A method and system for verifying the credibility of pre-inference input data of a large model for power internet of things

Abstract

The application discloses a kind of big model inference front input data credible verification method and system for power internet of things.The method comprises the following steps: receiving power internet of things multi-source heterogeneous input data;Input data is authenticated, format is parsed and standardized;Based on PKI certificate system and CRL+OCSP mechanism, authenticity is verified;Based on hash chain, local trusted timestamp and periodic blockchain anchoring mechanism, integrity is verified;Extract data features and cross-context features, build multidimensional data graph structure;Based on GraphSAGE, node embedding vector is generated and structural anomaly is identified;Based on Bayesian causal network, posterior probability calculation and abnormal link inference are carried out;Based on random forest fusion score, whether input data is allowed to enter big model inference according to risk level is judged.The application can form input data credible verification closed loop before big model inference, improve the credibility, robustness and explainability of big model inference in power internet of things scene.

Description

Technical Field

[0001] This invention relates to the fields of power Internet of Things, artificial intelligence input data security verification, data credibility assessment and large model inference security technology, and in particular to a method and system for verifying the credibility of input data before large model inference for power Internet of Things. Background Technology

[0002] With the rapid development of new power systems and digital twin grids, the power industry is evolving from the traditional energy internet towards deep integration of intelligence and digitalization. The continuous integration of power Internet of Things, edge computing, big data, and artificial intelligence technologies has generated massive amounts of multi-source heterogeneous data in power generation, transmission, distribution, and consumption, including structured sensor data, unstructured image or video data, real-time control commands, equipment status information, environmental data, and topology configuration data.

[0003] To improve the accuracy and response speed of intelligent decision-making, large-scale models are gradually being introduced into key business scenarios such as power dispatching, load forecasting, energy efficiency analysis, anomaly detection, and asset operation and maintenance. Large-scale models typically rely on high-quality data accessed from the cloud, edge nodes, or dispatch centers for inference, and the reliability of their inference results is highly dependent on the authenticity, completeness, and structural consistency of the input data.

[0004] Current technologies largely focus on data poisoning prevention during the training phase of traditional deep learning models, but lack a unified framework for tracing and verifying the source and integrity of input data before inference, risk classification, and identification of complex structural anomalies. In the power Internet of Things (IoT) environment, the number of terminal devices is enormous, and communication paths are complex. Input data may contain noise, outliers, packet loss, forgery, adversarial examples, or data injection attacks. If these data lack an effective pre-verification mechanism before entering a large model, it can easily lead to distortion of the model's inference results, thereby affecting the operational safety and decision-making stability of the power system.

[0005] Therefore, it is necessary to propose a reliable verification method and system for input data before inference of large-scale power Internet of Things (IoT) models. Before the data enters the large-scale model inference, the system performs authenticity verification, integrity verification, structural anomaly identification, causal anomaly link inference, and fusion risk scoring on the input data, thereby ensuring the reliability, robustness, and interpretability of the input data of the large-scale model. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for verifying the credibility of input data before inference in a large-scale power Internet of Things (IoT) model. This method and system are used to perform pre-verification and risk classification of input data for the power IoT model before inference is performed, thereby preventing untrustworthy, tampered, forged, or abnormally structured data from directly entering the large-scale model inference process.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a method for reliable verification of input data before inference in a large-scale model for the power Internet of Things, comprising the following steps: S1, receiving multi-source heterogeneous input data from the power Internet of Things; S2, performing access authentication, format parsing, and standardization processing on the input data; S3, verifying the authenticity of the input data; S4, verifying the integrity of the input data; S5, extracting risk assessment features and constructing a multi-dimensional data graph; S6, identifying structural anomalies based on GraphSAGE; S7, inferring abnormal links based on Bayesian causal networks; S8, outputting a comprehensive risk value and risk level based on random forests; S9, determining whether data is allowed to enter the large-scale model inference based on the risk level.

[0008] The system includes a data receiving and preprocessing unit, an authenticity verification unit, an integrity verification unit, a risk assessment unit, and an inference access decision unit. The risk assessment unit transforms prior verification results, time-series behavioral features, integrity structural features, and contextual cross-features into a multi-dimensional data graph structure, and generates node embedding vectors using GraphSAGE. Simultaneously, it abstracts device trust level, signature verification results, timestamp deviation level, hash chain integrity status, and structural deviation degree into Bayesian causal variables for posterior probability calculation and abnormal link interpretation. Finally, it outputs a comprehensive risk value and low, medium, and high risk levels through random forest fusion scoring.

[0009] This invention, by setting up a closed loop for trusted verification of input data before large-scale model inference, can identify source anomalies, integrity anomalies, structural anomalies, and potential attack risks before data enters the large-scale model, thereby reducing the impact of untrusted data on the inference results of large-scale models from the source.

[0010] This invention uses GraphSAGE to model the graph structure of devices, data packets, and communication relationships in the power Internet of Things, which can capture structural deviations and abnormal collaborative behaviors in scenarios with massive terminal access.

[0011] This invention uses a Bayesian causal network to model the causal dependencies between device trust, signature verification results, timestamp deviation, hash chain integrity, and structural deviation, which can improve the interpretability of anomaly identification.

[0012] This invention employs a random forest fusion of GraphSAGE embedding vectors, Bayesian posterior probabilities, and pre-validation features to output quantifiable comprehensive risk values, risk levels, and feature importance information, facilitating auditing and risk management. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the main components of the trusted verification method of the present invention;

[0014] Figure 2 This is a schematic diagram of the Bayesian causal graph structure of the present invention;

[0015] Figure 3 This is a flowchart of the method for verifying the credibility of input data before large-scale model inference in this invention;

[0016] Figure 4 This is a flowchart of the internal processing of the risk assessment unit of the present invention. Detailed Implementation

[0017] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be understood that the following embodiments are used to illustrate the technical solutions of the present invention, and not to limit the scope of protection of the present invention.

[0018] like Figure 1 As shown, the system of this invention mainly includes a data receiving and preprocessing unit, an authenticity verification unit, an integrity verification unit, a risk assessment unit, and an inference access decision unit. The system receives multi-source heterogeneous data uploaded by terminals in real time from the power Internet of Things communication network, including time-series measurement data, state variables and event counts, equipment operating parameters, topology and configuration information, etc.

[0019] The data receiving and preprocessing unit acquires the data source identifier, device ID, sender certificate fingerprint, and original timestamp of the input data. It performs access authentication, format parsing, field standardization, and log recording on the input data, and writes the standardized data to the preprocessing cache queue. The authenticity verification unit verifies the source identity and signature validity of the input data based on the PKI certificate system and the CRL+OCSP enhanced revocation mechanism. The integrity verification unit verifies whether the input data has been tampered with, lost, or had forged content inserted during the generation, transmission, caching, and retrieval stages based on a hash chain structure, a local trusted timestamp mechanism, and a periodic blockchain anchoring mechanism.

[0020] like Figure 3 As shown, the method of the present invention includes the following steps.

[0021] S1, receiving multi-source heterogeneous input data from the power Internet of Things. The multi-source heterogeneous input data may include time-series measurement data, state variables and event counts, equipment operating parameters, topology and configuration information from power generation, transmission, distribution, and consumption.

[0022] S2 performs access authentication, format parsing, and standardization on the input data. The system extracts the device ID, sender certificate fingerprint, and original timestamp, converts data from different sources and in different formats into a unified data object, and records the access log.

[0023] S3 verifies the authenticity of the input data. The system determines whether the data was issued by the expected trusted entity based on the PKI certificate system, certificate chain, certificate revocation status, and signature verification results.

[0024] S4 verifies the integrity of the input data. The system uses a hash chain structure, local trusted timestamps, and a periodic blockchain anchoring mechanism to determine whether the data has been tampered with, lost, or forged.

[0025] S5 extracts risk assessment features and constructs a multidimensional data graph. Risk assessment features include data source trust features, time-series behavioral features, integrity structure features, and contextual cross-feature features.

[0026] S6, Identifying Structural Anomalies Based on GraphSAGE. The system maps multi-source heterogeneous data into a graph structure, generates node embedding vectors through neighbor sampling and aggregation, and identifies structural deviations based on these embedding vectors.

[0027] S7, based on Bayesian causal networks, infers anomalous links. The system abstracts key observation features into causal variables, calculates the posterior probability of normal or anomalous structures, and determines anomalous links through likelihood ratio tests.

[0028] S8 outputs a comprehensive risk value and risk level based on random forest. The system concatenates the GraphSAGE embedding vector, Bayesian posterior probability, and pre-validation features into a feature vector, which is then input into the random forest model for fusion scoring.

[0029] S9 determines whether data should be allowed to enter the large model inference based on the risk level. Low-risk data is allowed to enter the inference process, medium-risk data triggers alarms, reviews, or downgrades, and high-risk data is blocked and enters the audit handling process.

[0030] GraphSAGE Structural Anomaly Identification Process

[0031] In the risk assessment unit, the multi-source heterogeneous data in the power Internet of Things environment is first mapped into a multi-dimensional data graph structure. This graph structure is represented as follows:

[0032]

[0033] Where G represents the multidimensional data graph structure, V represents the set of nodes in the graph, E represents the set of edges in the graph, and v represents any node in the graph. Let v represent the feature vector of node v, and d represent the feature dimension of the node. express It is a d-dimensional real vector; the nodes of the node set can correspond to devices, data packets, events, or communication entities; the edges of the edge set can correspond to communication relationships, time relationships, topological relationships, or similar device relationships.

[0034] GraphSAGE generates embedding vectors that can be generalized to new nodes by sampling and aggregating the neighbors of nodes. For a node v in the k-th layer, a fixed-size subset S(v) of neighbors is sampled from its neighbor set N(v):

[0035]

[0036] Where N(v) represents the set of neighbors of node v, S(v) represents the subset sampled from the set of neighbors, and s represents the number of neighbors sampled.

[0037] Aggregate the previous layer embeddings of the sampled neighbors to obtain the neighbor aggregation vector:

[0038]

[0039] in, This represents the embedding representation of neighbor node u at level k-1. This represents the aggregation function of the k-th layer. This represents the aggregated representation of the sampled neighbors of node v at layer k.

[0040] After concatenating the node's own upper-level representation with the neighbor aggregation vector, a linear transformation and a non-linear activation function are used to generate the current layer's embedded representation:

[0041]

[0042] Here, CONCAT represents the vector concatenation operation. Let σ represent the trainable weight matrix of the k-th layer, and let σ represent the non-linear activation function. This represents the embedding representation of node v at layer k. After k iterations, the final embedding vector of node v is obtained:

[0043]

[0044] This embedding vector integrates multi-dimensional information such as device origin, topological location, temporal context, and event association, and is used for subsequent Bayesian causal network inference and random forest fusion scoring.

[0045] Bayesian causal network anomaly link inference process

[0046] like Figure 2As shown, a Bayesian causal network is used to explain the causal links of anomalies in input data. The Bayesian causal network is a directed acyclic graph, where nodes represent random variables and edges represent causal dependencies. The system extracts key observation features from the authenticity verification unit, integrity verification unit, and GraphSAGE embedding results, and abstracts them into the following causal variables: A represents device trust level, discretized as high, medium, and low; S represents signature verification result, discretized as pass or fail; T represents timestamp deviation level, discretized as normal, slight deviation, or severe deviation; H represents hash chain integrity status, discretized as complete or anomalous; and C represents structural deviation degree, discretized as normal or anomalous.

[0047] In this embodiment, the causal dependencies include: A influences S, meaning device trust level affects signature verification results; T influences H, meaning timestamp offset affects hash chain integrity status; S and H jointly influence C, meaning signature verification results and hash chain integrity status jointly affect the degree of structural deviation. Therefore, the joint distribution of the Bayesian causal network is:

[0048]

[0049] Wherein, P(A) represents the prior probability of device trust level, P(T) represents the prior probability of timestamp deviation level, P(S|A) represents the conditional probability of signature verification result S given that device trust level A is known, P(H|T) represents the conditional probability of hash chain integrity state H given that timestamp deviation level T is known, and P(C|S,H) represents the conditional probability of structural deviation degree C given that signature verification result S and hash chain integrity state H are known.

[0050] For a given set of data observations, the system calculates the posterior probability of a structurally normal structure:

[0051]

[0052] Simultaneously calculate the posterior probability of structural anomalies and construct the likelihood ratio test:

[0053]

[0054] Here, Λ represents the likelihood ratio test. When Λ meets the preset anomaly detection criteria, the system determines that the causal link corresponding to the input data is abnormal. Through the above processing, the system can explain the causal relationship between anomalies such as "signature anomalies, time offsets, hash chain breaks, and structural deviations," rather than simply performing correlation judgments.

[0055] Random Forest Merging Scoring Process

[0056] like Figure 4As shown, the risk assessment unit concatenates the node embedding vectors generated by GraphSAGE, the posterior probabilities output by the Bayesian causal network, and the pre-order authenticity and integrity verification features into a random forest input feature vector:

[0057]

[0058] Where X represents the input feature vector of the random forest. This represents the node embedding vector generated by GraphSAGE. This represents the posterior probability of a Bayesian causal network outputting a structure that is either structurally normal or structurally abnormal. This indicates a score representing the authenticity of the signature. Indicates the hash chain integrity observation status. The timestamp offset observation status is indicated, A represents the device trust level, and the ellipsis represents other features that can participate in the scoring, such as integrity status, adjacent device correlation, topology path deviation, and anomaly degree of similar device comparison.

[0059] Random forest models perform parallel classification or regression on input features using multiple decision trees, and then vote on or average the outputs of each tree to output a comprehensive risk value.

[0060]

[0061] Here, RF represents a trained random forest model, and r represents the overall risk value. The system maps the overall risk value to low risk, medium risk, and high risk based on preset thresholds. For example, when r is less than the first threshold, it is classified as low risk; when r is between the first and second thresholds, it is classified as medium risk; and when r is greater than the second threshold, it is classified as high risk.

[0062] Random forests can also return the output distribution and feature importance information of each decision tree. This feature importance information is used for security auditing, enabling the system to track overall risk values ​​primarily caused by abnormal device trust levels, signature verification failures, severe timestamp offsets, hash chain breaks, structural deviations, or other characteristics.

[0063] Reasoning-based admission decision

[0064] The inference access decision unit performs corresponding processing based on the comprehensive risk value and risk level. When the risk level is low, input data is allowed to enter the large model inference process; when the risk level is medium, alarm, review, weight reduction, or additional verification processing is performed on the input data; when the risk level is high, input data is blocked from entering the large model inference process, and an audit log is recorded or a security handling process is triggered. Through this mechanism, the present invention can form a trusted verification closed loop before power Internet of Things data enters the large model.

Claims

1. A method for verifying the reliability of input data before inference in a large-scale model for the power Internet of Things, characterized in that, include: Receive multi-source heterogeneous input data from the power Internet of Things, including time-series measurement data, state variables and event counts, device operating parameters, and topology and configuration information; The multi-source heterogeneous input data is subjected to access authentication, format parsing and standardization processing to extract device ID, sender certificate fingerprint and original timestamp; the processed input data is then verified for authenticity to determine the legality of the data source identity and the validity of the signature. The data that has passed the authenticity verification is subjected to integrity verification to determine whether the input data has been tampered with, lost or forged during the generation, transmission, caching and retrieval stages; a multi-dimensional data graph structure is constructed based on the authenticity verification results, integrity verification results, time series behavioral features and contextual cross features; The multidimensional data graph structure is used to identify structural anomalies based on GraphSAGE to obtain node embedding vectors; abnormal causal links are inferred based on Bayesian causal networks to obtain posterior probabilities and anomaly determination results. Based on the random forest, the node embedding vector, posterior probability and prior validation features are fused to output a comprehensive risk value and risk level. Whether input data is allowed to enter the large model inference is determined based on the risk level.

2. The method for verifying the reliability of input data before inference in a large-scale model for the power Internet of Things according to claim 1, characterized in that, The authenticity verification includes: obtaining the sender's certificate chain, certificate fingerprint, and signature information based on the PKI certificate system; verifying whether the certificate is in a valid state through an enhanced revocation mechanism combining CRL and OCSP; and generating data source trust features based on the certificate chain length, revocation status code, signature verification result, and source device identifier.

3. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 1, characterized in that, The integrity verification includes: constructing a hash chain structure for the input data, recording the data generation and reception times based on local trusted timestamps, and anchoring periodic summary information to the blockchain; generating integrity structure features based on hash chain break counts, anchor mismatches, blockchain confirmation delays, and timestamp offset trends.

4. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 1, characterized in that, The multidimensional data graph structure is represented by the following relationship: ； Where G represents the graph structure obtained by mapping data from the power Internet of Things, V represents the set of nodes, E represents the set of edges, v represents a node in the graph structure, and x represents the node in the graph structure. v Represents the node feature vector of node v; express It is a d-dimensional real vector; the nodes of the node set include device nodes, data packet nodes or event nodes, and the edges of the edge set represent communication relationships, time association relationships, topological association relationships or similar device association relationships.

5. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 4, characterized in that, The structural anomaly identification based on GraphSAGE includes: sampling the neighbor set N(v) of node v to obtain a subset S(v); aggregating the previous-layer embeddings of the sampled neighbors based on an aggregation function; concatenating the previous-layer representation of the node itself with the aggregated vector and performing linear transformation and nonlinear activation to obtain the embedding representation of node v at the k-th layer; and obtaining the node embedding vector for risk assessment after K-layer iterations. .

6. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 1, characterized in that, The Bayesian causal network uses A, S, T, H, and C as random variables, where A represents device trust level, S represents signature verification result, T represents timestamp deviation level, H represents hash chain integrity status, and C represents structural deviation degree; the joint distribution of the Bayesian causal network satisfies: ； Furthermore, based on the causal dependencies from A to S, T to H, S to C, and H to C, the posterior probability of the degree of structural deviation is calculated and abnormal link inference is performed.

7. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 6, characterized in that, The abnormal link inference further includes constructing a likelihood ratio test. : ； When the likelihood ratio test meets the preset anomaly determination condition, the corresponding data is determined to have an abnormal causal link, and the anomaly determination result is used as the input feature of the random forest fusion score.

8. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 1, characterized in that, The input feature vector of the random forest includes node embedding vectors generated by GraphSAGE, posterior probabilities output by the Bayesian causal network, signature authenticity score, integrity status, timestamp offset status, and device trust level, in the form of: ； Where X represents the input feature vector of the random forest. Represents the node embedding vector. This represents the posterior probability of a Bayesian causal network outputting a structure that is either structurally normal or structurally abnormal. This indicates a score representing the authenticity of the signature. Indicates the integrity observation status. This indicates the timestamp offset observation status, and A represents the device trust level.

9. The method for verifying the reliability of input data before inference in a large model for the power Internet of Things according to claim 8, characterized in that, The random forest outputs a comprehensive risk value r, and maps the comprehensive risk value to low risk, medium risk, or high risk according to a preset threshold. When the risk level is low, the input data is allowed to enter the large model inference. When the risk level is medium, an alarm, review, or weight reduction is performed. When the risk level is high, the input data is blocked from entering the large model inference.

10. A trusted verification system for input data before inference in a large-scale model for the power Internet of Things, characterized in that, include: The data receiving and preprocessing unit is used to receive multi-source heterogeneous input data from the power Internet of Things and perform access authentication, format parsing and standardization processing. The authenticity verification unit is used to verify the legitimacy of the data source identity and the validity of the signature based on the PKI certificate system and the CRL+OCSP enhanced revocation mechanism; The integrity verification unit is used to verify data integrity based on a hash chain structure, a local trusted timestamp mechanism, and a periodic blockchain anchoring mechanism. The risk assessment unit is used to output a comprehensive risk value and risk level based on GraphSAGE, Bayesian causal networks, and random forests. An inference admission decision unit is used to determine whether to allow input data to enter the large model inference based on the risk level; wherein, the system is used to execute the method described in any one of claims 1 to 9.

Images