Hydropower station monitoring system network intrusion detection method, system, device and medium

Abstract

The present application relates to the technical field of network intrusion detection, and particularly relates to a hydropower station monitoring system network intrusion detection method, system, device and medium, steps are as follows: obtaining encrypted traffic packets to be detected of a target hydropower station monitoring system; respectively extracting flow level features and encrypted protocol features from the encrypted traffic packets to be detected; using a pre-trained abnormal traffic detection model to perform abnormal detection based on the flow level features and the encrypted protocol features; outputting a detection result; wherein the abnormal traffic detection model is trained using a semi-supervised manner. By combining and analyzing the flow level features and the encrypted protocol features, the present application can effectively reduce the false positive rate and the false negative rate in the process of abnormal detection of encrypted traffic of a hydropower station; at the same time, the semi-supervised training can effectively reduce the dependence on manually labeled traffic data.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection technology, and more specifically, to a method, system, equipment, and medium for network intrusion detection in a hydropower station monitoring system. Background Technology

[0002] With the accelerated advancement of industrialization and informatization, and the widespread adoption of digital electronic devices, modern society's demand for and reliance on electrical energy is increasing. As global climate change intensifies and environmental awareness grows, the sustainability and environmental protection of energy are receiving increasing attention. Under the "dual-carbon" development goal, power production needs to shift towards clean, low-carbon, and renewable energy. Among the available power sources, hydropower is the earliest developed and most technologically mature clean energy source. Hydropower also features stable operation, short start-up and shutdown times, and the ability to promptly meet sudden load changes. In the power grid system, it can serve as both base load and play a crucial role in peak shaving and frequency regulation. Modern hydropower stations utilize automation and digital technologies such as computer monitoring and big data analysis, greatly improving the ability to monitor and analyze hydropower station data, achieving unmanned operation mode with remote centralized control from a central control center. While the combination of hydropower generation technology and computer monitoring network technology enhances the automation level of hydropower stations, it also brings cybersecurity challenges. In the context of new technologies and new situations in the information age, the cybersecurity of hydropower station monitoring systems faces new challenges.

[0003] However, the detection strategies currently used in hydropower station monitoring systems can only provide limited detection performance because they mostly use a single feature representation, which cannot fully explore the complex relationships between features, thus affecting the detection accuracy. Summary of the Invention

[0004] The purpose of this invention is to provide a method, system, device and medium for network intrusion detection in a hydropower station monitoring system, so as to solve the technical problems pointed out in the background.

[0005] This invention is achieved through the following technical solution: a network intrusion detection method for a hydropower station monitoring system, comprising the following steps: Obtain the encrypted flow packets to be detected from the monitoring system of the target hydropower station; Flow-level features and encryption protocol features are extracted from the encrypted traffic packets to be detected, respectively. Anomaly detection is performed using a pre-trained abnormal traffic detection model based on the flow-level features and encryption protocol features. Output the detection results; The abnormal traffic detection model was trained using a semi-supervised method.

[0006] According to a preferred embodiment, the training process of the abnormal traffic detection model is as follows: Obtain historical network traffic data of the target hydropower station monitoring system, and perform data cleaning on the historical network traffic data to obtain encrypted traffic packets; The encrypted traffic packets are parsed to extract TCP protocol data packets, and the TCP protocol data packets are segmented into sessions to obtain a communication session stream; Extracting stream-level features from the communication session stream and inputting the stream-level features into a Transformer network to obtain several first hidden features; and extracting encryption protocol features from the communication session stream and inputting the encryption protocol features into a graph convolutional neural network to obtain several second hidden features. The first hidden feature and the second hidden feature are fused to obtain the fused feature; The SVM classifier is pre-trained based on the fused features, and then updated.

[0007] According to a preferred embodiment, the data cleaning includes: filtering target traffic related to the SSL / TLS protocol, and removing abnormal traffic from the target traffic that does not conform to normal network communication patterns.

[0008] According to a preferred embodiment, the stream-level features are obtained from the file header, packet header, and packet content of the pcap file.

[0009] According to a preferred embodiment, the extraction of the encryption protocol features specifically includes: Set the sliding window size, and slide the window along the message timing in the communication session stream to capture multiple local message sequences; Calculate the state transition probability of message type in each local message sequence, and generate the corresponding local Markov chain; By combining the described local Markov chains, the encryption protocol features are obtained.

[0010] According to a preferred embodiment, the TCP protocol data packets are segmented based on the five-tuple.

[0011] According to a preferred embodiment, before fusing the first hidden feature and the second hidden feature, the method further includes: The minimum redundancy maximum correlation algorithm is used to filter the first hidden feature and the second hidden feature respectively.

[0012] This invention also provides a network intrusion detection system for a hydropower station monitoring system, applied to the aforementioned network intrusion detection method for a hydropower station monitoring system. The system includes: The flow acquisition unit is used to acquire the encrypted flow packets to be detected from the monitoring system of the target hydropower station. The feature extraction unit is used to extract flow-level features and encryption protocol features from the encrypted traffic packet to be detected, respectively. An abnormal traffic detection unit is used to perform anomaly detection based on the flow-level features and encryption protocol features using a pre-trained abnormal traffic detection model. The output unit is used to output the detection results; The abnormal traffic detection model was trained using a semi-supervised method.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network intrusion detection method for a hydropower station monitoring system as described above.

[0014] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network intrusion detection method for a hydropower station monitoring system as described above.

[0015] The technical solution of the network intrusion detection method, system, equipment and medium for hydropower station monitoring system provided by the present invention has at least the following advantages and beneficial effects: By combining the analysis of flow level characteristics and encryption protocol characteristics, the present invention can effectively reduce the false alarm rate and false negative rate in the process of encrypted flow anomaly detection in hydropower stations; at the same time, semi-supervised training can effectively reduce the dependence on manually labeled flow data. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the network intrusion detection method for a hydropower station monitoring system provided in Embodiment 1 of the present invention. Figure 2 This is a structural block diagram of the network intrusion detection system for a hydropower station monitoring system provided in Embodiment 2 of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0018] Example 1 This invention provides a method for network intrusion detection in a hydropower station monitoring system. Figure 1This is a schematic diagram of the overall process of the network intrusion detection method for the monitoring system of this hydropower station, as follows: Figure 1 As shown, the network intrusion detection method for the hydropower station monitoring system includes the following steps: Step S1: Traffic collection; In this embodiment, by setting up port mirroring on the core switch of the process control area of ​​the target hydropower station monitoring system, real-time network data packets flowing through the switch are collected, and the collected network data packets are stored as pcap format files, which are used as encrypted traffic packets to be detected.

[0019] Step S2: Feature extraction; In this embodiment, flow-level features and encryption protocol features are extracted from the encrypted traffic packets to be detected.

[0020] Specifically, the process of extracting flow-level features is as follows: The file header, packet header, and packet content of the pcap file are read using a program parsing tool. Specifically, the file header is read to obtain global parameters such as the capture packet length, the packet header is read to obtain protocol layer fields such as timestamp, source port, and destination port, and the packet content is read to obtain the data payload length. Furthermore, based on the above basic data, statistical indicators such as average packet size, packet interval time, and flow duration are calculated as flow-level features.

[0021] The process of extracting encryption protocol features is as follows: A sliding window size is set, and the window moves along the time sequence of messages in the communication session stream to capture multiple local message sequences. Further, the application layer payload of each message sequence is extracted, and the handshake message type is identified. The state transition probabilities between message types in each local message sequence are calculated to generate a local Markov chain that characterizes the protocol interaction order. The transition probability matrices of each local Markov chain are concatenated and combined to obtain encryption protocol features that reflect the protocol interaction rules.

[0022] Step S3: Abnormal traffic detection; An anomaly detection model is used to detect anomalies based on flow-level features and encryption protocol features; the anomaly detection model is trained in a semi-supervised manner.

[0023] In some preferred embodiments of this example, the training process of the abnormal traffic detection model is as follows: Step S301: Obtain historical network traffic data of the target hydropower station monitoring system, and perform data cleaning on the historical network traffic data to obtain encrypted traffic packets; Specifically, data cleaning includes: extracting data streams using the Secure Sockets Protocol (SSL) through port filtering or packet header matching, filtering target traffic related to the SSL / TLS protocol, and removing abnormal traffic from the target traffic that is abnormal due to retransmission, incomplete three-way handshake, or does not conform to normal network communication patterns, thereby obtaining clean encrypted traffic packet samples. Step S302: Perform protocol parsing on the cleaned encrypted traffic packets, extract TCP protocol data packets, and perform session segmentation on the TCP protocol data packets according to the five-tuple to obtain the communication session flow; the five-tuple includes source IP address, destination IP address, source port, destination port, and transport layer protocol type; Step S303: Extract flow-level features from the communication session stream and input the flow-level features into a Transformer network. After feature transformation through a multi-head self-attention layer and a feedforward neural network, several first hidden features are obtained. Also, extract encryption protocol features from the communication session stream and input the encryption protocol features into a graph convolutional neural network. This graph convolutional neural network defines message type as a graph node and state transition probability as edge weight. It aggregates neighbor node features through graph convolutional layers to obtain several second hidden features. Step S304: The minimum redundancy maximum correlation algorithm is used to filter the first hidden feature and the second hidden feature respectively. It should be noted that the minimum redundancy maximum correlation algorithm can filter out a subset of features with low redundancy and strong correlation by calculating the mutual information between features and the correlation between features and category labels. Step S305: The first hidden feature and the second hidden feature after the filtering process are fused to obtain the fused feature; Step S306: Perform semi-supervised pre-training on the SVM classifier based on the fusion features; during training, the model uses a small number of labeled abnormal traffic features as supervised loss terms and a large number of unlabeled fusion features as unsupervised regularization terms to construct a semi-supervised loss objective, and updates the decision boundary of the support vector machine classifier through the gradient descent algorithm.

[0024] Furthermore, the fused features are input into the trained model, and the detection results are output through a support vector machine classifier.

[0025] In summary, by combining the analysis of flow level characteristics and encryption protocol characteristics, this invention can effectively reduce the false alarm rate and false negative rate in the encrypted flow anomaly detection process of hydropower stations; at the same time, the semi-supervised training method can effectively reduce the dependence on manually labeled flow data.

[0026] Example 2 This embodiment, based on the technical solution provided in Embodiment 1, provides a network intrusion detection system for a hydropower station monitoring system. This system applies the network intrusion detection method for a hydropower station monitoring system as described in Embodiment 1. Figure 2 This is a structural block diagram of the network intrusion detection system for the monitoring system of this hydropower station, such as... Figure 2 As shown, the system includes: The flow acquisition unit is used to acquire the encrypted flow packets to be detected from the monitoring system of the target hydropower station. The feature extraction unit is used to extract flow-level features and encryption protocol features from the encrypted traffic packets to be detected, respectively. An abnormal traffic detection unit is used to perform anomaly detection based on flow-level features and encryption protocol features using a pre-trained abnormal traffic detection model. The output unit is used to output the detection results; The abnormal traffic detection model was trained using a semi-supervised method.

[0027] The functions of each unit of the network intrusion detection system of the hydropower station monitoring system in this embodiment are the same as those of the embodiment of the network intrusion detection method of the hydropower station monitoring system, and the technical effects are the same, so they will not be repeated here.

[0028] Example 3 This invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the network intrusion detection method for a hydropower station monitoring system as described in Embodiment 1.

[0029] The electronic device provided in this embodiment has the same function and technical effect as the computer program running on the processor as the embodiment of the network intrusion detection method for hydropower station monitoring system, and will not be repeated here.

[0030] Example 4 This invention provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the network intrusion detection method for a hydropower station monitoring system as described in Embodiment 1.

[0031] The computer-readable storage medium provided in this embodiment, when the computer program is executed by the processor, has the same function and technical effect as the embodiment of the network intrusion detection method for hydropower station monitoring system, and will not be repeated here.

[0032] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network intrusion detection method for a hydropower station monitoring system, characterized in that, Includes the following steps: Obtain the encrypted flow packets to be detected from the monitoring system of the target hydropower station; Flow-level features and encryption protocol features are extracted from the encrypted traffic packets to be detected, respectively. Anomaly detection is performed using a pre-trained abnormal traffic detection model based on the flow-level features and encryption protocol features. Output the detection results; The abnormal traffic detection model was trained using a semi-supervised method.

2. The network intrusion detection method for a hydropower station monitoring system as described in claim 1, characterized in that, The training process of the abnormal traffic detection model is as follows: Obtain historical network traffic data of the target hydropower station monitoring system, and perform data cleaning on the historical network traffic data to obtain encrypted traffic packets; The encrypted traffic packets are parsed to extract TCP protocol data packets, and the TCP protocol data packets are segmented into sessions to obtain a communication session stream; Extracting stream-level features from the communication session stream and inputting the stream-level features into a Transformer network to obtain several first hidden features; and extracting encryption protocol features from the communication session stream and inputting the encryption protocol features into a graph convolutional neural network to obtain several second hidden features. The first hidden feature and the second hidden feature are fused to obtain the fused feature; The SVM classifier is pre-trained based on the fused features, and then updated.

3. The network intrusion detection method for a hydropower station monitoring system as described in claim 2, characterized in that, The data cleaning includes: filtering target traffic related to the SSL / TLS protocol, and removing abnormal traffic from the target traffic that does not conform to normal network communication patterns.

4. The network intrusion detection method for a hydropower station monitoring system as described in claim 3, characterized in that, The stream-level features are obtained from the file header, packet header, and packet content of the pcap file.

5. The network intrusion detection method for a hydropower station monitoring system as described in claim 4, characterized in that, The extraction of the encryption protocol features specifically includes: Set the sliding window size, and slide the window along the message timing in the communication session stream to capture multiple local message sequences; Calculate the state transition probability of message type in each local message sequence, and generate the corresponding local Markov chain; By combining the described local Markov chains, the encryption protocol features are obtained.

6. The network intrusion detection method for a hydropower station monitoring system as described in claim 5, characterized in that, Session segmentation is performed on the TCP protocol data packets based on the 5-tuple.

7. The network intrusion detection method for a hydropower station monitoring system as described in claim 6, characterized in that, Before fusing the first hidden feature and the second hidden feature, the method further includes: The minimum redundancy maximum correlation algorithm is used to filter the first hidden feature and the second hidden feature respectively.

8. A network intrusion detection system for a hydropower station monitoring system, characterized in that, The network intrusion detection method for a hydropower station monitoring system as described in any one of claims 1 to 7, wherein the system comprises: The flow acquisition unit is used to acquire the encrypted flow packets to be detected from the monitoring system of the target hydropower station. The feature extraction unit is used to extract flow-level features and encryption protocol features from the encrypted traffic packet to be detected, respectively. An abnormal traffic detection unit is used to perform anomaly detection based on the flow-level features and encryption protocol features using a pre-trained abnormal traffic detection model. The output unit is used to output the detection results; The abnormal traffic detection model was trained using a semi-supervised method.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the network intrusion detection method for a hydropower station monitoring system as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, it implements the network intrusion detection method for a hydropower station monitoring system as described in any one of claims 1 to 7.

Images