A power grid industrial control system abnormal traffic detection method and device

Abstract

The application provides a power grid industrial control system abnormal flow detection method and device, and relates to the technical field of industrial control.The method comprises the following steps: acquiring multi-modal data in a power grid industrial control system, and acquiring a global feature vector of the multi-modal data with a weight coefficient that can be self-adaptively adjusted according to the multi-modal data; wherein the multi-modal data comprises network flow data, device operation instruction data and environment perception data; processing the global feature vector based on a hybrid deep learning model to obtain a comprehensive score representing the degree of flow abnormality; and determining the abnormal level of power grid industrial control system abnormal flow detection according to the comparison result of the comprehensive score and a preset adaptive threshold.The device executes the above method.The power grid industrial control system abnormal flow detection method and device provided in the application can efficiently and accurately realize power grid industrial control system abnormal flow detection.

Description

Technical Field

[0001] This invention relates to the field of industrial control technology, specifically to a method and device for detecting abnormal flow in a power grid industrial control system. Background Technology

[0002] With the deep penetration of the Industrial Internet into the power sector and the large-scale application of new-generation information technologies in power grid control systems, the traditional power dispatching and control system is rapidly evolving towards intelligence and networking. The system is no longer an isolated physical control unit, but a complex system deeply integrated with public information networks, new energy access equipment, and user-side interactive terminals. Therefore, the safe and stable operation of the power grid control system is of paramount importance.

[0003] However, the blurring of network boundaries, the high frequency of data interaction, and the diversification of device access have exposed power grid industrial control systems to more complex security threats: Advanced persistent threats (APTs) frequently use targeted attack methods such as multi-stage covert penetration to obtain industrial control commands, zero-day vulnerability attacks to bypass traditional firewall protection systems, and malicious code injection to tamper with equipment operating parameters. Moreover, the attack targets have shifted from "damaging network connectivity" to "interfering with the operation of physical equipment." Once defenses are breached, it can lead to minor issues such as local substation shutdowns and regional power outages, or even major issues such as cascading power grid failures, large-scale power outages, and even power outages in chemical industrial parks.

[0004] Currently, there is no mature solution for anomaly detection technology in industrial control systems that is adapted to the "information-physical" integration characteristics of the power grid. Existing research mainly focuses on the following three directions, all of which have significant limitations: The first category is detection technology based on predefined rules and feature matching. This technology relies on manually constructed attack signature databases and static security policies, typically firewall ACL rules, to match network traffic one by one. The core logic is to "identify known threats." However, its shortcomings are extremely prominent: on the one hand, facing constantly evolving known attacks, such as disguised traffic from APT attacks, or entirely new unknown threats, such as exploits targeting vulnerabilities in new industrial control protocols, the rule database cannot cover them, directly leading to detection failure; on the other hand, the operating scenarios of power grid industrial control systems are dynamically changing, including seasonal load adjustments, access to new energy power plants, and equipment firmware upgrades, requiring a continuous investment of manpower to update rules. This not only results in high maintenance costs, but also in the rule iteration speed lagging far behind the speed of threat evolution, making it difficult to adapt to the complex operational needs of the system.

[0005] The second category is machine learning detection methods based on single-modal data. These methods often analyze a single type of data source, extracting only network traffic data. Specifically, they cover traffic statistics features of the NetFlow protocol, sampled data packets of the sFlow protocol, or simply parse system operation logs. They identify abnormal patterns using algorithms such as unsupervised clustering and isolated forests, or supervised classification models such as support vector machines and shallow neural networks. While these methods improve intelligence compared to rule-based approaches, they still struggle to adapt to the cyber-physical system (CPS) nature of power grid control systems. Firstly, system anomalies are multi-source, potentially stemming from abnormal traffic at the network layer (e.g., abnormal port scanning), tampering with physical layer device operation commands (e.g., unauthorized modification of transformer voltage regulation parameters), or abnormal environmental sensing data (e.g., equipment failure caused by a sudden increase in switchgear temperature). A single data source cannot comprehensively depict the security status, leading to missed detections (e.g., ignoring physical layer command anomalies) or false alarms (e.g., mistaking normal load fluctuations for attacks). Secondly, these methods often employ statically trained models. When new energy devices like photovoltaic inverters and energy storage converters are integrated into the power grid, or new business scenarios emerge (e.g., collaborative scheduling of virtual power plants), the models cannot autonomously update parameters, resulting in severely insufficient generalization capabilities. Retraining is required to adapt to the new scenarios.

[0006] The third category is detection schemes based on shallow data fusion. Some technologies attempt to integrate multi-source data, but only at the "data-level splicing" stage. Specific methods include simply merging traffic data and log data by timestamp, or "feature-level stacking," where traffic feature vectors and log feature vectors are directly concatenated into a long vector. This approach fails to delve into the intrinsic relationships between multimodal data, such as the temporal coupling between network traffic anomalies and device operation command tampering, or the correlation between abnormal environmental temperature and device communication frequency. It also lacks a mechanism to dynamically adjust the weights of each modality based on real-time operating scenarios. Because the feature spaces of different modal data differ significantly—for example, the statistical characteristics of "byte count / data packet count" in traffic data and the semantic characteristics of "operation type / permission level" in command data differ—the statistical properties also vary. For instance, traffic data fluctuates frequently while environmental data is relatively stable. Shallow fusion not only fails to leverage the complementary advantages of data but may also introduce redundant noise, leading to decreased detection accuracy and increased model computational overhead, making it difficult to meet the real-time requirements of power grid control systems.

[0007] In summary, existing technologies are insufficient to address the "multi-source, concealed, and dynamic" security threats faced by power grid industrial control systems. The core bottlenecks can be summarized in three points: First, the detection dimensions are one-sided, failing to construct a multimodal perception system under the "information-physical" fusion perspective, thus failing to comprehensively capture cross-layer security risks; second, the model adaptability is weak, lacking adaptive updates and incremental learning capabilities, making it difficult to match the evolutionary needs of system equipment iteration and business expansion, and also unable to cope with unknown threats; third, the fusion mechanism is inefficient, failing to fully utilize the complementarity and correlation of multimodal data, thus restricting the accuracy and real-time performance of detection. Summary of the Invention

[0008] To address the problems in the prior art, embodiments of the present invention provide a method and apparatus for detecting abnormal flow in a power grid industrial control system, which can at least partially solve the problems existing in the prior art.

[0009] On the one hand, this invention proposes a method for detecting abnormal flow in a power grid industrial control system, comprising: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0010] Wherein, obtaining a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data includes: Obtain the mutual information between each modal feature of the multimodal data and the features labeled with anomalies; The weight coefficients corresponding to each modal feature are calculated based on the mutual information. The global feature vector is calculated based on each modal feature and its corresponding weight coefficient.

[0011] The hybrid deep learning model includes a low-level structure, a mid-level structure, and a high-level structure; correspondingly, the process of processing the global feature vector based on the hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly includes: Based on the underlying structure, local spatiotemporal features of the global feature vector are extracted; Based on the aforementioned middle-layer structure, the temporal feature vector of the global feature vector is extracted; Based on the analysis of the local spatiotemporal features and the temporal feature vectors of the high-level structure, the vector analysis results of the global feature vectors are obtained; Based on the high-level structure, the comprehensive score is output according to the vector analysis results and the global feature vector.

[0012] The step of outputting the comprehensive score based on the high-level structure and the vector analysis results and the global feature vector includes: Calculate the geometric distance between each dimension feature vector in the global feature vector and the standard feature vector of each dimension; The anomaly probability factor is determined based on the vector analysis results; The comprehensive score is obtained by multiplying the geometric distance by the anomaly probability factor.

[0013] The preset adaptive threshold includes a first preset adaptive threshold and a second preset adaptive threshold; correspondingly, determining the anomaly level of the abnormal flow detection in the power grid industrial control system based on the comparison result of the comprehensive score and the preset adaptive threshold includes: If the comprehensive score is determined to be greater than or equal to the first preset adaptive threshold, then the anomaly level is determined to be the first anomaly level; If the comprehensive score is determined to be greater than or equal to the second preset adaptive threshold and less than the first preset adaptive threshold, then the abnormality level is determined to be the second abnormality level. Wherein, the first preset adaptive threshold is the product of the operating state coefficient and the initial value of the preset threshold, the second preset adaptive threshold is the product of the preset coefficient and the initial value of the preset threshold, the value of the operating state coefficient during peak load is greater than the value during trough load, and the preset coefficient is less than the value of the operating state coefficient during trough load.

[0014] The abnormal flow detection method for the power grid industrial control system further includes: If the comprehensive score is determined to be less than the second preset adaptive threshold, then the abnormal flow detection result of the power grid industrial control system is determined to be normal.

[0015] On one hand, the present invention proposes an abnormal flow detection device for a power grid industrial control system, comprising: The acquisition unit is used to acquire multimodal data from the power grid industrial control system and to acquire a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data. The multimodal data includes network traffic data, device operation command data, and environmental perception data. The processing unit is used to process the global feature vector based on a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. The detection unit is used to determine the abnormality level of abnormal flow detection in the power grid industrial control system based on the comparison result of the comprehensive score and the preset adaptive threshold.

[0016] In another aspect, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the following method: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0017] This invention provides a computer-readable storage medium, comprising: The computer-readable storage medium stores a computer program that, when executed by a processor, implements the following method: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0018] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the following method: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0019] The present invention provides a method and apparatus for detecting abnormal flow in a power grid industrial control system. This method acquires multimodal data from the power grid industrial control system and obtains a global feature vector of the multimodal data with adaptively adjustable weight coefficients. The multimodal data includes network traffic data, equipment operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly. Based on a comparison between the comprehensive score and a preset adaptive threshold, the anomaly level of the abnormal flow in the power grid industrial control system is determined, enabling efficient and accurate detection of abnormal flow in the power grid industrial control system. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a flowchart illustrating an abnormal flow detection method for a power grid industrial control system according to an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram of the abnormal flow detection device for a power grid industrial control system provided in an embodiment of the present invention.

[0022] Figure 3 This is a schematic diagram of the physical structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments and descriptions of the present invention are used to explain the present invention, but are not intended to limit the present invention. It should be noted that, unless otherwise specified, the embodiments and features in the embodiments of this application can be arbitrarily combined with each other.

[0024] Figure 1 This is a flowchart illustrating an abnormal flow detection method for a power grid industrial control system according to an embodiment of the present invention, as shown below. Figure 1 As shown, the abnormal flow detection method for power grid industrial control systems provided in this embodiment of the invention includes: Step S1: Obtain multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data.

[0025] Step S2: Process the global feature vector based on a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly.

[0026] Step S3: Determine the abnormality level of abnormal flow detection in the power grid industrial control system based on the comparison result between the comprehensive score and the preset adaptive threshold.

[0027] In step S1 above, the device acquires multimodal data from the power grid industrial control system and obtains a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data. The multimodal data includes network traffic data, device operation command data, and environmental perception data. The device can be a computer device executing the method. The acquisition, storage, use, and processing of data in this application all comply with relevant regulations.

[0028] The system can collect raw data streams of three modes in parallel through heterogeneous interfaces: network traffic data, equipment operation command data, and environmental perception data. Among them, network traffic data obtains transport layer protocol features through deep packet inspection technology, equipment operation command data extracts operation semantic features through industrial protocol parsing technology, and environmental perception data collects physical environment parameters through sensor networking technology.

[0029] The multimodal data underwent data cleaning, integrity restoration, and numerical range standardization preprocessing. An outlier removal algorithm based on a sliding window was used to eliminate impulse interference, a time-series correlation analysis algorithm was applied to repair missing data, and a linear transformation algorithm was used to map each modality's data to a unified numerical range. The details are as follows: Outlier removal: A sliding window algorithm is used, with a window size of N=5 sampling points. If the data... satisfy:

[0030] This indicates that the data is normal. Data outside the above range is considered impulse interference and is removed. Here, μ is the window mean and σ is the window standard deviation.

[0031] Missing data repair: Command data is filled using "temporal up-down sensing" (based on command pattern map), and environmental data is filled using "multi-sensor spatiotemporal collaborative reconstruction" (three-dimensional interpolation model). Standardization: Mapping to the [0,1] interval through a linear transformation, the formula is:

[0032] in, This represents the historical minimum value of the modality data. This represents the historical maximum value of the modality data.

[0033] By employing a dynamic weight allocation mechanism based on feature importance, an attention-weighted fusion algorithm is used to fuse the feature vectors of each modality into a global feature vector, where the weight coefficients of each modality are dynamically adjusted according to the real-time feature contribution.

[0034] The step of obtaining a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data includes: Obtain the mutual information between each modal feature of the multimodal data and the features labeled with anomalies; The weight coefficients corresponding to each modal feature are calculated based on the mutual information. The global feature vector is calculated based on each modal feature and its corresponding weight coefficient.

[0035] Multimodal feature fusion: Employs an attention-weighted fusion algorithm with dynamically allocated weights. Calculate the mutual information between each modal feature and the anomaly detection target. ( For the i-th mode feature, (for abnormal tags) Weighting coefficient calculation:

[0036] Global feature vector generation: .

[0037] In step S2 above, the device processes the global feature vector based on a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly. The hybrid deep learning model includes a low-level structure, a mid-level structure, and a high-level structure; correspondingly, processing the global feature vector based on the hybrid deep learning model to obtain the comprehensive score characterizing the degree of traffic anomaly includes: Based on the underlying structure, local spatiotemporal features of the global feature vector are extracted; Based on the aforementioned middle-layer structure, the temporal feature vector of the global feature vector is extracted; Based on the analysis of the local spatiotemporal features and the temporal feature vectors of the high-level structure, the vector analysis results of the global feature vectors are obtained; Based on the high-level structure, the comprehensive score is output according to the vector analysis results and the global feature vector.

[0038] Bottom layer: Multi-scale CNN (3×3, 5×5 convolutional kernels) extracts local spatiotemporal features; Middle layer: GRU (64 hidden layer dimensions) captures temporal feature vectors; Senior Management: MLP (64-32-1) outputs a comprehensive score, the formula is:

[0039] in, , where is the geometric distance. For standard feature vectors, (for feature dimensions) The anomaly probability factor (0-1) is the output of the model.

[0040] In step S3 above, the device determines the abnormality level of abnormal flow detection in the power grid industrial control system based on the comparison result between the comprehensive score and the preset adaptive threshold.

[0041] The preset adaptive threshold includes a first preset adaptive threshold and a second preset adaptive threshold; correspondingly, determining the abnormality level of abnormal flow detection in the power grid industrial control system based on the comparison result of the comprehensive score and the preset adaptive threshold includes: If the comprehensive score is determined to be greater than or equal to the first preset adaptive threshold, then the anomaly level is determined to be the first anomaly level; If the comprehensive score is determined to be greater than or equal to the second preset adaptive threshold and less than the first preset adaptive threshold, then the abnormality level is determined to be the second abnormality level. Wherein, the first preset adaptive threshold is the product of the operating state coefficient and the initial value of the preset threshold, the second preset adaptive threshold is the product of the preset coefficient and the initial value of the preset threshold, the value of the operating state coefficient during peak load is greater than the value during trough load, and the preset coefficient is less than the value of the operating state coefficient during trough load.

[0042] The abnormal flow detection method for the power grid industrial control system also includes: If the comprehensive score is determined to be less than the second preset adaptive threshold, then the abnormal flow detection result of the power grid industrial control system is determined to be normal.

[0043] Adaptive threshold determination and graded response: Preset initial threshold value: Real-time adjustment: First preset adaptive threshold ; Where α is the operating state coefficient, α=1.2 during peak load and α=0.8 during trough load; Tiered response: (Second preset adaptive threshold), then it is normal.

[0044] in, =0.5 ; This triggers a basic alert (logs + visualization); Trigger advanced alerts (network isolation + remote notification).

[0045] Taking the abnormal flow detection application of a 220kV substation industrial control system as an example, the abnormal flow detection method for a power grid industrial control system provided in this embodiment of the invention is described as follows: This embodiment uses a 220kV substation of a power grid as a scenario to verify the effectiveness of the technology implementation. The substation includes one main transformer (180MVA), two 220kV lines, and four 110kV lines, and uses the IEC61850 protocol for communication. Data acquisition parameters are shown in Table 1. Table 1

[0046] Preprocessing: Outlier removal: On September 3, 2025, at 10:05:03, the SF6 sensor reading abruptly increased to 1500 ppm (window mean 720 ppm). =50), satisfying 1500>720+2×50=820, it is determined to be pulse interference and discarded; Missing data repair: From 10:08:01 to 10:08:05, the temperature and humidity sensor was disconnected (3 sampling points were missing). This was resolved through "multi-sensor spatiotemporal collaborative reconstruction". Spatial correlation: Temperatures of two adjacent sensors are 28℃ and 29℃; Time-series correlation: The average temperature over the first 5 time periods was 28.5℃; Repair values: 28.6℃, 28.7℃, 28.8℃; Standardization: The original temperature range was 20-40℃, after standardization... For example, 28℃ is standardized to 0.4.

[0047] Feature fusion and model computation: Weight allocation: Obtained through mutual information calculation =0.82, =0.75, =0.68, weight: =0.82 / (0.82+0.75+0.68)=0.38, =0.35, =0.27; global feature vector (Dimension 45).

[0048] Model output: Normal operation:

[0049]

[0050]

[0051] Where 0.6 is the threshold T.

[0052] Abnormal scenario (September 3, 2025, 14:20): An illegal IEC61850MMS command (modifying circuit breaker settings) was detected. .

[0053]

[0054]

[0055] Anomaly level: High alert (S=0.85>T=0.6); Response action: Automatically issue network isolation commands to block communication between the abnormal IP (192.168.1.100) and the station control layer; Record event logs (including command content, trigger time, and isolated objects); Send SMS / APP alerts to maintenance personnel (respond within 5 minutes).

[0056] Taking the abnormal flow detection application of the power grid control system of a wind power grid-connected substation as an example, the abnormal flow detection method of the power grid control system provided in this embodiment of the invention is described as follows: This embodiment takes a 100MW wind farm (25 4MW wind turbines) as the scenario. The wind turbines use Modbus-RTU protocol for communication, the grid connection voltage is 35kV, and they are connected to the wind power dispatch system.

[0057] The data acquisition parameters are shown in Table 2: Table 2

[0058] Preprocessing and anomaly detection process: Impulse interference removal: At 08:15:02 on September 3, 2025, the wind speed sensor reading suddenly changed to 32 m / s (window mean 8 m / s, (σ=2.5), which satisfies 32>8+2×2.5=13. After removal, the value at the previous moment (8.2 m / s) was used to fill in the gap. Feature fusion: Mutual information MI(F1,y)=0.85, MI(F2,y)=0.78, MI(F3,y)=0.72; Weights w1=0.39, w2=0.34, w3=0.27, global feature dimension 44.

[0059] Model calculation: Under normal operating conditions: d(F,F0)=0.22, P=0.75, S=0.165<threshold T=0.55; Abnormal scenario 09:30:10: An illegal Modbus instruction (function code 0x10, attempting to modify the propeller angle register 40012) was detected, d(F,F0=0.88), P=0.88, S=0.77≥T=0.55.

[0060] Threshold judgment: S=0.77>T=0.55, T is adjusted by the current load factor α=1.1, T0=0.5, T=0.5×1.1=0.55; Risk assessment: By using an anomaly propagation model, we predict that anomalies may spread to three adjacent wind turbines and mark them in advance; Tiered response: Primary: Log recording (command frame, triggered fan ID (WT-12)); Advanced: Disconnect the WT-12 grid connection switch, isolate its control cabinet network, and push an alarm (including screenshots of abnormal commands) to the site operation and maintenance center.

[0061] Anomaly detection accuracy: 99.2% (only 1 false positive in 200 simulated attacks); Response latency: The total latency from detecting the anomaly to executing isolation is 780ms (meets the real-time requirements for wind power grid connection).

[0062] Taking the abnormal flow detection application of a 10kV regional distribution network industrial control system as an example, the abnormal flow detection method for a power grid industrial control system provided in this embodiment of the invention is described as follows: This embodiment uses a 10kV distribution network in a city (covering 20 distribution terminals and 50 distribution transformers) as a scenario. It adopts the DL / T645 protocol to collect electricity consumption data and detect illegal remote control commands and abnormal terminal communication.

[0063] Data Acquisition and Preprocessing: Data acquisition: 20 power distribution terminals, acquisition cycle 500ms, 16-dimensional network traffic characteristics, 13-dimensional operation commands, and 11-dimensional environmental data; Missing data repair: From 16:30:02 to 16:30:04 on September 3, 2025, terminal grounding resistance data was missing (3 sampling points). This was repaired using time-series correlation analysis (ARIMA model). Data for the first 5 moments: 14Ω, 14.2Ω, 14.1Ω, 14.3Ω, 14.2Ω; Repair values: 14.2Ω, 14.3Ω, 14.2Ω; Standardization: The original range of grounding resistance is 10-20Ω. The standardization formula is (x'=(x-10) / (20-10)). The repair value of 14.2Ω is standardized to 0.42.

[0064] Incremental learning and model computation: Incremental learning: On September 1, 2025, 5 new distribution transformers were added, using "parameter importance-aware local update": Calculate the contribution of historical parameters and freeze 70% of key parameters (such as CNN convolution kernels and GRU weights). Update 30% of parameters relevant to the new device (such as MLP output layer weights), and reduce training time by 60%; Model output: Normal state: d(F,F0)=0.24, P=0.75, S=0.18<threshold T=0.65; Abnormal scenario 17:45:20: Terminal DT-15 receives an illegal remote control command (attempting to disconnect the 10kV line switch), d(F,F0=0.85,P=0.85,S=0.72≥T=0.65).

[0065] Decision Response: Primary alarm: The monitoring platform displays a visual prompt (red pop-up window) and records the event (command source IP: 10.0.5.23); Advanced alarm: Automatically sends a "Do Not Remote Control" command to DT-15 to block abnormal operations, and maintenance personnel will arrive on-site to investigate within 10 minutes; Result storage: Based on anomaly knowledge graph association storage: Time dimension: Correlate network traffic and operation logs from 17:45 to 17:46; Equipment dimension: Correspond to the historical operation records of DT-15 and the trend of grounding resistance changes; Supports multi-scale backtracking: allows querying daily anomaly details down to the second, or monthly anomaly statistics.

[0066] False alarm rate: 0.3%; Data storage efficiency: Through knowledge graph association, storage capacity is reduced by 40% compared to traditional databases.

[0067] The present invention provides a method for detecting abnormal flow in a power grid industrial control system. This method acquires multimodal data from the power grid industrial control system and obtains a global feature vector of the multimodal data with adaptively adjustable weight coefficients. The multimodal data includes network traffic data, equipment operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly. Based on a comparison between the comprehensive score and a preset adaptive threshold, the anomaly level of the abnormal flow in the power grid industrial control system is determined, enabling efficient and accurate detection of abnormal flow in the power grid industrial control system.

[0068] In the above optional embodiments, obtaining a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data includes: The mutual information between each modal feature of the multimodal data and the features marked with anomaly labels is obtained; this can be referred to the above embodiments for explanation, and will not be repeated here.

[0069] The weight coefficients corresponding to each modal feature are calculated based on the mutual information; the above embodiments can be referred to for explanation, and will not be repeated here.

[0070] The global feature vector is calculated based on each modal feature and its corresponding weight coefficient. This can be referred to the above embodiment for explanation, and will not be repeated here.

[0071] In the above optional embodiments, the hybrid deep learning model includes a low-level structure, a mid-level structure, and a high-level structure; correspondingly, the step of processing the global feature vector based on the hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly includes: The local spatiotemporal features of the global feature vector are extracted based on the underlying structure; the above embodiments can be referred to for explanation, and will not be repeated here.

[0072] The temporal feature vector of the global feature vector is extracted based on the mid-layer structure; the above embodiments can be referred to for explanation, and will not be repeated here.

[0073] Based on the analysis of the local spatiotemporal features and the temporal feature vectors of the high-level structure, the vector analysis results of the global feature vectors are obtained; the above embodiments can be referred to for explanation, and will not be repeated here.

[0074] Based on the high-level structure, the comprehensive score is output according to the vector analysis results and the global feature vector. This can be referred to the above embodiments for further explanation, and will not be repeated here.

[0075] In the above optional embodiments, the step of outputting the comprehensive score based on the high-level structure and according to the vector analysis results and the global feature vector includes: Calculate the geometric distance between each dimension feature vector in the global feature vector and each dimension standard feature vector; refer to the above embodiments for explanation, and will not be repeated here.

[0076] The anomaly probability factor is determined based on the vector analysis results; the above embodiments can be referred to for explanation, and will not be repeated here.

[0077] The comprehensive score is obtained by multiplying the geometric distance by the anomaly probability factor. This can be explained with reference to the above embodiments and will not be repeated here.

[0078] In the above optional embodiments, the preset adaptive threshold includes a first preset adaptive threshold and a second preset adaptive threshold; correspondingly, determining the abnormality level of the abnormal flow detection in the power grid industrial control system based on the comparison result of the comprehensive score and the preset adaptive threshold includes: If the comprehensive score is determined to be greater than or equal to the first preset adaptive threshold, then the anomaly level is determined to be the first anomaly level; this can be referred to the above embodiments for explanation, and will not be repeated here.

[0079] If the comprehensive score is determined to be greater than or equal to the second preset adaptive threshold and less than the first preset adaptive threshold, then the abnormality level is determined to be the second abnormality level; this can be referred to the above embodiment for explanation, and will not be repeated here.

[0080] Wherein, the first preset adaptive threshold is the product of the operating state coefficient and the initial value of the preset threshold, and the second preset adaptive threshold is the product of the preset coefficient and the initial value of the preset threshold. The value of the operating state coefficient during peak load is greater than the value during trough load, and the preset coefficient is less than the value of the operating state coefficient during trough load. Refer to the above embodiments for further explanation; further elaboration is unnecessary.

[0081] In the above optional embodiments, the abnormal flow detection method for the power grid industrial control system further includes: If the overall score is determined to be less than the second preset adaptive threshold, then the abnormal flow detection result of the power grid industrial control system is determined to be normal. This can be referred to the above embodiments for further explanation, and will not be repeated here.

[0082] Figure 2 This is a schematic diagram of the abnormal flow detection device for a power grid industrial control system provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the abnormal flow detection device for a power grid industrial control system provided in this embodiment of the invention includes an acquisition unit 201, a processing unit 202, and a detection unit 203, wherein: The acquisition unit 201 is used to acquire multimodal data in the power grid industrial control system, and to acquire a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; wherein, the multimodal data includes network traffic data, equipment operation command data, and environmental perception data; the processing unit 202 is used to process the global feature vector based on a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly; the detection unit 203 is used to determine the anomaly level of abnormal traffic detection in the power grid industrial control system based on the comparison result of the comprehensive score and a preset adaptive threshold.

[0083] Specifically, the acquisition unit 201 in the device is used to acquire multimodal data from the power grid industrial control system, and to acquire a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; wherein, the multimodal data includes network traffic data, equipment operation command data, and environmental perception data; the processing unit 202 is used to process the global feature vector based on a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly; the detection unit 203 is used to determine the anomaly level of abnormal traffic detection in the power grid industrial control system based on the comparison result of the comprehensive score and a preset adaptive threshold.

[0084] The abnormal flow detection device for a power grid industrial control system provided in this embodiment of the invention acquires multimodal data from the power grid industrial control system and obtains a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data. The multimodal data includes network traffic data, equipment operation command data, and environmental perception data. The global feature vector is processed based on a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly. Based on the comparison result between the comprehensive score and a preset adaptive threshold, the anomaly level of the abnormal flow detection in the power grid industrial control system is determined, enabling efficient and accurate detection of abnormal flow in the power grid industrial control system.

[0085] The embodiments of the present invention provide an abnormal flow detection device for a power grid industrial control system, which can be used to execute the processing flow of the above-described method embodiments. Its functions will not be repeated here, but can be referred to the detailed description of the above-described method embodiments.

[0086] Figure 3 This is a schematic diagram of the physical structure of a computer device provided in an embodiment of the present invention, such as... Figure 3 As shown, the computer device includes: a memory 301, a processor 302, and a computer program stored in the memory 301 and executable on the processor 302. When the processor 302 executes the computer program, it implements the following method: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0087] This embodiment discloses a computer program product, which includes a computer program that, when executed by a processor, implements the following method: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0088] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the following method: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

[0089] Compared with existing technologies, the present invention provides a method for detecting abnormal flow in a power grid control system. This method acquires multimodal data from the power grid control system and obtains a global feature vector of the multimodal data with adaptively adjustable weight coefficients. The multimodal data includes network traffic data, equipment operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score characterizing the degree of traffic anomaly. Based on a comparison between the comprehensive score and a preset adaptive threshold, the anomaly level of the abnormal flow in the power grid control system is determined, enabling efficient and accurate detection of abnormal flow in the power grid control system.

[0090] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0091] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0092] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0093] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0094] In the description of this specification, the references to terms such as "an embodiment," "a specific embodiment," "some embodiments," "for example," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0095] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting abnormal flow in a power grid industrial control system, characterized in that, include: Acquire multimodal data from the power grid industrial control system, and obtain a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data; The multimodal data includes network traffic data, device operation command data, and environmental perception data. The global feature vector is processed using a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. Based on the comparison between the comprehensive score and the preset adaptive threshold, the abnormality level of abnormal flow detection in the power grid industrial control system is determined.

2. The abnormal flow detection method for a power grid industrial control system according to claim 1, characterized in that, The step of obtaining a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data includes: Obtain the mutual information between each modal feature of the multimodal data and the features labeled with anomalies; The weight coefficients corresponding to each modal feature are calculated based on the mutual information. The global feature vector is calculated based on each modal feature and its corresponding weight coefficient.

3. The abnormal flow detection method for a power grid industrial control system according to claim 1, characterized in that, The hybrid deep learning model includes a low-level structure, a mid-level structure, and a high-level structure; correspondingly, the process of processing the global feature vector based on the hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly includes: Based on the underlying structure, local spatiotemporal features of the global feature vector are extracted; Based on the aforementioned middle-layer structure, the temporal feature vector of the global feature vector is extracted; Based on the analysis of the local spatiotemporal features and the temporal feature vectors of the high-level structure, the vector analysis results of the global feature vectors are obtained; Based on the high-level structure, the comprehensive score is output according to the vector analysis results and the global feature vector.

4. The abnormal flow detection method for a power grid industrial control system according to claim 3, characterized in that, The comprehensive score, based on a high-level structure and derived from the vector analysis results and the global feature vector, includes: Calculate the geometric distance between each dimension feature vector in the global feature vector and the standard feature vector of each dimension; The anomaly probability factor is determined based on the vector analysis results; The comprehensive score is obtained by multiplying the geometric distance by the anomaly probability factor.

5. The abnormal flow detection method for a power grid industrial control system according to claim 1, characterized in that, The preset adaptive threshold includes a first preset adaptive threshold and a second preset adaptive threshold; correspondingly, determining the abnormality level of abnormal flow detection in the power grid industrial control system based on the comparison result of the comprehensive score and the preset adaptive threshold includes: If the comprehensive score is determined to be greater than or equal to the first preset adaptive threshold, then the anomaly level is determined to be the first anomaly level; If the comprehensive score is determined to be greater than or equal to the second preset adaptive threshold and less than the first preset adaptive threshold, then the abnormality level is determined to be the second abnormality level. Wherein, the first preset adaptive threshold is the product of the operating state coefficient and the initial value of the preset threshold, the second preset adaptive threshold is the product of the preset coefficient and the initial value of the preset threshold, the value of the operating state coefficient during peak load is greater than the value during trough load, and the preset coefficient is less than the value of the operating state coefficient during trough load.

6. The abnormal flow detection method for a power grid industrial control system according to claim 5, characterized in that, The abnormal flow detection method for the power grid industrial control system also includes: If the comprehensive score is determined to be less than the second preset adaptive threshold, then the abnormal flow detection result of the power grid industrial control system is determined to be normal.

7. An abnormal flow detection device for a power grid industrial control system, characterized in that, include: The acquisition unit is used to acquire multimodal data from the power grid industrial control system and to acquire a global feature vector of the multimodal data with adaptively adjustable weight coefficients based on the multimodal data. The multimodal data includes network traffic data, device operation command data, and environmental perception data. The processing unit is used to process the global feature vector based on a hybrid deep learning model to obtain a comprehensive score representing the degree of traffic anomaly. The detection unit is used to determine the abnormality level of abnormal flow detection in the power grid industrial control system based on the comparison result of the comprehensive score and the preset adaptive threshold.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images