Intelligent substation network intrusion detection method and system

Abstract

The invention relates to an intelligent substation network intrusion detection method and system, and the method comprises the steps: S1, collecting the real-time flow data of an intelligent substation network, and carrying out the preprocessing of the real-time flow data, and obtaining a feature vector; s2, performing flow detection on the feature vector of the real-time flow data to judge whether the feature vector is normal flow or abnormal flow; s3, further judging the attack type of the feature vector which is judged as the abnormal traffic, and judging the feature vector as a known attack type or an unknown attack type; and S4, carrying out anomaly detection on the feature vector of the unknown attack type, and judging the feature vector of the unknown attack type as normal flow or unknown attack flow so as to complete intrusion detection of real-time flow data. According to the method, network intrusion of the intelligent substation can be effectively detected, and known and unknown attacks can be efficiently dealt with.

Description

Technical Field

[0001] This invention relates to the field of network security detection technology, and in particular to a method and system for detecting network intrusion in intelligent substations. Background Technology

[0002] Smart substations are a crucial component of modern power systems. Their network communication involves multiple aspects, including equipment control, data acquisition, monitoring, and dispatching, connecting numerous automated devices, monitoring systems, sensors, and computing platforms. These interconnected devices and systems drive the automation and informatization levels of substations. However, as the networking of smart substations progresses, traditional network security measures are no longer sufficient to address increasingly complex attack threats. Especially under large-scale network traffic, existing feature-matching-based intrusion detection technologies cannot provide timely and effective responses to new and complex attack methods.

[0003] Current intrusion detection methods are mostly based on signature or rule matching techniques, primarily detecting known attack behaviors. While these methods can quickly identify and protect against existing attack types, they often fall short against unseen or variant attacks (such as zero-day attacks). Furthermore, with increasing network traffic, traditional methods suffer from high false positive and false negative rates, leading to inefficient security protection. Against this backdrop, designing an intrusion detection method that is adaptable to substation network environments and possesses efficient identification capabilities, especially for detecting unknown attack traffic, has become an urgent problem to be solved.

[0004] To address the aforementioned issues, intrusion detection technologies based on machine learning and deep learning algorithms have gradually become a research hotspot. In recent years, some deep learning-based traffic classification and attack identification methods have made some progress; however, existing technologies often lack in-depth analysis and multi-layered processing of network traffic, especially when dealing with unknown attacks in complex environments such as substations, often resulting in misjudgments or missed detections. Therefore, there is an urgent need for a new detection method capable of efficiently handling both known and unknown attacks. Summary of the Invention

[0005] Therefore, the technical problem to be solved by the present invention is to overcome the problem of misjudgment or missed judgment in the existing intelligent substation network intrusion detection technology based on machine learning and deep learning algorithms when dealing with unknown attacks.

[0006] To address the aforementioned technical problems, this invention provides a method for network intrusion detection in intelligent substations, comprising:

[0007] Step S1: Collect real-time traffic data of the smart substation network, and preprocess the real-time traffic data to obtain a feature vector;

[0008] Step S2: Perform traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic;

[0009] Step S3: For feature vectors identified as abnormal traffic, further determine their attack type and classify them as either known or unknown attack types;

[0010] Step S4: For feature vectors identified as unknown attack types, perform anomaly detection to determine whether they are normal traffic or unknown attack traffic, thus completing intrusion detection of real-time traffic data.

[0011] In one embodiment of the present invention, the method for step S2 to perform traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic includes:

[0012] The loss function for constructing the XGBoost model Through the loss function Train the XGBoost model;

[0013] The loss function Defined as:

[0014] ;

[0015] in, This is the set of parameters for the model, including the structure of all trees and the weights of the leaf nodes. To predict the loss weighting coefficients, it is important to control the classification accuracy; This represents the number of training samples; For the first The true label of each sample 0 indicates normal traffic, and 1 indicates abnormal traffic; For the model to the first The predicted output for each sample; This is the structural complexity weight coefficient, which controls the penalty strength for model complexity; The number of trees in the model;

[0016] Using the improved Focal Loss function, it is expressed as:

[0017] ;

[0018] in, These are class weight parameters to address the class imbalance problem. Focusing parameters for difficult samples;

[0019] For the first The complexity penalty term for a tree is defined as:

[0020] ;

[0021] in, For the first The number of leaf nodes in a tree. The weight vector of the leaf node represents the contribution of that node to the final prediction; is the complexity penalty coefficient for trees. is the L2 regularization coefficient for the weights of the leaf nodes;

[0022] The feature vector of the real-time traffic data Input the trained XGBoost model and get ,right The result of the processing is:

[0023] ;

[0024] in, For the first Tree pairs of input The predicted value; The sigmoid activation function is defined as follows:

[0025] ;

[0026] Output probability through XGBoost model ,when If the specified flow rate is normal, then the flow rate is considered normal; otherwise, the flow rate is considered abnormal. This is the threshold for determining normal traffic flow.

[0027] In one embodiment of the present invention, step S3, for feature vectors identified as abnormal traffic, further determines their attack type by including:

[0028] Feature vectors that will be identified as abnormal traffic Convert to grayscale ;

[0029] The grayscale image The input is fed into a joint deep learning model for attack type identification. This joint deep learning model comprises a multi-scale residual convolutional network (MSRCN), a bidirectional gated recurrent unit (BiGRU), and an attention mechanism, all connected sequentially.

[0030] The loss function is constructed to train the joint deep learning model, as shown in the following formula:

[0031] ;

[0032] in, For cross-entropy loss weights, Alignment weights for multi-scale features;

[0033] The cross-entropy loss function is expressed as:

[0034] ;

[0035] in, For the sample size, Number of attack types For the sample In category The real labels on The predicted probability of the model;

[0036] The multi-scale feature loss is expressed as:

[0037] ;

[0038] in, This represents the number of branches in the MSRCN network. For the first Output characteristics of each branch; The target feature representation, i.e., the feature vector output by the MSRCN network. .

[0039] In one embodiment of the present invention, the multi-scale residual convolutional network (MSRCN) includes three branches: the first branch includes a 3×3 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence; the second branch includes a 5×5 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence; and the third branch includes a 1×1 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence.

[0040] The outputs of the three branches are concatenated along the channel dimension to form a fused feature map;

[0041] The fused feature map is input into the residual module, which includes a 3×3 convolutional layer, a batch normalization layer, a ReLU activation function, another 3×3 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence, and the output of the second 3×3 convolutional layer is connected to the input of the first 3×3 convolutional layer.

[0042] The feature map output from the residual module is input into a global average pooling layer, and the feature map is averaged across each channel dimension to generate a fixed-length feature vector. ,in The sequence length is given.

[0043] In one embodiment of the present invention, the bidirectional gated recurrent unit (BiGRU) is used to process the feature vector. Perform time-dependent modeling to capture the temporal relationships between features and obtain the hidden state sequence. ,in,

[0044] The calculation formula for the GRU unit in the bidirectional gated cyclic unit (BiGRU) includes:

[0045] Update Gate :

[0046] ;

[0047] Reset door :

[0048] ;

[0049] Candidate hidden state :

[0050] ;

[0051] Current hidden state :

[0052] ;

[0053] in, For time step The input feature vector, This is the hidden state of the previous time step. It is the Sigmoid activation function. It is the hyperbolic tangent function. This indicates element-wise multiplication. The weight matrix is ​​input to each gate. This is the weight matrix from the hidden state to each gate.

[0054] In one embodiment of the present invention, the attention mechanism is used to process the hidden state sequence output by the bidirectional gated recurrent unit (BiGRU). To determine the type of attack, including:

[0055] Calculate attention score:

[0056] ;

[0057] in, For attention weight vectors, This is the weight matrix. Let be the hidden state of BiGRU at time step t. It is the bias vector;

[0058] Calculate attention weights:

[0059] ;

[0060] in, For time step index, The sequence length;

[0061] Calculate the context vector:

[0062] ;

[0063] The context vector is input into the fully connected layer and passed through the Softmax function to obtain the probability distribution of each attack type:

[0064] ;

[0065] in, For the Softmax function, The weight matrix of the output layer. This is the bias vector for the output layer;

[0066] For attack type determination, calculate the highest probability among the predicted results. ,when If the abnormal traffic's feature vector is of a known attack type, then the abnormal traffic's feature vector is determined to be of an unknown attack type; otherwise, the abnormal traffic's feature vector is determined to be of an unknown attack type. The threshold for identifying attack types.

[0067] In one embodiment of the present invention, step S4 involves performing anomaly detection on feature vectors identified as unknown attack types and determining them as normal traffic or unknown attack traffic.

[0068] The Isolation Forest algorithm is used to further detect anomalies in feature vectors of unknown attack types. The Isolation Forest algorithm includes:

[0069] Path length : Feature vectors for unknown attack types The path length in each tree is the number of edges traversed from the root node to a leaf node;

[0070] Average path length :

[0071] ;

[0072] in, The number of trees in an isolated forest. For the first Among the trees Path length;

[0073] Normalization constant :

[0074] ;

[0075] in, The size of the subsamples for each tree affects the tree depth and segmentation results. For the first There are harmonic numbers, expressed as:

[0076] ;

[0077] in, It is the Euler-Macheroni constant;

[0078] Abnormal scores :

[0079] ;

[0080] Unknown attack determination: When When determining the feature vector of an unknown attack type. If the attack traffic is unknown, then the feature vector is determined to be of an unknown attack type. This is normal traffic, among which, This is the threshold for determining unknown attacks.

[0081] To address the aforementioned technical problems, this invention provides an intelligent substation network intrusion detection system, comprising:

[0082] Acquisition module: Used to acquire real-time traffic data of the smart substation network, and preprocess the real-time traffic data to obtain feature vectors;

[0083] First detection module: used to perform traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic;

[0084] The second detection module is used to further determine the attack type of feature vectors identified as abnormal traffic, classifying them as either known or unknown attack types.

[0085] The third detection module is used to perform anomaly detection on feature vectors that are determined to be of unknown attack types, and to determine whether they are normal traffic or unknown attack traffic, thus completing intrusion detection of real-time traffic data.

[0086] To address the aforementioned technical problems, the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the intelligent substation network intrusion detection method described above.

[0087] To address the aforementioned technical problems, the present invention provides a computer-readable storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, it implements the steps of the above-described intelligent substation network intrusion detection method.

[0088] The technical solution of the present invention has the following advantages over the prior art:

[0089] The intelligent substation network intrusion detection method constructed in this invention can effectively detect and classify network traffic through the collaborative work of three major models. Each module employs a deep learning or machine learning algorithm suitable for its task, and through carefully designed training and optimization methods, ensures that each module can complete its task efficiently and accurately. The abnormal traffic detection module identifies abnormal traffic in the network using the XGBoost model, the attack type identification module identifies known attack types using the MSRCN+BiGRU+Attention model, and the unknown traffic classification module identifies unknown or zero-day attacks using the Isolation Forest model. These modules maintain a high degree of coordination during data flow and information transmission, thereby achieving comprehensive protection for the substation network. Attached Figure Description

[0090] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0091] Figure 1 This is a flowchart of the method of the present invention;

[0092] Figure 2 This is a schematic diagram of performing traffic detection on the feature vector of real-time traffic data in an embodiment of the present invention to determine whether the feature vector is normal traffic or abnormal traffic.

[0093] Figure 3 This is a schematic diagram in an embodiment of the present invention for determining whether the attack type of a feature vector identified as abnormal traffic is a known attack type or an unknown attack type.

[0094] Figure 4 This is a schematic diagram of the feature extraction and feature concatenation structure in the multi-scale residual convolutional network MSRCN in this embodiment of the invention;

[0095] Figure 5 This is a schematic diagram of the residual module and feature output structure in the multi-scale residual convolutional network MSRCN in this embodiment of the invention;

[0096] Figure 6 This is a schematic diagram illustrating how feature vectors identified as unknown attack types are classified as normal traffic or unknown attack traffic in this embodiment of the invention. Detailed Implementation

[0097] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0098] Example 1

[0099] Reference Figure 1 As shown, this invention relates to a method for network intrusion detection in intelligent substations, comprising:

[0100] Step S1: Collect real-time traffic data of the smart substation network, and preprocess the real-time traffic data to obtain a feature vector;

[0101] Step S2: Perform traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic;

[0102] Step S3: For feature vectors identified as abnormal traffic, further determine their attack type and classify them as either known or unknown attack types;

[0103] Step S4: For feature vectors identified as unknown attack types, perform anomaly detection to determine whether they are normal traffic or unknown attack traffic, thus completing intrusion detection of real-time traffic data.

[0104] The following is a detailed description of this embodiment:

[0105] Real-time traffic data is collected from the substation network. This data includes, but is not limited to, the following characteristics: protocol type, source IP address, destination IP address, source port, destination port, packet length, timestamp, and flags. These characteristics are crucial for identifying abnormal network traffic behavior and attack patterns.

[0106] The collected raw network traffic data needs to be preprocessed. The preprocessing steps include data cleaning, missing value imputation, outlier handling, and feature encoding.

[0107] For data cleaning and missing value imputation, duplicate and incomplete data records are removed; missing values ​​are imputed using the mean; outliers are detected and handled using box plots to prevent extreme values ​​from affecting model training; for feature normalization, numerical features are normalized. Normalization is performed, mapping the data to the [0,1] interval to eliminate dimensional differences between different features. The normalization formula is:

[0108] (1)

[0109] in, These are the normalized eigenvalues. and Features The minimum and maximum values ​​in the dataset.

[0110] For categorical features, such as protocol type and source IP address, one-hot encoding is used to convert them into binary feature vectors. For example, protocol types may include TCP, UDP, ICMP, etc. After one-hot encoding, the protocol type is encoded as [1,0,0] for TCP, [0,1,0] for UDP, and [0,0,1] for ICMP.

[0111] After preprocessing, the resulting feature vector ,in This represents the total number of features. The preprocessed data is then input into the abnormal traffic detection module.

[0112] Further, please refer to Figure 2 In step S2, the method for performing traffic detection on the feature vector of real-time traffic data to determine whether the feature vector is normal or abnormal traffic includes:

[0113] This embodiment uses the XGBoost model to determine the feature vector. Is it normal traffic or abnormal traffic? The XGBoost model is a gradient boosting-based decision tree ensemble algorithm, which is efficient and accurate. The XGBoost model consists of multiple CART (Classification and Regression Tree) decision trees, which are classified through weighted voting.

[0114] The goal of the XGBoost model is to build a classifier that can effectively distinguish between normal and abnormal traffic. This embodiment specifically improves the loss function of the XGBoost model by introducing Focal Loss to solve the class imbalance problem. Defined as:

[0115] (2)

[0116] in, This is the set of parameters for the model, including the structure of all trees and the weights of the leaf nodes. To predict the loss weighting coefficients, it is important to control the classification accuracy; This represents the number of training samples; For the first The true label of each sample 0 indicates normal traffic, and 1 indicates abnormal traffic; For the model to the first The predicted output for each sample; This is the structural complexity weight coefficient, which controls the penalty strength for model complexity; This represents the number of trees in the model.

[0117] Using the improved Focal Loss function, it is expressed as:

[0118] (3)

[0119] in, These are class weight parameters to address the class imbalance problem. The parameter is used to focus on difficult samples. When it equals 0, it degenerates into the standard cross-entropy loss. When it is greater than 0, it gives more attention to samples that are difficult to classify.

[0120] For the first The complexity penalty term for a tree is defined as:

[0121] (4)

[0122] in, For the first The number of leaf nodes in a tree. This is the weight vector of the leaf node, representing the node's contribution to the final prediction. This is a complexity penalty coefficient for the tree, controlling the number of leaf nodes to prevent excessive splitting. This is the L2 regularization coefficient for the weights of the leaf nodes, preventing the weights from becoming too large and improving the model's generalization ability.

[0123] Feature vectors of real-time traffic data Input the trained XGBoost model and get ,right The result of the processing is:

[0124] (5)

[0125] in, For the first Tree pairs of input The predicted value; The sigmoid activation function is defined as follows:

[0126] (6)

[0127] The probability that the flow rate is normal is calculated. , This threshold, used for determining normal traffic, affects the effectiveness of distinguishing between normal and abnormal traffic. When... If the specified threshold is met, the characteristic traffic is determined to be normal traffic; otherwise, it is determined to be abnormal traffic. It is generally set to 0.5, but can be adjusted according to the model's performance.

[0128] Please see Figure 3 In step S3, the feature vectors that are identified as abnormal traffic need to be further identified to determine their specific attack type, and to classify them as either a known attack type or an unknown attack type.

[0129] First, the feature vector of abnormal traffic is... Convert to grayscale : The feature vector The data is rearranged into a two-dimensional matrix according to a certain mapping rule to form a grayscale image. Specifically, assume the number of features is... Choose a matrix size of ,in The insufficient part is filled with zero.

[0130] grayscale image Gray value calculation in:

[0131] (7)

[0132] in, The first in the grayscale image Line number Column pixel values, For the normalized first 1 eigenvalue, Multiplying by 255 maps the normalized feature values ​​to the gray range of [0, 255].

[0133] Furthermore, the generated grayscale image The input is fed into a deep learning joint model (MSRCN+BiGRU+Attention model) for attack type identification. The following is a detailed introduction to the MSRCN+BiGRU+Attention model.

[0134] (a) Multi-Scale Residual Convolutional Network (MSRCN)

[0135] Please see Figure 4 The Multi-Scale Residual Convolutional Network (MSRCN) constructed in this embodiment includes three branches. Different sized convolutional kernels are used in parallel at the multi-scale feature extraction layers to capture multi-scale features. The first branch includes a 3×3 convolutional layer (using 3×3 kernels and 32 filters), a batch normalization layer, and a ReLU activation function connected in sequence to obtain fine-grained local features. The second branch includes a 5×5 convolutional layer (using 5×5 kernels and 16 filters), a batch normalization layer, and a ReLU activation function connected in sequence to extract coarse-grained contextual features. The third branch includes a 1×1 convolutional layer (using 1×1 kernels and 8 filters), a batch normalization layer, and a ReLU activation function connected in sequence to achieve feature compression and dimensionality adjustment.

[0136] The outputs of the three branches are concatenated along the channel dimension to form a fused feature map;

[0137] Please see Figure 5 The fused feature map is input into the residual module, which includes a 3×3 convolutional layer (each 3×3 convolutional layer is configured with 56 filters), a batch normalization layer, a ReLU activation function, a 3×3 convolutional layer (each 3×3 convolutional layer is configured with 56 filters), a batch normalization layer, and a ReLU activation function connected in sequence, and the output of the second 3×3 convolutional layer is connected to the input of the first 3×3 convolutional layer;

[0138] The feature map output from the residual module is input into a global average pooling layer as the final processing stage of the network. The feature map is averaged across each channel dimension to generate a fixed-length feature vector. ,in The sequence length is given.

[0139] (ii) Bidirectional Gated Recurrent Unit (BiGRU): The BiGRU network processes the feature vector output by the multi-scale residual convolutional network MSRCN. Perform time-dependent modeling to capture the temporal relationships between features and obtain the hidden state sequence. .

[0140] The calculation formula for the GRU cell in the BiGRU (Bidirectional Gated Cyclic Unit) includes:

[0141] Update Gate :

[0142] (8)

[0143] Reset door :

[0144] (9)

[0145] Candidate hidden state :

[0146] (10)

[0147] Current hidden state :

[0148] (11)

[0149] in, For time step The input feature vector, This is the hidden state of the previous time step. It is the Sigmoid activation function. It is the hyperbolic tangent function. This indicates element-wise multiplication. The weight matrix is ​​input to each gate. This is the weight matrix from the hidden state to each gate.

[0150] (iii) Attention mechanism is the sequence of hidden states output by the BiGRU. Perform a weighted summation to highlight key features.

[0151] Attention score calculation:

[0152] (12)

[0153] in, For attention weight vectors, This is the weight matrix. Let be the hidden state of BiGRU at time step t. This is the bias vector.

[0154] Attention weight calculation:

[0155] (13)

[0156] in, For time step index, The sequence length is given.

[0157] Context vector calculation:

[0158] (14)

[0159] For the output layer, the context vector is input into the fully connected layer and passed through the Softmax function to obtain the probability distribution of each attack type:

[0160] (15)

[0161] in, For the Softmax function, The weight matrix of the output layer. This is the bias vector for the output layer.

[0162] For attack type determination, calculate the highest probability among the predicted results. , The threshold for attack type identification affects the accuracy of identifying known attack types. If the abnormal traffic's feature vector indicates a known attack type, then the abnormal traffic's feature vector is determined to be of an unknown attack type; otherwise, the abnormal traffic's feature vector is determined to be of an unknown attack type. Threshold It is generally set to 0.5, but can be adjusted according to actual needs.

[0163] Furthermore, for the training and optimization of the MSRCN+BiGRU+Attention model, this embodiment employs Multi-Scale Feature Alignment Loss (MSFA-Loss):

[0164] (16)

[0165] in, For cross-entropy loss weights, Alignment weights for multi-scale features.

[0166] It is the cross-entropy loss function, defined as follows:

[0167] (17)

[0168] in, For the sample size, Number of attack types For the sample In category The actual label (one-hot encoded) on it. This represents the predicted probability of the model.

[0169] The multi-scale feature loss is defined as follows:

[0170] (18)

[0171] in, This represents the number of multi-scale branches (3 in the MSRCN network). For the first The output features of each branch The target feature representation (i.e., the feature sequence output by the MSRCN network) ).

[0172] Please see Figure 6 Step S4 involves performing anomaly detection on feature vectors identified as unknown attack types, classifying them as normal traffic or unknown attack traffic. Since the anomaly traffic could not previously be identified as a known attack type, the Isolation Forest algorithm is used for further anomaly detection. The Isolation Forest model constructs multiple random trees to segment the data and calculates anomaly scores for the samples.

[0173] Isolation forests construct a large number of binary trees (i.e., isolation trees) by randomly selecting features and randomly cutting values. Since outlier data is often sparse in the feature space, isolation forests can isolate it with fewer cuts.

[0174] Anomaly score calculation:

[0175] Path length : Feature vectors for unknown attack types The path length in each tree is the number of edges traversed from the root node to a leaf node.

[0176] Average path length :

[0177] (19)

[0178] in, The number of trees in an isolated forest affects the stability and computational complexity of the model; For the first Among the trees The path length.

[0179] Normalization constant :

[0180] (20)

[0181] in, The size of the subsamples for each tree affects the tree depth and segmentation results. For the first Harmonic number:

[0182] (twenty one)

[0183] in, It is the Euler-Marcheroni constant.

[0184] Abnormal scores :

[0185] (twenty two)

[0186] Unknown attack determination:

[0187] when When determining the feature vector of an unknown attack type. If the attack traffic is unknown, then the feature vector is determined to be of an unknown attack type. This is normal traffic. This is the threshold for determining unknown attacks, which affects the detection effectiveness of unknown attacks. It is set to 0.6 and can be adjusted according to the model performance.

[0188] In summary, the entire intelligent substation network intrusion detection method effectively detects and classifies network traffic through the collaborative work of three major models. Each module employs a deep learning or machine learning algorithm suitable for its task, and through carefully designed training and optimization methods, ensures that each module can complete its task efficiently and accurately. The abnormal traffic detection module identifies abnormal traffic in the network using the XGBoost model, the attack type identification module identifies known attack types using the MSRCN+BiGRU+Attention model, and the unknown traffic classification module identifies unknown or zero-day attacks using the Isolation Forest model. These modules maintain a high degree of coordination during data flow and information transmission, thereby achieving comprehensive protection for the substation network.

[0189] The overall algorithm employs a hierarchical structure to process network traffic data step-by-step, avoiding false alarms and missed alarms caused by improper processing. Independent training and optimization of each module enables the system to respond quickly to different attack behaviors, thereby improving the security and stability of the substation network. Furthermore, this method has good scalability, adapting to the security requirements of different types of substation networks, and can continue to update and optimize the model as new attack types emerge, maintaining high detection accuracy and adaptability.

[0190] Example 2

[0191] This embodiment provides an intelligent substation network intrusion detection system, including:

[0192] Acquisition module: Used to acquire real-time traffic data of the smart substation network, and preprocess the real-time traffic data to obtain feature vectors;

[0193] First detection module: used to perform traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic;

[0194] The second detection module is used to further determine the attack type of feature vectors identified as abnormal traffic, classifying them as either known or unknown attack types.

[0195] The third detection module is used to perform anomaly detection on feature vectors that are determined to be of unknown attack types, and to determine whether they are normal traffic or unknown attack traffic, thus completing intrusion detection of real-time traffic data.

[0196] Example 3

[0197] This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the intelligent substation network intrusion detection method described in Embodiment 1.

[0198] Example 4

[0199] This embodiment provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the steps of the intelligent substation network intrusion detection method described in Embodiment 1.

[0200] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0201] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0202] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0203] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0204] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0205] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for intelligent substation network intrusion detection, characterized in that: The method comprises the steps of: Step S1: collecting real-time traffic data of a smart substation network, and preprocessing the real-time traffic data to obtain a feature vector; Step S2: performing traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic; Step S3: for the feature vector determined as abnormal traffic, further determining the attack type thereof, and determining whether the feature vector is a known attack type or an unknown attack type; Step S4: for the feature vector determined as an unknown attack type, performing anomaly detection thereon to determine whether the feature vector is normal traffic or unknown attack traffic, thereby completing the intrusion detection of the real-time traffic data.

2. The intelligent substation network intrusion detection method of claim 1, wherein: The method of step S2 comprises: a loss function for constructing the XGBoost model training the XGBoost model by the loss function ​ The loss function is defined as: ； wherein, is a parameter set of the model, including the structure of all trees and the weight of leaf nodes, is a prediction loss weight coefficient, controlling the importance of classification accuracy; is the number of training samples; is the true label of the th sample, 0 represents normal traffic, and 1 represents abnormal traffic; is the prediction output of the model on the th sample; is a structure complexity weight coefficient, controlling the penalty strength of the model complexity; is the number of trees in the model; The improved Focal Loss function is represented as: ； wherein, is a class weight parameter that addresses class imbalance issues; is a hard sample focusing parameter; For the first The complexity penalty term for a tree is defined as: ； in, For the first The number of leaf nodes in a tree. The weight vector of the leaf node represents the contribution of that node to the final prediction; is the complexity penalty coefficient for trees. is the L2 regularization coefficient for the weights of the leaf nodes; a feature vector of the real-time traffic data inputting the trained XGBoost model, obtaining , processing to obtain: ​ ； where, is the tree's prediction of the input ; is the sigmoid activation function defined as: ； Outputting probabilities by the XGBoost model When , the feature flow is determined as normal flow, otherwise, the feature flow is determined as abnormal flow, wherein, is a determination threshold for normal flow detection.

3. The intelligent substation network intrusion detection method of claim 1, wherein: The method of step S3 comprises: Feature vector to be judged as abnormal traffic Convert to grayscale ; The grayscale image The input is fed into a joint deep learning model for attack type identification. This joint deep learning model comprises a multi-scale residual convolutional network (MSRCN), a bidirectional gated recurrent unit (BiGRU), and an attention mechanism, all connected sequentially. A loss function is constructed to train the deep learning joint model, and the formula is: ； wherein, is a cross-entropy loss weight, is a multi-scale feature alignment weight; The cross-entropy loss function is denoted as: ； in, For the sample size, Number of attack types For the sample In category The real labels on it The predicted probability of the model; For multi-scale feature loss, denoted as: ； wherein, is the number of branches in the MSRCN network, is the output feature of the th branch; is the target feature representation, i.e., the feature vector output by the MSRCN network .

4. The smart substation network intrusion detection method of claim 3, wherein: The multi-scale residual convolutional network MSRCN comprises three branches, the first branch comprises a 3x3 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence; the second branch comprises a 5x5 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence; and the third branch comprises a 1x1 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence; The outputs of the three branches are spliced in the channel dimension to form a fusion feature map; The fusion feature map is input into a residual module, and the residual module comprises a 3x3 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence, a 3x3 convolutional layer, a batch normalization layer, and a ReLU activation function connected in sequence, and the output of the second 3x3 convolutional layer is connected to the input of the first 3x3 convolutional layer; The feature map of the output of the residual module is input into a global average pooling layer, and the feature map is averaged in each channel dimension to generate a fixed-length feature vector wherein is the sequence length.

5. The smart substation network intrusion detection method of claim 3, wherein: The bidirectional gated recurrent unit BiGRU is used for time-dependent modeling on the feature vector to capture the timing relationship between features, and obtain a hidden state sequence wherein, The GRU unit calculation formula in the bidirectional gate recurrent unit BiGRU comprises: Updating gate : ； Reset gate : ； candidate hidden states : ； current hidden state : ； in, For time step The input feature vector, This is the hidden state of the previous time step. It is the Sigmoid activation function. It is the hyperbolic tangent function. This indicates element-wise multiplication. The weight matrix is ​​input to each gate. This is the weight matrix from the hidden state to each gate.

6. The smart substation network intrusion detection method of claim 3, wherein: The attention mechanism Attention is used for the hidden state sequence output by the bidirectional gated recurrent unit BiGRU The attack type discrimination includes: The attention score is calculated as follows: ； wherein, is an attention weight vector, is a weight matrix, is a hidden state of the BiGRU at time step t, is a bias vector; The attention weight is calculated as follows: ； wherein, is a time step index, is a sequence length; The context vector is calculated as follows: ； The context vector is input into a fully connected layer and passes through a Softmax function to obtain a probability distribution of each attack type: ； wherein, is a Softmax function, is a weight matrix of the output layer, is a bias vector of the output layer; For attack type determination, the maximum probability in the prediction result is calculated When , the feature vector of the abnormal traffic is determined as the known attack type; otherwise, the feature vector of the abnormal traffic is determined as the unknown attack type, wherein, is the determination threshold for attack type identification.

7. The intelligent substation network intrusion detection method of claim 1, wherein: The method of step S4 comprises: The isolated forest algorithm is used for further anomaly detection on the feature vector of the unknown attack type, wherein the isolated forest algorithm comprises: path length : feature vector for unknown attack type The path length in each tree is the number of edges from the root node to a leaf node. Average path length : ； wherein, is the number of trees in the isolated forest, is the path length of the tree in the isolated forest, tree in the isolated forest. Normalization constant : ； wherein, is the subsample size for each tree, influencing the depth and partitioning of the tree, is the th harmonic number and is expressed as: is the th harmonic number and is expressed as: ； wherein is the Euler-Mascheroni constant; Abnormal score : ； Unknown attack determination: When When determining the feature vector of an unknown attack type. If the attack traffic is unknown, then the feature vector is determined to be of an unknown attack type. This is normal traffic, among which, This is the threshold for determining unknown attacks.

8. A smart substation network intrusion detection system characterized by: The method comprises the steps of: A collection module is configured to collect real-time traffic data of a smart substation network, and to preprocess the real-time traffic data to obtain a feature vector; A first detection module is configured to perform traffic detection on the feature vector of the real-time traffic data to determine whether the feature vector is normal traffic or abnormal traffic; The second detection module is used for judging the attack type of the feature vector determined as the abnormal flow, and determining the feature vector as a known attack type or an unknown attack type. The third detection module is used for performing abnormal detection on the feature vector determined as the unknown attack type, and determining the feature vector as normal flow or unknown attack flow, thereby completing the intrusion detection of the real-time flow data.

9. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that: The processor executes the computer program to implement the steps of the intelligent substation network intrusion detection method in any one of claims 1 to 7.

10. A computer readable storage medium having stored thereon a computer program, characterized in that: The computer program is executed by the processor to implement the steps of the intelligent substation network intrusion detection method in any one of claims 1 to 7.

Images