A power multi-source data anomaly identification method based on a graph neural network

Abstract

The embodiment of the application provides a kind of based on graph neural network's electric power multi-source data anomaly identification method, belong to electric power data traceability technical field.The method includes: obtaining event record set, event record set includes several event records, event record is characterized the information of each entity operation behavior generated in the process of electric power multi-source data processing;PROV semantic mapping processing is carried out to several event records, obtain node set and edge set, and construct traceability graph based on node set and edge set;According to time sequence, event record set is divided into events, obtains several running segments, each running segment includes several event records, and all event records in each running segment are mapped as traceability graph sample;Traceability graph and all traceability graph samples are input into graph neural network, and abnormal segment is output.The method of the application can effectively improve the noise interference problem, improve the identification accuracy of low-frequency abnormal attack.

Description

Technical Field

[0001] This application relates to the field of power data traceability technology, and in particular to a method for identifying anomalies in multi-source power data based on graph neural networks. Background Technology

[0002] In the field of cybersecurity within the power industry, advanced persistent threat (APT) detection is a crucial step in ensuring the stable operation of the power system. However, current APT detection in the power sector faces numerous technical challenges, severely limiting detection effectiveness and operational efficiency.

[0003] In related technologies, power APT attacks often exhibit long-term latency and phased progression. Directly inputting timestamps as discrete or absolute features into graph neural networks can easily lead to scale instability and insufficient generalization, resulting in the model's inadequate ability to capture features of attacks spanning long periods and making it difficult to accurately identify anomalous activities across multiple time stages. Furthermore, power system data comes from a wide range of sources, covering multiple dispatching business platforms. The semantic formats of data from different sources differ, and the lack of a unified modeling standard results in large-scale source graphs composed of power data containing a large number of background noise events. The model is easily overwhelmed by high-frequency normal patterns, leading to overfitting issues in graph neural networks and low accuracy in identifying low-frequency anomalous attack patterns. This fails to meet the accuracy requirements for identifying anomalies in multi-source power data in real-world production environments.

[0004] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0005] The main objective of this application is to propose a method for identifying anomalies in multi-source power data based on graph neural networks. This invention improves the ability of graph neural network models to extract and generalize features of multi-source power data by performing PROV semantic mapping modeling on cross-source power data. It can effectively solve the noise interference problem caused by the inconsistency of semantics in data from different sources and improve the accuracy of identifying low-frequency anomaly attacks.

[0006] To achieve the above objectives, one aspect of this application proposes a method for identifying anomalies in multi-source power data based on graph neural networks, the method comprising: Obtain an event record set, which includes several event records, and the event records represent the operational behavior information of various entities generated during the multi-source power data processing; PROV semantic mapping is performed on several event records to obtain a set of nodes and a set of edges, and a source graph is constructed based on the set of nodes and the set of edges; The event record set is divided into several running segments according to the time sequence, each running segment includes several event records, and all event records in each running segment are mapped to source map samples; The source map and all source map samples are input into a graph neural network, which outputs anomaly segments. These anomaly segments represent abnormal operation segments in the process of multi-source power data operation.

[0007] In some embodiments, obtaining the event log set includes: Obtain the original event set, which includes several original events; All the original events are mapped to event records using the field mapping function; The event record set is obtained by performing field quality processing on several of the event records.

[0008] In some embodiments, the step of dividing the event record set according to chronological order to obtain several execution segments includes: The event records are sorted in chronological order to obtain a continuous event stream; The continuous event stream is processed by time feature extraction to obtain several time intervals, which represent the time difference between any two adjacent event records in the continuous event stream; When the time interval exceeds a preset time threshold, the time interval exceeding the preset time threshold is determined as the candidate segment boundary; The continuous event stream is divided based on the candidate segment boundaries to obtain several running segments.

[0009] In some embodiments, mapping all event records in each of the running segments to a source graph sample includes: Obtain the event set corresponding to the running segment; Feature extraction is performed on the event records in the event set to obtain the malicious segment ratio and segment tags; Based on the nodes and edges corresponding to the event records in the source graph, sample structural features are obtained, and the malicious proportion of the fragment, the fragment label and the sample structural features are mapped by a mapping function to obtain the source graph sample.

[0010] In some embodiments, the step of inputting the source graph and all the source graph samples into a graph neural network and outputting anomaly fragments includes: The node embedding vectors are obtained by embedding the node features and structural features of the source graph through a graph neural network. Graph-level representation is completed based on the node embedding vectors, and the anomaly score of the source graph sample is obtained; The running segments corresponding to the source map samples whose abnormal scores exceed the preset abnormal threshold are identified as abnormal segments.

[0011] In some embodiments, the graph neural network includes a graph attention encoder; the step of embedding the node features and structural features of the source graph through the graph neural network to obtain node embedding vectors includes: The node features and structural features of the source graph are subjected to multi-feature encoding processing to obtain several types of node features; The features of all the nodes are concatenated to obtain the initial enhanced fusion features; The initial enhanced fusion features are enhanced by the graph attention encoder to obtain enhanced fusion features, and node embedding vectors are obtained based on the enhanced fusion features.

[0012] In some embodiments, the method further includes: Based on all the aforementioned abnormal fragments, several key nodes and key edges are selected from the source tracing graph; Backtracking is performed on the source graph based on all the key nodes and key edges to obtain several candidate causal paths; Based on all the aforementioned causal paths, the starting node and complete propagation link of the anomaly propagation are determined, and the location of the anomaly and the propagation process of the anomaly in the multi-source power data are located.

[0013] To achieve the above objectives, another aspect of this application proposes a power multi-source data anomaly identification system based on graph neural networks, the system comprising: The first module is used to acquire an event record set, which includes several event records. The event records represent the operational behavior information of various entities generated during the multi-source power data processing. The second module is used to perform PROV semantic mapping processing on several event records to obtain a set of nodes and a set of edges, and to construct a source graph based on the set of nodes and the set of edges; The third module is used to divide the event record set into several running segments according to the time sequence, each running segment includes several event records, and maps all event records in each running segment to traceability graph samples; The fourth module is used to input the source map and all the source map samples into the graph neural network and output abnormal segments, which are used to represent abnormal operation segments in the process of power multi-source data operation.

[0014] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0015] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0016] The embodiments of this application include at least the following beneficial effects: This application provides a method for identifying anomalies in multi-source power data based on graph neural networks. This method includes acquiring an event record set of multi-source power data; constructing a source map by performing PROV semantic mapping on the event record set; completing unified modeling of cross-source power data; solving the problem of inconsistent semantic formats of data from different sources; reducing background noise interference in the source map; and lowering the probability of the model being overwhelmed by high-frequency normal patterns. The method also involves dividing the event record set based on time intervals, decomposing long-span attack behaviors into segmented features, alleviating the problems of unstable time feature scales and insufficient generalization, and improving the model's ability to capture features of cross-stage abnormal activities. Finally, the method inputs the source map and all source map samples into a graph neural network, outputting abnormal fragments. By combining the graph neural network with the embedding learning of the source map samples, it can accurately mine low-frequency abnormal attack patterns, improving the accuracy of anomaly identification, providing clear and reliable decision-making basis for the network security operation and maintenance of power systems, and meeting the accuracy and application requirements of multi-source power data anomaly identification in actual production environments. Attached Figure Description

[0017] Figure 1 This is a flowchart of a method for identifying anomalies in multi-source power data based on graph neural networks, provided in an embodiment of this application. Figure 2 This is a flowchart illustrating the process of obtaining an event log set as provided in an embodiment of this application; Figure 3 This is a flowchart illustrating the acquisition of a runtime segment as provided in an embodiment of this application; Figure 4 This is a schematic diagram of a process for mapping an event record to a source graph sample provided in an embodiment of this application; Figure 5 This is a flowchart illustrating the working principle of a graph neural network provided in this application embodiment; Figure 6 This is a flowchart illustrating the process of obtaining a node embedding vector as provided in an embodiment of this application. Figure 7This is a flowchart of an abnormal fragment tracing process provided in the embodiments of this application; Figure 8 This is a schematic diagram of the structure of a power multi-source data anomaly identification system based on graph neural networks provided in the embodiments of this application; Figure 9 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of systems and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0019] Among related technologies, the primary challenge in power APT detection lies in the significant differences in data format and semantics. Different data sources exhibit marked differences in field definitions, time precision, event granularity, and object identification methods. Simply concatenating data or modeling based on a single data source will lead to inconsistencies between the graph structure and the feature space, making cross-system and cross-scenario reuse difficult. Furthermore, power business objects possess specific semantics, such as dispatch master stations, station control layer and process layer equipment, gateways, and IEDs, each playing a different role in the attack chain. Without a power semantic mapping, detection results will be difficult for operations and maintenance personnel to understand and translate into actionable measures.

[0020] Furthermore, power sector APT attacks typically exhibit long-term latency and phased progression. The time intervals, periodicity, and phase transitions between events are key indicators for distinguishing normal operational activities from malicious behavior. However, existing methods often directly input timestamps as discrete or absolute value features, which can easily lead to scale instability and insufficient generalization ability. On the other hand, publicly available APT data in the power industry is extremely limited, attack samples are scarce, and annotation costs are high. Detection models relying on supervised learning are prone to overfitting, resulting in significant performance degradation when dealing with new types of attacks or cross-scenario migration. Meanwhile, the source graph is massive and contains a large number of background noise events. Without consistent constraints on the graph structure and attributes, the model is easily overwhelmed by high-frequency normal patterns, leading to both false positives and false negatives.

[0021] In view of this, this application provides a method for anomaly identification of multi-source power data based on graph neural networks. This method includes acquiring an event record set of multi-source power data; processing the event record set through PROV semantic mapping to obtain a node set and an edge set; and constructing a source graph based on the node set and the edge set to complete unified modeling of cross-source power data. This solves the problem of inconsistent semantic formats of data from different sources, reduces background noise interference in the source graph, and lowers the probability of the model being overwhelmed by high-frequency normal patterns. When the time interval exceeds a preset time threshold, the time interval exceeding the preset time threshold is determined as a candidate segment boundary, and the continuous event stream is divided based on the candidate segment boundaries. By breaking down long-term attack behaviors into segmented features, the problems of unstable time feature scale and insufficient generalization are alleviated, and the model's ability to capture features of cross-stage abnormal activities is improved. The source map and all source map samples are processed by multi-feature encoding and feature enhancement and then input into the graph neural network. Abnormal fragments are output through embedding learning. Combined with the embedding learning of source map samples by the graph neural network, low-frequency abnormal attack patterns can be accurately discovered, improving the accuracy of anomaly identification. At the same time, it is possible to further trace back to locate the location and propagation process of anomalies, providing a clear and reliable decision-making basis for the network security operation and maintenance of power systems, and meeting the accuracy and application requirements of power multi-source data anomaly identification in actual production environments.

[0022] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0023] Figure 1 This is an optional flowchart of a method for identifying anomalies in multi-source power data based on graph neural networks, provided in an embodiment of this application. Figure 1 The method may include, but is not limited to, steps S101 to S104.

[0024] Step S101: Obtain an event record set, which includes several event records. The event records represent the operational behavior information of various entities generated during the multi-source power data processing. Step S102: Perform PROV semantic mapping processing on several event records to obtain a node set and an edge set, and construct a source graph based on the node set and the edge set; Step S103: Perform event segmentation processing on the event record set according to the time sequence to obtain several running segments. Each running segment includes several event records, and map all event records in each running segment to a source map sample. Step S104: Input the source map and all the source map samples into the graph neural network and output abnormal segments. The abnormal segments are used to represent abnormal operation segments in the process of power multi-source data operation.

[0025] Among them, event records can be information on the operational behavior of various entities generated during the multi-source power data processing process, specifically events obtained by mapping the original events through field mapping functions.

[0026] Steps S101 to S104 as shown in the embodiments of this application firstly involve acquiring an event record set of multi-source power data, constructing a source graph by performing PROV semantic mapping on the event record set; then performing event segmentation processing on the event record set based on time intervals to decompose long-span attack behaviors into segmented features; finally, inputting the source graph and all source graph samples into a graph neural network, and outputting abnormal segments after feature encoding, feature enhancement, and embedding learning.

[0027] Please see Figure 2 In step S101 of some embodiments, obtaining the event record set includes: Obtain the original event set, which includes several original events; All the original events are mapped to event records using the field mapping function; The event record set is obtained by performing field quality processing on several of the event records.

[0028] Raw events can be host logs, network connection records, security alarm records, asset ledger data, and business system events. Let the set of raw events be: ; in, Represents the original set of events. Let i represent the i-th primitive event. For any primitive event... Through field mapping functions Converted into a unified event log : ; in, Indicates the time of the event. Represents the source object. Indicates the target object. Indicates the type of event action or operation. Indicates the event category, Indicates the data source. This indicates the index of the original log or alarm record.

[0029] For host-side data, priority is given to extracting process identifier, parent process identifier, file path, user identifier, operation type, and return status; for network-side data, priority is given to extracting source address, destination address, port, protocol, connection direction, and session status; for alarm data, priority is given to extracting alarm level, alarm type, triggering device, and associated asset; for asset data, priority is given to extracting device name, asset type, region, and business role.

[0030] To preserve the reliability differences between multi-source data, a field quality vector is generated for each event record: ; in, Indicates the situation where key fields are missing. Indicates the precision level of the timestamp. This indicates whether the object identifier can be matched with the asset ledger. Indicates the data source type. This indicates whether there is a conflict between cross-source object identifiers. This quality vector is not used as a standalone detection result, but rather as an auxiliary input in the subsequent feature encoding stage.

[0031] Event times are still normalized. Let the minimum time in the runtime segment or global event set be... Then the relative time of the event is: ; in, The event relative time is represented. Finally, the event relative time, the field quality vector, and the event record are merged to obtain the event record set.

[0032] In other embodiments, those skilled in the art can make appropriate adjustments to the method of obtaining the event record set based on their understanding of the inventive concept of this application.

[0033] In step S102 of some embodiments, PROV semantic mapping processing is performed on a plurality of event records to obtain a node set and an edge set, and a source graph is constructed based on the node set and the edge set; specifically including: The event records are mapped to a unified source tracing semantic space, and a source tracing graph structure is constructed. Specifically, based on the PROV model, data objects in multi-source power data are abstracted into entities, operation processes are abstracted into activities, and responsible executors are abstracted into subjects. Event relationships are mapped into semantic relationships such as use, generation, triggering, and derivation. At the same time, the semantics of power business objects are combined for extended mapping, so that the dispatch master station, station host, gateway, terminal, and key assets can be expressed in an interpretable way in the graph.

[0034] In this embodiment, a source graph is constructed by defining a set of nodes based on three concepts: entity, activity, and subject, and defining a set of edges based on semantic relationships. Furthermore, a power asset role mapping function is introduced based on general source semantics. Write the business roles such as scheduling master station, station host, border gateway, operation and maintenance terminal, application server, database server, and communication equipment into the node attributes: ; in, Indicates the role of assets. Indicates the region or network partition to which it belongs. Indicates the asset importance level. This indicates the asset's operational or maintenance status. For objects that cannot be directly matched to the asset ledger, candidate business role tags can be generated based on IP address ranges, hostname rules, port characteristics, or data source locations.

[0035] The constructed source graph can be represented as: ; in, For a set of nodes, Let be a set of directed edges. For a collection of node attributes, For the set of edge attributes, This refers to the event time or snapshot time range. The node set includes three categories: entities, activities, and subjects. Entities represent objects such as files, network objects, data packets, alarm objects, and power service equipment. Activities represent operations such as process execution, file reading and writing, network communication, protocol interaction, and command execution. Subjects represent users, accounts, system components, service processes, or business roles with assigned responsibilities.

[0036] Edge sets are used to express the PROV semantic relationships between nodes, mainly including , , , , , and Relationship. Each edge can be represented as: ; in, , These are the start and end points of the edge, respectively. The relation type is PROV. This refers to the event time corresponding to the relationship. To adapt to the power APT scenario, this invention maintains the aforementioned general PROV relationship type unchanged, interprets the meaning of the relationship in the power business scenario through the method of "node type pair + relationship type", and maps power business concepts such as dispatch control center, distribution automation system, monitoring terminal, back-end server, remote control, data acquisition, task scheduling, file transfer and command execution to node type or node attribute, thereby enhancing the interpretability of the business without changing the basic edge semantics of the source graph.

[0037] In other embodiments, those skilled in the art can make appropriate adjustments to the method of obtaining the traceability diagram based on their understanding of the inventive concept of this application.

[0038] Please see Figure 3 In some embodiments, step S103 may include, but is not limited to, steps S301 to S304: Step S301: Sort the event records in chronological order to obtain a continuous event stream; Step S302: Perform time feature extraction processing on the continuous event stream to obtain several time intervals, wherein the time intervals represent the time difference between any two adjacent event records in the continuous event stream; Step S303: When the time interval exceeds a preset time threshold, the time interval exceeding the preset time threshold is determined as the candidate segment boundary; Step S304: Divide the continuous event stream based on the candidate segment boundaries to obtain several running segments.

[0039] Wherein, the continuous time stream is a set of event records ordered chronologically, that is, the continuous time stream can be represented as: ; in, Show a continuous event stream, Indicates the first 1 event record, This represents the corresponding normalized timestamp. Indicates the total number of events.

[0040] For any two consecutive adjacent events in a continuous event stream, calculate the time interval between the adjacent events: ; when Greater than the silent threshold When this happens, it is used as the boundary of the candidate segment. To avoid individual segments being too large or too small, a lower limit on the number of events is also set. and upper limit The lower and upper limits for the number of events are used to constrain the total number of events contained in each running segment. If the sum of the total number of events in two adjacent segments obtained after division is less than the lower limit for the number of events, the two adjacent segments are merged. If the total number of events contained in a single segment exceeds the upper limit for the number of events, the segment is divided a second time according to the average step size, and finally several running segments that meet the length constraints are obtained.

[0041] For intervals where event density increases significantly, a density function is used. Identifying high-frequency regions: ; in, For kernel function, For bandwidth. When When this time interval is considered a high-frequency event region, the segment span can be appropriately reduced; when At that time, the events are divided into regular categories based on the number of events and the silence interval. This is a preset density threshold.

[0042] The time exceeding a preset time threshold is determined as the candidate segment boundary. Based on the candidate segment boundary, the continuous event stream is divided into k running segments. For the kth segment... One running segment Its event set is as follows: ; in, Indicates the first The initial time of each running segment, Indicates the first In this embodiment, the end time of each running segment is the same as the initial time of the running segment. and end time It was determined to be the boundary of the candidate segment.

[0043] Please see Figure 4 In some embodiments, mapping all event records in each of the running segments to a source graph sample includes: Obtain the event set corresponding to the running segment; Feature extraction is performed on the event records in the event set to obtain the malicious segment ratio and segment tags; Based on the nodes and edges corresponding to the event records in the source graph, sample structural features are obtained, and the malicious proportion of the fragment, the fragment label and the sample structural features are mapped by a mapping function to obtain the source graph sample.

[0044] Specifically, for each running segment Iterate through all the events contained within the segment and extract the set of nodes corresponding to all events within that segment from the already constructed global source graph G. Sum of edges Further extract the attribute set corresponding to the node. The set of attributes corresponding to the edges Finally, the subgraph corresponding to this running segment is constructed. This refers to the source map sample. Specifically, it involves running the fragment. The event mapping in the graph is a source graph sample: ; Simultaneously, all events within the segment are traversed. If the proportion of malicious events in the segment exceeds a preset threshold, the segment is marked as an abnormal sample; otherwise, it is marked as a normal sample, thus obtaining the label information for the corresponding source map sample. If the sample is a partially labeled scenario, the label bits of the unlabeled sample are retained as the state to be predicted, and the loss is calculated only using the labeled sample during the training phase.

[0045] If the running segment contains annotation information, segment tags can be generated based on the proportion of malicious events within the running segment: ; in, Indicates the number of malicious events within the segment. Indicates the total number of events within the segment. Indicates the fragment label threshold. This represents the proportion of malicious events within the segment.

[0046] This embodiment divides the continuous event stream into multiple time snapshots and converts each snapshot into a source graph sample. Since attack behavior may exhibit density spikes and phased progressions on the timeline, density estimation is used to identify dense time intervals, and combined with an equal number of events partitioning strategy, each snapshot contains a similar number of events, thereby achieving a more balanced graph sample size and structural complexity.

[0047] In other embodiments, those skilled in the art can make appropriate adjustments to the acquisition methods of the running segments and the traceability map samples based on their understanding of the inventive concept of this application.

[0048] In step S104 of some embodiments, the source map and all the source map samples are input into a graph neural network to output abnormal segments, which are used to represent abnormal operation segments in the process of power multi-source data operation.

[0049] It should be noted that this application adopts an end-to-end anomaly detection framework. First, the source map and all source map samples are transformed, encoded and fused in multiple dimensions. Then, feature enhancement is completed through graph attention mechanism. Subsequently, a graph-level representation is generated through global pooling. Finally, the confidence score of the source map sample as an abnormal segment is output. The running segment corresponding to the sample with a score higher than a preset threshold is the identified abnormal result.

[0050] Specifically, in this embodiment, this step includes: First, the security semantics of nodes, edges, time, and original fields in the source graph are converted into initial input features that can be processed by graph neural networks. Text field semantics, token pattern hits, field quality labels, and local topological statistics are then introduced to enable the initial features of the source graph to express more observable clues related to attack behavior. This includes the following transformation encoding methods: (1) One-Hot encoding: The node type and edge type are encoded to obtain the node type encoding and edge type encoding. Let the set of node types be The set of edge types is For nodes Its type is Node type encoding for: ; For a large number of node categories, a trainable embedding matrix is ​​used. Encode: ; For the edge Its relation type is Edge type encoding for: ; (2) Time encoding: Encoding time to obtain a continuous vector space: Functional time coding is used to map time into a continuous vector space, emphasizing relative time differences rather than absolute time values. The mapping is defined as follows. Temporal similarity is characterized by inner product: ; in, For time-encoding mapping functions, Represents the space of time values. yes 3D real vector space, Indicates time and The similarity function is equal to the inner product of the two functions. , that is , representing a kernel function that depends only on the relative time difference, and using random Fourier features to approximate finite-dimensional encoding: ; in, Indicates time of 3D time-encoded vector, For learnable frequency parameters, For learnable phase bias, To encode the dimension, the type-specific one-hot vector and the time-encoded vector are concatenated to form the final input feature vector of the node and edge, which is used for subsequent graph neural network learning.

[0051] (3) Semantic encoding of text fields: The open text fields are encoded to obtain text semantic features: For open text fields such as command lines, file paths, process names, URLs, account names, and alarm descriptions, normalization is first performed, including case consistency, path separator consistency, IP address replacement, random string normalization, numeric fragment generalization, and script suffix preservation. (Set up an object...) Text field collection for: ; in, Representation Object The An open text field, after normalization and word segmentation, yields a token sequence. : ; in, The first word obtained after normalization and word segmentation One token, for a token sequence Embedding and pooling are performed to obtain text semantic features. : ; in, Lightweight word vectors, hash embeddings, or token embeddings based on training data can be used. Average pooling or max pooling can be used.

[0052] (4) Token pattern feature encoding: The suspicious field fragments are encoded to obtain the pattern feature. To enhance the ability to express suspicious field fragments, this module establishes a token pattern set P: ; in, It can represent field patterns such as script suffixes, sensitive directories, abnormal command parameters, external link address fragments, compression or encryption related tokens, and remote execution related tokens. For objects... Define the pattern hit function : ; Based on the matching results of each token pattern, obtain the object. The pattern feature vector: ; in, Representation Object The pattern feature is used to characterize whether the text field of an object contains the aforementioned suspicious field patterns. If there are statistics on normal and abnormal samples, a discrimination score is calculated. : ; in, This indicates the number of times the pattern appears in the abnormal samples. This indicates the number of times the pattern appears in normal samples. For smoothing terms, This indicates the degree to which the pattern covers anomalous samples. If no labeled samples exist, a basic weight can be assigned to the pattern by security rules or manual configuration.

[0053] (5) Local topology and business attribute encoding: The nodes are encoded to obtain topology features, business attribute features, and quality label features: For nodes Extract lightweight topological features such as in-degree, out-degree, neighbor type distribution, whether it is associated with external connections, whether it is associated with sensitive assets, and whether it is located in cross-region access relationships: ; in, and These represent in-degree and out-degree, respectively. , , This indicates the number of objects of different types in the neighborhood. Indicates whether cross-regional or cross-border relationships are involved.

[0054] The power business attributes and field quality vectors are denoted as follows:

[0055] ; in, For the role mapping function of power assets The obtained power business attribute vector is used to represent the node. The business role, region, importance, and operation or maintenance status of the corresponding asset; For field quality vector At the node The corresponding representation on the above is used to indicate information such as missing key fields, timestamp precision, object identifier matching, data source type, and cross-source identifier conflict.

[0056] All transformed features are then fused, including: For nodes The node fusion vector is obtained by concatenating type features, FTE temporal features, textual semantic features, pattern features, topological features, business attributes, and quality markers. For the edge Similarly, by constructing the edge fusion vector, we obtain the edge fusion vector. ; To obtain an initial representation with uniform dimensions, fusion is performed using linear projection or a multilayer perceptron: ; in, For nodes The initial enhancement representation, The spliced ​​and normalized node fusion features, This is the learnable projection weight matrix for the node feature fusion stage. For the corresponding bias term, This represents a non-linear activation function.

[0057] The fused and concatenated features are enhanced using a graph attention encoder, including: Graph attention encoders infer and reconstruct masked features using neighborhood structure and contextual information. Specifically, graph attention encoders employ graph attention networks for message passing. Floor, Neighbor To the node News Defined as: ; in, Represents a node For neighboring nodes Attention weights Indicates the first The learnable feature transformation matrix of the layer, Represents a node In the Layer representation. Neighbor set. Aggregation yields: ; in, Represents a node The set of neighboring nodes, Indicates the first The intermediate representation is obtained after aggregating neighborhood messages at each layer. Further updates yield the next layer's representation. : ; in, Represents a node After the first The next layer representation obtained after message passing. This represents a non-linear activation function. The attention weights, learnable transformation matrix, and non-linear activation function together determine the weighting method for neighborhood aggregation.

[0058] During training, some node features are randomly masked. The decoder uses the contextual representation output by the graph attention encoder to reconstruct the masked features, minimizing the difference between the input features and the reconstructed features, thereby learning the attribute co-occurrence patterns of normal behavior.

[0059] To enable the latent representation to simultaneously encode structural patterns, a structural reconstruction branch is introduced in addition to node attribute reconstruction. This embodiment performs positive and negative sampling of edges and executes a binary classification reconstruction task to constrain topological consistency. The overall optimization objective is jointly constituted by the node reconstruction loss and the edge reconstruction loss: ; in, This represents the overall loss of the model. This represents the reconstruction loss of the masked node. Indicates the loss from edge reconstruction. The coefficients are used for tradeoffs. Through this joint optimization, the model is forced to recover node features and relational dependencies under conditions of missing attributes and perturbation structures, thereby learning stable normal co-occurrence patterns and potential causal structures.

[0060] Please see Figure 5 In some embodiments, the source map and all source map samples are input into a graph neural network to output anomaly fragments, including: The node embedding vectors are obtained by embedding the node features and structural features of the source graph through a graph neural network. Graph-level representation is completed based on the node embedding vectors, and the anomaly score of the source graph sample is obtained; The running segments corresponding to the source map samples whose abnormal scores exceed the preset abnormal threshold are identified as abnormal segments.

[0061] Specifically, the fragment image sample will be run. The nodes, edges, time, and original fields in the data are encoded into a secure semantic representation for the initial enhanced representation, where the node side forms... The sides are made of The corresponding edge features are obtained through fusion; and the initial enhanced representation and the source graph structure are used as input to a graph neural network for embedding learning. Node-level representations and graph-level representations are obtained through node masking, edge reconstruction, and graph attention encoding. Based on this, anomaly scores are calculated based on the reconstruction results and graph-level representations.

[0062] The graph-level embedding distance is determined by Representation of normal operation segments at the graph level The distance between them is obtained as follows: ; in, Cosine distance is used.

[0063] For the A sample of running fragments The attribute reconstruction error is taken from the node attribute reconstruction loss of the graph sample, and the structure reconstruction error is taken from the edge reconstruction loss of the graph sample, that is: ; ; Among them, for the first A sample of running fragments Anomaly scores are obtained by comprehensively considering node attribute reconstruction errors, structural reconstruction errors, and the differences between the graph-level representation and normal operation segments. : ; in, This indicates the attribute reconstruction error. This indicates the error in structural reconstruction. Indicates the graph-level embedding distance. , , This is the weighting coefficient. When the abnormal score exceeds the preset threshold, the running segment is determined to be an abnormal segment.

[0064] Please see Figure 6In one feasible embodiment, the graph neural network includes a graph attention encoder; the step of embedding and learning the node features and structural features of the source graph through the graph neural network to obtain node embedding vectors includes: The node features and structural features of the source graph are subjected to multi-feature encoding processing to obtain several types of node features; The features of all the nodes are concatenated to obtain the initial enhanced fusion features; The initial enhanced fusion features are enhanced by the graph attention encoder to obtain enhanced fusion features, and node embedding vectors are obtained based on the enhanced fusion features.

[0065] Specifically, the input multi-source power data is first categorized, and each node and edge type is mapped to a one-hot vector of the corresponding dimension according to the One-Hot encoding rule, completing the initial characterization of node and edge type features. Then, the time information associated with each object is time-encoded, and a finite-dimensional time feature vector is obtained through random Fourier features to capture the time difference layout pattern. Next, the open text fields are normalized and word-segmented, and the corresponding text semantic features are obtained through pooling. Then, the hit result and discrimination score are calculated based on a preset token pattern set to obtain the pattern feature vector. Finally, the topological features, power business attribute features, and field quality features are concatenated and normalized with all the aforementioned features, and then the initial enhanced representation of nodes and edges is obtained through nonlinear projection. This initial representation is then input into the subsequent graph attention encoder for feature enhancement learning to obtain node embedding vectors, completing the entire fusion process of local topology and business attribute encoding.

[0066] In other embodiments, those skilled in the art can make appropriate adjustments to the method of obtaining the abnormal fragments based on their understanding of the inventive concept of this application.

[0067] Please see Figure 7 In one feasible embodiment, the method further includes: Based on all the aforementioned abnormal fragments, several key nodes and key edges are selected from the source tracing graph; Backtracking is performed on the source graph based on all the key nodes and key edges to obtain several candidate causal paths; Based on all the aforementioned causal paths, the starting node and complete propagation link of the anomaly propagation are determined, and the location of the anomaly and the propagation process of the anomaly in the multi-source power data are located.

[0068] After identifying the anomalous segments, key nodes and edges are selected from the graph based on reconstruction error, pattern matching, and asset importance. Then, starting from these key nodes or edges, forward or backward backtracking with a limited number of hops is performed in the directed causal graph to obtain several candidate causal paths.

[0069] If multiple anomaly segments are temporally consecutive and involve the same asset, entity, or relationship type, they can be merged into a single anomaly stage to reduce duplicate alerts. The final output includes the anomaly segment number, time range, anomaly score, key nodes, key edges, candidate causal paths, associated power assets, and the original event index. Through this output method, this invention not only provides anomaly determination but also retains traceable object, relationship, and path information, facilitating subsequent manual verification and attack tracing.

[0070] Specifically, after identifying anomaly segments, key nodes and edges are selected based on their anomaly contribution. Anomaly contribution is calculated by combining a node's anomaly score with the attention weight during graph attention aggregation, retaining nodes and edges with the highest contribution as key elements. Then, starting from the anomaly endpoint, the process traverses backwards according to the dependencies of the source graph, backtracking all reachable predecessor nodes and related edges to generate multiple candidate causal paths. These candidate paths are then ranked based on the sum of the anomaly contributions of all key nodes along the path, selecting the path with the highest score as the final anomaly propagation link. The starting node of this path represents the initial location of the power multi-source data anomaly. The entire path fully reconstructs the propagation process of the anomaly in the power data network, providing a clear basis for subsequent anomaly handling and root cause analysis.

[0071] The following is a detailed description and explanation of the solutions in the embodiments of the present invention, using specific application examples: This application provides a method for identifying anomalies in multi-source power data based on graph neural networks. First, the original logs and event files in the multi-source power data are read, a unified set of field records is generated according to preset field mapping rules, and the subject and object information are written into a structured data table to ensure that nodes and edges can be uniformly constructed in the code later.

[0072] In the code, each record is constructed as an event object. Each event object contains at least the event time, source object identifier, destination object identifier, event relationship type, and direction information, and undergoes basic cleaning and deduplication. To facilitate subsequent calculations, the event times are uniformly converted to a numeric type and sorted.

[0073] The runtime segments are divided based on the time interval between adjacent events, the number of events, and the event density. When the time interval between adjacent events exceeds the silence threshold, it is used as a candidate segment boundary. When the local event density is high, the segment span is appropriately shortened. When events are sparse, adjacent events are merged according to the lower limit of the event number. For the [missing information]... Each runtime segment generates an event set. This data is then used as input for subsequent graph samples. For labeled data, the proportion of malicious segments is calculated, and segment labels are generated.

[0074] For events within each runtime segment, files, network objects, assets, and alarm objects are mapped to entities according to PROV semantics; process execution, file access, network connection, and business operations are mapped to activities; and users, accounts, system components, or device roles are mapped to subjects. Then, directed relationships such as usage, generation, association, derivation, triggering, or connection are generated based on event actions, forming a segment sourcing graph. For power business objects, asset roles such as master station, station-side host, border gateway, maintenance terminal, and server are written into node attributes. For repeated relationships of the same type within the same segment, they can be merged or counted to reduce redundant edges and preserve relationship strength.

[0075] The system constructs type features, FTE time features, text field semantic features, token pattern features, local topology features, field quality features, and power business attribute features for nodes and edges. Among these, FTE is used to encode relative time and time intervals, while text field semantics and token patterns are used to record suspicious field fragments in command lines, paths, URLs, process names, and alarm descriptions. For nodes... The various features are concatenated and projected into a unified dimensional representation, with edge features constructed in the same way. After completion, the initial node representations, initial edge representations, and graph structure are input into the subsequent graph neural network.

[0076] By constructing an encoder and decoder, node features are masked and attribute and structure reconstructions are performed during training. Self-supervised learning is conducted using only normal snapshots or primarily normal snapshots during training, allowing the model to fully learn the structural and attribute co-occurrence patterns of normal behavior.

[0077] The system calculates attribute reconstruction error, structural reconstruction error, and graph-level embedding distance for the tested runtime segment to obtain an anomaly score. When the anomaly score exceeds a preset threshold, the segment is identified as an anomalous segment. Finally, key nodes and key edges are selected based on reconstruction error, pattern matching, and asset importance. A limited number of forward or backward backtracking steps are then performed from the key objects to obtain candidate causal paths. The final output includes the anomalous segment number, time range, anomaly score, key nodes, key edges, candidate causal paths, associated power assets, and the original event index.

[0078] Please see Figure 8 This application also provides a power multi-source data anomaly identification system based on graph neural networks, which can implement the above-mentioned method. The system includes: The first module is used to acquire an event record set, which includes several event records. The event records represent the operational behavior information of various entities generated during the multi-source power data processing. The second module is used to perform PROV semantic mapping processing on several event records to obtain a set of nodes and a set of edges, and to construct a source graph based on the set of nodes and the set of edges; The third module is used to divide the event record set into several running segments according to the time sequence, each running segment includes several event records, and maps all event records in each running segment to traceability graph samples; The fourth module is used to input the source map and all the source map samples into the graph neural network and output abnormal segments, which are used to represent abnormal operation segments in the process of power multi-source data operation.

[0079] It is understood that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0080] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-described method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0081] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0082] Please see Figure 9 , Figure 9 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes: The processor 901 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application. The memory 902 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 902 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 902 and is called and executed by the processor 901 using the methods described in the embodiments of this application. The input / output interface 903 is used to implement information input and output; The communication interface 904 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.). Bus 905 transmits information between various components of the device (e.g., processor 901, memory 902, input / output interface 903, and communication interface 904); The processor 901, memory 902, input / output interface 903, and communication interface 904 are connected to each other within the device via bus 905.

[0083] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0084] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0085] This application provides a method, system, electronic device, storage medium, and program product for identifying anomalies in multi-source power data based on graph neural networks. It constructs a source graph by performing PROV semantic mapping on event records during multi-source power data processing, then obtains source graph samples corresponding to operational segments based on time. Through multi-feature encoding, it fuses local topology and business attribute information, and leverages graph neural networks for self-supervised learning, while also considering pattern learning of node attributes and topological structures. Ultimately, it achieves accurate identification of anomaly segments and traceable location of the anomaly propagation process. This solution effectively mines hidden entity dependencies and behavioral patterns in multi-source power data, solving the problem that traditional anomaly detection methods struggle to capture complex topological relationships in power data. It improves the accuracy and source tracing capabilities of multi-source power data anomaly identification, providing reliable technical support for power system data security.

[0086] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0087] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0088] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0089] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for identifying anomalies in multi-source power data based on graph neural networks, characterized in that, The method includes: Obtain an event record set, which includes several event records, and the event records represent the operational behavior information of various entities generated during the multi-source power data processing; PROV semantic mapping is performed on several event records to obtain a set of nodes and a set of edges, and a source graph is constructed based on the set of nodes and the set of edges; The event record set is divided into several running segments according to the time sequence, each running segment includes several event records, and all event records in each running segment are mapped to source map samples; The source map and all source map samples are input into a graph neural network, which outputs anomaly segments. These anomaly segments represent abnormal operation segments in the process of multi-source power data operation.

2. The method according to claim 1, characterized in that, The acquisition of the event record set includes: Obtain the original event set, which includes several original events; All the original events are mapped to event records using the field mapping function; The event record set is obtained by performing field quality processing on several of the event records.

3. The method according to claim 1, characterized in that, The event record set is divided into several execution segments according to the time sequence, including: The event records are sorted in chronological order to obtain a continuous event stream; The continuous event stream is processed by time feature extraction to obtain several time intervals, which represent the time difference between any two adjacent event records in the continuous event stream; When the time interval exceeds a preset time threshold, the time interval exceeding the preset time threshold is determined as the candidate segment boundary; The continuous event stream is divided based on the candidate segment boundaries to obtain several running segments.

4. The method according to claim 1, characterized in that, The step of mapping all event records in each of the running segments to a source graph sample includes: Obtain the event set corresponding to the running segment; Feature extraction is performed on the event records in the event set to obtain the malicious segment ratio and segment tags; Based on the nodes and edges corresponding to the event records in the source graph, sample structural features are obtained, and the malicious proportion of the fragment, the fragment label and the sample structural features are mapped by a mapping function to obtain the source graph sample.

5. The method according to claim 1, characterized in that, The step of inputting the source map and all the source map samples into a graph neural network and outputting abnormal fragments includes: The node embedding vectors are obtained by embedding the node features and structural features of the source graph through a graph neural network. Graph-level representation is completed based on the node embedding vectors, and the anomaly score of the source graph sample is obtained; The running segments corresponding to the source map samples whose abnormal scores exceed the preset abnormal threshold are identified as abnormal segments.

6. The method according to claim 5, characterized in that, The graph neural network includes a graph attention encoder; the step of embedding and learning the node features and structural features of the source graph through the graph neural network to obtain node embedding vectors includes: The node features and structural features of the source graph are subjected to multi-feature encoding processing to obtain several types of node features; The features of all the nodes are concatenated to obtain the initial enhanced fusion features; The initial enhanced fusion features are enhanced by the graph attention encoder to obtain enhanced fusion features, and node embedding vectors are obtained based on the enhanced fusion features.

7. The method according to claim 1, characterized in that, The method further includes: Based on all the aforementioned abnormal fragments, several key nodes and key edges are selected from the source tracing graph; Backtracking is performed on the source graph based on all the key nodes and key edges to obtain several candidate causal paths; Based on all the aforementioned causal paths, the starting node and complete propagation link of the anomaly propagation are determined, and the location of the anomaly and the propagation process of the anomaly in the multi-source power data are located.

8. A power multi-source data anomaly identification system based on graph neural networks, characterized in that, The system includes: The first module is used to acquire an event record set, which includes several event records. The event records represent the operational behavior information of various entities generated during the multi-source power data processing. The second module is used to perform PROV semantic mapping processing on several event records to obtain a set of nodes and a set of edges, and to construct a source graph based on the set of nodes and the set of edges; The third module is used to divide the event record set into several running segments according to the time sequence, each running segment includes several event records, and maps all event records in each running segment to traceability graph samples; The fourth module is used to input the source map and all the source map samples into the graph neural network and output abnormal segments, which are used to represent abnormal operation segments in the process of power multi-source data operation.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

Images