A fingerprint recognition method for power equipment based on sample optimization and replay incremental learning

Abstract

This invention discloses a fingerprint recognition method for power equipment based on incremental learning and sample optimization replay, belonging to the field of power data processing technology. The method comprises two core stages: Stage 1 involves building a basic classification model, utilizing a convolutional autoencoder to construct a lightweight and efficient session feature extractor, and training a basic classification model; Stage 2 is incremental learning and updating, where a partitioned genetic algorithm is used for efficient sample replay when a new equipment category appears, enabling the model to be incrementally updated and learn to recognize new categories without forgetting old knowledge. This invention solves the technical problems of complex model structures, high computational overhead, and catastrophic forgetting in dynamic open network environments when new equipment types continuously emerge, which are problems inherent in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of power data processing technology, and in particular to a fingerprint recognition method for power equipment based on sample optimization and playback incremental learning. Background Technology

[0002] With the rapid development of the Industrial Internet and smart grids, power systems are undergoing profound digital transformation, leading to a surge in the number and types of intelligent devices connected to the network. Against this backdrop, accurate identification and management of network devices in power systems has become fundamental to ensuring secure network operation and achieving refined asset management. Device fingerprinting technology uniquely identifies devices by capturing inherent behavioral characteristics in their communication traffic. Compared to traditional identification methods that rely on easily forged or mutated IP and MAC addresses, passive fingerprinting offers stronger concealment and stability. By monitoring normal business traffic, passive fingerprinting extracts information such as timing features, packet length distribution, interaction patterns, and protocol field statistics, making it suitable for power monitoring scenarios with extremely high requirements for real-time performance and business continuity.

[0003] In recent years, with the development of deep learning technology, models represented by convolutional neural networks (CNN), recurrent neural networks (RNN), and Transformer architectures have been widely used in traffic analysis, aiming to automatically capture complex spatial features and long-term temporal dependencies in high-dimensional data. However, although these methods have improved recognition accuracy to some extent, they still reveal serious limitations when deployed in engineering for real power networks.

[0004] First, existing research generally pursues recognition accuracy, tending to build deep models with huge numbers of parameters and complex structures. These "heavy models" require massive computing and storage resources during training and inference, resulting in high recognition latency, making it difficult to meet the real-time response requirements of power businesses. They are also unsuitable for edge gateways or embedded monitoring units with limited computing and storage capabilities, leading to serious deficiencies in their lightweight design and engineering adaptability.

[0005] Secondly, existing technologies generally rely on the "closed-world assumption" for static training, assuming that all device categories are known during the training phase. However, real power networks are inherently dynamic and open environments. The continuous integration of new device models (such as new IEDs and RTUs) and the periodic firmware upgrades of existing devices can lead to significant shifts in network traffic characteristics or the emergence of entirely new device categories not seen during the training phase. Faced with such unknown categories, traditional static models completely fail due to their lack of generalization ability. To adapt the model to this dynamic change, existing technological approaches face a severe dilemma:

[0006] Full retraining: This method merges all historical data with the new category data and retrains the model from scratch. While this approach can guarantee model accuracy, its enormous computational overhead, storage burden, and extremely long time cycle are impractical and unacceptable for edge deployment scenarios that prioritize low latency and limited resources.

[0007] Incremental fine-tuning involves rapidly tweaking an existing model using only new category data. While efficient, this approach can cause drastic shifts in model parameters when fitting the new data distribution, severely interfering with or even overwriting established knowledge, leading to a sharp decline in the model's recognition performance on older categories. This phenomenon is the "catastrophic forgetting" problem that urgently needs to be addressed in the field of machine learning.

[0008] Third, in incremental learning scenarios, sample replay strategies are commonly used to mitigate "catastrophic forgetting." However, existing replay mechanisms suffer from common flaws. Current methods often heuristically select a small number of old class samples under a fixed storage budget. Common problems include: a lack of explicit constraints on representativeness and diversity; an assumption that old classes have a unimodal distribution while ignoring intra-class multimodality and long-tail subclusters; failure to control class imbalance and cluster size differences; lack of explicit coverage of decision boundary-sensitive samples (marginal samples, easily confused samples); and the fact that replay samples remain static once stored, failing to adaptively update with feature extractor iterations, leading to "stale memories." Furthermore, the ratio of new to old samples and the loss weights are often set using fixed rules, easily causing the training process to bias towards the new class. These common problems result in a replay library filled with redundant "easy samples," lacking key difficult samples, and failing to comprehensively represent the true feature distribution of old classes.

[0009] In summary, existing device fingerprinting technologies have significant shortcomings in areas such as lightweight model design, adaptive learning capabilities in dynamic and open environments, and how to efficiently select representative samples to suppress catastrophic forgetting. These shortcomings make it difficult to simultaneously meet the urgent needs of modern power networks for high real-time performance, low resource consumption, and high adaptability in device identification. Summary of the Invention

[0010] To address the aforementioned problems, the present invention aims to provide a fingerprint recognition method for power equipment based on sample optimization and replay incremental learning, thereby solving the technical challenges of complex model structures, high computational overhead, and "catastrophic forgetting" in dynamic open network environments (when new equipment types are constantly emerging).

[0011] To solve the above-mentioned technical problems, the present invention provides the following technical solution: On the one hand, a fingerprint recognition method for power equipment based on sample optimization and replay incremental learning is provided, the method comprising the following steps: S1. Collect raw traffic data, aggregate it into session units based on network communication quintuples, and standardize it into session vectors; S2. Train the session vector based on a one-dimensional convolutional autoencoder to minimize the reconstruction loss, retain the trained encoder and its parameters, and obtain a lightweight encoder. S3. Freeze encoder parameters, attach and train classification head to form a base model, and set a low confidence threshold for subsequent detection of unknown categories; S4. Partition the old category data, use a genetic algorithm to find the best, and build a representative sample memory replay library; S5. When a new category appears, the representative old samples are mixed with the new samples to construct an incremental training set, the model parameters are unfrozen, and the mixed loss function is used to constrain the model update direction. S6. Deploy the model at the edge. The real-time session vector is inferred in two stages through a lightweight encoder and a classification head, and finally the recognized category is output.

[0012] Optionally, step S1 specifically includes: Raw traffic data is passively and non-intrusively collected at key network nodes in the power system via port mirroring or TAPs; these key network nodes include communication gateways and aggregation switches. The network communication quintuple aggregates continuous raw traffic data into independent session units. The network communication quintuple includes source IP address, destination IP address, source port number, destination port number, and transport layer protocol. For each session unit, data cleaning, anonymization, and standardization are performed. The number and length of data packets in each session unit are analyzed, and the mean and median are calculated. Based on these two statistical parameters, an appropriate truncation length L is selected to form a high-dimensional one-dimensional session vector. , as input to the subsequent model.

[0013] Optionally, step S2 specifically includes: Construct a one-dimensional convolutional autoencoder, which consists of an encoder. and a decoder Composition, its parameters are as follows and ; Based on the initial known category dataset obtained in step S1 Training a one-dimensional convolutional autoencoder, where For the first i Input session vectors The label for this input session vector. N The number of samples; The training objective is to minimize the reconstruction loss. That is, input The output after reconstruction by the encoder and decoder The difference between them is represented by the mean squared error as the loss function during model training: By minimizing the loss function, the encoder Will Compressed into a low-dimensional latent space feature ; After training converges, the optimal parameters are obtained. and Retain encoder and its parameters Discard decoder A lightweight encoder was obtained. .

[0014] Optionally, step S3 specifically includes: Freeze Lightweight Encoder parameters Add a category header Its parameters are denoted as ; The training process consists of two steps: (1) Feature compression: using a frozen encoder ,Will Transform into low-dimensional latent space features The encoder parameters It does not participate in gradient updates; (2) Classification: low-dimensional latent space features Input category header To obtain the predicted probability distribution ; The training objective is to minimize the standard cross-entropy loss. In this process, only the parameters of the classification head are optimized. : in It is a sample Category The true label; After training, a basic classification model is obtained. Its total parameters are ,in It is a fixed compressor. It is a pre-trained classifier.

[0015] Optionally, step S3 further includes: In the basic classification model After training, set a low confidence threshold. , ; When the basic classification model Session vector of new input When making a prediction, its Softmax probability distribution is obtained. ; Calculate the maximum prediction confidence: , Discrimination: When the session vector The maximum prediction confidence level is lower than Then the session vector If a data point is marked as an unknown category, the system will automatically record log information and trigger an alarm.

[0016] Optionally, step S4 specifically includes: In response to the new category The emergence of this algorithm employs a partitioned genetic algorithm for all old categories. Select representative samples and construct a memory replay library The process consists of two steps: (1) Feature extraction and partitioning: Use the initial known category dataset obtained in step S1 ,right Each old class in Calculate its prototype center in the high-dimensional primordial space. That is, all original session vectors of this class Mean: in It is a category The total number of samples; Calculate this class Each original session vector To its class center European distance According to distance All samples of this class from smallest to largest The samples are sorted and the sample pool is divided into three subsets: the central pool, the intermediate pool, and the boundary pool. (2) Optimization using genetic algorithms: For each old class Select the best combination of samples from the three sample pools. This allows it to represent the entire old class to the greatest extent possible. Distribution; Use a composite fitness function : Representative error :measure The mean of the middle sample and the class The real prototype The squared Euclidean distance between them; the smaller this value, the better the representativeness; diversity :measure middle The average squared pairwise Euclidean distance between samples; the larger this value, the better the diversity. α、β These are the corresponding representative errors and diversity Weight parameters; Evolutionary process: The population is randomly initialized by partitioning the area, and each population is a... The solution is based on The values ​​are repeatedly subjected to selection, crossover, and mutation operations until the maximum number of iterations is reached or the fitness converges. Product: Select the population with the highest fitness over generations, i.e. A combination of samples, as the class Optimal sample combination ; Ultimately, the memory replay library It is constructed as a collection of representative samples of all old classes, storing their original session vectors. and tags : .

[0017] Optionally, step S5 specifically includes: When an unknown sample is detected and manually identified as a new device category If so, then incremental learning will be performed; First, from the memory replay library Extract representative samples from the old class and compare them with the data of the new class. Hybridization to construct incremental training sets ; Secondly, regarding the basic classification model Classification Head Expand the structure and add One output neuron to accommodate To form a new classification head and inherit old parameters As initial values ​​for the parameters of the new model; During the incremental training phase, all parameters of the model are unfrozen and made trainable. To avoid catastrophic forgetting of old knowledge when learning new knowledge, a parameter-regularized hybrid loss function is adopted. right Optimize: in, The new model on the incremental training set Standard cross-entropy loss; It is an L2 parameter regularization term used to constrain new parameters. Keep the old parameters Within the neighborhood, thus preserving old knowledge and reducing catastrophic forgetting; λ It is a hyperparameter that controls the strength of regularization; After training, the results obtained Will cover As the new basic classification model of the system, it enters a standby state, awaiting the next incremental update triggered by human decision-making.

[0018] Optionally, step S6 specifically includes: During the inference phase, the latest parameters of the trained / incrementally updated model are denoted as... It is deployed at the edge; when monitoring online, the session vector Upon arrival, the edge device performs a two-step lightweight identification process: first, Sent into lightweight encoder Compress it into low-dimensional features Secondly, this low-dimensional feature Sent into a lightweight sorting head The probability distribution is calculated. ; The system according to To make a judgment: If If the condition is met, the device is identified as an unknown device, and a caching mechanism is triggered for manual auditing; otherwise, output... As the final identification category.

[0019] On the other hand, an electronic device is provided, the electronic device comprising: processor; The memory stores computer-readable instructions, which, when loaded and executed by the processor, implement the steps of the power equipment fingerprint recognition method based on sample optimization playback incremental learning as described above.

[0020] On the other hand, a computer-readable storage medium is provided, wherein program code is stored in the computer-readable storage medium, and the program code can be called by a processor to execute the steps of the power equipment fingerprint recognition method based on sample optimization playback incremental learning as described above.

[0021] The beneficial effects of the technical solution provided by this invention include at least the following: (1) This invention provides an efficient lightweight model architecture that significantly reduces the computational overhead and inference latency of deploying advanced recognition models on power edge devices. This invention employs an innovative two-stage training and inference mode: First, through unsupervised training of a one-dimensional convolutional autoencoder, the high-dimensional, redundant original session vectors are compressed into low-dimensional, high-information-density feature vectors; then, a simple classification head is trained only on the frozen lightweight encoder. In the final edge inference stage, this two-stage lightweight architecture avoids direct processing of high-dimensional original data, greatly reducing the number of model parameters and computational complexity, enabling low-latency, real-time device recognition on power gateways or switches with extremely low resource consumption.

[0022] (2) This invention constructs a complete incremental learning framework, solving the technical problem that traditional static models cannot adapt to dynamic open network environments and must be retrained costly when encountering new categories. When maintenance personnel manually confirm the need to add new device categories, this invention does not require full data retraining "from scratch". By adopting a hybrid loss function that includes parameter regularization terms, when the model unfreezes all parameters for fine-tuning, its old parameters (especially encoder parameters) are constrained, keeping them within the neighborhood of the original knowledge. This mechanism enables the model to efficiently learn new category features while effectively suppressing catastrophic forgetting of old category knowledge, achieving low-cost, high-efficiency dynamic expansion of the model's recognition capabilities.

[0023] (3) This invention proposes an innovative representative sample replay strategy based on a partitioned genetic algorithm, which solves the common problem of decision boundary drift caused by large sampling bias in traditional replay strategies. In the original session vector space, this invention explicitly divides the old class samples into three structured sample pools: "center," "middle," and "boundary" through distance partitioning; then, using the global optimization capability of the genetic algorithm, with "representativeness" and "diversity" as composite fitness objectives, it selects an optimal, minimally sized memory replay library. This strategy ensures that the replay library retains the typical features of the class and the key boundary samples necessary to maintain separability with extremely low storage overhead, thereby strongly anchoring the decision boundary of the old class in incremental updates and suppressing catastrophic forgetting. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of the fingerprint recognition method for power equipment based on sample optimization and replay incremental learning provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the overall process of the fingerprint recognition method for power equipment based on sample optimization and playback incremental learning provided in the embodiments of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0027] This invention provides a fingerprint recognition method for power equipment based on incremental learning and sample optimization replay. The method consists of two core stages: Stage 1 is the construction of a basic classification model, which uses a convolutional autoencoder to build a lightweight and efficient session feature extractor and train a basic classification model; Stage 2 is incremental learning and updating, which uses a partitioned genetic algorithm to perform efficient sample replay when a new equipment category appears, thereby achieving incremental updates to the model and enabling it to learn to recognize new categories without forgetting old knowledge.

[0028] refer to Figures 1-2 As shown, the processing flow of this method may include the following steps: S1. Collect raw traffic data, aggregate it into session units based on network communication quintuples, and standardize it into session vectors.

[0029] In critical network nodes of the power system (such as communication gateways and aggregation switches), raw traffic data is passively and non-intrusively collected through port mirroring or TAPs (Test Access Points). To construct analysis units with contextual information, this invention aggregates continuous raw traffic data into independent session units based on the network communication quintuple (source IP address, destination IP address, source port number, destination port number, and transport layer protocol).

[0030] To eliminate environmental features unrelated to device fingerprints and standardize model input, each session unit undergoes data cleaning, anonymization (0x00 padding for IP and MAC addresses), and standardization. To adapt to the input requirements of deep learning models, the number and length of data packets in each session unit are analyzed, and the mean and median are calculated. Based on these statistical information, an appropriate truncation length L is selected to form a high-dimensional one-dimensional session vector. , as input to the subsequent model.

[0031] S2. The session vector is trained based on a one-dimensional convolutional autoencoder to minimize the reconstruction loss. The trained encoder and its parameters are retained to obtain a lightweight encoder.

[0032] The core objective of this step is lightweight design. Considering the limited computing power and memory resources of power edge computing devices (such as edge gateways and aggregation switches), this invention first trains a feature compression model, achieving this by employing a one-dimensional convolutional autoencoder (CAE). This one-dimensional convolutional autoencoder consists of an encoder. And a decoder. Composition, its parameters are as follows and .

[0033] Based on the initial known category dataset obtained in step S1 Training a one-dimensional convolutional autoencoder, where For the first i Input session vectors The label for this input session vector. N This represents the number of samples.

[0034] The training objective is to minimize the reconstruction loss. That is, input The output after reconstruction by the encoder and decoder The difference between them is represented by the mean squared error as the loss function during model training: By minimizing the loss function, the encoder Forced to learn how to Compressed into a low-dimensional (dimension 1) ,in However, it retains the key features of the latent space. .

[0035] After training converges, the optimal parameters are obtained. and The present invention retains the encoder and its parameters Discard decoder This results in an efficient and fixed feature extractor, namely a lightweight encoder. It achieves compression from high-dimensional raw data to low-dimensional key features, laying the foundation for subsequent lightweight recognition.

[0036] S3. Freeze encoder parameters, attach and train classification head to form base model, and set a low confidence threshold for subsequent detection of unknown categories.

[0037] This step aims to utilize the lightweight feature extractor obtained in step S2 to construct a system capable of identifying initially known device categories. Basic model On top of this model, an online monitoring mechanism is established to detect devices of known and unknown categories, so as to trigger incremental learning in the future.

[0038] Specifically, freeze the lightweight encoder parameters Add a category header The classification head consists of one or more fully connected layers and a softmax output layer, with parameters denoted as follows: .

[0039] The training process consists of two steps: (1) Feature compression (fixed): using a frozen encoder ,Will Transform into low-dimensional latent space features The encoder parameters It does not participate in gradient updates; (2) Classification (training): Classifying low-dimensional latent space features Input category header To obtain the predicted probability distribution ; The training objective is to minimize the standard cross-entropy loss. In this process, only the parameters of the classification head are optimized. : in It is a sample Category The true label (one-hot encoded).

[0040] After training, a basic classification model is obtained. Its total parameters are ,in It is a fixed compressor. It is a pre-trained classifier.

[0041] Furthermore, in the basic classification model After training, a new category detection mechanism based on a confidence threshold is implemented to automatically trigger the subsequent step—the incremental learning process. A low confidence threshold is set. , , The value can be empirically set based on the Softmax output probability distribution on the validation set. For example, it can be... Set it to a certain percentile of the prediction confidence for all known class samples, or a fixed value, to ensure that the misclassification rate for known classes is at an acceptable low level.

[0042] When the basic classification model Session vector of new input When making a prediction, its Softmax probability distribution is obtained. Calculate the maximum prediction confidence: , Discrimination: When the session vector The maximum prediction confidence level is lower than Then the session vector When an item is marked as an unknown category, the system automatically logs the information and triggers an alarm. Ultimately, this results in a dynamically evolving basic identification system capable of recognizing known categories while also proactively monitoring and reporting unknown categories.

[0043] S4. Partition the old category data, use a genetic algorithm to find the best, and build a representative sample memory playback library.

[0044] In response to the new category The emergence of this technology, and its solution to the "catastrophic forgetting" problem in incremental learning, this invention employs a partitioned genetic algorithm (PGA) for all old categories. Select representative samples and construct a memory replay library The process consists of two steps: (1) Feature extraction and partitioning: Use the initial known category dataset obtained in step S1 ,right Each old class in Calculate its prototype center in the high-dimensional primordial space. That is, all original session vectors of this class Mean: in It is a category The total number of samples; Calculate this class Each original session vector To its class center European distance According to distance All samples of this class from smallest to largest The samples are sorted and divided into three subsets: the central pool, the intermediate pool, and the boundary pool.

[0045] The center pool consists of the 0%-50% of the nearest samples (representing typical characteristics). Intermediate Pool: Samples located between 50% and 70% of the distance; Boundary Pool: The 70%-100% of samples that are furthest away (representing edge and easily confused features).

[0046] (2) Genetic Algorithm (GA) Optimization: For each old class Select the best combination of samples from the three sample pools. This allows it to represent the entire old class to the greatest extent possible. The distribution of .

[0047] A composite fitness function is used. In higher dimensions The assessment is conducted in a space designed to maximize both representativeness and diversity.

[0048] Representative error :measure The mean of the middle sample and the class The real prototype The squared Euclidean distance between them. The smaller this value, the better the representativeness.

[0049] diversity :measure middle The average squared pairwise Euclidean distance between samples. The larger this value, the better the diversity.

[0050] α、β These are the corresponding representative errors and diversity The weight parameters.

[0051] Evolutionary process: The population is randomly initialized by partitioning the area, and each population is a... The solution is based on The values ​​are iterated through to perform selection, crossover, and mutation operations until the maximum number of iterations is reached or the fitness converges.

[0052] Product: Select the population with the highest fitness over generations, i.e. A combination of samples, as the class Optimal sample combination .

[0053] Ultimately, the memory replay library It is constructed as a collection of representative samples of all old classes, storing their original session vectors. and tags : .

[0054] S5. When a new category appears, the representative old samples are mixed with the new samples to construct an incremental training set, the model parameters are unfrozen, and the mixed loss function is used to constrain the model update direction.

[0055] When an unknown sample is detected, it is audited offline by operations and maintenance personnel or domain experts and manually identified as one or more new device categories that require additional identification. Incremental learning will then be performed.

[0056] First, from the memory replay library Extract representative samples from the old class and compare them with the data of the new class. Hybridization to construct incremental training sets ; Secondly, regarding the basic classification model Classification Head (parameter Expand the structure and add... One output neuron to accommodate To form a new classification head and inherit old parameters As initial values ​​for the parameters of the new model; During the incremental training phase, all model parameters (including the encoder) are... and classification head To prevent catastrophic forgetting of old knowledge when learning new knowledge, a parametrically regularized hybrid loss function is employed after all data is unfrozen and made trainable. right Optimize: in, The new model on the incremental training set Standard cross-entropy loss; It is an L2 parameter regularization term used to constrain new parameters. Keep the old parameters Within the neighborhood, thus preserving old knowledge and reducing catastrophic forgetting; λ It is a hyperparameter that controls the strength of regularization; Should The item is penalized by the new parameter. Deviation from old parameters To what extent, this forces the new model parameters to remain within the neighborhood of the old model parameters. This is achieved by minimizing this mixture loss function. This allows the model to efficiently learn new category recognition capabilities while retaining the memory of old categories to the greatest extent possible.

[0057] After training, the results obtained Will cover As the new basic classification model of the system, it enters a standby state, awaiting the next incremental update triggered by human decision-making.

[0058] S6. Deploy the model at the edge. The real-time session vector is inferred in two stages through a lightweight encoder and a classification head, and finally the recognized category is output.

[0059] The ultimate goal of this invention is to perform efficient, lightweight, and dynamically updatable device identification tasks on power edge devices with limited computing power.

[0060] During the inference phase, the latest parameters of the trained / incrementally updated model are denoted as... It is deployed at the edge; when monitoring online, the session vector Upon arrival, the edge device performs a two-step lightweight identification process: first, Sent into lightweight encoder Compress it into low-dimensional features Secondly, this low-dimensional feature Sent into a lightweight sorting head The probability distribution is calculated. .

[0061] Finally, the system according to To make a judgment: If If the condition is met, the device is identified as an unknown device, and a caching mechanism is triggered for manual auditing; otherwise, output... This scheme uses CAE compression to achieve lightweight deployment at the edge, and employs PGA and parameter regularization to achieve manually controlled incremental learning of new categories, thus solving the problem of model iteration in dynamic environments.

[0062] Compared with existing technologies, this invention has the following advantages: it provides an efficient and lightweight model architecture to achieve fast and low-resource-consumption feature compression and classification of session-level network traffic; it constructs an incremental learning framework that enables the model to dynamically expand its ability to identify new device categories without forgetting old knowledge; and it proposes an efficient representative sample optimization strategy to ensure that the selected sample set is both representative and diverse, thereby maintaining the feature distribution of old categories to the greatest extent with extremely low storage overhead and suppressing catastrophic forgetting.

[0063] In an exemplary embodiment, the present invention also provides an electronic device, the electronic device comprising: processor; The memory stores computer-readable instructions, which, when loaded and executed by the processor, implement the steps of the power equipment fingerprint recognition method based on sample optimization playback incremental learning as described above.

[0064] In an exemplary embodiment, the present invention also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the steps of the power equipment fingerprint recognition method based on sample-optimized playback incremental learning as described above. For example, the computer-readable storage medium may be a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, or optical data storage device, etc.

[0065] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Unless otherwise specified, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0066] The use of terms such as "an embodiment," "an embodiment," "an exemplary embodiment," and "some embodiments" in the specification indicates that the described embodiment may include a specific feature, structure, or characteristic, but not every embodiment necessarily includes that specific feature, structure, or characteristic. Furthermore, when a specific feature, structure, or characteristic is described in connection with an embodiment, implementing such a feature, structure, or characteristic in conjunction with other embodiments (whether explicitly described or not) should be within the knowledge of those skilled in the art.

[0067] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0068] In the embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0069] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0070] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0071] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0072] This invention encompasses any substitutions, modifications, equivalent methods, and solutions made within the spirit and scope of this invention. To provide the public with a thorough understanding of this invention, specific details are described in detail in the following preferred embodiments; however, those skilled in the art will fully understand the invention even without these details. Furthermore, to avoid unnecessary misunderstanding of the essence of this invention, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0073] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A fingerprint recognition method for power equipment based on sample optimization and replay incremental learning, characterized in that, Includes the following steps: S1. Collect raw traffic data, aggregate it into session units based on network communication quintuples, and standardize it into session vectors; S2. Train the session vector based on a one-dimensional convolutional autoencoder to minimize the reconstruction loss, retain the trained encoder and its parameters, and obtain a lightweight encoder. S3. Freeze encoder parameters, attach and train classification head to form a base model, and set a low confidence threshold for subsequent detection of unknown categories; S4. Partition the old category data, use a genetic algorithm to find the best, and build a representative sample memory replay library; S5. When a new category appears, the representative old samples are mixed with the new samples to construct an incremental training set, the model parameters are unfrozen, and the mixed loss function is used to constrain the model update direction. S6. Deploy the model at the edge. The real-time session vector is inferred in two stages through a lightweight encoder and a classification head, and finally the recognized category is output.

2. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 1, characterized in that, Step S1 specifically includes: Raw traffic data is passively and non-intrusively collected at key network nodes in the power system via port mirroring or TAPs; these key network nodes include communication gateways and aggregation switches. The network communication quintuple aggregates continuous raw traffic data into independent session units. The network communication quintuple includes source IP address, destination IP address, source port number, destination port number, and transport layer protocol. For each session unit, data cleaning, anonymization, and standardization are performed. The number and length of data packets in each session unit are analyzed, and the mean and median are calculated. Based on these two statistical parameters, an appropriate truncation length L is selected to form a high-dimensional one-dimensional session vector. , which serves as the input for subsequent models.

3. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 1, characterized in that, Step S2 specifically includes: Construct a one-dimensional convolutional autoencoder, which consists of an encoder. and a decoder Composition, its parameters are as follows and ; Based on the initial known category dataset obtained in step S1 Training a one-dimensional convolutional autoencoder, where For the first i One input session vector, The label for this input session vector. N The number of samples; The training objective is to minimize the reconstruction loss. That is, input The output after reconstruction by the encoder and decoder The difference between them is represented by the mean squared error as the loss function during model training: By minimizing the loss function, the encoder Will Compressed into a low-dimensional latent space feature ; After training converges, the optimal parameters are obtained. and Retain encoder and its parameters Discard decoder A lightweight encoder was obtained. .

4. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 1, characterized in that, Step S3 specifically includes: Freeze Lightweight Encoder parameters Add a category header Its parameters are denoted as ; The training process consists of two steps: (1) Feature compression: using a frozen encoder ,Will Transform into low-dimensional latent space features The encoder parameters It does not participate in gradient updates; (2) Classification: low-dimensional latent space features Input category header To obtain the predicted probability distribution ; The training objective is to minimize the standard cross-entropy loss. In this process, only the parameters of the classification head are optimized. : in It is a sample Category The true label; After training, a basic classification model is obtained. Its total parameters are ,in It is a fixed compressor. It is a pre-trained classifier.

5. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 4, characterized in that, Step S3 further includes: In the basic classification model After training, set a low confidence threshold. , ; When the basic classification model Session vector of new input When making a prediction, its Softmax probability distribution is obtained. ; Calculate the maximum prediction confidence: , Discrimination: When the session vector The maximum prediction confidence level is lower than Then the session vector If a data point is marked as an unknown category, the system will automatically record log information and trigger an alarm.

6. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 1, characterized in that, Step S4 specifically includes: In response to the new category The emergence of this algorithm employs a partitioned genetic algorithm for all old categories. Select representative samples and construct a memory replay library The process consists of two steps: (1) Feature extraction and partitioning: Use the initial known category dataset obtained in step S1 ,right Each old class in Calculate its prototype center in the high-dimensional primordial space. That is, all original session vectors of this class Mean: in It is a category The total number of samples; Calculate this class Each original session vector To its class center European distance According to distance All samples of this class from smallest to largest The samples are sorted and the sample pool is divided into three subsets: the central pool, the intermediate pool, and the boundary pool. (2) Optimization using genetic algorithms: For each old class Select the best combination of samples from the three sample pools. This allows it to represent the entire old class to the greatest extent possible. Distribution; Use a composite fitness function : Representative error :measure The mean of the middle sample and the class The real prototype The squared Euclidean distance between them; the smaller this value, the better the representativeness; diversity :measure middle The average squared pairwise Euclidean distance between samples; the larger this value, the better the diversity. α、β These are the corresponding representative errors and diversity Weight parameters; Evolutionary process: The population is randomly initialized by partitioning the area, and each population is a... The solution is based on The values ​​are repeatedly subjected to selection, crossover, and mutation operations until the maximum number of iterations is reached or the fitness converges. Product: Select the population with the highest fitness over generations, i.e. A combination of samples, as the class Optimal sample combination ; Ultimately, the memory replay library It is constructed as a collection of representative samples of all old classes, storing their original session vectors. and tags : 。 7. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 1, characterized in that, Step S5 specifically includes: When an unknown sample is detected and manually identified as a new device category If so, then incremental learning will be performed; First, from the memory replay library Extract representative samples from the old class and compare them with the data of the new class. Hybridization to construct incremental training sets ; Secondly, regarding the basic classification model Classification Head Expand the structure and add One output neuron to accommodate To form a new classification head and inherit old parameters As initial values ​​for the parameters of the new model; During the incremental training phase, all parameters of the model are unfrozen and made trainable. To avoid catastrophic forgetting of old knowledge when learning new knowledge, a parameter-regularized hybrid loss function is adopted. right Optimize: in, The new model on the incremental training set Standard cross-entropy loss; It is an L2 parameter regularization term used to constrain new parameters. Keep the old parameters Within the neighborhood, thus preserving old knowledge and reducing catastrophic forgetting; λ It is a hyperparameter that controls the strength of regularization; After training, the results obtained Will cover As the new basic classification model of the system, it enters a standby state, awaiting the next incremental update triggered by human decision-making.

8. The fingerprint recognition method for power equipment based on sample optimization and replay incremental learning according to claim 1, characterized in that, Step S6 specifically includes: During the inference phase, the latest parameters of the trained / incrementally updated model are denoted as... It is deployed at the edge; when monitoring online, the session vector Upon arrival, the edge device performs a two-step lightweight identification process: first, Sent into lightweight encoder Compress it into low-dimensional features Secondly, this low-dimensional feature Sent into a lightweight sorting head The probability distribution is calculated. ; The system according to To make a judgment: If If the condition is met, the device is identified as an unknown device, and a caching mechanism is triggered for manual auditing; otherwise, output... As the final identification category.

9. An electronic device, characterized in that, The electronic device includes: processor; A memory storing computer-readable instructions that, when loaded and executed by the processor, implement the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program code that can be invoked by a processor to perform the method as described in any one of claims 1 to 8.

Images