Multi-dimensional feature fusion analysis system for malicious traffic of power network

Abstract

The invention relates to the technical field of power grid data processing, and provides a power network malicious traffic multi-dimensional feature fusion analysis system, which comprises a data acquisition module for acquiring original traffic data from power network monitoring equipment; the time sequence alignment module performs nonlinear time alignment on the network flow sequence and the service flow sequence by adopting a dynamic time warping technology; a feature extraction module extracts a protocol feature vector and a service feature vector from the aligned data through a double-flow space-time diagram convolutional network; the feature fusion module performs weighted fusion on the multi-dimensional feature vectors by using a cross-modal attention mechanism; the time sequence modeling module processes the fusion feature vector through a pre-training time sequence large model to extract high-dimensional time sequence representation; the anomaly detection module judges malicious traffic events based on the anomaly score and generates a report; the defense response module executes an active defense action according to the report. According to the invention, through multi-dimensional feature fusion and a closed-loop processing mechanism, the accuracy of malicious traffic detection of the power network is effectively improved.

Description

Technical Field

[0001] This invention relates to the field of power grid data processing technology, and in particular to a multi-dimensional feature fusion and analysis system for malicious traffic in power networks. Background Technology

[0002] Malicious traffic on existing power grids refers to malicious data transmission targeting industrial control systems, which may disrupt the normal operation of critical smart grid infrastructure. In the smart grid industrial control network environment, real-time detection technology can identify potential threats in a timely manner by continuously monitoring traffic patterns and analyzing abnormal behavior, while proactive defense technology can automatically implement response strategies based on the detection results, such as isolating infected nodes or adjusting network access controls, to improve system security and resilience.

[0003] The existing multi-dimensional feature fusion analysis of malicious traffic in power networks suffers from the following technical pain points: Malicious traffic and service traffic exhibit synchronous fluctuations in the time dimension, rely on the power grid topology for diffusion in the spatial dimension, and interact within standard communication frames in the protocol dimension. Existing feature extraction methods, such as rule-based matching or shallow machine learning models, depend on fixed thresholds and isolated feature analysis, failing to adaptively capture the dynamic correlation and evolution patterns of multi-source time-series data. For example, in smart grid industrial control network scenarios, advanced persistent threat attackers, after infiltrating the host computer via phishing emails, laterally penetrate programmable logic controllers using worm programs. Their malicious traffic and normal service traffic, such as SCADA control commands, are highly intertwined in the time series. Existing detection methods, ignoring the coupling between protocol layer interactions and spatial propagation paths, mistakenly identify attack traffic as normal fluctuations or fail to report real threats, leading to delayed detection system response and defense failure. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a multi-dimensional feature fusion and analysis system for malicious traffic in power networks. This system solves the technical problems caused by the high coupling between malicious traffic and service traffic at the time, space, and protocol levels, which makes it difficult for existing feature extraction methods to fully capture dynamic evolution patterns, resulting in low detection accuracy, high false alarm rate, and response delay.

[0005] To solve the above-mentioned technical problems, the specific technical solution of the present invention is as follows:

[0006] The multi-dimensional feature fusion and analysis system for malicious traffic in power networks provided by this invention includes a data acquisition module, a time-series alignment module, a feature extraction module, a feature fusion module, a time-series modeling module, an anomaly detection module, and a defense response module, wherein:

[0007] The data acquisition module is configured to acquire raw flow data from power network monitoring equipment;

[0008] The time-series alignment module is configured to receive the raw traffic data output by the data acquisition module, perform non-linear time alignment on the network traffic sequence and service traffic sequence in the raw traffic data, and output synchronized time-series data to the feature extraction module.

[0009] The feature extraction module is configured to receive synchronized time-series data output by the time-series alignment module, extract protocol feature vectors and service feature vectors from the synchronized time-series data through a dual-stream spatiotemporal graph convolutional network, and concatenate the protocol feature vectors and the service feature vectors into a multi-dimensional feature vector.

[0010] The feature fusion module is configured to receive a multi-dimensional feature vector output by the feature extraction module, calculate the attention weight between the protocol feature vector and the business feature vector in the multi-dimensional feature vector through a cross-modal attention mechanism, perform weighted fusion of the multi-dimensional feature vector according to the attention weight, and output a fused feature vector to the time series modeling module.

[0011] The time series modeling module is configured to receive the fused feature vector output by the feature fusion module, process the fused feature vector through a pre-trained time series large model, and extract high-dimensional time series representations.

[0012] The anomaly detection module is configured to receive the high-dimensional time series representation output by the time series modeling module, calculate the anomaly score of the high-dimensional time series representation, and output an anomaly event report to the defense response module when the anomaly score exceeds a threshold.

[0013] The defense response module is configured to receive anomaly event reports output by the anomaly detection module and execute proactive defense actions corresponding to the anomaly event reports.

[0014] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the data acquisition module is configured to acquire raw traffic data from the SCADA system, programmable logic controller and remote terminal unit. The raw traffic data includes network traffic sequence, service traffic sequence and power grid topology information. The data acquisition module cleans the raw traffic data, removes duplicate records and invalid values, converts the cleaned data into a structured data stream indexed by timestamps, and outputs the structured data stream as the raw traffic data to the time sequence alignment module.

[0015] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the time alignment module is configured to apply dynamic time warping technology to process the network traffic sequence and service traffic sequence in the raw traffic data received from the data acquisition module, calculate the time offset between the network traffic sequence and the service traffic sequence through a dynamic programming algorithm, and perform nonlinear synchronization alignment between the network traffic sequence and the service traffic sequence based on the calculated time offset, and output synchronized time-series data including time-synchronized network traffic events and service traffic changes to the feature extraction module.

[0016] Furthermore, in the power network malicious traffic multidimensional feature fusion and analysis system of the present invention, the dual-stream spatiotemporal graph convolutional network in the feature extraction module includes protocol feature branches and service feature branches;

[0017] The protocol feature branch is configured to extract discrete protocol symbol features from the synchronized time-series data output by the time-series alignment module, map the discrete protocol symbol features into an embedding vector, input the embedding vector into a graph convolutional layer, and aggregate the protocol information of neighboring nodes based on the communication topology graph constructed according to the power grid topology information in claim 2, and output a protocol feature vector.

[0018] The service feature branch is configured to extract continuous service parameters from the synchronized time-series data, input the continuous service parameters into the spatiotemporal graph convolutional layer, the spatiotemporal graph convolutional layer extracts spatial diffusion features based on the physical connection relationship modeled by the power grid topology information in claim 2, and extracts temporal dynamic features through the temporal convolutional kernel, and outputs a service feature vector;

[0019] The protocol feature vector output by the protocol feature branch and the service feature vector output by the service feature branch are concatenated into a multi-dimensional feature vector, and the feature extraction module outputs the multi-dimensional feature vector to the feature fusion module.

[0020] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the cross-modal attention mechanism in the feature fusion module is configured to calculate the cross-correlation matrix between the protocol feature vector and the service feature vector in the multi-dimensional feature vector received from the feature extraction module, apply the softmax function to the calculated cross-correlation matrix to generate normalized attention weights; based on the attention weights, perform a weighted summation of the corresponding feature dimensions in the protocol feature vector and the service feature vector to generate a fused feature vector, and the feature fusion module outputs the fused feature vector to the time series modeling module.

[0021] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the temporal model in the temporal modeling module is a Transformer architecture model; the Transformer architecture model adds positional encoding to the fused feature vector received from the feature fusion module, calculates the dependency relationship between different time points in the fused feature vector sequence after adding positional encoding through multiple self-attention layers, and outputs a high-dimensional temporal representation to the anomaly detection module.

[0022] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the anomaly detection module is configured to apply the isolated forest algorithm to identify anomalies in the high-dimensional time series representation received from the time series modeling module. The isolated forest algorithm first constructs a random tree structure to segment the feature space of the high-dimensional time series representation, calculates the path length required for data points in the high-dimensional time series representation to be isolated in the random tree structure, and uses the path length as an anomaly score. When the anomaly score exceeds a preset threshold, the anomaly detection module determines that a malicious traffic event has occurred, generates an anomaly event report including an event timestamp, source node identifier, and protocol type, and outputs the anomaly event report to the defense response module.

[0023] Furthermore, in the power network malicious traffic multi-dimensional feature fusion analysis system of the present invention, the defense response module is configured to execute the active defense action based on a reinforcement learning framework; the reinforcement learning framework has a predefined action space, which includes actions such as isolating infected nodes, modifying firewall rules, and switching backup communication links; the defense response module receives anomaly event reports output by the anomaly detection module, selects an action from the predefined action space to execute based on the anomaly event reports, and records the attack path information associated with the anomaly event reports.

[0024] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the protocol feature branch and the service feature branch extract features from the synchronized time-series data in parallel; the protocol feature vector output by the protocol feature branch includes protocol layer interaction information, and the service feature vector output by the service feature branch includes spatial diffusion information and temporal evolution information of power grid physical parameters; the protocol feature vector and the service feature vector transmitted to the feature fusion module are fused in the feature fusion module through the cross-modal attention mechanism.

[0025] Furthermore, in the power network malicious traffic multi-dimensional feature fusion and analysis system of the present invention, the time-series alignment module outputs synchronized time-series data to the feature extraction module; the feature extraction module uses the synchronized time-series data to extract protocol feature vectors and service feature vectors through the dual-stream spatiotemporal graph convolutional network; the feature fusion module receives the protocol feature vectors and the service feature vectors, generates a fused feature vector through the cross-modal attention mechanism, and outputs it to the time-series modeling module; the time-series modeling module processes the fused feature vector to extract a high-dimensional time-series representation and outputs it to the anomaly detection module; the anomaly detection module generates an anomaly event report based on the high-dimensional time-series representation and outputs it to the defense response module.

[0026] The beneficial effects of this invention are:

[0027] This invention establishes a feature representation system covering time, space, and protocol dimensions by employing a data acquisition module for standardized processing of multi-source heterogeneous traffic data from power networks, a time-series alignment module for nonlinear sequence synchronization based on dynamic time warping technology, and a feature extraction module for analyzing protocol and service features using a dual-stream spatiotemporal graph convolutional network. A feature fusion module utilizes a cross-modal attention mechanism to adaptively weight multi-dimensional feature vectors, a time-series modeling module captures long-period dependencies using a pre-trained Transformer architecture, an anomaly detection module calculates anomaly scores using the isolated forest algorithm, and a defense response module executes proactive defense actions based on a reinforcement learning framework. This forms a closed-loop processing chain from data acquisition to defense response. This modular collaborative mechanism effectively solves the technical challenge of existing methods' insufficient capture of multi-dimensional coupled features of malicious traffic and service traffic in time synchronization fluctuations, topology spatial diffusion, and protocol embedding interactions, significantly improving the accuracy and real-time performance of threat identification in complex power grid environments. Attached Figure Description

[0028] To more clearly illustrate the technical solution of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on the drawings without creative effort.

[0029] Figure 1 This is a system architecture diagram for a system that fuses and analyzes the multi-dimensional features of malicious traffic in power networks. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. The technical solutions provided by various embodiments of this invention will be described in detail below with reference to the accompanying drawings.

[0031] To better understand the purpose of this invention, the invention will now be described in further detail.

[0032] Please see Figure 1 The multi-dimensional feature fusion and analysis system for malicious traffic in power networks provided by this invention includes a data acquisition module, a time-series alignment module, a feature extraction module, a feature fusion module, a time-series modeling module, an anomaly detection module, and a defense response module, wherein:

[0033] The data acquisition module is configured to acquire raw flow data from power network monitoring equipment;

[0034] The time-series alignment module is configured to receive the raw traffic data output by the data acquisition module, perform non-linear time alignment on the network traffic sequence and service traffic sequence in the raw traffic data, and output synchronized time-series data to the feature extraction module.

[0035] The feature extraction module is configured to receive synchronized time-series data output by the time-series alignment module, extract protocol feature vectors and service feature vectors from the synchronized time-series data through a dual-stream spatiotemporal graph convolutional network, and concatenate the protocol feature vectors and the service feature vectors into a multi-dimensional feature vector.

[0036] The feature fusion module is configured to receive a multi-dimensional feature vector output by the feature extraction module, calculate the attention weight between the protocol feature vector and the business feature vector in the multi-dimensional feature vector through a cross-modal attention mechanism, perform weighted fusion of the multi-dimensional feature vector according to the attention weight, and output a fused feature vector to the time series modeling module.

[0037] The time series modeling module is configured to receive the fused feature vector output by the feature fusion module, process the fused feature vector through a pre-trained time series large model, and extract high-dimensional time series representations.

[0038] The anomaly detection module is configured to receive the high-dimensional time series representation output by the time series modeling module, calculate the anomaly score of the high-dimensional time series representation, and output an anomaly event report to the defense response module when the anomaly score exceeds a threshold.

[0039] The defense response module is configured to receive anomaly event reports output by the anomaly detection module and execute proactive defense actions corresponding to the anomaly event reports.

[0040] The operation of the power network malicious traffic multi-dimensional feature fusion and analysis system begins with the data acquisition module obtaining raw traffic data from monitoring equipment deployed at key nodes of the power grid. Monitoring equipment includes the SCADA system master station, programmable logic controllers in substations, and remote terminal units in the distribution automation system. The collected raw data includes network-layer communication message sequences and telemetry and telecontrol data streams at the power grid business layer, while also acquiring power grid topology information reflecting the connection relationships of primary equipment. The data acquisition module performs preliminary cleaning of the raw traffic, removing duplicate packets and invalid data frames with incorrect formats caused by network jitter, and uniformly converts heterogeneous data sources into structured data streams indexed by millisecond-level timestamps.

[0041] After receiving the structured data stream, the time-series alignment module calibrates the network traffic sequence and the service traffic sequence to address potential time-scale differences. This module employs a dynamic time warping algorithm, using dynamic programming to calculate the optimal curved path between the two sequences, eliminating time offsets caused by different sampling frequencies or transmission delays. The aligned sequences establish a precise correspondence between network layer attack events and service layer indicators such as voltage fluctuations and load changes on the time axis, laying the foundation for subsequent cross-dimensional correlation analysis.

[0042] The feature extraction module employs a two-stream architecture spatiotemporal graph convolutional network to process synchronized time-series data. The protocol feature branch transforms discrete communication protocol fields into embedding vectors and performs graph convolution operations based on the power grid communication topology to capture the propagation path characteristics of malicious traffic between nodes. The service feature branch constructs spatiotemporal graph convolutional models for continuous physical quantities such as voltage and current, capturing dynamic patterns of parameter changes through temporal convolution kernels, while simultaneously using spatial convolutional layers to analyze the spread of faults along the power grid topology. The feature vectors output by the two branches respectively carry protocol interaction patterns and physical process evolution information, forming a multi-dimensional feature representation through concatenation.

[0043] The feature fusion module introduces a cross-modal attention mechanism to deeply interact with the concatenated features. This mechanism automatically learns the coupling strength distribution of the two types of features in the temporal and spatial dimensions by calculating the cross-correlation matrix between protocol features and business features. After normalization, the attention weight matrix is ​​used to weight and enhance the dimensions of highly correlated features while suppressing the noise dimension, thereby generating a fused feature vector that enhances the identification of malicious traffic.

[0044] The temporal modeling module uses a pre-trained Transformer architecture to learn sequences from fused features. The model first adds positional encoding to the input sequence to preserve temporal information, and then establishes long-distance dependencies through a multi-layered self-attention mechanism. During the pre-training phase, the model learns baseline patterns of power communication using massive amounts of normal traffic data; the fine-tuning phase introduces a small number of labeled attack samples, enabling the model to identify abnormal fluctuations deviating from the baseline pattern.

[0045] The anomaly detection module inputs the high-dimensional representation output from the time-series modeling module into the Isolation Forest algorithm. This algorithm constructs a randomly partitioned tree structure and calculates the difference in path length between normal and anomaly points in the feature space. When the anomaly score of a real-time traffic data point exceeds a threshold based on historical data distribution, the module automatically generates an anomaly event report including attack time, source address, and protocol type.

[0046] The defense response module implements adaptive decision-making based on a reinforcement learning framework. This module predefines a space of actions including node isolation, rule adjustment, and link switching. Based on the threat context provided by the anomaly event report, it selects the optimal response strategy that minimizes system damage. While executing these actions, the module records attack attribution information for subsequent strategy optimization, forming a closed-loop security protection system from detection to defense.

[0047] When the data acquisition module obtains raw flow data from the SCADA system, programmable logic controller, and remote terminal unit, it needs to handle the integration of multi-source heterogeneous data. For example, the telemetry data output by the SCADA system is sampled at a second-level cycle, while the network flow sensor may capture messages at a millisecond-level frequency. This difference needs to be coordinated through a unified time base. During the data cleaning stage, rules are designed to address the interference scenarios unique to power communication: duplicate records are usually caused by network retransmission mechanisms and need to be deduplicated based on message sequence numbers; invalid values ​​may manifest as voltage over-range or empty frames caused by communication interruptions, requiring filtering in conjunction with power grid physical constraints. When converting to a structured data stream, the timestamp index needs to be accurate to the millisecond level to support subsequent microsecond-level time-series analysis, while preserving the node relationships in the power grid topology to ensure the integrity of spatial dimension information.

[0048] When the time-series alignment module handles the non-linear alignment of network traffic sequences and service traffic sequences, the dynamic time warping algorithm needs to address the typical problem of sequence length mismatch in power scenarios. For example, service traffic sequences may experience interruptions due to equipment dormancy, while network traffic sequences are continuously collected. In this case, the algorithm achieves point-to-point matching through local stretching and compression. In the calculation of time offset, the dynamic planning path needs to consider the propagation delay of power grid events, such as the inherent delay of substation fault signals from detection to reporting. The aligned sequence not only eliminates time offset but also marks the alignment confidence level. Low-confidence segments will trigger data quality warnings to prevent erroneous alignment features from entering downstream modules.

[0049] The dual-stream architecture of the feature extraction module needs to adapt to the diversity of power protocols: when processing industrial protocols, the protocol feature branch needs to map symbolic fields such as protocol type and function code into high-dimensional embedding vectors. The communication topology graph of the graph convolutional layer operation needs to be dynamically updated; for example, when the smart grid topology is reconstructed, the node adjacency matrix needs to be adjusted in real time. When the business feature branch processes continuous parameters such as voltage drops and frequency fluctuations, the design of the convolution kernel of the spatiotemporal graph convolution needs to take into account the laws of power physics, such as the power balance relationship under the constraints of Kirchhoff's laws, to ensure that the extracted features conform to the dynamic characteristics of the power grid.

[0050] The cross-modal attention mechanism in the feature fusion module needs to handle the scale differences between protocol features and business features. For example, protocol features may represent sudden, discrete events, while business features exhibit continuous, gradual patterns; therefore, the calculation of the cross-correlation matrix requires the introduction of a multi-scale sliding window. A gating mechanism is used in the weighted fusion stage. When transient noise caused by lightning strikes appears in the business features, the corresponding attention weight is automatically reduced to prevent noise from contaminating the fusion result. The fused feature vector carries a modal contribution identifier, facilitating subsequent modules to trace the source of key features.

[0051] The Transformer architecture of the time-series modeling module needs to be optimized for long-term dependencies in power data. Location encoding needs to embed the periodic characteristics of power time series, such as the daily and weekly cycles of load curves. During self-attention layer computation, higher attention weights are assigned to key events (such as the timing of relay protection actions), allowing the model to focus on abnormal patterns within the time windows before and after faults. When using a masking strategy during pre-training, data from the fault period is intentionally hidden to test the model's generalization ability against unknown attacks.

[0052] The isolated forest algorithm in the anomaly detection module needs to adapt to the high-dimensional characteristics of power flow. When constructing the random tree, an adaptive splitting strategy is adopted to address the differences in numerical distribution between the protocol and business dimensions. Weight correction is introduced in path length calculation, and more sensitive judgment thresholds are set for critical flows such as SCADA control commands. When a synchronous flooding attack is detected in the substation control layer network, the algorithm combines spatial topology information to associate multiple node anomalies within the same substation as composite events.

[0053] The reinforcement learning framework for the defense response module needs to balance the real-time performance and security of actions. The action space design includes progressive response strategies, such as first limiting current and then isolating, to avoid misjudgments leading to power outages. The training environment simulates typical power grid attack scenarios, such as state estimation errors under false data injection attacks. The action selection mechanism introduces a latency penalty factor to prevent oscillations caused by frequent switching of backup links. Attack path records are linked to cross-zone access logs in power grid security zones II and III, forming a traceable defense decision chain.

[0054] The parallel extraction mechanism for protocol features and business features needs to address resource contention issues. The dual-stream architecture employs a shared memory strategy to avoid redundant loading of synchronized time-series data. A cross-validation mechanism is designed in the feature fusion stage; when protocol features detect malicious login but business features show no anomalies, a secondary verification process is initiated. This design effectively counters attackers' evasion techniques that use forged normal business traffic to conceal malicious behavior.

[0055] System-level data flow is ensured to maintain processing continuity through a pipelined buffer mechanism. A circular buffer is set up at the output of the time-series alignment module to handle sudden spikes in business traffic. Asynchronous communication is used between the feature fusion module and the time-series modeling module to prevent model inference delays from blocking real-time detection. Heartbeat monitoring is deployed in this link; if the anomaly detection module fails to output a report within a timeout period, the degradation handling strategy of the defense response module is automatically triggered.

[0056] The implementation of a multi-dimensional feature fusion and analysis system for malicious traffic in power networks requires close integration with the actual operating environment of the smart grid industrial control network. When deploying data acquisition modules in the substation control layer network, three types of data interfaces must be simultaneously accessed: the SCADA system server, the programmable logic controller (PLC) of the protection and control device, and the remote terminal unit for distribution automation. The acquisition module captures network traffic sequences through mirror ports, subscribes to business traffic sequences via the OPC UA protocol, and synchronously reads the power grid graphical description file to obtain topology information. Addressing the timescale difference between SCADA's second-level telemetry data and the network's millisecond-level messages, the time alignment module employs a dynamic time warping algorithm to establish a nonlinear mapping relationship. For example, it dynamically compensates for the transmission delay between relay protection action events and corresponding control commands, ensuring precise alignment of fault recording data and protection messages on the time axis.

[0057] The feature extraction module needs to adapt to specific protocols such as IEC 61850 MMS and GOOSE in the power communication protocol parsing stage. The protocol feature branch maps ASN.1 encoded message types to 256-dimensional embedding vectors. The graph convolutional layer constructs an adjacency matrix based on the substation virtual terminal connection table to model the communication relationships between intelligent electronic devices. When processing voltage phasor measurement unit data, the service feature branch requires the spatiotemporal graph convolutional kernel to be designed to adapt to the spatial constraints of the power flow equations, for example, by characterizing electrical connection strength through the node admittance matrix, thereby accurately capturing the propagation trajectory of fault disturbances in the power grid. The feature vectors output by the two branches are concatenated through a shared memory mechanism to avoid repeated readings of synchronous time-series data.

[0058] The cross-modal attention mechanism of the feature fusion module needs to address the modal differences between the continuity of service measurement data and the discreteness of protocol events. When calculating the cross-correlation matrix, a sliding time window mechanism is used to smooth the protocol features, matching their temporal resolution to match that of the service parameters. When a line overload protection action is detected, the attention weights automatically enhance the voltage drop feature dimension strongly correlated with the event, while suppressing transient noise caused by lightning interference. This weighting strategy enables the fused feature vector to highlight the coordinated anomalies of malicious attacks at the protocol interaction and physical measurement levels.

[0059] When the time-series modeling module uses the Transformer architecture to process fused feature vectors, the location encoding needs to embed the unique periodic patterns of the power system. For example, in load forecasting scenarios, the model learns daily and weekly load curve patterns through a self-attention mechanism. When abnormal electricity consumption occurs, the model can identify malicious mining traffic that deviates from the normal pattern. The pre-training phase uses historical data from the provincial power grid dispatch center to build a baseline model, and the fine-tuning phase injects known APT attack samples to enable the model to generalize and identify new threats.

[0060] The isolated forest algorithm for anomaly detection needs to be optimized for the high-dimensional feature space of power monitoring systems. When constructing random trees, the algorithm sets feature weights for key dimensions such as SCADA control commands and synchronization phasor measurements. When multiple intelligent electronic devices in a substation simultaneously issue abnormal communication requests, the algorithm calculates spatial correlation based on topological relationships, aggregating distributed attack events into a unified threat alarm.

[0061] The reinforcement learning framework of the defense response module simulates various attack scenarios during the training phase, such as the injection of false data leading to incorrect state estimation. The action space design includes a tiered response strategy. When an anomaly report indicates that the site control layer network has been scanned and probed, traffic shaping strategies are prioritized over directly isolating nodes to avoid impacting real-time control services. The decision module records the execution effect of each action, forming an attack attribution knowledge base for optimizing subsequent strategy selection.

[0062] The system achieves asynchronous communication between modules through message queues, and a data buffer is set up between the timing alignment module and the feature extraction module to cope with peak business traffic. When the anomaly detection module fails to output detection results within a set time, the defense response module automatically switches to a preset baseline protection strategy to ensure the system's basic protection capability under extreme conditions. This invention effectively solves the pain point of insufficient identification of coupled attacks in existing detection methods through multi-dimensional feature fusion and closed-loop response mechanisms.

Claims

1. A multi-dimensional feature fusion and analysis system for malicious traffic in power networks, characterized in that, It includes a data acquisition module, a time-series alignment module, a feature extraction module, a feature fusion module, a time-series modeling module, an anomaly detection module, and a defense response module, among which: The data acquisition module is configured to acquire raw flow data from power network monitoring equipment; The time-series alignment module is configured to receive the raw traffic data output by the data acquisition module, perform non-linear time alignment on the network traffic sequence and service traffic sequence in the raw traffic data, and output synchronized time-series data to the feature extraction module. The feature extraction module is configured to receive synchronized time-series data output by the time-series alignment module, extract protocol feature vectors and service feature vectors from the synchronized time-series data through a dual-stream spatiotemporal graph convolutional network, and concatenate the protocol feature vectors and the service feature vectors into a multi-dimensional feature vector. The feature fusion module is configured to receive a multi-dimensional feature vector output by the feature extraction module, calculate the attention weight between the protocol feature vector and the business feature vector in the multi-dimensional feature vector through a cross-modal attention mechanism, perform weighted fusion of the multi-dimensional feature vector according to the attention weight, and output a fused feature vector to the time series modeling module. The time series modeling module is configured to receive the fused feature vector output by the feature fusion module, process the fused feature vector through a pre-trained time series large model, and extract high-dimensional time series representations. The anomaly detection module is configured to receive the high-dimensional time series representation output by the time series modeling module, calculate the anomaly score of the high-dimensional time series representation, and output an anomaly event report to the defense response module when the anomaly score exceeds a threshold. The defense response module is configured to receive anomaly event reports output by the anomaly detection module and execute proactive defense actions corresponding to the anomaly event reports.

2. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 1, characterized in that, The data acquisition module is configured to acquire raw traffic data from the SCADA system, programmable logic controller and remote terminal unit. The raw traffic data includes network traffic sequence, service traffic sequence and power grid topology information. The data acquisition module cleans the raw traffic data, removes duplicate records and invalid values, converts the cleaned data into a structured data stream indexed by timestamps, and outputs the structured data stream as the raw traffic data to the time sequence alignment module.

3. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 2, characterized in that, The time-series alignment module is configured to apply dynamic time warping technology to process the network traffic sequence and service traffic sequence in the raw traffic data received from the data acquisition module, calculate the time offset between the network traffic sequence and the service traffic sequence using a dynamic programming algorithm, and perform non-linear synchronization alignment between the network traffic sequence and the service traffic sequence based on the calculated time offset, and output synchronized time-series data including time-synchronized network traffic events and service traffic changes to the feature extraction module.

4. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 3, characterized in that, The dual-stream spatiotemporal graph convolutional network in the feature extraction module includes a protocol feature branch and a service feature branch; The protocol feature branch is configured to extract discrete protocol symbol features from the synchronized time-series data output by the time-series alignment module, map the discrete protocol symbol features into an embedding vector, input the embedding vector into a graph convolutional layer, and aggregate the protocol information of neighboring nodes based on the communication topology graph constructed according to the power grid topology information in claim 2, and output a protocol feature vector. The service feature branch is configured to extract continuous service parameters from the synchronized time-series data, input the continuous service parameters into the spatiotemporal graph convolutional layer, the spatiotemporal graph convolutional layer extracts spatial diffusion features based on the physical connection relationship modeled by the power grid topology information in claim 2, and extracts temporal dynamic features through the temporal convolutional kernel, and outputs a service feature vector; The protocol feature vector output by the protocol feature branch and the service feature vector output by the service feature branch are concatenated into a multi-dimensional feature vector, and the feature extraction module outputs the multi-dimensional feature vector to the feature fusion module.

5. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 4, characterized in that, The cross-modal attention mechanism in the feature fusion module is configured to calculate the cross-correlation matrix between the protocol feature vector and the business feature vector in the multi-dimensional feature vector received from the feature extraction module, apply the softmax function to the calculated cross-correlation matrix to generate normalized attention weights, and perform a weighted summation of the corresponding feature dimensions in the protocol feature vector and the business feature vector based on the attention weights to generate a fused feature vector. The feature fusion module then outputs the fused feature vector to the time series modeling module.

6. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 5, characterized in that, The temporal model in the temporal modeling module is a Transformer architecture model. The Transformer architecture model adds positional encoding to the fused feature vector received from the feature fusion module, calculates the dependencies between different time points in the fused feature vector sequence after adding positional encoding through multiple self-attention layers, and outputs a high-dimensional temporal representation to the anomaly detection module.

7. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 6, characterized in that, The anomaly detection module is configured to apply the isolated forest algorithm to identify anomalies in the high-dimensional time series representation received from the time series modeling module. The isolated forest algorithm first constructs a random tree structure to segment the feature space of the high-dimensional time series representation, calculates the path length required for the data points in the high-dimensional time series representation to be isolated in the random tree structure, and uses the path length as the anomaly score. When the anomaly score exceeds a preset threshold, the anomaly detection module determines that a malicious traffic event has occurred, generates an anomaly event report including an event timestamp, source node identifier, and protocol type, and outputs the anomaly event report to the defense response module.

8. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 7, characterized in that, The defense response module is configured to execute the proactive defense action based on a reinforcement learning framework. The reinforcement learning framework has a predefined action space, which includes actions such as isolating infected nodes, modifying firewall rules, and switching backup communication links. The defense response module receives anomaly event reports output by the anomaly detection module, selects an action from the predefined action space based on the anomaly event report, and records the attack path information associated with the anomaly event report.

9. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 8, characterized in that, The protocol feature branch and the service feature branch extract features from the synchronized time-series data in parallel; the protocol feature vector output by the protocol feature branch includes protocol layer interaction information, and the service feature vector output by the service feature branch includes spatial diffusion information and temporal evolution information of power grid physical parameters; the protocol feature vector and the service feature vector transmitted to the feature fusion module are fused in the feature fusion module through the cross-modal attention mechanism.

10. The power network malicious traffic multi-dimensional feature fusion and analysis system according to claim 9, characterized in that, The temporal alignment module outputs synchronized temporal data to the feature extraction module; the feature extraction module uses the synchronized temporal data to extract protocol feature vectors and service feature vectors through the dual-stream spatiotemporal graph convolutional network; the feature fusion module receives the protocol feature vectors and the service feature vectors, generates a fused feature vector through the cross-modal attention mechanism, and outputs it to the temporal modeling module; the temporal modeling module processes the fused feature vector to extract a high-dimensional temporal representation and outputs it to the anomaly detection module; the anomaly detection module generates an anomaly event report based on the high-dimensional temporal representation and outputs it to the defense response module.

Images