Power terminal access attack behavior detection method and system based on multi-modal data fusion

Abstract

The invention discloses a multi-modal data fusion-based power terminal access attack behavior detection method and system, and the method comprises the steps: collecting data through a specific collection tool, and carrying out the collection of four key indexes, namely, a traffic mode, a system log, signal strength and network topology; and an access security assessment detection model is constructed based on a Transform model of multi-modal feature fusion, and abnormal behaviors of the access terminal of the power Internet of Things platform are accurately identified. A system constructed according to the method comprises a collection unit, a processing unit, a behavior detection unit, a trust evaluation unit and a blocking unit, a deep learning algorithm is utilized to analyze multi-modal features, terminal behaviors are evaluated in combination with a trust evaluation mechanism, and trust levels are divided. According to the invention, an intelligent blocking rule strategy is provided for different abnormal behaviors, and the access safety and reliability of the electric power Internet of Things terminal are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for detecting power terminal access attack behavior based on multimodal data fusion. Background Technology

[0002] The Power Internet of Things (IoT) is an intelligent network integrating IoT technology, aiming to achieve efficient monitoring and intelligent management of power systems. Through the comprehensive application of sensors, computers, and network technologies, the Power IoT can monitor multi-dimensional data of the power system in real time, achieving more comprehensive status awareness and precise control. By collecting and analyzing various data within the power system, the system can formulate more optimized operating plans, realizing intelligent management of power resources. Simultaneously, the Power IoT can significantly improve the safety and reliability of the power system, effectively reducing the risks caused by safety hazards and equipment failures.

[0003] Power IoT terminal equipment access refers to the connection of smart terminals in the power system to the power grid via IoT technology to achieve monitoring and management of power facilities, user terminals, and energy management equipment. These terminal devices include smart meters, load controllers, sensors, and other remote monitoring equipment. These terminal devices are also simply referred to as terminals or simply devices. With the rapid development of the power IoT, the types and numbers of access terminals have increased significantly, and the resulting network security issues have become increasingly prominent. Because power IoT terminals are typically widely distributed and resources are limited, secure terminal access and behavior management have become crucial aspects of power network security.

[0004] In the field of power Internet of Things (IoT) terminal access security, most commonly used security technologies are based on single-data source analysis methods. For example, some systems rely on network traffic monitoring to identify abnormal traffic or analyze system logs to monitor abnormal operational behavior. These technologies can be effective in specific scenarios, providing real-time monitoring for a single security dimension. However, when faced with increasingly complex and varied attack behaviors, single-dimensional data analysis methods have significant limitations. When multi-source data such as traffic patterns, system logs, signal strength, and network topology are not fully integrated, key security features often cannot be comprehensively identified, leading to the overlooking of potential attack indications and affecting the overall effectiveness of security protection. Furthermore, traditional static trust assessment mechanisms are difficult to adapt to dynamic changes in terminal behavior, while existing dynamic trust assessment methods are insufficient in terms of sensitivity and response speed, failing to effectively capture subtle fluctuations in data changes. This often results in false alarms or missed alarms in practical applications, further reducing the accuracy and response speed of security detection. Therefore, existing technologies are insufficient to provide adequate protection against complex attacks and dynamic terminal behavior, and a more accurate, efficient, and dynamically adaptable security protection solution is urgently needed. Summary of the Invention

[0005] Purpose of the invention: To address the problems in the background technology mentioned above, this invention proposes a method and system for detecting power terminal access attack behavior based on multimodal data fusion, which can more accurately identify and respond to abnormal terminal access behavior, thereby improving the security and reliability of power Internet of Things terminal access.

[0006] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0007] A method for detecting power terminal access attack behavior based on multimodal data fusion includes the following steps:

[0008] Multimodal data on traffic patterns, system logs, signal strength, and network topology are collected synchronously using dedicated collection tools. Among them, traffic patterns, interactive behaviors in system logs, and signal strength-related data constitute dynamic data, while terminal information, hardware configuration, installed software version, and terminal-network connection methods in system logs constitute static data.

[0009] The collected multimodal data features are initially processed and filtered. Different types of data are preprocessed according to corresponding processing standards. Specifically, dynamic data is time-aligned, and the raw data from each dynamic data source is converted into time series samples using a sliding window method. For static data, useful discrete or numerical features are extracted from terminal information in system logs. For network topology data, structural and path information of the network topology is extracted. The preprocessed multimodal data is mapped to a shared feature space and then reduced to form multimodal features.

[0010] A Transformer model for multimodal data fusion is established, using multimodal features as training inputs. By fine-tuning the model parameters, a trust model of the terminal's historical behavior is constructed. This trust model is then used to predict the terminal's future behavior, and the terminal attack behavior detection results are output.

[0011] By combining a static trust assignment mechanism and a time-weighted mechanism, a trust assessment of the terminal is performed based on the terminal attack behavior detection results and data characteristic indicators.

[0012] Based on the trust assessment results, differentiated intelligent blocking strategies are implemented for terminals to achieve precise protection against attacks on power terminal access.

[0013] Furthermore, the specific process for collecting multi-modal data such as traffic patterns, system logs, signal strength, and network topology is as follows:

[0014] Capture and analyze the communication traffic between devices using network packet capture tools or traffic monitoring software to obtain information such as source IP address, source port number, destination IP address, destination port number, protocol type, network request type, packet size, and transmission rate.

[0015] By integrating terminal and system log files through system log collection tools, dynamic attributes including operation behavior, login and logout records, permission upgrade attempts, and status changes, as well as static attributes including terminal identity information, hardware configuration, installed software version, and terminal connection method to the network are extracted.

[0016] Monitor the received signal strength, signal-to-noise ratio, and signal quality using wireless signal scanning tools;

[0017] By scanning the power IoT terminal network with network discovery tools, the terminals, nodes and their connection relationships in the network are identified, the network topology is updated in real time, and the physical and logical connection relationships between terminals are extracted.

[0018] The test script simulates normal and abnormal access scenarios, and the data collection is triggered by the interactive data triggering mechanism.

[0019] Furthermore, the specific strategy for time alignment of dynamic feature-related data is as follows:

[0020] If the timestamp has a directly matching value in the three data sources of traffic pattern, system log, and signal strength, the corresponding samples are directly merged.

[0021] If any data source has no data at a specific point in time, the most recent timestamp will be selected for matching;

[0022] If the number of missing data exceeds the preset condition, the missing timestamps will be filled by linear interpolation.

[0023] The aligned data samples contain traffic patterns, signal strength, and system log data with consistent timestamps.

[0024] Furthermore, structural and path information of the network topology is extracted from the network topology data. The extracted path information includes path length, shortest path length, bandwidth, latency, and packet loss rate; the extracted structural information includes the number of nodes, connectivity, network density, and degree centrality.

[0025] Furthermore, the preprocessed multimodal data is mapped to a shared feature space, including:

[0026] The dynamic feature-related data is processed by LSTM and then mapped to a low-dimensional space through an embedding layer;

[0027] Static and topological feature data are processed by fully connected layers and then mapped to a low-dimensional space.

[0028] Furthermore, the data reduction uses principal component analysis to select the features that have the greatest influence on the target variable and remove redundant or irrelevant features.

[0029] Furthermore, the training and detection process of the Transformer model for multimodal feature fusion is as follows:

[0030] The Transformer model includes a token generation unit, a Transformer unit, and a prediction head. During the training phase, the token generation unit encodes the dynamic feature sequence, static feature sequence, and topological feature sequence in the training data into tokens through three channels. After the multi-head self-attention mechanism layer calculates the association weights of the three types of tokens, a three-channel attention weight token vector is generated. Then, the Transformer unit performs class label appending, position embedding, and Transformer layer processing on the token vector to output the class label. Finally, the prediction head's linear layer and Softmax layer process the prediction results to obtain the prediction results. The model parameters are adjusted based on the difference between the prediction results and the true labels to complete the training.

[0031] The detection phase uses the trained model to process the data to be detected according to the same feature encoding and processing procedures described above, outputting a probability value in the range of 0 to 1. The relationship between this probability value and a preset threshold is calculated to determine whether an attack behavior exists, thus completing the attack behavior detection.

[0032] Furthermore, a trust assessment of the terminal is performed by combining a static trust assignment mechanism and a time-weighted mechanism, including:

[0033] By analyzing the historical behavior data, configuration information, and static authentication status information of the access terminals, an initial trust value is assigned to each terminal as a basic score.

[0034] A time-weighted strategy is used to assign weights to the detection results of terminal attack behavior, and the time-weighted strategy gives higher weights to recent behaviors to obtain time-weighted similarity.

[0035] A comprehensive trust score is calculated based on a base score and time-weighted similarity, and the trust level of the terminal is determined based on the comprehensive trust score.

[0036] Furthermore, when performing trust assessment on a terminal by combining a static trust assignment mechanism and a time-weighted mechanism, the following operations are also performed:

[0037] The terminal trust assessment results are recalibrated periodically.

[0038] When the terminal exhibits abnormal behavior, the trust assessment mechanism is automatically triggered for dynamic adjustment.

[0039] Implement gradual restriction measures on terminals exhibiting abnormal behavior, and set a remedial period for terminals in the trust transition zone.

[0040] A power terminal access attack detection system based on multimodal data fusion includes:

[0041] The collection unit is used to synchronously collect multimodal data such as traffic patterns, system logs, signal strength, and network topology using dedicated collection tools. Among them, traffic patterns, interactive behaviors in the system logs, and signal strength-related data constitute dynamic data, while terminal information, hardware configuration, installed software version, and terminal-network connection methods in the system logs constitute static data.

[0042] The processing unit is used to perform preliminary processing and filtering of the collected multimodal data features. It preprocesses different types of data according to corresponding processing standards. Specifically, after time alignment of dynamic data, the raw data of each dynamic data source is converted into time series samples using a sliding window method. For static data, useful discrete or numerical features are extracted from terminal information in system logs. For network topology data, structural and path information of the network topology is extracted. The preprocessed multimodal data is mapped to a shared feature space and formed into multimodal features after data reduction.

[0043] The behavior detection unit is used to build a Transformer model for multimodal data fusion. It uses multimodal features as the training input of the model, fine-tunes the model parameters, builds a trust model of the terminal's historical behavior, uses the trust model to predict the terminal's future behavior, and outputs the terminal attack behavior detection results.

[0044] The trust assessment unit is used to combine the static trust assignment mechanism and the time weighting mechanism to assess the trust of the terminal based on the terminal attack behavior detection results and data characteristic indicators.

[0045] The blocking unit is used to implement differentiated intelligent blocking strategies for terminals based on trust assessment results, thereby achieving precise protection against attacks on power terminal access.

[0046] The present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the power terminal access attack behavior detection method based on multimodal data fusion as described above.

[0047] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the power terminal access attack behavior detection method based on multimodal data fusion as described above.

[0048] The present invention also provides a computer program product, including a computer program, characterized in that, when the computer program is executed by a processor, it implements the power terminal access attack behavior detection method based on multimodal data fusion as described above.

[0049] Beneficial Effects: This invention constructs a unique multi-source data acquisition system by comprehensively collecting multimodal data such as traffic patterns, system logs, signal strength, and network topology, enabling it to fully capture signs of potential attack behaviors from power IoT terminals. Through the Transformer model, which can perform multi-channel feature sequence processing, it deeply mines and fully utilizes multimodal data in power IoT scenarios, overcoming the bottleneck of power data heterogeneity and significantly enhancing the detection capability for complex attacks. Unified network topology data processing effectively simplifies the data processing process while maintaining the integrity of network structure information. The static assignment mechanism and time weighting mechanism enable the system to dynamically respond to changes in terminal behavior when assessing terminal trust, thereby improving the accuracy of trust value calculation. Differentiated blocking strategies based on terminal trust levels ensure that appropriate security measures are taken for devices with different trust levels, achieving efficient attack protection and precise isolation of malicious terminals. In summary, this invention has unique engineering application value in improving system security protection capabilities, enhancing network stability, and optimizing resource management, laying the foundation for building a more intelligent, efficient, and secure power IoT ecosystem. Attached Figure Description

[0050] Figure 1 The overall architecture of a power terminal access attack detection system based on multimodal data fusion;

[0051] Figure 2 This is a schematic diagram illustrating the specific process of multimodal data acquisition and processing.

[0052] Figure 3 This is a schematic diagram of the Transformer model for multimodal feature fusion. Detailed Implementation

[0053] The technical solutions in the embodiments of the present invention will now be clearly and completely described in conjunction with the accompanying drawings.

[0054] In existing technologies, methods for detecting attacks on power IoT terminal access devices (hereinafter referred to as access terminals or devices, which can also be directly referred to as terminals or devices in this paper) mainly rely on single-dimensional data analysis and traditional security protection measures. While these methods have certain application effects in their respective scenarios, they often struggle to effectively identify and respond to multi-dimensional data and complex attack behaviors, particularly exhibiting significant shortcomings in data privacy protection, time synchronization attack detection, and illegal wireless communication link detection. Furthermore, traditional methods are easily affected by network traffic pressure and computing resource limitations when processing massive amounts of terminal data, resulting in slow response speeds and high false alarm rates. This invention constructs a comprehensive terminal trust assessment system, improving the accuracy and response speed of abnormal behavior detection, enhancing the system's dynamic response capability to changes in terminal behavior, and effectively improving the security and reliability of power IoT terminal access.

[0055] This invention provides a method for detecting power terminal access attacks based on multimodal data fusion. The system constructed according to this method includes a collection unit, a processing unit, a behavior detection unit, a trust assessment unit, and a blocking unit, which correspond to steps S1-S5 respectively:

[0056] S1: The collection unit acquires key indicator data such as traffic patterns, system logs, signal strength, and network topology through dedicated collection tools, and then transmits the collected data to the processing unit.

[0057] S2: The processing unit performs preliminary processing and screening of the collected multimodal data features, preprocesses different types of data according to corresponding processing standards, and fuses the processed multimodal data to form multimodal data features that are then transmitted to the behavior detection unit.

[0058] S3: The behavior detection unit uses the Transformer model for multimodal feature fusion to train and detect the input dynamic features, static features and topological features, and outputs the detection results for the trust evaluation unit to use.

[0059] S4: Based on the detection results and characteristic indicators, the trust assessment unit, combined with the static trust assignment mechanism and the time weighting mechanism, divides the terminal into four trust levels: trustworthy, generally trustworthy, generally untrustworthy, and untrustworthy.

[0060] S5: Based on the trust assessment results, the blocking unit executes corresponding intelligent blocking strategies for trusted terminals, generally trusted terminals, generally untrusted terminals, and untrusted terminals.

[0061] According to an embodiment of the present invention, the collection unit constructs a collection network in step S1. The terminals of the collection network include power acquisition devices and environmental status acquisition devices. The collection network specifically acquires key indicator data in the following ways:

[0062] S11: Capture and analyze communication traffic between devices using network packet capture tools or dedicated traffic monitoring software to obtain information such as source IP address, source port number, destination IP address, destination port number, protocol type, network request type, packet size, and transmission rate.

[0063] S12: Integrate device and system log files, including operating system logs, application logs, and security logs, through system log collection tools to extract dynamic key attributes such as operation behavior, login and logout records, permission upgrade attempts and status changes, as well as static key attributes such as device identity information, hardware configuration, installed software version, and device connection method to the network.

[0064] S13: Monitor key attributes such as Received Signal Strength (RSSI), Signal-to-Noise Ratio (SNR), and signal quality using wireless signal scanning tools.

[0065] S14: Scan the power IoT terminal network through network discovery tools and automatically identify devices, nodes and their connections in the network. Update the network topology in real time, extract the physical and logical connections between power IoT devices, and provide richer contextual information for detecting attack behavior. Focus on extracting structural and path information in the network topology.

[0066] S15: By designing test scripts to simulate various normal and abnormal access scenarios, such as simulating DDoS attacks, authentication failures, signal interference, etc., and designing interactive data triggering mechanisms based on actual scenarios, such as device access, data requests and responses, etc., to trigger data collection, we can ensure that possible attack signs are captured at critical moments.

[0067] According to an embodiment of the present invention, the processing unit processes the acquired multimodal data in step S2, and the specific process includes:

[0068] S21: Data cleaning steps: remove or fill missing values, remove possible noisy data, ensure that all input data conforms to uniform format requirements, and identify and process outlier data points.

[0069] S22: The dynamic data processing step treats traffic patterns, interactive behaviors in system logs, and signal strength as dynamic data. It performs time alignment on dynamic data from different sources to ensure that all dynamic data can be compared and analyzed at the same timestamp. After aligning the timestamps, the raw data from each dynamic data source is converted into time-series samples using a sliding window method.

[0070] Furthermore, the dynamic data processing procedure is as follows:

[0071] S2201: Defines the flow pattern, signal strength, and dynamic data sample format for system logs. The flow pattern sample is defined as follows:

[0072] , It is a timestamp, and the other attributes correspond to the source IP address, source port number, destination IP address, destination port number, protocol type, network request type, packet size, and transmission rate information at that time point;

[0073] The signal strength sample is defined as follows:

[0074] , It is a timestamp, and the other attributes are the received signal strength, signal-to-noise ratio, and signal quality information at that time point;

[0075] The system log sample is defined as follows:

[0076] , It is a timestamp, and the other attributes correspond to the operation behavior, login and logout records, permission upgrade attempts and status change information at that time point.

[0077] S2202: Align the three-party data samples according to the alignment strategy based on timestamps. The timestamps for traffic pattern, signal strength, and system log are respectively... , and .

[0078] Furthermore, the alignment strategy is as follows:

[0079] Direct matching strategy, if timestamp If there are directly matching values ​​in the three data sources, then these samples are merged directly;

[0080] The nearest neighbor matching strategy selects the nearest timestamp for matching if a data source has no data at a certain point in time.

[0081] The interpolation strategy involves linearly interpolating missing timestamps to fill in missing values ​​if the data loss is severe, such as exceeding preset conditions.

[0082] The aligned data samples contain traffic patterns, signal strength, and system log data with consistent timestamps. The merged sample format is as follows:

[0083] ,in, All sample data do not include timestamps, and the sample dimension is [missing information]. , These are the dimensions of the corresponding indicator datasets.

[0084] S2203: Use a sliding window to generate time series samples, with a sliding window size of [size missing]. Step size set to The time window is represented as follows:

[0085] ,in It is in time Aligned composite feature data samples at different times.

[0086] S23: The static data processing step extracts useful discrete or numerical features from the device information in the system log.

[0087] Furthermore, the static data processing procedure is as follows:

[0088] S2301: Uses one-hot encoding and tag encoding techniques to convert discrete device information into a vector form. This vector contains device identification information such as device ID, device type, and manufacturer. One-hot encoding is used to convert category information into a vector. Device types, such as routers and switches, are encoded according to the number of device types. and Manufacturers A, Manufacturer B, etc., are coded according to the number of manufacturers. and ;

[0089] Software version information, including the operating system and the version number of the installed software, is processed using one-hot encoding. At the same time, if the version number is ordered, tag encoding can be used to map the version number to a number, such as version number 1.0 mapping to the number 1, version number 1.1 mapping to 2, and version number 2.0 mapping to 3.

[0090] It contains device and network connection information such as IP address, MAC address, and network interface type. The network interface type is encoded using one-hot encoding, and the IP address and MAC address are processed into strings, using hash encoding or converting them into numerical values.

[0091] S2302: Standardize equipment performance indicators and other information into numerical form, such as memory, hard drive, and CPU in hardware configuration. Use Min-Max normalization to scale the data to the range of 0 to 1, as shown in the following formula:

[0092] .

[0093] For example, after one-hot encoding and numerical normalization, for devices configured as shown in Table 1:

[0094] Table 1 Equipment Configuration Information

[0095] Equipment type Manufacturers Memory size Network interface router Manufacturer A 16 GB WIFI

[0096] The results of static data processing are as follows:

[0097] Equipment type: (Router), Manufacturer: (Manufacturer A), Memory size: (Standardized 16GB), Network Interface: (WIFI), after feature concatenation, the final feature vector is: , recorded as .

[0098] S24: Considering that network topology data will change dynamically with changes in network traffic, equipment failure, link disconnection or recovery, etc., although such changes are not frequent, it is necessary to separate the network topology data processing steps from the data processing process and abstract the structural information and path information of the network topology. The structural information refers to the connection relationship between various devices in the network, and the path information refers to the path that the devices may take when communicating and the information related to the communication path.

[0099] Furthermore, the network topology data processing procedure is as follows:

[0100] S2401: Extract path information including path length, shortest path length, bandwidth, latency, packet loss rate, etc. Specifically, calculate the shortest path and path length between devices using the Dijkstra algorithm, and record the bandwidth, latency, and other information for each path.

[0101] S2402: Extract structural information including the number of nodes, connectivity, network density, degree centrality, etc. Specifically, obtain the degree of each device, calculate the network connectivity and network density, and possible centrality features. The formula for calculating network density is as follows:

[0102] Network density = 2 × number of edges / number of nodes × (number of nodes - 1); the formula for degree centrality is as follows:

[0103] ,in, It is a node The degree, It represents the number of nodes in the network topology, while degree centrality is a floating value between 0 and 1.

[0104] As an example, for a simple network topology containing 4 devices (A, B, C, D), their connections are as follows:

[0105] A to B (bandwidth: 1Gbps, latency: 5ms), B to C (bandwidth: 2Gbps, latency: 3ms), A to C (bandwidth: 1Gbps, latency: 7ms), C to D (bandwidth: 1Gbps, latency: 4ms).

[0106] The extracted path information is as follows:

[0107] A to B: Path length is 1 hop, shortest path is 1 hop, bandwidth is 1Gbps, latency is 5ms; A to C: Path length is 1 hop, shortest path is 1 hop, bandwidth is 1Gbps, latency is 7ms; B to C: Path length is 1 hop, shortest path is 1 hop, bandwidth is 2Gbps, latency is 3ms; C to D: Path length is 1 hop, shortest path is 1 hop, bandwidth is 1Gbps, latency is 4ms; A to D: Path length is 2 hops, shortest path is 2 hops, bandwidth is 1Gbps, latency is 9ms.

[0108] The extracted structural information is as follows:

[0109] Number of nodes: 4; Number of connections per device: A(2), B(2), C(3), D(1); Network density: 0.67; Degree centrality of nodes: A(0.67), B(0.67), C(1.0), D(0.33).

[0110] After numericalization, encoding, and simplification of path and structural information, the final feature vector is as follows:

[0111] [Path characteristics: A→B_1 jump, A→C_1 jump, B→C_1 jump, C→D_1 jump, A→D_2 jump, A→B_1, A→C_1, B→C_2, C→D_1, A→D_1, A→B_5, A→C_7, B→C_3, C→D_4, A→D_9]

[0112] [Structural characteristics: Number of nodes_4, A degree_2, B degree_2, C degree_3, D degree_1, Network density_0.67, A degree centrality_0.67, B degree centrality_0.67, C degree centrality_1.0, D degree centrality_0.33], denoted as .

[0113] S25: The data mapping step maps multi-source heterogeneous data, performing feature space mapping for data of different modalities, mapping dynamic data, static data, and network topology data to their corresponding feature spaces. For features of different modalities, different neural network embedding layers can be used to transform them into corresponding low-dimensional feature spaces.

[0114] Furthermore, the data mapping process is as follows:

[0115] S2501: Dynamic data is processed using LSTM, then mapped to a low-dimensional space using an embedding layer, resulting in dynamic data samples after the sliding window transformation in step S2203. ,Include There are 1 time steps, and each time step has 1 time step. 3D features, the output of LSTM is the hidden state at each time step. Specifically, it is expressed as follows:

[0116] Take the last hidden state of the LSTM As a representation of the time series, it is mapped to a low-dimensional space through an embedding layer to obtain an embedded representation of the dynamic data. Specifically, it is expressed as follows:

[0117] ,in, It is the dimension after dynamic data is mapped to a low-dimensional space.

[0118] S2502: Static data and network topology data are processed by the fully connected layer and mapped to a low-dimensional space; the low-dimensional embedding representation of static data. As shown below:

[0119] ,in, It is the dimension of the static data mapped to the low-dimensional space, and the low-dimensional embedding representation of network topology data. As shown below:

[0120] ,in, It is the dimension of the static data mapped to the low-dimensional space.

[0121] S26: The data reduction step uses Principal Component Analysis (PCA) to reduce the dimensionality or size of the data, selects the features most influential on the target variable, and removes redundant or irrelevant features. Specifically, it is represented as follows:

[0122] ,in, It is standardized data. It was before The eigenvector matrix corresponding to each principal component It is the sample size. It is the number of principal components selected.

[0123] S27: The data storage step enables the processed data to be stored and accessed efficiently. After converting the uniform feature data into binary formats such as HDF5, Parequest, and TFRecord, it is stored in file systems such as NTFS, ext4, and FAT32.

[0124] The detailed process of data acquisition and processing in steps S1 and S2 of this invention is attached. Figure 2 As shown.

[0125] According to an embodiment of the present invention, in step S3, the behavior detection unit establishes a Transformer model for multimodal data fusion. The multimodal features output by the processing unit are used as input to the model. By fine-tuning the network parameters, a trust model of the terminal's historical behavior is constructed. This model is used to predict the terminal's future behavior. A similarity score is generated by calculating the similarity between the predicted behavior and the actual behavior, and the similarity score is passed to the trust evaluation unit. (Appendix) Figure 3 The Transformer model structure for multimodal data fusion is shown. The components and their corresponding functions of the Transformer model for multimodal data fusion are detailed below:

[0126] S31: The first component of the model is the token generation unit. The processed dynamic feature sequence, static feature sequence and topological feature sequence are used as inputs to the token generation unit. The token generation unit contains three channels, which encode the three types of data sequences into meaningful tokens, and then pass them to the Transformer unit of the model.

[0127] Furthermore, the encoding process of the token generation unit is as follows:

[0128] S3101: For dynamic feature sequences, instance normalization is performed, and the dynamic time series is segmented into blocks using convolutional and mean pooling layers. Similarly, blocks are generated by calculating the difference between two adjacent timestamps for the dynamic sequence. To preserve information about the original unit measurements, the original dynamic sequence is segmented into blocks before instance normalization, and the mean and standard deviation of each block are calculated and encoded using a multi-scale scalar encoder. Finally, all features are concatenated and passed through a linear layer to generate a token vector for the dynamic sequence.

[0129] S3102: For static feature sequences, after layer normalization and mean pooling, static sequence features are extracted through convolutional layers and input into discrete feature embedding layers for dense vector mapping. Then, a layer normalization layer is used to adjust the feature distribution after embedding. Simultaneously, before the convolutional layer processing, the original static feature sequence is divided into blocks, and the mean and standard deviation of each block are calculated. These blocks are then encoded using a multi-scale scalar encoder, and the feature distribution is adjusted again through a layer normalization layer. Finally, all features are concatenated to generate a token vector for the static sequence.

[0130] S3103: For the topological feature sequence, after processing through a layer normalization layer, a linear layer, and a mean pooling layer, the topological sequence features are extracted through a convolutional layer and input to an adjacency matrix encoding layer to encode the actual physical connections between devices into a structured matrix. Then, a layer normalization layer is used to adjust the feature distribution. Simultaneously, before the convolutional layer processing, the original topological feature sequence is divided into blocks, and the mean and standard deviation of each block are calculated. A multi-scale scalar encoder is used to encode these blocks, and a layer normalization layer is used to adjust the feature distribution. Finally, all features are concatenated to generate a token vector for the topological sequence.

[0131] The reasons for adopting differentiated processing procedures for the above three different types of feature sequences are as follows:

[0132] (1) For dynamic feature sequences (flow and signal), they have significant temporal fluctuations and continuity. Instance normalization and convolutional layer processing can effectively capture local change trends within the time window, eliminate amplitude differences of signals with different dimensions, and retain key dynamic fluctuation information.

[0133] (2) For static feature sequences (device attributes), since they contain a large amount of discrete category information (such as manufacturer and version), the use of discrete feature embedding layer can map sparse category data into dense real value vectors. Combined with layer normalization, it ensures the consistency of numerical distribution of different device configuration features, which makes it easier for the model to understand device fingerprints.

[0134] (3) For topological feature sequences (network structure), the core lies in the connection relationship between devices. The adjacency matrix encoding layer can directly transform the graph structure information in non-Euclidean space into a structured matrix. Combined with the convolutional layer, high-order topological connection patterns (such as degree centrality patterns) are extracted, thereby ensuring that the model can perceive the perturbation caused by network attacks on the overall connection structure.

[0135] S3104: Dynamic sequence tokens, static sequence tokens, and topological sequence tokens are dynamically calculated using a multi-head self-attention mechanism layer to determine the association weights of the three types of tokens. A layer normalization layer is then used to eliminate the distribution differences among the three modalities of the tokens. Finally, a three-channel attention weight token vector is generated.

[0136] S32: The second component of the model is the Transformer unit. The token generated in step S31 is used as the input of the Transformer unit. Through class tag appending, position embedding and a series of Transformer layers, class tags are generated as the output of the Transformer unit.

[0137] Furthermore, the specific processing procedure of the Transformer unit is as follows:

[0138] S3201: First, a class token is attached to the token generated in step S31. As a learnable vector, the class token is introduced to aggregate information from the input into its associated embedding.

[0139] S3202: Then, to incorporate positional information about the tokens, classic sinusoidal positional encoding is used. The positional embedding is added to the input tokens and fed into a series of Transformer layers. The class tokens generated by the Transformers are used as the final output of this component. S33: The third component of the model is a prediction head that preserves the linear and softmax layers, outputting... The probability values ​​within the range are used for subsequent similarity calculations. It should be noted that the recognition result output by the prediction head is a classification probability distribution of the terminal's current behavior. Specifically, during the model training phase, the dataset needs to be pre-labeled, with the label categories corresponding to the scenarios simulated in step S15, including "normal behavior" and various abnormal attack behaviors, such as "DDoS attack," "authentication brute-force attack," and "illegal link access." At this time, the actual behavior... This is the one-hot label vector for the corresponding category.

[0140] To simplify the expression, the multi-dimensional feature data passed from the processing unit... Simplified to This serves as the input to the Transformer model, which is designed for multi-dimensional data fusion. During the training phase, the predicted values ​​are obtained after the model is trained. Specifically, it is expressed as follows:

[0141] At this point, the predictive behavior is calculated. With actual behavior The differences or similarities between the inputs are used for backpropagation to update the model parameters. However, during the actual detection phase, i.e., the inference phase, the system no longer needs inputs. The system directly uses the trained model to calculate the predicted probability vector from the real-time collected and processed S1 and S2 data. If the probability of the "normal behavior" category in the output is lower than a preset threshold, or if the probability of a specific attack category is the highest, then an attack is determined to exist. To standardize the trust assessment metric, this embodiment uses the cosine similarity between the predicted vector and the ideal normal state vector as the basis for trust assessment, as shown in the following formula:

[0142] , Represents the dot product of vectors. Representing vectors Norm, Indicates actual behavior Corrected during the testing phase That is, the ideal normal state.

[0143] According to an embodiment of the present invention, the trust assessment unit assesses the trust level of the access terminal in step S4 to ensure that the behavior and trust status of the terminal are accurately reflected, specifically including the following steps:

[0144] S41: Implement a static trust assignment mechanism. By analyzing the historical behavior data, configuration information, authentication status, and other static information of the access terminals, an initial trust value is assigned to each terminal as a basic score, denoted as:

[0145] ,in, It is a function that maps this static information to a trust score. , Indicates terminal Historical behavioral data, This indicates the terminal's configuration information. This indicates the authentication status of the terminal.

[0146] S42: Implement a time-weighted mechanism, and use a time-weighted strategy to assign weights to the results transmitted by the behavior detection unit, giving higher weights to recent behaviors, so as to enhance the system's sensitivity to changes in terminal behavior and prevent occasional abnormal behaviors from erroneously affecting the judgment of terminal trust level.

[0147] Similarity score transmitted from the behavior detection unit When applied to a specific point in time, the time-weighted mechanism needs to be aligned with that point in time. Combined use, time-related similarity scores It can be represented as In the time-weighted function Under the influence of ( (where the decay coefficient is used), time-weighted similarity is defined as:

[0148] ,in, This represents the total number of time steps.

[0149] S43: Calculate the comprehensive trust value, ultimately generating a trust level value. This trust level value is used to classify the terminal's trust level, which includes: Trusted, Generally Trusted, Generally Untrusted, and Untrusted, corresponding to values ​​{[0,0.25],(0.25,0.50],(0.50,0.75],(0.75,1]} respectively. The final trust level value can be expressed as:

[0150] ,in, and It is an adjustment coefficient that determines the relative weights of static and dynamic trust levels. That is, the static trust score value calculated in step S41, and This refers to the time-weighted similarity calculated in step S42. This represents the dynamic trust score after incorporating a time decay factor. By directly using time-weighted similarity as the dynamic trust term, it ensures that the trust assessment results reflect both the correctness of the behavior and the impact of recent behavior on security.

[0151] The trust level of a terminal should be dynamically adjusted based on its long-term behavior, especially for devices falling between "generally trustworthy" and "generally untrustworthy." By tracking and promptly reflecting behavioral changes in real time, terminals that should be gradually improved can be prevented from being prematurely classified as "untrustworthy."

[0152] S44: Employ a behavior slippage mechanism to reassess the terminal trust level at regular intervals (e.g., every 30 days). If a device's behavior temporarily declines, the trust level can be restored as long as its subsequent performance improves; if the behavior does not improve over a long period, the trust level will be downgraded and blocking measures will be strengthened.

[0153] S45: A dynamic adjustment triggering mechanism is adopted. When the terminal's behavior exhibits an abnormal pattern, the trust assessment mechanism is automatically triggered for dynamic adjustment. If the terminal's performance remains good (even if it was previously assessed as a generally untrustworthy terminal), the trust level can be gradually improved through the "behavior recovery mode"; conversely, if the behavior remains abnormal, its trust level may be reduced to "untrustworthy".

[0154] S46: Adaptive blocking and gradual recovery are employed. For terminals exhibiting abnormal behavior, gradual restrictions are implemented, initially reducing access permissions only and gradually restoring them as the behavior improves. If a device falls between "generally trustworthy" and "generally untrustworthy," a remedial period is set: during this period, the terminal can restore its trust level by correcting its behavior or performing additional verification; devices that do not improve will be subject to stronger blocking measures.

[0155] According to an embodiment of the present invention, after the blocking unit defines the terminal trust level in step S5, it takes corresponding blocking measures for abnormal behavior of different trust levels based on the intelligent blocking strategy, so as to realize real-time automatic isolation and processing of malicious terminals. The specific blocking strategy is as follows:

[0156] S51: In the case of a trusted terminal, it allows full access to system resources with almost no additional blocking measures.

[0157] S52: Under normal trusted terminal conditions, access to most resources is allowed, but critical or high-risk operations such as high-privilege operations and access to sensitive data are restricted or continuously reviewed. The behavior of such devices is monitored more closely, and warnings or further verification are issued when their behavior is abnormal.

[0158] S53: In cases of generally untrusted terminals, restrict their access to network bandwidth or request frequency, and require stricter authentication, behavior analysis, and real-time checks on the devices.

[0159] S54: In the case of an untrusted terminal, completely isolate the terminal from critical systems or resources, and prevent it from accessing any sensitive data or operations.

[0160] The above steps illustrate specific embodiments of the present invention, as detailed in the appendix. Figure 1 This invention showcases its overall architecture. By constructing a multi-source data acquisition system, it comprehensively collects data such as traffic patterns, system logs, signal strength, and network topology, enabling precise detection of potential attack signs. It employs feature space mapping and dynamic / static feature fusion to optimize information representation and improve detection performance in complex environments. By simplifying network topology data processing and maintaining network structural integrity, it improves the accuracy of terminal trust value calculation by combining static assignment and time weighting mechanisms. The Transformer model, using multi-channel feature sequence processing, effectively bridges the modal gap in power terminal device data. Differentiated security measures are implemented based on terminal trust levels, effectively protecting against attacks and accurately isolating malicious terminals. In summary, this invention has significant engineering application value in improving security protection, enhancing network stability, and optimizing resource management, laying the foundation for the intelligent and secure development of the power Internet of Things (IoT) ecosystem. This method addresses the following problems in existing power IoT terminal access security detection: failure to select the most representative key indicators, ineffective fusion of multimodal data, static trust assessment mechanisms unable to adapt to dynamic behavior changes, lack of a multi-channel deep learning model oriented towards multimodal features, and insufficient sensitivity of existing dynamic trust assessment methods to data changes, resulting in insufficient detection accuracy and reliability. Furthermore, this invention can more accurately identify and respond to abnormal behavior of terminal access, thereby improving the security and reliability of power Internet of Things terminal access.

[0161] The present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, wherein when the programs are executed by the processors, they implement the steps of the power terminal access attack behavior detection method based on multimodal data fusion as described above.

[0162] The present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the power terminal access attack behavior detection method based on multimodal data fusion as described above.

[0163] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus (systems), computer devices, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] This invention is described with reference to a flowchart of a method according to embodiments of the invention. It should be understood that each step in the flowchart and combinations thereof can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing device, generate instructions for implementing the process. Figure 1 A device for a function specified in one or more processes.

[0165] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 The function specified in one or more processes.

[0166] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 Steps of a specified function in one or more processes.

Claims

1. A method for detecting power terminal access attack behavior based on multi-modal data fusion, characterized in that, The method comprises the following steps: Synchronously collecting multi-modal data of traffic patterns, system logs, signal strength and network topology by a special collection tool, wherein the interactive behavior in the traffic patterns, system logs and signal strength related data constitute dynamic data, and the terminal information, hardware configuration, installed software version and terminal and network connection mode related data in the system logs constitute static data; Preliminarily processing and screening the collected multi-modal data features, and pre-processing different types of data according to the corresponding processing standards, wherein the original data of each dynamic data source is converted into time series samples by a sliding window method after time alignment of the dynamic data; the useful discrete or numerical features are extracted from the terminal information in the system logs; the network topology data are used to extract the structure information and path information of the network topology; and the pre-processed multi-modal data are mapped to a shared feature space to form multi-modal features after data reduction; Establishing a Transformer model for multi-modal data fusion, taking the multi-modal features as the training input of the model, adjusting the model parameters, constructing a trust model of terminal historical behavior, predicting the future behavior of the terminal by using the trust model, and outputting the terminal attack behavior detection result; Combining a static trust assignment mechanism and a time weighting mechanism, performing trust evaluation on the terminal according to the terminal attack behavior detection result and the data feature index; According to the trust evaluation result, a differentiated intelligent blocking strategy is executed on the terminal to realize accurate protection against attack behavior of the power terminal.

2. The method of claim 1, wherein, The specific process of collecting multi-modal data of traffic patterns, system logs, signal strength and network topology is as follows: The communication traffic between devices is captured and analyzed by a network packet capture tool or traffic monitoring software to obtain source IP address, source port number, destination IP address, destination port number, protocol type, network request type, packet size and transmission rate information; The log files of the terminal and system are integrated by a system log collection tool to extract dynamic attributes including operation behavior, login and logout records, privilege upgrade attempts, state changes, and static attributes including terminal identity information, hardware configuration, installed software version, and terminal and network connection mode; The received signal strength, signal-to-noise ratio and signal quality are monitored by a wireless signal scanning tool; The power Internet of Things terminal network is scanned by a network discovery tool to identify terminals, nodes and their connection relationships in the network, update the network topology in real time, and extract the physical and logical connection relationships between terminals; Normal and abnormal access situations are simulated by test scripts, and data collection is triggered in combination with an interactive data triggering mechanism.

3. The method of claim 1, wherein, The specific strategy for time alignment of dynamic feature related data is as follows: If the timestamp has a direct matching value in the traffic patterns, system logs and signal strength, the corresponding samples are directly merged; If any data source has no data at a specific time point, the nearest timestamp is selected for matching; If the data is missing for more than a predetermined condition, linear interpolation is performed to fill in the missing timestamp; The aligned data samples include traffic patterns, signal strength and system log data with consistent timestamps.

4. The method of claim 1, wherein, The structural information and path information of the network topology are extracted from the network topology data, the extracted path information includes path length, shortest path length, bandwidth, delay and packet loss rate, and the extracted structural information includes node number, connectivity, network density and degree centrality.

5. The method of claim 1, wherein, The preprocessed multi-modal data is mapped to a shared feature space, including: After processing the dynamic feature-related data through LSTM, it is mapped to a low-dimensional space through an embedding layer; The static feature and topology feature-related data are respectively processed through a fully connected layer and then mapped to a low-dimensional space.

6. The method of claim 1, wherein, The data reduction adopts a principal component analysis algorithm to select the most influential features for the target variable and remove redundant or irrelevant features.

7. The method of claim 1, wherein, The training and detection processes of the multi-modal feature fusion-oriented Transformer model are as follows: The Transformer model includes a token generation unit, a Transformer unit and a prediction head. In the training stage, the dynamic feature sequence, static feature sequence and topology feature sequence in the training data are respectively encoded into token labels through the three channels of the token generation unit. After calculating the correlation weights of the three types of token labels through the multi-head self-attention mechanism layer, three-channel attention weight token vectors are generated. Then, the token vectors are processed through class label addition, position embedding and Transformer layer in the Transformer unit to output class labels. Finally, the prediction result is obtained by processing through the linear layer and Softmax layer of the prediction head. Based on the difference between the prediction result and the true label, the model parameters are adjusted to complete the training. In the detection stage, the model trained is used to process the data to be detected according to the same feature encoding and processing process as described above, and a probability value in the range of 0 to 1 is output. Whether an attack behavior exists is determined by calculating the relationship between the probability value and the preset threshold, and the attack behavior detection is completed.

8. The method of claim 1, wherein, The terminal is evaluated based on the static trust assignment mechanism and the time weighting mechanism, including: By analyzing the historical behavior data, configuration information and authentication state static information of the access terminal, an initial trust value is assigned to each terminal as a basic score; A time weighting strategy is used to assign weights to the terminal attack behavior detection results. The time weighting strategy gives higher weight to recent behavior, and obtains a time-weighted similarity; The comprehensive trust value is calculated based on the basic score and the time-weighted similarity, and the trust level of the terminal is divided according to the comprehensive trust value.

9. The method of claim 1, wherein, When the terminal is evaluated based on the static trust assignment mechanism and the time weighting mechanism, the following operations are also performed: The terminal trust evaluation result is recalibrated at regular intervals; When the terminal behavior appears an abnormal pattern, the trust evaluation mechanism is automatically triggered for dynamic adjustment; Gradual restriction measures are taken for the terminal with abnormal behavior, and a remediation period is set for the terminal in the trust transition interval. 10.A power terminal access attack behavior detection system based on multi-modal data fusion, characterized in that, Including: The collection unit is used for synchronously collecting multi-modal data of traffic patterns, system logs, signal strengths and network topologies by a dedicated collection tool, wherein the interactive behaviors in the traffic patterns and the system logs and the signal strength related data constitute dynamic data, and the terminal information, hardware configuration, installed software version and terminal and network connection mode related data in the system logs constitute static data; The processing unit is used for preliminarily processing and screening the collected multi-modal data features, and pre-processing different types of data according to corresponding processing standards, wherein the original data of each dynamic data source is converted into time series samples by a sliding window method after time alignment of the dynamic data; useful discrete or numerical features are extracted from the terminal information in the system logs for the static data; the structural information and path information of the network topology are extracted from the network topology data; the pre-processed multi-modal data is mapped to a shared feature space, and multi-modal features are formed after data reduction; The behavior detection unit is used for establishing a Transformer model facing multi-modal data fusion, taking the multi-modal features as the training input of the model, constructing a trust model of terminal historical behaviors by fine-tuning the model parameters, predicting the future behaviors of the terminal by using the trust model, and outputting the terminal attack behavior detection result; The trust evaluation unit is used for combining a static trust assignment mechanism and a time weighting mechanism, and performing trust evaluation on the terminal according to the terminal attack behavior detection result and the data feature index; The blocking unit is used for executing a differentiated intelligent blocking strategy on the terminal according to the trust evaluation result, so as to realize accurate protection of the power terminal access attack behaviors.

11. An electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the programs, when executed by the processor, implement the power terminal access attack behavior detection method based on multi-modal data fusion as claimed in any one of claims 1-9.

12. A computer readable storage medium having stored thereon a computer program, the computer program, when executed by a processor, implements the power terminal access attack behavior detection method based on multi-modal data fusion as claimed in any one of claims 1-9.

Images