Novel power system cyber attack vector normalization optimization method based on semantic explainability

Abstract

The application discloses a novel power system network attack vector normalization optimization method based on semantic explainability. The method aims to process unstructured network logs and intrusion data of the novel power system. First, semantic restoration and normalization processing are performed on the unstructured data to restore the missing semantic information in the attack description and eliminate expression ambiguity. Then, attack semantic elements are extracted through deep semantic analysis to construct an explainable attack vector graph representing the attack causality. Then, the attack vector graph is projected into a predefined normalized semantic space and associated with structured vulnerability knowledge. Finally, a structured and machine-readable normalized attack vector model is generated. Through explainable graph construction and semantic projection, the application realizes transparent mapping from unstructured logs to normalized attack models, overcomes the semantic gap and black box model problems in traditional methods, and provides verifiable attack vector definition and analysis capabilities for power system network security.

Description

Technical Field

[0001] This invention belongs to the field of new power system network security technology, specifically involving a semantic analysis, knowledge modeling and paradigmatic expression method for network attack information, which is particularly suitable for extracting, defining and constructing interpretable attack vector models from unstructured security logs. Background Technology

[0002] The deep integration of information technology and physical systems in new power systems has led to increasingly blurred network boundaries and a constantly expanding attack surface. Security data such as network logs and intrusion detection system alerts are core sources of threat perception. However, this data is highly heterogeneous, massive, and unstructured. It often exists in the form of natural language descriptions, filled with obscure references, missing context, and inconsistent terminology.

[0003] Current security analysis methods, such as those based on keyword matching or traditional statistical models, struggle to deeply understand the true semantics of unstructured text. These methods typically only identify isolated threat indicators and cannot reconstruct the attacker's complete, multi-step attack chain. Furthermore, many machine learning-based detection models are like black boxes, lacking transparency and interpretability in their decision-making processes. When a model issues an alert, security operations personnel often struggle to understand the specific attack logic and causal relationships behind the alert, significantly hindering timely incident response and accurate attack attribution.

[0004] Therefore, there is an urgent need for a new technical approach that can automatically and interpretably extract attack semantics from unstructured power system network logs and construct them into a structured, machine-readable, paradigmatic attack vector model to achieve a deep understanding of network threats and efficient defense. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of existing technologies in terms of insufficient analysis of unstructured logs and lack of interpretability, and to provide a novel power system network attack vector paradigm optimization method based on semantic interpretability.

[0006] The technical solution adopted in this invention is a novel power system network attack vector paradigm optimization method based on semantically interpretable methods, comprising the following steps:

[0007] Step 1: Construct a power system-specific knowledge base. First, define the vulnerability ontology and standardize the core entities and relationships. Then, map the structured power system-specific vulnerability database and the communication protocol security baseline onto this ontology to construct a reference knowledge graph as the target space for cross-source alignment.

[0008] Step 2: Obtain unstructured network data from the new power system. This data includes power system network logs, intrusion detection records, or device communication data.

[0009] Step 3: Perform semantic restoration and normalization processing on the unstructured network data. This step aims to recover the missing semantic information in the attack description and eliminate ambiguity, outputting semantically complete normalized text.

[0010] Step 4: Perform deep semantic analysis on the normalized text and extract attack semantic elements. These elements include, but are not limited to, attacker, attack method, attack target, affected power system components, or attack impact.

[0011] Step 5: Based on the extracted semantic elements and their interrelationships, construct an interpretable attack vector graph. The graph explicitly represents the causal logic of the attack in the form of nodes and edges, and all nodes and edges of the graph retain source evidence of the specific text in the original data.

[0012] Step 6: Project the interpretable attack vector graph onto a predefined paradigmatic semantic space, and perform interpretable mapping and similarity calculation with the power system-specific knowledge base constructed in Step 1, thereby generating a structured paradigmatic attack vector model.

[0013] Step one: Construct a power system-specific knowledge base. This step forms the data and semantic foundation of the entire methodology, providing a target space for subsequent cross-source alignment. This step specifically includes:

[0014] Step 1.1, Vulnerability Ontology Definition. For the novel power system cybersecurity scenario, a vulnerability ontology is defined to standardize core entities, such as power system components, communication protocols, attack methods, vulnerability types, and their interrelationships, providing semantic support for consistent knowledge representation. The ontology is defined as a quintuple: , in Represents a set of concept categories. Represents a set of attributes. Represents a set of relationships between classes. This represents the set of logical constraints used for reasoning. This represents a set of instances corresponding to specific vulnerability data. Each entity category... Associate an attribute vector Each relationship Describe entity and Directed semantic connections between them. Logical constraints. Define allowed combinations of relations and attributes to ensure semantic consistency in graph construction. The relation layer of the ontology defines how entities interact. Four main relations are designed to cover the most common patterns of vulnerability propagation and dependencies:

[0015] Belongs to (SV, SP): Connects the vendor with its software products;

[0016] Impact (SP, VU): Indicates the products affected by the vulnerability;

[0017] Includes (VT, VU): Associates a vulnerability with its abstract type category;

[0018] Exploitation (VU, AM): Connects the vulnerability to its exploitation method.

[0019] To extract these ontology entities from structured data, this invention employs an entity extraction algorithm. This algorithm summarizes the entity extraction process from preprocessed text to ontology-compatible triples, specifically including:

[0020] Calculate word embeddings: First, the process receives a preprocessed sequence of sentences. As input, for each token in the sequence. Calculate the corresponding continuous bag-of-words model embedding vector for each. .

[0021] Context encoding: embedding the word vector sequence generated in the previous step The input is encoded into a Bidirectional Long Short-Term Memory (BiLSTM) network to obtain a hidden state vector that incorporates contextual information. .

[0022] Calculate the score based on the context vector output by the BiLSTM. Calculate the emission score required for the Conditional Random Field (CRF) layer. and transfer score .

[0023] Sequence Decoding: A CRF decoding layer is applied, and the Viterbi algorithm is used to calculate and decode the highest probability, optimal tag sequence. .

[0024] Entity mapping: the decoded tag sequence The identified entities strictly follow the predefined vulnerability ontology. Mapped to the corresponding ontology class and properties.

[0025] Output: Finally, a collection containing all mapped entities is returned. This completes the entire process of extracting the vulnerable entity.

[0026] Step 1.2, Knowledge Base Data Mapping. Obtain a structured power system-specific vulnerability database and communication protocol security baseline data.

[0027] To transform unstructured vulnerability description text (such as descriptions in CNVD or NVD) into structured data conforming to the above ontology, this invention employs a hybrid neural sequence annotation model, CBOW-BiLSTM-CRF. This model consists of three layers:

[0028] Embedding Layer (CBOW): Utilizes the Continuous Bag-of-Words (CBOW) model to capture domain-level co-occurrence statistics. Given a context window... Each word element The vector representation is the average of the surrounding word vectors, which allows semantically related tags to cluster in the vector space, enhancing interpretability.

[0029] Context Encoding Layer (BiLSTM): Uses a bidirectional long short-term memory network to capture long-range dependencies. It involves concatenating the forward and backward hidden states. It effectively encodes the syntactic cues required for entity boundary detection.

[0030] Decoding Layer (CRF): Uses Conditional Random Fields (CRF) to decode the most likely label sequence. The CRF layer learns the state transition matrix. This ensures that the output label sequence is logically valid.

[0031] To address the issue of inconsistent names for the same entity across different sources, this invention employs entity lexical normalization and synonym alignment. Entity names are standardized, and the cosine similarity between word embedding vectors is used to calculate the semantic similarity between candidate entities.

[0032]

[0033] It is a physical entity and entity The semantic similarity score between them. and : are entities and The embedding vector representation. and : are vectors and The similarity exceeds a preset threshold, for example... The entities will be merged into a unified standard node.

[0034] A rule-based fusion strategy is adopted to address the problem of inconsistent or incomplete information provided by different data sources for the same attribute of the same entity:

[0035] Time field: Use the earliest available date.

[0036] Category attributes: Unified by majority voting.

[0037] Text description: Concatenation is performed after redundancy is removed.

[0038] Numerical attributes: A weighted average method based on source credibility weights is used, referencing the formula:

[0039]

[0040] in, This represents the final attribute value after fusion. Indicates that it comes from a data source. The attribute value, Indicates assignment to the data source Credibility weight, This indicates the total number of data sources that provide this property.

[0041] Finally, relations are merged, aligned, and combined to describe relationships connecting the same facts. First, relations extracted from different sources are standardized to predicates already defined in the ontology, such as *belong*, *influence*, *include*, and *utilize*. If multiple relations have identical head-tail entity pairs, these duplicate or semantically equivalent relations are merged into one. A source set is maintained for each merged relation. This is to record all original data sources and ensure traceability.

[0042] Step 1.3, Reference Knowledge Graph Construction. The structured data from Step 1.2 is mapped and fused strictly according to the ontology defined in Step 1.1 to construct a unified, machine-readable reference knowledge graph. This knowledge graph is preferably stored in a graph database to facilitate subsequent queries, visualization, and efficient subgraph similarity calculation. This step fuses multi-source heterogeneous data into a unified standard knowledge graph through ontology mapping, eliminating semantic silos, constructing a cross-source aligned target space, and utilizing graph storage to support efficient association calculations, significantly improving the accuracy and interpretability of attack analysis. Using word embedding cosine similarity calculation and entity alignment techniques from Step 1.2, synonyms from different sources are merged into a single standard node. It resolves attribute conflicts (such as inconsistent descriptions of the same vulnerability from different sources), cleanses data through weighted averaging and majority voting mechanisms, and connects unstructured logs with structured vulnerability knowledge through ontology (quintuples).

[0043] Step 2: Obtain unstructured network data for the novel power system. This step is the starting point for the method's initial data input. Specifically, this step includes:

[0044] Step 2.1, Data Source Identification and Interface Configuration. This step first requires identifying the specific source of the unstructured data. Identify and locate the servers, devices, or systems storing power system network logs, intrusion detection records, and equipment communication data, such as SCADA log servers, IDS / IPS devices, RTU communication loggers, etc. Then, configure the corresponding acquisition interfaces, such as Syslog forwarding, database connections, API calls, or file directory monitoring.

[0045] Step 2.2, Multi-Source Data Aggregation. Initiate the data collection task to centralize heterogeneous data from different sources. Use the interface configured in Step 2.1 to pull or receive data in real-time or in batches. Aggregate data from multiple sources with different formats into a unified data pool or message queue to prepare for subsequent processing. This stage only handles aggregation and does not change the unstructured nature of the data.

[0046] Step 2.3, Data Stream Supply. The aggregated raw data stream is supplied to the analysis module in sequence. The raw, unstructured data stream aggregated in Step 2.2 is organized in chronological order and used as input to the semantic restoration and normalization processing module in the subsequent Step 3 of this invention for actual semantic analysis.

[0047] Step 2.3's advantage lies in its strict temporal organization, breaking the limitations of traditional methods for processing isolated logs. It provides the necessary temporal logic foundation for subsequent reconstruction of multi-step attack chains and acts as a dedicated pipeline, transforming raw data into a semantically relevant stream, enabling in-depth analysis through the semantic reconstruction module. This step emphasizes organizing the aggregated raw data stream in chronological order, a necessary prerequisite for constructing causal logic and attack vector graphs (Step 5). Only by strictly sorting by time can subsequent semantic analysis accurately determine the sequence of actions, thus connecting discrete logs into a coherent story. Traditional methods typically treat logs as static text for keyword matching, lacking an understanding of contextual flow. This step not only transmits data but also supplies it as input for genuine semantic analysis to the semantic reconstruction module (Step 3). It provides a contextual environment for solving complex natural language problems (such as cross-sentence reference resolution and missing subject completion). This streaming supply mechanism ensures that the analysis module can process logs like natural language conversations, rather than fragmented words.

[0048] Step 3: Perform semantic restoration and normalization processing on the unstructured network data. This step aims to recover the missing semantic information in the attack description and eliminate ambiguity, outputting semantically complete normalized text. This step specifically includes:

[0049] Step 3.1, missing subject restoration, that is, using syntactic dependency analysis to restore the logical subject in the context of predicate verbs that are missing a subject in the text; first, perform syntactic analysis on the input sentence to generate its dependency tree. Then, the system uses predefined dependency templates to check the verbs in the sentence. Is a grammatical subject missing?

[0050] If a subject is found to be missing, the system will copy the corresponding subject from the context and insert it into the current sentence to restore its complete meaning. The relevant formula expression logic is as follows:

[0051] (when (When the subject is missing)

[0052] Indicates verb The subject that should be bound. This indicates the verb being analyzed in the current sentence. It indicates a known subject derived from the preceding context.

[0053] Step 3.2, Pronoun Reference Resolution: A pronoun reference resolution model is used to resolve pronoun references in the text, replacing them with their corresponding concrete entities. This step addresses the issue of ambiguous pronoun references in the text, ensuring entity consistency throughout the description. A neural coreference engine is employed as the pronoun reference resolution model. The model reads text containing pronouns. Sentences And predict the specific antecedent that the pronoun refers to. Then use replace The relevant formulas are as follows:

[0054]

[0055] This indicates a new sentence with clearer meaning after the referential analysis. This represents the original input sentence; The representative refers to the resolution model; In the sentence Pronouns detected in the text; Representation Model Predicted, pronoun The antecedent that it actually points to; This indicates that a replacement operation will be performed.

[0056] Step 3.3, Redundancy Removal, involves using lexical pattern matching to remove repetitive modifiers or auxiliary phrases, thus simplifying the text while preserving the core attack semantics. Following subject recovery and referential parsing, this step simplifies the text, removing interfering redundant information and retaining the core attack semantics. This step employs a rule-based approach based on lexical pattern pruning. It analyzes the part-of-speech sequence of the sentence. It also finds and removes duplicate modifiers, auxiliary phrases, or conditional clauses based on predefined rule templates.

[0057] Step 4: Perform deep semantic analysis on the normalized text and extract attack semantic elements. This step extracts the core semantic components constituting the attack behavior based on the normalized text output in Step 3. This invention uses a BERT-BiLSTM joint model to simultaneously complete two tasks:

[0058] Step 4.1, Semantic Role Labeling. The normalized text is analyzed using a sequence labeling model to automatically label key semantic roles. This identifies key elements within the sentence.

[0059] Model input: word embeddings of a normalized sentence .

[0060] Processing: Obtain the hidden state through BiLSTM encoding. .

[0061] Output: Through linear layers The lexical tokens are labeled as Actor, Method, Target, or Effect.

[0062] Step 4.2, Attack Behavior Classification. The behaviors described in the normalized text are classified and mapped to a predefined attack stage classification system. This step is based on an understanding of all lexical units in the sentence. Based on this, the functions of the entire sentence are classified.

[0063] Calculate sentence vectors using attention mechanisms ,in It is the attention weight, which can highlight the keywords that contribute the most to the classification, thereby providing interpretability of the model.

[0064] Step 4.2 utilizes an attention mechanism to enhance the model's interpretability, highlighting key decision words to clarify the basis for judgment. Simultaneously, semantic aggregation based on the entire sentence's context enables accurate identification of the attack phase, avoiding the contextual ambiguity of simple keyword matching.

[0065] Existing technical challenges: Many deep learning-based detection models (such as traditional CNNs or RNNs) are highly accurate, but they are typically black-box models. When a model determines that a log entry is an attack, security operations personnel cannot know which words in the log the model used to make the judgment, resulting in low trust levels and difficulty in identifying false positives.

[0066] Step 4.2 introduces an attention mechanism that scores each word in a sentence by calculating attention weights.

[0067] The system can highlight the keywords that contribute most to the classification decision. This allows operations and maintenance personnel not only to know that it is an attack, but also to intuitively see why it is an attack, greatly improving the interpretability and transparency of the model.

[0068] Traditional methods (such as keyword regular expression matching) or simple bag-of-words models ignore word order and context, which can easily lead to ambiguity. Step 4.2 is based on the understanding that "all lexical units in a sentence are context embedding vectors processed by a bidirectional long short-term memory network (BiLSTM), which contain contextual information."

[0069] By weighted summing of these vectors, the model classifies the core semantic functions of the entire sentence, rather than looking at words in isolation.

[0070] Results: It can accurately distinguish complex contexts and precisely map behaviors to a predefined attack phase classification system, rather than simply labeling them as anomalies.

[0071] Step 5: Based on the extracted semantic elements and their interrelationships, construct an interpretable attack vector graph. This step organizes the scattered semantic elements extracted in Step 4 into a trace graph representing the attack logic. Specifically, this step includes:

[0072] Step 5.1, Graph Node Definition. The attack semantic elements are used as nodes in the graph. All elements identified in Step 4, such as attackers, malicious scripts, execution, and servers, are created as independent nodes in the graph. The node set of the entire graph It is the set of all these nodes.

[0073] Step 5.2, Graph Edge Definition. The semantic relationships, causal relationships, or temporal relationships between the semantic elements are used as edges in the graph. Directed edges are established between nodes based on the analyzed semantic roles and dependencies. The relevant formulas are as follows:

[0074]

[0075] From node Pointing to node One of the edges. The relational predicate representing this edge. : Represents a node The semantic type.

[0076]

[0077] The final, complete tracking graph representing the entire log or report. From a single sentence The sentence-level subgraphs extracted from it. This represents the union operation, which merges the subgraphs of all sentences into a larger graph.

[0078] Step 5.3, preservation of textual source evidence. This includes a graph. Each node in (Even including the edges) Each of these stores retains a pointer to its source text or metadata. This pointer is represented by a tuple. Stored in the form of . It is a node in the graph. It is this node The index number of the original sentence from the source. It is this node In the original sentence By identifying the specific character range corresponding to the source, security analysts can clearly verify which specific record in the original log the element in the final attack vector graph originates from, making the entire analysis process transparent and verifiable.

[0079] Compared to traditional black-box models that only provide results without detailing the process, step 5.3 achieves precise backtracking from the abstract attack graph to the character-level of the original logs by retaining the quintuple. This ensures that every element in the graph is verifiable, eliminating the risk of model illusion and significantly improving the credibility of the analysis results and the efficiency of forensic investigation. Existing technical pain points: Many deep learning-based threat detection systems are black-box models, only outputting the judgment of anomalies or attacks without informing users of the specific information upon which the judgment was based. This system achieves character-level precision, recording the specific character range. This means the system can not only find which log entry but also precisely highlight which words within the log, greatly shortening forensic investigation time and allowing security analysts to instantly pinpoint the subtle traces left by the attack without having to manually search through massive amounts of logs. It constructs a two-way channel from the abstract graph to the underlying data, ensuring a strong binding relationship between high-level semantic analysis and low-level textual evidence. This mechanism makes the generated model not only a machine-readable logical structure but also a human-examined chain of evidence.

[0080] Step 6: Project the interpretable attack vector graph onto a predefined paradigmatic semantic space and perform interpretable mapping to generate a paradigmatic attack vector model. This step aims to bridge the semantic gap between the narrative graph in Step 5 and the structured knowledge base in Step 1. Specifically, this step includes:

[0081] Step 6.1, Semantic Space Definition. This involves pre-defining a paradigmatic semantic space composed of core semantic triples, which preferably include (affected power system components, attack methods, security protocol baselines, or vulnerability types). This step prepares for subsequent comparisons and mappings.

[0082] Step 6.2, Semantic Projection. This involves projecting the interpretable attack vector map (...). This is summarized and refined into a set of standardized attack vector facts that conform to the aforementioned paradigmatic semantic space. This step performs a translation action, transforming the narrative graph from unstructured logs into standardized facts.

[0083] Mapping Entities: Entities marked as executable files or power equipment modules in the graph are mapped to affected power system components.

[0084] Mapping Actions: Map actions represented in the diagram as exploitation, injection, or permission modification to attack methods.

[0085] Mapping Impact: Nodes in the diagram representing impacts such as remote code execution and data breaches are mapped to vulnerability types or violated security protocol baselines. The relevant formulas are as follows:

[0086]

[0087] in This represents an interpretable attack vector graph constructed from the logs. This represents the projected set of attack vector facts consisting of standardized triples. A mapping function representing semantic projection.

[0088] Step 6.3, Model Generation. This involves calculating the graph similarity between the standardized attack vector facts and the power system-specific knowledge base, and storing the matching results to generate the final paradigmatized attack vector model. This step quantitatively compares the attack vector facts from the logs and the fact subgraph from the knowledge base in a shared semantic space.

[0089] Node-level similarity calculation: Calculate two triples (one from the log) A source from a knowledge base The similarity between [words] combines semantic similarity and lexical similarity. The relevant formula is as follows:

[0090]

[0091] in There are two triples. and Similarity score between them. It is a weight parameter between [0,1]. It is the context embedding vector of the node text in the triple. and Cosine similarity between them. It is the set of ontology terms corresponding to the nodes in the triple. and Jaccard similarity between them.

[0092] Graph-level similarity calculation: Aggregate the similarity scores of all triples to calculate the entire attack vector graph. ) and knowledge base subgraph ( Overall similarity between The relevant formulas are as follows:

[0093]

[0094] in It is the final overall similarity score between the attack graph and the knowledge base subgraph. The best matching triplet pair was determined by the optimal binary matching algorithm. A set of. and These represent the total number of triples in the attack graph and the knowledge base subgraph, respectively, and are used to normalize the score.

[0095] Step 6.3, Model Generation: Based on the calculated overall similarity All entries in the knowledge base are sorted. The knowledge base entry with the highest score that exceeds a preset threshold is linked to the current log graph. This linking relationship, along with the linked knowledge base entries, constitutes the final output paradigmized attack vector model.

[0096] Step 6.3 achieves automated and precise alignment of attack logs with standard vulnerability databases by calculating graph-level similarity. It transforms isolated attack clues into standardized models with quantified confidence scores, significantly improving the accuracy of attack attribution and the speed of defense response. Through a linking mechanism, the log graph generated on-site is directly mounted to standard entries in the power system's dedicated knowledge base. The final output model is no longer an isolated log fragment but is explicitly defined as an instance of a specific known vulnerability. This standardizes attack descriptions, making it clear to both machines and humans what kind of attack it is. The graph-level similarity calculation does not compare individual words but uses an optimal binary matching algorithm to aggregate the scores of all triples. It integrates semantic and lexical similarity, so even if the log wording is not standardized, as long as the attack's structural logic is similar to the knowledge base, the system can still accurately identify it. A specific overall similarity score is calculated, and a preset threshold is set; only sufficiently high scores are considered a match. This not only filters out low-quality false positives but also provides security analysts with a quantified confidence index to assist in decision-making.

[0097] Compared with existing technologies, the present invention, based on a novel semantically interpretable power system network attack vector paradigm optimization method, has the following significant advantages:

[0098] 1. Efficient Fusion and Uncertainty Management of Multi-Source Heterogeneous Data: This invention addresses the challenges of dispersed and heterogeneous power system security data sources by introducing an event correlation mechanism based on Dempster-Shafer evidence theory. This mechanism not only effectively integrates fragmented information from different components such as IDS, firewalls, and SCADA logs, but also enables robust reasoning even when data conflicts or incompleteness exist. By quantifying the trust level of evidence, this method significantly improves the system's perception capability in complex network environments, overcoming the limitations of traditional single-source detection methods, such as limited scope and high false alarm rates.

[0099] 2. Precise reconstruction and pattern recognition of the entire attack process: Unlike traditional methods that only focus on isolated alerts, this invention constructs a dynamic attack sequence diagram and applies kill chain mapping technology to string discrete events into a coherent sequence of attack behaviors. This not only achieves accurate matching of known attack patterns but also completely reconstructs the attacker's penetration path, lateral movement, and final target. This panoramic attack situation awareness capability solves the problem of existing technologies lacking a comprehensive description of the attack, providing security personnel with a deep analytical perspective.

[0100] 3. This invention innovatively introduces a semantically interpretable framework to achieve semantic interpretability and transparency in the attack model. Through semantic deconstruction (SDR / PRR / ERR) and attack vector graph construction, the obscure underlying logs are transformed into an intuitive and standardized attack vector model. Each identified attack step can be traced back to the original textual evidence, making the reasons for the attack and the attack logic transparent and verifiable. This interpretability eliminates the lack of transparency in the decision-making of "black box" models, greatly enhancing the trust of operations and maintenance personnel in the system.

[0101] 4. Providing precise intelligence support for proactive defense decisions: By constructing a structured threat information database, this method provides a scientific basis for power system defense decisions. It not only supports real-time threat level assessment but also lays a solid data foundation for developing targeted mitigation measures, emergency responses, and recovery plans, effectively improving the resilience and response efficiency of power systems against advanced persistent threats (APTs). Attached Figure Description

[0102] Figure 1 This is a flowchart of a novel power system network attack vector paradigm optimization method based on semantically interpretable principles. Detailed Implementation

[0103] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0104] Implementation Examples

[0105] This embodiment constructs a prototype system for the paradigmatic definition of power system network attack vectors based on semantically interpretable methods, and verifies it using real network threat data. This embodiment aims to demonstrate how to extract semantics from unstructured power system logs, construct an attack vector graph, and associate it with a structured vulnerability knowledge base to ultimately generate a paradigmatic attack model.

[0106] In this embodiment, the prototype system's hardware environment is configured as follows: an Intel Core i5-1135G7 @ 2.4 GHz processor, 16 GB LPDDR4 memory; and a high-performance server environment: an Intel Xeon E5-2683 v4 @ 2.00 GHz, 314 GB DDR4 memory, and an NVIDIA GeForce GTX 1080Ti graphics card. The software environment includes: the operating system CentOS 7, the programming language Python 3.7, the deep learning framework PyTorch 1.8.0, the graph database Neo4jCommunity 3.5.0, and the natural language processing toolkits SpaCy and NLTK.

[0107] Step 1: Build a dedicated knowledge base for the power system

[0108] As the target space for cross-source alignment, this embodiment first constructs a reference knowledge graph containing rich vulnerability knowledge.

[0109] Data source: 66,385 structured vulnerability entries were collected from the National Vulnerability Database (NVD) and the power system-specific vulnerability database, covering nine major categories of typical vulnerabilities such as buffer overflow, SQL injection, and cross-site scripting, serving as the basic database of potential vulnerabilities in the power system.

[0110] Table 1: Distribution of Power System-Specific Vulnerability Database Entries by Vulnerability Type

[0111]

[0112] Entities and Relationships: Defines an ontology structure that includes vulnerabilities (VU), vulnerability types (VT), software products (SP), attack methods (AM), and software vendors (SV).

[0113] Training Data Construction: To train the entity extraction model, a corpus containing 18,372 vulnerability text descriptions was constructed. Of these, 10,000 were used to train the CBOW embedding dictionary, and 8,372 were meticulously manually annotated following the BIOES format. The dataset was divided into training, validation, and test sets in a 7:1:2 ratio.

[0114] Step 2: Obtain unstructured network data of the new power system

[0115] This embodiment collected 263 unstructured network security reports as input for simulated power system network logs and intrusion detection records. These data sources included GDataSoftware, TrendMicro, and Microsoft Security Intelligence, covering a variety of heterogeneous narrative styles and technical details, thus fully testing the invention's ability to process unstructured data.

[0116] Step 3, semantic restoration and normalization processing

[0117] To address common issues in power system logs such as missing subjects, ambiguous referents, and redundant expressions, this embodiment employs the SDR-PRR-ERR process. Taking the WHRAT attack log as an example, the original 102 sentences are compressed and normalized into 35 core semantic sentences after processing. Through this process, implicit information in the log, such as omitted attack source IPs, is completed, pronouns are parsed into specific entities, and redundant descriptive text is removed, thus providing high-quality input for subsequent analysis.

[0118] The table below shows the changes in the number of sentences from different data sources after this step, validating the effectiveness of the summarization and normalization processes:

[0119] Table 2: Comparison of sentence extraction using topic classification and summary

[0120]

[0121] As shown in Table 2, the method of the present invention can significantly compress text length with an average retention rate of about 20%, while preserving the core attack semantics.

[0122] Step 4: Perform deep semantic analysis on the normalized text and extract attack semantic elements.

[0123] Based on standardized text, this embodiment uses a hybrid neural network model for feature extraction.

[0124] Model parameter settings:

[0125] CBOW-BiLSTM-CRF model (for entity extraction): CBOW word vector dimension is set to 100, BiLSTM hidden unit is set to 100, Dropout rate is 0.5, learning rate is 0.001, batch size is 64, and training epochs are 30.

[0126] BERT-BiLSTM model (for semantic role labeling and classification): BERT uses 12 hidden layers and 12 attention heads, BiLSTM has 200 hidden units, a dropout rate of 0.5, a learning rate of 0.001, a batch size of 128, and 60 training epochs.

[0127] Extraction Performance Validation: On the test set, the CBOW-BiLSTM-CRF model proposed in this invention performs excellently in extracting key features. The table below shows the performance comparison between this model and the baseline model:

[0128] Table 3: Comparison of entity extraction performance with baseline models

[0129]

[0130] As shown in Table 3, the method of this invention achieved an F1 score of 83.53%, outperforming other comparative models and demonstrating its accuracy in identifying security entities in power systems. Furthermore, in the sentence classification task, the model of this invention achieved an F1 score of 93.81%.

[0131] Step 5, construct the attack vector graph

[0132] Based on the extracted semantic elements, the system automatically constructs an attack vector graph. Taking the WSHRAT case as an example, the system generates a graph containing 47 nodes and 45 edges. Nodes represent specific entities, such as WSHRAT, the RDP protocol, and remote servers, while edges explicitly represent the causal logic of the attack, such as Exploit, Connect, and Download. Each node is bound to a source pointer pointing to the original log text, achieving a high degree of interpretability.

[0133] Step 6: Generate a structured, paradigmatic attack vector model.

[0134] The constructed tracking graph is projected onto the paradigmatic semantic space and subgraph similarity is calculated with the knowledge base.

[0135] Calculation results: The WHRAT tracing graph and the entry in the power system-specific vulnerability database (BlueKeep vulnerability) in the knowledge base show extremely high structural similarity, with a calculated similarity score of 0.81, exceeding the preset threshold of 0.6.

[0136] Final output: The system successfully defined the unstructured log as a paradigmatic attack vector model based on the power system-specific vulnerability database, clarifying that it exploited the RDP pre-authentication remote code execution vulnerability.

[0137] The table below shows the retrieval results for five typical attack cases in this embodiment, verifying the method's cross-source alignment capability:

[0138] Table 4: Subgraph Text Similarity Search Results

[0139]

[0140] As shown in Table 4, the similarity of all cases exceeded the threshold of 0.6, with an average similarity of 0.61. 71% of the matching results had a similarity exceeding 0.7. This indicates that the present invention can effectively bridge the semantic gap, achieving accurate association between unstructured data and structured knowledge, and generating a reliable, paradigmatic attack vector model.

[0141] In summary, this embodiment successfully achieved the automated conversion from unstructured network logs to a high-precision, interpretable attack vector model by constructing a power system-specific knowledge base, utilizing deep learning for semantic normalization and element extraction, building a traceable attack vector graph, and performing a paradigmatic mapping based on graph similarity. This verifies the effectiveness and advancement of the present invention.

Claims

1. A novel power system network attack vector paradigm optimization method based on semantically interpretable methods, characterized in that, The method includes the following steps: Step 1: Construct a power system-specific knowledge base, define a vulnerability ontology, and standardize core entities and relationships; map the structured power system-specific vulnerability database and the communication protocol security baseline onto this ontology, and construct a reference knowledge graph as the target space for cross-source alignment. Step 2: Obtain unstructured network data from the new power system, including power system network logs, intrusion detection records, or device communication data. Step 3 involves performing semantic restoration and normalization on the unstructured network data. This step aims to recover the missing semantic information in the attack description, eliminate ambiguity, and output semantically complete normalized text. Step 4: Perform deep semantic analysis on the normalized text and extract attack semantic elements. These elements include the attacker, attack method, attack target, affected power system components, or attack impact. Step 5: Based on the extracted semantic elements and their interrelationships, construct an interpretable attack vector graph. The graph explicitly represents the causal logic of the attack in the form of nodes and edges, and all nodes and edges of the graph retain the source evidence of the specific text in the original data. Step 6: Project the interpretable attack vector graph onto a predefined paradigmatic semantic space, and perform interpretable mapping and similarity calculation with the power system-specific knowledge base constructed in Step 1 to generate a structured paradigmatic attack vector model.

2. The novel power system network attack vector paradigm optimization method based on semantically interpretable principles as described in claim 1, characterized in that, Step 1, building a power system-specific vulnerability database, includes: Step 1.1, Vulnerability Ontology Definition: For novel power system cybersecurity scenarios, a vulnerability ontology is defined to standardize core entities, including power system components, communication protocols, attack methods, vulnerability types, and their interrelationships, providing semantic support for consistent knowledge representation. The ontology is defined as a quintuple: ,in Represents a set of concept categories. Represents a set of attributes. Represents a set of relationships between classes. This represents the set of logical constraints used for reasoning. This represents a set of instances corresponding to specific vulnerability data, with each entity category... Associate an attribute vector Each relationship Describe entity and Directed semantic connections and logical constraints between them Define allowed combinations of relations and attributes to ensure semantic consistency in graph construction. The ontology's relation layer defines the interaction methods between entities and designs four main relations to cover the most common patterns of vulnerability propagation and dependencies: belong Connect suppliers with their software products; Influence Indicates the products affected by the vulnerability; Include Associate a vulnerability with its abstract type category; use Connect the vulnerability with its exploitation method. The entity extraction process is implemented through algorithm design. The following algorithm summarizes the entity extraction process from preprocessed text to ontology-compatible triples. a. Calculate word embeddings: First, this process receives the preprocessed sentence sequence. As input, for each token in the sequence Calculate the corresponding continuous bag-of-words model embedding vector for each. , b. Context encoding: Embedding the word vector sequence generated in the previous step. The input is encoded into a bidirectional long short-term memory network to obtain a hidden state vector that incorporates contextual information. , c. Calculate the score: based on the context vector output by the bidirectional long short-term memory network. Calculate the launch score required for the conditional random field layer. and transfer score , d. Sequence Decoding: Apply a CRF decoding layer and use the Viterbi algorithm to calculate and decode the highest probability, optimal tag sequence. , e. Entity mapping: Mapping the decoded tag sequence The identified entities strictly follow the predefined vulnerability ontology. Mapped to the corresponding ontology class and properties. f. Output: Finally, a collection containing all mapped entities is returned. This completes the entire process of extracting the vulnerable entity. Step 1.2, Knowledge Base Data Mapping: Obtain a structured power system-specific vulnerability database and communication protocol security baseline data. To address the issue of inconsistent names for the same entity across different sources, entity lexical normalization and synonym alignment are used to standardize entity names, and cosine similarity between word embedding vectors is used to calculate semantic similarity between candidate entities. It is a physical entity and entity Semantic similarity score between them and : are entities and The embedding vector representation, and : are vectors and The similarity between the models exceeds a preset threshold. A rule-based fusion strategy is adopted to address the problem of inconsistent or incomplete information provided by different data sources for the same attribute of the same entity: Time field: Use the earliest available date. Category attributes: unified by majority voting. Text description: After removing redundancy, the text is concatenated. Numerical attributes: A weighted average method based on source credibility weights is used, referencing the formula: in, This represents the final attribute value after fusion. Indicates that it comes from a data source. The attribute value, Indicates assignment to the data source Credibility weight, This indicates the total number of data sources that provide this attribute. Finally, relation fusion, alignment, and merging describe relationships connecting the same facts. First, relations extracted from different sources are standardized into predicates defined in the ontology, including *belong*, *influence*, *include*, and *utilize*. If multiple relations have identical head-tail entity pairs, these duplicate or semantically equivalent relations are merged into one, preserving a source set for each merged relation. To record all original data sources and ensure traceability. Step 1.3, referencing knowledge graph construction, strictly map and merge the structured data from Step 1.2 according to the ontology defined in Step 1.1 to construct a unified, machine-readable reference knowledge graph.

3. The novel power system network attack vector paradigm optimization method based on semantically interpretable principles as described in claim 1, characterized in that, Step 2, obtaining unstructured network data of the new power system, includes: Step 2.1, Data Source Identification and Interface Configuration: First, it is necessary to clarify the specific source of the unstructured data, identify and locate the server, device, or system storing power system network logs, intrusion detection records, and equipment communication data. Then, configure the corresponding acquisition interfaces, including Syslog forwarding, database connection, API calls, or file directory monitoring. Step 2.2, Multi-Source Data Aggregation: The data collection task is initiated to centralize heterogeneous data from different sources. Through the interface configured in Step 1.1, data is pulled or received in real-time or in batches, aggregating data from multiple data sources of different formats into a unified data pool or message queue, preparing for subsequent processing. This stage only handles aggregation and does not alter the unstructured nature of the data. Step 2.3, Data Stream Supply: The collected raw data stream is supplied to the analysis module in sequence. The raw, unstructured data stream collected in Step 1.2 is organized in chronological order and used as input to the semantic restoration and normalization processing module in the subsequent Step 2 of this invention for actual semantic analysis.

4. The novel power system network attack vector paradigm optimization method based on semantically interpretable principles as described in claim 1, characterized in that, The semantic restoration and normalization process in step 3 includes: Step 3.1, missing subject restoration, that is, using syntactic dependency analysis to restore the logical subject in the context of predicate verbs that are missing a subject in the text; first, perform syntactic analysis on the input sentence to generate its dependency tree. Then, the system uses predefined dependency templates to check the verbs in the sentence. Is a grammatical subject missing? If a subject is found to be missing, the system will copy the corresponding subject from the context and insert it into the current sentence to restore its complete semantics. The relevant formula logic is as follows: (when (When the subject is missing) Indicates verb The subject that should be bound. Indicates the verb that is currently being analyzed in the sentence. This indicates a known, explicit subject derived from the preceding context. Step 3.2, Pronoun Reference Resolution, involves using a pronoun reference resolution model to parse pronouns in the text and replace them with the specific entities they refer to. This step addresses the issue of ambiguous pronoun references in the text and ensures consistency of entities throughout the description. A neural coreference engine is used as the model for resolving the association. The model reads text containing pronouns. Sentences And predict the specific antecedent that the pronoun refers to. Then use replace The relevant formulas are as follows: This indicates a new sentence with clearer meaning after the referential analysis. This represents the original input sentence; The representative refers to the resolution model; In the sentence Pronouns detected in the text; Representation Model Predicted, pronoun The antecedent that it actually points to; This indicates that a replacement operation will be performed. Step 3.3, Redundancy elimination, involves removing repeated modifiers or auxiliary phrases through lexical pattern matching to simplify the text while preserving the core attack semantics. Following subject recovery and pronoun parsing, this step is used to simplify the text, remove interfering and redundant information, and retain the core attack semantics. This step employs a rule-based method based on lexical pattern pruning, which analyzes the part-of-speech (POS) sequence of the sentence. It also finds and removes duplicate modifiers, auxiliary phrases, or conditional clauses based on predefined rule templates.

5. The novel power system network attack vector paradigm optimization method based on semantically interpretable principles as described in claim 1, characterized in that, Step 4, the extraction of attack semantic elements, includes: Step 4.1, semantic role labeling, that is, using a sequence labeling model to analyze the normalized text and automatically label the key semantic roles; First, the model needs to understand the deep contextual meaning of each token in the normalized text. First, it is fed into a pre-trained model to generate a context embedding vector that captures long-range dependencies. Subsequently, these context embedding vectors It is fed into a BiLSTM (Bidirectional Long Short-Term Memory) network to further model local sequence information, as shown in the following formula: Indicates word elements The context embedding vector obtained after processing by the BERT model This represents a bidirectional long short-term memory network model. This is the final hidden state output of the BiLSTM, which is a concatenation of the forward pass. and backward The information vector represents the word unit. The final semantic representation in its complete context, this This will serve as the common input for the next two sub-steps. Semantic role labeling refers to the process of understanding each lexical unit ( Based on this, a specific semantic role is assigned to each lexical unit. The hidden state vector obtained above The input is a linear projection layer, and the input is passed through a softmax activation function to predict the word. Final semantic role labels The relevant formulas are as follows: Lexical context representation from step 1, and Linear layer weights and biases for semantic role labeling tasks It is a word predicted by the model. The corresponding semantic role tags, Step 4.2, attack behavior classification, that is, classifying the behaviors described in the normalized text and mapping them to a predefined attack stage classification system. Attack behavior classification is based on understanding all word units in the sentence ( Based on this, the functions of the entire sentence are classified. Attention pooling: First, an attention mechanism is used to compute each word in the sentence. The importance of attention score To determine which word contributes the most to sentence classification, Then, through these attention scores For all lexical units By performing a weighted summation, we obtain a vector representing the core semantics of the entire sentence. Finally, this sentence is represented as a vector. The data is fed into a Softmax classifier to predict the final category of the entire sentence. The relevant formulas are as follows: Lexical context representation from step 1, These are trainable parameters in the attention mechanism. It is a word element Attention score It is a vector representing the semantics of the entire sentence, obtained through attention-weighted summation. These are the linear layer weights and biases for a sentence classification task. The final sentence category predicted by the model. To ensure that the two sub-steps of semantic role labeling and attack behavior classification mutually reinforce each other, the model employs multi-task joint training, as shown in the following formula: It is the overall loss function of the model. It is the loss of semantic role labeling. It is the loss in attack behavior classification. It is a hyperparameter used to balance the importance of the two tasks.

6. The novel power system network attack vector paradigm optimization method based on semantically interpretable method according to claim 1, characterized in that, Step 5, constructing an interpretable attack vector graph, includes: Step 5.1, Graph Node Definition: The attack semantic elements are defined as nodes in the graph; the previously extracted semantic elements are defined as the node set of the graph. All elements identified through semantic role labeling and entity sequence labeling during the extraction of attack semantic elements, including attackers, malicious scripts (Actors), execution (Methods), and servers (Targets), are created as independent nodes in the graph. The node set of the entire graph It is the set of all these nodes. Step 5.2: Define the semantic relationships, causal relationships, or temporal relationships between semantic elements as edges of the graph; define the semantic relationships, causal relationships, or temporal relationships between nodes as the edge set of the graph. Based on the semantic roles and dependencies obtained from the previous analysis, directed edges are established between nodes. , For edges that express the chronological order, an additional order attribute will be added. This is used for subsequent attack timeline analysis. When subgraphs from different sentences share the same entity or reference the same object, these subgraphs are merged into a single connected graph. This forms a complete graph reflecting the entire attack log narrative process, with the relevant formulas as follows: From node Pointing to node One of the edges. The relational predicate representing this edge, : Represents a node semantic type, The final, complete trace graph representing the entire log or report. From a single sentence The sentence-level subgraphs extracted from it. This represents the union operation, which merges the subgraphs of all sentences into a larger graph. Step 5.3 preserves textual source evidence for the origin of each node and each edge in the graph to achieve interpretability. This requires that each element in the graph can be traced back to the original log text. The image is a map. Each node in Even including the edges Each of them retains a pointer or metadata to its source text, which is represented by a tuple. Stored in the form of These are the nodes in the diagram. It is this node The index number of the original sentence from the source. It is this node In the original sentence By identifying the specific character range corresponding to the source, security analysts can clearly verify which specific record in the original log the element in the final attack vector graph originates from, making the entire analysis process transparent and verifiable.

7. The novel power system network attack vector paradigm optimization method based on semantically interpretable principles according to claim 1, characterized in that, The projection generation paradigmatic attack vector model in step 6 includes: Step 6.1, semantic space definition, involves pre-defining a paradigmatic semantic space composed of core semantic triples, whereby the triples include affected power system components, attack methods, and security protocol baselines; this step is preparation for subsequent simultaneous interpretation. Step 6.2, semantic projection, which involves summarizing and refining the interpretable attack vector graph into a set of standardized attack vector facts conforming to the paradigmatic semantic space; this step is an action of translation, transforming the narrative interpretable attack vector graph from unstructured logs ( Projecting this onto a defined shared semantic space transforms it into standardized attack vector facts. ), Mapping Entities: Entities marked as executable files or power equipment modules in the graph are mapped to affected power system components. Mapping Actions: Map actions represented in the diagram as exploitation, injection, or permission modification methods to attack methods. Mapping Impact: Nodes in the diagram representing impacts such as remote code execution and data breaches are mapped to vulnerability types or violated security protocol baselines. The relevant formulas are as follows: This represents an interpretable attack vector graph constructed from the logs. This represents the projected set of attack vector facts consisting of normalized triples. The mapping function representing semantic projection. Step 6.3, model generation, involves calculating the graph similarity between the standardized attack vector facts and the power system-specific knowledge base, and storing the matching results to generate the final paradigmatic attack vector model. In the shared semantic space, a quantitative comparison is performed between attack vector facts from logs and fact subgraphs from the knowledge base to complete the final mapping and model generation. Node-level (triple) similarity calculation: First, calculate the similarity between two triples (one from the log). A source from a knowledge base The similarity between them combines two measures: Semantic similarity (Cosine): Compares the context embedding vectors of the node text in a triplet. Lexical similarity (Jaccard): Compares the overlap of attributes of nodes in a triplet within the ontology. Graph-level similarity calculation: Aggregate the similarity scores of all triples to calculate the entire attack vector graph. and knowledge base subgraph Overall similarity between , Model generation: based on the calculated overall similarity All entries in the knowledge base are sorted, and the highest-scoring entries that exceed a preset threshold are linked to the current log graph. This link itself, along with the linked knowledge base entries, constitutes the final output paradigmized attack vector model. The relevant formula is as follows: Two triples and Similarity score between them A weight parameter between [0,1] is used to balance the importance of semantic and lexical similarity. Context embedding vector of node text in triples and Cosine similarity between them The ontology terminology set corresponding to the nodes in the triplet and Jaccard similarity between them The final overall similarity score between the attack graph and the knowledge base subgraph. The best-matching triplet pairs between two graphs, determined by the optimal bipartite matching algorithm. The set, These represent the total number of triples in the attack graph and the knowledge base subgraph, respectively, and are used to normalize the score.

8. A novel power system network attack vector paradigm definition system based on semantically interpretable syntax, characterized in that, The system is used to implement the novel power system network attack vector paradigm optimization method based on semantically interpretable methods as described in any one of claims 1-7, the system comprising: The data acquisition module is used to acquire unstructured network data of the new power system, including power system network logs, intrusion detection records, or device communication data. The semantic normalization module is used to perform semantic restoration and normalization processing on the unstructured network data and output semantically complete normalized text; The semantic extraction module is used to perform deep semantic analysis on the normalized text and extract attack semantic elements; The graph construction module is used to construct an interpretable attack vector graph based on the extracted semantic elements and their interrelationships. The nodes and edges of the graph retain the source evidence of the specific text in the original data. The model generation module is used to project the interpretable attack vector graph onto a predefined paradigmatic semantic space and perform interpretable mapping between it and a power system-specific knowledge base, including a power system-specific vulnerability database or a communication protocol security baseline, thereby generating a structured paradigmatic attack vector model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the novel power system network attack vector paradigm optimization method based on semantically interpretable methods according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the novel power system network attack vector paradigm optimization method based on semantically interpretable according to any one of claims 1 to 7.

Images