cross-modal association graph is constructed; S34. Based on the structural causal model, the intervention analysis calculates the average causal effect strength from the event node in the information technology layer to the event node in the business system layer, which is used as the causal association weight. The weights of the corresponding edges in the initial cross-modal association graph are updated to generate a cross-domain event graph that combines the causal weights.

7. The method for constructing a network security dataset for a large power management information region according to claim 6, characterized in that, S31 includes: Extract statistical time-series features from events whose data type is network traffic mirroring; For events whose data types are firewall logs, intrusion detection alarms, audit logs, or bastion host operation records, use a security domain pre-trained model to extract the semantic vector of their text; For events whose data type is a record of key operations in the business system, extract the semantic vector of the operation and the features of the state change.

8. The method for constructing a network security dataset for a large power management information region according to claim 1, characterized in that, S4 includes: Based on the timestamp sequence of the original security logs and the reachability relationship of the network topology, an unauthorized event structure graph is constructed. ; event structure diagram Cross-domain event graph The events are merged to generate a weighted event cause-effect graph. ; Based on weighted event causality graph A priority-driven path search strategy is adopted to generate candidate attack paths starting from malicious event nodes with high confidence or high causal weight. By combining power security zoning and key business operation processes, each candidate attack path is verified, paths that violate security zoning or business logic are eliminated, and a complete attack chain set is output.

9. A method for constructing a network security dataset for a large power management information region according to claim 1, characterized in that, S5 includes: Identify attack categories whose sample count in the complete attack chain set is below a set threshold as scarce categories; For each attack type in the aforementioned scarce category, a generative adversarial network is constructed with noise vector z and attack type label c as conditions to generate synthetic attack samples that conform to the semantics of the power scenario. ; For the synthetic attack sample Perform protocol field format validation and statistical distribution consistency verification; The qualified synthetic attack samples are added to the labeled event set to generate an enhanced labeled event set.

10. A method for constructing a network security dataset for a large power management information region according to claim 1, characterized in that, S6 includes: Construct a multi-dimensional quality assessment system that includes annotation accuracy, annotation consistency, attack type coverage, and sample balance, evaluate the enhanced annotation event set, and generate a quality assessment report; By comparing the attack types covered by the current dataset with those in an external threat intelligence database, the identification results of the uncovered attack types are obtained. Based on the quality assessment report and the results of identifying uncovered attack types, specific types of security data are collected in a targeted manner, or supplementary samples of specific types are generated through a conditional generative adversarial network, and added to the enhanced labeled event set to generate a cybersecurity dataset.

Images