Cyber-physical system network attack threat propagation path detection method and system

Abstract

The application provides a power information physical system network attack threat propagation path detection method and system, and the method comprises the following steps: acquiring power flow data, acquiring power system network traffic and log information, and preprocessing the data; constructing a power information physical double-layer coupled network; integrating the power network topology and the information network topology into a three-dimensional tensor representation by using a multi-view fusion technology; identifying key query nodes by using a K-Means clustering algorithm based on a node importance scoring mechanism, and dynamically optimizing the network topology structure. The application solves the technical problems that the complex correlation relationship capturing effect in the power information physical system is poor, unknown attacks and variant attacks are difficult to identify, the perception ability for new threats is poor, and the global influence of attacks is difficult to accurately evaluate.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security for novel cyber-physical coupled systems, specifically to a method and system for detecting the propagation path of network attack threats in power cyber-physical systems. Background Technology

[0002] With the rapid advancement of new power system construction and the deepening integration of power information and physical systems, the coupling and interaction between power grid operation and information networks are becoming increasingly close, posing unprecedented cybersecurity challenges to the power system. Currently, the new power system, dominated by new energy sources, exhibits typical characteristics such as a high proportion of renewable energy integration and AC / DC hybrid operation. While these characteristics improve the system's green and low-carbon level, they also significantly increase its complexity and vulnerability. The widespread application of power monitoring systems, intelligent terminal equipment, and communication networks, while enhancing the intelligence level of the power grid, has also greatly expanded the network attack surface, making the power system face even more severe cybersecurity threats.

[0003] In recent years, cyberattacks targeting power systems have become increasingly frequent, evolving from traditional general attacks such as viruses and Trojans to targeted attacks specifically aimed at power industrial control systems. Attack methods are constantly escalating, and the severity of the damage continues to increase. In particular, attacks such as advanced persistent threats (APTS), fake data injection attacks, and denial-of-service attacks can penetrate the physical power grid through information networks, triggering cascading failures and even causing large-scale power outages. Traditional power system security primarily relies on static defenses such as boundary isolation, access control, and intrusion detection. These methods are significantly inadequate in the face of new cyberattacks, struggling to effectively identify unknown and variant attacks and lacking the ability to detect new threats. Furthermore, traditional methods typically analyze the security status of information networks or physical systems in isolation, failing to fully consider the cross-domain threat propagation characteristics brought about by cyber-physical interactions, making it difficult to accurately assess the global impact of attacks.

[0004] Therefore, there is an urgent need to study methods for detecting and protecting against network attack threats propagation paths in new power cyber-physical systems, overcome existing technological limitations, build a security protection system adapted to the characteristics of new power systems, and ensure the safe and stable operation of the power grid.

[0005] The existing invention patent application document CN115514655A, entitled "A Malicious Program Propagation Model and Optimal Control Method for Distribution Network Cyber-Physical Systems," describes a method that includes: constructing a PC-PLC two-layer heterogeneous network model for distribution network CPS based on the propagation principle of PC-PLC worm viruses; constructing a node state transition diagram; dividing nodes into susceptible nodes, infected nodes, isolated nodes, and immune nodes; and establishing a system of differential equations based on the node state transition diagram to obtain the malicious program propagation model in the distribution network CPS. However, the aforementioned existing solution is based on a traditional epidemic differential equation model, which can only model and suppress the propagation of known malicious programs and cannot detect or identify new or variant attacks.

[0006] The existing invention patent application document CN107196808A, entitled "A Method for Constructing a Two-Layer Network Model," includes the following steps: generating networks A and B based on a scale-free network model proposed by Barabasi and Albert, namely the BA network model; selecting node importance parameters, including node degree and node clustering coefficient; and redefining node importance in the two-layer network coupling system by weighting node degree and number of nodes. However, the aforementioned prior art mainly focuses on the construction and robustness optimization of the two-layer network topology, without addressing the detection and tracing of network security threats.

[0007] In summary, existing technologies suffer from technical problems such as poor capture of complex relationships in power cyber-physical systems, difficulty in identifying unknown and variant attacks, lack of awareness of new threats, and difficulty in accurately assessing the global impact of attacks. Summary of the Invention

[0008] The technical problem to be solved by this invention is how to address the issues in the prior art where the capture of complex relationships in power cyber-physical systems is poor, it is difficult to identify unknown and variant attacks, there is a lack of awareness of new threats, and it is difficult to accurately assess the global impact of attacks.

[0009] This invention solves the above-mentioned technical problems by employing the following technical solution: A method for detecting the propagation path of network attack threats in power information physical systems includes:

[0010] S1. Obtain power flow data and information network traffic and log information from the power system, and preprocess the multi-source heterogeneous data; S2. Construct a power information-physical dual-layer coupled network model to associate and map the power network topology and the information network topology; based on the existing power network topology, use the Barabási-Albert model to generate the information layer network in the power information-physical dual-layer coupled network model, and set different connection weights according to the differences in the importance of power nodes. S3. Using multi-view fusion technology, the power network topology and information network topology are integrated into a three-dimensional tensor representation; S4. Based on the node importance scoring mechanism, key query nodes are identified through the K-Means clustering algorithm, and the network topology is dynamically optimized to obtain an optimized graph representation. S5. Input the optimized graph representation into the graph neural network for training and prediction; construct a deep network model based on graph attention mechanism and graph convolution to learn the threat state characteristics and potential propagation paths of nodes; the deep network model adopts graph attention network, which updates the representation of the current node by aggregating the features of neighboring nodes, and uses the attention mechanism to assign different importance weights to different neighbors to capture the key paths of threat propagation.

[0011] The method proposed in this invention can effectively capture complex relationships in power cyber-physical systems, and significantly outperforms traditional methods in terms of attack detection accuracy, recall, and F1 score. This invention effectively solves the problems of poor capture of complex relationships, difficulty in identifying unknown and variant attacks, and lack of awareness of cross-domain threats in existing technologies. It is particularly suitable for detecting collaborative attacks and cascading fault propagation paths across cyber-physical domains in novel power systems.

[0012] This invention constructs a two-layer coupled network model of power information and physics, and integrates multi-view tensor representation and graph neural network technology. It can automatically learn complex nonlinear coupling relationships from multi-source heterogeneous data such as power flow and information flow, thereby achieving accurate detection of unknown network attacks and variant attacks, and predicting threat propagation paths.

[0013] In a more specific technical solution, S2, the physical layer network diagram in the power information physical dual-layer coupled network model is represented as follows:

[0014] In the formula, Represented as a physical layer network diagram, Represents physical layer network node information. Represents the edge information of the physical layer network graph; The information layer network diagram in the power cyber-physical two-layer coupled network model is represented as follows:

[0015] In the formula, Represented as an information layer network diagram, This represents information about network nodes in the information layer. This represents the edge information of the information layer network graph.

[0016] This invention constructs a novel power information-physical dual-layer coupling model, a power information-physical coupling graph neural network model, and a network attack threat propagation path detection model. Based on comprehensive model support, it learns complex nonlinear coupling relationships from multi-source data, enabling the discovery of network attack propagation paths that are difficult for humans to detect.

[0017] In a more specific technical solution, S2 uses an adjacency matrix to represent the physical layer network topology and the information layer network topology:

[0018] In the formula, v=1 Represented as an adjacency matrix of the information layer network, v=2 Time represents the physical layer network adjacency matrix; The following logic is used to express the adjacency matrix of the power information physical coupling model:

[0019] In the formula, the model adopts a one-to-one coupling method between power nodes and information nodes. N The number of nodes in the information layer network and the physical layer network. This is the adjacency matrix of the physical coupling model of power information.

[0020] In a more specific technical solution, S3 utilizes the following logic to integrate the adjacency matrices of the power network and the information network into a three-dimensional tensor:

[0021] In the formula, A three-dimensional tensor representation of the physical coupling model of power information; The Tucker tensor decomposition method is used to decompose the three-dimensional tensor of the power information physical coupling model into a core tensor and a factor matrix, yielding the following decomposition results:

[0022] In the formula, This is the core tensor representation of the power information physical coupling model. Corresponding tensors The three dimensions; The core tensor and factor matrix are optimized by minimizing the reconstruction error to minimize the squared Frobenius norm of the difference between the two tensors, resulting in a suitable fitting and compression decomposition model.

[0023] By approximating the original tensor with the decomposition results, averaging the slices yields a reconstruction matrix. This process uncovers shared structures and view-specific information among the views, enabling effective fusion and optimized representation of multi-view data.

[0024]

[0025] In the formula, This represents the approximate three-dimensional tensor representation of the decomposition result. This represents the power information physical coupling model reconstruction matrix obtained after averaging the slices; Adjusting the graph structure by adding, deleting, or reweighting edges yields a fused graph representation. .

[0026] In a more specific technical solution, S4 employs the K-Means clustering algorithm for cluster identification, selects query nodes, and obtains K query points, where Q is the query vector of each query point.

[0027] In the formula, Here, K represents the number of query nodes selected. Using a closed-form sorting function, the most relevant and least relevant edges to the query node in the graph are identified, and their corresponding importance scores are obtained, thus revealing the association data between the query node and the query node.

[0028] In the formula, Q represents the query vector of the query point, marking the query node; For each query node, based on importance score ,Add to X The most prominent edge That is, the non-existing connection that is most strongly associated with the query node; Remove the edge in the existing connection that is least associated with the query node.

[0029] In a more specific technical solution, in S5, for the first... l Layered graph attention networks compute nodes using the following logic. i For nodes j Attention coefficient :

[0030] In the formula, This represents the feature vector of node i in the l-th layer. This is the learnable weight matrix for this layer. For the parameter vector of the attention mechanism, This represents a vector concatenation operation, where LeakyReLU is the activation function. The attention coefficients are normalized to obtain normalized attention weights. : In the formula, Indicates that node i is in the fused adjacency matrix The set of neighboring nodes in; By weighted aggregation of the features of all neighboring nodes, the output features of node i at layer l are obtained: In the formula, σ For non-linear activation functions, such as ReLU function; After a multi-layer graph attention network, a graph convolutional network layer is stacked to capture the deep structural features of the graph. Design a threat detection and path prediction module to output the threat state probability of nodes and the attack propagation path prediction results; wherein, the node features output by the last layer of the graph neural network are used. The input is fed into a fully connected layer, and the probability of each node being attacked or in a normal state is calculated using the softmax function:

[0031] In the formula, and The weights and bias parameters of the output layer. For nodes i The probability distribution of threat status prediction; Calculate the probability that an attack propagation link exists between any two nodes in the graph to predict the attack propagation path; The node classification loss is calculated using the cross-entropy loss function. Optimize graph neural network parameters through supervised learning:

[0032] In the formula, For nodes i The true state label, where C is the number of categories.

[0033] Link prediction loss is calculated using the binary cross-entropy loss function. To supervise the model to learn the existence of edges in the graph:

[0034] In the formula, E is the known set of edges, including normal connections and known attack paths. For the edge (i,j) The real existence of the label; The total model loss is obtained as a weighted sum of the node classification loss and the link prediction loss:

[0035] In the formula, λ is the equilibrium hyperparameter.

[0036] In a more specific technical solution, the graph convolution operation of the l-th layer is defined using the following logic:

[0037] In the formula, To incorporate self-connected fused adjacency matrices, It is the identity matrix. for The degree matrix, whose diagonal elements , For the first l The node feature matrix of the layer This is the learnable parameter matrix for this layer.

[0038] In a more specific technical solution, node representation based on the final layer and The probability of link existence is obtained by performing an inner product operation followed by a Sigmoid function. :

[0039] In the formula, σ is the Sigmoid function, which generates a set of potential attack propagation paths.

[0040] In a more specific technical solution, the Adam optimization algorithm is used to minimize the total loss L, and all trainable parameters in the graph neural network are updated through backpropagation. The input real-time power information physically coupled network data is preprocessed, graph constructed, and optimized. The optimized data is then input into a trained graph neural network model. The model outputs the threat probability of all nodes. The probability of a link existing with all node pairs ; Set probability threshold and It marks high-risk nodes and potential attack propagation edges, generates a visualized threat propagation path graph, and outputs a list of high-risk nodes, key propagation paths, and corresponding threat probabilities.

[0041] This invention utilizes a graph neural network model to learn complex nonlinear coupling relationships from fused data, enabling accurate detection and prediction of network attack threat propagation paths.

[0042] This invention, by inputting the optimized power cyber-physical coupling graph into a neural network that deeply fuses graph attention and graph convolution, can effectively learn the node features and global topology under complex coupling relationships, accurately identify attacked nodes and predict attack propagation paths, thereby improving the threat perception and tracing capabilities of power cyber-physical systems in the face of network attacks.

[0043] In a more specific technical solution, the power cyber-physical system network attack threat propagation path detection system includes: The preprocessing module is used to acquire power system flow data and information network traffic and log information, and to preprocess multi-source heterogeneous data. The dual-layer coupled network construction module is used to construct a power information-physical dual-layer coupled network model, which associates and maps the power network topology and the information network topology. Based on the existing power network topology, the Barabási-Albert model is used to generate the information layer network in the power information-physical dual-layer coupled network model, and different connection weights are set according to the differences in the importance of power nodes. The multi-view fusion module is used to integrate the power network topology and information network topology into a three-dimensional tensor representation using multi-view fusion technology. The multi-view fusion module is connected to the two-layer coupled network construction module. The network topology optimization module is used to identify key query nodes based on the node importance scoring mechanism and the K-Means clustering algorithm, and dynamically optimize the network topology structure to obtain an optimized graph representation. The network topology optimization module is connected to the multi-view fusion module. The threat propagation path capture module is used to input the optimized graph representation into the graph neural network for training and prediction. A deep network model based on graph attention mechanism and graph convolution is constructed to learn the threat state characteristics of nodes and potential propagation paths. The deep network model adopts a graph attention network, which updates the representation of the current node by aggregating the features of neighboring nodes, and uses the attention mechanism to assign different importance weights to different neighbors to capture the key paths of threat propagation. The threat propagation path capture module is connected to the network topology optimization module.

[0044] The present invention has the following advantages over the prior art: The method proposed in this invention can effectively capture the complex relationships in the power cyber-physical system. It significantly outperforms traditional methods in terms of attack detection accuracy, recall, and F1 score, and is particularly suitable for detecting coordinated attacks and cascading failure propagation paths across cyber-physical domains.

[0045] This invention constructs a novel power information-physical dual-layer coupling model, a power information-physical coupling graph neural network model, and a network attack threat propagation path detection model. Based on comprehensive model support, it learns complex nonlinear coupling relationships from multi-source data, enabling the discovery of network attack propagation paths that are difficult for humans to detect.

[0046] This invention utilizes a graph neural network model to learn complex nonlinear coupling relationships from fused data, enabling accurate detection and prediction of network attack threat propagation paths.

[0047] This invention, by inputting the optimized power cyber-physical coupling graph into a neural network that deeply fuses graph attention and graph convolution, can effectively learn the node features and global topology under complex coupling relationships, accurately identify attacked nodes and predict attack propagation paths, thereby improving the threat perception and tracing capabilities of power cyber-physical systems in the face of network attacks.

[0048] This invention solves the technical problems existing in the prior art, such as poor capture of complex relationships in power cyber-physical systems, difficulty in identifying unknown and variant attacks, lack of perception of new threats, and difficulty in accurately assessing the global impact of attacks. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the novel power information physical coupling model of Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the basic steps of the method for detecting the propagation path of network attack threats in a power cyber-physical system according to Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of dataset preprocessing in Embodiment 1 of the present invention; Figure 4 This is a schematic diagram of the multi-view fusion of the power information physical coupling system in Embodiment 1 of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Example 1 like Figure 1 As shown, the novel power information physical coupling system is essentially a multi-layered, heterogeneous, and complex network, while graph neural networks, as models specifically designed to process graph-structured data, are highly compatible with it. Figure 2As shown, the method for detecting the propagation path of network attack threats in a power information physical system provided by this invention includes the following basic steps: S1. Acquire power system flow data and information network traffic and log information, and preprocess multi-source heterogeneous data; In this embodiment, preprocessing includes data format standardization, unit conversion, missing value handling, and outlier detection, such as... Figure 2 The diagram shown illustrates the preprocessing of the dataset.

[0052] S2. Construct a two-layer coupled network of power information and physical systems; In this embodiment, a power information physical dual-layer coupled network model is constructed to associate and map the power network topology and the information network topology; The physical layer network diagram in the power information physical two-layer coupled network model is represented as follows:

[0053] In the formula, Represented as a physical layer network diagram, Represents physical layer network node information. This represents the edge information of the physical layer network graph.

[0054] The information layer network diagram in the power cyber-physical two-layer coupled network model is represented as follows:

[0055] In the formula, Represented as an information layer network diagram, This represents information about network nodes in the information layer. This represents the edge information of the information layer network graph.

[0056] In the power cyber-physical two-layer coupled network model, the information layer network is based on the existing power network topology. The Barabási-Albert model is used to generate a realistic information network, with new nodes tending to connect to existing nodes with higher degrees. Different connection weights are set according to the importance of the power nodes. The power generation node interacts frequently and, as the network hub, is given a priority weight of 3.0; the load node is given a priority weight of 1.5 with a medium connection probability; and other nodes are given a priority weight of 1.0 with a baseline connection probability.

[0057] Represent the physical layer network topology and the information layer network topology using an adjacency matrix:

[0058] In the formula, v=1 Represented as an adjacency matrix of the information layer network, v=2Let represent the adjacency matrix of the physical layer network. The adjacency matrix of the power information physical coupling model is represented as:

[0059] In the formula, the model adopts a one-to-one coupling method between power nodes and information nodes. N The number of nodes in the information layer network and the physical layer network. This is the adjacency matrix of the physical coupling model of power information.

[0060] In this embodiment, the input and output of the algorithm are shown in the table below:

[0061] S3. Integrate the power network topology and information network topology into a three-dimensional tensor representation using multi-view fusion technology; In this embodiment, a multi-view fusion method is employed to intelligently merge the power network and information network of the power information physical coupling system into a unified, high-quality fusion network. This allows the subsequent graph neural network to learn more powerful and robust feature representations from it, such as... Figure 3 The diagram shown illustrates the multi-view fusion of a power-information-physical coupling system. The adjacency matrices of the power network and information network are integrated into a single three-dimensional tensor.

[0062] In the formula, This is a three-dimensional tensor representation of the physical coupling model of power information.

[0063] The Tucker tensor decomposition method is used to decompose the three-dimensional tensor of the power information physical coupling model into a core tensor and a factor matrix:

[0064] In the formula, This is the core tensor representation of the power information physical coupling model, containing the most essential, compressed core features of the original data and the factor matrix of interaction relationships between different dimensions. Corresponding tensors The matrix has three dimensions. The column vectors of each matrix represent the basis along that dimension.

[0065] The core tensor and factor matrix are optimized by minimizing the reconstruction error, so that the squared Frobenius norm of the difference between the two tensors is minimized. This yields a decomposition model that best fits and compresses the original data with the least information loss.

[0066]

[0067] By approximating the original tensor with the decomposition result, the slices are averaged to obtain the reconstruction matrix, thus achieving effective fusion and optimized representation of multi-view data.

[0068]

[0069]

[0070] In the formula, This represents the approximate three-dimensional tensor representation of the decomposition result. This represents the reconstruction matrix of the physical coupling model of power information obtained after averaging the slices. Through tensor decomposition, shared structures and view-specific information between views are mined, ultimately reconstructing an optimized and fused graph representation.

[0071] The fused graph may still contain a large number of redundant or irrelevant connections, and may also lack some key, implicit relationships. Adjusting the graph structure—adding, deleting, or reweighting edges—can improve the model's ability to perceive network threats and its prediction accuracy. This results in the fused graph representation. Subsequently, the graph structure was further optimized, highlighting important connections and pruning unimportant connections to improve the performance of subsequent learning tasks.

[0072] S4. Based on the node importance scoring mechanism, key query nodes are identified through K-Means clustering algorithm, and the network topology is dynamically optimized. In this embodiment, the K-Means clustering algorithm is used for cluster identification, selecting query nodes to obtain K query points, where Q is the query vector of each query point.

[0073] In the formula K represents the number of query nodes selected.

[0074] Using a closed-form sorting function, the most relevant and least relevant edges to the query node in the graph are identified, and their corresponding importance scores are obtained.

[0075] Here, Q represents the query vector of the query point, marking the query node. The algorithm calculates the importance score of all nodes in the graph relative to the query node. The higher the score, the stronger the connection between the node and the query node.

[0076] For each query node determined by the cluster centers, based on the importance score ,Add to X The most prominent edge This refers to the non-existing connections that are most strongly associated with the query node. This helps strengthen potential and important semantic relationships. Simultaneously, removing... Y The least significant edge This refers to the edge with the weakest connection to the query node among existing connections. Reducing noisy connections decreases the sparsity of the graph structure.

[0077] S5. After completing the graph structure optimization, the optimized graph representation is used as input to the graph neural network for training and prediction.

[0078] In this embodiment, a deep network model based on graph attention and graph convolution is constructed to learn the threat state characteristics of nodes and potential propagation paths. The model input is the optimized fused graph representation. and its corresponding node feature matrix ,in N The total number of nodes. F The initial feature dimension for each node. Node features. X It is composed of the operating status data of the power nodes and the traffic and log characteristics of the information nodes.

[0079] The model uses a graph attention network to update the representation of the current node by aggregating the features of neighboring nodes, and uses the attention mechanism to assign different importance weights to different neighbors, thereby more accurately capturing the key paths of threat propagation.

[0080] For the l Layered graph attention network, nodes i For nodes j Attention coefficient The calculation is as follows:

[0081] In the formula, This represents the feature vector of node i in the l-th layer. This is the learnable weight matrix for this layer. For the parameter vector of the attention mechanism, This represents the vector concatenation operation, with LeakyReLU as the activation function. Subsequently, the attention coefficients are normalized to obtain the normalized attention weights. : In the formula, Indicates that node i is in the fused adjacency matrix The set of neighboring nodes in the array. The output feature of node i at layer l is obtained by weighted aggregation of the features of all its neighboring nodes: In the formula, σFor non-linear activation functions, such as ReLU Function. Following a multi-layer graph attention network, graph convolutional network layers are stacked to further capture the deep structural features of the graph. The graph convolutional operation of the l-th layer is defined as:

[0082] In the formula, To incorporate self-connected fused adjacency matrices, It is the identity matrix. for The degree matrix, whose diagonal elements , For the first l The node feature matrix of the layer This is the learnable parameter matrix for this layer.

[0083] Design a threat detection and path prediction module to output the threat state probability of nodes and the attack propagation path prediction results. This involves using the node features output from the last layer of the graph neural network. The input is fed into a fully connected layer, and the probability of each node belonging to the "attacked" or "normal" state is calculated using the softmax function:

[0084] In the formula, and The weights and bias parameters of the output layer. For nodes i The probability distribution of threat state prediction.

[0085] The probability of an attack propagation link existing between any two nodes in the graph is calculated to predict the attack propagation path. This is based on the node representation of the final layer. and The probability of link existence is obtained by performing an inner product operation followed by a Sigmoid function. :

[0086] In the formula, σ is the Sigmoid function, which generates a set of potential attack propagation paths.

[0087] The node classification loss is calculated using the cross-entropy loss function. This is used to optimize graph neural network parameters through supervised learning.

[0088] In the formula, For nodes i The true state label (one-hot encoded), C is the number of categories, and C=2 in the graph neural network model of the novel cyber-physical coupled system.

[0089] Link prediction loss is calculated using the binary cross-entropy loss function. To supervise the model to learn the existence of edges in the graph:

[0090] In the formula, E is the known set of edges, including normal connections and known attack paths. For the edge (i,j) The actual existence label (1 indicates existence, 0 indicates non-existence).

[0091] The total model loss is obtained as a weighted sum of the node classification loss and the link prediction loss:

[0092] In the formula, λ is the balancing hyperparameter, which takes values ​​in the range of [0,1] and is used to adjust the relative importance of the two tasks.

[0093] The Adam optimization algorithm is used to minimize the total loss L, and all trainable parameters in the graph neural network are updated through backpropagation. During training, the dataset is divided into training, validation, and test sets by nodes. Early stopping is used to prevent overfitting, and training is terminated when the validation set loss does not decrease for several consecutive epochs.

[0094] After model training, real-time power information physical coupling network data is input. After preprocessing, graph construction, and optimization, this data is fed into the trained graph neural network model. The model outputs the threat probability of all nodes. The probability of a link existing with all node pairs Set a probability threshold. and ,Will > The node is marked as a "high-risk node". > Furthermore, edges connecting at least one "high-risk node" are marked as "potential attack propagation edges." Based on this, a visualized threat propagation path graph is automatically generated, and a list of high-risk nodes, key propagation paths, and corresponding threat probabilities are output, providing precise decision support for network security protection.

[0095] In summary, the method proposed in this invention can effectively capture the complex relationships in power cyber-physical systems. It significantly outperforms traditional methods in terms of attack detection accuracy, recall, and F1 score, and is particularly suitable for detecting coordinated attacks and cascading failure propagation paths across cyber-physical domains.

[0096] This invention constructs a novel power information-physical dual-layer coupling model, a power information-physical coupling graph neural network model, and a network attack threat propagation path detection model. Based on comprehensive model support, it learns complex nonlinear coupling relationships from multi-source data, enabling the discovery of network attack propagation paths that are difficult for humans to detect.

[0097] This invention utilizes a graph neural network model to learn complex nonlinear coupling relationships from fused data, enabling accurate detection and prediction of network attack threat propagation paths.

[0098] This invention, by inputting the optimized power cyber-physical coupling graph into a neural network that deeply fuses graph attention and graph convolution, can effectively learn the node features and global topology under complex coupling relationships, accurately identify attacked nodes and predict attack propagation paths, thereby improving the threat perception and tracing capabilities of power cyber-physical systems in the face of network attacks.

[0099] This invention solves the technical problems existing in the prior art, such as poor capture of complex relationships in power cyber-physical systems, difficulty in identifying unknown and variant attacks, lack of perception of new threats, and difficulty in accurately assessing the global impact of attacks.

[0100] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting the propagation path of network attack threats in power information physical systems, characterized in that, The method includes: S1. Obtain power flow data and information network traffic and log information from the power system, and preprocess the multi-source heterogeneous data; S2. Construct a power information-physical dual-layer coupled network model to associate and map the power network topology and the information network topology; based on the existing power network topology, use the Barabási-Albert model to generate the information layer network in the power information-physical dual-layer coupled network model, and set different connection weights according to the differences in the importance of power nodes. S3. Using multi-view fusion technology, the power network topology and the information network topology are integrated into a three-dimensional tensor representation; S4. Based on the node importance scoring mechanism, key query nodes are identified through the K-Means clustering algorithm, and the network topology is dynamically optimized to obtain an optimized graph representation. S5. Input the optimized graph representation into a graph neural network for training and prediction; construct a deep network model based on graph attention mechanism and graph convolution to learn the threat state characteristics and potential propagation paths of nodes; the deep network model adopts a graph attention network, which updates the representation of the current node by aggregating the features of neighboring nodes, and uses the attention mechanism to assign different importance weights to different neighbors to capture the key paths of threat propagation.

2. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, In S2, the physical layer network diagram in the power information physical two-layer coupled network model is represented as follows: In the formula, Represented as a physical layer network diagram, Represents physical layer network node information. Represents the edge information of the physical layer network graph; The information layer network diagram in the power cyber-physical two-layer coupled network model is represented as follows: In the formula, Represented as an information layer network diagram, This represents information about network nodes in the information layer. This represents the edge information of the information layer network graph.

3. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, In S2, the physical layer network topology and the information layer network topology are represented using an adjacency matrix: In the formula, v=1 Represented as an adjacency matrix of the information layer network, v=2 Time represents the physical layer network adjacency matrix; The following logic is used to express the adjacency matrix of the power information physical coupling model: In the formula, the model adopts a one-to-one coupling method between power nodes and information nodes. N The number of nodes in the information layer network and the physical layer network. This is the adjacency matrix of the physical coupling model of power information.

4. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, In step S3, the adjacency matrices of the power network and the information network are integrated into a three-dimensional tensor using the following logic: In the formula, A three-dimensional tensor representation of the physical coupling model of power information; The Tucker tensor decomposition method is used to decompose the three-dimensional tensor of the power information physical coupling model into a core tensor and a factor matrix, yielding the following decomposition results: In the formula, This is the core tensor representation of the power information physical coupling model. Corresponding tensors The three dimensions; The core tensor and factor matrix are optimized by minimizing the reconstruction error to minimize the squared Frobenius norm of the difference between the two tensors, resulting in a suitable fitting and compression decomposition model. By approximating the original tensor using the decomposition result, averaging the slices yields a reconstruction matrix. This process uncovers shared structures and view-specific information among the views, enabling effective fusion and optimized representation of multi-view data. In the formula, This represents the approximate three-dimensional tensor representation of the decomposition result. This represents the power information physical coupling model reconstruction matrix obtained after averaging the slices; Adjusting the graph structure by adding, deleting, or reweighting edges yields a fused graph representation. .

5. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, In step S4, the K-Means clustering algorithm is used for cluster identification, and query nodes are selected to obtain K query points, where Q is the query vector of each query point. In the formula, Here, K represents the number of query nodes selected. Using a closed-form sorting function, the most relevant and least relevant edges to the query node in the graph are identified, and their corresponding importance scores are obtained, thus revealing the association data between the query node and the query node. In the formula, Q represents the query vector of the query point, marking the query node; For each of the query nodes, based on the importance score ,Add to X The most prominent edge That is, the non-existing connection that is most strongly associated with the query node; Remove the weakest edge in the existing connection that is associated with the queried node.

6. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, In S5, for the first l The graph attention network described in the layer uses the following logic to compute the nodes. i For nodes j Attention coefficient : In the formula, This represents the feature vector of node i in the l-th layer. This is the learnable weight matrix for this layer. For the parameter vector of the attention mechanism, This represents a vector concatenation operation, where LeakyReLU is the activation function. The attention coefficients are normalized to obtain normalized attention weights. : In the formula, Indicates that node i is in the fused adjacency matrix The set of neighboring nodes in; By weighted aggregation of the features of all neighboring nodes, the output features of node i at layer l are obtained: In the formula, σ For non-linear activation functions, such as ReLU function; After a multi-layer graph attention network, a graph convolutional network layer is stacked to capture the deep structural features of the graph. A threat detection and path prediction module is designed to output the threat state probability of nodes and the attack propagation path prediction results; wherein, the node features output from the last layer of the graph neural network are used. The input is fed into a fully connected layer, and the probability of each node being attacked or in a normal state is calculated using the softmax function: In the formula, and The weights and bias parameters of the output layer. For nodes i The probability distribution of threat status prediction; Calculate the probability that an attack propagation link exists between any two nodes in the graph to predict the attack propagation path; The node classification loss is calculated using the cross-entropy loss function. Optimize graph neural network parameters through supervised learning: In the formula, For nodes i The true state label, where C is the number of categories. Link prediction loss is calculated using the binary cross-entropy loss function. To supervise the model to learn the existence of edges in the graph: In the formula, E is the known set of edges, including normal connections and known attack paths. For the edge (i,j) The real existence of the label; The total model loss is obtained as a weighted sum of the node classification loss and the link prediction loss: In the formula, λ is the equilibrium hyperparameter.

7. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 6, characterized in that, The graph convolution operation of the l-th layer is defined using the following logic: In the formula, To incorporate self-connected fused adjacency matrices, It is the identity matrix. for The degree matrix, whose diagonal elements , For the first l The node feature matrix of the layer This is the learnable parameter matrix for this layer.

8. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, Node representation based on the final layer and The probability of link existence is obtained by performing an inner product operation followed by a Sigmoid function. : In the formula, σ is the Sigmoid function, which generates a set of potential attack propagation paths.

9. The method for detecting the propagation path of network attack threats in a power information physical system according to claim 1, characterized in that, The Adam optimization algorithm is used to minimize the total loss L, and all trainable parameters in the graph neural network are updated through backpropagation. The input real-time power information physically coupled network data is preprocessed, graph constructed, and optimized. The optimized data is then input into a trained graph neural network model. The model outputs the threat probability of all nodes. The probability of a link existing with all node pairs ; Set probability threshold and It marks high-risk nodes and potential attack propagation edges, generates a visualized threat propagation path graph, and outputs a list of high-risk nodes, key propagation paths, and corresponding threat probabilities.

10. A system for detecting the propagation path of network attack threats in power information physical systems, characterized in that, The system includes: The preprocessing module is used to acquire power system flow data and information network traffic and log information, and to preprocess multi-source heterogeneous data. The dual-layer coupled network construction module is used to construct a power information-physical dual-layer coupled network model, which associates and maps the power network topology and the information network topology. Based on the existing power network topology, the Barabási-Albert model is used to generate the information layer network in the power information-physical dual-layer coupled network model, and different connection weights are set according to the differences in the importance of power nodes. The multi-view fusion module is used to integrate the power network topology and the information network topology into a three-dimensional tensor representation using multi-view fusion technology. The multi-view fusion module is connected to the two-layer coupled network construction module. The network topology optimization module is used to identify key query nodes based on the node importance scoring mechanism and the K-Means clustering algorithm, and dynamically optimize the network topology structure to obtain an optimized graph representation. The network topology optimization module is connected to the multi-view fusion module. The threat propagation path capture module is used to input the optimized graph representation into a graph neural network for training and prediction; to construct a deep network model based on graph attention mechanism and graph convolution to learn the threat state characteristics and potential propagation paths of nodes; the deep network model adopts a graph attention network, which updates the representation of the current node by aggregating the features of neighboring nodes, and uses the attention mechanism to assign different importance weights to different neighbors to capture the key paths of threat propagation; the threat propagation path capture module is connected to the network topology optimization module.

Images