A power system account risk prediction and attribution method and system

Abstract

The application relates to a power system account risk prediction and attribution method and system, and belongs to the technical field of power system information security. The method comprises the following steps: performing information processing on a multi-source behavior log of a target account to obtain a structured behavior sequence; a dynamic behavior graph is constructed based on the sequence, and a graph-based representation is obtained through graph neural network learning; the graph-based representation is encoded into a behavior pattern feature vector through a prototype learning network trained by a joint loss; a risk score is calculated based on the behavior pattern feature vector, and a key abnormal node is located by calculating the contribution degree of the node pair in the dynamic behavior graph; and a large language model is driven based on the key node information to generate an interpretable natural language risk attribution report. The application can deeply understand the semantic and logical association of account behavior, realize accurate risk prediction, and provide interpretable analysis results with clear disposal basis, thereby significantly improving the intelligent level of internal account security management of the power system.

Description

Technical Field

[0001] This application relates to the field of power system information security technology, and more specifically, to a method and system for predicting and attributing risks of power system accounts. Background Technology

[0002] With the comprehensive digital transformation and intelligent upgrading of the power system, the scale and complexity of its information infrastructure have significantly increased. The sheer number of internal accounts, the complex permission system, and the multi-dimensional and heterogeneous operational behaviors make accurate prediction and attribution of behavioral risks associated with internal accounts a key technical challenge. This problem manifests itself in several interrelated technical aspects: First, there is the challenge of effectively integrating multi-source heterogeneous behavioral data: Account behavior information is scattered across multiple independent systems, including operation commands, network sessions, and permission changes, with inconsistent data formats, time sequences, and semantics, making it difficult to construct a unified and in-depth behavioral representation. Second, there is the challenge of deeply mining complex abnormal behavior patterns: Internal risks often manifest as a series of seemingly compliant but logically disordered operation sequences. Traditional methods struggle to model the temporal, logical, and resource relationships between operations and are insufficient in identifying covert attack chains. Third, there are the practical limitations of risk assessment models: Models need to address the "cold start" problem of new accounts or new types of attacks, and their predictions must be interpretable, able to pinpoint specific risk points and provide a basis for handling them to support effective security decisions. Therefore, there is an urgent need to research an intelligent account risk analysis technology that can deeply understand behavioral semantics from multi-source data, accurately characterize complex patterns, and output interpretable decision-making basis to meet the inherent requirements of the power industry for high reliability and high security. Summary of the Invention

[0003] To address the aforementioned technical problems, this invention proposes a method and system for predicting and attributing risks of power system accounts.

[0004] The technical solution of this invention is as follows: This invention proposes a method for predicting and attributing risks in power system accounts, comprising the following steps: Information processing is performed on the multi-source behavior logs of the target account in the power business system to obtain a structured behavior sequence; Based on structured behavior sequences, a dynamic behavior graph is constructed, and a graph representation of the dynamic behavior pattern of the target account is learned based on a graph neural network. The graph representation is encoded into behavioral pattern feature vectors through a prototype learning network; wherein, the prototype learning network is trained by combining contrastive loss and prototype alignment loss, so that different types of behavioral pattern feature vectors are clustered into corresponding safety or risk prototype vectors in a pre-constructed risk representation space. Risk is quantified based on behavioral pattern feature vectors, and the risk quantification results and dynamic behavior graphs drive a large language model to perform interpretable attribution analysis and generate risk reports.

[0005] Preferably, the information processing of multi-source behavior logs specifically includes: Collect operation command logs, network session logs, and permission change logs; Operational semantic features, temporal pattern features, and resource context features are extracted from the logs by using an operational semantic encoder, a temporal pattern encoder, and a resource association encoder, respectively. By fusing operational semantic features, temporal pattern features, and resource context features, a structured behavior sequence is formed.

[0006] Preferably, the operation semantic encoder employs a language model pre-trained on power domain text and introduces a domain knowledge-guided attention mechanism to enhance the pre-trained language model's semantic understanding and attention to high-risk operation instructions and their context in the power operation and maintenance field. The temporal pattern encoder uses a multi-scale periodic perception module to convert operation timestamp sequences into multi-dimensional periodic features, and then extracts long- and short-term temporal patterns through a parallel dilated causal convolutional network. The resource association encoder is implemented by constructing an in-session dynamic resource graph and combining it with a graph attention network. The nodes of the in-session dynamic resource graph are the resource entities accessed in a single session, and the edges are the resource access relationships reflected in the operation log. The graph attention network is used to learn the dynamic representation of nodes in the in-session dynamic resource graph.

[0007] Preferably, the construction of the dynamic behavior graph specifically includes: using the behavior units in the structured behavior sequence within the sliding window as nodes, and using the temporal adjacency, logical causality, and resource co-occurrence relationships between behavior units as edges to construct an initial graph; and adding an account summary node connected to all behavior unit nodes in the graph to introduce account identity information.

[0008] Preferably, the graph representation is obtained based on graph neural network learning, and a message-passing-based graph neural network is used. The node feature is updated by aggregating the features of its neighboring nodes and combining its own features. The aggregation operation distinguishes the features of neighboring nodes based on the different types of edges.

[0009] Preferably, the contrast loss adopts Triplet Loss, which is used to shorten the distance between the behavioral pattern feature vectors of the same normal account at different time periods and increase the distance between them and the behavioral pattern feature vectors of risky accounts; the prototype alignment loss is the sum of the squared Euclidean distances between the behavioral pattern feature vectors of all samples in the training batch and the nearest prototype in the prototype set of their respective categories, which is used to drive the behavioral pattern feature vectors to move closer to the nearest prototype vector in the risk representation space.

[0010] Preferably, the risk quantification based on behavioral pattern feature vectors specifically involves calculating the distances from the behavioral pattern feature vectors to the nearest safe prototype and the nearest risk prototype. and And calculate the risk score using a formula. ,in, This is the scaling factor.

[0011] Preferably, the driving force for interpretable attribution analysis of the large language model specifically includes: Calculate the contribution of each node in the dynamic behavior graph to the risk score, and locate key abnormal behavior nodes based on the contribution. Extract the contextual information of key abnormal behavior nodes and their neighborhoods to construct a structured prompt word input large language model; Receive natural language risk attribution reports generated by large language models.

[0012] Preferably, the contribution is calculated by plotting the gradient of the final layer feature vector of a node in the dynamic behavior graph with respect to the risk score, and the L2 norm of the gradient is used as the contribution of the node to the risk score.

[0013] On the other hand, the present invention also provides a power system account risk prediction and attribution system, comprising: The data processing module processes the multi-source behavior logs of the target account in the power business system to obtain a structured behavior sequence. The behavior pattern graphing module constructs a dynamic behavior graph based on structured behavior sequences and learns a graph representation of the target account's dynamic behavior patterns based on graph neural networks. The behavior encoding module encodes the graph representation into behavior pattern feature vectors through a prototype learning network; wherein, the prototype learning network is trained by combining contrastive loss and prototype alignment loss, so that different types of behavior pattern feature vectors are clustered into corresponding safety or risk prototype vectors in a pre-constructed risk representation space. The risk quantification and attribution module quantifies risk based on behavioral pattern feature vectors, and drives a large language model to perform interpretable attribution analysis based on the risk quantification results and dynamic behavior graphs, generating a risk report.

[0014] The present invention has the following beneficial effects: 1. By constructing a technical chain of multi-view targeted augmented encoder (operational semantics, temporal patterns, resource associations) → multi-relationship dynamic behavior graph → relationship graph convolutional network, rich semantic, temporal, and resource association features can be extracted and fused from discrete operation logs to accurately model complex logical relationships between operations. This enables the model to deeply understand the intent behind the behavior, effectively identify hidden and complex attack patterns that are difficult to detect using traditional methods, significantly improve the accuracy and depth of risk detection, and reduce the false negative rate.

[0015] 2. By introducing a prototype-based contrastive learning training mechanism and utilizing a joint loss function for model optimization, a structured risk representation space is constructed. In this space, normal and risky behavior patterns form clearly separated clusters around their corresponding prototypes. This approach transforms risk assessment into measuring the relative distance between the behavior to be tested and the "normal pattern prototype" and "risk pattern prototype," thereby endowing the model with excellent generalization ability. It can effectively address the "cold start" problem and detect novel and unknown risk patterns, improving the model's practicality and robustness.

[0016] 3. This approach combines the gradient attribution capabilities of deep learning models with the natural language reasoning and knowledge integration capabilities of Large Language Models (LLMs). After risk assessment, it not only automatically identifies key abnormal operation nodes leading to high risks but also drives the LLM to generate structured natural language risk attribution reports. These reports clearly identify abnormal operations, specific security rule violations, associated risk patterns, and targeted remediation recommendations, upgrading traditional "black-box warnings" to "white-box analysis." This significantly improves the efficiency and accuracy of security operations personnel's assessments and responses, while simultaneously meeting the compliance requirements of high-level security audits for traceable operations and explainable decisions. Attached Figure Description

[0017] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be understood that the step numbers used in the text are for ease of description only and are not intended to limit the order in which the steps are performed.

[0020] It should be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0021] The terms “comprising” and “including” indicate the presence of the described feature, whole, step, operation, element and / or component, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or collections thereof.

[0022] The term “and / or” refers to any combination of one or more of the associated listed items, as well as all possible combinations, and includes these combinations.

[0023] Example 1: To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in conjunction with specific embodiments of the present application and with reference to the accompanying drawings.

[0024] To address the problems in existing technologies, this invention provides a method for predicting and attributing risks in power system accounts, comprising the following steps: Information processing is performed on the multi-source behavior logs of the target account in the power business system to obtain a structured behavior sequence; The steps for processing the information in the multi-source behavior logs include: The system collects operation command logs, network session logs, and permission change logs. Operation command logs are collected from the operations and maintenance bastion host, obtaining all command-line operation records executed by the account (such as SSH, RDP, and kubectl commands), including precise timestamps and operation command text. Network session logs are collected from network traffic probes or network devices supporting Netflow / sFlow, including source / destination IP, port, protocol, traffic volume, and session start and end times, used to correlate the network behavior behind the operations. Permission change logs are collected from the unified identity authentication (IAM) system and the cloud management platform API gateway, obtaining account role and permission policy change logs from IAM, and API call records such as resource creation, deletion, and configuration changes from the cloud management platform.

[0025] Operational semantic features, temporal features, and resource context features are extracted from the logs using an operational semantic encoder, a temporal pattern encoder, and a resource association encoder, respectively; wherein: The operation semantic encoder uses a language model, such as PowerBERT, pre-trained on professional texts like the "Guidelines for Cybersecurity Protection in the Power Industry" and the "Operation and Maintenance Procedures for Dispatch Automation Systems," as its foundation. It introduces a domain-knowledge-guided attention mechanism within the PowerBERT model. Specifically, it constructs a vocabulary of key power operation and maintenance actions (e.g., "delete," "restart," "exceeding authority," "bypass"). During model training and inference, when these words appear in the input text, an auxiliary attention mask mechanism enhances the model's focus on these high-risk words and their contextual combinations. The operation semantic encoder encodes the operation command text in the operation instruction log, outputting an operation semantic feature vector. ; The temporal pattern encoder, through a designed multi-scale periodic perception module, first converts the operation timestamp sequence into multi-dimensional periodic features containing "second-minute-hour-week". Then, it inputs a parallel dilated causal convolutional network. One convolutional kernel is larger to capture long-term patterns measured in "days" or "weeks," while the other kernel is smaller to capture short-term dense patterns at the minute / hour level. The two outputs are then fused to obtain the temporal feature vector. The technical effect of this design is that it can more accurately model the normal cyclical patterns of account behavior, thereby having a higher sensitivity to behaviors that occur at abnormal times (such as late at night) but may appear normal in terms of operational semantics (such as system login), and improving the model's ability to detect highly concealed temporal anomaly attacks.

[0026] The resource association encoder differs from traditional knowledge graph embedding (such as TransE) in that it is static and cannot represent the dynamic importance of resources within a single session. This embodiment addresses the problem that traditional static knowledge graph embedding cannot reflect the dynamic and temporary relationships between resources in a single session by constructing a dynamic resource graph within the session and learning representations using a graph attention network (GAT). Specifically, for each independent operation and maintenance session, a dynamic resource graph within the session is constructed in real time. Its nodes are all resource entities accessed in the session (such as server A, database B, and configuration file C), and the edges are dynamically generated from the operation logs of the session, representing the access relationships between resources (such as "accessed" and "modified"). The GAT learns the representations of each node in this dynamic graph. The initial feature of a node is its type encoding (such as "database" and "configuration file"). The GAT aggregates neighbor node information through an attention mechanism, so that the same resource can obtain different vector representations in different sessions (due to different access patterns). Finally, the GAT node vector of the operated resource is used as the resource context feature. The technical advantage of this design lies in its ability to accurately depict the dynamic context of resources being accessed step by step in a potential attack chain. For example, it can distinguish the different risk implications of the "database" resource in two scenarios: "normal access to the database" and "access to the database after scanning ports." This effectively identifies lateral movement attacks based on resource dependencies and enhances the model's ability to understand the context of complex, multi-step attack chains.

[0027] The semantic features of operations, temporal context features, and resource association features are fused to form a structured sequence of behaviors. Specifically, this involves merging related behaviors at the same time or for the same operation. , and By concatenating the vectors, we obtain the fused behavioral unit vector. .Will Arranged chronologically, these constitute a structured sequence of account behaviors.

[0028] Based on structured behavior sequences, a dynamic behavior graph is constructed, and a graph representation of the dynamic behavior pattern of the target account is learned based on a graph neural network. In this embodiment, a linear sequence of actions is transformed into a graph structure that can characterize the complex relationships between operations, and its overall representation is learned. The specific steps are as follows: In this embodiment, a structured behavior sequence within a 15-minute period is taken as input and a graph is constructed using a sliding window. Each fused behavior unit vector is then... Treat it as a behavioral unit node in the graph, and construct directed edges according to the following rules: Temporally adjacent edges: Edges are established between two temporally consecutive behavioral unit nodes.

[0029] Logical causal edge: If the output resource of behavior A (such as "scanning ports") is the input resource of behavior B (such as "connecting to a database"), then an edge is established between nodes A and B.

[0030] Resource co-occurrence edge: An edge is established between nodes that perform different actions on the same critical resource (such as the core database IP).

[0031] Simultaneously, an account summary node is added to the graph, with its initial feature being the account's role ID code. This node is connected to all behavioral unit nodes within the window. It integrates global information at the account level (such as the role ID) and, by connecting to all behavioral nodes, propagates account identity attributes to specific operation nodes during message passing. This allows the final learned graph representation to distinguish "similar operation sequences from different accounts." Thus, a dynamic behavioral graph containing multiple relationship types is constructed. .

[0032] In a preferred embodiment of this invention, a graph representation is obtained based on graph neural network learning. This is achieved using a message-passing-based graph neural network, where node features are updated by aggregating the features of their neighboring nodes and combining their own features. Furthermore, the aggregation operation differentiates neighboring node features based on edge types. In this embodiment, a relational graph convolutional network (R-GCN) is used to process the dynamic behavior graph. Representation learning is performed by R-GCN updating node features through multiple rounds of message passing. For each node i in the graph, its features at layer l+1 are... It is obtained by aggregating its features at layer l and the features of its neighboring nodes, and the specific formula is as follows: ; In the formula: R is the set of edge types; Let i be the set of neighbors of node i under relation r; , For the learnable weight matrix of relation r and self-loop; The normalization constant is taken as a value in this embodiment. ; For activation functions; Let j be the feature of the neighbor node j at layer l.

[0033] After L-layer propagation, graph-level pooling is performed on the final layer features of all nodes in the entire graph to obtain a graph representation of the overall account behavior pattern during that period. .

[0034] The graph representation is encoded into behavioral pattern feature vectors through a prototype learning network; wherein, the prototype learning network is trained by combining contrastive loss and prototype alignment loss, so that different types of behavioral pattern feature vectors are clustered into corresponding safety or risk prototype vectors in a pre-constructed risk representation space. In this embodiment, by analyzing historical data, both normal and risky accounts are analyzed separately. K-Means clustering was performed, and the cluster centers of normal samples constituted the baseline safety prototype set. The cluster centers of risk samples constitute a set of known risk prototypes. For example, a security prototype might correspond to normal work modes such as routine inspections and work order processing, while a risk prototype might correspond to risk modes such as data theft and privilege escalation.

[0035] The prototype learning network is trained by constructing a joint loss function, which includes: Contrast loss is used to narrow the distance between the feature vectors of behavioral patterns of the same normal account at different time periods, and to widen the distance between them and the feature vectors of behavioral patterns of risky accounts. Specifically, contrast loss uses triple loss for an anchor sample, ensuring that its distance to a positive sample is less than its distance to a negative sample by a boundary value. The specific calculation function is as follows: ; In the formula: To compare the loss values; N is the total number of triples in a training batch; These are the behavioral pattern feature vectors of the anchor sample, positive sample, and negative sample in the i-th triplet, respectively. The anchor and positive samples come from different time periods of the same normal account, while the negative samples come from risky accounts. The distance metric function is Euclidean distance, which is used in this embodiment. This is a boundary value hyperparameter greater than 0. This loss function encourages that the distance between the anchor point and the positive sample is at least smaller than the distance between the anchor point and the negative sample.

[0036] Prototype alignment loss is used to drive behavioral pattern feature vectors to converge towards the nearest prototype vector in the risk representation space. Specifically, for each sample's behavioral pattern feature vector... Calculate the nearest prototype in the prototype set of its category. The sum of squared Euclidean distances. This loss forces the behavioral pattern feature vectors to cluster around their respective prototypes by category within the risk representation space. The specific calculation function is: ; In the formula: This represents the prototype alignment loss value. Let a be the behavioral pattern feature vector of the a-th sample; for The closest prototype vector in the prototype set corresponding to the label.

[0037] The specific formula for calculating the joint loss function is as follows: ; In the formula: L is the joint loss function; is a hyperparameter used to balance the two losses. By optimizing this joint loss, the risk representation space learned by the model has a clear geometric structure: safe behaviors cluster around safe prototypes, and risky behaviors cluster around risky prototypes, with the two clusters being separate from each other.

[0038] Through the trained prototype learning network Mapped to behavioral pattern feature vectors ( ); For the encoding operation of the prototype learning network, in this embodiment, the encoder in the prototype learning network... A multilayer perceptron structure based on residual connections and layer normalization is adopted to address the gradient vanishing or representation degradation problems that may occur during deep network training, ensuring the integrity of the graph representation. The encoder achieves high coding quality. Specifically, it consists of three sequentially connected residual blocks, each containing a fully connected layer, a layer normalization layer, and an activation function. The output of the previous residual block is added to the input of the next residual block, forming a short-circuit connection. This structure can be represented by the following formula: ; ; ; In the formula: , , These are the outputs of the three residual blocks; , These are learnable parameters; For activation functions; This is a layer normalization operation. Residual connections ensure the effective flow of gradients during backpropagation, while layer normalization accelerates training convergence and stabilizes the activation value distribution. Together, these two aspects enable the encoder to learn the complex nonlinear mapping from the graph representation to the risk representation space more stably and effectively, thereby improving the representational ability of the final behavioral pattern feature vector and the overall training efficiency of the model.

[0039] In this embodiment, the joint loss function is optimized. The encoder of the prototype learning network is trained to represent the graph. This is mapped to our desired risk representation space. In this process: The pre-computed prototype vector , As fixed anchor points in this space, regional centers for "typical safety" and "typical risk" were defined respectively.

[0040] Prototype alignment loss This directly drives the behavioral pattern feature vector of each training sample to move toward the nearest anchor point of its category, thereby forming a "cluster" around the anchor point.

[0041] Comparative loss This imposes constraints on the triplet relationship, requiring not only the aggregation of security behaviors within the same account, but also maintaining at least one boundary value between different clusters (i.e., between security clusters and risk clusters). The distance is such that the spatial structure is clear and different categories of areas are well separated.

[0042] After training, the risk representation space is successfully constructed: it is a space generated by the encoder. The defined mapping space, where the safety prototype and risk prototype serve as cluster centers, with similar behavioral feature vectors clustered around them, and dissimilar clusters far apart. Any new graph representation is... After mapping, its position in this space directly represents its risk attribute.

[0043] Risk is quantified based on behavioral pattern feature vectors, and the risk quantification results and dynamic behavior graphs drive a large language model to perform interpretable attribution analysis and generate risk reports.

[0044] In this embodiment, risk quantification based on behavioral pattern feature vectors specifically involves: for the account behavior to be evaluated, obtaining its behavioral pattern feature vector. Then, it is calculated to be comparable to the most recent security prototype. and recent risk prototypes European distance and ,based on and The specific formula for calculating the risk score is as follows: ; In the formula: To score risk, The closer a value is to 1, the more the behavior pattern deviates from the safe cluster and the closer it is to the risky cluster, and the higher the risk. The scaling factor is a preset hyperparameter greater than 0, used to adjust the risk score for distance difference. Sensitivity, in practical applications, The specific values ​​are determined by adjusting them on the validation set to achieve the optimal discrimination effect of the risk score distribution.

[0045] After obtaining the risk score, this embodiment further introduces an adaptive scoring calibration mechanism based on historical risk distribution to address the issue of inconsistent alert sensitivity of fixed thresholds during different business periods, such as peak business hours and maintenance windows, or for different account roles, such as senior administrators and ordinary maintenance personnel. Specifically, a histogram of the score distribution for all accounts within a historical time period is collected. For the account to be evaluated, a subset of the corresponding historical risk score distribution is first selected based on its role attributes and operation time period. Subsequently, the percentile of this subset distribution is calculated. The calculated score is compared with this dynamic percentile threshold; if it exceeds the threshold, a high-risk alarm is triggered. The specific calculation process is as follows: Let the account to be evaluated be u, and its calculated original risk score be... The account's role attributes are: The business time period in which the operation occurred is (For example, it can be discretized into "peak business hours", "maintenance window", "nighttime", etc.).

[0046] Collect a time-series dataset D containing ratings for all accounts evaluated over the past W=30 days: ; In the formula: The timestamp for the risk score generation; N is the total number of historical risk score samples.

[0047] For account u, a subset of reference group ratings similar to its role and time period is selected from D. : ; This step ensures that the calibration benchmark and the account to be evaluated are in the same business context.

[0048] Based on subsets Calculate the specified percentile threshold. In this embodiment, the required warning percentile is p=0.95, so the dynamic threshold... Defined as: ; In the formula, To calculate the p-quantile function of the set, when p=0.95, This indicates that, in similar contexts, 95% of historical behavioral risk scores were below this value.

[0049] Final binary risk assessment By comparing the original scores with the dynamic threshold, we can conclude that: .

[0050] This mechanism transforms absolute risk scores into deviations relative to the normal behavioral background of "similar" entities, enabling dynamic adaptive adjustment of warning thresholds. This significantly reduces false alarms caused by cyclical business changes or inherent differences in role permissions, making risk warnings more aligned with the actual business context and improving the accuracy of control measures.

[0051] When a high-risk alarm is triggered, attribution analysis is initiated, and the specific steps include: Locating key nodes: Calculating dynamic behavior graphs In the middle, the final layer features of each behavioral unit node (corresponding to a specific operation) Risk scoring The contribution is determined by the number of nodes. The top 2-3 nodes with the highest contribution are identified as key abnormal behavior nodes. For example, nodes like "abnormal login time" and "attempt to read sensitive files" might be identified. The contribution is calculated by taking the gradient of the final layer feature vector of a node in the dynamic behavior graph with respect to the risk score, and then using the L2 norm of that gradient. The specific formula for calculating the contribution is as follows: ; In the formula: For dynamic behavior graphs The contribution of the i-th behavioral unit node to the final risk score; The risk score corresponds to the final layer feature vector of the corresponding node. The gradient; is the L2 norm of the vector, used to quantify the overall size of the gradient vector.

[0052] The large language model generates a report by extracting the original operation command, time, involved resources, and direct neighbor node information in the constructed dynamic behavior graph from the key abnormal behavior nodes located in the localized data. This data is then combined with a preset prompt word template and input into the large language model (ChatGLM3-6B is used in this embodiment). An example of the prompt word template is shown below: "You are a power network security analyst. Based on the following structured behavior log fragment, analyze the security risks present: {Key Nodes and Neighborhood Information JSON}. Please identify the 1-2 most suspicious operations, explain why they are abnormal in conjunction with power industry security standards (such as 'principle of least privilege' and 'operation and maintenance operation audit requirements'), and provide handling suggestions (such as 'immediately terminate the session' or 'review account permissions'). Your answer should be concise and professional." Report Generation: Based on its internalized security knowledge and reasoning ability, the large language model outputs a risk attribution report in natural language, such as: "Account sys_admin_01 was detected logging in from an uncommon IP outside of working hours (02:30) and attempting to read the critical system file / etc / shadow. This behavior violates the security guidelines of 'maintenance operations should be performed during working hours' and 'unnecessary access to core system files is prohibited,' and is consistent with the risk pattern of 'malicious insider theft.' Recommendation: Immediately lock this account session and initiate a security audit." Example 2: This embodiment provides a power system account risk prediction and attribution system, including: The data processing module processes the multi-source behavior logs of the target account in the power business system to obtain a structured behavior sequence. The behavior pattern graphing module constructs a dynamic behavior graph based on structured behavior sequences and learns a graph representation of the target account's dynamic behavior patterns based on graph neural networks. The behavior encoding module encodes the graph representation into behavior pattern feature vectors through a prototype learning network; wherein, the prototype learning network is trained by combining contrastive loss and prototype alignment loss, so that different types of behavior pattern feature vectors are clustered into corresponding safety or risk prototype vectors in a pre-constructed risk representation space. The risk quantification and attribution module quantifies risk based on behavioral pattern feature vectors, and drives a large language model to perform interpretable attribution analysis based on the risk quantification results and dynamic behavior graphs, generating a risk report.

[0053] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, A and B simultaneously, or B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of singular or plural items. For example, at least one of a, b, and c can represent: a, b, c, a and b, a and c, b and c, or a and b and c, where a, b, and c can be single or multiple.

[0054] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0055] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0056] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0057] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A method for predicting and attributing account risks in a power system, characterized in that, Includes the following steps: Information processing is performed on the multi-source behavior logs of the target account in the power business system to obtain a structured behavior sequence; Based on structured behavior sequences, a dynamic behavior graph is constructed, and a graph representation of the dynamic behavior pattern of the target account is learned based on a graph neural network. The graph representation is encoded into behavioral pattern feature vectors through a prototype learning network; wherein, the prototype learning network is trained by combining contrastive loss and prototype alignment loss, so that different types of behavioral pattern feature vectors are clustered into corresponding safety or risk prototype vectors in a pre-constructed risk representation space. Risk is quantified based on behavioral pattern feature vectors, and the risk quantification results and dynamic behavior graphs drive a large language model to perform interpretable attribution analysis and generate risk reports.

2. The method for predicting and attributing power system account risks according to claim 1, characterized in that: The information processing of multi-source behavior logs specifically includes: Collect operation command logs, network session logs, and permission change logs; Operational semantic features, temporal pattern features, and resource context features are extracted from the logs by using an operational semantic encoder, a temporal pattern encoder, and a resource association encoder, respectively. By fusing operational semantic features, temporal pattern features, and resource context features, a structured behavior sequence is formed.

3. The method for predicting and attributing power system account risks according to claim 2, characterized in that: The operation semantic encoder employs a language model pre-trained on power domain text and introduces a domain knowledge-guided attention mechanism to enhance the pre-trained language model's semantic understanding and attention to high-risk operation instructions and their context in the power operation and maintenance field. The temporal pattern encoder uses a multi-scale periodic perception module to convert operation timestamp sequences into multi-dimensional periodic features, and then extracts long- and short-term temporal patterns through a parallel dilated causal convolutional network. The resource association encoder is implemented by constructing an in-session dynamic resource graph and combining it with a graph attention network. The nodes of the in-session dynamic resource graph are the resource entities accessed in a single session, and the edges are the resource access relationships reflected in the operation instruction log. The graph attention network is used to learn the dynamic representation of nodes in the in-session dynamic resource graph.

4. The method for predicting and attributing power system account risks according to claim 1, characterized in that: The construction of the dynamic behavior graph specifically includes: using the behavior units in the structured behavior sequence within the sliding window as nodes, and using the temporal adjacency, logical causality, and resource co-occurrence relationships between behavior units as edges to construct an initial graph; and adding an account summary node connected to all behavior unit nodes in the graph to introduce account identity information.

5. The method for predicting and attributing power system account risks according to claim 4, characterized in that: The graph representation is obtained based on graph neural network learning, and a message-passing-based graph neural network is used. The node feature is updated by aggregating the features of its neighboring nodes and combining its own features. The aggregation operation distinguishes the features of neighboring nodes based on the different types of edges.

6. The method for predicting and attributing power system account risks according to claim 1, characterized in that: The contrast loss employs Triplet Loss, which is used to narrow the distance between the behavioral pattern feature vectors of the same normal account at different time periods and widen the distance between them and the behavioral pattern feature vectors of risky accounts. The prototype alignment loss is the sum of the squared Euclidean distances between the behavioral pattern feature vectors of all samples in the training batch and the nearest prototype in the prototype set of their respective categories, which is used to drive the behavioral pattern feature vectors to move closer to the nearest prototype vector in the risk representation space.

7. The method for predicting and attributing power system account risks according to claim 1, characterized in that: The risk quantification based on behavioral pattern feature vectors specifically involves calculating the distances from the behavioral pattern feature vectors to the nearest safe prototype and the nearest risk prototype. and And calculate the risk score using a formula. ,in, This is the scaling factor.

8. The method for predicting and attributing power system account risks according to claim 1, characterized in that: The driving force for interpretable attribution analysis of the large language model specifically includes: Calculate the contribution of each node in the dynamic behavior graph to the risk score, and locate key abnormal behavior nodes based on the contribution. Extract the contextual information of key abnormal behavior nodes and their neighborhoods to construct a structured prompt word input large language model; Receive natural language risk attribution reports generated by large language models.

9. The method for predicting and attributing power system account risks according to claim 8, characterized in that: The contribution is calculated by plotting the gradient of the final layer feature vector of a node in the dynamic behavior graph with respect to the risk score, and the L2 norm of this gradient is used as the contribution of that node to the risk score.

10. A power system account risk prediction and attribution system, characterized in that, include: The data processing module processes the multi-source behavior logs of the target account in the power business system to obtain a structured behavior sequence. The behavior pattern graphing module constructs a dynamic behavior graph based on structured behavior sequences and learns a graph representation of the target account's dynamic behavior patterns based on graph neural networks. The behavior encoding module encodes the graph representation into behavior pattern feature vectors through a prototype learning network; wherein, the prototype learning network is trained by combining contrastive loss and prototype alignment loss, so that different types of behavior pattern feature vectors are clustered into corresponding safety or risk prototype vectors in a pre-constructed risk representation space. The risk quantification and attribution module quantifies risk based on behavioral pattern feature vectors, and drives a large language model to perform interpretable attribution analysis based on the risk quantification results and dynamic behavior graphs, generating a risk report.

Images