Method and system for monitoring abnormal traffic of Internet of Things terminal in power system

Abstract

The invention discloses an abnormal traffic monitoring method and system for an Internet of Things terminal in a power system, and the method comprises the steps: obtaining a network message sent and received by the Internet of Things terminal at a terminal side, and generating original traffic data; based on a power service period, slicing the original traffic data at intervals, synchronously extracting a time domain traffic sequence and an application layer instruction sequence in each slicing period, and splicing the time domain traffic sequence and the application layer instruction sequence to generate a collaborative feature frame; inputting the collaborative feature frame into a lightweight anomaly detection model, predicting a cosine similarity residual error through a prediction branch, obtaining a reconstruction error through a reconstruction branch, and calculating and outputting a comprehensive anomaly score based on fusion of the cosine similarity residual error and the reconstruction error; and comparing the comprehensive abnormal score with a preset score threshold, and generating and outputting an abnormal mark of the Internet of Things terminal. According to the method, the traffic characteristic deviation can be effectively identified through the lightweight parallel double-branch model, the missing report rate and the false report rate under complex attacks are reduced, and the detection precision is improved.

Description

Technical Field

[0001] This invention relates to the field of power communication monitoring technology, and in particular to a method and system for monitoring abnormal flow of Internet of Things (IoT) terminals in a power system. Background Technology

[0002] With the accelerated digital transformation of power systems, the application of IoT terminals in power systems is becoming increasingly widespread, encompassing various devices such as smart meters, smart sensors, and distributed energy controllers. These terminal devices interact with the master station system via networks to achieve functions such as remote monitoring, automated control, and data acquisition. However, the network connectivity of IoT terminals also brings new security challenges, such as network attacks, data tampering, and abnormal traffic injection. These security threats may affect the stable operation of the power system and even lead to power outages.

[0003] Traditional network traffic monitoring methods rely primarily on static rules and simple statistical analysis, making them ill-equipped to handle complex and ever-changing network attacks and abnormal traffic. In recent years, deep learning technology has been widely applied in network security, enabling more effective detection and identification of abnormal traffic through the construction of complex neural network models. However, existing terminal-side solutions often employ single, isolated detection strategies. For example, they may only use prediction models based on recurrent neural networks, detecting anomalies by comparing the predicted traffic values ​​with the actual values; or they may only use reconstruction models such as autoencoders, identifying anomalies by comparing reconstruction errors. This model architecture, by sacrificing detection dimensions, easily leads to high false negative rates and fails to effectively and accurately comprehensively assess the multi-dimensional anomaly characteristics of IoT terminals. Summary of the Invention

[0004] To address the problem that existing model architectures, which sacrifice detection dimensions in their detection strategies, often result in high false negative rates and fail to effectively and comprehensively assess IoT terminals, this invention provides a method and system for monitoring abnormal flow of IoT terminals in power systems. This system utilizes a lightweight parallel dual-branch model to effectively identify deviations in flow characteristics, reducing false negative and false positive rates under complex attacks and improving detection accuracy. The specific technical solution is as follows: In a first aspect, the present invention provides a method for monitoring abnormal flow in an Internet of Things (IoT) terminal in a power system, comprising: Acquire network packets sent and received by IoT terminals on the terminal side to generate raw traffic data; Based on the power business cycle, the original flow data is sliced ​​at intervals, and the time-domain flow sequence and application layer instruction sequence within each slice cycle are extracted synchronously and combined to generate a collaborative feature frame. The collaborative feature frame is input into a lightweight anomaly detection model, which includes a prediction branch and a reconstruction branch that are processed in parallel. The prediction branch predicts the cosine similarity residual, and the reconstruction branch obtains the reconstruction error. The comprehensive anomaly score is calculated and output based on the fusion of the cosine similarity residual and the reconstruction error. The comprehensive anomaly score is compared with a preset score threshold to generate and output an anomaly flag for the IoT terminal; the preset score threshold is adjusted based on historical normal traffic data.

[0005] Preferably, the step of assembling and generating collaborative feature frames further includes: It also simultaneously extracts the frequency domain amplitude spectrum within each slice period, and concatenates the time domain flow sequence, frequency domain amplitude spectrum and application layer instruction sequence to generate a collaborative feature frame of time domain, frequency domain and instruction.

[0006] Preferably, the prediction branch employs a spatiotemporal separation residual network module. The co-functional feature frame is processed by the spatiotemporal separation residual network module to predict the instruction vector of the next frame, and the cosine similarity residual between the predicted instruction vector and the actual value is calculated.

[0007] Preferably, the spatiotemporal separation residual network module includes: One or more two-dimensional convolutional layers are used to extract the spatial features of the collaborative feature frame; One or more time shifting modules are used for time series modeling in the channel dimension.

[0008] Preferably, the reconstruction branch employs a sparse memory autoencoder with a readable and writable memory matrix, and the collaborative feature frame is reconstructed using the sparse autoencoder to obtain the reconstruction error corresponding to different domains.

[0009] Preferably, the sparse memory autoencoder includes: A read-write memory matrix is ​​used to store normal traffic patterns; A sparse encoder is used to encode the cooperative feature frames into a sparse representation; A sparse decoder is used to decode the sparse representation into a reconstructed feature frame.

[0010] Preferably, the step of calculating and outputting a comprehensive anomaly score based on the fusion of the cosine similarity residual and the reconstruction error includes: Based on the addressing distribution entropy value of the current collaborative feature frame in the memory matrix, assign weights to the reconstruction errors of different domains; The weighted reconstruction error is then weighted and fused with the cosine similarity residual to generate the comprehensive anomaly score.

[0011] Preferably, the present invention provides a method for monitoring abnormal flow of IoT terminals in a power system, further comprising: When the cosine similarity residual output by the prediction branch is lower than the preset residual threshold, the reconstruction branch is triggered to re-verify the current collaborative feature frame and send the abnormal pattern features obtained from the re-verification back to the spatiotemporal separation residual network module of the prediction branch to adjust the prediction weight parameters.

[0012] Preferably, the present invention provides a method for monitoring abnormal flow of IoT terminals in a power system, further comprising: If the cosine similarity residual is lower than a preset residual threshold, and the reconstruction error is not lower than a preset error threshold, then the comprehensive anomaly score is increased.

[0013] Preferably, the present invention provides a method for monitoring abnormal flow of IoT terminals in a power system, further comprising: Obtain IoT terminal hardware-side channel information corresponding to the slice timing, wherein the hardware-side channel information includes the current ripple of the power supply loop; If the overall anomaly score is lower than a preset score threshold and the cosine similarity residual is lower than a preset residual threshold, but the current ripple energy of the current ripple does not exceed the limit, then the overall anomaly score is reduced by a preset ratio.

[0014] Secondly, the present invention also provides an abnormal flow monitoring system for Internet of Things (IoT) terminals in a power system, which applies the aforementioned method and includes: The data acquisition unit is used to acquire network packets sent and received by IoT terminals on the terminal side and generate raw traffic data. The feature splicing unit is used to slice the original traffic data at intervals based on the power business cycle, and simultaneously extract the time-domain traffic sequence and application layer instruction sequence within each slice cycle, and splice them to generate a collaborative feature frame. The computational processing unit is used to input the collaborative feature frame into a lightweight anomaly detection model. The lightweight anomaly detection model includes a prediction branch and a reconstruction branch that are processed in parallel. The prediction branch predicts the cosine similarity residual, and the reconstruction branch obtains the reconstruction error. Based on the cosine similarity residual and the reconstruction error, a comprehensive anomaly score is calculated and output. An anomaly assessment unit is used to compare the comprehensive anomaly score with a preset score threshold, generate and output an anomaly flag for the IoT terminal; the preset score threshold is adjusted and set based on historical normal traffic data.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention provides a method for monitoring abnormal flow in IoT terminals within a power system. By employing periodic slicing synchronized with power operations, the extracted time-domain and instruction sequence features closely match the business logic. Through the design of a lightweight parallel dual-branch model, parallel processing of prediction and reconstruction is achieved without significantly increasing computational overhead. This method can both capture instruction logic anomalies and effectively identify deviations in flow characteristics, thereby comprehensively improving detection accuracy and significantly reducing the false negative and false positive rates under complex attacks. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 This is a flowchart of an abnormal flow monitoring method for an Internet of Things (IoT) terminal in a power system, according to an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram illustrating the principle of traffic data acquisition and processing in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of an abnormal flow monitoring system for an Internet of Things (IoT) terminal in a power system, according to an embodiment of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] It should be understood that, when used in this specification, the terms “comprising” and “including” indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0022] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0023] It should also be further understood that the term "and / or" as used in this specification refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes such combinations.

[0024] Please refer to the following examples. Figures 1 to 3 .

[0025] This invention provides a method for monitoring abnormal flow in an Internet of Things (IoT) terminal within a power system, comprising: Step S1: Obtain network packets sent and received by the IoT terminal on the terminal side and generate raw traffic data; By enabling the promiscuous mode of the terminal network card or utilizing the local loopback interface, all raw data packets flowing through the network interface of the IoT terminal are collected, including network messages sent / received by the IoT terminal, such as uplink messages sent by the IoT terminal to the master station and downlink messages received by the master station.

[0026] The collected network packets contain at least the link layer frame header, network layer IP header, transport layer TCP / UDP header, and complete application layer payload. The collected packets are filtered, retaining only protocol packets relevant to the current terminal's service. Each packet is timestamped, and the processed packets are briefly cached in memory in a queue.

[0027] Step S2: Based on the power business cycle, the original flow data is sliced ​​at intervals, and the time-domain flow sequence and application layer instruction sequence in each slice cycle are extracted synchronously and combined to generate a collaborative feature frame. The power service cycle can be configured according to actual needs. Its value is preset based on the terminal type and the fixed services it executes, such as a 15-minute data collection cycle for distribution terminals and an hourly reporting cycle for metering terminals. Starting from the system clock or the first service message, the cached raw traffic data is sliced ​​into non-overlapping, equal-length slices according to the power service cycle, and the raw traffic data is then divided into segments at fixed time intervals. Slice to obtain the first The feature set of each slice period.

[0028] The temporal traffic sequence is extracted by statistically analyzing the message quantity sequence, byte count sequence, and message arrival time interval sequence within the current slice period. The mean / variance of message length and the message interval time sequence within the slice are then extracted to form a temporal feature vector. , The temporal feature dimension is used. Application layer instruction sequences are extracted through deep analysis of the application layer payload of all messages within each slice period. The application layer instruction codes within a slice are mapped to one-hot vectors to form instruction feature vectors. ( (Number of instruction types).

[0029] The time-domain traffic sequences extracted within the same time slice are aligned and combined with the application layer instruction sequences to form a coherent feature frame. This coherent feature frame contains both network traffic statistical features and business instruction logical features. The following formula is used to eliminate dimensional differences and combine the sequences into a standardized coherent feature frame: For instructions that require data, their key data values ​​can be normalized and encoded into the sequence, represented as follows: in, To avoid tiny values ​​where the denominator is zero.

[0030] Step S3: Input the collaborative feature frame into the lightweight anomaly detection model. The lightweight anomaly detection model includes a prediction branch and a reconstruction branch that are processed in parallel. The prediction branch predicts the cosine similarity residual, and the reconstruction branch obtains the reconstruction error. Based on the cosine similarity residual and the reconstruction error, the comprehensive anomaly score is calculated and output. Specifically, the prediction branch uses a spatiotemporal separation residual network module to process the collaborative feature frame, predict the instruction vector of the next frame, and calculate the cosine similarity residual between the predicted instruction vector and the actual value.

[0031] In this embodiment, the spatiotemporal separation residual network module includes: One or more two-dimensional convolutional layers are used to extract the spatial features of the collaborative feature frame; One or more time shifting modules are used for time series modeling in the channel dimension.

[0032] In practice, the prediction branch uses a spatiotemporally separated residual network module to calculate the cosine similarity residual between the predicted instruction vector and the actual measured value. Through three levels of processing—spatial feature extraction, temporal dependency modeling, and residual connection—it captures the temporal patterns of the collaborative feature frames of the time domain and the instruction. This is based on the assumption of standardized collaborative feature frames. , For time-domain normalization features, This is a feature of instruction standardization.

[0033] In this embodiment, spatially separated convolution (including and Stepwise convolution extracts intra-domain correlation features, such as the correspondence between temporal traffic fluctuations and instruction types, and then uses residual connections. Mitigating gradient vanishing and outputting spatial feature maps .

[0034] For continuous Spatial feature map of each slice period Employing temporal convolutional layers, based on Convolutional kernels and sliding windows capture inter-frame temporal dependencies, such as the periodic occurrence of specific instructions, and output temporal feature vectors. .

[0035] Through the fully connected layer Mapped to the application layer instruction prediction vector of the next frame , Let be the number of instruction types. Then the formula for calculating the cosine similarity residual is: in, Avoid having a denominator of zero; This is the actual instruction vector; The larger the value, the more significant the instruction prediction deviation.

[0036] The spatiotemporal separation residual network module takes the collaborative feature frame of the current moment as input and aims to predict the vector representation of the application layer instruction sequence for the next business cycle. It then compares the predicted instruction vector with the actual instruction vector collected and parsed in the next cycle. By calculating the cosine similarity residual, a larger cosine similarity residual indicates a greater deviation between the actual instruction flow executed by the terminal and the model's expected normal business logic based on historical learning, suggesting potential attacks such as instruction injection or sequence disorder.

[0037] Specifically, the reconstruction branch employs a sparse memory autoencoder with a readable and writable memory matrix to reconstruct the collaborative feature frame, thereby obtaining the reconstruction error corresponding to different domains.

[0038] The sparse memory autoencoder includes: A read-write memory matrix is ​​used to store normal traffic patterns; A sparse encoder is used to encode the cooperative feature frames into a sparse representation; A sparse decoder is used to decode the sparse representation into a reconstructed feature frame.

[0039] In practice, the dual-domain reconstruction error calculation based on the sparse memory autoencoder with a readable and writable memory matrix achieves normal mode restoration of the cooperative feature frame and outputs the reconstruction error in the time domain and instruction domain through the interaction of the encoder, memory matrix and decoder structure.

[0040] A convolutional encoder employing sparse constraints and L1 regularization ,Will Compressed into low-dimensional latent vectors , To highlight key features by sparsifying the latent space dimension.

[0041] Memory Matrix ( This represents a typical latent vector pattern for storing historical normal traffic (number of memory units). The latent vector is calculated using an attention mechanism. The degree of matching with each memory unit is expressed as: The addressing distribution probability is obtained as follows: If the current feature deviates from the memory pattern, the memory matrix is ​​updated through a write operation, as follows: in, This refers to the update rate.

[0042] Based on weighted memory vector Temporal and instruction domain features are reconstructed through transposed convolutional layers. , The reconstruction bias in the time domain and instruction domain are calculated separately, using the following formula: , in, For the first Domain feature dimension; The larger the value, the more the characteristics of that domain deviate from the normal pattern.

[0043] Specifically, the calculation of the comprehensive anomaly score based on the fusion of the cosine similarity residual and the reconstruction error includes: Based on the addressing distribution entropy value of the current collaborative feature frame in the memory matrix, assign weights to the reconstruction errors of different domains; The memory addressing distribution entropy corresponding to the time-domain and instruction-domain features is calculated based on the domain weight allocation of addressing entropy. : in, For the first Addressing probability of memory cells with domain characteristics; using temperature coefficient Normalization yields the domain weights : The weighted reconstruction error is then weighted again and fused with the cosine similarity residual to generate the comprehensive anomaly score. The formula for the comprehensive anomaly score is: in, These are weighting coefficients, optimized through training to balance the contributions of reconstruction error and instruction prediction bias; The higher the value, the higher the probability of an anomaly.

[0044] Step S4: Compare the comprehensive anomaly score with a preset score threshold, generate and output the anomaly flag of the IoT terminal; the preset score threshold is adjusted and set based on historical normal traffic data.

[0045] Among them, the preset score threshold The statistical characteristics are dynamically set based on historical normal traffic data. By collecting at least 30 days of normal traffic data, the calculation of all normal samples is performed according to step S3. To obtain the normal score distribution , This represents the sample size.

[0046] The initial threshold was determined using the mean and three standard deviations principle: The mean is updated periodically based on newly added normal data. and standard deviation Dynamic adjustment This avoids the decrease in adaptability caused by a fixed preset score threshold.

[0047] The result obtained in step S3 and Compare and generate the final anomaly marker: like If the traffic is identified as abnormal, an abnormal flag will be output, and the abnormal frame will be recorded. , and To help locate the type of exception, such as The main cause may be a sudden and abnormal traffic spike. The main issue may be an instruction injection anomaly.

[0048] like If the data is determined to be normal traffic, the output is marked as normal, and the features of this frame are updated in the normal pattern library through a memory matrix write operation to enhance the model's adaptability to normal pattern variations.

[0049] This invention provides a method for monitoring abnormal flow in IoT terminals within a power system. By employing periodic slicing synchronized with power operations, the extracted time-domain and instruction sequence features closely match the business logic. Through the design of a lightweight parallel dual-branch model, parallel processing of prediction and reconstruction is achieved without significantly increasing computational overhead. This method can both capture instruction logic anomalies and effectively identify deviations in flow characteristics, thereby comprehensively improving detection accuracy and significantly reducing the false negative and false positive rates under complex attacks.

[0050] Specifically, in a preferred embodiment of this application, the step of merging to generate a collaborative feature frame further includes: It also simultaneously extracts the frequency domain amplitude spectrum within each slice period, and concatenates the time domain flow sequence, frequency domain amplitude spectrum and application layer instruction sequence to generate a collaborative feature frame of time domain, frequency domain and instruction.

[0051] When the power system has excess computing power allocated to IoT terminals for abnormal traffic monitoring, or when the computing power is strong enough, the raw network traffic is sliced ​​according to the power service cycle interval, and the time-domain sampling sequence, frequency-domain amplitude spectrum, and application layer instruction vector are extracted simultaneously from each slice of traffic. A ternary collaborative feature frame is then constructed by combining the time-domain, frequency-domain, and instruction data. Simultaneously, the processing procedure for inputting the ternary collaborative feature frame into the lightweight anomaly detection model is the same as that for processing the binary collaborative feature frame in the aforementioned embodiment, and will not be described in detail again here.

[0052] Among them, by analyzing the time-domain flow characteristics Perform a Fast Fourier Transform (FFT) to extract the pre-processed part. Amplitude characteristics of the main frequency components : In this preferred embodiment, under scenarios with sufficient computing power, a ternary collaborative feature frame is constructed by introducing frequency domain amplitude spectrum. The frequency domain dimension can capture the hidden periodic patterns in the time domain sequence, such as the inherent harmonic flow characteristics of power business, thus compensating for the blind spot in the time domain for identifying slow frequency anomalies and hidden flow tampering. Through the complementarity of multi-domain features in the time domain, frequency domain, and command domain, the collaborative feature frame more comprehensively represents the essence of the flow, avoiding misjudgments of abnormal patterns caused by information loss in the binary collaborative feature frame of the time domain and command domain. By enriching feature inputs, the prediction accuracy of the command vector of the lightweight model prediction branch and the quantification capability of the abnormal deviation of the reconstruction branch are improved, reducing the false negative rate of minor anomaly attacks, such as low-rate command injection and gradual flow, ultimately enhancing the accuracy of abnormal flow monitoring of power IoT terminals and adapting to the requirements of high-security scenarios.

[0053] Specifically, the present invention provides a method for monitoring abnormal flow in an Internet of Things (IoT) terminal in a power system, which further includes: When the cosine similarity residual output by the prediction branch is lower than the preset residual threshold, the reconstruction branch is triggered to re-verify the current collaborative feature frame and send the abnormal pattern features obtained from the re-verification back to the spatiotemporal separation residual network module of the prediction branch to adjust the prediction weight parameters.

[0054] In practice, when the cosine similarity residual of the predicted branch output ( When the preset residual threshold is not met, the following process is triggered: The reconstruction branch performs enhanced verification on the current collaborative feature frame, reducing the temperature coefficient of attention computation by improving the addressing accuracy of the memory matrix. In addition, the number of decoder reconstruction iterations is increased, and the reconstruction errors in the time domain, frequency domain, and instruction domain are calculated. .

[0055] If any domain error ( If the threshold value is set to an abnormal threshold within the domain, then an abnormal pattern is identified, including frequency band distortion in the frequency domain or sudden fluctuations in traffic in the time domain.

[0056] The identified abnormal pattern features are fed back to the spatiotemporal separation residual network module of the prediction branch. For the spatial separation convolutional layer, the kernel weights are fine-tuned by gradient descent; for the temporal convolutional layer, the sliding window stride is adjusted; and for the residual connection, the jump weight coefficients are dynamically adjusted.

[0057] In this embodiment, dynamic collaboration and feedback optimization of the two branches are realized to avoid missed detections caused by the prediction of the command vector of the prediction branch and improve the comprehensiveness of anomaly identification. By back-transmitting the anomaly pattern features, the prediction branch is optimized to target the sensitivity of new / latent anomalies, thereby enhancing the model's adaptive learning ability. Parameter adjustment is only performed when the triggering conditions are met, taking into account both lightweight characteristics and detection accuracy, and adapting to scenarios with dynamic changes in the computing power of power Internet of Things terminals.

[0058] Preferably, the present invention provides a method for monitoring abnormal flow of IoT terminals in a power system, further comprising: If the cosine similarity residual is lower than a preset residual threshold, and the reconstruction error is not lower than a preset error threshold, then the comprehensive anomaly score is increased.

[0059] Preferably, the present invention provides a method for monitoring abnormal flow of IoT terminals in a power system, further comprising: Obtain IoT terminal hardware-side channel information corresponding to the slice timing, wherein the hardware-side channel information includes the current ripple of the power supply loop; If the overall anomaly score is lower than a preset score threshold and the cosine similarity residual is lower than a preset residual threshold, but the current ripple energy of the current ripple does not exceed the limit, then the overall anomaly score is reduced by a preset ratio.

[0060] In practical implementation, when the cosine similarity residual And reconstruction error When at least one domain feature significantly deviates from the normal pattern, such as distortion in a specific frequency band in the frequency domain or a sudden change in traffic in the time domain, the comprehensive anomaly score is increased. The quantification formula for the increase is as follows: in, This is an upward adjustment factor; Take the normalized value of the reconstruction error that exceeds the maximum threshold, in the range [0,1], to ensure that the higher the degree of anomaly, the greater the upward adjustment.

[0061] Synchronously acquire the terminal power circuit current ripple signal corresponding to the slice timing, and calculate the ripple energy through Fourier transform. .

[0062] When the comprehensive abnormal score , and ( If the maximum normal ripple energy is reached, then a reduction in the overall anomaly score will be triggered. The formula for reducing the overall anomaly score is as follows: in, To reduce the proportion and lower the probability of misjudgment.

[0063] In other embodiments, the IoT terminal hardware-side channel information may also include electromagnetic radiation or CPU power consumption information.

[0064] In this implementation, the comprehensive anomaly score up-adjustment mechanism solves the problem of missed detection when the instruction prediction is accurate but other domain anomalies are not detected. By dynamically amplifying the anomaly score, the sensitivity of identifying latent anomalies is improved. The comprehensive anomaly score down-adjustment mechanism combines hardware side channel information and utilizes the physical reliability of current ripple to filter out artificially high scores caused by normal flow fluctuations, thereby reducing the false alarm rate. The two mechanisms work together to achieve bidirectional dynamic calibration of the anomaly score, adapting to the complex and ever-changing operating scenarios of power Internet of Things terminals.

[0065] This invention also provides an abnormal flow monitoring system for IoT terminals in a power system, which applies the aforementioned method and includes: The data acquisition unit is used to acquire network packets sent and received by IoT terminals on the terminal side and generate raw traffic data. The feature splicing unit is used to slice the original traffic data at intervals based on the power business cycle, and simultaneously extract the time-domain traffic sequence and application layer instruction sequence within each slice cycle, and splice them to generate a collaborative feature frame. The computational processing unit is used to input the collaborative feature frame into a lightweight anomaly detection model. The lightweight anomaly detection model includes a prediction branch and a reconstruction branch that are processed in parallel. The prediction branch predicts the cosine similarity residual, and the reconstruction branch obtains the reconstruction error. Based on the cosine similarity residual and the reconstruction error, a comprehensive anomaly score is calculated and output. An anomaly assessment unit is used to compare the comprehensive anomaly score with a preset score threshold, generate and output an anomaly flag for the IoT terminal; the preset score threshold is adjusted and set based on historical normal traffic data.

[0066] The functional explanation of each unit in this embodiment is the same as that of an abnormal flow monitoring method for an Internet of Things terminal in a power system, and the technical effects are the same, so it will not be repeated here.

[0067] Those skilled in the art will recognize that the units of the various examples described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the invention.

[0068] In the embodiments provided by the present invention, it should be understood that the division of units is only a logical functional division. In actual implementation, there may be other division methods, such as multiple units can be combined into one unit, one unit can be split into multiple units, or some features can be ignored.

[0069] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0070] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0071] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the specification of the present invention.

Claims

1. A method for monitoring abnormal flow in an Internet of Things (IoT) terminal within a power system, characterized in that, include: Acquire network packets sent and received by IoT terminals on the terminal side to generate raw traffic data; Based on the power business cycle, the original flow data is sliced ​​at intervals, and the time-domain flow sequence and application layer instruction sequence within each slice cycle are extracted synchronously and combined to generate a collaborative feature frame. The collaborative feature frame is input into a lightweight anomaly detection model, which includes a prediction branch and a reconstruction branch that are processed in parallel. The prediction branch predicts the cosine similarity residual, and the reconstruction branch obtains the reconstruction error. The comprehensive anomaly score is calculated and output based on the fusion of the cosine similarity residual and the reconstruction error. The comprehensive anomaly score is compared with a preset score threshold to generate and output an anomaly flag for the IoT terminal; The preset score threshold is obtained by adjusting and setting based on historical normal traffic data.

2. The method for monitoring abnormal flow of an Internet of Things (IoT) terminal in a power system according to claim 1, characterized in that, The method of merging to generate collaborative feature frames also includes: It also simultaneously extracts the frequency domain amplitude spectrum within each slice period, and concatenates the time domain flow sequence, frequency domain amplitude spectrum and application layer instruction sequence to generate a collaborative feature frame of time domain, frequency domain and instruction.

3. The method for monitoring abnormal flow of an Internet of Things (IoT) terminal in a power system according to claim 2, characterized in that, The prediction branch employs a spatiotemporal separation residual network module. The spatiotemporal separation residual network module processes the collaborative feature frame to predict the instruction vector of the next frame, and calculates the cosine similarity residual between the predicted instruction vector and the actual value.

4. The method for monitoring abnormal flow of an Internet of Things (IoT) terminal in a power system according to claim 3, characterized in that, The spatiotemporal separation residual network module includes: One or more two-dimensional convolutional layers are used to extract the spatial features of the collaborative feature frame; One or more time shifting modules are used for time series modeling in the channel dimension.

5. The method for monitoring abnormal flow of an Internet of Things (IoT) terminal in a power system according to claim 3, characterized in that, The reconstruction branch employs a sparse memory autoencoder with a readable and writable memory matrix to reconstruct the collaborative feature frame, thereby obtaining the reconstruction error corresponding to different domains.

6. The method for monitoring abnormal flow of an Internet of Things (IoT) terminal in a power system according to claim 5, characterized in that, The sparse memory autoencoder includes: A read-write memory matrix is ​​used to store normal traffic patterns; A sparse encoder is used to encode the cooperative feature frames into a sparse representation; A sparse decoder is used to decode the sparse representation into a reconstructed feature frame.

7. The method for monitoring abnormal flow of an Internet of Things (IoT) terminal in a power system according to claim 6, characterized in that, The comprehensive anomaly score calculated based on the cosine similarity residual and reconstruction error includes: Based on the addressing distribution entropy value of the current collaborative feature frame in the memory matrix, assign weights to the reconstruction errors of different domains; The weighted reconstruction error is then weighted and fused with the cosine similarity residual to generate the comprehensive anomaly score.

8. A method for monitoring abnormal flow in an Internet of Things (IoT) terminal in a power system according to claim 6, characterized in that, Also includes: If the cosine similarity residual is lower than a preset residual threshold, and the reconstruction error is not lower than a preset error threshold, then the comprehensive anomaly score is increased.

9. A method for monitoring abnormal flow in an Internet of Things (IoT) terminal in a power system according to claim 8, characterized in that, Also includes: Obtain IoT terminal hardware-side channel information corresponding to the slice timing, wherein the hardware-side channel information includes the current ripple of the power supply loop; If the overall anomaly score is lower than a preset score threshold and the cosine similarity residual is lower than a preset residual threshold, but the current ripple energy of the current ripple does not exceed the limit, then the overall anomaly score is reduced by a preset ratio.

10. An abnormal flow monitoring system for Internet of Things (IoT) terminals in a power system, characterized in that, The method described by any one of claims 1 to 9 includes: The data acquisition unit is used to acquire network packets sent and received by IoT terminals on the terminal side and generate raw traffic data. The feature splicing unit is used to slice the original traffic data at intervals based on the power business cycle, and simultaneously extract the time-domain traffic sequence and application layer instruction sequence within each slice cycle, and splice them to generate a collaborative feature frame. The computational processing unit is used to input the collaborative feature frame into a lightweight anomaly detection model. The lightweight anomaly detection model includes a prediction branch and a reconstruction branch that are processed in parallel. The prediction branch predicts the cosine similarity residual, and the reconstruction branch obtains the reconstruction error. Based on the cosine similarity residual and the reconstruction error, a comprehensive anomaly score is calculated and output. An anomaly assessment unit is used to compare the comprehensive anomaly score with a preset score threshold, generate and output an anomaly flag for the IoT terminal; the preset score threshold is adjusted and set based on historical normal traffic data.

Images