Power network target range hybrid intrusion identification method based on multi-node cooperation

Abstract

The application relates to the technical field of network security, in particular to a power network target range mixed intrusion identification method based on multi-node cooperation, which comprises the following steps: respectively pre-processing security data to obtain corresponding first security data; obtaining feature information corresponding to nodes; analyzing the feature information corresponding to the nodes to obtain local alarm information of the nodes; performing space-time correlation on the local alarm information of the multiple nodes to obtain global alarm information; performing fusion according to the feature information corresponding to the multiple nodes and a preset fusion algorithm to obtain fusion feature information; and obtaining a mixed intrusion identification result based on the global alarm information, the fusion feature information and a preset mixed intrusion identification model. The application can obtain global alarm information and fusion feature information by analyzing multi-node data, and can realize comprehensive discrimination of mixed intrusion by combining a preset mixed intrusion identification model, so that the identification precision is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a hybrid intrusion identification method for power network test ranges based on multi-node collaboration. Background Technology

[0002] Power network test ranges are crucial infrastructure for simulating real power system network environments, conducting cybersecurity attack and defense drills, and verifying protection technologies. As the digitalization and intelligence of power systems continue to increase, core business systems such as power monitoring systems, dispatch automation systems, and distribution automation systems are gradually evolving from closed, isolated dedicated networks to interconnected, open network architectures. This makes the security threats facing power networks increasingly complex.

[0003] Currently, intrusions targeting power grids are showing a diversified trend. Attackers may use various methods such as network scanning, malicious code injection, vulnerability exploitation, privilege escalation, and data tampering to carry out attacks.

[0004] Traditional identification methods rely on a single identification approach, employing a single classifier or detection engine, making it difficult to accurately identify intrusion behavior from complex data. Summary of the Invention

[0005] (a) Purpose of the invention The purpose of this invention is to provide a hybrid intrusion identification method for power network test ranges based on multi-node collaboration. By analyzing multi-node data, global alarm information and fused feature information are obtained. Combined with a preset hybrid intrusion identification model, a comprehensive judgment of hybrid intrusions is achieved, thereby improving the identification accuracy.

[0006] (II) Technical Solution To address the above problems, this invention provides a hybrid intrusion identification method for power network test ranges based on multi-node collaboration, comprising: The security data collected from multiple nodes are preprocessed to obtain the first security data corresponding to each node. Feature extraction is performed on each of the first security data to obtain the feature information corresponding to the node; The feature information corresponding to the node is analyzed to obtain the local alarm information of the node; By spatiotemporally correlating local alarm information from multiple nodes, global alarm information can be obtained. Based on the feature information corresponding to multiple nodes and the preset fusion algorithm, the fusion is performed to obtain fused feature information; Based on the global alarm information, fused feature information, and the preset hybrid intrusion identification model, hybrid intrusion identification results are obtained.

[0007] In another aspect of the present invention, preferably, the security data includes: network communication data, operating status data, and log data; The step of preprocessing the security data collected from multiple nodes to obtain the corresponding first security data includes: Remove invalid, duplicate, and noise information from the security data to obtain cleaned security data; The cleaned security data is then timestamped and converted to a unit to obtain the converted security data. The converted security data is aligned according to a time window to obtain aligned security data; The aligned security data is then processed for outliers to obtain the corresponding first security data.

[0008] In another aspect of the present invention, preferably, the feature information includes: traffic features, abnormal behavior features, and log features; The step of extracting features from each of the first security data to obtain feature information corresponding to the node includes: The number of packets, the number of bytes, and the distribution of data flow direction of the network communication data are statistically analyzed to generate traffic characteristics; Based on a preset abnormal behavior feature recognition algorithm, the running status data is analyzed to obtain abnormal behavior features; The event types, time intervals, error code distributions, and user operation behavior patterns of the log data are statistically analyzed to generate log features.

[0009] In another aspect of the present invention, preferably, the analysis of the operational status data based on a preset node historical behavior model to obtain abnormal behavior characteristics includes: Statistical analysis is performed on the operational status data to generate statistical indicators, including mean, variance, peak value, and rate of change. The statistical indicators are compared with the corresponding preset threshold ranges to identify abnormal indicators that exceed the threshold ranges. Based on the operational status data corresponding to the abnormal indicators, pattern matching is performed to determine the type of abnormal behavior; Based on the operational status data corresponding to the abnormal behavior types and abnormal indicators, abnormal behavior feature parameters are obtained, whereby the abnormal behavior types and abnormal behavior feature parameters are abnormal behavior features.

[0010] In another aspect of the present invention, preferably, the step of analyzing the feature information corresponding to the node to obtain the node's local alarm information includes: The traffic characteristics, abnormal behavior characteristics, and log characteristics are input into a preset node-local anomaly detection model to obtain the node's local alarm information. The node-local anomaly detection model is constructed based on a single-class support vector machine algorithm.

[0011] In another aspect of the present invention, preferably, the step of spatiotemporally correlating the local alarm information of multiple nodes to obtain global alarm information includes: Based on the preset network topology, establish spatiotemporal association rules between nodes; Collect local alarm information from multiple nodes within a preset time window; Based on the aforementioned spatiotemporal correlation rules, each local alarm information is analyzed to identify alarm sequences with mixed intrusion characteristics; The alarm sequences are integrated to obtain global alarm information.

[0012] In another aspect of the present invention, preferably, the step of fusing the feature information corresponding to multiple nodes and a preset fusion algorithm to obtain fused feature information includes: Align the feature information corresponding to multiple nodes according to timestamps to obtain a multi-node feature matrix; Correlation analysis is performed on the multi-node feature matrix to calculate the correlation coefficients of each feature dimension between different nodes; Based on the correlation coefficient, a strongly correlated feature group with a correlation exceeding a preset threshold is obtained; Principal component analysis was performed on the strongly correlated feature groups to extract the principal component features of each strongly correlated feature group; The principal component features are concatenated with the feature information that did not enter the strongly correlated feature group to obtain the fused feature information.

[0013] In another aspect of the present invention, preferably, the step of performing principal component analysis on the strongly correlated feature groups to extract the principal component features of each strongly correlated feature group includes: Normalize the feature data within each strongly correlated feature group to obtain normalized feature data; Calculate the covariance matrix of the normalized feature data, and solve for the eigenvalues ​​of the covariance matrix and the eigenvectors corresponding to each eigenvalue; The eigenvectors are sorted in descending order according to the magnitude of the eigenvalues, and the cumulative variance contribution rate of each eigenvalue is calculated. The principal component transformation matrix is ​​constructed from the eigenvectors corresponding to the first k eigenvalues ​​whose cumulative variance contribution rate is greater than or equal to a preset threshold. The normalized feature data is multiplied by the principal component transformation matrix to obtain the principal component features.

[0014] In another aspect of the present invention, preferably, the preset hybrid intrusion detection model is based on an ensemble model of multiple classifiers, wherein the multiple base classifiers include support vector machines, random forests, and gradient boosting trees.

[0015] In another aspect of the present invention, preferably, obtaining the hybrid intrusion identification result based on the global alarm information, fused feature information, and a preset hybrid intrusion identification model includes: The alarm feature information and the fused feature information are concatenated to form comprehensive identification feature information; The comprehensive identification feature information is input into a pre-trained, preset hybrid intrusion identification model, and multiple preliminary identification results are output. The multiple preliminary identification results are voted on to obtain a hybrid intrusion identification result.

[0016] (III) Beneficial Effects The above-described technical solution of the present invention has the following beneficial technical effects: This invention extracts features from security data from multiple nodes and performs spatiotemporal correlation analysis on local alarm information from multiple nodes to obtain global alarm information. This effectively identifies complex attack behaviors that cross nodes and span time, avoiding false positives or false negatives caused by single-point detection. Furthermore, by fusing feature information from multiple nodes, it improves the ability to identify hybrid intrusion behaviors that are highly concealed and lack distinct phase characteristics. By combining global alarm information and fused feature information into a pre-defined hybrid intrusion identification model, a comprehensive judgment of hybrid intrusions is achieved, improving identification accuracy. Attached Figure Description

[0017] Figure 1 This is an overall flowchart of one embodiment of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments and the accompanying drawings. It should be understood that these descriptions are merely exemplary and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0019] Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0020] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0021] Example 1 A hybrid intrusion detection method for power network test ranges based on multi-node collaboration. Figure 1 An overall flowchart of one embodiment of the present invention is shown, as follows: Figure 1 As shown, it includes: Security data collected from multiple nodes is preprocessed to obtain corresponding first security data. Nodes can be master stations, substation monitoring units, edge acquisition terminals, or virtual simulation nodes in a power network test range. Security data includes: network communication data, operational status data, and log data. In this embodiment, preprocessing includes: removing invalid, duplicate, and noise information from the security data collected by each node to obtain cleaned security data; for invalid information, filtering can be performed based on preset data integrity rules, such as deleting data records with a field missing rate exceeding a set threshold, such as 30%, or removing empty data; for duplicate information, identification and deletion are performed; for noise information, filtering or smoothing methods can be used, such as using moving average filtering, median filtering, or wavelet transform-based denoising methods for continuous time series data to reduce the impact of random fluctuations on subsequent analysis. For log-type text data, irrelevant fields can also be removed using regular expressions or keyword matching.

[0022] The cleaned security data is then timestamped and converted to a unit to obtain converted security data. Timestamping involves converting the local time used by different nodes into a standard time format, and unit conversion involves standardizing different types of data, such as converting network bandwidth to Mbps.

[0023] The converted security data is aligned according to a time window to obtain aligned security data; a fixed-length time window can be set, such as 1 second, 5 seconds or 10 seconds, and the data can be segmented in the form of a sliding window or a scrolling window.

[0024] The aligned secure data is then processed for outliers to obtain the corresponding first secure data. For numerical data, outlier identification can be performed using statistical methods.

[0025] Feature extraction is performed on each of the first security data to obtain the feature information corresponding to the node. Feature extraction can be performed in various ways, including methods based on statistical analysis, methods based on time series analysis, and methods based on deep learning. In this embodiment, the feature information includes: traffic features, abnormal behavior features, and log features. The step of performing feature extraction on each of the first security data to obtain the feature information corresponding to the node includes: The system statistically analyzes the number of packets, bytes, and data flow direction distribution of the network communication data to generate traffic characteristics. It can segment the network data based on a preset time window (e.g., 1 second or 5 seconds), and within each time window, it statistically analyzes basic statistics such as the number of packets, total bytes, average packet length, and peak packet length. Simultaneously, it distinguishes the data flow direction, for example, classifying it according to inbound and outbound traffic, and statistically analyzing their proportional relationship and changing trends. Based on a preset abnormal behavior feature recognition algorithm, the operating status data is analyzed to obtain abnormal behavior features, including: Statistical analysis is performed on the operational status data to generate statistical indicators, including mean, variance, peak value, and rate of change. The operational status data may include equipment operating parameters such as CPU utilization, memory usage, number of processes, voltage, current, frequency, and control execution status data. For each type of operational status data, statistical calculations can be performed within a preset time window (e.g., 1 second, 5 seconds, or 10 seconds) to obtain the corresponding statistical indicators. The mean characterizes the average level of the data within the time window; the variance reflects the degree of data fluctuation; the peak value characterizes the maximum or minimum extreme values; and the rate of change can be calculated by the difference or slope between adjacent time points to describe the trend and degree of abrupt change in the data.

[0026] The statistical indicators are compared with corresponding preset threshold ranges to identify abnormal indicators that exceed the threshold ranges. For different types of operating status parameters, corresponding threshold ranges can be preset. These threshold ranges can be obtained based on historical normal operating data statistics, for example, determined by the mean ± k times the standard deviation (k is a preset coefficient), or by setting upper and lower limits based on expert experience. In the actual comparison process, each current statistical indicator is compared with its corresponding threshold range. When a statistical indicator exceeds the upper limit or falls below the lower limit, it is determined to be an abnormal indicator.

[0027] Based on the operational status data corresponding to the abnormal indicators, pattern matching is performed to determine the type of abnormal behavior. An abnormal behavior pattern library can be constructed, which pre-stores various typical abnormal behavior patterns and their corresponding feature rules, such as sudden load anomalies, continuous high utilization anomalies, periodic fluctuation anomalies, and abnormal command-triggered behaviors. The pattern matching process can be performed through similarity calculations, such as Euclidean distance and cosine similarity.

[0028] Based on the operational status data corresponding to the abnormal behavior types and abnormal indicators, abnormal behavior characteristic parameters are obtained. The abnormal behavior types and abnormal behavior characteristic parameters constitute abnormal behavior characteristics. Abnormal behavior characteristic parameters may include information such as the time of occurrence of the abnormality, duration, magnitude of the abnormality, rate of change, types of key parameters involved, and their corresponding values.

[0029] The log data is statistically analyzed for event types, time intervals, error code distribution, and user operation behavior patterns to generate log features. The log data is parsed, converting unstructured text into structured information, such as extracting fields like timestamps, event types, event levels, error codes, and user identifiers. Then, the frequency of different event types, the distribution of various error codes, and the number of event triggers per unit time are statistically analyzed. Simultaneously, the time interval between adjacent log events is calculated to analyze the density and suddenness of event occurrences. For user operation behavior, user behavior patterns can be constructed by analyzing operation sequences, such as login, configuration modification, and command execution. For example, sequence patterns can be used to mine typical operation paths and identify abnormal behaviors that deviate from the normal path.

[0030] The feature information corresponding to the node is analyzed to obtain the node's local alarm information, including: The traffic features, abnormal behavior features, and log features are input into a preset local anomaly detection model on the node to obtain the node's local alarm information. This local anomaly detection model is constructed based on a single-class support vector machine (SVM) algorithm. The traffic features, abnormal behavior features, and log features are vectorized to form a unified multi-dimensional feature vector. For categorical features, such as log event types and abnormal behavior types, they can be converted into numerical representations using one-hot encoding or label encoding to obtain a standard feature vector suitable for model input. The single-class SVM algorithm can use a radial basis function as its kernel function and is obtained by training on historical normal operation data. The local anomaly detection model outputs the corresponding discrimination result as the node's local alarm information.

[0031] By spatiotemporally correlating local alarm information from multiple nodes to obtain global alarm information, alarms from different nodes can be aligned based on a time window mechanism, and an alarm correlation graph can be constructed by combining the topological or communication relationships between nodes. This embodiment includes: Based on a pre-defined network topology, spatiotemporal correlation rules are established between nodes. According to the actual deployment structure of the power network testbed, a topology graph is constructed between nodes, including master station systems, substation monitoring units, edge acquisition terminals, and virtual simulation nodes. These topology relationships can be described through physical connections or logical communication relationships. Furthermore, the spatiotemporal correlation rules include time correlation rules and spatial correlation rules. Time correlation rules are used to limit the temporal correlation between alarms, for example, setting alarms to be considered time-correlated only if they occur within a preset time interval, such as 1 to 30 seconds. Spatial correlation rules are used to describe the propagation relationship between nodes, for example, defining the alarm propagation direction based on network paths, upstream and downstream node relationships, or access dependencies.

[0032] Collect local alarm information from multiple nodes within a preset time window; a fixed or adaptive time window can be set, such as a sliding time window, to summarize the local alarm information reported by all nodes within each time window.

[0033] Based on the spatiotemporal correlation rules, each local alarm information is analyzed to identify alarm sequences with mixed intrusion characteristics. Mixed intrusion characteristics can include the identification of the attack source, which can be determined by combining the source IP address, node identifier, and access path information in the alarms to determine whether multiple alarms originate from the same attack entity; and the identification of the attack path, which can be determined by inferring the propagation path of the attack in the network based on topological relationships, such as the process of gradual diffusion from edge nodes to core nodes. Furthermore, the correlation can be verified by calculating the similarity between each local alarm information, such as feature vector similarity or alarm type consistency. In this embodiment, the method further includes: determining the causal dependency relationship between each local alarm information. The determination of the causal dependency relationship takes the first alarm information and the second alarm information as an example, including: Determine the number of times the first alarm message and the second alarm message co-occur within a preset time window; the length of the time window can be set according to the specific application scenario, such as seconds, minutes or longer time scales.

[0034] Based on the co-occurrence count, the conditional probability between the first alarm message and the second alarm message and the marginal probability of the second alarm message are calculated. The conditional probability can be obtained by the ratio of the co-occurrence count of the first alarm message and the second alarm message to the total number of times the first alarm message appears. The marginal probability of the second alarm message can be calculated by the ratio of the total number of times the second alarm message appears to the total number of local alarm messages.

[0035] Based on preset attack phase sequence constraints, alarm information in the alarm information set is filtered to obtain candidate alarm information pairs. The attack phase sequence constraints can be predefined according to typical attack chain models, such as information gathering, vulnerability exploitation, privilege escalation, lateral movement, and data theft. The alarm information pair is retained as a candidate pair only when the attack phase to which the first alarm information belongs is logically earlier than or equal to the phase to which the second alarm information belongs, thereby avoiding invalid associations that do not conform to the attack evolution law.

[0036] Based on the candidate alarm information pairs, the conditional probability boost value is calculated using the corresponding conditional probability and marginal probability; the conditional probability boost value can be defined as the ratio of the conditional probability to the marginal probability, or as the difference between the two.

[0037] When the conditional probability boost value is greater than a preset boost threshold, a causal dependency is determined between the first alarm message and the second alarm message. When the conditional probability boost value is greater than the preset boost threshold, it indicates that the probability of the second alarm message occurring is significantly higher than its natural occurrence probability given the occurrence of the first alarm message. The boost threshold can be obtained through historical data statistical analysis or empirical setting. By comparing and calculating the conditional probability and the marginal probability, the dependency strength can be quantified, providing a foundation for hybrid intrusion identification.

[0038] The alarm sequences are integrated to obtain global alarm information.

[0039] Based on the feature information corresponding to multiple nodes and a preset fusion algorithm, fusion is performed to obtain fused feature information; the fusion algorithm can employ weighted fusion, principal component analysis, feature concatenation, etc.; in this embodiment, it includes: The feature information corresponding to multiple nodes is aligned according to timestamps to obtain a multi-node feature matrix; based on a unified time window, the traffic features, abnormal behavior features and log features from different nodes are synchronously arranged in chronological order; where the rows of the matrix can represent time windows or sample sequences, and the columns can represent various feature dimensions of different nodes.

[0040] Correlation analysis is performed on the multi-node feature matrix to calculate the correlation coefficients of each feature dimension between different nodes. The Pearson correlation coefficient or Spearman correlation coefficient can be used to measure the correlation between any two feature dimensions, resulting in a correlation coefficient matrix. The correlation coefficients reflect the degree of linear or nonlinear association between features of different nodes. For example, when the correlation coefficient is close to 1 or -1, it indicates a strong positive or negative correlation between the features; when the correlation coefficient is close to 0, it indicates a weak correlation.

[0041] Based on the correlation coefficient, a strongly correlated feature group with a correlation exceeding a preset threshold is obtained; a correlation threshold can be set, such as 0.7 or 0.8, and when the absolute value of the correlation coefficient between any two or more features is greater than the threshold, they are classified into the same strongly correlated feature group.

[0042] Principal component analysis was performed on the strongly correlated feature groups to extract the principal component features of each strongly correlated feature group, including: Normalize the feature data within each strongly correlated feature group to eliminate dimensional differences and obtain normalized feature data; for example, use min-max normalization or Z-score standardization methods.

[0043] Calculate the covariance matrix of the normalized feature data, and solve for the eigenvalues ​​of the covariance matrix and the eigenvectors corresponding to each eigenvalue; specifically, calculate the covariance matrix of the normalized feature data using the covariance matrix formula, and solve for the eigenvalues ​​of the covariance matrix and the eigenvectors corresponding to each eigenvalue using the eigenvalue decomposition formula.

[0044] The eigenvectors are sorted in descending order based on the magnitude of the eigenvalues, and the cumulative variance contribution rate of each eigenvalue is calculated. Specifically, the cumulative variance contribution rate is calculated using the variance contribution rate formula, which measures the degree to which the principal components retain information from the original data.

[0045] The eigenvectors corresponding to the top k eigenvalues ​​whose cumulative variance contribution rate is greater than or equal to a preset threshold, such as 80% or 85%, are used to construct a principal component transformation matrix. The normalized feature data is then multiplied by the principal component transformation matrix to obtain principal component features. This process achieves dimensionality reduction and information compression for strongly correlated feature groups while preserving as much of the original data's main information as possible. The principal component features are then concatenated with feature information not included in strongly correlated feature groups to obtain the fused feature information. Features not classified into strongly correlated feature groups are considered to have strong independence or unique information and are directly retained as original features. The fused feature information retains both the main information of strongly correlated features and the unique information of weakly correlated or independent features.

[0046] Based on the global alarm information, fused feature information, and a preset hybrid intrusion detection model, a hybrid intrusion detection result is obtained. In this embodiment, the preset hybrid intrusion detection model is based on an ensemble model of multiple classifiers, including support vector machines, random forests, and gradient boosting trees. Each base classifier independently receives the comprehensive identification feature information, performs the intrusion detection task, and outputs a preliminary identification result, such as the intrusion type or risk level.

[0047] Furthermore, the process of obtaining a hybrid intrusion identification result based on the global alarm information, fused feature information, and a preset hybrid intrusion identification model includes: The alarm feature information and the fused feature information are combined to form comprehensive identification feature information; at the same time, it reflects cross-node spatiotemporal attack features and multi-node collaborative features, and can provide rich information for intrusion identification.

[0048] The comprehensive identification feature information is input into a pre-trained, preset hybrid intrusion identification model, and multiple preliminary identification results are output. The multiple preliminary identification results are voted on to obtain a hybrid intrusion identification result. Simple majority voting or weighted voting can be used: simple majority voting selects the category predicted by the majority of classifiers as the final identification result; weighted voting assigns weights based on the accuracy or historical performance of each classifier during training, and then determines the final category based on the weighted result. The output obtained through voting is the hybrid intrusion identification result.

[0049] This invention extracts features from security data from multiple nodes and performs spatiotemporal correlation analysis on local alarm information from multiple nodes to obtain global alarm information. This effectively identifies complex attack behaviors that cross nodes and span time, avoiding false positives or false negatives caused by single-point detection. Furthermore, by fusing feature information from multiple nodes, it improves the ability to identify hybrid intrusion behaviors that are highly concealed and lack distinct phase characteristics. By combining global alarm information and fused feature information into a pre-defined hybrid intrusion identification model, a comprehensive judgment of hybrid intrusions is achieved, improving identification accuracy.

[0050] It should be understood that the specific embodiments described above are merely illustrative or explanatory of the principles of the invention and do not constitute a limitation thereof. Therefore, any modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and scope of the invention should be included within the protection scope of the invention. Furthermore, the appended claims are intended to cover all variations and modifications falling within the scope and boundaries of the appended claims, or equivalent forms of such scope and boundaries.

[0051] The present invention has been described above with reference to embodiments thereof. However, these embodiments are merely illustrative and not intended to limit the scope of the invention. The scope of the invention is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the invention, and all such substitutions and modifications should fall within the scope of the invention.

[0052] Although embodiments of the present invention have been described in detail, it should be understood that various changes, substitutions, and modifications can be made to the embodiments of the present invention without departing from the spirit and scope of the invention.

[0053] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A hybrid intrusion identification method for power network test ranges based on multi-node collaboration, characterized in that, include: The security data collected from multiple nodes are preprocessed to obtain the first security data corresponding to each node. Feature extraction is performed on each of the first security data to obtain the feature information corresponding to the node; The feature information corresponding to the node is analyzed to obtain the local alarm information of the node; By spatiotemporally correlating local alarm information from multiple nodes, global alarm information can be obtained. Based on the feature information corresponding to multiple nodes and the preset fusion algorithm, the fusion is performed to obtain fused feature information; Based on the global alarm information, fused feature information, and the preset hybrid intrusion identification model, hybrid intrusion identification results are obtained.

2. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 1, characterized in that, The security data includes: network communication data, operational status data, and log data; The step of preprocessing the security data collected from multiple nodes to obtain the corresponding first security data includes: Remove invalid, duplicate, and noise information from the security data to obtain cleaned security data; The cleaned security data is then timestamped and converted to a unit to obtain the converted security data. The converted security data is aligned according to a time window to obtain aligned security data; The aligned security data is then processed for outliers to obtain the corresponding first security data.

3. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 2, characterized in that, The feature information includes: traffic features, abnormal behavior features, and log features; The step of extracting features from each of the first security data to obtain feature information corresponding to the node includes: The number of packets, the number of bytes, and the distribution of data flow direction of the network communication data are statistically analyzed to generate traffic characteristics; Based on a preset abnormal behavior feature recognition algorithm, the running status data is analyzed to obtain abnormal behavior features; The event types, time intervals, error code distributions, and user operation behavior patterns of the log data are statistically analyzed to generate log features.

4. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 3, characterized in that, The method based on a preset node historical behavior model analyzes the operational status data to obtain abnormal behavior characteristics, including: Statistical analysis is performed on the operational status data to generate statistical indicators, including mean, variance, peak value, and rate of change. The statistical indicators are compared with the corresponding preset threshold ranges to identify abnormal indicators that exceed the threshold ranges. Based on the operational status data corresponding to the abnormal indicators, pattern matching is performed to determine the type of abnormal behavior; Based on the operational status data corresponding to the abnormal behavior types and abnormal indicators, abnormal behavior feature parameters are obtained, whereby the abnormal behavior types and abnormal behavior feature parameters are abnormal behavior features.

5. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 4, characterized in that, The step of analyzing the feature information corresponding to the node to obtain the node's local alarm information includes: The traffic characteristics, abnormal behavior characteristics, and log characteristics are input into a preset node-local anomaly detection model to obtain the node's local alarm information. The node-local anomaly detection model is constructed based on a single-class support vector machine algorithm.

6. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 5, characterized in that, The step of spatiotemporally correlating local alarm information from multiple nodes to obtain global alarm information includes: Based on the preset network topology, establish spatiotemporal association rules between nodes; Collect local alarm information from multiple nodes within a preset time window; Based on the aforementioned spatiotemporal correlation rules, each local alarm information is analyzed to identify alarm sequences with mixed intrusion characteristics; The alarm sequences are integrated to obtain global alarm information.

7. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 6, characterized in that, The step of fusing multiple nodes' corresponding feature information with a preset fusion algorithm to obtain fused feature information includes: Align the feature information corresponding to multiple nodes according to timestamps to obtain a multi-node feature matrix; Correlation analysis is performed on the multi-node feature matrix to calculate the correlation coefficients of each feature dimension between different nodes; Based on the correlation coefficient, a strongly correlated feature group with a correlation exceeding a preset threshold is obtained; Principal component analysis was performed on the strongly correlated feature groups to extract the principal component features of each strongly correlated feature group; The principal component features are concatenated with the feature information that did not enter the strongly correlated feature group to obtain the fused feature information.

8. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 7, characterized in that, The step of performing principal component analysis on the strongly correlated feature groups and extracting the principal component features of each strongly correlated feature group includes: Normalize the feature data within each strongly correlated feature group to obtain normalized feature data; Calculate the covariance matrix of the normalized feature data, and solve for the eigenvalues ​​of the covariance matrix and the eigenvectors corresponding to each eigenvalue; The eigenvectors are sorted in descending order according to the magnitude of the eigenvalues, and the cumulative variance contribution rate of each eigenvalue is calculated. The principal component transformation matrix is ​​constructed from the eigenvectors corresponding to the first k eigenvalues ​​whose cumulative variance contribution rate is greater than or equal to a preset threshold. The normalized feature data is multiplied by the principal component transformation matrix to obtain the principal component features.

9. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 8, characterized in that, The preset hybrid intrusion detection model is based on an ensemble model of multiple classifiers, including support vector machines, random forests, and gradient boosting trees.

10. The hybrid intrusion identification method for power network test ranges based on multi-node collaboration according to claim 9, characterized in that, The process of obtaining hybrid intrusion identification results based on the global alarm information, fused feature information, and a preset hybrid intrusion identification model includes: The alarm feature information and the fused feature information are concatenated to form comprehensive identification feature information; The comprehensive identification feature information is input into a pre-trained, preset hybrid intrusion identification model, and multiple preliminary identification results are output. The multiple preliminary identification results are voted on to obtain a hybrid intrusion identification result.

Images