A method and system for anomaly identification in power control terminals based on contrastive learning

Abstract

This invention relates to a method and system for anomaly identification in power control terminals based on contrastive learning, belonging to the field of network data security technology. It solves the problem that existing technologies cannot effectively mine complex abnormal behaviors in power control data. The method includes: dividing network traffic at the data interaction interface into multiple time sliding windows, extracting multi-dimensional traffic features to obtain data interaction feature vectors; constructing a time-series feature graph using the data interaction feature vectors and constructing positive and negative contrast samples, and performing contrastive learning training on a graph attention network model; generating an embedding vector for each sliding window using the encoder of the pre-trained graph attention network model, scoring all sliding windows for anomalies based on the embedding vectors, and identifying sliding windows with abnormal data interaction behavior. This invention combines graph learning, contrastive learning, and time-series modeling techniques to provide a high-precision, low-dependency, and highly generalizable anomaly identification and control method.

Description

Technical Field

[0001] This invention relates to the field of network data security technology, and in particular to a method and system for anomaly identification of power control terminals based on contrastive learning. Background Technology

[0002] Power control terminals are one of the core devices in power system operation, widely used for real-time monitoring, dispatching, and control of power equipment. Their data interaction primarily involves communication and information exchange between the terminal and the control system. Due to the openness of the power control terminal's communication interface with the outside world, its data interaction is highly susceptible to interference from abnormal behaviors (such as misconfiguration, network attacks, or equipment failures). Furthermore, because power control terminal data interaction needs to be real-time and efficient, any delay or abnormal behavior can severely impact power system operation. Therefore, establishing an efficient data interaction anomaly identification mechanism is crucial for ensuring the safe operation of power control terminals.

[0003] Data interaction anomaly identification is a key technology in power system security monitoring. It aims to analyze and model data interaction behavior to promptly detect abnormal behavior and take corresponding measures to avoid potential security risks. With the development of artificial intelligence technology, it has become possible to automatically identify data interaction anomalies through machine learning models. However, some commonly used data interaction anomaly identification models also have some significant shortcomings.

[0004] First, the abnormal behavior of power control terminals typically manifests in nonlinear relationships across multiple dimensions (including but not limited to data transmission volume, periodicity, volatility, and deviation), and this abnormal behavior may exhibit non-static change patterns over time. Traditional static modeling methods struggle to adapt to this high dynamism, and traditional single-feature or shallow models are also ill-suited for effectively uncovering deep-seated temporal dependencies and feature coupling relationships, thus failing to accurately identify complex abnormal behaviors. Second, the real-time nature and structural complexity of power control terminal data interaction behaviors make labeling anomaly and normal data costly and difficult to cover all anomaly types, resulting in a general scarcity of labeled data. With limited labeled samples, purely supervised or deep models are prone to overfitting and noise sensitivity, impacting recognition performance. Therefore, existing technologies for identifying abnormal interactions in power control terminal data generally face challenges such as insufficient labeled data, difficulty in modeling feature relationships, ambiguous anomaly boundaries, and poor model robustness. Summary of the Invention

[0005] Based on the above analysis, the embodiments of the present invention aim to provide a method and system for identifying anomalies in power control terminals based on contrastive learning, in order to solve the problem that existing technologies cannot effectively mine complex abnormal behaviors in power control data.

[0006] On one hand, embodiments of the present invention provide a method for anomaly identification in power control terminals based on contrastive learning, the method comprising the following steps:

[0007] The network traffic of the power control terminal data interaction interface is divided into multiple time sliding windows. Multi-dimensional traffic features of data interaction behavior in each sliding window are extracted to obtain the data interaction feature vector of each sliding window.

[0008] Construct a time-feature map using each sliding window and its data interaction feature vectors, and construct positive and negative contrast samples;

[0009] The graph attention network model is trained by contrastive learning using temporal feature maps and positive and negative contrast samples to obtain an encoder for the graph attention network model that can enhance the embedding representation of the sliding window;

[0010] The encoder of the pre-trained graph attention network model generates the embedding vector for each sliding window. Based on the embedding vector, all sliding windows are scored for anomalies, and sliding windows with abnormal data interaction behavior are identified.

[0011] Based on a further improvement to the above method, the method further includes the following steps:

[0012] For a new sliding window obtained from newly generated data traffic, extract multi-dimensional traffic features of the data interaction behavior of the new sliding window to obtain the data interaction feature vector of the new sliding window;

[0013] Integrate the data interaction feature vector of the new sliding window into the existing time-series feature map;

[0014] Incremental inference is performed in the pre-trained graph attention network model to compute the embedding vector of the new sliding window;

[0015] Anomaly score is applied to the new sliding window based on the embedding vector to determine whether the new sliding window is abnormal.

[0016] Based on further improvements to the above method, the multi-dimensional traffic characteristics include traffic characteristics in four dimensions: data transmission volume, deviation, periodicity, and volatility.

[0017] By performing z-score normalization on the traffic features of each dimension, we obtain the data interaction feature vectors for each sliding window.

[0018] Based on a further improvement of the above method, the construction of the time-series feature map includes the following steps:

[0019] Each sliding window is used as a node in the time-feature map;

[0020] Connect any two sliding window nodes that are adjacent in time using a time adjacency edge;

[0021] Calculate the similarity of the data interaction feature vectors of each sliding window, and connect multiple sliding window nodes with high similarity through feature similarity edges;

[0022] By combining time dependence and feature similarity, weight parameters are set for each edge to obtain a weighted time-series feature map.

[0023] Based on a further improvement of the above method, the construction of positive and negative comparison samples includes the following steps:

[0024] By applying two random perturbations to each node in the time-series feature map, positive samples are obtained from the two perturbation views.

[0025] Randomly select other node views in the time-series feature map as negative samples for the current node, and combine them to obtain positive and negative comparison samples at the node level and subgraph level.

[0026] Based on a further improvement of the above method, the two random perturbations include applying Gaussian noise and randomly occluding a portion of the dimension.

[0027] Based on the further improvement of the above method, the comparative learning training of the graph attention network model includes the following steps:

[0028] The temporal-feature map and positive-negative contrast samples are input into the graph attention network model to extract the node embedding vectors represented by the encoder;

[0029] The node embedding vectors are mapped to the contrast space through a multilayer perceptron. The contrast loss function NT-Xent is used to optimize the model and obtain encoder optimization parameters that make the embedding distances of positive samples of the same node close and the embedding distances of negative samples widen.

[0030] Based on a further improvement of the above method, the extraction of the node embedding vector represented by the encoder includes the following steps:

[0031] For each node in the time-feature map , has feature vector Positive samples negative samples ;

[0032] Obtain node feature vectors linear transformation ,in It is a learnable weight matrix;

[0033] According to the node with neighbors Calculate unnormalized attention weights ;in, It is a learnable parameter vector. This indicates a feature concatenation operation. Represents nodes The feature vector is closest to the previous A set of neighboring nodes, Representing neighboring nodes Feature vector Linear transformation;

[0034] Nodes in the time-feature graph with neighbors edge weight Fusion computation normalized attention coefficient ;

[0035] Aggregate time series - nodes in feature graph The node that receives the attention of all its neighbors Embedded vector ;in, It is the ReLU activation function.

[0036] Based on the further improvement of the above method, the optimization of the model using the contrastive loss function NT-Xent includes the following steps:

[0037] For each node in the time-feature map The NT-Xent loss is calculated as follows:

[0038] ;

[0039] in, It is a node Positive samples Mapping in contrasting spaces, It is a node negative samples Mapping in contrasting spaces, It is any two vectors The cosine similarity calculation function, It is a temperature parameter;

[0040] The total loss is the average of the losses of all nodes. The optimization result of the model is obtained by minimizing the total loss.

[0041] Based on a further improvement to the above method, the anomaly scoring is performed by the computing node. Local outlier (LOF):

[0042] ;

[0043] in, and They are nodes with neighbors Locally achievable density, Represents nodes The feature vector is closest to the previous A set of neighboring nodes;

[0044] Locally achievable density ,in For nodes with neighbors The reachable distance is , For nodes with neighbors Embedding vector distance, For all neighbors and nodes The first of all embedding vector distances Small distance value.

[0045] Based on a further improvement to the above method, the method further includes the following steps:

[0046] when At that time, determine the node The sliding window it represents is normal;

[0047] when At that time, determine the node The sliding window it represents exhibits abnormal data interaction behavior.

[0048] Based on a further improvement to the above method, the method further includes the following steps:

[0049] Obtain the LOF score set of normal nodes as follows ;

[0050] make The 25th percentile of L, Define the interquartile range as the 75th percentile of L. ;

[0051] Set the anomaly detection threshold as follows ;

[0052] when At that time, determine the node The sliding window it represents exhibits abnormal data interaction behavior.

[0053] Based on a further improvement to the above method, the method further includes the following steps:

[0054] Based on abnormal scores and anomaly detection threshold Dynamically adjusting interface permissions includes:

[0055] ;

[0056] in, express Access permissions are dynamically adjusted for the interface in real time. This indicates full permissions. This indicates a downgrade in privileges. Indicates isolation permissions.

[0057] On the other hand, embodiments of the present invention provide a power control terminal anomaly identification system based on contrastive learning, the system comprising:

[0058] The feature extraction module is used to divide the network traffic of the power control terminal data interaction interface into multiple time sliding windows, extract multi-dimensional traffic features of the data interaction behavior of each sliding window, and obtain the data interaction feature vector of each sliding window.

[0059] The sample construction module is used to construct a time-feature map and build positive and negative contrast samples using each sliding window and its data interaction feature vectors.

[0060] The model training module is used to perform comparative learning training on the graph attention network model using temporal-feature maps and positive-negative contrast samples, to obtain an encoder for the graph attention network model that can enhance the embedding representation of the sliding window;

[0061] The anomaly detection module is used to generate an embedding vector for each sliding window using the encoder of the pre-trained graph attention network model, score all sliding windows for anomalies based on the embedding vectors, and identify sliding windows with abnormal data interaction behavior.

[0062] Based on further improvements to the above system, the system also includes:

[0063] The feature extraction module is also used to extract multi-dimensional traffic features of the data interaction behavior of the new sliding window obtained from the newly generated data traffic, and obtain the data interaction feature vector of the new sliding window.

[0064] The graph update module is used to integrate the data interaction feature vector of the new sliding window into the existing time-series feature graph;

[0065] The incremental inference module is used to perform incremental inference in the pre-trained graph attention network model and compute the embedding vector of the new sliding window.

[0066] The anomaly detection module is also used to score the new sliding window based on the embedding vector to determine whether the new sliding window is abnormal.

[0067] Based on further improvements to the above system, the multi-dimensional traffic characteristics include four dimensions of traffic characteristics: data transmission volume, deviation, periodicity, and volatility.

[0068] By performing z-score normalization on the traffic features of each dimension, we obtain the data interaction feature vectors for each sliding window.

[0069] Based on further improvements to the above system, the sample construction module includes:

[0070] A node representation module is used to treat each sliding window as a node in the time-series-feature map;

[0071] The adjacency edge representation module is used to connect any two sliding window nodes that are temporally adjacent through temporal adjacency edges;

[0072] The similarity edge representation module is used to calculate the similarity of the data interaction feature vectors of each sliding window, and connect multiple sliding window nodes with high similarity through feature similarity edges.

[0073] The weight setting module is used to set weight parameters for each edge by combining time dependence and feature similarity, so as to obtain a weighted time-series feature map.

[0074] Based on further improvements to the above system, the sample construction module also includes:

[0075] The perturbation module is used to obtain positive samples formed by two perturbation views by applying two random perturbations to each node in the time-series-feature map;

[0076] The negative sample selection module is used to randomly select other node views in the time-series feature map as negative samples for the current node, and combine them to obtain positive and negative comparison samples at the node level and subgraph level.

[0077] Based on further improvements to the above system, the two random perturbations include applying Gaussian noise and randomly occluding a portion of the dimension.

[0078] Based on further improvements to the above system, the model training module includes:

[0079] The embedding representation module is used to input the temporal-feature map and positive-negative contrast samples into the graph attention network model and extract the node embedding vectors represented by the encoder.

[0080] The parameter optimization module is used to map the node embedding vectors to the contrast space through a multilayer perceptron, and optimize the model using the contrast loss function NT-Xent to obtain encoder optimization parameters that make the positive sample embedding distances of the same node close and the negative sample embedding distances widen.

[0081] On the other hand, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the power control terminal anomaly identification method based on contrastive learning as described above.

[0082] Compared with existing technologies, the present invention proposes a method and system for anomaly identification in power control terminals based on contrastive learning. Through contrastive learning of time-series feature graphs, it effectively addresses the key challenges in identifying data interaction anomalies in current power control terminals. First, the method constructs an information graph structure that integrates time dependence and feature similarity, abstracting data interaction behaviors across multiple time windows into nodes in the graph. Feature association edges are constructed through time sequence and feature similarity, thereby achieving joint modeling between multi-dimensional features and improving the ability to identify complex anomalies. Second, by generating perturbation views, constructing positive and negative contrast samples, and introducing a contrastive learning mechanism, robust embedding learning is achieved through a graph attention encoder and NT-Xent contrastive loss without requiring extensive manual annotation, significantly alleviating the problem of insufficient anomaly data samples. In summary, the embodiments of the present invention combine graph learning, contrastive learning, and time-series modeling techniques to provide a high-precision, low-dependency, and highly generalizable anomaly identification and control method for power control systems.

[0083] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0084] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0085] Figure 1 This is a schematic diagram of the process of an anomaly identification method for power control terminals based on contrastive learning in one embodiment of the present invention;

[0086] Figure 2 This is a schematic diagram of the preprocessing flow of power control data in a preferred embodiment of the present invention;

[0087] Figure 3 This is a schematic diagram of a model architecture for contrastive learning based on time-series feature maps in a preferred embodiment of the present invention;

[0088] Figure 4This is a flowchart illustrating the process of dynamically adjusting access control permissions for data interaction interfaces in a preferred embodiment of the present invention.

[0089] Figure 5 This is a schematic diagram of the actual traffic data of the control terminal data interaction interface in a preferred embodiment of the present invention;

[0090] Figure 6 This is a schematic diagram illustrating the extraction of multi-dimensional traffic features of data interaction behavior of each sliding window in a preferred embodiment of the present invention.

[0091] Figure 7 This is a schematic diagram illustrating the change in NT-Xent contrast loss value in a preferred embodiment of the present invention;

[0092] Figure 8 This is a schematic diagram of the anomaly identification results of each time sliding window in a preferred embodiment of the present invention. Detailed Implementation

[0093] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0094] Due to the real-time nature and complex structure of data interaction behavior in power control terminals, the cost of labeling abnormal and normal data is high and it is difficult to cover all anomaly types, resulting in a general scarcity of labeled data. Furthermore, interaction behavior often manifests as nonlinear correlations between multidimensional features, making it difficult for traditional methods to effectively uncover deep-seated temporal dependencies and feature coupling relationships.

[0095] To address the aforementioned problems, this invention proposes a method and system for anomaly identification in power control terminals based on contrastive learning. This method integrates multi-dimensional feature modeling, contrastive learning, and graph neural networks, combining a sliding window and incremental inference mechanism to achieve efficient modeling and dynamic identification of abnormal data, thereby significantly improving the accuracy and practicality of anomaly identification in power control terminals. Specifically, as... Figure 1 As shown, this embodiment of the invention provides a method for anomaly identification in power control terminals based on contrastive learning. The method includes the following steps:

[0096] S11, the network traffic of the power control terminal data interaction interface is divided into multiple time sliding windows, and the multi-dimensional traffic features of the data interaction behavior of each sliding window are extracted to obtain the data interaction feature vector of each sliding window.

[0097] S12, construct a time-feature map using each sliding window and its data interaction feature vector, and construct positive and negative contrast samples;

[0098] S13, Use temporal-feature maps and positive-negative contrast samples to perform comparative learning training on the graph attention network model to obtain an encoder for the graph attention network model that can enhance the embedding representation of the sliding window;

[0099] S14: The encoder of the pre-trained graph attention network model generates the embedding vector for each sliding window. Based on the embedding vector, all sliding windows are scored for abnormality to identify sliding windows with abnormal data interaction behavior.

[0100] In embodiments of the present invention, the network traffic of the power control terminal data interaction interface is first analyzed by a time sliding window to effectively capture the time series characteristics of power data interaction; at the same time, multi-dimensional feature extraction is performed to comprehensively capture data interaction behavior patterns, thereby improving the accuracy, precision and robustness of anomaly detection.

[0101] Specifically, such as Figure 2 As shown, in this embodiment of the invention, based on a preset time period length, such as the time resolution (sampling period) or business monitoring granularity requirements of power control terminal data acquisition and interaction, a fixed time period length Δt (e.g., 5 minutes or 15 minutes) is preset. The total observation time of data interaction behavior with a total time length of T is divided into N equally spaced time periods according to the time period Δt. ,get The network traffic representing data interaction behavior within each time period is as follows: That is, the i-th time period Internal data traffic is , In general, power control terminals collect network traffic data at a fixed sampling period. The time period length Δt should be consistent with the sampling period or an integer multiple thereof to ensure the continuity of the time series. Under certain specific needs, the time period length can also be set according to the specific scenario and requirements: if it is necessary to detect short-term sudden anomalies and the sensitivity requirement for anomaly detection is high, a smaller Δt (such as 1 minute, half a minute, or even accurate to the second or millisecond level) can be selected; if more attention is paid to long-term trends, a larger Δt (such as 15 minutes) can be selected.

[0102] Then, a time sliding window is formed by W time intervals, and each time the window slides forward by S time intervals, the j-th sliding window... The included time periods are , , where n is the total number of sliding windows, and we have .

[0103] In a preferred embodiment of the present invention, assuming high sensitivity for anomaly detection, in an exemplary sliding window division description, if the total observation time is T=700 seconds, each second is a time interval (i.e., Δt=1s, N=700), the sliding window contains 5 time intervals (W=5), and each time interval is 2 time intervals (S=2), then the first time window is The second time window is And so on, resulting in a total of 348 sliding windows.

[0104] Subsequently, multi-dimensional traffic features of each sliding window are extracted. Preferably, traffic features of four dimensions are extracted: data transmission volume, deviation, periodicity, and volatility.

[0105] 1. For the j-th sliding window The data transmission volume is represented by the total amount of data transmitted through the network interface during the sliding window period (W time intervals). have:

[0106] ;

[0107] 2. The deviation is calculated from the standard deviation of the time period in which interactive behavior data exists. Deviation It is mainly used to characterize whether the time distribution of interactive data within a sliding window is uniform; assuming the j-th sliding window... First, identify all time periods (i.e., traffic) within that window where interactive behavior occurs. (For time periods that are not equal to 0), calculate the time interval sequence between these time periods, and then calculate the average of these intervals. Finally, calculate the standard deviation of these intervals relative to the mean, i.e., the deviation. ,have:

[0108] ;

[0109] in, t i and t i-1 These represent two adjacent data time points where interactive behavior occurs, and the difference between them is an interactive behavior interval (i.e., the duration during which no interactive behavior occurs; in the preferred embodiment of this invention, it is not represented by the actual time length, but indirectly by the number of time intervals). This represents the number of interactive actions (or valid intervals) that occurred within the window; no action intervals. It is the average of these intervals, the "average duration" without interactive behavior (as mentioned above, in the preferred embodiment of the invention, it is not expressed as the actual time length, but indirectly as the number of intervals in time periods); deviation This indicates the degree of fluctuation of these intervals around the average interval. Among them, ;

[0110] For example, suppose: sliding window ω j Includes 5 time periods (W=5);

[0111] The time periods are T1, T2, T3, T4, and T5; the corresponding flow rates are f = [0, 3.2, 0, 2.8, 3.0].

[0112] The time periods with interactive behavior are T2, T4, and T5, with time indices of [2, 4, 5].

[0113] The time interval between adjacent actions is:

[0114] [t2 t1,t4 t2,t5 t4]=[2,2,1];

[0115] The average interval without behavior (i.e., the average occurrence interval) is:

[0116] =(2+2+1) / 3=1.67;

[0117] Deviation is:

[0118] .

[0119] The results indicate that the intervals between interactive behaviors within the window fluctuate to some extent (the greater the deviation, the more irregular the interactive behaviors).

[0120] 3. Use the autocorrelation function to measure the periodicity of flow. :

[0121]

[0122] in, k The lag step represents the time difference between two observations; the average flow rate within the window. ;

[0123] 4. An adaptive threshold detection method based on a sliding window quantifies volatility by calculating the mean and standard deviation of the data within the window. For each sliding window The data within the window is used to calculate the average flow rate within that window. Further calculate the standard deviation of the flow rate. In this embodiment of the invention, the standard deviation of flow rate is used as a quantitative indicator of volatility characteristics, that is... This volatility characteristic can measure the degree of change in interface network traffic over a period of time.

[0124] To process multi-dimensional features at a unified scale, this embodiment of the invention further standardizes the multi-dimensional traffic features, ultimately obtaining data interaction feature vectors for each sliding window. Preferably, data standardization is implemented using z-score standardization, processing the four dimensions of traffic features—data transmission volume, deviation, periodicity, and volatility—into unified-scale data interaction feature vectors, resulting in:

[0125] ;

[0126] in, , Corresponding features average ,Right now ; Corresponding features The standard deviation, i.e. The standardized multi-dimensional traffic features are combined to obtain the data interaction feature vectors for each sliding window. .

[0127] In this embodiment of the invention, a time-series-feature graph structure is used to represent the temporal and feature relationships of each sliding window, enabling the machine learning model to simultaneously learn and mine temporal dependencies and feature coupling relationships. Specifically, each sliding window is treated as a node in the graph, and temporal adjacency edges are established based on the temporal relationships (chronological order) of the sliding windows, connecting two temporally adjacent sliding window nodes through temporal adjacency edges. Simultaneously, the similarity of the data interaction feature vectors of each sliding window is calculated, and multiple sliding window nodes with high similarity are connected through feature similarity edges. Finally, a weight parameter is set for each edge based on a combination of temporal dependencies and feature similarity to construct a weighted time-series-feature graph.

[0128] Optionally, similarity in the temporal-feature graph is evaluated by calculating the Euclidean distance between node features, and then nodes with similar features are connected based on the kNN (k-Nearest Neighbors) method.

[0129] Based on the data interaction feature vectors of each sliding window Stack the feature vectors of all sliding windows into a feature matrix:

[0130] ;

[0131] like Figure 3 As shown, each sliding window As a node in the time-feature map The set of nodes that make up the graph: As mentioned earlier, each node There are eigenvectors .

[0132] In this embodiment of the invention, the sliding window is constructed according to the chronological order, exhibiting temporal continuity. Therefore, short-term dependencies are captured through temporal adjacency edges. Specifically, two sliding window nodes that are temporally adjacent are connected by temporal adjacency edges, forming a set of temporal adjacency edges. have:

[0133] ;

[0134] Therefore, the temporal adjacency matrix is ​​constructed:

[0135] This is a sparse, symmetric, banded matrix.

[0136] To characterize the similarity relationship of data interaction behaviors between different sliding windows in the feature space and improve the graph structure's ability to perceive global behavior patterns, this embodiment of the invention further constructs feature similarity edges based on feature similarity. Preferably, the similarity edges between any two sliding window nodes are calculated. Features Euclidean distance between them:

[0137] ;

[0138] in, Indicates the first j The node of the first l There are eigenvalues, with , , , The calculated Euclidean distance between two node features is used to measure the similarity between sliding windows in multidimensional data behavior; the smaller the distance, the closer the behavior.

[0139] Then, based on the idea of ​​"nearest neighbor distance metric" (similar to the traditional kNN method), a system is established. Nearest neighbor connections are used to obtain the connection relationships between nodes in the feature space. In this embodiment of the invention, the Euclidean distance between the feature vectors of any two nodes (i.e., the sliding window) is calculated; for each node, the k nearest neighbor nodes with the most similar features are selected (i.e., only the k nearest neighbor nodes are retained), and feature similarity connections are established; this connection only reflects "similarity" rather than "category judgment", and is used to enhance the connectivity of the graph and the feature aggregation effect.

[0140] Described as for each node in the graph Select the one whose feature vector is closest to its own, excluding itself. A collection of node indexes And establish feature similarity edges for them, forming a feature similarity edge set:

[0141] ;

[0142] Feature similarity edges can effectively capture the similarity in behavioral patterns between discontinuous sliding windows, thereby enhancing the graph structure's ability to express potential behavioral clustering structures and providing richer contextual features for subsequent graph attention network model learning. A binary feature similarity matrix can also be constructed based on feature similarity edges.

[0143] ;

[0144] Therefore, the total set of edges in the time-series feature graph is the set of temporally adjacent edges. Edge set with feature similarity Union of: .

[0145] Finally, weight parameters are assigned to each edge based on both time dependency and feature similarity to construct a weighted graph structure; for each edge in the total edge set... The corresponding weights are:

[0146] ;

[0147] in, For hyperparameters, These are the weight coefficients for the feature similarity term. These are the weighting coefficients for time adjacency terms; The RBF kernel bandwidth is set to the median of the feature distance. This is used to control the sensitivity to feature distance. If the edge... If an edge is both temporally adjacent and feature-similar, then the weights of the two parts are added together; otherwise, only one term is non-zero. The final result is a symmetric edge weight matrix.

[0148] ;

[0149] The corresponding set of sparse edges is:

[0150] ;

[0151] The above method yields the node set of the weighted temporal-feature map. Edge set (i.e., selecting only sparse edges with weights greater than 0 from the total edge set) and the edge weight matrix A weighted time-feature map is constructed. .

[0152] In embodiments of the present invention, the values ​​of the hyperparameters α and β are used to balance the importance of "feature similarity" and "temporal dependence" in the weighted graph structure. Their typical or optimal values ​​are usually obtained through experimental verification and parameter tuning optimization. α and β primarily reflect the relative contributions of the two types of edges in the graph structure construction. When the temporal continuity of the system behavior is strong, the weight of β should be relatively large to highlight temporal adjacency relationships; when the system behavior is greatly influenced by multidimensional feature patterns, the weight of α should be large to strengthen feature similarity connections.

[0153] In a preferred embodiment of the present invention, during the initial stage of model training, a combination test is performed on a set of candidate values ​​(e.g., α, β ∈ [0, 1], and α + β = 1) using methods such as cross-validation or grid search. The optimal combination is selected based on performance metrics such as the model's anomaly detection accuracy, AUC, or F1 score on the validation set. Typical value range: empirically, α and β are often between 0.3 and 0.7. If time dependence and feature similarity are equally important, α = β = 0.5 can be set.

[0154] In order to effectively train machine learning models when labeled samples are scarce, embodiments of the present invention also construct positive and negative contrast samples by perturbation view.

[0155] The preferred approach is to generate two views by applying Gaussian noise and randomly occluding a portion of the dimension to each node, forming positive samples. Simultaneously, other node views are randomly selected as negative samples, thus constructing positive and negative comparison samples at both the node and subgraph levels.

[0156] To achieve unsupervised or weakly supervised node behavior representation learning, this invention introduces a contrastive learning approach. Positive and negative samples are constructed by artificially generating views, enabling the model to learn discriminative embedding representations. Specifically, starting from each graph node, two different observation views are constructed by perturbing the feature vector, serving as positive samples. Then, other node views in the graph are randomly sampled as negative samples, achieving contrastive training between nodes and between local graph structures.

[0157] Step 1: During the perturbation operation, the view after adding Gaussian noise perturbation is described as follows:

[0158]

[0159] in, It is a noise vector, representing the perturbation term of the features, which follows a pattern with a mean of 0 and a covariance of . A multidimensional Gaussian distribution It is an identity matrix.

[0160] Step 2: During the perturbation operation, add a random occlusion perturbation described as follows: Let... The occlusion vector is randomly generated, with the number of occlusion dimensions not exceeding 2. The occluded view is as follows:

[0161]

[0162] in, This represents element-wise multiplication. The two perturbated views constitute positive samples of the same node. .

[0163] Step 3: Negative sample selection is described as follows: The learning objective requires bringing positive samples closer to the target and pushing negative samples further away. Sources of negative samples include: images from the same batch, excluding... Any other node view outside the subgraph, or a subgraph embedded by constructing its subgraph, is compared with its own subgraph view at the subgraph level. In a preferred embodiment of the invention, Gaussian noise perturbation and random occlusion can also be added to negative samples, then the preferred set of negative samples is... In other alternative embodiments, instead of perturbating the negative samples, a subset of sample pairs can be randomly selected from all candidate negative samples for training, directly using the original node features to obtain the negative sample pairs. .

[0164] The graph attention network model is trained using temporal feature maps and positive and negative contrast samples. The graph structure and positive and negative contrast samples are input into the graph attention network (GAT) encoder to extract node embedding representations. These representations are then mapped to the contrast space through a projection head. The model is optimized using the contrast loss function NT-Xent, which makes the embeddings of the same node similar in different views and far apart in different nodes, thus achieving robust feature learning.

[0165] Furthermore, the training process of the graph attention network model is as follows:

[0166] First, input the graph structure. and the characteristics of the nodes after the disturbance , ;

[0167] The encoder employs a graph attention mechanism, assuming the node feature matrix in the input graph is... The perturbation view is denoted as , The graph attention network performs the following operations at each layer:

[0168] Perform a linear transformation on the node feature vectors: ,in It is a learnable weight matrix.

[0169] For nodes with his neighbors Calculate the attention coefficient:

[0170] ;

[0171] in, It is a learnable parameter vector, and d' is the output dimension of GAT; Indicates feature concatenation operation; This represents the unnormalized attention weights.

[0172] In one embodiment of the present invention, a learnable weight matrix can be used. The weight matrix of the linear transformation layer in a graph attention network is used to map the input feature vector to a new feature space, and can learn parameter vectors. The attention parameter vector is used to calculate the attention coefficients between nodes and to learn the relevance weights between nodes. Both of these items are learnable parameters in the Graph Attention Network (GAT), which are automatically optimized to obtain optimal parameter values ​​during model training through the backpropagation algorithm. In the contrastive learning training phase, these two parameters are continuously updated as the contrastive loss function (NT-Xent) is optimized, eventually converging into a set of optimal parameter values ​​that maximize the distinction between positive and negative samples.

[0173] Edge weight fusion and normalization, combined with the original edge weights of the graph structure. Introducing a weighting term, we define the normalized attention coefficient:

[0174] ;

[0175] The neighbor aggregation computation node embedding is represented as:

[0176] ;

[0177] in, It is the ReLU activation function.

[0178] Finally, the model is mapped to the contrast space via the projection head, and optimized using the contrast loss function NT-Xent (Normalized Temperature-scaled Cross Entropy Loss). This ensures that the embeddings of different views of the same node are similar, while the embeddings of different nodes are far apart, achieving robust feature learning. This can be described as embedding the nodes output by the GAT encoder... The input is fed into the MLP multilayer perceptron of the projector head, where it undergoes a nonlinear transformation to obtain the contrast space representation. :

[0179] ;

[0180] in, A two-layer nonlinear network (containing one hidden layer and one output layer, with a nonlinear activation function, such as ReLU, set between layers to map the node embedding vectors output by the GAT encoder to the contrast space to enhance the discriminativeness of feature representations): , Output dimensions for GAT, To compare spatial dimensions, the model is then optimized using the contrastive loss function NT-Xent.

[0181] ;

[0182] in, It is the j-th node The two perturbation views represent In a specific instance of the contrast space (also obtained by outputting the embedding vector from the GAT encoder and then passing it through an MLP). It is a node negative samples Mapping in contrast space; It is the cosine similarity calculation function; This is a temperature parameter used to control the discriminative power of the comparison. When τ is small, the contrastive loss is more sensitive to similarity differences, and the model will more strictly distinguish between positive and negative samples, but training may be unstable; when τ is large, the model's discriminative power weakens, but the optimization process is smoother and convergence is more stable. In a preferred embodiment of the present invention, its value is usually set between 0.1 and 0.5, more preferably 0.2, to balance the stability of the model and the feature discriminative power.

[0183] The total loss is the average of the losses of all nodes. The optimization objective is to minimize the total loss so that the distance between the two view embeddings (positive samples) of the same node is close and the distance between the embeddings (negative samples) of different nodes is widened, thereby achieving a robust and discriminative node embedding representation and enhancing anomaly detection performance.

[0184] After pre-training the graph attention network model (i.e., contrastive learning of temporal-feature maps), the encoder generates the embedding vector for each node. Then, the Local Outlier Factor (LOF) is used to score all nodes for anomalies, identifying nodes with high outlier levels in the embedding space as potential anomaly time sliding windows. This process identifies anomalous data interaction behaviors within the time sliding windows.

[0185] Step 1: After pre-training, obtain the graph attention encoder. Each node can be eigenvectors Mapped to an embedding vector: All nodes are embedded to form a set ;in, Represents a node The input feature vector provided by the graph attention encoder varies depending on whether it is in the training or inference phase. In the pre-training phase, it consists of perturbed view features (i.e., in the training phase). In the anomaly detection phase, the original feature vector is used (i.e., in the inference phase). ).

[0186] Step 2: Calculation - Distance, described as: for each pair of nodes Calculate the distance in the embedding space For each node All Sort and select nearest neighbors Take the first The smallest distance is -distance:

[0187] The Middle Smaller values;

[0188] Step 3: For each neighbor , guarantee when When the local density is low, the reachable distance is not less than that density scale; the reachable distance is defined as follows:

[0189] ;

[0190] Step 4: Calculate the local reachability density and assign nodes... The local reachability density is defined as the inverse average of the reachability distances. The larger the value, the more likely it is to be a node. The denser the surrounding neighborhood:

[0191] ;

[0192] Step 5: Calculate the LOF anomaly score for each node. The Local Outlier Factor (LOF) is the average of the ratios of its neighbor density to its own density.

[0193] ;

[0194] Step 6: When When the node density is the same as that of its neighbors, it is generally considered normal. When a node's local density is significantly lower than its neighbors, it is generally considered an anomaly. Specifically, this invention uses a threshold to determine anomalies. Determined based on the LOF distribution of normal nodes. Let the set of LOF scores for normal nodes be... ,make for The 25th percentile, for The 75th percentile is defined as the interquartile range. Then the anomaly detection threshold can be expressed as: .when At that time, node This is an anomaly, i.e., a time window. The data interaction of the power control terminal is considered abnormal if it is not normal otherwise.

[0195] For newly generated data time windows, four-dimensional features are extracted and graph nodes are constructed. These nodes are then integrated into an existing time-series-feature graph comparison learning model for incremental inference. The embedding vector and anomaly score are calculated to determine whether the behavior is abnormal, thereby enabling real-time monitoring and anomaly identification of power data interaction behavior in new data windows.

[0196] Furthermore, anomaly identification is performed on the newly generated time window's control data, as described below: For a newly generated time window, firstly, four-dimensional features—data transmission volume, deviation, periodicity, and volatility—are extracted, and then standardized using the same mean and standard deviation as in the training phase to obtain the four-dimensional features of the new window. Then add new nodes to the graph structure of the temporal-graph contrastive learning model: in the existing graph model of the temporal-graph contrastive learning model. Based on this, add nodes incrementally. and its time adjacent edges Edge with feature similarity And according to the formula Update edge weights ( and Temporal adjacency, where a value of 1 in the temporal adjacency matrix represents a parameter. β (actually multiplied directly by 1) to construct a new weighted graph. Subsequently, without model fine-tuning, a graph attention encoder is used. right Perform forward inference to obtain the embedding vector. As mentioned earlier, after the model training is complete, during the inference phase (i.e., when predicting new nodes), the standardized feature vectors of the new nodes are directly used as input to the graph attention encoder. Perform forward propagation to obtain its embedding vector.

[0197] Based on the updated set of embeddings, calculate its -Nearest neighbor, reachability distance, and local reachability density, and through An abnormal score is obtained. If the score exceeds the threshold... If the time window is abnormal, it is determined to be an abnormal time window, indicating that the power interaction data is abnormal during the window period.

[0198] Optionally, embodiments of the present invention may also establish a policy-based dynamic access control model for data interaction interfaces based on the identified abnormal data interaction behaviors, and dynamically adjust and manage the access permissions of the interaction interfaces by combining information such as node historical behavior embedding, abnormal scores, and graph associations.

[0199] Among them, the policy-based dynamic access control model for data interaction interfaces, by combining anomaly identification results, adjusts the access permissions of the interaction interfaces in real time, dynamically controlling abnormal behavior and ensuring system security and stability. For example... Figure 4 As shown, it mainly includes the following steps:

[0200] Step 1: Permission Adjustment Strategy: The strategy includes the following: Degradation strategy, which reduces the frequency or scope of interface access; Isolation strategy, which completely blocks abnormal interfaces; Recovery strategy, which restores interface permissions in stages.

[0201] Step 2: Dynamic permission adjustment: Based on LOF anomaly score and preset threshold Dynamically adjust interface permissions: If If an interface malfunctions, a degradation or isolation strategy is triggered, restricting or blocking access to the malfunctioning interface; if The interface is functioning normally; maintaining or gradually restoring the interface represents normal access permissions. Define an interface permission adjustment function:

[0202] ;

[0203] in, Indicates time Access permissions for the following interfaces; Indicates full permissions; Indicates a downgrade in privileges; Indicates isolation permissions.

[0204] Step 3: Dynamic Strategy Optimization: Continuously optimize the threshold based on information such as the embedding of historical behavior of nodes in the interface behavior, anomaly scores, relationships in the graph, and real-time performance. The system adjusts its rules to improve the adaptability and accuracy of its strategies. Typically, if the false alarm rate increases after multiple consecutive detections, the system automatically raises the threshold; if multiple false negatives occur (judged through external alarms or manual annotation feedback), the system automatically lowers the threshold.

[0205] Finally, refer to Figures 5-8 In a preferred embodiment of the present invention, the technical effects of the present invention were demonstrated through model training and testing and comparative experiments.

[0206] Operating environment: On a Windows 10 system, using PyTorch 2.0.0+ CPU and Python 3.9.6, the model was trained and tested using PyCharm 2022.1.

[0207] Furthermore, see Figure 5 Obtain traffic data from the control terminal's data interaction interface for a duration of [duration missing]. .

[0208] Furthermore, see Figure 6 The sliding window size is The sliding window step size is A total of 348 time windows were obtained, and then multi-dimensional features of data interaction behavior, such as data transmission volume, deviation, periodicity, and volatility, were extracted.

[0209] Furthermore, see Figure 7 This invention provides a method for identifying and controlling anomalies in power control terminal data based on a time-series-feature map contrastive learning model. The model was trained using a CPU for 200 epochs. In the initial stage (0-5 epochs), the NT-Xent contrastive loss value decreased significantly, indicating that the model was rapidly learning features. In the middle stage (5-125 epochs), the NT-Xent contrastive loss value continued to decrease, but at a slower rate, indicating a slower convergence speed. In the later stage (125-200 epochs), the decrease in the NT-Xent contrastive loss value became even slower, stabilizing at a minimum value, indicating that the model had completed the feature extraction task. The training process was reasonable, the model effectively learned the data features, and the loss showed a stable downward trend without oscillations or rebounds, indicating a relatively smooth optimization process without gradient explosion or vanishing, which is in line with expectations.

[0210] Furthermore, see Figure 8 Using a pre-trained time-series-feature map-based contrastive learning model, anomaly scoring was performed on all nodes based on the Local Outlier Factor (LOF). Nodes with high outlier rates in the embedding space were identified as potential anomalous time windows. Abnormal data interaction behaviors within these time windows were then identified, resulting in 11 windows (7, 22, 114, 129, 190, 206, 237, 263, 296, 303, and 308) being identified as anomalous, indicating that the data interaction behaviors within these time windows were abnormal.

[0211] Compared to existing technologies, this invention, through comparative learning of time-series and feature maps, effectively overcomes the problems of multiple feature dimensions and scarce labeled samples in current power control terminal data interaction anomaly identification, achieving accurate identification of complex abnormal behaviors. Therefore, it has the following advantages and benefits: Multi-dimensional feature extraction improves anomaly detection accuracy. By employing a sliding window method to analyze network traffic at the power control terminal data interaction interface, the model can comprehensively capture data interaction behavior patterns, thereby improving the accuracy and robustness of anomaly detection. Combining time series prediction enhances anomaly early warning capabilities. Considering different data interaction characteristics, feature fusion and standardization enhance model stability. Combining semi-supervised learning with a ladder network improves the accuracy and robustness of anomaly detection while reducing the need for large amounts of labeled data. Through a well-trained semi-supervised data interaction anomaly identification model, it is possible to analyze and identify whether the data interaction behavior in the next time window is abnormal in real time, thereby achieving more refined anomaly detection and improving the system's response speed to abnormal situations.

[0212] On the other hand, embodiments of the present invention provide a power control terminal anomaly identification system based on contrastive learning, the system comprising:

[0213] The feature extraction module is used to divide the network traffic of the power control terminal data interaction interface into multiple time sliding windows, extract multi-dimensional traffic features of the data interaction behavior of each sliding window, and obtain the data interaction feature vector of each sliding window.

[0214] The sample construction module is used to construct a time-feature map and build positive and negative contrast samples using each sliding window and its data interaction feature vectors.

[0215] The model training module is used to perform comparative learning training on the graph attention network model using temporal-feature maps and positive-negative contrast samples, to obtain an encoder for the graph attention network model that can enhance the embedding representation of the sliding window;

[0216] The anomaly detection module is used to generate an embedding vector for each sliding window using the encoder of the pre-trained graph attention network model, score all sliding windows for anomalies based on the embedding vectors, and identify sliding windows with abnormal data interaction behavior.

[0217] Based on further improvements to the above system, the system also includes:

[0218] The feature extraction module is also used to extract multi-dimensional traffic features of the data interaction behavior of the new sliding window obtained from the newly generated data traffic, and obtain the data interaction feature vector of the new sliding window.

[0219] The graph update module is used to integrate the data interaction feature vector of the new sliding window into the existing time-series feature graph;

[0220] The incremental inference module is used to perform incremental inference in the pre-trained graph attention network model and compute the embedding vector of the new sliding window.

[0221] The anomaly detection module is also used to score the new sliding window based on the embedding vector to determine whether the new sliding window is abnormal.

[0222] Based on further improvements to the above system, the multi-dimensional traffic characteristics include four dimensions of traffic characteristics: data transmission volume, deviation, periodicity, and volatility.

[0223] By performing z-score normalization on the traffic features of each dimension, we obtain the data interaction feature vectors for each sliding window.

[0224] Based on further improvements to the above system, the sample construction module includes:

[0225] A node representation module is used to treat each sliding window as a node in the time-series-feature map;

[0226] The adjacency edge representation module is used to connect any two sliding window nodes that are temporally adjacent through temporal adjacency edges;

[0227] The similarity edge representation module is used to calculate the similarity of the data interaction feature vectors of each sliding window, and connect multiple sliding window nodes with high similarity through feature similarity edges.

[0228] The weight setting module is used to set weight parameters for each edge by combining time dependence and feature similarity, so as to obtain a weighted time-series feature map.

[0229] Based on further improvements to the above system, the sample construction module also includes:

[0230] The perturbation module is used to obtain positive samples formed by two perturbation views by applying two random perturbations to each node in the time-series-feature map;

[0231] The negative sample selection module is used to randomly select other node views in the time-series feature map as negative samples for the current node, and combine them to obtain positive and negative comparison samples at the node level and subgraph level.

[0232] Based on further improvements to the above system, the two random perturbations include applying Gaussian noise and randomly occluding a portion of the dimension.

[0233] Based on further improvements to the above system, the model training module includes:

[0234] The embedding representation module is used to input the temporal-feature map and positive-negative contrast samples into the graph attention network model and extract the node embedding vectors represented by the encoder.

[0235] The parameter optimization module is used to map the node embedding vectors to the contrast space through a multilayer perceptron, and optimize the model using the contrast loss function NT-Xent to obtain encoder optimization parameters that make the positive sample embedding distances of the same node close and the negative sample embedding distances widen.

[0236] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0237] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for anomaly identification in power control terminals based on contrastive learning, characterized in that, The method includes the following steps: The network traffic of the power control terminal data interaction interface is divided into multiple time sliding windows. Multi-dimensional traffic features of data interaction behavior in each sliding window are extracted to obtain the data interaction feature vector of each sliding window. Construct a time-feature map using each sliding window and its data interaction feature vectors, and construct positive and negative contrast samples; The graph attention network model is trained by contrastive learning using temporal feature maps and positive and negative contrast samples to obtain an encoder for the graph attention network model that can enhance the embedding representation of the sliding window; The encoder of the pre-trained graph attention network model generates the embedding vector for each sliding window. Based on the embedding vector, all sliding windows are scored for anomalies to identify sliding windows with abnormal data interaction behavior. The comparative learning training of the graph attention network model includes the following steps: The temporal-feature map and positive-negative contrast samples are input into the graph attention network model to extract the node embedding vectors represented by the encoder; The node embedding vectors are mapped to the contrast space through a multilayer perceptron. The contrast loss function NT-Xent is used to optimize the model and obtain encoder optimization parameters that make the positive sample embedding distances of the same node close and the negative sample embedding distances widen. The optimization of the model using the contrastive loss function NT-Xent includes the following steps: For each node in the time-feature map The NT-Xent loss is calculated as follows: ； in, It is a node Positive samples Mapping in contrasting spaces, It is a node negative samples Mapping in contrasting spaces, It is any two vectors The cosine similarity calculation function, This is the temperature parameter, and n is the total number of sliding windows. Features of the nodes after perturbation; The total loss is the average of the losses of all nodes. The optimization result of the model is obtained by minimizing the total loss.

2. The method according to claim 1, characterized in that, The method further includes the following steps: For a new sliding window obtained from newly generated data traffic, extract multi-dimensional traffic features of the data interaction behavior of the new sliding window to obtain the data interaction feature vector of the new sliding window; Integrate the data interaction feature vector of the new sliding window into the existing time-series feature map; Incremental inference is performed in the pre-trained graph attention network model to compute the embedding vector of the new sliding window; Anomaly score is applied to the new sliding window based on the embedding vector to determine whether the new sliding window is abnormal.

3. The method according to claim 1, characterized in that, The construction of the time-series feature map includes the following steps: Each sliding window is used as a node in the time-feature map; Connect any two sliding window nodes that are adjacent in time using a time adjacency edge; Calculate the similarity of the data interaction feature vectors of each sliding window, and connect multiple sliding window nodes with high similarity through feature similarity edges; By combining time dependence and feature similarity, weight parameters are set for each edge to obtain a weighted time-series feature map.

4. The method according to claim 1, characterized in that, The construction of positive and negative comparison samples includes the following steps: By applying two random perturbations to each node in the time-series feature map, positive samples are obtained from the two perturbation views. Randomly select other node views in the time-series feature map as negative samples for the current node, and combine them to obtain positive and negative comparison samples at the node level and subgraph level.

5. The method according to claim 1, characterized in that, The extraction of the node embedding vector represented by the encoder includes the following steps: For each node in the time-feature map , has feature vector Positive samples negative samples ; Obtain node feature vectors linear transformation ,in It is a learnable weight matrix; According to the node with neighbors Calculate unnormalized attention weights ;in, It is a learnable parameter vector. This indicates a feature concatenation operation. Represents nodes The feature vector is closest to the previous A set of neighboring nodes, Representing neighboring nodes Feature vector Linear transformation; Nodes in the time-feature graph with neighbors edge weight Fusion computation normalized attention coefficient ; Aggregated time-feature graph nodes The node that receives the attention of all its neighbors Embedded vector ;in, It is the ReLU activation function.

6. The method according to claim 1 or 2, characterized in that, The anomaly scoring is performed by the computing node. Local outlier (LOF): ； in, and They are nodes with neighbors Locally achievable density, Represents nodes The feature vector is closest to the previous A set of neighboring nodes; Locally achievable density ,in For nodes with neighbors The reachable distance is , For nodes with neighbors Embedding vector distance, For all neighbors and nodes The first of all embedding vector distances Small distance value.

7. The method according to claim 6, characterized in that, The method further includes the following steps: Obtain the LOF score set of normal nodes as follows ; make The 25th percentile of L, Define the interquartile range as the 75th percentile of L. ; Set the anomaly detection threshold as follows ; when At that time, determine the node The sliding window it represents exhibits abnormal data interaction behavior.

8. A power control terminal anomaly identification system based on contrastive learning, characterized in that, The system includes: The feature extraction module is used to divide the network traffic of the power control terminal data interaction interface into multiple time sliding windows, extract multi-dimensional traffic features of the data interaction behavior of each sliding window, and obtain the data interaction feature vector of each sliding window. The sample construction module is used to construct a time-feature map and build positive and negative contrast samples using each sliding window and its data interaction feature vectors. The model training module is used to perform comparative learning training on the graph attention network model using temporal-feature maps and positive-negative contrast samples, to obtain an encoder for the graph attention network model that can enhance the embedding representation of the sliding window; The comparative learning training of the graph attention network model includes the following steps: The temporal-feature map and positive-negative contrast samples are input into the graph attention network model to extract the node embedding vectors represented by the encoder; The node embedding vectors are mapped to the contrast space through a multilayer perceptron. The contrast loss function NT-Xent is used to optimize the model and obtain encoder optimization parameters that make the positive sample embedding distances of the same node close and the negative sample embedding distances widen. The optimization of the model using the contrastive loss function NT-Xent includes the following steps: For each node in the time-feature map The NT-Xent loss is calculated as follows: ； in, It is a node Positive samples Mapping in contrasting spaces, It is a node negative samples Mapping in contrasting spaces, It is any two vectors The cosine similarity calculation function, This is the temperature parameter, and n is the total number of sliding windows. Features of the nodes after perturbation; The total loss is the average of the losses of all nodes. The optimization result of the model is obtained by minimizing the total loss; The anomaly detection module is used to generate an embedding vector for each sliding window using the encoder of the pre-trained graph attention network model, score all sliding windows for anomalies based on the embedding vectors, and identify sliding windows with abnormal data interaction behavior.

Images