Power network abnormal behavior monitoring system and method based on full flow analysis

Abstract

The invention discloses a power network abnormal behavior monitoring system and method based on full flow analysis, and relates to the technical field of power system network security. Comprising a data acquisition module, a flow preprocessing and analysis module, a behavior feature extraction module, an anomaly detection and analysis module and an alarm and response module, and the flow preprocessing and analysis module is internally provided with a hardware analysis unit and a software deep detection engine and outputs enhanced flow identification and protocol semantic information. A dynamic baseline model, a machine learning classification model and an anomaly rule base are arranged in the anomaly detection and analysis module. According to the method, FPGA hardware acceleration and a DPI engine are fused, so that a deep protocol sensing function is realized, a mainstream power industrial control protocol is accurately analyzed, protocol semantics can be understood, a foundation is laid for business layer anomaly detection, and the detection depth and the recognition accuracy of advanced directional threats are greatly improved.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, specifically to a power network abnormal behavior monitoring system and method based on full flow analysis. Background Technology

[0002] With the deepening of smart grid and digital transformation, the closed nature of power monitoring system networks has been broken, and they are facing increasingly severe cybersecurity threats. Advanced persistent threats (APTs), ransomware, insider misconduct, and specific attacks targeting industrial control protocols have become major risks affecting the safe and stable operation of power systems. Currently, power networks are widely equipped with traditional perimeter protection devices such as firewalls and intrusion detection systems (IDS). However, these devices have significant limitations: insufficient protocol awareness: they lack deep parsing capabilities of the semantics, function codes, and data objects of power industrial control protocols, making it impossible to identify malicious command injection or data theft disguised under legitimate protocols; limited detection perspective: log-based or sampling-based detection methods cannot obtain complete network session context, making it difficult to detect low-frequency, slow, and persistent APT attacks and lateral movement behaviors; lack of dynamic adaptability: power production operations have strong periodicity and temporality, and static detection rules are difficult to adapt to such normal business fluctuations, easily generating a large number of false alarms or missed alarms; fragmented alarms: alarms generated by different security devices are isolated from each other, lacking the ability to perform correlation analysis based on full traffic data, making it difficult to reconstruct the complete attack chain, and placing a huge burden on security operations personnel for event analysis.

[0003] Patent document CN118200019B discloses a network event security monitoring method and system. The above patent improves the monitoring and response capabilities of network security, discovers abnormal nodes and potential threat events in the power network, helps to detect potential attacks or abnormal situations in the early stage, and performs threat event identification and generates corresponding threat identification events for potential threat events in the power network, which helps to classify and identify different types of threats.

[0004] The aforementioned patents improve the comprehensiveness and adaptability of network security protection by identifying abnormal nodes in network events and constructing multi-layered attack type defense strategies, but the protocol awareness capability of the monitoring system is still insufficient.

[0005] Therefore, this application proposes a power network abnormal behavior monitoring system and method based on full flow analysis that can perform multi-dimensional behavior modeling. Summary of the Invention

[0006] The purpose of this invention is to provide a power network abnormal behavior monitoring system and method based on full flow analysis, so as to solve the technical problems of insufficient protocol awareness and one-sided detection perspective mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a power network abnormal behavior monitoring system based on full-flow analysis. The monitoring system is deployed at the core switching node of the power monitoring system network and includes a data acquisition module, a flow preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The data acquisition module captures the original data packets of the entire network flow. The flow preprocessing and parsing module is connected to the data acquisition module and incorporates a hardware parsing unit and a deep packet inspection engine to perform high-speed parsing, flow reconstruction, and deep parsing of industrial control protocols on the original data packets, outputting enhanced flow identifiers and protocol semantic information. The behavior feature extraction module is connected to the flow preprocessing and parsing module and calculates the behavior feature vector of the network session in real time based on the flow identifier and semantic information. The anomaly detection and analysis module is connected to the behavior feature extraction module and incorporates a dynamic baseline model, a machine learning classification model, and an anomaly rule base to compare and match abnormal behaviors. The alarm and response module is connected to the anomaly detection and analysis module to generate visual alarms and support response linkage.

[0008] Preferably, the data acquisition module includes an industrial Ethernet switch with port mirroring function. The input end of the data acquisition module is physically connected to the mirror port of the core switching node of the monitored network through optical fiber. The data acquisition module captures and forwards the original data packets of the entire network traffic without interruption. The output end of the data acquisition module is connected to the input end of the traffic preprocessing and parsing module through a high-speed data bus.

[0009] Preferably, the traffic preprocessing and parsing module includes a hardware parsing unit based on a field-programmable gate array and a deep packet inspection engine based on a general-purpose processor. The hardware parsing unit has embedded data packet parsing logic circuitry. The logic circuitry performs link layer decapsulation, network layer protocol identification, and transport layer stream reassembly on the received raw data packets, and outputs a five-tuple information consisting of source IP address, destination IP address, source port, destination port, and transport layer protocol type. The hardware parsing unit also has embedded traffic statistics logic circuitry to perform real-time statistics on the number of packets, bytes, and new connection rate at the port level and flow level. The deep packet inspection engine is loaded with a power control protocol feature library, which contains message structure feature codes of IEC60870-5-104, IEC 61850 MMS and Modbus TCP protocols. The deep packet inspection engine receives the reassembled application layer payload corresponding to the five-tuple information, identifies the specific industrial control protocol type by matching the feature codes, and deeply parses the function code field, data object address field and operation data content containing telemetry values, remote signaling status and remote control commands in the application layer message according to the identified protocol specifications. The deep packet inspection engine also contains a protocol fingerprint library, which identifies the industrial control protocol traffic carried by non-standard ports by matching the distribution characteristics and fixed values ​​of the first N bytes of the payload.

[0010] Preferably, the behavior feature extraction module includes a stream session tracking unit and a multi-dimensional feature calculation unit. The stream session tracking unit maintains an active stream session table based on the five-tuple information output by the hardware parsing unit and the industrial control protocol type. The active stream session table records the session identifier, timestamp, and the parsed application layer transaction sequence within the session. The multi-dimensional feature calculation unit receives the output of the traffic preprocessing and parsing module in real time, and periodically calculates the following feature vectors for each active flow session: session duration, ratio of uplink to downlink data packets in the session, mean and variance of data packet payload size in the session, frequency of occurrence of specific function code type messages within a preset time window, access order pattern of data object addresses in continuous application layer transactions, and rate of change of telemetry data in adjacent sampling periods.

[0011] Preferably, the multi-dimensional feature calculation unit specifically calculates the following industrial control protocol semantic features: for the IEC60870-5-104 protocol, it calculates the frequency and response integrity of the general call command; for the Modbus TCP protocol, it determines whether the address range of register operations is out of bounds; for the IEC 61850 MMS protocol, it constructs the service access path pattern.

[0012] Preferably, the anomaly detection and analysis module includes: a dynamic baseline modeling unit, a machine learning classifier unit, a rule matching unit, and a correlation analysis unit; The dynamic baseline modeling unit uses time series analysis to learn the historical feature vectors output by the behavior feature extraction module, and establishes a multi-dimensional behavior baseline model for different stream session types, including the normal range of feature values, periodic patterns and correlations. The machine learning classifier unit is trained using a sample set of feature vectors pre-labeled with normal and abnormal types. The classifier uses a gradient boosting decision tree model, takes real-time feature vectors as input, and outputs the probability that the feature vectors belong to a predefined abnormal type. The rule matching unit stores and matches a set of deterministic anomaly rules, which define specific behavioral patterns that violate power network security regulations; The correlation analysis unit analyzes the temporal, IP, and logical relationships between abnormal events, aggregating discrete events into complex attack scenarios.

[0013] Preferably, the alarm and response module includes an alarm generation unit, a visualization interface unit, and a linkage interface unit; The alarm generation unit receives the anomaly judgment results output by the anomaly detection and analysis module. The judgment results include the anomaly flow session identifier, the specific feature dimension that triggered the anomaly, the magnitude of deviation from the baseline and the classification probability, and the deterministic rule number that triggered the anomaly. The alarm generation unit assigns a threat level to each anomaly event according to the preset threat level matrix and generates a structured alarm log. The visualization interface unit graphically displays network traffic topology, real-time traffic statistics, and a list and details of abnormal events, and provides interfaces for querying and tracing historical alarms. Based on the generated alarms and their threat levels, the linkage interface unit sends instructions to the existing intrusion prevention system in the power monitoring system network through the standard API interface. The instructions include blocking specific IP addresses, closing specific network ports, and temporarily modifying access control policies.

[0014] Preferably, the specific steps of the monitoring method are as follows: S1. Full Traffic Data Acquisition: By deploying mirror ports on core network nodes, the system captures raw bidirectional network traffic data packets without loss and transmits the data packets to the processing system in real time. S2. Traffic Deep Parsing and Identification: Utilizing hardware acceleration and deep packet inspection technology, high-speed parsing, flow reconstruction, and deep parsing of industrial control protocols are performed on data packets to extract enhanced flow identifiers and semantic information. S3. Real-time extraction of multi-dimensional behavioral features: Based on enhanced flow identifiers, maintain the active session state, and for each session, calculate network layer traffic features, transport layer interaction features, and application layer industrial control service semantic features in real time to generate feature vectors. S4. Dynamic baseline modeling and anomaly detection: Using a dynamic baseline model, a pre-trained machine learning model, and a deterministic rule base, the feature vectors are compared and matched to determine abnormal behavior. S5. Alarm Generation and Threat Response: Based on the behavior identified as abnormal, assess the potential threat level and generate structured alarm events; display them through a visual interface, and trigger proactive network-level defense measures through linkage interfaces.

[0015] Preferably, the S2 traffic deep parsing and identification specifically includes: S21. Hardware Layer Parsing: The Ethernet frame is decapsulated using FPGA logic circuits, the IP header is identified, and the source IP address and destination IP address are extracted; the TCP and UDP headers are identified, and the source port number and destination port number are extracted, the transport layer stream is reassembled, and the continuous application layer data payload is output. S22. Protocol Identification and Deep Parsing: The application layer payload is sent to the deep packet inspection engine and matched sequentially with the pre-stored industrial control protocol feature library to determine the protocol type; according to the determined protocol specifications, the application protocol data units in the message are parsed to extract the control field, function code field, data unit identifier field and data value field. S23. For encrypted and private protocol traffic, perform protocol fingerprint matching and record basic session characteristics. After marking it as "unknown protocol", still extract behavioral features of the network layer and transport layer.

[0016] Preferably, the S4 dynamic baseline modeling and anomaly detection specifically includes: S41. Baseline learning phase: Collect historical feature vector data within a preset learning period, use time series clustering method to divide traffic sessions into different categories according to access patterns, and establish a seasonal baseline model for each feature dimension of each category. S42. Real-time deviation detection: For real-time feature vectors, first determine the session category based on the stream identifier, and obtain the baseline expectation value and fluctuation range corresponding to the current moment; calculate the Z-score of each feature dimension. If the number of dimensions exceeding the preset threshold is greater than the set value, a baseline deviation alarm is triggered. S43. Machine Learning Classification: Input the real-time feature vector into the trained gradient boosting classifier. The classifier outputs the probability distribution of the vector belonging to the preset category. Take the maximum probability value and its corresponding category. If it is an abnormal category and the probability exceeds the confidence threshold, trigger the model classification alarm. S44. Rule Determination: Match the stream session information with a predefined deterministic security rule base. If the rule conditions are completely matched, a rule alarm is immediately triggered, which has the highest priority.

[0017] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention achieves deep protocol awareness by integrating FPGA hardware acceleration and DPI engine, accurately analyzes mainstream power industrial control protocols, understands protocol semantics, lays the foundation for anomaly detection at the business layer, fundamentally solves the blind spot of traditional security equipment that cannot see the content of industrial control protocols, and greatly improves the depth of detection and the accuracy of identifying advanced targeted threats. 2. This invention achieves adaptive learning and low false alarm monitoring by constructing a multi-dimensional dynamic baseline model. It can automatically learn and establish a normal behavior profile that conforms to the power production law. The baseline model can evolve smoothly with changes in business mode, thereby effectively distinguishing normal business fluctuations from real abnormal behavior. It overcomes the inherent defect of high false alarm rate of static threshold rules, enabling the system to maintain high availability in complex industrial environments. 3. This invention employs a three-engine fusion analysis architecture of dynamic baseline deviation detection, machine learning model classification, and deterministic rule matching to achieve the function of discovering unknown threats and blocking them in real time. The machine learning model can discover unknown potential abnormal patterns by learning from historical feature vectors; the deterministic rule base can achieve real-time matching and alarm for clear violations, ensuring that the monitoring system has the ability to respond to high-risk behaviors in real time while covering a wide range of threats. 4. This invention achieves a closed-loop security system by designing a feedback learning and linkage response mechanism. The confirmation results of alarms by security personnel can be used as labeled data to continuously optimize machine learning models and dynamic baselines, enabling the system to have self-evolution capabilities and continuously reduce false alarms and false negatives. At the same time, the system links with network firewalls and intrusion prevention systems to quickly isolate and block high-level threats, transforming monitoring capabilities into actual protection capabilities and improving the overall proactive defense level of the power network. Attached Figure Description

[0018] Figure 1 This is a schematic block diagram illustrating the overall workflow of the present invention; Figure 2 This is a schematic block diagram of the system architecture of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example 1: Please refer to Figure 1 and Figure 2A power network abnormal behavior monitoring system based on full traffic analysis is disclosed. The monitoring system is deployed at the core switching node of the power monitoring system network and includes a data acquisition module, a traffic preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The data acquisition module includes an industrial Ethernet switch with port mirroring function. The input end of the data acquisition module is physically connected to the mirror port of the core switching node of the monitored network through optical fiber. The data acquisition module captures and forwards the original data packets of the full network traffic without interruption. The output end of the data acquisition module is connected to the input end of the traffic preprocessing and parsing module through a high-speed data bus. Furthermore, this embodiment elaborates on the overall architecture of the monitoring system and the specific implementation of its data acquisition module. The monitoring system is physically deployed at the core exchange node between the production control area and the management information area of ​​the power monitoring system network. It aims to achieve panoramic monitoring of abnormal behavior of the entire power monitoring network by performing lossless acquisition and in-depth analysis of all network traffic flowing through the critical path. The core hardware platform of the system adopts a high-performance industrial server, equipped with multiple high-speed network interface cards and a dedicated field-programmable gate array (FPGA) acceleration card to ensure real-time processing capability of network traffic. The software system is built on the Linux operating system and adopts a modular design. Data exchange between various functional modules is carried out through a high-speed message bus to ensure the high efficiency and low latency of the data processing pipeline. The data acquisition module is the system's data entry point. Without affecting the normal operations of the monitored network, it completely captures bidirectional raw data packets from the network. The module includes an industrial Ethernet switch. Utilizing the port mirroring function built into the industrial Ethernet switch, the service port to be monitored (i.e., the uplink port or the port connecting to important regional devices) is configured as the source port, and a dedicated, unused 10 Gigabit optical or electrical port is configured as the destination mirror port. Subsequently, the mirror port is physically connected to the input port of a dedicated data acquisition network card on the monitoring system server using optical fiber. The switch hardware ASIC automatically forwards copies of all data packets flowing through the source port to the mirror port, thus achieving uninterrupted, line-speed copying of traffic. The hardware (acquisition network card) of the data acquisition module supports Data Plane Development Kit (DPDK) kernel bypass technology, directly sending the captured raw data packets into a user-space ring buffer, greatly reducing the processing overhead of the operating system kernel protocol stack and providing a high-throughput, low-jitter raw data stream for subsequent modules. The software part of the data acquisition module is mainly responsible for driving the acquisition hardware, managing the buffer, and adding accurate timestamps to the raw data packets. It then continuously transmits the timestamped raw data packet stream to the downstream traffic preprocessing and parsing module via the PCIe bus.

[0021] Example 2: Please refer to Figure 1 and Figure 2 A power network abnormal behavior monitoring system based on full flow analysis is disclosed. The monitoring system is deployed at the core switching node of the power monitoring system network and includes a data acquisition module, a flow preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The flow preprocessing and parsing module includes a hardware parsing unit based on a field-programmable gate array and a deep packet inspection engine based on a general-purpose processor. The hardware parsing unit has embedded data packet parsing logic circuits. The logic circuits perform link layer decapsulation, network layer protocol identification, and transport layer flow reassembly on the received raw data packets, and output a five-tuple information consisting of source IP address, destination IP address, source port, destination port, and transport layer protocol type. The hardware parsing unit also has embedded flow statistics logic circuits to count the number of packets, bytes, and new connection rate at the port level and flow level in real time. The deep packet inspection engine is loaded with a power control protocol feature library, which contains message structure feature codes of IEC60870-5-104, IEC 61850 MMS and Modbus TCP protocols. The deep packet inspection engine receives the reassembled application layer payload corresponding to the five-tuple information, identifies the specific industrial control protocol type by matching the feature codes, and deeply parses the function code field, data object address field and operation data content containing telemetry values, remote signaling status and remote control commands in the application layer message according to the identified protocol specifications. The deep packet inspection engine also contains a protocol fingerprint library, which identifies the industrial control protocol traffic carried by non-standard ports by matching the distribution characteristics and fixed values ​​of the first N bytes of the payload. Furthermore, this embodiment focuses on the specific technical implementation of the traffic preprocessing and parsing module. The traffic preprocessing and parsing module is the bridge connecting the raw traffic and high-level behavior analysis. Its performance and accuracy directly determine the upper limit of the entire system's capabilities. The traffic preprocessing and parsing module adopts a hardware and software co-design concept, consisting of an FPGA-based hardware parsing unit and a software deep packet inspection (DPI) engine running on a general-purpose processor, forming an efficient and accurate parsing pipeline. The core of the hardware parsing unit is an FPGA acceleration card integrated within the server. The hardware parsing unit uses hardware description languages ​​(such as Verilog and VHDL) to design and embed dedicated packet parsing logic circuits. When the raw Ethernet frame data stream is input from the data acquisition module, this logic circuit first performs link layer decapsulation, identifies the frame type, and extracts the destination MAC address and source MAC address. Next, the circuit parses the network layer header, identifies the protocol version, and extracts the crucial source IP address and destination IP address fields. For the transport layer, the logic circuit can identify the TCP or UDP header, extract the source port number and destination port number, and store the data in the FPGA's high-speed memory based on the five-tuple (source IP, destination IP, protocol, source port, and destination port). The BRAM maintains a flow session state table, reassembles out-of-order or fragmented packets belonging to the same TCP flow, and outputs a continuous and complete application layer payload. The entire process is performed at line speed at the hardware level with extremely low latency. In addition, the logic circuit also integrates a traffic statistics submodule, which can count the number of data packets and the total number of bytes for each physical input port and each active 5-tuple flow in real time, and calculate basic indicators such as the number of new connections per second. These statistics will be directly output as basic features. The hardware parsing unit finally outputs two types of data: one is the 5-tuple information flow used to identify the session; the other is the application layer payload data flow corresponding to the 5-tuple and reassembled. Both are efficiently passed to the software deep packet inspection engine running on the host CPU through queues or descriptors. The deep packet inspection engine is the core of protocol semantic parsing. It loads a feature library of power control protocols. This library not only includes standard port numbers for mainstream protocols such as IEC 60870-5-104, IEC 61850 MMS, DNP3.0, and Modbus TCP, but also the message structure feature codes of these protocols. For example, for Modbus TCP, the feature code includes a transaction identifier, a fixed value for the protocol identifier (0x0000), and a function code field located at a specific offset; for IEC 104, it includes a start character (0x68) and a length field checksum. After receiving the application layer payload from the hardware parsing unit, the deep packet inspection engine uses a multi-pattern matching algorithm to quickly match it with the feature library to determine the specific power control protocol type to which the current payload belongs. Once the protocol is identified, the deep packet inspection engine calls the corresponding protocol parser. The parser strictly follows the protocol standard to perform deep decoding of the message: parsing the control field, type identifier, variable structure qualifiers, and information body address of IEC 104; parsing the function code and register address range of Modbus TCP; and parsing the IEC... The 61850 MMS PDU structure extracts service calls and object references. Finally, the deep packet inspection engine outputs enhanced flow identification information, which not only includes the basic 5-tuple but also extends to application layer protocol type, specific function code, data object address of the operation (such as register address, message body address, and object reference), and specific operation values ​​(such as telemetry values ​​and remote control command status). For encrypted traffic or private protocols using non-standard ports, the deep packet inspection engine is also equipped with a protocol fingerprint library. It generates fingerprints by analyzing the entropy value, byte value distribution, and fixed magic number at specific positions of the first N bytes of the payload and performs similarity matching with samples of known industrial control protocols in the fingerprint library to achieve protocol inference. Even if it cannot be fully decoded, it can be classified and further network layer behavior analysis can be performed.

[0022] Example 3: Please refer to Figure 1 and Figure 2 A power network abnormal behavior monitoring system based on full flow analysis is disclosed. The monitoring system is deployed at the core switching node of the power monitoring system network and includes a data acquisition module, a flow preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The behavior feature extraction module includes a flow session tracking unit and a multi-dimensional feature calculation unit. The flow session tracking unit maintains an active flow session table based on the five-tuple information output by the hardware parsing unit and the industrial control protocol type. The active flow session table records the session identifier, timestamp, and the parsed application layer transaction sequence within the session. The multi-dimensional feature calculation unit receives the output of the traffic preprocessing and parsing module in real time, and periodically calculates the following feature vectors for each active flow session: session duration, ratio of uplink to downlink data packets in the session, mean and variance of data packet payload size in the session, frequency of occurrence of specific function code type messages within a preset time window, access order pattern of data object addresses in continuous application layer transactions, and rate of change of telemetry data in adjacent sampling periods. The multi-dimensional feature calculation unit specifically calculates the following semantic features of industrial control protocols: for the IEC 60870-5-104 protocol, it calculates the frequency and response integrity of the general call command; for the Modbus TCP protocol, it determines whether the address range of register operations is out of bounds; for the IEC 61850 MMS protocol, it constructs the pattern of service access path. Furthermore, this embodiment details the process by which the behavior feature extraction module transforms the parsed protocol semantic information into a quantifiable and analyzable behavior feature vector. The behavior feature extraction module consists of a flow session tracking unit and a multi-dimensional feature calculation unit. Its goal is to construct a dynamic profile that can comprehensively depict the behavior patterns of network entities. The flow session tracking unit maintains an active flow session table, which is stored in the system's in-memory database. Each entry in the table represents a currently active network session, and its key value (i.e., session identifier) ​​consists of an enhanced flow identifier including a 5-tuple and a protocol type. Each entry records the following: the session's start timestamp, the timestamp of the most recent activity, the session status, and a list of parsed application layer transaction sequences. The list records all industrial control protocol transactions within the session that have been successfully parsed by the deep packet inspection engine in chronological order. Each transaction entry contains at least a timestamp, function code, data object address, and operands. This table provides the basis for calculating behavior features based on time sequence and context. The multi-dimensional feature calculation unit periodically calculates multi-dimensional feature vectors for each session based on the event scanning active flow session table. These features describe session behavior from different levels: basic traffic features, including the number of seconds the session has lasted, the ratio of uplink to downlink data packets within the session, and the average and variance of the effective payload bytes of data packets, reflecting the session's activity and data exchange patterns; time-series frequency features, which count the frequency of messages of specific function code types within a sliding time window. For example, in a SCADA system, telemetry transmissions may have a high periodicity, while remote control commands have a low frequency. Abnormal frequency changes may indicate scanning or attacks; and business sequence features, which analyze the access order patterns of data object addresses in continuous application layer transactions. Normal operation and maintenance operations may access certain registers or data points in a specific order, while malicious scanning or vulnerability exploitation attempts may exhibit random or traversal access patterns. For the MMS protocol, service access path patterns can be constructed and their regularity analyzed; data content characteristics can be analyzed by calculating the rate of change of specific data points in adjacent sampling periods for telemetry data. According to physical laws, changes in power parameters are usually continuous and bounded, and sudden changes or values ​​exceeding physical limits may indicate data tampering or measurement failures; session association characteristics can be analyzed by associating multiple sessions initiated by the same source IP or destination IP, calculating the rate of new sessions and the number of different destination ports accessed per unit time, and detecting scanning or lateral movement behavior. All these characteristics are calculated based on real-time data and historical sequences maintained by the flow session tracking unit. The calculation results are organized into feature vectors, with session identifiers and timestamps attached, and pushed to the input queue of the anomaly detection and analysis module in real time. The dimension of the feature vectors can be configured and expanded according to the monitoring focus, ensuring the richness and adaptability of the behavioral profile.

[0023] Example 4: Please refer to Figure 1 and Figure 2 A power network abnormal behavior monitoring system based on full flow analysis is disclosed. The monitoring system is deployed at the core switching node of the power monitoring system network and includes a data acquisition module, a flow preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The anomaly detection and analysis module includes a dynamic baseline modeling unit, a machine learning classifier unit, a rule matching unit, and a correlation analysis unit. The dynamic baseline modeling unit uses time series analysis to learn from the historical feature vectors output by the behavior feature extraction module, establishing a multi-dimensional behavior baseline model for different stream session types, including normal ranges of feature values, periodic patterns, and correlations. The machine learning classifier unit is trained using a pre-labeled set of feature vector samples with normal and abnormal types. The classifier uses a gradient boosting decision tree model, taking real-time feature vectors as input and outputting the probability that the feature vectors belong to a predefined abnormal type. The rule matching unit stores and matches a set of deterministic abnormal rules, which define specific behavioral patterns that violate power network security regulations. The correlation analysis unit analyzes the temporal, IP, and logical correlations between abnormal events, aggregating discrete events into complex attack scenarios. Furthermore, this embodiment elaborates on how the anomaly detection and analysis module comprehensively analyzes behavioral feature vectors to achieve a balance between high detection rate and low false alarm rate. The anomaly detection and analysis module includes a dynamic baseline modeling unit, a machine learning classifier unit, a rule matching unit, and a correlation analysis unit. These units work together to form a comprehensive detection system from statistical anomalies and pattern anomalies to identifying violations. The dynamic baseline modeling unit is responsible for learning and characterizing the behavioral patterns of the power network under normal operating conditions. After the initial system deployment, it enters a learning phase. During this phase, the dynamic baseline modeling unit collects historical feature vector data generated by the behavioral feature extraction module, but does not issue anomaly alarms. First, the dynamic baseline modeling unit uses a time-series clustering algorithm. Based on the protocol type and access mode of the sessions, the massive session traffic is automatically divided into several categories (such as "station control layer MMS query", "protection device setting call", "telemetry data periodic upload"). For each feature dimension under each category, the dynamic baseline modeling unit uses the time series decomposition method to establish a seasonal baseline model. The time axis is divided into weekdays / holidays and peak hours (daytime working hours) / valley hours (late night). For the feature data within each time slice, the exponentially weighted moving average (EWMA) is calculated as the expected value μ, and the moving standard deviation σ is calculated as the fluctuation range. Subsequently, based on the expected value and standard deviation, the Z-score of each feature dimension is rigorously calculated. The calculation formula is as follows: , where x i It is the observation value of the i-th dimension in the real-time feature vector. This baseline model can automatically adapt to normal business changes brought about by different power grid operation modes. After the system is officially put into operation, the dynamic baseline modeling unit continuously updates the baseline parameters smoothly with real-time data that is judged to be normal in an online learning manner, so as to realize the gradual evolution of the baseline model. The machine learning classifier unit focuses on discovering complex anomaly patterns that are difficult to describe using fixed rules or statistical thresholds. In the offline phase, the security officer prepares a labeled training sample set, with samples from historical traffic or simulation tests. Feature vectors are labeled as "normal" or specific anomaly types. The machine learning classifier unit is trained using a gradient boosting decision tree (GBDT) model because it has good handling capabilities for heterogeneous features and complex nonlinear relationships. The trained model is loaded into the machine learning classifier unit. During online operation, for each real-time input feature vector, the model outputs the probability distribution of each predefined category. The system selects the category with the highest probability. If the category is anomaly and its probability exceeds a preset confidence threshold, a model classification alarm is triggered. The machine learning classifier unit can discover subtle, multi-feature combination anomaly patterns that may be overlooked by baseline deviation detection.

[0024] The rule matching unit provides deterministic, zero-false-report detection capabilities. The rule matching unit maintains a rule base defined by security policies. Each rule clearly describes the behavior pattern that violates the regulations. The rule matching unit receives enhanced flow identifiers and transaction information in real time. Once it finds that the flow session information completely matches the conditions of a certain rule, it immediately generates the highest priority rule alarm to achieve real-time blocking. The correlation analysis unit receives raw alarm events generated by the above three units. By analyzing the chronological order of events, the correlation between IP addresses, and the relevance of operational logic, it aggregates multiple discrete, low-level alarms into a high-level composite security event that describes a complete attack chain, greatly improving the understandability of alarms and the severity assessment of threats.

[0025] Example 5: Please refer to Figure 1 and Figure 2 A power network abnormal behavior monitoring system based on full flow analysis is provided. The monitoring system is deployed at the core switching node of the power monitoring system network and includes a data acquisition module, a flow preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The alarm and response module includes an alarm generation unit, a visualization interface unit, and a linkage interface unit. The alarm generation unit receives the anomaly judgment results output by the anomaly detection and analysis module. The judgment results include the anomaly flow session identifier, the specific feature dimension that triggered the anomaly, the magnitude of deviation from the baseline and the classification probability, and the deterministic rule number that triggered the anomaly. The alarm generation unit assigns a threat level to each anomaly event according to the preset threat level matrix and generates a structured alarm log. The visualization interface unit graphically displays the network traffic topology, real-time traffic statistics, and anomaly event list and details, and provides interfaces for querying and tracing historical alarms. The linkage interface unit sends instructions to the existing intrusion prevention system in the power monitoring system network through the standard API interface according to the generated alarm and its threat level. The instructions include blocking specific IP addresses, closing specific network ports, and temporarily modifying access control policies. Furthermore, this embodiment details the security closed loop of the alarm and response module. The alarm generation unit of the alarm and response module receives the judgment results from the anomaly detection and analysis module. Based on a preset threat level matrix, the alarm generation unit automatically assigns high, medium, and low threat levels to each alarm event and generates structured alarm logs. The alarm logs contain the complete identifier of the abnormal flow session, the specific characteristics that triggered the anomaly and its deviation value, the probability of machine learning classification, the triggering rule ID, the event ID after correlation analysis, and the final threat level. The visualization interface unit is responsible for presenting this information graphically, including a dynamic network topology map (highlighting abnormal nodes and links), a real-time traffic dashboard, a detailed list of abnormal events, and a complete source tracing analysis view, supporting security personnel to perform click queries and in-depth investigations. The linkage interface unit automatically sends instructions to the firewalls or intrusion prevention systems deployed in the network through standard RESTful APIs or Syslog protocols based on high-threat-level alarms. For "high" level alarms, instructions can be automatically issued to temporarily block the attack source IP on the boundary firewall. This linkage mechanism realizes a closed loop from "monitoring" to "protection". Security analysts can input alarm IDs or time ranges through the system interface. The system automatically retrieves all raw data packets involving the subject and object of the alarm within the relevant time period from the full traffic storage and visualizes their communication relationship diagram to assist in analysis. In addition, the monitoring system also includes a feedback learning mechanism: security analysts confirm alarms in the interface (confirming them as real threats, false alarms, or missed alarms). This annotation information is automatically collected and used regularly to incrementally train the machine learning model and fine-tune the parameters of the dynamic baseline model. This enables the entire monitoring system to continuously self-optimize and adapt to new threats, realizing an intelligent security operation closed loop.

[0026] Working Principle: First, the data acquisition module deployed at the core node of the power monitoring system network captures the raw data packets of the entire network without loss. The traffic preprocessing and parsing module uses FPGA-based hardware circuits to perform line-speed link-to-transport layer parsing and flow reconstruction of the data packets, and uses a deep packet inspection engine to identify specific industrial control protocols, deeply parsing semantic information such as function codes, data object addresses, and operands. Next, the behavior feature extraction module calculates multi-dimensional behavior feature vectors for each network session in real time, including traffic statistics, operation sequences, and service frequencies, based on the parsing results. Then, the anomaly detection and analysis module comprehensively uses dynamic baseline models, machine learning classification models, and deterministic rule bases to perform fusion analysis and correlation analysis on behavior, accurately determining anomalies. Finally, the alarm and response module generates visualized alarms containing detailed source information based on the judgment results, and can link with firewalls and other devices through standard interfaces to perform proactive defense measures such as blocking. At the same time, the system continuously optimizes the detection model using feedback data, forming a security closed loop of monitoring, response, and optimization.

[0027] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A power network abnormal behavior monitoring system based on full flow analysis, characterized in that: The monitoring system is deployed at the core switching node of the power monitoring system network. It includes a data acquisition module, a traffic preprocessing and parsing module, a behavior feature extraction module, an anomaly detection and analysis module, and an alarm and response module. The data acquisition module captures all raw network traffic data packets. The traffic preprocessing and parsing module is connected to the data acquisition module and incorporates a hardware parsing unit and a deep packet inspection engine to perform high-speed parsing, flow reconstruction, and deep parsing of industrial control protocols on the raw data packets, outputting enhanced flow identifiers and protocol semantic information. The behavior feature extraction module is connected to the traffic preprocessing and parsing module and calculates the behavior feature vector of the network session in real time based on the flow identifier and semantic information. The anomaly detection and analysis module is connected to the behavior feature extraction module and incorporates a dynamic baseline model, a machine learning classification model, and an anomaly rule base to compare and match abnormal behaviors. The alarm and response module is connected to the anomaly detection and analysis module to generate visual alarms and support response linkage.

2. The power network abnormal behavior monitoring system based on full flow analysis according to claim 1, characterized in that: The data acquisition module includes an industrial Ethernet switch with port mirroring functionality. The input end of the data acquisition module is physically connected to the mirror port of the core switching node of the monitored network via optical fiber. The data acquisition module captures and forwards the original data packets of the entire network traffic without interruption. The output end of the data acquisition module is connected to the input end of the traffic preprocessing and parsing module via a high-speed data bus.

3. The power network abnormal behavior monitoring system based on full flow analysis according to claim 1, characterized in that: The traffic preprocessing and parsing module includes a hardware parsing unit based on a field-programmable gate array (FPGA) and a deep packet inspection engine based on a general-purpose processor. The hardware parsing unit has embedded packet parsing logic circuitry. The logic circuitry performs link layer decapsulation, network layer protocol identification, and transport layer stream reassembly on the received raw data packets, and outputs a five-tuple information consisting of source IP address, destination IP address, source port, destination port, and transport layer protocol type. The hardware parsing unit also has embedded traffic statistics logic circuitry, which performs real-time statistics on the number of packets, bytes, and new connection rate at the port level and flow level. The deep packet inspection engine is loaded with a power control protocol feature library, which contains message structure feature codes of IEC 60870-5-104, IEC 61850 MMS and Modbus TCP protocols. The deep packet inspection engine receives the reassembled application layer payload corresponding to the five-tuple information, identifies the specific industrial control protocol type by matching the feature codes, and deeply parses the function code field, data object address field and operation data content containing telemetry values, remote signaling status and remote control commands in the application layer message according to the identified protocol specifications. The deep packet inspection engine also contains a protocol fingerprint library, which identifies the industrial control protocol traffic carried by non-standard ports by matching the distribution characteristics and fixed values ​​of the first N bytes of the payload.

4. The power network abnormal behavior monitoring system based on full flow analysis according to claim 1, characterized in that: The behavior feature extraction module includes a stream session tracking unit and a multi-dimensional feature calculation unit. The stream session tracking unit maintains an active stream session table based on the five-tuple information output by the hardware parsing unit and the industrial control protocol type. The active stream session table records the session identifier, timestamp, and the parsed application layer transaction sequence within the session. The multi-dimensional feature calculation unit receives the output of the traffic preprocessing and parsing module in real time, and periodically calculates the following feature vectors for each active flow session: session duration, ratio of uplink to downlink data packets in the session, mean and variance of data packet payload size in the session, frequency of occurrence of specific function code type messages within a preset time window, access order pattern of data object addresses in continuous application layer transactions, and rate of change of telemetry data in adjacent sampling periods.

5. A power network abnormal behavior monitoring system based on full flow analysis according to claim 4, characterized in that: The multi-dimensional feature calculation unit specifically calculates the following semantic features of industrial control protocols: for the IEC 60870-5-104 protocol, it calculates the frequency and response integrity of the general call command; for the Modbus TCP protocol, it determines whether the address range of register operations is out of bounds; for the IEC 61850 MMS protocol, it constructs the mode of service access path.

6. The power network abnormal behavior monitoring system based on full flow analysis according to claim 1, characterized in that: The anomaly detection and analysis module includes: a dynamic baseline modeling unit, a machine learning classifier unit, a rule matching unit, and a correlation analysis unit; The dynamic baseline modeling unit uses time series analysis to learn the historical feature vectors output by the behavior feature extraction module, and establishes a multi-dimensional behavior baseline model for different stream session types, including the normal range of feature values, periodic patterns and correlations. The machine learning classifier unit is trained using a sample set of feature vectors pre-labeled with normal and abnormal types. The classifier uses a gradient boosting decision tree model, takes real-time feature vectors as input, and outputs the probability that the feature vectors belong to a predefined abnormal type. The rule matching unit stores and matches a set of deterministic anomaly rules, which define specific behavioral patterns that violate power network security regulations; The correlation analysis unit analyzes the temporal, IP, and logical relationships between abnormal events, aggregating discrete events into complex attack scenarios.

7. A power network abnormal behavior monitoring system based on full flow analysis according to claim 1, characterized in that: The alarm and response module includes an alarm generation unit, a visualization interface unit, and a linkage interface unit. The alarm generation unit receives the anomaly judgment results output by the anomaly detection and analysis module. The judgment results include the anomaly flow session identifier, the specific feature dimension that triggered the anomaly, the magnitude of deviation from the baseline and the classification probability, and the deterministic rule number that triggered the anomaly. The alarm generation unit assigns a threat level to each anomaly event according to the preset threat level matrix and generates a structured alarm log. The visualization interface unit graphically displays network traffic topology, real-time traffic statistics, and a list and details of abnormal events, and provides interfaces for querying and tracing historical alarms. Based on the generated alarms and their threat levels, the linkage interface unit sends instructions to the existing intrusion prevention system in the power monitoring system network through the standard API interface. The instructions include blocking specific IP addresses, closing specific network ports, and temporarily modifying access control policies.

8. A method for monitoring abnormal behavior of power networks based on full flow analysis, applicable to the power network abnormal behavior monitoring system based on full flow analysis as described in any one of claims 1-7, characterized in that: The specific steps of the monitoring method are as follows: S1. Full Traffic Data Acquisition: By deploying mirror ports on core network nodes, the system captures raw bidirectional network traffic data packets without loss and transmits the data packets to the processing system in real time. S2. Traffic Deep Parsing and Identification: Utilizing hardware acceleration and deep packet inspection technology, high-speed parsing, flow reconstruction, and deep parsing of industrial control protocols are performed on data packets to extract enhanced flow identifiers and semantic information. S3. Real-time extraction of multi-dimensional behavioral features: Based on enhanced flow identifiers, maintain the active session state, and for each session, calculate network layer traffic features, transport layer interaction features, and application layer industrial control service semantic features in real time to generate feature vectors. S4. Dynamic baseline modeling and anomaly detection: Using a dynamic baseline model, a pre-trained machine learning model, and a deterministic rule base, the feature vectors are compared and matched to determine abnormal behavior. S5. Alarm Generation and Threat Response: Based on the behavior identified as abnormal, assess the potential threat level and generate structured alarm events; display them through a visual interface, and trigger proactive network-level defense measures through linkage interfaces.

9. A method for monitoring abnormal behavior of power networks based on full flow analysis according to claim 8, characterized in that: The S2 traffic deep analysis and identification specifically refers to: S21. Hardware Layer Parsing: The Ethernet frame is decapsulated using FPGA logic circuits, the IP header is identified, and the source IP address and destination IP address are extracted; the TCP and UDP headers are identified, and the source port number and destination port number are extracted, the transport layer stream is reassembled, and the continuous application layer data payload is output. S22. Protocol Identification and Deep Parsing: The application layer payload is sent to the deep packet inspection engine and matched sequentially with the pre-stored industrial control protocol feature library to determine the protocol type; according to the determined protocol specifications, the application protocol data units in the message are parsed to extract the control field, function code field, data unit identifier field and data value field. S23. For encrypted or private protocol traffic, perform protocol fingerprint matching and record basic session characteristics. After marking it as "unknown protocol", still extract behavioral features of the network layer and transport layer.

10. A method for monitoring abnormal behavior of power networks based on full flow analysis according to claim 8, characterized in that: The S4 dynamic baseline modeling and anomaly detection specifically refers to: S41. Baseline learning phase: Collect historical feature vector data within a preset learning period, use time series clustering method to divide traffic sessions into different categories according to access patterns, and establish a seasonal baseline model for each feature dimension of each category. S42. Real-time deviation detection: For real-time feature vectors, first determine the session category based on the stream identifier, and obtain the baseline expectation value and fluctuation range corresponding to the current moment; calculate the Z-score of each feature dimension. If the number of dimensions exceeding the preset threshold is greater than the set value, a baseline deviation alarm is triggered. S43. Machine Learning Classification: Input the real-time feature vector into the trained gradient boosting classifier. The classifier outputs the probability distribution of the vector belonging to the preset category. Take the maximum probability value and its corresponding category. If it is an abnormal category and the probability exceeds the confidence threshold, trigger the model classification alarm. S44. Rule Determination: Match the stream session information with a predefined deterministic security rule base. If the rule conditions are completely matched, a rule alarm is immediately triggered, which has the highest priority.

Images