A method and system for generating lightweight attack paths for power networks

Abstract

The application relates to a power network lightweight attack path generation method and system, and belongs to the technical field of attack path generation. The method comprises the following steps: obtaining power network flow data of a target area power grid in real time, and preprocessing the data to eliminate sampling differences between heterogeneous devices to obtain preprocessed time sequence aligned heterogeneous data; based on the preprocessed time sequence aligned heterogeneous data, heterogeneous graph modeling is performed to obtain a combined heterogeneous graph; wherein the heterogeneous graph modeling comprises extracting differentiated node features based on source device types, and constructing edges with interaction features based on power service logic and protocol types to form protocol interaction element paths; the combined heterogeneous graph is input into a pre-trained potential attack path generation model to obtain a potential attack path probability; wherein the potential attack path generation model is obtained through joint adversarial training with a noise generation model; a suspicious path score is calculated based on the potential attack path probability, and an attack path is generated based on the suspicious path score.

Description

Technical Field

[0001] This invention relates to the field of attack path generation technology, and in particular to a lightweight attack path generation method and system for power networks. Background Technology

[0002] Traditional power grid security systems primarily rely on GNN (Graph Neural Network) or GAN (Generative Adversarial Network) for data processing and model training to obtain attacker attack paths (e.g., attackers illegally logging in, issuing malicious commands to RTUs, and subsequently tampering with power equipment status). These systems then connect discrete anomaly alerts into complete attack paths, achieving a smart security leap from passive alerting to proactive prediction, precise attribution, and targeted defense, thus maintaining the safe operation of the power grid. While traditional methods are effective in specific scenarios, they lack differentiated modeling for the heterogeneity of power equipment, resulting in the following shortcomings:

[0003] (1) Homogeneous modeling leads to insufficient generalization ability: Existing power security models based on GNN treat all power equipment as homogeneous (i.e., as nodes of the same type) and ignore the differences in equipment type and communication protocol. This results in the traditional model being unable to effectively distinguish between critical interaction paths that are crucial to power system security and a large number of irrelevant noise interactions. When dealing with dynamic and covert network attacks, the traditional model is unable to accurately identify the abnormal behavior chain initiated by the attacker using specific equipment and protocols, resulting in a high false alarm rate and seriously interfering with security operation and maintenance.

[0004] (2) Lack of domain specificity in adversarial training: Existing GAN-based power security models suffer from a lack of domain knowledge in adversarial training to improve model robustness. The adversarial samples generated by this method mostly rely on random noise or general network attack patterns, failing to deeply integrate the protocol specifications, device interaction logic, and historical attack characteristics unique to power industrial control systems. Although the generated adversarial samples are statistically abnormal, they often do not conform to the semantics of real power attacks, resulting in limited improvement of the trained model's ability to defend against advanced sustainable threats with domain specificity in reality.

[0005] (3) Insufficient computational efficiency and lightweight design: Existing power security models based on complex graph neural networks and generative adversarial networks generally face challenges in terms of computational efficiency and lightweight design. On the one hand, traditional multi-layer graph convolution operations rely on fully connected adjacency matrices, whose computational complexity is related to the number of nodes in the power network. Proportional to the square On the one hand, it is difficult to cope with the real-time and high-frequency updates of node and edge features in large-scale power networks. On the other hand, the complex adversarial training architecture to improve accuracy, such as multi-layer discriminators and refined generators, greatly increases the computational overhead of training and inference. This makes it difficult for existing models to achieve lightweight deployment on resource-constrained edge devices or central monitoring systems that require second-level response, thus restricting their application in actual production environments. Summary of the Invention

[0006] Based on the above analysis, the embodiments of the present invention aim to provide a lightweight attack path generation method and system for power networks, in order to solve the technical problems of interaction mode confusion and high false alarm rate under dynamic attacks caused by the homogenization of heterogeneous devices in traditional power network security models.

[0007] This invention provides a method for generating lightweight attack paths in power networks, comprising the following steps:

[0008] Step S1: Real-time acquisition of power network flow data of the target area power grid and preprocessing to eliminate sampling differences between heterogeneous devices to obtain preprocessed time-aligned heterogeneous data;

[0009] Step S2: Based on the preprocessed time-aligned heterogeneous data, perform heterogeneous graph modeling to obtain a combined heterogeneous graph; wherein, the heterogeneous graph modeling includes extracting differentiated node features based on the source device type, and constructing edges with interaction features based on power business logic and protocol type to form protocol interaction meta-paths;

[0010] Step S3: Input the combined heterogeneous graph into the pre-trained potential attack path generation model to obtain the potential attack path probability; wherein, the potential attack path generation model is obtained by joint adversarial training with the noise generation model;

[0011] Step S4: Calculate the suspicious path score based on the potential attack path probability, and generate an attack path based on the suspicious path score.

[0012] The present invention also discloses a lightweight attack path generation system for power networks, the system comprising a heterogeneous data fusion module M1, a dynamic heterogeneous graph construction module M2, a lightweight adversarial detection module M3, and an attack path generation module M4;

[0013] The heterogeneous data fusion module M1 is used to acquire power network traffic data of the target area power grid in real time and perform preprocessing to eliminate sampling differences between heterogeneous devices, so as to obtain preprocessed time-aligned heterogeneous data.

[0014] The dynamic heterogeneous graph construction module M2 is used to perform heterogeneous graph modeling based on the preprocessed time-aligned heterogeneous data to obtain a combined heterogeneous graph; wherein, the heterogeneous graph modeling includes extracting differentiated node features based on the source device type, and constructing edges with interaction features based on power business logic and protocol type to form protocol interaction meta-paths.

[0015] The lightweight adversarial detection module M3 inputs the combined heterogeneous graph into a pre-trained potential attack path generation model to obtain the potential attack path probability; wherein, the potential attack path generation model is obtained through joint adversarial training with a noise generation model;

[0016] The attack path generation module M4 is used to calculate a suspicious path score based on the probability of the potential attack path, and generate an attack path based on the suspicious path score.

[0017] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0018] 1. This invention overcomes the limitations of traditional homogeneous graph modeling by employing heterogeneous graph modeling to distinguish the node types and communication protocol edge types of power equipment (such as RTUs, HMIs, SCADA systems, and gateways). This enables the model to accurately learn and establish normal interaction baselines that conform to power business logic (such as the difference between periodic telemetry flows and sudden control commands). In complex dynamic attack scenarios, this effectively distinguishes critical attack paths from background noise, significantly improving detection accuracy and generalization ability. It solves the problem of interaction pattern confusion caused by the neglect of device heterogeneity in traditional homogeneous graph models, increasing the attention weight of critical interaction paths and reducing the weight of non-critical noise interactions, thereby reducing the false alarm rate in dynamic attack scenarios.

[0019] 2. This invention addresses the lack of domain knowledge in existing adversarial training by introducing a large language model as a noise generation model. This model integrates knowledge of power protocol specifications, equipment operation logic, and historical attack patterns to generate high-quality adversarial samples that are grammatically compliant and semantically anomalous (such as simulating unauthorized value modifications during periods). Through domain knowledge-driven joint adversarial training, the detection model not only resists random disturbances but also deeply understands and defends against advanced persistent threats that conform to real attack logic, enhancing the model's robustness and adaptability to real advanced threats. By analyzing the unique abnormal behavior of the power network through the noise generation model and co-training it with the message passing mechanism of the potential attack path generation model, dynamic pruning of interactive edges reduces the computational complexity of the adjacency matrix and improves the detection rate of protocol tampering attacks.

[0020] 3. To overcome the bottleneck of low computational efficiency in traditional complex models, this invention integrates a dynamic pruning mechanism based on meta-path attention during training. This mechanism automatically identifies and retains key interaction paths, eliminates redundant connections, and generates a sparse adjacency matrix template. This reduces the computational complexity of online inference, achieving second-level response and low resource consumption while ensuring high detection performance (e.g., F1-score exceeding 92%). This allows the solution to be directly deployed on resource-constrained power monitoring edge devices or central systems, meeting the stringent requirements of real-time performance and lightweight design in production environments. It achieves a balance between high performance and lightweight design, meeting the real-time deployment needs of industry.

[0021] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0022] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.

[0023] Figure 1 This is a flowchart of a method for generating lightweight attack paths for power grids according to an embodiment of the present invention;

[0024] Figure 2 This is a flowchart of the dual-model joint training process in an embodiment of the present invention;

[0025] Figure 3 This is a detailed flowchart of a method for generating lightweight attack paths for power grids, as described in an embodiment of the present invention.

[0026] Figure 4 This is a visualization diagram of the combined heterogeneous graph of the state and interaction relationship of the power cyber-physical system and the attack path in an embodiment of the present invention.

[0027] Figure 5 This is a schematic diagram comparing the multi-cycle F1-score curves of the present invention and the prior art;

[0028] Figure 6 This is a diagram comparing the false alarm rate and attack detection rate of the present invention and the prior art.

[0029] Figure 7 This is a schematic diagram of a power grid lightweight attack path generation system module in an embodiment of the present invention. Detailed Implementation

[0030] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0031] The purpose of this invention is to generate high-fidelity attack paths, aiming to replace the flat alarm mechanisms of traditional security systems and provide actionable advanced threat intelligence with contextual semantics for power network security systems. This invention dynamically distinguishes between device types and protocol characteristics to construct heterogeneous graphs, and combines this with the unique abnormal behaviors of power networks. Through joint training of a potential attack path generation model and a noise generation model, it dynamically prunes interactive edges, solving the dual challenges of power device diversity and attack complexity.

[0032] Example 1:

[0033] A specific embodiment of the present invention discloses a method for generating lightweight attack paths in power networks, such as... Figure 1 As shown, it includes the following steps:

[0034] Step S1: Real-time acquisition of power network flow data of the target area power grid and preprocessing to eliminate sampling differences between heterogeneous devices to obtain preprocessed time-aligned heterogeneous data;

[0035] Step S2: Based on the preprocessed time-aligned heterogeneous data, perform heterogeneous graph modeling to obtain a combined heterogeneous graph; wherein, the heterogeneous graph modeling includes extracting differentiated node features based on the source device type, and constructing edges with interaction features based on power business logic and protocol type to form protocol interaction meta-paths;

[0036] Step S3: Input the combined heterogeneous graph into the pre-trained potential attack path generation model to obtain the potential attack path probability; wherein, the potential attack path generation model is obtained by joint adversarial training with the noise generation model;

[0037] Step S4: Calculate the suspicious path score based on the potential attack path probability, and generate an attack path based on the suspicious path score.

[0038] Step S1 includes steps S11-S12.

[0039] Step S11: Obtain real-time power network flow data of the target area power grid.

[0040] The power network traffic data includes RTU (Remote Terminal Unit) data, HMI (Human Machine Interface) data, gateway data, and SCADA (Supervisory Control and Data Acquisition) data.

[0041] The RTU data includes Modbus protocol field data and real-time telemetry data;

[0042] The HMI data includes user operation logs and interface event stream data;

[0043] Both the SCADA data and the gateway data include MMS messages of the IEC61850 protocol and cross-device interaction link record data.

[0044] (1) The RTU is deployed in industrial fields or remote sites as an edge node connecting physical devices and SCADA. RTU data includes serial communication Modbus protocol fields and real-time telemetry data;

[0045] ①Modbus protocol fields include: function code 03, function code 06, register address, and Cyclic Redundancy Check (CRC) value;

[0046] ② Real-time telemetry data includes: voltage, current, and frequency; logically, one RTU corresponds to one edge node, and physically, it can centrally monitor multiple devices within a region. The voltage, current, and frequency data collected by one RTU node in this invention may be the summed measurements from multiple instrument transformers in that region (such as a line or a main transformer).

[0047] For example, the RTU data sampling frequency is 100-500ms / time.

[0048] In the Modbus protocol, function codes define the type of operation performed by the master station (such as SCADA) on the slave station (such as RTU).

[0049] Function code 03 indicates reading the value of one or more holding registers; the master station requests the slave station, the slave station responds to the master station, and the response data flows from the RTU uplink to SCADA; reading, querying, and monitoring use function code 03, and the periodic data reporting stream is the main basis for building the telemetry data edge. Abnormal changes in the reporting frequency, order, and range of registers read may be signs of an attack.

[0050] Function code 06 indicates writing to a single holding register; the master station uses function code 06 to send control commands (such as switching devices on / off) or modify setting parameters (such as modifying device protection thresholds) to the RTU. The master station requests the slave station with the data to be written to the register, and the slave station responds to the master station with confirmation. Downlink commands flow from SCADA to RTU; function code 06 is used for writing, controlling, and setting parameters to change device status or parameters.

[0051] Function code 06 represents a critical control command, indicating a high-risk operation. It serves as the primary basis for constructing control command edges in subsequent heterogeneous graph modeling steps. Monitoring anomalies in function code 06 (such as abnormal sources, sudden frequency increases, or the writing of illegal values) is crucial for detecting attacks (such as unauthorized remote control of devices or tampering with device parameters).

[0052] (2) HMI data includes user operation logs and interface event streams;

[0053] ① User operation logs include: login time, logout time, and parameter modification records;

[0054] ②The UI event flow includes button clicks and UI switching;

[0055] For example, the HMI data sampling frequency is 1 second / time.

[0056] (3) Both SCADA data and gateway data include: Manufacturing Message Specification (MMS) messages of the IEC61850 protocol and cross-device interaction link records;

[0057] ①MMS data includes control commands and status monitoring;

[0058] ② Cross-device interaction link records include the uplink data flow path from RTU to gateway to SCADA, and the downlink data flow path from SCADA to gateway to RTU.

[0059] Step S12: Preprocess the real-time acquired power network flow data of the target area power grid to standardize the power network flow data and eliminate sampling differences. The elimination of sampling differences in this invention is not simply deduplication and filling in missing values, but rather a targeted processing based on the characteristics of the power data.

[0060] The power network traffic data of the target area power grid is preprocessed, including: invalid data filtering, equipment type and protocol type labeling, timestamp alignment, and feature standardization.

[0061] (1) Invalid data filtering: Remove empty protocol fields (such as missing function codes in Modbus messages), duplicate telemetry values ​​(continuous identical sampling due to equipment failure), and physical anomalies (such as voltage = -10kV, which is outside the normal range of the power system) from the power network traffic data.

[0062] (2) Device type and protocol type labeling: Label the device category and protocol type for each data source to ensure that the heterogeneous graph can distinguish the node types in the subsequent process;

[0063] For example, RTU_Modbus_189.112.68.4 and HMI_IEC61850_192.168.1.10;

[0064] (3) Timestamp alignment: Due to the difference in sampling frequency between RTU and HMI (e.g., RTU samples every 100ms, HMI records every 1s), linear interpolation is used to align the data to a 100ms time granularity to avoid feature deviation caused by timing misalignment.

[0065] (4) Feature standardization: The sliding window Z-score normalization method is used to standardize the original feature data of the aligned timestamps.

[0066] Sliding window settings: For example, a 5-minute sliding window is used (covering the typical disturbance-recovery cycle of the power system), and the mean is calculated within the window. with standard deviation ;

[0067] For each aligned timestamp of power network traffic data, perform the following calculation:

[0068]

[0069] in, These are the standardized eigenvalues; The original feature data for aligning timestamps.

[0070] Feature standardization eliminates the impact of differences in sampling frequency and range of different devices. For example, RTU telemetry values ​​and HMI operation frequency are both mapped to the [-2,2] interval after standardization, ensuring fair feature weights in subsequent model training.

[0071] The sliding window updates dynamically. For example, the sliding window slides once every minute to adapt to the dynamic changes in the power network in real time (such as the overall increase in telemetry values ​​during peak load periods) and avoid feature distortion caused by static standardization.

[0072] Step S1 is to preprocess the raw flow data of the multi-source heterogeneous power network collected in real time, and transform it into a standardized time series data set that eliminates equipment differences and sampling noise, so as to provide a data foundation for the subsequent construction of an accurate heterogeneous graph model.

[0073] Step S2 includes steps S21-S22.

[0074] Based on the preprocessed heterogeneous power network traffic data, a combined heterogeneous graph is dynamically constructed.

[0075] In this scheme, a physical device (such as RTU, HMI, SCADA, or gateway) and its attributes are considered as a node.

[0076] Step S21: Extract differential features from the preprocessed power network traffic data to obtain node features.

[0077] Based on the source device type of the power network traffic data, differential features are extracted from the power network traffic data to obtain node features; a set of heterogeneous power nodes is constructed. The heterogeneous nodes in this invention are not single-type nodes of traditional isomorphic graphs.

[0078] The coded node ID is labeled with the device type and protocol type in step S12 to ensure that the node can be directly identified by utilizing the heterogeneous attributes of each node; node features are extracted based on the differences in physical device type.

[0079] Based on the source device type of the power network traffic data, differential feature extraction is performed on the preprocessed power network traffic data to obtain node features, including:

[0080] If the source device type is RTU, extract the Modbus protocol features, telemetry features, and device status features from the power network traffic data to obtain the RTU node features;

[0081] If the source device type is HMI, extract the operation characteristics, user characteristics, and interface characteristics of the power network traffic data to obtain the HMI node characteristics;

[0082] If the source device type is a gateway or SCADA, extract the protocol conversion characteristics, link characteristics, and security characteristics of the power network traffic data to obtain the gateway node characteristics or SCADA node characteristics.

[0083] The source device type refers to the type or role of the device that initiates the communication request or sends the data packet.

[0084] (1) If the source physical device type is RTU, extract the Modbus protocol features, telemetry features, and device status features of the preprocessed power network traffic data to obtain 256-dimensional RTU node features;

[0085] Modbus protocol features include: one-hot encoding of function codes and hash values ​​for register addresses;

[0086] Telemetry features include: mean voltage, mean current, mean frequency, variance, and slope;

[0087] Equipment status characteristics include: online duration and number of failures.

[0088] Modbus protocol features, 112 dimensions; telemetry features, 104 dimensions; device status features, 40 dimensions; totaling 256 dimensions of RTU node feature data.

[0089]

[0090] (1) The 112-dimensional Modbus protocol features are derived from the one-hot encoding of function codes and the hash value of register addresses.

[0091] a) Function code one-hot encoding extension (32 dimensions in total)

[0092] ① Basic function code one-hot (8-dimensional): Encodes the 8 commonly used function codes of RTU (01, 02, 03, 04, 05, 06, 08, 16).

[0093] ② Function code timing segment encoding (24 dimensions): The function code sequences of the most recent 10 messages are divided into groups of 5, and each group is encoded through a 6-dimensional micro-embedding layer, resulting in 2 groups with a total of 12 dimensions; then, statistical features are calculated for the entire 10 sequences: the number of different function codes (1 dimension), the ratio of the occurrence of 03 to 06 (1 dimension), sequence entropy (1 dimension), and transition frequency (1 dimension); totaling 8+12+4=24 dimensions.

[0094] Revised to 32 dimensions: The output of the micro-embedding layer is changed to 8 dimensions, with 2 groups totaling 16 dimensions; the statistical features now include the longest consecutive read / write sequence length (2 dimensions). That is: 8 (basic) + 16 (temporal embedding) + 6 (statistical features) + 2 (consecutive sequences) = 32 dimensions.

[0095] b) Register address hash value extension (80 dimensions in total)

[0096] ① Basic hash index (1-dimensional): Hash the current or main register address using %1024 to obtain one index value;

[0097] ② Multi-granularity hash vector (79 dimensions):

[0098] Sliding window hash set (40-dimensional): The register addresses of the 20 most recent packets are processed using 5 different hash functions. Each function produces a sparse vector of 128 buckets. The average of these 20 packets' vectors is taken (compressed to 128 dimensions). Principal component analysis (PCA) is then performed on these 5 128-dimensional vectors to reduce them to 8 dimensions, resulting in 5*8=40 dimensions.

[0099] The five different hash functions are designed to have complementary statistical properties, including but not limited to: hashing based on address numeric bit operations, hashing based on cryptographic algorithms, and hashing based on address business semantics.

[0100]

[0101] Address range distribution (16-dimensional): The Modbus address space (e.g., 0x0000-0xFFFF) is divided into 16 consecutive ranges. The frequency of accesses falling into each range within the window is counted to obtain a 16-dimensional distribution vector.

[0102] Address change pattern (8-dimensional): Calculate the mean, variance, and sign ratio of the difference sequence of recent register address sequences (3-dimensional); autocorrelation of register addresses (3-dimensional); whether it is a cyclic access pattern (2-dimensional, such as polling a fixed number of addresses).

[0103] Semantic hash enhancement (15-dimensional): Based on the preset address-function code combination rules (such as the combination of address 40001 and function code 03), a 15-dimensional rule matching degree vector is generated.

[0104] (2) The 104-dimensional telemetry features are derived from the mean, variance, and slope of voltage / current / frequency, which are 3 physical quantities * 3 statistical items = 9 basic values.

[0105] a) Multiscale statistical extension (75 dimensions in total)

[0106] Mean expansion: Calculate the mean of five time windows: current value, last 10 seconds, last 1 minute, last 5 minutes, and last 1 hour; 3 physical quantities * 5 windows = 15 dimensions.

[0107] Variance expansion: Calculate the variance for three time windows: the last 10 seconds, the last 1 minute, and the last 5 minutes. 3*3=9 dimensions. Simultaneously add the coefficient of variation (standard deviation / mean) for the last 1 minute; 3*1=3 dimensions. Total: 9+3=12 dimensions.

[0108] Slope expansion: Calculate the linear fitting slopes for the three granularities based on the most recent 5, 10, and 30 points; 3*3=9 dimensions. Add slope stability (standard deviation of the slopes for the three granularities); 3*1=3 dimensions; Total 9+3=12 dimensions.

[0109] Higher-order moments and shape: Calculate the skewness and kurtosis of the data in the last minute; 3*2=6 dimensions.

[0110] Extreme values ​​and range: the maximum value, minimum value, and range within the last 5 minutes; 3*3=9 dimensions.

[0111] Crossing and positioning: The number of times a value crosses its mean within the last minute; 3*1=3 dimensions.

[0112] Short-term Fourier coefficients: Perform FFT (Fast Fourier Transform) on the sequence of nearly 64 sampling points, and take the amplitude of the first 3 main frequency components; 3*3=9 dimensions.

[0113] b) Multivariate relationship features (29 dimensions in total)

[0114] ① Covariance matrix elements: Calculate the covariance between each pair of U (voltage), I (current) and F (frequency) (approximately 1 minute), and obtain 3 independent values, 3-dimensional.

[0115] ② Linear regression characteristics: Using U as the independent variable and I as the dependent variable, a linear fit is performed to obtain the slope, intercept, and R² residuals (3 dimensions). Similarly, the UF and IF relationships are calculated, resulting in 3*3=9 dimensions.

[0116] ③ Phase synchronization: Calculate the maximum value and corresponding lag of the cross-correlation function of U and I waveforms near zero lag, 2D.

[0117] ④ Power and power factor approximation: Calculate the approximate values ​​(scalar, 3-dimensional) of apparent power, active power, and reactive power, and the mean value (1-dimensional) of the power factor over the past minute, 4-dimensional.

[0118] ⑤ Unbalance: The unbalance of the three-phase current (1-dimensional), and the estimated amplitudes of the positive-sequence, negative-sequence, and zero-sequence components (3-dimensional), 4-dimensional.

[0119] ⑥ Harmonic distortion rate approximation: Based on the FFT results, calculate the approximate value of the total harmonic distortion rate (1-dimensional).

[0120] ⑦ Frequency-active power static characteristic coefficient (1-dimensional): Frequency variation within the calculation window. Changes in total active power The ratio is approximately This reflects the primary frequency regulation characteristics of the power grid; outliers may indicate that critical generators have been attacked or have gone out of service.

[0121] ⑧ Voltage-Reactive Power Sensitivity (1D): Voltage change within the calculation window. Changes in total reactive power The ratio is approximately It reflects the voltage support capacity of the power grid. An anomaly may indicate that reactive power compensation equipment (such as SVG and capacitors) has been maliciously switched on or off.

[0122] ⑨ Three-phase voltage imbalance (1-dimensional), calculation , These represent the maximum, minimum, and average voltage values ​​within a window. Voltage imbalance may originate from line faults or single-phase ground faults.

[0123] ⑩ Proportion of negative sequence components in voltage / current (2D): Based on the symmetrical component method, the ratio (U2 / U1) of the amplitude of the negative sequence voltage component (U2) to the amplitude of the positive sequence voltage component (U1), and the proportion of negative sequence current (I2 / I1) are calculated respectively. Motor loads are extremely sensitive to negative sequence components. An abnormally high value of this ratio is a strong indicator for judging asymmetrical attacks or open circuit faults.

[0124] Power factor change rate (1D): Calculates the standard deviation of the power factor within a window. Rapid fluctuations in the power factor may indicate frequent load switching or a burst of power.

[0125] (3) 40-dimensional equipment status characteristics are derived from online duration and number of failures.

[0126] a) Online duration extension (20 dimensions in total)

[0127] ① Original values ​​and transformations: Original values, logarithmic transformation values, and square root transformation values ​​of continuous online duration, in 3D.

[0128] ② Multi-period online rate: Online rate over the past 1 day, 7 days, and 30 days (online duration / total duration). 3-dimensional.

[0129] ③ Regularity of online time: Statistically analyze the distribution of the most recent 30 online times in a 24-hour day, calculate their entropy value and main time periods (such as one-hot encoding for "day shift" and "night shift"), 4-dimensional.

[0130] ④ Heartbeat Interval Statistics: The mean and variance of the heartbeat message or periodic data reporting interval when the system is online normally, in 2D.

[0131] ⑤ Historical survival analysis features: Based on historical online and offline records, calculate the mean time between failures, the duration of the most recent offline event, and the frequency of recent offline events in 3 dimensions.

[0132] ⑥ Predictive features: Based on a time series model, predict the probability of remaining online within the next hour, 1-dimensional.

[0133] b) Fault Count Extension (20 dimensions in total)

[0134] Frequency across multiple time windows: the number of failures occurring in the last hour, 24 hours, 7 days, and 30 days, in 4 dimensions.

[0135] Failure rate: Divide the above number of times by the corresponding duration to obtain the failure rate, which is 4-dimensional.

[0136] Failure Interval: The time interval between the three most recent failures, 3D.

[0137] Fault type distribution: Faults are roughly divided into communication, power supply, sensor and other categories, and the recent proportions are statistically analyzed in 4 dimensions.

[0138] Fault Severity Vector: A 5-dimensional severity score vector is generated based on fault codes or log keywords.

[0139] Fault recovery mode: The recovery time and number of intermediate state transitions from the most recent fault to the return to stable operation, in 2D.

[0140] (2) If the source device type is HMI, extract the 48-dimensional operation features, 40-dimensional user features, and 40-dimensional interface features of the power network traffic data to obtain a total of 128-dimensional HMI node features;

[0141] Operational characteristics of power grid traffic data include: number of operations in the past hour and the proportion of sensitive operations;

[0142] User characteristics: User permission level, historical operation compliance rate;

[0143] Interface features: Current display interface ID, button click frequency.

[0144]

[0145] (3) If the source device type is a gateway or SCADA, extract the 64-dimensional protocol conversion features, 64-dimensional link features, and 64-dimensional security features of the power network traffic data to obtain 192-dimensional gateway node features or 192-dimensional SCADA node features.

[0146] The 64-dimensional protocol conversion features include: forwarding delay from Modbus to IEC 61850;

[0147] The 64-dimensional link characteristics include: number of connected devices and data forwarding volume;

[0148] The 64-dimensional security features include: firewall rule matching rate and number of abnormal packets blocked.

[0149] a) 64-dimensional protocol conversion features, describing the performance and behavior patterns of the device in converting and processing different protocols.

[0150] Delay characteristics (8 dimensions): Average / minimum / maximum / 95th percentile forwarding delay between key protocol pairs such as Modbus→IEC61850 and IEC61850→DNP3 (4 protocol pairs × 2 statistics = 8 dimensions).

[0151] Throughput characteristics (8 dimensions): Average / peak packet forwarding rate (packets / s) in each protocol direction;

[0152] Protocol field mapping integrity (16-dimensional): The success rate of mapping source protocol fields to target protocol fields for 8 key data points (such as telemetry values ​​and device status);

[0153] Session state synchronization characteristics (16 dimensions): Records the state synchronization latency and success rate of the four main session states (establishment, hold, interruption, and recovery) during protocol transitions (4 states × 4 indicators).

[0154] Error codes and retransmission characteristics (16 dimensions): frequency of specific error codes occurring during each protocol conversion process (8 dimensions) and retransmission rate triggered by conversion failure (8 dimensions).

[0155] b) 64-dimensional link characteristics, describing the network connectivity and data carrying status of the device.

[0156] Connection topology features (16 dimensions): Number of directly connected sub-devices (4 types of devices × 4 statistics: current value, daily average, peak value, variance);

[0157] Data traffic characteristics (24 dimensions):

[0158] Throughput: Total bytes uplink / downlink (bps), packets (pps);

[0159] Traffic composition: The percentage of traffic from services such as telemetry, remote control, remote signaling, and file transfer (%).

[0160] Traffic burstiness: Traffic variance and peak-to-average power ratio calculated based on a sliding window;

[0161] Link quality characteristics (24 dimensions):

[0162] Basic metrics: Round-trip time (RTT), jitter, packet loss rate (8 dimensions);

[0163] Time series pattern: The trend (slope) of the above indicators in the most recent 1, 5, and 15 minutes (8 dimensions);

[0164] Ports and Connections: Number of active TCP / UDP ports, number of concurrent connections and their rate of change (8 dimensions).

[0165] c) 64-dimensional security features, describing the device's security policy execution and threat handling.

[0166] Strategy execution characteristics (24 dimensions):

[0167] Firewall / ACL match rate: The percentage of traffic that hits predefined security rules (subdivided by rule type: blacklist, whitelist, abnormal protocol);

[0168] Deep Packet Inspection (DPI) Results: Number of times potential malicious payloads or protocol violations were identified;

[0169] Session audit compliance rate: The percentage of sessions that are fully recorded and meet audit requirements.

[0170] Active defense features (24 dimensions):

[0171] Abnormal message interception: Interception count and rate for different attack types (such as malformed messages, flood attacks, and illegal function codes);

[0172] Intrusion Prevention System (IPS) Actions: Alarm Level Distribution (High, Medium, Low) and Number of Automatic Blocking Events;

[0173] Security status and contextual features (16 dimensions):

[0174] Self-defined vulnerability indicators: The presence of known high-risk vulnerabilities based on the CVE database (Boolean vector);

[0175] Neighboring threat propagation: The number and level of security alarms generated by directly connected devices in the past hour;

[0176] Certificates and Encryption Status: Percentage of valid certificates and usage of weak encryption suites.

[0177] The purpose of step S21 is to obtain node features.

[0178] Step S22: Construct edges between nodes, add protocol features, and obtain the protocol interaction meta-path.

[0179] Interaction feature embedding is performed on the edges between node features to obtain the protocol interaction meta-path, including:

[0180] Add interaction frequency, protocol compliance rate, and transmission latency to each edge, and dynamically update the edges according to preset time slices to obtain the protocol interaction metapath.

[0181] Based on the power business interaction logic, edges are generated between node features. The edge generation rule is to retain only the interactions that conform to the power business logic, such as the telemetry data transmission edge from RTU to gateway (based on Modbus protocol), the control command transmission edge from HMI to SCADA (based on IEC61850 protocol), and the data forwarding edge from gateway to SCADA. Meaningless random connections, such as direct communication from HMI to RTU, are eliminated because they do not conform to the power system topology.

[0182] Interaction features are embedded into the edges between node features. Interaction frequency, protocol compliance rate, and transmission latency are added to each edge. The edges are dynamically updated according to a preset time slice (i.e., time window) to obtain the protocol interaction meta-path. The feature embedding of the edges adds interaction features to each edge, which is different from the featureless edges of traditional graphs.

[0183] ① Interaction frequency: For example, the edge from RTU to gateway is embedded with the number of interactions per 100ms (normal range 5-10 times / 100ms).

[0184] ② Protocol compliance rate: For example, the compliance rate of Modbus edge embedded function code (normally 100%, but may drop below 80% during an attack).

[0185] ③ Transmission delay: For example, the transmission delay of IEC61850 edge-embedded messages (normally <100ms, may be >500ms in abnormal situations).

[0186] ④ Update according to preset time slices: The edges are dynamically updated in 30-second time slices to form a dynamic heterogeneous graph sequence. For example, the set of edges in time slice t1 (00:00-00:30) reflects the interaction state during that time period, and time slice t2 (00:30-01:00) is updated to the new interaction state to adapt to the real-time dynamics of the power network.

[0187] Based on node characteristics and protocol interaction meta-paths, a combined heterogeneous graph is generated to characterize the state and interaction relationships of the power cyber-physical system, such as... Figure 4 As shown, the attack path is visualized; the attack path is as follows:

[0188] 189.112.68.4->72.246.31.26->207.46.203.78->64.12.238.62->

[0189] 198.31.50.33->72.29.89.200->98.129.77.170->65.78.180.146.

[0190] Step S2 is to transform the original time-series data stream into a dynamic combination heterogeneous graph that integrates device attributes, interaction behaviors, and business logic by performing semantic-driven feature extraction and relationship modeling on the preprocessed heterogeneous power network traffic data.

[0191] Step S3, specifically.

[0192] The potential attack path generation model consists of a Graph Attention Network (GAT) layer, a Graph Convolutional Network (GCN) layer, an auxiliary layer, and a fully connected layer connected in sequence.

[0193] The pre-trained potential attack path generation model is obtained by jointly training the potential attack path generation model and the noise generation model. The noise generation model is based on the Large Language Model (LLM) model integrated with DeepSeek-R1:32B.

[0194] The potential attack path generation model includes a GAT layer, a GCN layer, an auxiliary layer, and a fully connected layer connected in sequence.

[0195] The GAT layer is used to call the sparse adjacency matrix template; the sparse adjacency matrix template is obtained by jointly training the attack path generation model and the noise generation model.

[0196] The GCN layer is used to perform neighborhood aggregation on the node features in the combined heterogeneous graph based on the sparse adjacency matrix template to obtain the node interaction feature vector.

[0197] The auxiliary layer is used to process the correlation between the node itself and its neighborhood in the node interaction feature vector and to normalize it to eliminate the feature distribution offset of the node interaction feature vector, so as to obtain an optimized node interaction feature vector.

[0198] The fully connected layer is used to perform linear transformation and probability mapping on the optimized node interaction feature vector to obtain the probability of potential attack paths.

[0199] (1) In the GAT layer, the sparse adjacency matrix template output after the joint training of the potential attack path generation model and the noise generation model is directly called;

[0200] For example, protocol interaction meta-path 1 (RTU→Modbus→telemetry): the weight is initially set to 0.8 (critical path, directly affecting scheduling decisions).

[0201] Protocol interaction meta-path 2 (HMI→IEC 61850→Control): initial weight set to 0.7 (important path, involving operational safety);

[0202] Protocol interaction meta-path 3 (ordinary sensor → TCP → data reporting): weight initially set to 0.3 (non-critical path, with more noise);

[0203] (2) In the GCN layer, based on the sparse adjacency matrix template, the node features in the combined heterogeneous graph are aggregated in the neighborhood to obtain the node interaction feature vector;

[0204] Neighborhood aggregation is performed on the features of RTU nodes to obtain the interaction feature vector of RTU nodes, as shown below:

[0205] The node features are aggregated into neighborhoods as follows:

[0206]

[0207] in, For node interaction feature vectors; and These are the node feature vector and the neighboring node feature vector, respectively; and These are the weights of the node's feature vector and the feature vectors of each of its neighboring nodes, respectively. The set of neighboring nodes in the sparse adjacency matrix template represents the node characteristics. For the neighboring node index; for example, and They are 0.8 and 0.2 respectively.

[0208] (3) The auxiliary layer includes the self-attention processing layer and the batch normalization elimination layer;

[0209] The self-attention processing layer is used to process the node interaction feature vectors to perform correlation processing between the node itself and its neighborhood (e.g., when RTU telemetry is abnormal, the feature weights of the gateway node are adjusted synchronously).

[0210] The batch normalization elimination layer is used to eliminate the feature distribution offset of the node interaction feature vector (improving the model's generalization ability) to obtain the optimized node interaction feature vector;

[0211] Specifically as follows:

[0212] (1) Self-attention processing layer (processing the relationship between the node itself and its neighborhood)

[0213] Based on node interaction feature vectors N is the number of nodes, and D is the feature dimension and number of nodes. Neighborhood set Node abnormal state vector , (1 indicates an anomaly) Node association weight matrix Matrix elements Represents a node Strongly associated adjacent nodes;

[0214] Linear transformation: mapping the node interaction feature vectors. ,in, Let D be the learnable weight matrix, and D' be the hidden layer dimension.

[0215] Attention score calculation: merging node abnormal states and associations ,as follows:

[0216]

[0217] in, For attention parameters, The learnable coefficient, This indicates a splicing operation.

[0218] Attention weight normalization: Ensure that the weight sum is 1.

[0219] Feature aggregation: Weighted aggregation of neighborhood features. ,in, It is the ReLU activation function. These are the aggregated neighborhood features.

[0220] (2) Batch normalization elimination layer (eliminating feature distribution offset)

[0221] Features based on self-attention processing Perform batch standardization.

[0222] Batch normalization: Standardizing batch characteristics. ,in, Batch average , where is the batch variance. For learnable parameters, numerical stability terms This is to prevent numerical instability when the denominator is zero or close to zero.

[0223] Obtain the optimized node interaction feature vector .

[0224] In the fully connected layer, the Sigmoid function is used to perform probability mapping on the optimized node interaction feature vector to obtain the probability of potential attack paths. The probability of potential attack paths is between 0 and 1. The closer it is to 1, the less likely there is a potential attack path and no risk of attack.

[0225] The implementation details of the fully connected layer technology and the probability of potential attack paths are calculated as follows:

[0226] Input: Optimized node interaction feature vector .

[0227] Linear transformation: reduces the dimensionality of features to 1 dimension. ,in, , These are learnable parameters.

[0228] Probability mapping: Probabilities are output through the Sigmoid function. ,in, The potential attack probability of the path associated with node i; thus, the potential attack path probability vector is obtained. .

[0229] like Figure 2 As shown, the joint training of the potential attack path generation model and the noise generation model includes:

[0230] The power network traffic data of the target area power grid within a certain historical period is acquired and preprocessed to obtain the corresponding combined heterogeneous graph as a sample. The power network traffic data includes a large amount of normal behavior data and a small amount of abnormal behavior data.

[0231] The combined heterogeneous graph corresponding to the normal behavior data is used as a normal behavior sample and input into the potential attack path generation model to drive the potential attack path generation model to learn normal interaction behavior patterns.

[0232] The normal behavior samples and the power attack pattern library are input into the noise generation model to obtain grammatically compliant abnormal behavior samples; wherein, the power attack pattern library includes abnormal samples of various historical power attacks.

[0233] The normal behavior samples and abnormal behavior samples are mixed together with the corresponding sample labels to form a mixed behavior sample;

[0234] The mixed behavior samples are used to generate potential attack paths to obtain corresponding normal or abnormal discrimination results, which are then used to calculate the discrimination loss; the mixed behavior samples are input into a noise generation model to obtain generation results, which are then used to calculate the adversarial loss.

[0235] The model is updated and trained based on the joint loss function constructed from the discriminative loss and adversarial loss. After reaching the preset training termination condition, the parameters of the potential attack path generation model are saved to obtain the trained potential attack path generation model.

[0236] Phase 1: The potential attack path generation model learns normal interaction behavior patterns.

[0237] For example, historical data of actual power network traffic in the target area's power grid within one year are obtained to obtain combined heterogeneous graphs at multiple times; the combined heterogeneous graphs corresponding to normal behavior data in the multiple combined heterogeneous graphs to be trained are used as normal behavior samples and input into the potential attack path generation model to drive the potential attack path generation model to learn normal interaction behavior patterns.

[0238] In the GAT layer, the attention weights of the protocol interaction meta-paths in the normal behavior data are calculated. Based on the attention weights and preset pruning weights of the protocol interaction meta-paths in the normal behavior data, the protocol interaction meta-paths in the normal behavior data are pruned to generate the first sparse adjacency matrix template.

[0239] For example, preset pruning weights The default value is 0.7, which can be changed according to specific needs in actual applications. The attention weight of the protocol interaction metapath is greater than or equal to... The value is retained; otherwise, pruning is performed, and the metapath is removed.

[0240] For example, the discrimination loss is the cross-entropy loss; the cross-entropy loss is calculated, and the backpropagation uses the AdamW optimizer to optimize and update the GAT, GCN, and fully connected layer parameters of the potential attack path generation model.

[0241] Phase Two: The LLM model generates grammatically compliant samples of anomalous behavior.

[0242] Input normal behavior samples and a library of power attack patterns into the noise generation model, and output grammatically compliant abnormal behavior samples, including:

[0243] The normal function codes in the normal behavior samples are modified to illegal function codes corresponding to samples in the power attack pattern library that are different except for the function codes, and an abnormal message is generated.

[0244] Modify the normal operation time in the normal behavior sample to the unauthorized operation time corresponding to the sample in the power attack pattern library that is different from the normal operation time, and generate an abnormal operation log.

[0245] The normal voltage in the normal behavior sample is modified to the non-voltage tolerance range corresponding to the sample in the power attack pattern library except for the voltage, and abnormal telemetry data is generated.

[0246] The abnormal message, abnormal operation log, and abnormal telemetry data are input into the noise generation model to obtain a grammatically compliant abnormal behavior sample.

[0247] LLM integrates DeepSeek-R1:32B for the power sector. In this solution, DeepSeek-R1:32B serves as the knowledge engine and semantic understanding core for the power sector, providing protocol compliance constraints and intelligent anomaly sample enhancement for adversarial training. This significantly improves the generation quality of potential attack paths and the generalization ability of the detection model.

[0248] The power attack pattern library includes anomalous data on various historical power attacks;

[0249] Protocol semantic understanding (e.g., input "Modbus function code 06", output "Write to a single holding register for parameter setting"), attack mode classification (input abnormal message, output "function code tampering attack / abnormal traffic injection / unauthorized operation"), and abnormal sample generation (input normal Modbus message, output abnormal message that conforms to the attack logic).

[0250] Generation logic (distinct from traditional random noise):

[0251] (1) Modbus function code tampering: change the normal function code 03 (read) to the illegal function code 65 in the power attack mode library, keep other fields (register address, data value) unchanged, and generate an abnormal message of "function code 65 + address 0x0001 + voltage 10kV";

[0252] (2) Operations outside authorized time periods: Change the normal operation time of HMI (9:00-17:00) to the unauthorized operation time of 2:00 AM in the power attack mode library, and generate an abnormal operation log of "unauthorized time period + sensitive parameter modification";

[0253] (3) Abnormal telemetry injection: Change the normal RTU voltage of 10kV to the non-voltage tolerance range of 30kV in the power attack mode library (which exceeds the system tolerance range) to generate abnormal telemetry data of "physical abnormal value + compliance protocol field".

[0254] Based on abnormal messages, abnormal operation logs, and abnormal telemetry data, 1,000-2,000 grammatically compliant abnormal behavior samples are obtained per training round. Each abnormal behavior sample conforms to the communication syntax of power equipment and is abnormal only in the function code, operation period, and voltage key dimensions.

[0255] Phase 3: Dual-model joint adversarial training:

[0256] Abnormal behavior samples and normal behavior samples are mixed in a certain proportion. For example, 20% abnormal behavior samples and 80% normal samples are mixed. The samples are labeled with adversarial samples as 1 and normal samples as 0 to obtain mixed behavior samples.

[0257] The potential attack path generation model is input from the mixed behavior sample. In the GAT layer, the attention weights of the protocol interaction meta-paths in the mixed behavior sample are calculated. Based on the attention weights and preset pruning weights of the protocol interaction meta-paths in the mixed behavior sample, the protocol interaction meta-paths in the mixed behavior sample are pruned to generate the second sparse adjacency matrix template.

[0258] After extracting features through the GAT layer, GCN layer, and auxiliary layer, the gradient of the abnormal behavior sample is multiplied by -1 and the gradient is reversed. The purpose is to make it difficult for the potential attack path generation model to distinguish between abnormal behavior samples and normal behavior samples.

[0259] Calculate the weighted sum of cross-entropy loss and adversarial loss: cross-entropy loss drives the potential attack path generation model to distinguish between normal behavior samples and abnormal behavior samples, while adversarial loss drives the LLM model to generate abnormal behavior samples that are more difficult to distinguish.

[0260] Backpropagation: The parameters of the potential attack path generation model are updated through cross-entropy loss (to improve discriminative power), while the parameters of the LLM model are updated through adversarial loss (to improve sample deception).

[0261] Dynamic pruning is performed synchronously: weights are dynamically adjusted, and interaction edges are pruned based on the attention weights of protocol interaction meta-paths. For example, protocol interaction meta-paths with weights ≥ 0.7 are retained, reducing the adjacency matrix computation complexity from O(N^2) of traditional fully connected graphs. 2 The weight of the critical path is reduced to O(mN), where m is the number of critical paths. For example, if a protocol anomaly occurs on the edge from RTU to gateway, the weight of the protocol interaction meta-path to which the edge belongs is automatically increased to 0.9, which strengthens the model's attention to critical anomalies.

[0262] After every 5 rounds of training, based on the attention weights of the GAT layer, edges with weights ≥ 0.7 (such as key telemetry edges from RTU to gateway) are retained, while edges with weights < 0.7 (such as redundant reporting edges from ordinary sensors) are removed. The templates of the first and second sparse adjacency matrices are then updated to ensure the model is lightweight.

[0263] Training configuration: Equipment used, CUDA and lightweight parameters;

[0264] Hardware acceleration: Utilizing NVIDIA A100 GPU (CUDA 11.7 environment), it performs parallel computation of matrix multiplication of sparse adjacency matrices (4-6 times more efficient than CPU computation), with each training round taking less than 10 minutes at a scale of 100,000 nodes.

[0265] Joint loss function: The joint loss function is a weighted sum of cross-entropy discriminative loss and adversarial loss. Cross-entropy loss ensures that the potential attack path generation model can distinguish between normal and abnormal, while adversarial loss ensures that the abnormal samples generated by the LLM model can confuse the potential attack path generation model. For example, the weight ratio of discriminative loss and adversarial loss is 7:3 to balance detection accuracy and robustness.

[0266] Optimizer and Learning Rate: The potential attack path generation model uses the AdamW optimizer (learning rate...) Weight decay The LLM model uses the Lion optimizer (learning rate). To improve model training stability, the learning rate is reduced to 0.8 of the previous round every 10 rounds to avoid oscillations in later stages.

[0267] Termination condition for adversarial iterative training: Training stops when either of the following two conditions is met.

[0268] ① The potential attack path generation model consistently achieved an F1 score of over 92% on the mixed behavior sample set for three consecutive rounds;

[0269] ② The potential attack path generation model has a detection rate of ≥88% for Modbus protocol tampering attacks and a false positive rate of ≤3.5%.

[0270] Obtaining the sparse adjacency matrix template includes:

[0271] In the GAT layer, the attention weights of the protocol interaction meta-paths in the combined heterogeneous graph corresponding to the normal behavior data are calculated. Based on the attention weights of the protocol interaction meta-paths in the combined heterogeneous graph corresponding to the normal behavior data and the preset pruning weights, the protocol interaction meta-paths in the combined heterogeneous graph corresponding to the normal behavior data are pruned to generate the first sparse adjacency matrix template.

[0272] In the GAT layer, the attention weights of the protocol interaction meta-paths in the hybrid behavior samples are calculated. Based on the attention weights and preset pruning weights of the protocol interaction meta-paths in the hybrid behavior samples, the protocol interaction meta-paths in the hybrid behavior samples are pruned to generate the second sparse adjacency matrix template.

[0273] After the potential attack path generation model and the noise generation model are jointly trained, the intersection of the first sparse adjacency matrix template and the second sparse adjacency matrix template is calculated to obtain the sparse adjacency matrix template.

[0274] The sparse adjacency matrix template obtained after joint training is directly called when the potential attack path generation model is actually used.

[0275] The combined heterogeneous graph is input into a pre-trained potential attack path generation model, and a fully connected layer is used for probability mapping to obtain the probability of potential attack paths.

[0276] The purpose of step S3 is to optimize the model through adversarial joint training, enabling it to accurately identify covert attack paths in power system protocol interactions on the combined heterogeneous graph with pruning and noise reduction.

[0277] Step S4, specifically.

[0278] Anomaly detection: When the probability of a potential attack path is >0.8, it is marked as a suspicious edge; when the length of the path formed by the suspicious edges is ≥3, such as RTU→gateway→SCADA, an alarm is triggered, because APT attacks are usually multi-node penetrations.

[0279] Based on the probability of the potential attack path, a suspicious path score is calculated, and an attack path is generated based on the suspicious path score, as follows:

[0280]

[0281] in, Score suspicious paths; Probability of potential attack paths; Weights for potential attack paths; This represents the importance weight of the equipment.

[0282] Paths with suspicious path scores greater than the preset suspicious path score are listed as attack paths.

[0283] For example, the importance weight of the gateway device is 1.5, and the importance weight of the ordinary sensor device is 1.0; in actual applications, it can be changed according to specific needs.

[0284] Will The path column represents the attack path, and the nodes involved are the attack path nodes. For example... Figure 4 As shown, the attack path is highlighted in the heterogeneous topology diagram; the device IP attack path is: 189.112.68.4→72.246.31.26→207.46.203.78→64.122.31.50.33→198.129.77.170→72.29.89.200→65.78.180.146, and this path is highlighted in the heterogeneous topology diagram.

[0285] like Figure 3As shown, this paper presents a visualized engineering implementation path for a lightweight attack path generation method for power networks, covering the entire process from data input, model building, adversarial training, security detection, and risk mitigation. Targeting the detection of Advanced Persistent Threats (APTs) in power networks, it utilizes heterogeneous data-driven approaches and dual-model collaboration as its technical mainstay, addressing the pain points of traditional power security models, such as poor generalization of the constructed model, lack of domain relevance of adversarial samples, and computationally intensive real-time challenges. This includes:

[0286] 1: Load and preprocess the data, the same as step S1.

[0287] Dynamic charts of power network flow data are created using self-supervised learning and Long Short-Term Memory (LSTM) models, recording the number of charts and data dimensions.

[0288] 2: Construct dynamic graphs, that is, construct dynamic combined heterogeneous graphs, which is the same as step S2.

[0289] 3: Initialize the model; 4: Train the model; 5: Start adversarial training, the same as step S3;

[0290] 6: Start APT detection; 7: Analyze suspicious paths; Same as step S4.

[0291] Real-time data input: Real-time power network traffic is preprocessed and divided into 30-second time windows to generate a real-time dynamic combined heterogeneous diagram;

[0292] Fast inference: Load a pre-trained potential attack path generation model to obtain suspicious path scores.

[0293] The attack path was obtained as follows: RTU (189.112.68.4) → Gateway (72.246.31.26) → SCADA (207.46.203.78). The abnormal characteristics of this path were: Modbus function code 65 and the operation was carried out at 2:00 AM.

[0294] Semantic Interpretation Report: This path is the core control link of the substation. The abnormal characteristics are consistent with the Modbus function code tampering attack mode, which may cause SCADA to receive incorrect telemetry data, thereby leading to scheduling misjudgment.

[0295] Recommended solutions: Temporarily disconnect Modbus communication on this path, upgrade the gateway's protocol verification rules (block function code 65 messages), and add two-factor authentication for HMI users.

[0296] The highlighted attack path topology map, semantic interpretation report, and handling suggestions are written into the security log and pushed to the operation and maintenance terminal to achieve closed-loop handling of security incidents.

[0297] This technical solution improves generalization ability:

[0298] On a test set containing four types of devices (RTU, HMI, gateway, and SCADA), this solution achieved an F1-score of 92.7%, a significant improvement over the traditional isomorphic graph model's 78.4%. Figure 5 As shown.

[0299] The detection rate for Modbus protocol tampering attacks increased from 61% to 89%, while the false positive rate decreased from 21.6% to 3.2%. Figure 6 Outlier analysis standard deviation histogram;

[0300] The left / right bar represents the average false alarm rate: 21.6% for the traditional scheme and 3.2% for this scheme.

[0301] The line represents the Modbus attack detection rate: 61% for the traditional solution and 89% for this solution.

[0302] The error bar reflects the standard deviation of the false alarm rate: ±4.8% for the traditional scheme and ±0.9% for this scheme.

[0303] The arrow indicates the increase in detection rate, +28%.

[0304] Example 2:

[0305] A specific embodiment of the present invention discloses a lightweight attack path generation system for power networks, thereby implementing the lightweight attack path generation method for power networks described in Embodiment 1. The specific implementation of each module is described in the corresponding section of Embodiment 1.

[0306] like Figure 7 As shown, a lightweight attack path generation system for power networks includes a heterogeneous data fusion module M1, a dynamic heterogeneous graph construction module M2, a lightweight adversarial detection module M3, and an attack path generation module M4.

[0307] The heterogeneous data fusion module M1 is used to acquire power network traffic data of the target area power grid in real time and perform preprocessing to eliminate sampling differences between heterogeneous devices, so as to obtain preprocessed time-aligned heterogeneous data.

[0308] The dynamic heterogeneous graph construction module M2 is used to perform heterogeneous graph modeling based on the preprocessed time-aligned heterogeneous data to obtain a combined heterogeneous graph; wherein, the heterogeneous graph modeling includes extracting differentiated node features based on the source device type, and constructing edges with interaction features based on power business logic and protocol type to form protocol interaction meta-paths.

[0309] The lightweight adversarial detection module M3 is used to input the combined heterogeneous graph into a pre-trained potential attack path generation model to obtain the potential attack path probability; wherein, the potential attack path generation model is obtained by joint adversarial training with a noise generation model;

[0310] The attack path generation module M4 is used to calculate a suspicious path score based on the probability of the potential attack path, and generate an attack path based on the suspicious path score.

[0311] Since the system in this embodiment and the method in Embodiment 1 are related and can be referenced from each other, this description is redundant and will not be repeated here. Because this system embodiment shares the same principle as the above method embodiment, it also possesses the corresponding technical effects of the above method embodiment.

[0312] In summary, the lightweight attack path generation method and system for power networks according to embodiments of the present invention have the following beneficial effects:

[0313] 1. This invention overcomes the limitations of traditional homogeneous graph modeling by employing heterogeneous graph modeling to distinguish the node types and communication protocol edge types of power equipment (such as RTUs, HMIs, SCADA systems, and gateways). This enables the model to accurately learn and establish normal interaction baselines that conform to power business logic (such as the difference between periodic telemetry flows and sudden control commands). In complex dynamic attack scenarios, this effectively distinguishes critical attack paths from background noise, significantly improving detection accuracy and generalization ability. It solves the problem of interaction pattern confusion caused by the neglect of device heterogeneity in traditional homogeneous graph models, increasing the attention weight of critical interaction paths and reducing the weight of non-critical noise interactions, thereby reducing the false alarm rate in dynamic attack scenarios.

[0314] 2. This invention addresses the lack of domain knowledge in existing adversarial training by introducing a large language model as a noise generation model. This model integrates knowledge of power protocol specifications, equipment operation logic, and historical attack patterns to generate high-quality adversarial samples that are grammatically compliant and semantically anomalous (such as simulating unauthorized value modifications during periods). Through domain knowledge-driven joint adversarial training, the detection model not only resists random disturbances but also deeply understands and defends against advanced persistent threats that conform to real attack logic, enhancing the model's robustness and adaptability to real advanced threats. By analyzing the unique abnormal behavior of the power network through the noise generation model and co-training it with the message passing mechanism of the potential attack path generation model, dynamic pruning of interactive edges reduces the computational complexity of the adjacency matrix and improves the detection rate of protocol tampering attacks.

[0315] 3. To overcome the bottleneck of low computational efficiency in traditional complex models, this invention integrates a dynamic pruning mechanism based on meta-path attention during training. This mechanism automatically identifies and retains key interaction paths, eliminates redundant connections, and generates a sparse adjacency matrix template. This reduces the computational complexity of online inference, achieving second-level response and low resource consumption while ensuring high detection performance (e.g., F1-score exceeding 92%). This allows the solution to be directly deployed on resource-constrained power monitoring edge devices or central systems, meeting the stringent requirements of real-time performance and lightweight design in production environments. It achieves a balance between high performance and lightweight design, meeting the real-time deployment needs of industry.

[0316] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0317] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for generating lightweight attack paths in power grids, characterized in that, include: Real-time acquisition of power network flow data of the target area power grid and preprocessing to eliminate sampling differences between heterogeneous devices to obtain preprocessed time-aligned heterogeneous data; Based on the preprocessed time-aligned heterogeneous data, heterogeneous graph modeling is performed to obtain a combined heterogeneous graph; wherein, the heterogeneous graph modeling includes extracting differentiated node features based on the source device type, and constructing edges with interaction features based on power business logic and protocol type to form protocol interaction meta-paths. The combined heterogeneous graph is input into a pre-trained potential attack path generation model to obtain the potential attack path probability; wherein, the potential attack path generation model is obtained through joint adversarial training with a noise generation model; The joint training of the potential attack path generation model and the noise generation model includes: The power network traffic data of the target area power grid within a certain historical period is acquired and preprocessed to obtain the corresponding combined heterogeneous graph as a sample. The power network traffic data includes a large amount of normal behavior data and a small amount of abnormal behavior data. The combined heterogeneous graph corresponding to the normal behavior data is used as a normal behavior sample and input into the potential attack path generation model to drive the potential attack path generation model to learn normal interaction behavior patterns. The normal behavior samples and the power attack pattern library are input into the noise generation model to obtain grammatically compliant abnormal behavior samples; wherein, the power attack pattern library includes abnormal samples of various historical power attacks. The normal behavior samples and abnormal behavior samples are mixed together with the corresponding sample labels to form a mixed behavior sample; The mixed behavior samples are input into the potential attack path generation model to obtain the corresponding normal or abnormal discrimination results, which are used to calculate the discrimination loss; the mixed behavior samples are input into the noise generation model to obtain the generation results, which are used to calculate the adversarial loss. The model is updated and trained based on the joint loss function constructed by the discriminative loss and adversarial loss. After reaching the preset training termination condition, the parameters of the potential attack path generation model are saved to obtain the trained potential attack path generation model. Input normal behavior samples and a library of power attack patterns into the noise generation model, and output grammatically compliant abnormal behavior samples, including: The normal function codes in the normal behavior samples are modified to illegal function codes corresponding to samples in the power attack pattern library that are different except for the function codes, and an abnormal message is generated. Modify the normal operation time in the normal behavior sample to the unauthorized operation time corresponding to the sample in the power attack pattern library that is different from the normal operation time, and generate an abnormal operation log. The normal voltage in the normal behavior sample is modified to the non-voltage tolerance range corresponding to the sample in the power attack pattern library except for the voltage, and abnormal telemetry data is generated. The abnormal message, abnormal operation log and abnormal telemetry data are input into the noise generation model to obtain a grammatically compliant abnormal behavior sample. A suspicious path score is calculated based on the probability of the potential attack path, and an attack path is generated based on the suspicious path score.

2. The method for generating lightweight attack paths for power networks according to claim 1, characterized in that, The potential attack path generation model includes a GAT layer, a GCN layer, an auxiliary layer, and a fully connected layer connected in sequence. The GAT layer is used to call the sparse adjacency matrix template; the sparse adjacency matrix template is obtained by jointly training the attack path generation model and the noise generation model. The GCN layer is used to perform neighborhood aggregation on the node features in the combined heterogeneous graph based on the sparse adjacency matrix template to obtain the node interaction feature vector. The auxiliary layer is used to process the correlation between the node itself and its neighborhood in the node interaction feature vector and to normalize it to eliminate the feature distribution offset of the node interaction feature vector, so as to obtain an optimized node interaction feature vector. The fully connected layer is used to perform linear transformation and probability mapping on the optimized node interaction feature vector to obtain the probability of potential attack paths.

3. The method for generating lightweight attack paths for power networks according to claim 1, characterized in that, Obtaining the sparse adjacency matrix template includes: In the GAT layer, the attention weights of the protocol interaction meta-paths in the combined heterogeneous graph corresponding to the normal behavior data are calculated. Based on the attention weights of the protocol interaction meta-paths in the combined heterogeneous graph corresponding to the normal behavior data and the preset pruning weights, the protocol interaction meta-paths in the combined heterogeneous graph corresponding to the normal behavior data are pruned to generate the first sparse adjacency matrix template. In the GAT layer, the attention weights of the protocol interaction meta-paths in the hybrid behavior samples are calculated. Based on the attention weights and preset pruning weights of the protocol interaction meta-paths in the hybrid behavior samples, the protocol interaction meta-paths in the hybrid behavior samples are pruned to generate the second sparse adjacency matrix template. After the potential attack path generation model and the noise generation model are jointly trained, the intersection of the first sparse adjacency matrix template and the second sparse adjacency matrix template is calculated to obtain the sparse adjacency matrix template.

4. The method for generating lightweight attack paths for power networks according to claim 1, characterized in that, Based on the source device type of the power network traffic data, differential feature extraction is performed on the preprocessed power network traffic data to obtain node features, including: If the source device type is RTU, extract the Modbus protocol features, telemetry features, and device status features from the power network traffic data to obtain the RTU node features; If the source device type is HMI, extract the operation characteristics, user characteristics, and interface characteristics of the power network traffic data to obtain the HMI node characteristics; If the source device type is a gateway or SCADA, extract the protocol conversion characteristics, link characteristics, and security characteristics of the power network traffic data to obtain the gateway node characteristics or SCADA node characteristics. The source device type refers to the type or role of the device that initiates the communication request or sends the data packet.

5. The method for generating lightweight attack paths for power networks according to claim 4, characterized in that, Interaction feature embedding is performed on the edges between node features to obtain the protocol interaction meta-path, including: Add interaction frequency, protocol compliance rate, and transmission latency to each edge, and dynamically update the edges according to preset time slices to obtain the protocol interaction metapath.

6. The method for generating lightweight attack paths for power networks according to claim 1, characterized in that, Based on the probability of the potential attack path, a suspicious path score is calculated, and an attack path is generated based on the suspicious path score, as follows: in, Score suspicious paths; Probability of potential attack paths; Weights for potential attack paths; Assign weights to equipment importance; Paths with suspicious path scores greater than the preset suspicious path score are listed as attack paths.

7. The method for generating lightweight attack paths for power networks according to any one of claims 1-6, characterized in that, The power network traffic data includes RTU data, HMI data, gateway data, and SCADA data; The RTU data includes Modbus protocol field data and real-time telemetry data; The HMI data includes user operation logs and interface event stream data; Both the SCADA data and the gateway data include MMS messages of the IEC61850 protocol and cross-device interaction link record data.

8. A lightweight attack path generation system for power grids, characterized in that, The system includes a heterogeneous data fusion module M1, a dynamic heterogeneous graph construction module M2, a lightweight adversarial detection module M3, and an attack path generation module M4. The heterogeneous data fusion module M1 is used to acquire power network traffic data of the target area power grid in real time and perform preprocessing to eliminate sampling differences between heterogeneous devices, so as to obtain preprocessed time-aligned heterogeneous data. The dynamic heterogeneous graph construction module M2 is used to perform heterogeneous graph modeling based on the preprocessed time-aligned heterogeneous data to obtain a combined heterogeneous graph; wherein, the heterogeneous graph modeling includes extracting differentiated node features based on the source device type, and constructing edges with interaction features based on power business logic and protocol type to form protocol interaction meta-paths. The lightweight adversarial detection module M3 inputs the combined heterogeneous graph into a pre-trained potential attack path generation model to obtain the potential attack path probability; wherein, the potential attack path generation model is obtained through joint adversarial training with a noise generation model; The joint training of the potential attack path generation model and the noise generation model includes: The power network traffic data of the target area power grid within a certain historical period is acquired and preprocessed to obtain the corresponding combined heterogeneous graph as a sample. The power network traffic data includes a large amount of normal behavior data and a small amount of abnormal behavior data. The combined heterogeneous graph corresponding to the normal behavior data is used as a normal behavior sample and input into the potential attack path generation model to drive the potential attack path generation model to learn normal interaction behavior patterns. The normal behavior samples and the power attack pattern library are input into the noise generation model to obtain grammatically compliant abnormal behavior samples; wherein, the power attack pattern library includes abnormal samples of various historical power attacks. The normal behavior samples and abnormal behavior samples are mixed together with the corresponding sample labels to form a mixed behavior sample; The mixed behavior samples are input into the potential attack path generation model to obtain the corresponding normal or abnormal discrimination results, which are used to calculate the discrimination loss; the mixed behavior samples are input into the noise generation model to obtain the generation results, which are used to calculate the adversarial loss. The model is updated and trained based on the joint loss function constructed by the discriminative loss and adversarial loss. After reaching the preset training termination condition, the parameters of the potential attack path generation model are saved to obtain the trained potential attack path generation model. Input normal behavior samples and a library of power attack patterns into the noise generation model, and output grammatically compliant abnormal behavior samples, including: The normal function codes in the normal behavior samples are modified to illegal function codes corresponding to samples in the power attack pattern library that are different except for the function codes, and an abnormal message is generated. Modify the normal operation time in the normal behavior sample to the unauthorized operation time corresponding to the sample in the power attack pattern library that is different from the normal operation time, and generate an abnormal operation log. The normal voltage in the normal behavior sample is modified to the non-voltage tolerance range corresponding to the sample in the power attack pattern library except for the voltage, and abnormal telemetry data is generated. The abnormal message, abnormal operation log and abnormal telemetry data are input into the noise generation model to obtain a grammatically compliant abnormal behavior sample. The attack path generation module M4 is used to calculate a suspicious path score based on the probability of the potential attack path, and generate an attack path based on the suspicious path score.

Images