Alarm noise reduction method and system based on large model of power system

Abstract

The invention provides an alarm noise reduction method and system based on a large model of a power system, and the method comprises the steps: obtaining multi-source heterogeneous alarm data in the power system, and constructing a preprocessing data set; constructing a heterogeneous information network based on the preprocessed data set, generating a node sequence containing alarm semantics by using the heterogeneous information network, and aggregating a plurality of node sequences meeting a similarity requirement into an alarm cluster; generating an alarm cluster feature data structure based on the alarm cluster; obtaining a knowledge graph and historical alarm data of the power system, and constructing a large power threat detection model; and inputting the alarm cluster feature data structure into the large power threat detection model to generate an alarm research and judgment report of the power system. The problem that high-risk events in an existing power system are hidden in massive alarms and cannot be found in time is solved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to an alarm noise reduction method and system based on a large power system model. Background Technology

[0002] With the rapid advancement of new power system construction, the large-scale integration of distributed energy sources such as wind power and photovoltaics, and the widespread deployment of smart terminals and IoT devices, the power system network architecture is becoming increasingly complex. At the same time, the network attack surface of the power system is also gradually expanding, requiring network security situation awareness platforms to process massive amounts of alert data daily from multiple sources, including firewalls, intrusion detection systems, and host protection software. This alert data is not only voluminous but also exhibits significant heterogeneity, short text, and multimodal characteristics.

[0003] Faced with massive amounts of alert data, traditional analysis methods are struggling to achieve efficient alert assessment and rapid response. On one hand, traditional alert analysis techniques, which rely on rules designed by security experts and simple feature matching, are ill-suited to new and unknown attack patterns. This results in high-risk events being buried under a sea of ​​low-risk and invalid alerts, leading to alert fatigue among security analysts, alert delays, and threats to enterprise network security. On the other hand, while some existing machine learning or deep learning technologies can automatically extract some valid features from textual data, network security alert data is highly specialized and has complex relationships, making it difficult for existing technologies to generate accurate and highly interpretable alert reports. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose an alarm noise reduction method and system based on a large power system model, which solves the problem that high-risk events in the existing power system are hidden in a large number of alarms and cannot be detected in a timely manner.

[0005] To achieve one of the aforementioned objectives, this application provides an alarm noise reduction method based on a large power system model, the method comprising: Acquire multi-source heterogeneous alarm data from the power system and construct a preprocessed dataset; A heterogeneous information network is constructed based on the preprocessed dataset. The heterogeneous information network is used to generate node sequences containing alarm semantics. Multiple node sequences that meet the similarity requirements are aggregated into an alarm cluster. Based on the alarm cluster, generate an alarm cluster feature data structure; Acquire the knowledge graph and historical alarm data of the power system to construct a large-scale power threat detection model; The alarm cluster feature data structure is input into the power threat detection big data model to generate an alarm analysis report for the power system.

[0006] As a further improvement to one embodiment of this application, the construction of the preprocessed dataset includes: The multi-source heterogeneous alarm data is standardized to generate standard format data. Extract feature fields from the standard format data and construct regular expressions; The set of regular expressions is used to form the preprocessed dataset.

[0007] As a further improvement to one embodiment of this application, the step of constructing a heterogeneous information network based on the preprocessed dataset and generating a node sequence containing alarm semantics using the heterogeneous information network includes: A basic information network is obtained, which includes multiple nodes and multiple edges. The multiple nodes correspond to multiple types of information, and the multiple edges correspond to the relationships between the multiple types of information. The data in the preprocessed dataset are introduced into the nodes of the basic information network according to their types to generate the heterogeneous information network; The node sequence corresponding to the alarm semantics is generated using a random walk strategy.

[0008] As a further improvement to one embodiment of this application, the step of aggregating multiple node sequences that meet the similarity requirements into an alarm cluster includes: Process multiple node sequences to generate multiple vector representations corresponding to the multiple node sequences; Using a density-based clustering algorithm, the Euclidean distance between multiple vector representations is calculated, and the vector representations are divided into alarm clusters and outliers.

[0009] As a further improvement to one embodiment of this application, the step of generating an alarm cluster feature data structure based on the alarm cluster includes: Based on the alarm cluster, a clustering algorithm is used to generate summary features in a structured representation of the target format, and the summary features are used as the feature data structure of the alarm cluster.

[0010] As a further improvement to one embodiment of this application, the step of acquiring the knowledge graph and historical alarm data of the power system and constructing a large-scale power threat detection model includes: Select the large base model; Freeze the pre-training weights of the base model, inject the knowledge graph and the historical alarm data, and fine-tune the base model.

[0011] As a further improvement to one embodiment of this application, the step of inputting the alarm cluster feature data structure into the power threat detection big data model to generate an alarm assessment report for the power system includes: The alarm cluster feature data structure is input into the power threat detection big model to generate an analysis document of the judgment results in a specified format as the alarm judgment report; After generating the power system alarm analysis report, it includes: The correctness of the alarm analysis report is determined, and the alarm analysis report and its judgment results are used as training set and input into the power threat detection big model.

[0012] As a further improvement to one embodiment of this application, after aggregating multiple node sequences that meet the similarity requirements into an alarm cluster, the process includes: The risk level of a specific number of node sequences is randomly selected within a single alarm cluster; If multiple sampled node sequences have the same risk level, then the risk level of the node sequence is determined to be the risk level of the alarm cluster.

[0013] As a further improvement to one embodiment of this application, the step of randomly checking the risk level of a specific number of node sequences within a single alarm cluster includes: Detect the highest risk level of the alarm cluster; The node sequence is extracted from the alarm cluster, and the probability of extracting the node sequence with the highest risk level is calculated according to the following formula: ); Among them, P threshold Let q be the probability, q be the specific number of samples, U be the set of all node sequences in the alarm cluster, |U| be the total number of node sequences in the alarm cluster, H be the set of node sequences with the highest risk level in the alarm cluster, and |H| be the total number of node sequences with the highest risk level in the alarm cluster. Select the sampling quantity corresponding to the probability meeting the requirements, and use the minimum sampling quantity among the selected sampling quantities as the specific number.

[0014] Based on the same inventive concept, this application also provides an alarm noise reduction system based on a large power system model, comprising: The first acquisition module is used to acquire multi-source heterogeneous alarm data in the power system and construct a preprocessed dataset. An aggregation module is used to construct a heterogeneous information network based on the preprocessed dataset, generate node sequences containing alarm semantics using the heterogeneous information network, and aggregate multiple node sequences that meet similarity requirements into an alarm cluster. The first generation module is used to generate an alarm cluster feature data structure based on the alarm cluster; The first construction module is used to acquire the knowledge graph and historical alarm data of the power system and build a large power threat detection model. The second generation module is used to input the alarm cluster feature data structure into the power threat detection big model to generate an alarm analysis report for the power system.

[0015] Compared to existing technologies, the technical advantages of this invention lie in the following: By constructing a heterogeneous information network from multi-source heterogeneous alarm data in the power system, and generating node sequences containing alarm semantics and alarm clusters formed by aggregating these node sequences, this context-aware clustering method can deeply mine the correlations between alarm clusters from multiple dimensions such as time, space, topology, and semantics. This efficiently aggregates the originally scattered massive alarm data and achieves noise reduction of the alarm data. The noise-reduced alarm clusters are then input into a large-scale power threat detection model, overcoming the poor adaptability of traditional models or rule engines in power system scenarios and improving the interpretability of alarm analysis reports. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the implementation methods or related technologies will be briefly introduced below. Obviously, the drawings described below are only the implementation methods of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A flowchart of an alarm noise reduction method based on a large power system model provided in one embodiment of this application; Figure 2 A schematic diagram of an alarm noise reduction system based on a large power system model provided for the implementation of this application; Figure 3 This is a schematic diagram of the hardware structure of an electronic device provided for an embodiment of this application. Detailed Implementation

[0018] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0019] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by those skilled in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects.

[0020] The cybersecurity situational awareness platform of the power system needs to process massive amounts of alarm data daily from multiple sources, including firewalls, intrusion detection systems, and host protection software. This alarm data is not only voluminous but also exhibits significant heterogeneity, short text, and multimodal characteristics. Faced with this massive amount of alarm data, traditional analysis methods are struggling to achieve efficient alarm assessment and rapid response. On the one hand, while traditional alarm analysis techniques relying on rules designed by security experts and simple feature matching are straightforward, their static nature makes them ill-suited to new and unknown attack patterns. This results in high-risk events being submerged in a sea of ​​low-risk and invalid alarms, leading to alarm fatigue among security analysts, alarm delays, and threats to enterprise cybersecurity.

[0021] On the other hand, although some existing machine learning or deep learning technologies can automatically extract some effective features from text data, cybersecurity alert data is highly specialized and has complex relationships. For example, 1) alert data such as threat intelligence, vulnerability descriptions, and attack patterns contain a large number of technical terms and code snippets, and their textual semantics differ significantly from natural language; 2) alerts are correlated in terms of temporal sequence, topological relationships, and similarities in behavioral intent. This contextual semantic information is crucial for accurately determining the nature of alerts and reconstructing attack chains, but traditional machine learning and deep learning-based alert analysis technologies struggle to fully mine and utilize the rich contextual information contained in cybersecurity alert data. Existing technologies often utilize these contextual relationships in a one-sided and isolated manner. First, it is difficult to identify key threat data from massive alerts, leading to alert delays and posing significant risks to enterprise cybersecurity. Second, security personnel cannot grasp the full picture of threat events from a global perspective, making it impossible to effectively reconstruct attack chains and assess the scope of impact.

[0022] The core flaws of existing technologies stem from the separation of "data processing" and "semantic understanding" in their infrastructure, as well as the disconnect between general models and specific domain requirements. Because key processes in alarm noise reduction fail to be deeply empowered by domain knowledge, and the correlation model cannot accurately depict the complex contextual relationships between alarms, directly applying existing alarm noise reduction technologies to new power systems will result in high false alarm rates and low, limited noise reduction rates when faced with the massive, heterogeneous alarm data unique to these systems. The shortcomings of current alarm noise reduction technologies in this field highlight the urgency and importance of the core problem that this invention aims to solve.

[0023] To address the aforementioned problems, this application provides an alarm noise reduction method based on a large power system model, such as... Figure 1 As shown, it includes the following steps: Step S100: Obtain multi-source heterogeneous alarm data from the power system and construct a preprocessed dataset.

[0024] Specifically, the first step involves collecting multi-source heterogeneous alarm data from the network environment of real power systems. This includes a large amount of alarm data generated within a specified timeframe by the company's full-scenario network security situational awareness platform deployed in various provincial power companies. This multi-source heterogeneous alarm data includes power information network traffic data, system operation logs, and asset information such as the IP addresses, business systems, and physical locations of the devices that generated the network security alarms. The multi-source heterogeneous alarm data acquired in this step is unprocessed data that still needs noise reduction and further identification of key alarms.

[0025] In one possible implementation of this application, step S100, which involves constructing a preprocessed dataset, includes: Step S110: Standardize the multi-source heterogeneous alarm data to generate standard format data.

[0026] Specifically, multi-source network alarms and threat-related data have issues such as inconsistent data formats. Therefore, for different types of data, it is necessary to first standardize some format characteristics.

[0027] In some specific implementation methods, standardization processing includes: converting timestamped alarm data to the ISO860 standard format, represented as YYYY-MM-DDThh:mm:ss.sssZ; standardizing IP addresses by uniformly processing IPv4, IPv6, and domain names, mapping different forms of network identifiers to a unique and consistent base IP address, while keeping the IPv4 format unchanged; converting IPv6 addresses to complete IPv6 colon-hexadecimal format; and obtaining the corresponding IPv4 or IPv6 address for domain names in alarm data through real-time DNS resolution, prioritizing IPv4. The resolution results are cached and saved as supplementary data for alarms.

[0028] Step S120: Extract feature fields from standard format data and construct regular expressions.

[0029] Step S130: The set of regular expressions is converted into a preprocessed dataset.

[0030] Specifically, regular expressions are constructed from unstructured alarm data to extract core fields such as source IP, destination IP, source port, destination port, protocol type, alarm type, and timestamp, which are then saved as alarm data feature fields. During this process, alarm records lacking key fields (such as destination port) are marked and analyzed in detail. If a record is a duplicate alarm, the corresponding alarm data can be directly removed. Furthermore, the attack payloads contained in the alarm data can directly reflect the attack methods used by attackers and are an important basis for alarm information merging and noise reduction. Therefore, in the data preprocessing stage, regular expressions are designed to match alarm payloads of common network attacks. The designed regular expressions include common network attack types such as path traversal attacks, SQL injection attacks, port scanning activities, access to sensitive system files, executable file execution, startup item modification, and registry modification.

[0031] In one feasible implementation, the regular expression used to match sensitive database operations is: This rule can effectively identify potential SQL injection attack payloads.

[0032] In another specific implementation, the regular expression for detecting time injection attacks is: This rule can effectively identify time injection attack payloads.

[0033] Step S200: Construct a heterogeneous information network based on the preprocessed dataset, generate node sequences containing alarm semantics using the heterogeneous information network, and aggregate multiple node sequences that meet the similarity requirements into an alarm cluster.

[0034] Specifically, the preprocessed alarm data is used to construct a heterogeneous information network in this process, and alarms represented by node sequences are generated by processing the network structure. Finally, the node sequences of the processed heterogeneous information network are clustered to complete the initial noise reduction of the alarm data.

[0035] In one possible implementation of this application, step S200, generating the node sequence, includes: Step S210: Obtain the basic information network, which includes multiple nodes and multiple edges. Multiple nodes correspond to multiple types of information, and multiple edges correspond to the relationships between multiple types of information.

[0036] Step S220: The data in the preprocessed dataset is introduced into the nodes of the basic information network according to their types to generate a heterogeneous information network.

[0037] Specifically, the basic information network can contain four types of nodes and six types of edges. The data in the preprocessed dataset is represented in the form of the basic information network to generate a heterogeneous information network. The definitions of nodes and edges in the heterogeneous information network are shown in the table below: Table 1 - Node Relationships in Heterogeneous Information Networks

[0038] Table 2 - Edge Relationships in Heterogeneous Information Networks

[0039] Based on the above definitions of nodes and edges, and according to the relationships between the data in the preprocessed dataset, an alarm heterogeneous information network is constructed, whose node type set is represented as follows: V={Alert,IP,Port,PayloadPattern} The set of edge types is represented as: E={Trigger,Target,Adjoin,Carry} This implementation defines four types of node-edge relationships in heterogeneous information networks, labeled P1-P4. The abstract representation and meaning of these relationships are as follows: 1.P1: This allows for the capture of time-series-based attack patterns, such as brute-force password attacks.

[0040] 2.P2: Since network services are usually bound to specific ports, an attack on the same service will trigger an alarm on the same target port. Therefore, this association can represent an attack on a specific service and port.

[0041] 3.P3: The same attack source (i.e. the same attacking IP address) usually launches multiple attack attempts within a period of time, so this correlation can track the attacks and lateral movement of a single attack source.

[0042] 4.P4: The attack payload of an alarm contains the most direct and complete attack information, including key attack technology code and target ports. The same attack technology generally uses similar attack payloads, so this correlation can be used to perform correlation analysis between alarms based on attack technology.

[0043] Step S230: Use a random walk strategy to generate a node sequence corresponding to the alarm semantics.

[0044] Specifically, after designing the semantic relationships of alarms and forming a heterogeneous information network from the preprocessed alarm data, a node sequence containing alarm semantics is generated in the heterogeneous information network based on a random walk strategy. After this step, the node sequence of each line can be regarded as a complex sentence containing semantics, and the nodes are treated as words in a general sentence.

[0045] In one specific implementation, the random walk strategy strictly follows four semantic relationships in a pre-defined alarm heterogeneous graph to select the next node. Specifically, the route in this invention can be described as follows: Given a meta-path pattern P: → → The traversal begins with a node of a certain type. When the traversal reaches the i-th step, it is located at a node of type t. When selecting the next node The probability calculation formula is shown below: ; In the formula v i v represents the node selected when traversing to the i-th step. i+1 N represents the next node of the candidate. t+1 (v i ) represents v i Among all neighboring nodes, the type is exactly the next type v in the metapath. i+1 Let E be the set of nodes in the network, and let E be the set of all edges in the network. ( ) represents the mapping function for node types. As defined in the formula above, in each step of the random walk, the walk path can only visit neighboring nodes that are connected to the current node and whose type and semantic association relationship specifies that the next node type is exactly the same. These neighboring nodes that meet the conditions have an equal probability of being selected.

[0046] By performing numerous such walks for each semantic association, a semantically rich sequence of nodes is generated for the heterogeneous alarm information network, forming a corpus for subsequent embedding learning.

[0047] In one possible implementation of this application, step S200, aggregating alarms into a cluster, includes: Step S240: Process multiple node sequences to generate multiple vector representations corresponding to the multiple node sequences.

[0048] Specifically, the node sequence generated by the random walk algorithm is regarded as a special sentence containing semantics, where the nodes are "words". In order to transform these symbolic nodes into numerical vectors that can be used for computation, the word2vec model is selected to obtain the vector representation of alarm nodes in the alarm heterogeneous information network.

[0049] For example, given a node sequence S1, S2, ... S generated by walking through semantic associations. i (i=1,2,3..n), after processing by the word2vec model, each node in the network receives a fixed-length, low-dimensional, dense vector representation. The alarm vector output by a node sequence is: W j (j=1,2,3..n).

[0050] Step S250: Using a density-based clustering algorithm, calculate the Euclidean distance between multiple vector representations and divide the vector representations into alarm clusters and outliers.

[0051] Specifically, after obtaining the vector representation of the alarm nodes, a density-based DBSCAN clustering algorithm is used for noise reduction. The vectors of the alarm nodes encode various complex semantic relationships defined by semantic associations. In the subsequent clustering steps, the closer the Euclidean distance between the vectors of two alarm nodes, the more similar they are in the context defined by multiple meta-paths, and therefore the more likely they belong to the same security event or attack activity.

[0052] First, the similarity between alarm vectors a and b is calculated using Euclidean distance, as shown in the following formula: ; Where n represents the dimension of the vector, a m and b m Let m represent the m-th component of vectors a and b. Euclidean distance is sensitive to outliers, making it easier to distinguish abnormal alarms from normal alarms. A density-based clustering algorithm, DBSCAN, is selected for initial alarm noise reduction. Based on Euclidean distance, DBSCAN efficiently clusters alarms.

[0053] Secondly, the vector representation is used as the input to the DBSCAN clustering algorithm, and the output of the clustering algorithm is a set of alarm clusters C. k (k=1,2,3..n) and the set N of outliers (nodes that do not belong to any cluster). oise For each cluster C k Alarms within the same context have highly similar contexts and can be processed in batches. Outlier N oiseOutliers are usually few in number, but because they may contain anomalies or new types of attacks that require special attention, traditional analysis methods typically delegate outlier analysis to cybersecurity analysts for manual review.

[0054] In one possible implementation of this application, after step S200 aggregates alarms into alarm clusters, the method further includes: Step S201: In a single alarm cluster, randomly select a specific number of node sequences to check their risk levels.

[0055] In one possible implementation of this application, in order to minimize the specific number of samples, step S201 includes: Step S2011: Detect the highest risk level of the alarm cluster; Step S2012: Extract node sequences from the alarm cluster, and calculate the probability of extracting the node sequence with the highest risk level according to the following formula: ; Among them, P threshold Let q be the probability, q be the specific number of samples to be checked, U be the set of all node sequences in the alarm cluster, |U| be the total number of node sequences in the alarm cluster, H be the set of node sequences with the highest risk level in the alarm cluster, and |H| be the total number of node sequences with the highest risk level in the alarm cluster.

[0056] Step S2013: Select the sampling quantity corresponding to the probability meeting the requirements, and take the minimum sampling quantity among the selected sampling quantities as the specific number.

[0057] Specifically, for each alarm cluster after clustering, if the amount of sampled data in a cluster can cover all risk levels in the cluster with a high probability, then according to a conservative strategy, the alarm risk level of the sampled cluster is set to the highest risk level determined by manual analysis of the sampled data. The goal of the sampling is to first find the alarm with the highest risk level in each cluster, and then, according to the conservative evaluation strategy, consider all alarms in that cluster as that highest risk level. For example, if a cluster contains 10 alarms with a risk level of 0 and 90 alarms with a risk level of 1, then if at least one alarm with a risk level of 1 is found during sampling, the highest risk level of that cluster can be set as 1.

[0058] For a specific example, in 50,000 multi-source heterogeneous alarm data, after clustering, 99.96% of the multi-source heterogeneous alarm data was clustered into 51 alarm clusters, while the remaining 0.04% (20 alarms) could not be clustered. For the data in the 51 clusters, the alarm risk level of the data in each alarm cluster is first determined. Then, the number of data in the alarm cluster belonging to each risk level is counted to obtain the total number of alarms in the cluster |U|, and the total number of alarms belonging to the highest risk level |H|. Substituting these into the above formula, and selecting different q values, P is calculated.threshold The score records the P value corresponding to each q-value selected from 51 clusters. threshold Score, and calculate P for each q value corresponding to 51 clusters. threshold Mean P threshold-avg (P) threshold-avg (Short for average probability).

[0059] q value and P threshold-avg The calculation results are shown in the table below.

[0060] Table 3 - Statistical Results of Experimental Calculation of Sample Size and Average Probability of Alarm Clusters

[0061] Statistical analysis of P for different values ​​of q threshold-avg The calculation results show that when q=5, P threshold-avg That is, it can reach 99.02%. This average probability can largely guarantee that the data with the highest alarm risk level can be sampled from an alarm cluster that has been processed by the above method.

[0062] Therefore, after clustering the alarm data, q=5 samples are extracted from each cluster. Security experts manually analyze and determine the alarm risk level of the 5 sampled samples, and select the highest risk level as the alarm risk level label for the entire cluster. In actual alarm noise reduction operations, the risk level assessment of all alarms in the entire cluster is completed by manually analyzing only 5 alarms, effectively reducing the alarm analysis workload of security operations personnel.

[0063] In step S202, in response to the fact that the risk levels of multiple sampled node sequences are the same, the risk level of the node sequence is determined to be the risk level of the alarm cluster.

[0064] Specifically, after clustering, although most alarm data has been divided into different clusters, it is unclear whether all alarms in each cluster belong to the same risk level. Ideally, alarms within the same cluster should have the same risk level; however, in reality, some clusters may contain alarms with different risk levels. Therefore, to determine whether alarms within a cluster have the same risk level, it is necessary to sample multiple alarms from each cluster. For each cluster, if all sampled alarms are determined to be at the same risk level, and the sample size is large enough, then it can be determined that all alarms in that cluster belong to that risk level. If the sampled alarms have different risk levels, the clustering result is more complex and requires further analysis by security analysts.

[0065] It should also be noted that for outliers generated during clustering, a large-scale power threat detection model is generated by fine-tuning the base model. This large-scale power threat detection model, with semantic analysis capabilities, can automatically analyze outliers generated during the clustering process and provide judgment results. The next section will elaborate on the large-scale model construction and alarm judgment process of this invention.

[0066] Step S300: Based on the alarm cluster, generate the alarm cluster feature data structure.

[0067] Specifically, an alarm cluster feature data structure containing core features is generated for each alarm cluster. This structure is then input into a large-scale power threat detection model that has been fine-tuned with knowledge data from the power sector to identify attack intent, reconstruct attack chains, and assess the scope of impact.

[0068] In one possible implementation of this application, step S300 includes: Based on alarm clusters, a clustering algorithm is used to generate summary features in a structured representation of the target format, which then serve as the feature data structure for the alarm clusters.

[0069] Specifically, before constructing the large-scale power threat detection model, we first generate each alarm cluster C in the previous step using a clustering algorithm. k A structured summary feature is automatically generated, represented in a JSON data structure, and used as input to the large model.

[0070] An example of the summary features of a structured alarm cluster is as follows: { "alert_types": ["SSH Login Request Authentication", "SQL Injection",...], "source_ips": ["192.168.1.10", "192.168.1.11"], "target_ports": ["22"], "time_window": ["2023-10-01 14:00:00", "2023-10-01 14:05:00"], "payload_patterns": ["Weak Password Pattern"], "asset_context": "Alert Importance: High" } Step S400: Obtain the knowledge graph and historical alarm data of the power system to build a large-scale power threat detection model.

[0071] In one possible implementation of this application, step S400 includes: Step S410: Select the large base model.

[0072] Specifically, since the power threat detection big model is a domain-specific big model, a base big model is first selected. Based on the base big model, the base big model is fine-tuned by using the knowledge graph of the power system and historical alarm data, so that the base big model has the ability to analyze network security alarms in the power industry, and the power threat detection big model is constructed.

[0073] In one feasible implementation, SecGPT is chosen as the base model. SecGPT is the world's first open-source cybersecurity model, suitable for all cybersecurity tasks, including vulnerability analysis, threat detection, attribution analysis, and alert assessment. SecGPT offers broad usability and powerful analytical capabilities in addressing cybersecurity issues.

[0074] Step S420: Freeze the pre-trained weights of the base model, inject knowledge graph and historical alarm data, and fine-tune the base model.

[0075] Specifically, historical alarm data is obtained from the full-scenario network security situational awareness platform used in various provinces. This platform has been operating in provincial power companies for many years and has a long operating history and a large amount of data accumulation within the power system. In practical implementation, 100,000 network security alarm data points, abnormal traffic data packets, and malware samples from the past year can be obtained from the situational awareness platform for fine-tuning of the base model.

[0076] Specifically, LoRA (Local Alternating Range) technology is chosen for large-scale model fine-tuning. LoRA adapts to downstream tasks in power systems by freezing pre-trained weights and injecting trainable low-rank decomposition matrices, making it a parameter-efficient fine-tuning method. For the pre-trained weight matrix... LoRA parameterizes the weight update ΔW as ΔW=BA, where , And the hyperparameter r min(d,k). Its forward propagation calculation formula is: ; The original path is W0x, the adapted path is BAx, and the two are added together in the formula to obtain the final output of the forward propagation.

[0077] LoRA is typically applied to the attention layer of a Transformer (such as W). q W v It can significantly reduce training parameters, support task switching and has no inference latency, and is superior to full fine-tuning and adapter methods.

[0078] Step S500: Input the alarm cluster feature data structure into the power threat detection big model to generate an alarm analysis report for the power system.

[0079] Specifically, after constructing a large-scale power threat detection model, the model is used to conduct in-depth analysis of alarms and assessment of their impact range.

[0080] In one possible implementation of this application, the alarm cluster feature data structure is input into the power threat detection big data model to generate an analysis document of the judgment results in a specified format as an alarm judgment report.

[0081] In one possible implementation of this application, after step S500, the method further includes: The accuracy of the alarm analysis report is determined, and the alarm analysis report and its judgment results are used as training data and input into the power threat detection big model.

[0082] Specifically, the large model generates an analysis document of the assessment results in a specified format. This document includes an alert overview, attack chain analysis, assessment of affected assets, vulnerability correlation analysis, and security recommendations.

[0083] In one possible implementation of this application, after generating the power system alarm assessment report, the method further includes: The accuracy of the alarm analysis report is determined, and the alarm analysis report and its judgment results are used as training data and input into the power threat detection big model.

[0084] Specifically, during the development and optimization phase of the large-scale power threat detection model, the alarm analysis results document output by the large-scale power threat detection model is manually reviewed. Security operations and maintenance personnel then provide feedback on the manual review results of the reports to the large-scale power threat detection model, further optimizing the model during the development process.

[0085] Security operations personnel can manually review the analysis reports output by the large model, analyzing each cluster to determine if it contains valid alarms and removing invalid alarm clusters, thus achieving further alarm noise reduction. Analyzing alarms at the cluster level significantly reduces the number of alarms that security personnel need to manually analyze, achieving effective alarm noise reduction. This can significantly improve the accuracy of alarm risk level assessment and attack intent identification, while effectively avoiding the alarm fatigue problem present in existing alarm analysis processes.

[0086] The alarm noise reduction method based on a large power system model disclosed in this application firstly efficiently aggregates the originally scattered massive alarms into a limited number of alarm clusters based on their contextual similarity. This design can significantly improve the alarm noise reduction effect. It reduces the number of independent alarm items that security analysts need to focus on by several orders of magnitude, and changes the analysis mode from "examining each alarm individually" to "batch processing by cluster," thereby fundamentally alleviating the alarm fatigue problem caused by the reduced accuracy of analysis due to the need for security operations and maintenance personnel to process massive alarm data in a short period of time.

[0087] Furthermore, it innovatively introduces a large-scale domain model specifically designed for power grid network security for cluster-level in-depth analysis. This model has undergone incremental pre-training with a power domain knowledge base and specialized fine-tuning for alarm analysis tasks, enabling it to understand power control protocols and identify specific attack patterns in the power grid. Therefore, it overcomes the shortcomings of traditional general-purpose models or rule engines in power scenarios, such as poor adaptability and high false alarm rates, achieving a significant improvement in the accuracy of alarm risk level determination and attack intent identification. Simultaneously, it outputs alarm analysis results, effectively improving the interpretability of these results, allowing security personnel to quickly grasp the full picture of threats and formulate precise response strategies, rather than passively responding to isolated alarms.

[0088] Another embodiment of this application discloses an alarm noise reduction system based on a large power system model, such as... Figure 2 As shown, it includes: The first acquisition module is used to acquire multi-source heterogeneous alarm data in the power system and construct a preprocessed dataset. The aggregation module is used to build a heterogeneous information network based on the preprocessed dataset, generate node sequences containing alarm semantics using the heterogeneous information network, and aggregate multiple node sequences that meet the similarity requirements into an alarm cluster. The first generation module is used to generate alarm cluster feature data structures based on alarm clusters; The first construction module is used to acquire the knowledge graph and historical alarm data of the power system and build a large-scale power threat detection model. The second generation module is used to input the alarm cluster feature data structure into the power threat detection big model to generate an alarm analysis report for the power system.

[0089] In one possible implementation of this application, the first acquisition module includes: The first processing module is used to standardize multi-source heterogeneous alarm data and generate standard format data. The second building module is used to extract feature fields from standard format data and construct regular expressions. The collection module combines regular expressions into a preprocessed dataset.

[0090] In one possible implementation of this application, the aggregation module includes: The second acquisition module is used to acquire the basic information network, which includes multiple nodes and multiple edges. Multiple nodes correspond to multiple types of information, and multiple edges correspond to the relationships between multiple types of information. The third generation module is used to introduce data from the preprocessed dataset into the nodes of the basic information network according to their types, thereby generating a heterogeneous information network. The fourth generation module is used to generate the node sequence corresponding to the alarm semantics using a random walk strategy.

[0091] In one possible implementation of this application, the aggregation module further includes: The second processing module is used to process multiple node sequences and generate multiple vector representations corresponding to the multiple node sequences. The first calculation module is used to calculate the Euclidean distance between multiple vector representations using a density-based clustering algorithm, and to divide the vector representations into alarm clusters and outliers.

[0092] In one possible implementation of this application, the first generation module includes: The fifth generation module is used to generate summary features in JSON format based on alarm clusters using a clustering algorithm, so that the summary features serve as the feature data structure for alarm clusters.

[0093] In one possible implementation of this application, the first construction module includes: The selection module is used to select the large base model; The fine-tuning module is used to freeze the pre-trained weights of the base model based on LoRA technology, inject knowledge graph and historical alarm data, and fine-tune the base model.

[0094] In one possible implementation of this application, the second generation module includes: The sixth generation module is used to input the alarm cluster feature data structure into the power threat detection big model and generate an analysis document of the judgment results in a specified format as an alarm judgment report. It also includes a training module, which judges the correctness of alarm analysis reports and inputs the alarm analysis reports and their judgment results as training sets into the power threat detection big model.

[0095] In one possible implementation of this application, the aggregation module includes: The sampling module is used to sample a specific number of node sequences within a single alarm cluster to assess their risk levels. The judgment module determines the risk level of the node sequence as the risk level of the alarm cluster if the risk levels of multiple sampled node sequences are the same.

[0096] In one possible implementation of this application, the sampling module includes: The detection module is used to detect the highest risk level of alarm clusters; The second calculation module is used to extract node sequences from the alarm cluster and calculate the probability of extracting the node sequence with the highest risk level according to the following formula: ; Among them, P threshold Let q be the probability, q be the specific number of samples to be checked, U be the set of all node sequences in the alarm cluster, |U| be the total number of node sequences in the alarm cluster, H be the set of node sequences with the highest risk level in the alarm cluster, and |H| be the total number of node sequences with the highest risk level in the alarm cluster.

[0097] The selection module is used to select the sampling quantity corresponding to the probability meeting the requirements, and the minimum sampling quantity among the selected sampling quantities is used as the specific number.

[0098] Figure 3 This diagram illustrates a more specific hardware structure of an electronic device provided in this embodiment. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0099] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0100] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0101] The input / output interface 1030 is used to connect input / output modules to realize information input and output. The input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.

[0102] The communication interface 1040 is used to connect the communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, radio (shortwave / ultra-shortwave) communication, satellite communication, data link communication, etc.).

[0103] Bus 1050 includes pathways for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0104] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments described in this specification, and need not include all the components shown in the figures.

[0105] The electronic devices described above are used to implement the corresponding alarm noise reduction methods based on large power system models in any of the foregoing embodiments, and have the beneficial effects of the corresponding method implementations, which will not be elaborated here.

[0106] Based on the same inventive concept, corresponding to any of the above-described embodiments, this application also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the alarm noise reduction method based on a large power system model as described in any of the above embodiments.

[0107] The computer-readable medium in this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0108] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the alarm noise reduction method based on the large power system model as described in any of the above embodiments, and have the beneficial effects of the corresponding method implementation, which will not be repeated here.

[0109] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; this manner of description is merely for clarity, and those skilled in the art should consider the specification as a whole. Within the framework of this application, the above embodiments or the technical features of different embodiments can also be appropriately combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0110] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be entirely within the understanding of those skilled in the art). While specific details (e.g., circuits) are set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0111] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0112] The embodiments described herein are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and principles of the embodiments described herein should be included within the protection scope of this application.

Claims

1. An alarm noise reduction method based on a large power system model, characterized in that, The method includes: Acquire multi-source heterogeneous alarm data from the power system and construct a preprocessed dataset; A heterogeneous information network is constructed based on the preprocessed dataset. The heterogeneous information network is used to generate node sequences containing alarm semantics. Multiple node sequences that meet the similarity requirements are aggregated into an alarm cluster. Based on the alarm cluster, generate an alarm cluster feature data structure; Acquire the knowledge graph and historical alarm data of the power system to construct a large-scale power threat detection model; The alarm cluster feature data structure is input into the power threat detection big data model to generate an alarm analysis report for the power system.

2. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, The construction of the preprocessed dataset includes: The multi-source heterogeneous alarm data is standardized to generate standard format data. Extract feature fields from the standard format data and construct regular expressions; The set of regular expressions is used to form the preprocessed dataset.

3. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, The step of constructing a heterogeneous information network based on the preprocessed dataset, and using the heterogeneous information network to generate node sequences containing alarm semantics, includes: A basic information network is obtained, which includes multiple nodes and multiple edges. The multiple nodes correspond to multiple types of information, and the multiple edges correspond to the relationships between the multiple types of information. The data in the preprocessed dataset are introduced into the nodes of the basic information network according to their types to generate the heterogeneous information network; The node sequence corresponding to the alarm semantics is generated using a random walk strategy.

4. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, The step of aggregating multiple node sequences that meet the similarity requirements into an alarm cluster includes: Process multiple node sequences to generate multiple vector representations corresponding to the multiple node sequences; Using a density-based clustering algorithm, the Euclidean distance between multiple vector representations is calculated, and the vector representations are divided into alarm clusters and outliers.

5. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, The step of generating an alarm cluster feature data structure based on the alarm cluster includes: Based on the alarm cluster, a clustering algorithm is used to generate summary features in a structured representation of the target format, and the summary features are used as the feature data structure of the alarm cluster.

6. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, The process of acquiring the knowledge graph and historical alarm data of the power system and constructing a large-scale power threat detection model includes: Select the large base model; Freeze the pre-training weights of the base model, inject the knowledge graph and the historical alarm data, and fine-tune the base model.

7. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, The step of inputting the alarm cluster feature data structure into the power threat detection big data model to generate an alarm analysis report for the power system includes: The alarm cluster feature data structure is input into the power threat detection big model to generate an analysis document of the judgment results in a specified format as the alarm judgment report; After generating the power system alarm analysis report, it includes: The correctness of the alarm analysis report is determined, and the alarm analysis report and its judgment results are used as training set and input into the power threat detection big model.

8. The alarm noise reduction method based on a large power system model according to claim 1, characterized in that, After aggregating multiple node sequences that meet the similarity requirements into an alarm cluster, the process includes: The risk level of a specific number of node sequences is randomly selected within a single alarm cluster; If multiple sampled node sequences have the same risk level, then the risk level of the node sequence is determined to be the risk level of the alarm cluster.

9. The alarm noise reduction method based on a large power system model according to claim 8, characterized in that, The risk level of randomly selecting a specific number of node sequences within a single alarm cluster includes: Detect the highest risk level of the alarm cluster; The node sequence is extracted from the alarm cluster, and the probability of extracting the node sequence with the highest risk level is calculated according to the following formula: ； Among them, P threshold Let q be the probability, q be the number of checks, U be the set of all node sequences in the alarm cluster, |U| be the total number of node sequences in the alarm cluster, H be the set of node sequences with the highest risk level in the alarm cluster, and |H| be the total number of node sequences with the highest risk level in the alarm cluster. Select the sampling quantity corresponding to the probability meeting the requirements, and use the minimum sampling quantity among the selected sampling quantities as the specific number.

10. An alarm noise reduction system based on a large power system model, characterized in that, The system includes: The first acquisition module is used to acquire multi-source heterogeneous alarm data in the power system and construct a preprocessed dataset. An aggregation module is used to construct a heterogeneous information network based on the preprocessed dataset, generate node sequences containing alarm semantics using the heterogeneous information network, and aggregate multiple node sequences that meet similarity requirements into an alarm cluster. The first generation module is used to generate an alarm cluster feature data structure based on the alarm cluster; The first construction module is used to acquire the knowledge graph and historical alarm data of the power system and build a large power threat detection model. The second generation module is used to input the alarm cluster feature data structure into the power threat detection big model to generate an alarm analysis report for the power system.

Images