A multi-source risk fusion detection method for power grid AI large model attacks

Abstract

The application provides a multi-source risk fusion detection method for power grid AI large model attacks, which integrates multi-dimensional risk evidence by establishing a unified event object, dynamically adjusts the fusion weight according to the event context, and introduces a suspicious event skipping mechanism to prevent baseline pollution, thereby improving the accuracy, explainability and online stability of security detection in the power grid AI composite attack scenario. The method comprises the following steps: obtaining the network traffic of the power grid side to be detected, performing protocol identification and protocol analysis on the network traffic, and generating a unified event object E; performing protocol semantic rule detection, behavior baseline deviation detection, abnormal model detection, Prompt injection detection and adversarial sample detection based on the unified event object E to obtain multi-source risk evidence; adjusting the dynamic weight of the multi-source risk evidence according to the context information context of the current event, and fusing into a final detection risk score S; and outputting a detection result action according to the final detection risk score S.

Description

Technical Field

[0001] This invention relates to the field of power safety technology, specifically to a multi-source risk fusion detection method for attacks on large AI models of power grids. Background Technology

[0002] With the construction of new power systems and the improvement of the digitalization and intelligence of power grids, artificial intelligence models, especially large models with natural language understanding, knowledge reasoning, and tool invocation capabilities, are gradually being introduced into power grid dispatch control, substation automation, equipment operation and maintenance, alarm analysis, and decision support. Therefore, the security detection targets in power grid operations are no longer limited to traditional network packets or single industrial control protocols, but have expanded to a composite scenario consisting of power industrial control protocol traffic, general network attack payloads, business behavior data, and large model inputs and outputs. In this composite scenario, the large model can serve as an intelligent analysis component for alarm summaries, operation and maintenance Q&A, and decision support; it can also influence subsequent business processes through tool invocation, work order generation, script orchestration, or control suggestions. Once an attacker induces the large model to ignore security constraints, leak sensitive information, invoke inappropriate tools, or provide incorrect control suggestions through network traffic, business text, or prompt input, the risk may extend from the information system side to the power production control and operation decision-making side. Therefore, security testing for large-scale AI models for power grids needs to simultaneously determine whether the semantics of power protocols are abnormal, whether network loads have attack characteristics, whether business behavior deviates from the normal baseline, whether the model input contains prompt injections or adversarial disturbances, and whether the model confidence and output labels show abnormal changes. Only by analyzing the risks from the above sources in the same event context can we more accurately identify compound attacks in power grid AI applications.

[0003] Existing technologies can be broadly categorized as follows: The first category comprises rule-based or protocol semantic-based detection methods. These methods offer strong interpretability and are suitable for identifying known risks such as Modbus batch writes, abnormal responses, illegal address access, and abuse of IEC61850 control commands. However, they lack sufficient coverage for unknown anomalies, low-frequency attacks, and cross-protocol combination attacks. The second category consists of anomaly detection methods based on statistical features or machine learning models. These methods can detect events that deviate from the normal sample distribution, but they typically lack the ability to interpret power protocol function codes, control commands, asset importance, and operational semantics. The third category includes detection methods based on behavioral baselines. These methods can identify historical behavioral drift across dimensions such as source address, destination address, protocol type, and operation type. However, if the online update mechanism is not restricted, it may absorb attack samples or abnormal samples as normal behavior. The fourth category comprises Prompt injection or adversarial sample detection methods for large model inputs. These methods can identify input attack risks in large model applications, but they are usually separated from the traditional power industrial control protocol detection link, making it difficult to form a unified judgment on protocol semantic risks, behavioral deviation risks, model confidence risks, and Prompt attack risks in the same event. The fifth category is multi-source fusion and context-aware detection methods, which can integrate security evidence from multiple sources. However, existing solutions are mostly geared towards general heterogeneous networks and have not yet fully incorporated power control protocol semantics, large model input risks, model confidence anomalies, and baseline contamination protection mechanisms.

[0004] Furthermore, a search of existing Chinese patents also reveals technical solutions related to network security detection, industrial control system security detection, smart grid security monitoring, or large-scale model security detection. For example, Chinese patent CN121723356A discloses an anomaly detection method for industrial control systems driven by time-series dual-view imaging; CN119513551B discloses an industrial IoT anomaly detection method based on time-frequency domain collaboration under a lightweight MLP architecture; and CN119598258B discloses a fast anomaly detection method for unsupervised industrial time-series data oriented towards edge devices. These patents focus on single-point anomaly detection in industrial time-series data and do not cover comprehensive detection involving power control protocol semantics, large-scale model input attacks, and multi-source evidence fusion. Chinese patent CN121638898A discloses a security risk management method and system driven by multi-source data fusion; CN120151001B discloses a network intrusion traffic detection method and system based on incremental learning; and CN119922069B discloses a public data security management system and method based on multi-source data fusion. The aforementioned patents involve multi-source data fusion and network intrusion detection, but they do not address the complex attack surface in the context of large-scale AI models for power grids by implementing unified event modeling and dynamic weight fusion. Chinese patent CN122053182A discloses a secure execution method for confidential computational agents resistant to Prompt injection, focusing primarily on single-point protection and failing to address the collaborative fusion with multi-source risk evidence from the power grid side, such as semantic detection of power control protocols, behavioral baseline deviation, and anomaly detection models.

[0005] In summary, existing technologies still have the following shortcomings: First, traditional power control protocol detection, general network attack detection, and large model input attack detection are usually modeled separately, lacking a unified event object for complex AI scenarios in the power grid, making it difficult to integrate protocol semantic risks, behavioral deviation risks, model confidence risks, and Prompt attack risks into the same detection process for comprehensive judgment; Second, single rule or single anomaly detection models cannot simultaneously cover multiple types of complex security threats such as known protocol attacks, unknown behavioral anomalies, Prompt injections, and adversarial sample attacks; Third, if multi-source detection results are fused using fixed weights, it is difficult to dynamically adjust the detection focus based on contextual factors such as protocol type, control commands, presence of prompt words, model confidence, unknown protocol status, and asset criticality, resulting in insufficient accuracy and adaptability of the fusion results; Fourth, if there is a lack of a suspicious event skipping mechanism during the online learning process of behavioral baselines, they are easily contaminated by abnormal samples, absorbing attack samples or abnormal samples as normal behavioral baselines, thereby reducing the effectiveness and online stability of subsequent detection.

[0006] Therefore, we developed a multi-source risk fusion detection method for attacks on large AI models of power grids to solve the above-mentioned technical problems. Summary of the Invention

[0007] This invention aims to address the technical deficiencies of existing technologies by providing a multi-source risk fusion detection method for attacks on large-scale AI models in the power grid. By establishing a unified event object to integrate multi-dimensional risk evidence and dynamically adjusting the fusion weights according to the event context, and by introducing a suspicious event skipping mechanism to prevent baseline contamination, the method improves the accuracy, interpretability, and online stability of security detection in power grid AI composite attack scenarios.

[0008] This invention provides the following technical solution: a multi-source risk fusion detection method for attacks on large-scale AI models of power grids, comprising:

[0009] S1. Obtain the network traffic on the power grid side to be detected, perform protocol identification and parsing on the network traffic, and generate a unified event object E;

[0010] S2. Based on the unified event object E, semantic rule detection, behavior baseline deviation detection, anomaly model detection, prompt injection detection, and adversarial example detection are performed to obtain multi-source risk evidence, which includes rule-based risk evidence R. rule Evidence of behavioral risk R behavior Model risk evidence R model Prompt injection risk evidence R prompt and adversarial sample risk evidence R adv ;

[0011] S3. Adjust the dynamic weights of multi-source risk evidence based on the context information of the current event and fuse them into the final detected risk score S;

[0012] S4. Output the detection result action based on the final detection risk score S, and prevent the current event from being written to the normal behavior baseline when the current event meets the suspicious condition skipUpdate.

[0013] Furthermore,

[0014] The network traffic is collected from switch mirror ports, industrial control gateways, boundary probes, log collectors, online TCP data streams, or offline sample files.

[0015] Furthermore,

[0016] Step S1 involves identifying and parsing network traffic protocols to generate a unified event object E. The steps include:

[0017] Protocol identification is performed on network traffic to obtain protocol type p. Protocol identification is based on at least one of the following: packet fields, protocol identifier, application layer header, port, payload keywords, data frame length, function code position, and frame format. First, a candidate protocol set is generated based on the port, transport layer type, and application layer header. Then, the candidate protocols are verified based on the frame start identifier, length field, function code position, protocol key fields, and payload semantic keywords. When a candidate protocol simultaneously meets the frame format legality and key field matching conditions, it is identified as protocol type p. When multiple protocols meet the identification conditions, the protocol with higher frame format matching degree and field legality is prioritized. When neither condition is met, protocol type p is marked as an unknown protocol. The source address src, destination address dst, protocol type p, and original payload are recorded to form the original frame feature F. raw F raw ={p,src,dst,payload};

[0018] The system performs protocol parsing on network traffic, normalizes the fields of the parsing results for different protocols, and generates a unified event object E. It then calls the corresponding protocol parsing rules based on the protocol type p. These rules include field position parsing rules, frame structure verification rules, and payload semantic extraction rules. Specifically, the field position parsing rules extract function codes, length fields, service fields, and status numbers according to protocol specifications or preset field offset positions. The frame structure verification rules verify whether the packet header, length field, function code position, and protocol identifier meet the corresponding protocol format. The payload semantic extraction rules extract prompt words, query statements, file operations, control commands, and abnormal behavior keywords from text payloads or structured parameters. Finally, it maps fields with similar meanings under different protocols to unified field names.

[0019] Specifically, the Modbus / TCP protocol extracts the function code, starting address, access count, write count, and exception code from the MBAP header and PDU structure, mapping the function code to fc and the write count to wc, and writing protocol details such as the starting address, access count, exception code, and address risks into the payload; the IEC61850 protocol extracts the service type, control object, status sequence number, sequence number, and control command from the GOOSE or MMS frame structure, and writes the semantics of control commands, service type, and status sequence number into the payload; the HTTPAI protocol extracts the prompt word 'q', modulo 'modulo', and modulo 'modulo'. Model confidence level c, historical model confidence level c0, model prediction label y, and historical prediction label y0; SQL protocol extracts query statement, operation type, and injection keywords, and writes them into the payload; SMB protocol extracts file operation type, file path, and abnormal file behavior keywords, and writes them into the payload; unknown traffic extracts the original payload, payload length len, and payload entropy value H, and sets unresolved protocol fields to null or default values; unified event object E={p,src,dst,payload,len,fc,wc,t,H,q,c,c0,y,y0}.

[0020] Furthermore,

[0021] The protocol semantic rule detection in step S2 includes the following steps:

[0022] Based on the protocol type p, function code fc, write quantity wc, control command identifier ctrl, address risk identifier addrRisk, and payload content in the unified event object E, rule detection is performed. If the normalized risk value of the i-th rule is r... i Then, the rule risk evidence R that matches multiple rules rule The expression is:

[0023] R rule =1-∏(1-r i ), i=1,2,...,n;

[0024] Where n represents the number of rules that are hit in the synthesis.

[0025] Furthermore,

[0026] The behavior baseline deviation detection in step S2 includes the following steps:

[0027] A behavior baseline is constructed based on a unified event object E. A profile key (profileKey) is generated based on the source address (src), destination address (dst), protocol type (p), and operation type (op). A context key (contextKey) is also generated based on the source address (src), destination address (dst), and protocol type (p).

[0028] profileKey=concat(src,dst,p,op);

[0029] contextKey=concat(src,dst,p);

[0030] A sliding window is maintained under the profile key, containing latency t, entropy H, payload size len, number of writes wc, and model confidence c; the operation frequency is maintained under the context key.

[0031] For any continuous numerical feature x in the sliding window X, calculate its median and absolute median difference, and then calculate the robust deviation risk R based on these. robust :

[0032] MAD(X) = median(|x) i -median(X)|);

[0033] z(x)=|x-median(X)| / (1.4826×MAD(X)+ε);

[0034] R robust (x)=clamp((z(x)-2) / 4,0,1);

[0035] Where X represents the historical sliding window of the continuous numerical features corresponding to the profile key, x i Let represent the i-th historical sample value in the sliding window X, median(X) represent the median of the sample values ​​in the sliding window X, MAD(X) represent the absolute median difference, ε is a constant, z(x) represent the robust standardization deviation of the current feature value x relative to the historical window, and clamp(a,0,1) means restricting a to the interval [0,1].

[0036] The basic deviation risk R is calculated based on the robust deviation risk of multiple continuous characteristics. base :

[0037] R base =η1×R robust (t)+η2×R robust (H)+η3×R robust (len)+η4×R robust (wc)+η5×R robust (c);

[0038] Among them, R robust (t), R robust (H), R robust (len), R robust (wc) and Rrobust (c) represents the robust deviation risk of latency, load entropy, load length, number of writes and model confidence relative to their respective historical sliding windows, respectively. η1, η2, η3, η4 and η5 are continuous feature weight coefficients, with η1, η2, η3, η4 and η5 taking values ​​of 0.25, 0.20, 0.20, 0.20 and 0.15, respectively.

[0039] Calculate the probability of the current operation type (op) appearing under the context key (contextKey), and then calculate the operation frequency risk (R). freq :

[0040] R freq =clamp((1-P(op|src,dst,p))×λ,0,1);

[0041] Where P(op|src,dst,p) represents the probability of the current operation type op appearing in historical operation statistics under the context key determined by the source address src, destination address dst, and protocol type p, and λ is the operation frequency risk amplification coefficient;

[0042] Calculate baseline aging risk R age :

[0043] R age =0, if age ≤ Tstale;

[0044] Rage=clamp((age-Tstale) / (3×Tstale),0,1), if age > Tstale;

[0045] Where age represents the time interval between the current time and the last update time of the image, and Tstale represents the preset aging time threshold;

[0046] Based on the risk of deviation from continuous characteristics R robust Operation frequency risk R freq and baseline aging risk R age Determine evidence of behavioral risk R behavior :

[0047] R behavior =α×R base +β×R freq +γ×R age ;

[0048] Wherein, α, β, and γ are preset weighting coefficients, with α, β, and γ taking values ​​of 0.82, 0.13, and 0.05, respectively.

[0049] Furthermore,

[0050] The anomaly detection step S2 includes the following steps:

[0051] The anomaly detection model uses at least one of IsolationForest, One-ClassSVM, LOF, AutoEncoder, or a statistical anomaly model;

[0052] Input the numerical features x of the current event into the anomaly detection model to obtain the model risk evidence R. model :

[0053] x=[norm(t),norm(H),norm(len),norm(wc),1-c];

[0054] R model =fmodel(x);

[0055] Here, norm() represents the normalization function, and fmodel() represents the scoring function of the anomaly detection model.

[0056] Furthermore,

[0057] The Prompt injection detection and adversarial example detection in step S2 include the following steps:

[0058] Based on joint analysis of the prompt word q, payload text, model confidence c, historical model confidence c0, model prediction label y, and historical prediction label y0 in the unified event object E, this study identifies Prompt injection and adversarial attacks, and provides evidence R regarding the risk of Prompt injection. prompt and adversarial sample risk evidence R adv The expressions are as follows:

[0059] R prompt =clamp(Σ j a j ×F prompt,j +B prompt ,0,1);

[0060] Among them, F prompt,j Let a represent the j-th Prompt injection feature. j B represents the corresponding weight. prompt Indicates a combined compensation term;

[0061] Adversarial sample risk evidence R adv Based on the determination of low confidence, decreased confidence, high entropy input, predicted label flipping, behavioral baseline deviation, and model anomaly risk, its expression is:

[0062] R adv =h(1-c,c0-c,H,flip(y0,y),Rbehavior ,R model );

[0063] Where flip(y0,y) indicates whether the historical predicted label and the current predicted label have been flipped, and h() is the adversarial example detection function. When the h() function is in weighted normalization form:

[0064] R adv =clamp(Σ k b k ×F adv,k +B adv ,0,1);

[0065] Among them, F adv,k The k-th adversarial example feature, b, is composed of low confidence, decreased confidence, high entropy input, predicted label flipping, behavioral baseline deviation, and model anomaly risk. k B represents the corresponding weight. adv This indicates a combined compensation term.

[0066] Furthermore,

[0067] The context information in step S3 includes at least one of the following: protocol type, control command identifier, prompt word identifier, low confidence identifier, unknown protocol identifier, high-risk rule hit identifier, hidden threat identifier, and asset importance.

[0068] Furthermore,

[0069] The step S3, which involves adjusting the dynamic weights of multi-source risk evidence and fusing them into a final detection risk score S, includes the following steps:

[0070] Let the base weight vector be w0, and the context adjustment function be φ(context), then the dynamic weight w is expressed as:

[0071] w=normalize(w0⊙(1+φ(context)));

[0072] Where ⊙ represents the element-wise multiplication of the vectors at corresponding positions, and normalize() represents the weight normalization function;

[0073] Let the normalized risk value of the i-th type of risk evidence be S. i The corresponding dynamic weight is w i Then the fusion risk value S f Represented as:

[0074] S f =1-∏(1-w i ×S i ), where i = 1, 2, ..., m;

[0075] S i ∈{R rule ,R behavior ,R model ,R prompt ,R adv};

[0076] Where m represents the number of risk evidence categories involved in the fusion;

[0077] Integrate risk value S f Converted to a percentage-based final risk score (S):

[0078] S=min(round(100×S f )+Bonus,100);

[0079] Bonus is a security compensation item that can be added when rules for bulk writes, unauthorized address access, abuse of control commands, backdoor beacons, lateral movement, or severity levels are hit.

[0080] Furthermore,

[0081] The detection result action in step S4 includes any one of allow, alarm, isolation, or block.

[0082] action = allow, if S < θ1;

[0083] action = alert, if θ1 ≤ S < θ2;

[0084] action=quarantine,ifθ2≤S<θ3;

[0085] action = block, if S ≥ θ3;

[0086] Where θ1 is the alarm threshold, θ2 is the isolation threshold, and θ3 is the blocking threshold, and 0≤θ1<θ2<θ3≤100; θ1 is 30, θ2 is 50, and θ3 is 75;

[0087] When the current event meets the suspicious condition `skipUpdate`, writing the current event into the normal behavior baseline is prohibited, and the number of skipped updates is recorded. When the current event does not meet the suspicious condition `skipUpdate`, the corresponding protocol statistics, profile statistics, and context statistics are updated according to the current event.

[0088] skipUpdate=(S≥θ s )∨(c<θ c ∧H>θ H )∨(wc>θ w ∧t>θ t)∨keyword(payload,q);

[0089] Where, θ s θ is the risk threshold for suspicious events. c θ is the confidence threshold. H θ is the entropy threshold. w θ is the threshold for the number of writes. t The delay threshold is keyword(payload,q), which indicates that the payload or hint word hits the attack keyword.

[0090] This invention discloses a multi-source risk fusion detection method for attacks on large-scale AI models of power grids, and produces the following beneficial effects:

[0091] This invention achieves unified event modeling for multi-source security risks in the context of AI-driven power grid scenarios, filling the technological gap of fragmented traditional detection methods. Addressing the issue that existing technologies typically model traditional power control protocol detection, general network attack detection, and large-model input attack detection separately, lacking a unified event object for AI-driven power grid scenarios, this invention uses step S1 to identify and parse network traffic protocols, generating a unified event object E. This integrates power protocol semantics, network attack payloads, business behavior baselines, model confidence changes, and large-model input attack characteristics into the same detection process, providing a standardized data foundation for subsequent multi-source risk fusion and resolving the problem of independent and difficult-to-coordinate detection methods.

[0092] A comprehensive detection system covering protocol attacks, behavioral anomalies, model confidence, prompt injection, and adversarial examples has been constructed, overcoming the shortcomings of incomplete coverage by a single detection model. Addressing the problem in existing technologies where "a single rule or single anomaly detection model cannot simultaneously cover known protocol attacks, unknown behavioral anomalies, prompt injection, and adversarial example attacks," this invention, through step S2, performs five types of detection in parallel on the same unified event object, obtaining evidence of rule risks, behavioral risks, model risks, prompt injection risks, and adversarial example risks, respectively. This achieves comprehensive detection of multiple types of risks in the composite attack surface of power grid AI, significantly improving the coverage of attack detection.

[0093] This invention achieves dynamic weight fusion based on event context, overcoming the lack of adaptability in fixed weight fusion. Addressing the problem in existing technologies where "fixed weight fusion of multi-source detection results makes it difficult to dynamically adjust the detection focus based on contextual factors such as protocol type, control commands, presence of prompts, model confidence, unknown protocol status, and asset criticality," this invention dynamically adjusts the fusion weights of each risk piece of evidence based on the contextual information of the current event in step S3. This allows the detection focus to adapt to changes in business scenarios and risk situations, effectively improving the accuracy and scenario adaptability of the fused detection results.

[0094] By introducing a suspicious event skipping mechanism, the behavioral baseline is effectively prevented from being contaminated by attack samples. In response to the problem in the prior art that "if the suspicious event skipping mechanism is not available during the online learning process of the behavioral baseline, it is easily contaminated by abnormal samples, which absorb attack samples or abnormal samples as normal behavioral baselines, thereby reducing the effectiveness and online stability of subsequent detection", this invention prevents the current event from being written into the normal behavioral baseline when it meets the suspicious conditions in step S4, ensuring the purity of the baseline update, avoiding the degradation of detection capabilities caused by baseline contamination, and significantly improving the long-term stability of the system's online operation.

[0095] In summary, this invention integrates semantic detection of power control protocols, behavioral baseline deviation detection, anomaly detection models, Prompt injection detection, and adversarial example detection into a single detection framework. Through unified event object modeling, multi-source risk evidence extraction, dynamic weight fusion, and a suspicious event skipping mechanism, it jointly solves the technical challenges of cross-source collaboration, narrow coverage, fixed and rigid weights, and easy baseline contamination faced by security detection in the context of complex attacks on large-scale AI models in the power grid. This achieves comprehensive benefits in improving detection accuracy, interpretability, and online stability. Attached Figure Description

[0096] Figure 1 This is a diagram of the overall architecture for multi-source fusion attack detection according to a specific embodiment of the present invention;

[0097] Figure 2 This is a schematic diagram of the unified event model and sparse field representation in a specific embodiment of the present invention;

[0098] Figure 3 This is a schematic diagram of the multi-source detection process and evidence aggregation in a specific embodiment of the present invention;

[0099] Figure 4 This is a flowchart illustrating the context-adaptive risk fusion process in a specific embodiment of the present invention. Detailed Implementation

[0100] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0101] like Figures 1-4 As shown, the present invention discloses a multi-source risk fusion detection method for attacks on large-scale AI models of power grids, comprising:

[0102] S1. Obtain the network traffic on the power grid side to be detected, perform protocol identification and parsing on the network traffic, and generate a unified event object E;

[0103] S2. Based on the unified event object E, semantic rule detection, behavior baseline deviation detection, anomaly model detection, prompt injection detection, and adversarial example detection are performed to obtain multi-source risk evidence, which includes rule-based risk evidence R. rule Evidence of behavioral risk R behavior Model risk evidence R model Prompt injection risk evidence R prompt and adversarial sample risk evidence R adv ;

[0104] S3. Adjust the dynamic weights of multi-source risk evidence based on the context information of the current event and fuse them into the final detected risk score S;

[0105] S4. Output the detection result action based on the final detection risk score S, and prevent the current event from being written to the normal behavior baseline when the current event meets the suspicious condition skipUpdate.

[0106] See Figure 1 The specific execution steps include traffic collection and protocol identification, unified event object generation, multi-source risk evidence extraction, context dynamic weight fusion, and detection result output and baseline contamination protection, as described in detail below:

[0107] (1) Traffic collection and protocol identification

[0108] (1.1) Obtain the network traffic to be detected on the power grid side. The network traffic may come from switch mirror ports, industrial control gateways, boundary probes, log collectors, online TCP data streams, or offline sample files.

[0109] (1.2) Perform protocol identification on network traffic to obtain protocol type p. Protocol identification can be based on at least one of the following: message fields, protocol identifier, application layer header, port, payload keywords, data frame length, function code position, and frame format. When two or more identification criteria are used, cross-validation can reduce the probability of false identification. When three or more identification criteria are used, the identification stability in scenarios involving unknown or masquerading protocols can be further improved. First, a candidate protocol set is generated based on the port, transport layer type, and application layer header. Then, the candidate protocols are verified based on the frame start identifier, length field, function code position, protocol key fields, and payload semantic keywords. When a candidate protocol simultaneously meets the frame format legality and key field matching conditions, it is determined as protocol type p. When multiple protocols meet the identification conditions, the protocol with higher frame format matching degree and field legality is given priority. When none of them are met, protocol type p is marked as an unknown protocol.

[0110] (1.3) Record the source address src, destination address dst, protocol type p, and original payload to form the original frame feature F. raw .

[0111] F raw ={p,src,dst,payload};

[0112] Where p represents the protocol type, src represents the source address, dst represents the destination address, and payload represents the original payload or the payload text after preliminary decoding. Original frame features F raw Used to store the minimum set of traffic information for subsequent protocol parsing and risk detection steps;

[0113] (1.4) Protocol parsing; Perform protocol parsing on network traffic, normalize the fields of the parsing results of different protocols, and generate a unified event object E; Call the corresponding protocol parsing rule according to the protocol type p, the protocol parsing rule includes field position parsing rule, frame structure verification rule and payload semantic extraction rule; wherein, the field position parsing rule is used to extract the function code, length field, service field and status sequence number according to the protocol specification or preset field offset position; the frame structure verification rule is used to verify whether the packet header, length field, function code position and protocol identifier meet the corresponding protocol format; the payload semantic extraction rule is used to extract prompt words, query statements, file operations, control commands and abnormal behavior keywords from text payload or structured parameters; and map fields with similar meanings under different protocols to a unified field name;

[0114] (2) Unified event object generation

[0115] (2.1) See Figure 2The parsing results for different protocols are normalized to generate a unified event object E. For protocol fields without specific semantics, null or default values ​​are used, and subsequent detection modules selectively process them based on protocol type and field validity.

[0116] (2.2) The Modbus / TCP protocol extracts the function code, starting address, number of accesses, number of writes, and exception code based on the MBAP header and PDU structure, and maps the function code to fc and the number of writes to wc. Protocol details such as the starting address, number of accesses, exception code, and address risk are written into the payload. The IEC61850 protocol extracts the service type, control object, status number, sequence number, and control command based on the GOOSE or MMS frame structure, and writes the semantics of the control command, service type, and status number into the payload. The HTTPAI protocol extracts the prompt word q, model confidence c, historical model confidence c0, model prediction label y, and historical prediction label y0. The SQL protocol extracts the query statement, operation type, and injection keyword, and writes them into the payload. The SMB protocol extracts the file operation type, file path, and abnormal file behavior keywords, and writes them into the payload. The unknown traffic extracts the original payload, payload length len, and payload entropy value H, and sets unresolved protocol fields to null or default values.

[0117] (2.3) The unified event object E can be represented as:

[0118] E={p,src,dst,payload,len,fc,wc,t,H,q,c,c0,y,y0};

[0119] Where len represents the payload size, fc represents the function code or service code, wc represents the number of writes, t represents the latency, H represents the payload entropy value, q represents the cue word, c represents the current model confidence, c0 represents the historical model confidence, y represents the current model prediction label, and y0 represents the historical prediction label.

[0120] The project does not expand all protocol-private fields into independent top-level fields, but only retains the fields that are commonly needed for cross-protocol detection. Protocol-specific information, such as startAddr, exceptionCode, service, ctrlObj, sqlOp, and filePath, will be included in the semantic text of the payload for continued use by the rule detection, prompt detection, adversarial detection, and risk fusion modules.

[0121] (3) Protocol semantics and attack rule detection

[0122] (3.1) Detection is performed based on the protocol type p, function code fc, write quantity wc, control command identifier ctrl, address risk identifier addrRisk, and payload content in the unified event object E. Among them, the control command information is derived from the semantics of command, service, etc. in the payload, and the address risk information is derived from the semantics of address_risk in the payload.

[0123] (3.2) When the protocol type p is Modbus / TCP and the function code is write operation and the number of writes wc exceeds the preset write threshold, it is determined that there is a risk of Modbus batch write; when the address risk identifier addrRisk indicates illegal range or protection control area access, it is determined that there is a risk of illegal address access; when the control command identifier ctrl or the payload content contains control semantics such as trip, open-breaker, close-breaker, operate or selectWithValue, it is determined that there is a risk of abuse of IEC61850 control commands.

[0124] (3.3) For common network attacks such as SQL injection, ransomware, data theft, backdoor Beacon and lateral movement, detection is performed by payload keywords, rule base or regular expressions.

[0125] (3.4) If the normalized risk value of the i-th rule hit is r i Then, the rule risk evidence R that matches multiple rules rule The following method is used for synthesis:

[0126] R rule =1-∏(1-r i ), i=1,2,...,n;

[0127] Where, r i It can be determined based on both the rule severity level and the rule score, where n represents the number of rules involved in the synthesis. i r represents the normalized risk value of the i-th rule hit. i =max(G(sev i ), score i / S max ), sev i G(sev) represents the severity level of the i-th rule hit. i The score represents the normalized risk value corresponding to the severity level. i S represents the rule score of the i-th rule. maxThis represents the maximum normalized baseline value of the rule score; in specific implementations, G(critical), G(high), G(medium), G(low), and G(info) are taken as 1.00, 0.82, 0.55, 0.25, and 0.10, respectively, and S max Take 40. The above product complement form is used to combine the risks of multiple rule hits into a single rule risk evidence.

[0128] (4) Behavioral baseline deviation detection

[0129] (4.1) Construct a behavioral baseline based on the unified event object E, and generate a profile key profileKey based on the source address src, destination address dst, protocol type p, and operation type op; generate a context key contextKey based on the source address src, destination address dst, and protocol type p. The operation type op is derived from the unified event object E and is specifically determined based on at least one of the following: protocol type p, function code fc, service type, control command, query statement, file operation type, prompt word, or payload semantic keyword.

[0130] profileKey=concat(src,dst,p,op);

[0131] contextKey=concat(src,dst,p);

[0132] (4.2) Maintain a sliding window for latency t, entropy H, load size len, number of writes wc and model confidence c under profileKey; maintain operation frequency under contextKey.

[0133] (4.3) For any continuous feature x in the sliding window X, calculate the median and absolute median difference, and calculate the robust deviation risk R accordingly. robust .

[0134] MAD(X) = median(|x) i -median(X)|);

[0135] z(x)=|x-median(X)| / (1.4826×MAD(X)+ε);

[0136] R robust (x)=clamp((z(x)-2) / 4,0,1);

[0137] Where X represents the historical sliding window of the continuous numerical features corresponding to the profile key, x iLet represent the i-th historical sample value in the sliding window X, median(X) represent the median of the sample values ​​in the sliding window X, MAD(X) represent the absolute median difference, ε is a minimal constant to prevent the denominator from being zero, z(x) represents the robust normalization deviation of the current feature value x relative to the historical window, and clamp(a,0,1) represents restricting a to the interval [0,1]. R robust (x) represents the robust deviation risk of the current feature value x;

[0138] (4.4) Calculate the basic deviation risk R based on the robust deviation risk of multiple continuous characteristics. base :

[0139] R base =η1×R robust (t)+η2×R robust (H)+η3×R robust (len)+η4×R robust (wc)+η5×R robust (c);

[0140] Among them, R robust (t), R robust (H), R robust (len), R robust (wc) and R robust (c) represents the robust deviation risk of latency, load entropy, load length, number of writes, and model confidence relative to their respective historical sliding windows, where η1, η2, η3, η4, and η5 are continuous feature weight coefficients. In one implementation, η1, η2, η3, η4, and η5 are taken as 0.25, 0.20, 0.20, 0.20, and 0.15, respectively.

[0141] (4.5) Calculate the probability of the current operation type op appearing under the context key and calculate the operation frequency risk R. freq .

[0142] R freq =clamp((1-P(op|src,dst,p))×λ,0,1);

[0143] (4.6) Calculate the baseline aging risk R age :

[0144] R age =0, if age ≤ Tstale;

[0145] Rage=clamp((age-Tstale) / (3×Tstale),0,1), if age > Tstale;

[0146] Where age represents the time interval between the current time and the last update time of the image, Tstale represents the preset aging time threshold, and R age This indicates the risk of aging that arises when a portrait has not been updated for a long time.

[0147] (4.7) Determine behavioral risk evidence R based on continuous characteristic deviation risk, operation frequency risk, and baseline aging risk. behavior .

[0148] R behavior =α×R base +β×R freq +γ×R age ;

[0149] Among them, R base For the underlying deviation risk of multiple continuous features, R freq To mitigate the risk of operational frequency, R age To mitigate the aging risk of images that have not been updated for a long time, α, β, and γ are preset weighting coefficients. In one implementation, α, β, and γ are set to 0.82, 0.13, and 0.05, respectively.

[0150] (5) Trainable anomaly detection

[0151] (5.1) Extract numerical features such as latency, entropy, payload size, number of writes, and model confidence gap from the normal sample set to train the anomaly detection model. The anomaly detection model can be at least one of IsolationForest, One-ClassSVM, LOF, AutoEncoder, or statistical anomaly model; when different anomaly detection models are used, the generation method of model risk evidence is affected, but the unified event object, risk evidence fusion, and detection result output process are not changed.

[0152] (5.2) During runtime, the numerical feature x of the current event is input into the anomaly detection model to obtain the model risk evidence R. model .

[0153] x=[norm(t),norm(H),norm(len),norm(wc),1-c];

[0154] R model =fmodel(x);

[0155] Here, norm() represents the normalization function, and fmodel() represents the scoring function of the anomaly detection model. Model risk evidence R model It is used to discover events where the rules are not directly applied but the overall multidimensional numerical features deviate from the normal sample distribution.

[0156] (6) AI input attack detection

[0157] (6.1) Jointly analyze the prompt word q, payload text, model confidence c, historical model confidence c0, model prediction label y, and historical prediction label y0 in the unified event object E to identify prompt injection and adversarial sample attacks.

[0158] (6.2) Evidence of Prompt Injection Risk R prompt It is determined based on features such as role overriding, instruction overriding, policy bypassing, sensitive information extraction, tool abuse, encoding obfuscation, delimiter forgery, system prompt word reference, and credential export intent.

[0159] R prompt =clamp(Σ j a j ×F prompt,j +B prompt ,0,1);

[0160] Among them, F prompt,j Let a represent the j-th Prompt injection feature. j B represents the corresponding weight. prompt This indicates a combined compensation term; when two or more Prompt injection features are hit, the combined compensation term can improve the evidence of risk; when three or more features are hit, it indicates that the input has a stronger intention to manipulate or evade instructions, which can further improve the evidence of risk of Prompt injection.

[0161] (6.3) Evidence of adversarial sample risk R adv The features are determined based on low confidence, decreased confidence, high entropy input, perturbation keywords, prediction reversal, temporal anomalies, behavioral baseline deviation, and model deviation.

[0162] R adv =h(1-c,c0-c,H,flip(y0,y),R behavior ,R model );

[0163] Where flip(y0,y) indicates whether the historical predicted label and the current predicted label have been flipped, and h() is the adversarial example detection function. In one implementation, the h() function adopts the following weighted normalization form:

[0164] R adv =clamp(Σ k b k ×F adv,k +B adv ,0,1)

[0165] Among them, F adv,kThe k-th adversarial example feature, b, is composed of low confidence, decreased confidence, high entropy input, predicted label flipping, behavioral baseline deviation, and model anomaly risk. k B represents the corresponding weight. adv denoted as the combined compensation term, and h() as the adversarial sample detection function.

[0166] (7) Context-based dynamic weight fusion

[0167] (7.1) See Figure 4 The weights of rule risk evidence, behavior risk evidence, model risk evidence, Prompt injection risk evidence, and adversarial example risk evidence are adjusted according to the current event context.

[0168] (7.2) Context information includes at least one of the following: protocol type, control command identifier, prompt word identifier, low confidence identifier, unknown protocol identifier, high-risk rule hit identifier, hidden threat identifier, and asset importance. When one type of context information is used, the weight of the corresponding detection module is adjusted according to that single context factor; when two types of context information are used, different context factors apply to the weight of the corresponding detection module respectively, and the same risk evidence is superimposed or adjusted based on the higher value; when three or more types of context information are used, multiple context factors participate in the weight adjustment together, and the total weight range is limited by normalization processing to avoid the unlimited amplification of a certain type of risk evidence.

[0169] (7.3) Let the basic weight vector be w0 and the context adjustment function be φ(context), then the dynamic weight w is expressed as:

[0170] w=normalize(w0⊙(1+φ(context)));

[0171] Where w0 represents the basic weight vector, φ() represents the context adjustment function, ⊙ represents the element-wise multiplication of the vector, and normalize() represents the weight normalization function.

[0172] (7.4) Let the normalized risk value of the i-th type of risk evidence be S. i The corresponding dynamic weight is w i Then the fusion risk value S f Represented as:

[0173] S f =1-∏(1-w i ×S i ), i=1,2,...,m;

[0174] S i ∈{R rule ,R behavior,R model ,R prompt ,R adv};

[0175] Where m represents the number of risk evidence categories involved in the fusion.

[0176] (7.5) To avoid the dilution of clearly high-risk events by the weight normalization process, a safety compensation term Bonus is introduced, and the fused risk value S is also included. f Convert to a percentage-based final risk score (S).

[0177] S=min(round(100×S f )+Bonus,100);

[0178] Among them, the security compensation item Bonus can be added when the rules for bulk write, unauthorized address access, abuse of control commands, backdoor beacon, lateral movement, or severity level are hit.

[0179] (8) Output of test results and baseline contamination protection

[0180] (8.1) Output the detection result action based on the final detection risk score S. The detection result action includes one of the following: allow, alarm, isolate, or block.

[0181] action = allow, if S < θ1;

[0182] action=alert,if θ1≤S<θ2;

[0183] action=quarantine,if θ2≤S<θ3;

[0184] action = block, if S ≥ θ3;

[0185] Where θ1 is the alarm threshold, θ2 is the isolation threshold, and θ3 is the blocking threshold; θ1 is 30, θ2 is 50, and θ3 is 75.

[0186] (8.2) When the current event meets the suspicious condition skipUpdate, the current event is prohibited from being written to the normal behavior baseline, and the number of skipped updates is recorded; when the current event does not meet the suspicious condition skipUpdate, the corresponding protocol statistics, profile statistics and context statistics are updated according to the current event.

[0187] skipUpdate=(S≥θ s )∨(c<θ c ∧H>θ H )∨(wc>θ w ∧t>θ t)∨keyword(payload,q);

[0188] Where, θ s θ is the risk threshold for suspicious events. c θ is the confidence threshold. H θ is the entropy threshold. w θ is the threshold for the number of writes. t The delay threshold is keyword(payload,q), which indicates that the payload or hint word hits the attack keyword.

[0189] In Specific Embodiment 1, to verify the technical effectiveness of the method of the present invention, a power grid AI business security detection sample set is constructed. The sample set includes normal business traffic samples, protocol attack samples, general network attack samples, Prompt injection attack samples, adversarial attack samples, and multi-source combined attack samples, totaling 509 samples, of which 187 are normal samples and 322 are attack samples.

[0190] Among the comparative metrics, accuracy represents the proportion of samples correctly identified out of all samples; recall represents the proportion of attack samples successfully detected; F1 score represents a comprehensive evaluation index of accuracy and recall; and false negative rate represents the proportion of attack samples not detected. Higher accuracy, recall, and F1 score indicate better detection performance; lower false negative rate indicates fewer missed attacks.

[0191] When using rule-based detection as a control, the detection accuracy was 71.32%, recall was 58.39%, F1 score was 72.03%, and false negative rate was 41.61%. After employing the multi-source risk fusion detection method described in this invention, the detection accuracy was 93.71%, recall was 95.03%, F1 score was 95.03%, and false negative rate was 4.97%. Therefore, this invention, by fusing protocol semantic rules, behavioral baseline deviation, anomaly models, prompt injection detection, and adversarial example detection, can improve detection coverage in complex attack scenarios and reduce the risk of false negatives.

[0192] In another specific embodiment 2, the method of the present invention is compared with a scheme that removes some detection sources. When Prompt injection detection and adversarial example detection are removed, the F1 score is 87.92% and the false negative rate is 18.63%; after using the complete method, the F1 score increases to 95.03% and the false negative rate decreases to 4.97%. When fixed weight fusion is used instead of context dynamic weight fusion, the F1 score is 93.38% and the false negative rate is 8.07%; after using the context dynamic weight fusion of the present invention, the F1 score increases to 95.03% and the false negative rate decreases to 4.97%. These results show that the AI ​​input attack detection module and the context dynamic weight fusion mechanism can further improve the accuracy and adaptability of the detection results.

[0193] In another specific embodiment, 3, verification was performed based on 464 pcap traffic samples. The accuracy of the method of the present invention was 93.10%, the recall was 94.52%, the F1 score was 94.52%, and the false negative rate was 5.48%. Under the same sample conditions, Snort's accuracy was 73.49% and its F1 score was 75.25%, Suricata's accuracy was 72.41% and its F1 score was 73.77%, and Zeek's accuracy was 63.58% and its F1 score was 61.85%. This shows that the method of the present invention has a higher overall detection effect than traditional rule-based detection methods in complex traffic scenarios including power control protocol attacks and AI input attacks.

[0194] The above embodiments are only used to illustrate the technical effects that the method of the present invention can produce, and do not constitute a limitation on the number of samples, sample type, detection threshold, or deployment environment. Under different power grid business scenarios, sample size, and threshold configurations, those skilled in the art can adjust the sample set and threshold according to actual needs, which still falls within the protection scope of the present invention.

[0195] The preferred embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention. These changes involve related technologies well known to those skilled in the art, and all of them fall within the protection scope of the present invention.

[0196] Many other changes and modifications can be made without departing from the concept and scope of this invention. It should be understood that this invention is not limited to the specific embodiments, and the scope of this invention is defined by the appended claims.

Claims

1. A multi-source risk fusion detection method for attacks on large-scale AI models of power grids, characterized in that, include: S1. Obtain the network traffic on the power grid side to be detected, perform protocol identification and parsing on the network traffic, and generate a unified event object E; S2. Based on the unified event object E, semantic rule detection, behavior baseline deviation detection, anomaly model detection, prompt injection detection, and adversarial example detection are performed to obtain multi-source risk evidence, which includes rule-based risk evidence R. rule Evidence of behavioral risk R behavior Model risk evidence R model Prompt injection risk evidence R prompt and adversarial sample risk evidence R adv ; S3. Adjust the dynamic weights of multi-source risk evidence based on the context information of the current event and fuse them into the final detected risk score S; S4. Output the detection result action based on the final detection risk score S, and prevent the current event from being written to the normal behavior baseline when the current event meets the suspicious condition skipUpdate.

2. The multi-source risk fusion detection method for attacks on large-scale AI models of power grids according to claim 1, characterized in that, The network traffic is collected from switch mirror ports, industrial control gateways, boundary probes, log collectors, online TCP data streams, or offline sample files.

3. The multi-source risk fusion detection method for attacks on large-scale AI models of power grids according to claim 2, characterized in that, Step S1 involves identifying and parsing network traffic protocols to generate a unified event object E. The steps include: Protocol identification is performed on network traffic to obtain protocol type p. Protocol identification is based on at least one of the following: packet fields, protocol identifier, application layer header, port, payload keywords, data frame length, function code position, and frame format. First, a candidate protocol set is generated based on the port, transport layer type, and application layer header. Then, the candidate protocols are verified based on the frame start identifier, length field, function code position, protocol key fields, and payload semantic keywords. When a candidate protocol simultaneously meets the frame format legality and key field matching conditions, it is identified as protocol type p. When multiple protocols meet the identification conditions, the protocol with higher frame format matching degree and field legality is prioritized. When neither condition is met, protocol type p is marked as an unknown protocol. The source address src, destination address dst, protocol type p, and original payload are recorded to form the original frame feature F. raw F raw ={p,src,dst,payload}; The system performs protocol parsing on network traffic, normalizes the fields of the parsing results for different protocols, and generates a unified event object E. It then calls the corresponding protocol parsing rules based on the protocol type p. These rules include field position parsing rules, frame structure verification rules, and payload semantic extraction rules. Specifically, the field position parsing rules extract function codes, length fields, service fields, and status numbers according to protocol specifications or preset field offset positions. The frame structure verification rules verify whether the packet header, length field, function code position, and protocol identifier meet the corresponding protocol format. The payload semantic extraction rules extract prompt words, query statements, file operations, control commands, and abnormal behavior keywords from text payloads or structured parameters. Finally, it maps fields with similar meanings under different protocols to unified field names. Specifically, the Modbus / TCP protocol extracts the function code, starting address, access count, write count, and exception code from the MBAP header and PDU structure, mapping the function code to fc and the write count to wc, and writing protocol details such as the starting address, access count, exception code, and address risks into the payload; the IEC61850 protocol extracts the service type, control object, status sequence number, sequence number, and control command from the GOOSE or MMS frame structure, and writes the semantics of control commands, service type, and status sequence number into the payload; the HTTPAI protocol extracts the prompt word 'q', modulo 'modulo', and modulo 'modulo'. Model confidence level c, historical model confidence level c0, model prediction label y, and historical prediction label y0; SQL protocol extracts query statement, operation type, and injection keywords, and writes them into the payload; SMB protocol extracts file operation type, file path, and abnormal file behavior keywords, and writes them into the payload; unknown traffic extracts the original payload, payload length len, and payload entropy value H, and sets unresolved protocol fields to null or default values; unified event object E={p,src,dst,payload,len,fc,wc,t,H,q,c,c0,y,y0}.

4. A multi-source risk fusion detection method for attacks on large-scale AI models of power grids, as described in any one of claims 1-3, is characterized in that... The protocol semantic rule detection in step S2 includes the following steps: Based on the protocol type p, function code fc, write quantity wc, control command identifier ctrl, address risk identifier addrRisk, and payload content in the unified event object E, rule detection is performed. If the normalized risk value of the i-th rule is r... i Then, the rule risk evidence R that matches multiple rules rule The expression is: R rule =1-∏(1-r i ),i=1,2,...,n; Where n represents the number of rules that are hit in the synthesis.

5. The multi-source risk fusion detection method for attacks on large-scale AI models of power grids according to claim 4, characterized in that, The behavior baseline deviation detection in step S2 includes the following steps: A behavior baseline is constructed based on a unified event object E. A profile key (profileKey) is generated based on the source address (src), destination address (dst), protocol type (p), and operation type (op). A context key (contextKey) is also generated based on the source address (src), destination address (dst), and protocol type (p). profileKey=concat(src,dst,p,op); contextKey=concat(src,dst,p); A sliding window is maintained under the profile key, containing latency t, entropy H, payload size len, number of writes wc, and model confidence c; the operation frequency is maintained under the context key. For any continuous numerical feature x in the sliding window X, calculate its median and absolute median difference, and then calculate the robust deviation risk R based on these. robust : MAD(X)=median(|x i -median(X)|); z(x)=|x-median(X)| / (1.4826×MAD(X)+ε); R robust (x)=clamp((z(x)-2) / 4,0,1); Where X represents the historical sliding window of the continuous numerical features corresponding to the profile key, x i Let represent the i-th historical sample value in the sliding window X, median(X) represent the median of the sample values ​​in the sliding window X, MAD(X) represent the absolute median difference, ε is a constant, z(x) represent the robust standardization deviation of the current feature value x relative to the historical window, and clamp(a,0,1) means restricting a to the interval [0,1]. The basic deviation risk R is calculated based on the robust deviation risk of multiple continuous characteristics. base : R base =η1×R robust (t)+η2×R robust (H)+η3×R robust (len)+η4×R robust (wc)+η5×R robust (c); Among them, R robust (t), R robust (H), R robust (len), R robust (wc) and R robust (c) represents the robust deviation risk of latency, load entropy, load length, number of writes and model confidence relative to their respective historical sliding windows, respectively. η1, η2, η3, η4 and η5 are continuous feature weight coefficients, with η1, η2, η3, η4 and η5 taking values ​​of 0.25, 0.20, 0.20, 0.20 and 0.15, respectively. Calculate the probability of the current operation type (op) appearing under the context key (contextKey), and then calculate the operation frequency risk (R). freq : R freq =clamp((1-P(op|src,dst,p))×λ,0,1); Where P(op|src,dst,p) represents the probability of the current operation type op appearing in historical operation statistics under the context key determined by the source address src, destination address dst, and protocol type p, and λ is the operation frequency risk amplification coefficient; Calculate baseline aging risk R age : R age =0,if age ≤ Tstale; Rage=clamp((age-Tstale) / (3×Tstale),0,1), if age > Tstale; Where age represents the time interval between the current time and the last update time of the image, and Tstale represents the preset aging time threshold; Based on the risk of deviation from continuous characteristics R robust Operation frequency risk R freq and baseline aging risk R age Determine evidence of behavioral risk R behavior : R behavior =α×R base +β×R freq +γ×R age ; Wherein, α, β and γ are preset weighting coefficients, with α, β and γ taking values ​​of 0.82, 0.13 and 0.05 respectively.

6. The multi-source risk fusion detection method for attacks on large-scale AI models of power grids according to claim 5, characterized in that, The anomaly detection step S2 includes the following steps: The anomaly detection model uses at least one of IsolationForest, One-ClassSVM, LOF, AutoEncoder, or a statistical anomaly model; Input the numerical features x of the current event into the anomaly detection model to obtain the model risk evidence R. model : x=[norm(t),norm(H),norm(len),norm(wc),1-c]; R model =fmodel(x); Here, norm() represents the normalization function, and fmodel() represents the scoring function of the anomaly detection model.

7. The multi-source risk fusion detection method for attacks on large-scale AI models of power grids according to claim 6, characterized in that, The Prompt injection detection and adversarial example detection in step S2 include the following steps: Based on joint analysis of the prompt word q, payload text, model confidence c, historical model confidence c0, model prediction label y, and historical prediction label y0 in the unified event object E, this study identifies Prompt injection and adversarial attacks, and provides evidence R regarding the risk of Prompt injection. prompt and adversarial sample risk evidence R adv The expressions are as follows: R prompt =clamp(Σ j a j ×F prompt,j +B prompt ,0,1); Among them, F prompt,j Let a represent the j-th Prompt injection feature. j B represents the corresponding weight. prompt Indicates a combined compensation term; Adversarial sample risk evidence R adv Based on the determination of low confidence, decreased confidence, high entropy input, predicted label flipping, behavioral baseline deviation, and model anomaly risk, its expression is: R adv =h(1-c,c0-c,H,flip(y0,y),R behavior ,R model ); Where flip(y0,y) indicates whether the historical predicted label and the current predicted label have been flipped, and h() is the adversarial example detection function. When the h() function is in weighted normalization form: R adv =clamp(Σ k b k ×F adv,k +B adv ,0,1); Among them, F adv,k The k-th adversarial example feature, b, is composed of low confidence, decreased confidence, high entropy input, predicted label flipping, behavioral baseline deviation, and model anomaly risk. k B represents the corresponding weight. adv This indicates a combined compensation term.

8. A multi-source risk fusion detection method for attacks on large-scale AI models of power grids, as described in claim 6, is characterized in that... The context information in step S3 includes at least one of the following: protocol type, control command identifier, prompt word identifier, low confidence identifier, unknown protocol identifier, high-risk rule hit identifier, hidden threat identifier, and asset importance.

9. A multi-source risk fusion detection method for attacks on large-scale AI models of power grids, as described in claim 8, is characterized in that... The step S3, which involves adjusting the dynamic weights of multi-source risk evidence and fusing them into a final detection risk score S, includes the following steps: Let the base weight vector be w0, and the context adjustment function be φ(context), then the dynamic weight w is expressed as: w=normalize(w0⊙(1+φ(context))); Where ⊙ represents the element-wise multiplication of the vectors at corresponding positions, and normalize() represents the weight normalization function; Let the normalized risk value of the i-th type of risk evidence be S. i The corresponding dynamic weight is w i Then the fusion risk value S f Represented as: S f =1-∏(1-w i ×S i ), where i = 1, 2, ..., m; S i ∈{R rule ,R behavior ,R model ,R prompt ,R adv }; Where m represents the number of risk evidence categories involved in the fusion; Integrate risk value S f Converted to a percentage-based final risk score (S): S=min(round(100×S f )+Bonus,100); Bonus is a security compensation item that can be added when rules for bulk writes, unauthorized address access, abuse of control commands, backdoor beacons, lateral movement, or severity levels are hit.

10. A multi-source risk fusion detection method for attacks on large-scale AI models of power grids according to claim 9, characterized in that, The detection result action in step S4 includes any one of allow, alarm, isolation, or block. action = allow, if S < θ1; action = alert, if θ1 ≤ S < θ2; action=quarantine,ifθ2≤S<θ3; action = block, if S ≥ θ3; Where θ1 is the alarm threshold, θ2 is the isolation threshold, and θ3 is the blocking threshold, and 0≤θ1<θ2<θ3≤100; θ1 is 30, θ2 is 50, and θ3 is 75; When the current event meets the suspicious condition skipUpdate, the current event is prohibited from being written to the normal behavior baseline, and the number of skipped updates is recorded. When the current event does not meet the suspicious condition skipUpdate, the corresponding protocol statistics, profile statistics and context statistics are updated according to the current event. skipUpdate=(S≥θ s )∨(c<θ c ∧H>θ H )∨(wc>θ w ∧t>θ t )∨keyword(payload,q); Where, θ s θ is the risk threshold for suspicious events. c θ is the confidence threshold. H θ is the entropy threshold. w θ is the threshold for the number of writes. t The delay threshold is keyword(payload,q), which indicates that the payload or hint word hits the attack keyword.

Images