Power monitoring system intrusion detection method and system based on flow analysis

Abstract

The invention relates to the field of electric power monitoring, in particular to an electric power monitoring system intrusion detection method and system based on flow analysis. The method comprises the following steps: collecting network traffic, analyzing and recombining to obtain structured session data; time sequence behavior features and function code distribution features are extracted to construct a multi-dimensional feature set; inputting the feature set into a compliance rule base and a behavior baseline model in parallel, and respectively outputting a rule matching result and an abnormal deviation degree score; generating a comprehensive threat index by adopting a weighted decision fusion strategy; and when the index exceeds a dynamic threshold value, intrusion is determined and an alarm is given. According to the invention, the problem of insufficient precision and adaptability caused by single feature dimension and isolated detection mechanism is solved.

Description

Technical Field

[0001] This invention relates to the field of power monitoring, and in particular to an intrusion detection method and system for power monitoring systems based on flow analysis. Background Technology

[0002] As a core infrastructure ensuring the safe and stable operation of the power grid, the power monitoring system bears the critical responsibility of real-time monitoring of the operating status of power equipment and regulating power transmission processes. Its security capabilities are directly related to energy supply security and socio-economic stability. With the deep integration of industrial internet technology into the power sector, power monitoring networks are gradually evolving from closed architectures to open interconnections. In this process, network boundaries are becoming increasingly blurred, and security threats such as hacker attacks and malicious intrusions are becoming more severe. In recent years, targeted attacks on power systems have occurred frequently. Attackers, through methods such as forging business instructions and tampering with transmitted data, may cause serious consequences such as substation malfunctions, abnormal fluctuations in power load, or even large-scale power outages. Therefore, building an efficient and accurate intrusion detection mechanism has become a core requirement in the field of power security.

[0003] Current intrusion detection technologies for power monitoring systems are mainly divided into two categories: rule-based misuse detection and behavior baseline-based anomaly detection. Rule-based methods rely on predefined attack signature databases for matching and detection. While they respond quickly to known attacks, they cannot identify unknown attack patterns and are prone to rule failure in the face of dynamic changes in power business. Behavior baseline-based methods identify anomalies by establishing normal business behavior models. Although they can cover unknown threats, their single feature extraction dimension and isolated detection mechanism often lead to insufficient detection accuracy. For example, Chinese invention patent CN114826711B (application number CN202210396010.6), "A Security Monitoring Method for a Host in a Power Monitoring System," extracts application layer traffic features and inputs them into a support vector machine model to achieve security judgment. This method only focuses on basic traffic features, without considering the specific operational sequences and time-series patterns of power business. Its feature extraction dimension is singular, and it uses a single model for detection, making it difficult to balance the efficiency of identifying known attacks with the coverage of unknown threats.

[0004] Existing technologies generally suffer from two major flaws: First, feature extraction often focuses on basic traffic statistics, neglecting features strongly correlated with power operations, such as function code call sequences and operation timing. This results in weak identification capabilities for intrusion behaviors disguised as normal business operations. Second, detection mechanisms often employ isolated rule bases or single models, lacking synergy and integration. This makes it impossible to simultaneously address both accurate matching of known attacks and dynamic perception of unknown threats. Furthermore, the decision-making process does not consider real-time network security status, and fixed detection thresholds are prone to false negatives or false positives for critical business operations under high load scenarios. These problems make existing intrusion detection methods insufficient to meet the high requirements of power monitoring systems for detection accuracy, adaptability, and reliability. Therefore, there is an urgent need for an intrusion detection solution that can integrate multi-dimensional business features and construct a collaborative detection mechanism. Summary of the Invention

[0005] This invention provides an intrusion detection method and system for power monitoring systems based on flow analysis, aiming to solve the problems of insufficient accuracy and poor adaptability caused by the single feature extraction dimension and isolated detection mechanism in the prior art.

[0006] To achieve the above objectives, the following technical solution is adopted.

[0007] An intrusion detection method for a power monitoring system based on flow analysis includes the following steps: Raw network traffic data from the power monitoring network is collected, and protocol parsing and session reassembly are performed on the raw network traffic data to obtain structured session data. Temporal behavioral features reflecting the sequence of power business operations and function code distribution features reflecting business function calls are extracted from the structured session data to obtain a multi-dimensional behavioral feature set. This multi-dimensional behavioral feature set is simultaneously input into a predefined power business compliance rule base and a behavioral baseline model trained based on normal traffic for parallel analysis. The power business compliance rule base outputs rule matching results, and the behavioral baseline model outputs an anomaly deviation score. Based on the rule matching results and the anomaly deviation score, a weighted decision fusion strategy is used to generate a comprehensive threat index. When the comprehensive threat index exceeds a dynamically adjusted detection threshold, the current session is determined to be an intrusion, and an alarm signal is generated.

[0008] Optionally, the step of collecting raw network traffic data from the power monitoring network, performing protocol parsing and session reassembly on the raw network traffic data to obtain structured session data specifically includes: The raw network traffic data is obtained by mirroring network data packets using traffic probes deployed at key nodes of the power monitoring network. Deep packet inspection is performed on the raw network traffic data to identify and extract the application layer payload, resulting in application layer messages. Based on the specifications of industrial communication protocols, the application layer messages are decoded to parse out the protocol type, function code, and data area content, yielding the protocol parsing result. Using the Internet Protocol addresses and port numbers of both communicating parties as session identifiers, the protocol parsing results belonging to the same communication process are merged and sorted in chronological order to reconstruct a complete business session sequence, thus obtaining the structured session data.

[0009] Optionally, the step of extracting temporal behavioral features reflecting the power business operation sequence and function code distribution features reflecting business function calls from the structured session data to obtain a multi-dimensional behavioral feature set specifically includes: Extract function codes for multiple consecutive business operations from the structured session data to form an operation sequence. Calculate the edit distance between this operation sequence and the pre-stored standard operation procedure sequence to obtain the sequence anomaly index. The frequency of each function code in the current session period is counted, a function code frequency vector is constructed, and the cosine similarity between the function code frequency vector and the function code baseline vector of historical normal sessions is calculated to obtain the distribution consistency index. Extract statistics on session duration, number of data packets, and data packet size distribution to form session traffic statistical features; The sequence anomaly index, the distribution consistency index, and the session traffic statistical features are combined to form the multi-dimensional behavioral feature set.

[0010] Optionally, the step of generating a comprehensive threat index using a weighted decision fusion strategy based on the rule matching result and the anomaly deviation score specifically includes: A first weight is assigned to the rule matching result. The rule matching result is a binary value. If it matches any predefined intrusion rule, the value is 1; otherwise, it is 0. A second weight is assigned to the anomaly deviation score, which is a continuous value between 0 and 1; The initial threat index is obtained by adding the weighted rule matching result to the weighted anomaly deviation score using a linear weighting formula. The current network security status level is introduced as an adjustment factor, which is dynamically calculated based on recent alarm frequency and network load. The initial threat index is scaled using the adjustment factor to obtain the final comprehensive threat index.

[0011] Optionally, the training steps of the behavioral baseline model trained based on normal traffic specifically include: During system initialization or the security confidence period, a large amount of normal power business flow data is collected to form a training sample set; Extract all features contained in the multi-dimensional behavioral feature set from the training sample set to form a feature vector; An unsupervised learning algorithm is used to perform cluster analysis on the feature vectors to identify multiple normal business operation modes and determine the cluster center of each mode in the feature space. Calculate the average distance from all sample points in each cluster to its cluster center, and use it as the threshold for the normal fluctuation range of that cluster; During detection, the behavior baseline model calculates the distance between the input feature vector and all cluster centers, takes the minimum distance value, and compares the minimum distance value with the normal fluctuation range threshold of the corresponding cluster to calculate the abnormal deviation score.

[0012] Optionally, after generating an alarm signal, the method further includes an intrusion behavior tracing step: When an intrusion is identified, the structured session data that generated the session is immediately locked, and the source Internet Protocol address, target Internet Protocol address, operation timestamp, and specific function code operation executed are extracted from it to form an initial chain of evidence. Query the network asset database to obtain the physical device information corresponding to the source Internet Protocol address and its location in the network topology, thereby obtaining the attack source identity information; By retrospectively querying all operation instructions recently received by the target Internet Protocol address, related operations that are close in time and initiated by the same attack source are filtered out to obtain the attack sequence; The initial chain of evidence, the identity information of the attack source, and the attack sequence are correlated and integrated to generate a complete attack tracing report.

[0013] Optionally, the step of determining the dynamically adjusted detection threshold specifically includes: Set a basic detection threshold; monitor network traffic load and business criticality level in real time. When the network traffic load exceeds a first set threshold, lower the basic detection threshold to obtain higher detection sensitivity. When the business criticality level exceeds a second set threshold, raise the basic detection threshold to reduce false alarms for critical businesses. The number of false alarms confirmed by the security administrator in recent alarm signals is counted. When the false alarm rate exceeds the third set threshold, the basic detection threshold is adjusted upward. When a missed event is confirmed, the basic detection threshold is adjusted downward. The threshold, dynamically adjusted based on the above factors, will be used as the final detection threshold.

[0014] Optionally, the method further includes an adaptive learning step: Regularly collect newly generated normal business traffic data and confirmed false alarm data to form an incremental training dataset; The behavior baseline model trained on normal traffic is incrementally learned using the incremental training dataset to update the parameters of the behavior baseline model so that the behavior baseline model can adapt to the slow drift of power business patterns. The system analyzes the characteristic patterns of confirmed intrusion behaviors. When a new characteristic is found that is not covered by existing rules, a new candidate detection rule is automatically generated based on the characteristic pattern. After review by the security administrator, the candidate detection rule is added to the predefined power business compliance rule library.

[0015] An intrusion detection system for power monitoring systems based on flow analysis, comprising: The system includes a traffic acquisition and analysis module, a multi-dimensional feature extraction module, a parallel analysis module, a decision fusion module, and an alarm generation module. The traffic acquisition and parsing module is used to acquire raw network traffic data in the power monitoring network, perform protocol parsing and session reassembly on the raw network traffic data to obtain structured session data, and send the structured session data to the multi-dimensional feature extraction module. The multi-dimensional feature extraction module is used to extract time-series behavioral features reflecting the power business operation sequence and function code distribution features reflecting the business function call from the received structured session data, to obtain a multi-dimensional behavioral feature set, and send the multi-dimensional behavioral feature set to the parallel analysis module. The parallel analysis module is used to simultaneously input the received multi-dimensional behavioral feature set into a predefined power business compliance rule base and a behavioral baseline model trained based on normal traffic for parallel analysis, so that the power business compliance rule base outputs rule matching results, the behavioral baseline model outputs anomaly deviation scores, and the rule matching results and the anomaly deviation scores are sent to the decision fusion module. The decision fusion module is used to generate a comprehensive threat index based on the received rule matching result and the abnormal deviation score using a weighted decision fusion strategy, and send the comprehensive threat index to the alarm generation module. The alarm generation module is used to compare the received comprehensive threat index with a dynamically adjusted detection threshold. When the comprehensive threat index exceeds the detection threshold, the current session is determined to be an intrusion behavior, and an alarm signal is generated.

[0016] Optionally, the behavioral baseline model based on normal traffic training integrated in the parallel analysis module is specifically trained and maintained offline by the baseline modeling module; The baseline modeling module includes: The training data acquisition unit is used to collect a large amount of normal power business flow data during system initialization or the safety confidence period to form a training sample set. A feature vector construction unit, connected to the training data acquisition unit, is used to extract all features contained in the multi-dimensional behavioral feature set from the training sample set to form a feature vector. The clustering analysis unit, connected to the feature vector construction unit, is used to perform clustering analysis on the feature vector using an unsupervised learning algorithm, identify multiple normal business operation modes, and determine the cluster center of each mode in the feature space. The fluctuation range calculation unit is connected to the cluster analysis unit and is used to calculate the average distance from all sample points in each cluster to its cluster center, which is used as the normal fluctuation range threshold of the cluster. The model update unit is used to periodically collect newly generated normal business traffic data, incrementally update the business operation patterns and their normal fluctuation range thresholds identified by the clustering analysis unit, and synchronize the updated model parameters to the behavior baseline model in the parallel analysis module.

[0017] Compared with the prior art, the present invention has the following beneficial effects: This application effectively solves the technical problems of insufficient accuracy and poor adaptability caused by the single feature extraction dimension and isolated detection mechanism in existing power monitoring system intrusion detection methods. Through a complete process of "traffic acquisition and analysis - multi-dimensional feature extraction - parallel analysis of rule base and baseline model - weighted fusion decision - dynamic threshold alarm", it achieves comprehensiveness and accuracy in attack detection: the multi-dimensional feature set simultaneously covers the temporal behavior characteristics and function code distribution characteristics of power business, which, compared with existing methods that only extract basic traffic characteristics, can better characterize the essential rules of business operations and accurately identify intrusion behaviors disguised as normal business; the parallel analysis mechanism of rule base and behavioral baseline model not only quickly matches known attacks through rule base, but also captures unknown threats with the help of baseline model, and the weighted decision fusion strategy integrates the advantages of the two types of detection results, avoiding the limitations of a single detection mechanism.

[0018] By employing traffic probe mirroring, deep packet inspection, and session reassembly techniques, the integrity and accuracy of structured session data were ensured, providing a high-quality data foundation for subsequent feature extraction. Edit distance calculation, cosine similarity analysis, and traffic statistics feature extraction enabled quantification and high discriminative power of features, enhancing the sensitivity of the feature set to intrusion behavior. Introducing network security situation level as a moderating factor made the calculation of the comprehensive threat index more closely reflect real-time network conditions, improving the scientific rigor of decision-making. Unsupervised learning clustering was used to construct a behavioral baseline model, eliminating the need for manual annotation of attack samples, reducing model training costs, and simultaneously utilizing cluster centers and fluctuation ranges... The threshold setting enhances the model's adaptability to normal business patterns; the intrusion tracing step can quickly pinpoint the attack source and reconstruct the attack sequence, providing a complete chain of evidence for security incident handling; the dynamic threshold adjustment mechanism achieves a balance between detection sensitivity and business availability by combining network load, business criticality, and false negative / false negative statistics; the adaptive learning step enables the model and rule base to continuously iterate, adapting to the slow drift of power business patterns and the emergence of new attacks; the system architecture achieves the engineering implementation of various technical features through modular design, and the offline training and incremental update mechanism of the baseline modeling module ensures the long-term effectiveness and operational efficiency of the behavioral baseline model. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the control flow of an embodiment of an intrusion detection method for a power monitoring system based on flow analysis according to the present invention.

[0020] Figure 2 This is a schematic diagram of an intrusion detection system module for a power monitoring system based on flow analysis, according to the present invention. Detailed Implementation

[0021] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0022] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used in this invention is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0023] Example 1 like Figure 1As shown, this embodiment is applied to the monitoring network of a 220kV smart substation under the jurisdiction of a provincial power grid dispatch center. This network encompasses core equipment such as remote communication devices, protection and control devices, and the main station and substations of the data acquisition and monitoring control system. Data interaction is achieved using industrial communication protocols such as IEC60870-5-104 and DL / T634.5101. To address security threats in this scenario, such as intrusion using disguised business commands and abnormal function code calls, this embodiment achieves accurate intrusion detection through a complete traffic analysis process. The specific steps are as follows.

[0024] First, raw network traffic data from the power monitoring network is collected, and protocol parsing and session reassembly are performed to obtain structured session data. During traffic acquisition, based on the substation network topology, traffic probes with 10Gbps processing capacity are deployed at the following key nodes: the serial communication link between the remote control unit and the dispatch data network gateway, the mirror port of the protection and control unit aggregation switch, and the SPAN port of the data acquisition and monitoring control system master station core switch. The traffic probes employ a passive mirror acquisition mode, acquiring raw traffic data by obtaining complete data packets at the link layer. Timestamp synchronization is enabled during acquisition to ensure that the time accuracy of all data packets is controlled within milliseconds, avoiding time deviations that could affect the accuracy of subsequent session reassembly. The collected raw traffic data includes complete fields such as Ethernet frame headers, IP headers, TCP / UDP headers, and application layer payloads. The data is stored in the PCAP standard format for easy retrieval by subsequent parsing tools.

[0025] After the raw traffic is collected, the protocol parsing phase begins, starting with a deep packet inspection process. A regular expression-based pattern matching algorithm identifies the protocol type of the data packets. For TCP packets, fields such as sequence number, acknowledgment number, and window size are parsed to verify connection legitimacy, eliminating abnormally disconnected half-connection packets. For UDP packets, the application layer protocol type is determined by matching the port number with protocol signatures. During deep packet inspection, the application layer payload is carefully stripped. For IEC60870-5-104 protocol packets, APDU messages are extracted from the TCP payload, and the start character and length identifier fields in the header are removed to obtain a clean application layer message. For DL / T634.5101 protocol packets, the start position of the application layer data is located using the link layer address identifier, and redundant fields such as the frame check sequence are removed. Subsequently, based on the specifications of the corresponding industrial protocol, decoding is performed. Taking the 104 protocol as an example, the fields such as type identifier, variable structure qualifier, and transmission reason in the application service data unit are parsed to determine whether the protocol type is remote signaling, telemetry, or remote control. At the same time, the function code field is extracted, such as remote signaling change function code 0x01, telemetry call function code 0x02, and remote control execution function code 0x22. The data area content is then decoded to obtain specific remote signaling status values, telemetry values, or remote control operation object identifiers, forming a protocol parsing result containing protocol type, function code, data content, source IP, destination IP, port number, and timestamp.

[0026] During the session reassembly phase, the IP addresses and port numbers of both communicating parties serve as unique session identifiers. For example, all data packets with a source IP of 192.168.1.10 and a source port of 6001, and a destination IP of 192.168.2.20 and a destination port of 2404, are considered to belong to the same session. During reassembly, for TCP sessions, the protocol parsing results are sorted in ascending order of sequence numbers to fill in data packet out-of-order issues caused by network latency. For UDP sessions, due to their connectionless nature, timestamps are used in ascending order combined with transaction identifiers from application layer messages to ensure the integrity of the session sequence. When a session end marker is detected, such as a TCP FIN packet or a 104 stop data transmission message, all parsing results for that session are merged to form a complete business session sequence. The final output structured session data is organized in JSON format, with each session record containing fields such as session identifier, start time, end time, protocol type, function code sequence, and corresponding data content.

[0027] Next, a multi-dimensional behavioral feature set is extracted from the structured session data. This feature set covers time-series behavioral features, function code distribution features, and session traffic statistics features, achieving a comprehensive characterization of business behavior. During time-series behavioral feature extraction, an operation sequence is constructed by extracting 10 consecutive business operation function codes from the function code sequence of the structured session data. For example, the function code sequence for a remote control operation session might be 0x02 (telemetry call), 0x08 (telemetry data upload), 0x21 (remote control selection), and 0x22 (remote control execution). The pre-stored standard operation procedure sequence is obtained by analyzing historical normal business data. For remote control operation types, the standard sequence is telemetry call - telemetry upload - remote control selection - remote control confirmation - remote control execution. This sequence is jointly reviewed and confirmed by the security administrator and maintenance personnel to ensure compliance with power business operation specifications. The Levinstein edit distance algorithm is used to calculate the difference between the current operation sequence and the standard sequence. This algorithm obtains the edit distance by counting the number of insertion, deletion, and replacement operations. The ratio of the edit distance to the length of the standard sequence is the sequence anomaly index; a larger ratio indicates a more abnormal operation sequence.

[0028] In the function code distribution feature extraction process, the current session period is first determined. For periodic telemetry upload services, the session period is a preset collection period (e.g., 5 seconds); for non-periodic remote control services, the session period is the complete duration from the start to the end of the session. The frequency of each function code within this period is counted, and a function code frequency vector is constructed by combining all function code types supported by the system. The vector dimension is consistent with the total number of function codes in the system, and the value of each dimension represents the frequency of occurrence of the corresponding function code. The baseline vector of function codes for historical normal sessions is obtained by statistically analyzing the frequency distribution of function codes in normal sessions of similar services over the past 30 days. A sliding window update mechanism is used, updating the baseline vector every 7 days to adapt to the slow changes in services. The distribution consistency index is obtained by calculating the cosine similarity between the current frequency vector and the baseline vector. The similarity value ranges from 0 to 1, with a value close to 1 indicating a high degree of consistency between the function code distribution and the normal pattern.

[0029] The extraction of session traffic statistical features revolves around the temporal and data volume characteristics of the session, specifically including session duration (the difference between the session end time and start time), number of data packets (the total number of data packets contained in the session), and statistical measures of data packet size distribution (including mean, standard deviation, maximum, and minimum values). For remote control sessions, the statistical features of data packet time intervals are also extracted, as abnormal intrusion behavior often manifests as a dense sending of commands within a short period. The sequence anomaly index, distribution consistency index, and session traffic statistical features are standardized to eliminate the dimensional differences between different features. The standardized data combination forms a multi-dimensional behavioral feature set, which is stored in the form of feature vectors for easy input into subsequent models.

[0030] After the multi-dimensional behavioral feature set is generated, it is simultaneously input into the power business compliance rule base and the behavioral baseline model for parallel analysis, enabling comprehensive detection of known attacks and unknown threats. The power business compliance rule base adopts a decision tree-based rule organization method, with rules divided into two categories: basic rules and business-specific rules. Basic rules cover common attack characteristics, such as sending more than 5 invalid function codes (e.g., 0xFF) consecutively within a short period, initiating remote control operations from source IPs not in the preset trusted IP list, and data packet size exceeding the maximum payload limit of the corresponding protocol. Business-specific rules are formulated in conjunction with the characteristics of power business, such as remote signaling change messages without corresponding timestamp information, remote control execution instructions lacking preceding remote control selection instructions, and telemetry data exceeding the normal operating range of equipment. The rule base adopts a priority mechanism, with business-specific rules having higher priority than basic rules. When the feature set matches any rule, the rule matching result is set to 1; otherwise, it is set to 0. The specific rule ID of the match is recorded during the matching process for subsequent tracing.

[0031] The behavioral baseline model is constructed using an unsupervised learning algorithm. Model training is completed within the safety confidence period after system initialization, which is set to the first 14 days after system commissioning. During this phase, manual verification ensures that all collected traffic is normal business traffic. The training sample set contains at least 100,000 normal session data points of different business types, covering core business types such as remote signaling, telemetry, remote control, and general call. After extracting feature vectors from the training sample set, K-means clustering is used for cluster analysis. The number of clusters is determined using the elbow rule: a curve is plotted showing the clustering error as a function of the number of clusters, and the value corresponding to the inflection point of the curve is taken as the optimal number of clusters. This value is typically consistent with the number of typical operating modes in the power business. After cluster analysis, cluster centers for each normal mode are obtained, and each dimension of the cluster center vector corresponds to the mean of each feature in the feature set. Subsequently, the Euclidean distances from all sample points in each cluster to the cluster center are calculated. The average of these distances is the normal fluctuation range threshold for that cluster, used to determine the deviation of subsequent detected samples.

[0032] During the detection phase, the behavioral baseline model calculates the Euclidean distance between the input feature vector and all cluster centers, selecting the minimum distance as the closest distance between the sample and the normal pattern. The minimum distance is compared to the normal fluctuation range threshold of the corresponding cluster. If the minimum distance is less than or equal to the threshold, the sample belongs to the normal pattern, and the anomaly deviation score is 0. If the minimum distance is greater than the threshold, a linear interpolation method is used to calculate the anomaly deviation score. The formula is: Deviation Score = (Minimum Distance - Threshold) / (Maximum Allowable Distance - Threshold), where the maximum allowable distance is determined by statistically analyzing the distance values ​​of historical anomalous samples, ensuring the score is between 0 and 1. The closer the score is to 1, the higher the degree of anomalousness of the sample.

[0033] After parallel analysis, a comprehensive threat index is generated based on rule matching results and anomaly deviation scores using a weighted decision fusion strategy. Weight allocation is determined using the analytic hierarchy process (AHP). Five experts in power safety were invited to score the importance of the two types of detection results. After consistency testing, the first weight was determined to be 0.4, and the second weight to be 0.6. The linear weighting formula is: Initial Threat Index = Rule Matching Result × 0.4 + Anomaly Deviation Score × 0.6. For example, when the rule matching result is 1 and the anomaly deviation score is 0.8, the initial threat index is 1 × 0.4 + 0.8 × 0.6 = 0.88. The network security situation level serves as a moderating factor. Its calculation combines two indicators: recent alarm frequency and network load. Alarm frequency is the number of alarms in the past hour, and network load is the port utilization rate of the core switch. Both indicators are standardized to values ​​between 0 and 1, and a weighted sum is used to obtain the security situation level, with weights of 0.6 and 0.4 respectively. The situation level ranges from 0.5 to 1.5, with higher values ​​indicating a more severe network security situation. The overall threat index is calculated as: Initial Threat Index × Security Situation Level. This adjustment enables the linkage between threat assessment and real-time network status.

[0034] After the comprehensive threat index is generated, it is compared with the dynamically adjusted detection threshold to determine whether the current session constitutes an intrusion. The detection threshold is determined based on a base detection threshold, which is determined by statistically analyzing the distribution of the comprehensive threat index of historical normal sessions, taking 1.2 times the maximum value of the normal session index as the initial base threshold. During dynamic adjustment, network traffic load and business criticality level are monitored in real time. Network traffic load is obtained by collecting the core link bandwidth utilization rate through traffic probes, with an initial threshold of 80%. When the utilization rate exceeds this value, the base threshold is lowered by 10% to improve detection sensitivity and avoid missed detections under high load. Business criticality level is classified according to the importance of the operated equipment. Main transformer protection devices, bus protection devices, etc., are classified as Level 1 critical equipment, with a corresponding second threshold of Level 1. When the target of the operation is this type of equipment, the base threshold is raised by 15% to reduce the impact of false alarms on critical services. Simultaneously, the false alarms and missed alarms over the past 24 hours are statistically analyzed. The false alarm rate is calculated as the ratio of the number of false alarms to the total number of alarms. A third threshold is set at 10%. When the false alarm rate exceeds this value, the base threshold is slightly adjusted upwards by 5%; when a missed alarm event is confirmed, the base threshold is slightly adjusted downwards by 8%. Each adjusted threshold is recorded with the adjustment time, reason, and adjustment range, forming a threshold adjustment log.

[0035] When the overall threat index exceeds the detection threshold, the current session is determined to be an intrusion, and the alarm generation module immediately generates an alarm signal. The alarm signal employs a three-level alarm mechanism, determining the alarm level based on the difference between the overall threat index and the threshold: a difference between 0 and 0.2 indicates a Level 3 alarm, notifying junior security personnel via system pop-ups and SMS; a difference between 0.2 and 0.5 indicates a Level 2 alarm, triggering a voice prompt and notifying the security supervisor in addition to the above methods; a difference exceeding 0.5 indicates a Level 1 alarm, immediately cutting off the communication link corresponding to the intrusion session and simultaneously initiating the emergency response process, notifying the power grid security emergency command team. All alarm information includes core information such as session identifier, attack type, threat index, involved devices, and timestamp, stored in the alarm database for subsequent retrieval.

[0036] Upon alarm generation, the intrusion tracing process is initiated. First, the structured session data of the session is locked. Complete records are extracted from the database using the session identifier, and the source IP address, target IP address, timestamps of each operation, and corresponding function codes are filtered to form an initial chain of evidence. The network asset database stores asset information for all devices, including the correspondence between IP addresses and device models, installation locations, responsible persons, and departments, as well as the device's connection path in the network topology. The database is queried using the source IP address to determine the physical device corresponding to the attack source. If it is a portable maintenance terminal, the terminal's MAC address and most recent access authentication information are also extracted; if it is a network device, the device's firmware version and configuration information are obtained to form the attack source's identity information. Subsequently, all operation commands received by the target IP address in the past 24 hours are traced back. Filtering is performed using the source IP address and a time window (30 minutes before and after the alarm) to obtain related operations initiated by the same attack source. These are arranged chronologically to form an attack sequence, clarifying the attack steps and target evolution process. Finally, the initial chain of evidence, the identity information of the attack source, and the attack sequence are imported into the report generation module, which automatically generates a source tracing report containing an attack overview, evidence details, attack path, and handling suggestions. The report supports export and printing in PDF format.

[0037] To adapt to changes in power business models and the emergence of new attacks, this embodiment also includes an adaptive learning step. The incremental training dataset is collected weekly, including newly generated normal business traffic data and session data corresponding to false alarms confirmed by the security administrator, with a data volume of no less than 10,000 records. An incremental learning algorithm based on stochastic gradient descent is used to update the behavioral baseline model. Each update trains only on new samples, calculating new cluster centers and fluctuation range thresholds, which are then fused with the original model parameters. The fusion weights are determined based on the proportion of new samples to the total number of samples to avoid catastrophic forgetting in the model. For confirmed real intrusion behaviors, unique feature patterns are extracted using feature mining algorithms, such as abnormal function code combinations and specific traffic statistics. Based on these features, new candidate detection rules are automatically generated. The rule format adopts a "condition-action" form, where the condition is a combination of features and the action is the processing method after matching. After the candidate rules are generated, they are submitted to the security administrator's review interface. The administrator compares them with the existing rule base and attack feature analysis, confirms that there are no duplicates and that the rules are valid, and then adds them to the power business compliance rule base, recording the rule addition time and reviewer information.

[0038] Example 2 like Figure 2 As shown, this embodiment provides an intrusion detection system that implements the above method. The system adopts a distributed architecture design and is deployed in the provincial power grid dispatch center and its subordinate 220kV smart substations. Data interaction and collaborative work are achieved through the dispatch data network. The system is divided into a front-end acquisition layer, a middle processing layer, and a back-end application layer, encompassing a traffic acquisition and parsing module, a multi-dimensional feature extraction module, a parallel analysis module, a decision fusion module, an alarm generation module, and a baseline modeling module. Each module transmits data via high-speed Ethernet and message queues, with transmission latency controlled within 50 milliseconds, meeting the real-time requirements of the power monitoring system.

[0039] The traffic acquisition and parsing module is the system's data entry point, consisting of two parts: a traffic probe and a parsing server. The traffic probe adopts an industrial-grade hardware design, equipped with an Intel Xeon D-2141I processor and a 10Gbps SFP+ optical port, supporting a wide operating temperature range to adapt to substation conditions. The probe has a built-in dedicated acquisition chip, enabling line-speed acquisition without packet loss. The probe deployment adopts a "distributed acquisition + centralized management" model, with 2-3 probes deployed at each substation, each corresponding to a different critical link. All probes are configured through a unified probe management platform, allowing remote setting of acquisition parameters, starting or stopping acquisition tasks, and synchronizing timestamps. The parsing server adopts a dual-machine hot standby architecture, with each server configured with two Intel Xeon Gold 6330 processors and 128GB of memory to ensure stable parsing performance. The server runs parsing software optimized based on an open-source parsing engine, supporting the parsing of mainstream power communication protocols such as IEC60870-5-101 / 104 and DL / T634.5101 / 5104. The software has a built-in protocol knowledge base and can be updated online to obtain parsing rules for new protocols. A multi-threaded parallel processing mechanism is used during parsing, allocating parsing tasks for different sessions to different threads. Parsed data is then sent to the multi-dimensional feature extraction module via a message queue implemented using RabbitMQ to ensure reliable data transmission.

[0040] The multi-dimensional feature extraction module is deployed in a feature server cluster at the intermediate processing layer, consisting of three high-performance servers, with task distribution achieved through a load balancer. Each server is equipped with an AMD EPYC7763 processor and 256GB of memory, supporting the AVX2 instruction set to accelerate feature computation. The module has a built-in feature extraction engine, which includes three parallel processing units: a temporal feature computation unit, a distributed feature computation unit, and a statistical feature computation unit. The temporal feature computation unit is specifically responsible for calculating the edit distance, implemented using an optimized Levenstein algorithm, reducing the algorithm's time complexity from O(n^2). 2 The algorithm is optimized to O(n) to improve the processing efficiency of long sequences. The distribution feature calculation unit uses a vector operation library to quickly calculate cosine similarity, supporting parallel processing of batch feature vectors. The statistical feature calculation unit calculates session traffic statistics in real time using a sliding window algorithm, with the window size dynamically adjusted according to the session type. After feature extraction, the feature fusion unit performs standardization and feature combination. Standardization uses the Z-score method to convert each feature value into a value with a mean of 0 and a standard deviation of 1. The fused feature vector is sent to the parallel analysis module via a RESTful API, and SSL encryption is used during transmission to ensure data security.

[0041] The parallel analysis module is the core processing module of the system, consisting of a rule engine server and a model inference server. These two types of servers are connected via a high-speed fiber optic switch to achieve parallel data processing. The rule engine server deploys a power business compliance rule base system developed based on the Drools rule engine. The rule base uses an in-memory database for storage and supports millisecond-level rule matching. The rule base system includes a rule management interface, through which security administrators can add, modify, delete, and enable / disable rules. Rule modifications are synchronized to the rule engine in real time without requiring a service restart. The rule matching process uses the Rete algorithm, constructing a rule network to achieve rapid matching of features and rules. The matching results, including the matching status and details of the matched rules, are pushed to the decision fusion module in real time.

[0042] The model inference server employs a GPU-accelerated architecture, with each server configured with four NVIDIA A10 GPU cards, supporting parallel model inference. The behavioral baseline model is deployed on the inference server, developed using the TensorFlow framework, and its files are stored in a distributed file system to ensure high availability. The inference server has a built-in model management module responsible for loading, unloading, and version control of models, supporting hot updates without affecting the execution of existing detection tasks. During model inference, the CUDA cores of the GPU are used to perform parallel calculations of the distance between feature vectors and cluster centers, keeping inference latency below 10 milliseconds to meet real-time detection requirements. After inference, anomaly deviation scores and corresponding clustering matching information are output and sent to the decision fusion module via a message queue.

[0043] The decision fusion module is deployed on the core server of the backend application layer, employing a primary-backup dual-machine architecture to enhance system reliability. The core server is equipped with an Intel Xeon Platinum 8375C processor and 512GB of memory, running a Linux operating system and a real-time database. The module integrates a weight allocation unit, a situation assessment unit, and an index calculation unit. The weight allocation unit stores weight parameters determined using the analytic hierarchy process (AHP), allowing administrators to fine-tune them via a configuration interface. The situation assessment unit obtains network load data by calling the network management system's API and extracts recent alarm frequency information from the alarm database to calculate the security situation level in real time. The index calculation unit calculates the comprehensive threat index based on a linear weighting formula and adjustment factors, writing the results to the real-time database in real time. The database uses time-series data storage, supporting efficient querying and statistical analysis. The decision fusion module communicates with the alarm generation module via a long TCP connection to ensure real-time transmission of threat index data.

[0044] The alarm generation module consists of an alarm processing unit, a threshold management unit, and a notification unit, deployed on the alarm server at the backend application layer. The alarm processing unit receives the comprehensive threat index and compares it with a dynamic detection threshold, which is provided in real-time by the threshold management unit. The threshold management unit has a built-in threshold calculation engine that dynamically adjusts the threshold based on network load, business criticality level, and false positive / false negative statistics, while maintaining a threshold adjustment log that supports querying and exporting. When an intrusion is detected, the alarm processing unit generates an alarm event containing complete information and sends it to the notification unit. The notification unit supports multiple alarm methods: SMS notification via integrated SMS gateway, email notification via SMTP service, and voice prompts via interface with a voice alarm device. It also generates pop-up alarms on the system monitoring interface. For level-one alarms, the notification unit also triggers an emergency linkage interface to send instructions to the dispatch automation system to cut off the communication link corresponding to the intrusion session.

[0045] The offline training and maintenance of the behavioral baseline model in the parallel analysis module is handled by the baseline modeling module. This module is deployed on a separate modeling server cluster, physically isolated from the production environment, and obtains training data from the traffic acquisition system through a dedicated data interface. The baseline modeling module includes a training data acquisition unit, a feature vector construction unit, a clustering analysis unit, a fluctuation range calculation unit, and a model update unit. These units interact via a data bus. The training data acquisition unit collects normal business traffic data within the safety confidence period, and removes duplicate and noisy data through a data cleaning sub-unit to ensure the quality of the training samples. The feature vector construction unit uses the same feature extraction algorithm as the multi-dimensional feature extraction module to ensure consistency between training and detection features. The clustering analysis unit uses an optimized K-means algorithm, improving the accuracy of clustering results by introducing a density factor to improve the selection of initial cluster centers. The fluctuation range calculation unit calculates the average distance and also calculates the standard deviation of the distance, providing a reference for subsequent model updates. The model update unit periodically collects incremental training data from the production environment, updates model parameters using an incremental learning algorithm, and synchronizes the updated model to the model inference server through a dedicated transmission channel. A verification mechanism is used during the synchronization process to ensure model integrity.

[0046] The system also includes supporting modules to ensure overall functionality. The network asset database module uses an Oracle database to store asset information, network topology information, and IP address allocation information for all devices in the power monitoring network. It supports batch import and manual maintenance of asset information, and the database employs a scheduled backup strategy to ensure data security. The log management module collects operation logs, management logs, and alarm logs from each module of the system. Log data is stored in a distributed log system and supports multi-dimensional queries by time, module, log level, etc., with a log retention period of 180 days. The system management module provides a unified web management interface, through which administrators can manage users, assign permissions, configure modules, and monitor the system. It supports role-based access control, with different roles having different operating permissions to ensure system management security. Furthermore, the system has a self-diagnostic function, periodically checking the operating status of each module, network connectivity, and hardware health. When an anomaly is detected, it automatically generates a system fault alarm to notify maintenance personnel for handling.

[0047] As is known from common technical knowledge, this invention can be implemented through other embodiments that do not depart from its spirit or essential characteristics. Therefore, the disclosed embodiments described above are merely illustrative in all respects and are not the only ones. All modifications within the scope of this invention or its equivalents are included in this invention.

Claims

1. A traffic analysis based power monitoring system intrusion detection method, characterized in that, The method comprises the following steps: Collecting raw network traffic data in a power monitoring network, performing protocol analysis and session recombination on the raw network traffic data to obtain structured session data; Extracting time sequence behavior features reflecting power business operation sequences and function code distribution features reflecting business function calls from the structured session data to obtain a multi-dimensional behavior feature set; simultaneously inputting the multi-dimensional behavior feature set into a pre-defined power business compliance rule library and a behavior baseline model trained based on normal traffic for parallel analysis, the power business compliance rule library outputting rule matching results, and the behavior baseline model outputting an abnormal deviation degree score; Based on the rule matching results and the abnormal deviation degree score, a comprehensive threat index is generated using a weighted decision fusion strategy; when the comprehensive threat index exceeds a dynamically adjusted detection threshold, the current session is determined to be an intrusion behavior, and an alarm signal is generated.

2. The traffic analysis based power monitoring system intrusion detection method of claim 1, wherein, The step of collecting raw network traffic data in a power monitoring network, performing protocol analysis and session recombination on the raw network traffic data to obtain structured session data specifically comprises: Mirroring network data packets collected by a traffic probe deployed at a key node of the power monitoring network to obtain raw network traffic data; Performing deep packet inspection on the raw network traffic data to identify and strip out application layer loads to obtain application layer messages; decoding the application layer messages based on the specifications of industrial communication protocols to analyze protocol types, function codes, and data area contents to obtain protocol analysis results; Using the Internet protocol addresses and port numbers of both communication parties as session identifiers, merging and sorting the protocol analysis results belonging to the same communication process in chronological order to reconstruct complete business session sequences to obtain the structured session data.

3. The traffic analysis based power monitoring system intrusion detection method of claim 1, wherein, The step of extracting time sequence behavior features reflecting power business operation sequences and function code distribution features reflecting business function calls from the structured session data to obtain a multi-dimensional behavior feature set specifically comprises: Extracting function codes of consecutive multiple business operations from the structured session data to form an operation sequence, calculating the edit distance between the operation sequence and a pre-stored standard operation rule sequence to obtain a sequence abnormality index; Statistically counting the occurrence frequencies of each function code within a current session period to construct a function code frequency vector, calculating the cosine similarity between the function code frequency vector and a historical normal session function code reference vector to obtain a distribution consistency index; Extracting the duration, packet quantity, and packet size distribution statistics of a session to form session traffic statistical features; Combining the sequence abnormality index, the distribution consistency index, and the session traffic statistical features to form the multi-dimensional behavior feature set.

4. The traffic analysis based power monitoring system intrusion detection method of claim 1, wherein, The step of generating a comprehensive threat index using a weighted decision fusion strategy based on the rule matching results and the abnormal deviation degree score specifically comprises: Assigning a first weight to the rule matching results, the rule matching results being binary values, taking a value of 1 if any pre-defined intrusion rule is matched, and 0 otherwise; assigning a second weight to the anomaly deviation score, the anomaly deviation score being a continuous value between 0 and 1; adding the weighted rule matching result and the weighted anomaly deviation score using a linear weighting formula to obtain an initial threat index; introducing a current security posture level of the network as an adjustment factor, the security posture level being dynamically calculated according to a recent alarm frequency and a network load; scaling the initial threat index using the adjustment factor to obtain a final comprehensive threat index.

5. The traffic analysis based power monitoring system intrusion detection method of claim 1, wherein, The training step of the behavior baseline model trained based on normal traffic specifically comprises: collecting a large amount of normal power traffic data during system initialization or a security confidence period to form a training sample set; extracting all features contained in the multi-dimensional behavior feature set from the training sample set to form a feature vector; performing clustering analysis on the feature vector using an unsupervised learning algorithm to identify multiple normal business operation modes and determine the clustering center of each mode in the feature space; calculating the average distance of all sample points in each cluster to the clustering center thereof as a normal fluctuation range threshold of the cluster; When the behavior baseline model is detected, the distance of the input feature vector to all clustering centers is calculated, the minimum distance value is taken, and the minimum distance value is compared with the normal fluctuation range threshold of the corresponding cluster to calculate the anomaly deviation score.

6. The traffic analysis based power monitoring system intrusion detection method of claim 1, wherein, After the method generates an alarm signal, it further comprises an intrusion behavior tracing step: When the intrusion behavior is determined, the structured session data generating the session is immediately locked to extract the source Internet protocol address, target Internet protocol address, operation timestamp, and specific function code operation performed therefrom to form an initial evidence chain; querying a network asset database to obtain physical device information corresponding to the source Internet protocol address and its position in the network topology to obtain attack source identity information; backtracking to query all operation instructions recently accepted by the target Internet protocol address to filter out associated operations initiated by the same attack source in time proximity to obtain an attack sequence; integrating the initial evidence chain, attack source identity information, and attack sequence to generate a complete attack tracing report.

7. The traffic analysis based power monitoring system intrusion detection method of claim 4, wherein, The determination step of the dynamically adjusted detection threshold specifically comprises: setting a basic detection threshold; real-time monitoring of network traffic load and business criticality level, when the network traffic load exceeds a first set threshold, the basic detection threshold is lowered to obtain higher detection sensitivity, when the business criticality level exceeds a second set threshold, the basic detection threshold is raised to reduce false positives for critical business; statistically counting the number of false positives confirmed by security administrators in recent alarm signals, when the false positive rate exceeds a third set threshold, the basic detection threshold is adjusted upward, when a missed alarm event is confirmed, the basic detection threshold is adjusted downward; the threshold dynamically adjusted by the above factors is taken as the final detection threshold.

8. The traffic analysis based power monitoring system intrusion detection method of claim 1, wherein, The method further comprises an adaptive learning step: periodically collecting newly generated normal business traffic data and confirmed false alarm data to form an incremental training data set; Incrementally learning the behavior baseline model trained based on normal traffic using the incremental training data set, updating parameters of the behavior baseline model to adapt the behavior baseline model to slow drift of power business mode; Analyzing the feature mode of the confirmed real intrusion behavior, and automatically generating a new candidate detection rule based on the feature mode when it shows new features not covered by existing rules, and adding the candidate detection rule to the predefined power business compliance rule library after being reviewed by a security administrator.

9. A traffic analysis based power monitoring system intrusion detection system for implementing a traffic analysis based power monitoring system intrusion detection method according to any one of claims 1 to 8, characterized in that, Comprise: a traffic collection and analysis module, a multi-dimensional feature extraction module, a parallel analysis module, a decision fusion module and an alarm generation module; The traffic collection and analysis module is used to collect original network traffic data in the power monitoring network, perform protocol analysis and session reorganization on the original network traffic data, obtain structured session data, and send the structured session data to the multi-dimensional feature extraction module; The multi-dimensional feature extraction module is used to extract time sequence behavior features reflecting power business operation sequences and function code distribution features reflecting business function calls from the received structured session data, obtain a multi-dimensional behavior feature set, and send the multi-dimensional behavior feature set to the parallel analysis module; The parallel analysis module is used to simultaneously input the received multi-dimensional behavior feature set to a predefined power business compliance rule library and a behavior baseline model trained based on normal traffic for parallel analysis, so that the power business compliance rule library outputs a rule matching result and the behavior baseline model outputs an abnormal deviation score, and the rule matching result and the abnormal deviation score are sent to the decision fusion module; The decision fusion module is used to generate a comprehensive threat index based on the received rule matching result and abnormal deviation score using a weighted decision fusion strategy, and send the comprehensive threat index to the alarm generation module; The alarm generation module is used to compare the received comprehensive threat index with a dynamically adjusted detection threshold, and determine that the current session is an intrusion behavior when the comprehensive threat index exceeds the detection threshold, and generate an alarm signal.

10. The traffic analysis based power monitoring system intrusion detection system of claim 9, wherein, The behavior baseline model trained based on normal traffic integrated in the parallel analysis module is specifically trained and maintained offline by a baseline modeling module; The baseline modeling module comprises: a training data collection unit configured to collect a large amount of normal power business traffic data to form a training sample set during system initialization or a security confidence period; a feature vector construction unit connected to the training data collection unit and configured to extract all features contained in the multi-dimensional behavior feature set from the training sample set to form a feature vector; a clustering analysis unit connected to the feature vector construction unit and configured to perform clustering analysis on the feature vector using an unsupervised learning algorithm, identify a plurality of normal business operation modes, and determine a clustering center of each mode in a feature space; a fluctuation range calculation unit, connected to the cluster analysis unit, configured to calculate the average distance of all sample points in each cluster to the cluster center thereof as the normal fluctuation range threshold of the cluster; a model updating unit configured to periodically collect newly generated normal traffic data, incrementally update the traffic operation mode and the normal fluctuation range threshold thereof identified by the cluster analysis unit, and synchronize the updated model parameters to the behavior baseline model in the parallel analysis module.

Images