A power grid dispatching terminal authentication method, system, device, medium and product

Abstract

The application discloses a power grid dispatching terminal authentication method, system, equipment, medium and product, relates to the technical field of digital computer information security and man-machine behavior recognition, adjusts a global shared network of a preset modal feature extraction model according to a global shared network weight, obtains a corresponding target modal feature extraction model, extracts multi-modal features from standard terminal data flow through the target modal feature extraction model and the global shared network weight, obtains a corresponding user behavior embedding vector, performs trust evaluation based on a preset local storage legal user reference holographic image and the user behavior embedding vector, obtains a corresponding trust score, performs authentication decision according to the trust score and a dispatching instruction type, obtains a corresponding access control strategy, and adjusts the power grid dispatching terminal according to the access control strategy. The technical problem that the existing authentication method is difficult to adapt to the special scene of high safety, real-time performance and user behavior heterogeneity of the power grid dispatching is solved.

Description

Technical Field

[0001] This invention relates to the field of digital computer information security and human-machine behavior recognition technology, and in particular to a power grid dispatching terminal authentication method, system, device, medium and product. Background Technology

[0002] With the widespread adoption of remote power grid dispatching, mobile dispatching terminals can access core control systems across the internet and DMZ regions, rendering the traditional boundary protection plus static one-time authentication model inapplicable. The lack of continuous identity verification after terminal login makes them highly susceptible to security vulnerabilities such as account theft and terminal hijacking, threatening the operational safety of power grid equipment. Dispatcher keystrokes and mouse movements are considered sensitive data, and the industry requires local storage of such data. Traditional centralized behavior recognition models require aggregating raw terminal data for cloud training, posing privacy and compliance risks. Federated learning, multimodal behavior recognition, and zero-trust security technologies offer solutions to this problem, but existing solutions struggle to adapt to the specific scenarios of high security, real-time requirements, and heterogeneous user behavior in power grid dispatching. Summary of the Invention

[0003] This invention provides a method, system, device, medium, and product for power grid dispatching terminal authentication, solving the problem that traditional centralized behavior recognition models require aggregating raw terminal data to the cloud for training, which poses privacy and compliance risks. Federated learning, multimodal behavior recognition, and zero-trust security technologies offer solutions to this problem, but existing solutions are difficult to adapt to the special scenarios of high security, real-time requirements, and heterogeneous user behavior in power grid dispatching.

[0004] The first aspect of this invention provides a power grid dispatch terminal authentication method, comprising: The real-time data stream, dispatch instruction type, and global shared network weight of the power grid dispatch terminal are obtained, and the real-time data stream is preprocessed to obtain the corresponding standard terminal data stream. The global shared network of the preset modal feature extraction model is adjusted according to the global shared network weights to obtain the corresponding target modal feature extraction model; Multimodal features are extracted from the standard terminal data stream using the target modal feature extraction model and the global shared network weights to obtain the corresponding user behavior embedding vector; Trust assessment is performed based on a preset local storage benchmark holographic profile of legitimate users and the user behavior embedding vector to obtain a corresponding trust score; An authentication decision is made based on the trust score and the type of scheduling instruction to obtain the corresponding access control policy, and the power grid scheduling terminal is adjusted according to the access control policy.

[0005] Optionally, the target modality feature extraction model includes a global shared network and a multimodal attention network, and the standard terminal data stream includes keystroke timing data, mouse trajectory timing data, and eye-tracking fixation point data. The step of extracting multimodal features from the standard terminal data stream using the target modality feature extraction model and the global shared network weights to obtain the corresponding user behavior embedding vector includes: The keystroke timing data is used to construct the corresponding keystroke behavior feature vector, and kinematic features are extracted from the mouse trajectory timing data to obtain the corresponding mouse behavior feature vector. The corresponding visual heatmap matrix is ​​constructed using the eye-tracking fixation point data; Temporal features of the keystroke behavior feature vector and the mouse behavior feature vector are extracted by the long short-term memory network of the global shared network to obtain the corresponding first temporal feature vector and second temporal feature vector. Spatial features are extracted from the visual heatmap matrix using the convolutional neural network of the global shared network to obtain the corresponding visual spatial feature map; The first temporal feature vector, the second temporal feature vector, and the visual spatial feature map are fused using the multimodal attention network to obtain the corresponding user behavior embedding vector.

[0006] Optionally, the step of performing trust assessment based on a preset locally stored legitimate user baseline holographic profile and the user behavior embedding vector to obtain a corresponding trust score includes: Calculate the cosine similarity and Mahalanobis distance mixture metric between the user behavior embedding vector and the preset local storage legal user baseline holographic profile, respectively; The preset matching benchmark value and the Mahalanobis distance hybrid metric are summed to obtain the corresponding first sum value; The matching benchmark value is compared with the first sum value to obtain the corresponding first ratio value; Based on the preset confidence weight, the cosine similarity and the first ratio are weighted and calculated to obtain the corresponding instantaneous confidence. Based on the smooth decay weight, the pre-acquired historical instantaneous confidence and the instantaneous confidence are weighted and calculated to obtain the corresponding trust score.

[0007] Optionally, the step of making an authentication decision based on the trust score and the scheduling instruction type to obtain the corresponding access control policy includes: The corresponding risk coefficient is obtained by retrieving the preset business risk coefficient mapping table using the scheduling instruction type; The difference between the preset safety threshold and the preset basic low-risk threshold is processed to obtain the corresponding first difference; The first difference is multiplied by the square of the risk coefficient to obtain the corresponding certification benchmark value; The basic low-risk threshold is summed with the authentication benchmark value to obtain the corresponding authentication threshold; The authentication decision is made based on the authentication threshold and the basic low-risk threshold, and the corresponding access control policy is obtained.

[0008] Optionally, the step of making an authentication decision based on the trust score according to the authentication threshold and the basic low-risk threshold to obtain the corresponding access control policy includes: When the trust score is greater than the authentication threshold, the first control policy is determined as the corresponding access control policy. When the trust score is less than or equal to the authentication threshold, it is determined whether the trust score is greater than the basic low-risk threshold. When the trust score is greater than the basic low-risk threshold, the second control policy is determined as the corresponding access control policy. When the trust score is less than or equal to the basic low-risk threshold, the third control strategy is determined as the corresponding access control strategy.

[0009] Optionally, it also includes: The operating status of the power grid dispatch terminal is obtained. When the operating status is idle, the historical holographic profile private dataset of the power grid dispatch terminal is obtained. Based on the preset cross-entropy loss function, the target modality feature extraction model is trained using the historical holographic portrait private dataset to obtain the corresponding global shared update amount; The globally shared update quantity is encrypted using a preset encryption algorithm to obtain the corresponding ciphertext gradient data packet; The encrypted gradient data packet is sent to a preset cloud aggregation server for decryption to obtain the corresponding decryption global shared update amount; The cloud aggregation server performs weighted aggregation of the decryption global shared update quantity and the corresponding terminal global shared update quantity to obtain a new global shared network weight, and then jumps to execute the step of adjusting the global shared network of the preset modal feature extraction model according to the global shared network weight to obtain the corresponding target modal feature extraction model.

[0010] A second aspect of the present invention provides a power grid dispatching terminal authentication system, comprising: The acquisition module is used to acquire the real-time data stream, dispatch instruction type and global shared network weight of the power grid dispatch terminal, and preprocess the real-time data stream to obtain the corresponding standard terminal data stream. The adjustment module is used to adjust the global shared network of the preset modal feature extraction model according to the weight of the global shared network to obtain the corresponding target modal feature extraction model; The extraction module is used to extract multimodal features from the standard terminal data stream using the target modal feature extraction model and the global shared network weights to obtain the corresponding user behavior embedding vector; The evaluation module is used to perform trust evaluation based on the preset local storage benchmark holographic profile of legitimate users and the user behavior embedding vector, and obtain the corresponding trust score; The authentication module is used to make an authentication decision based on the trust score and the scheduling instruction type, obtain the corresponding access control policy, and adjust the power grid dispatching terminal according to the access control policy.

[0011] A third aspect of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the power grid dispatch terminal authentication method described above.

[0012] The fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed, implements the power grid dispatch terminal authentication method as described above.

[0013] The fifth aspect of the present invention provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, wherein when the program instructions are executed by a computer, the computer performs the power grid dispatch terminal authentication method as described above.

[0014] As can be seen from the above technical solutions, the present invention has the following advantages: This invention obtains the real-time data stream, dispatch command type, and globally shared network weights from the power grid dispatching terminal. The real-time data stream is preprocessed to obtain the corresponding standard terminal data stream. The globally shared network of a pre-defined modal feature extraction model is adjusted according to the globally shared network weights to obtain the corresponding target modal feature extraction model. Multimodal features are extracted from the standard terminal data stream using the target modal feature extraction model and the globally shared network weights to obtain the corresponding user behavior embedding vector. Trust assessment is performed based on a pre-defined locally stored legitimate user baseline holographic profile and the user behavior embedding vector to obtain the corresponding trust score. Authentication is determined based on the trust score and dispatch command type to obtain the corresponding access control policy. The power grid dispatching terminal is then adjusted according to the access control policy. This invention overcomes the risks of privacy leaks and compliance issues associated with traditional centralized behavior recognition models, which require aggregating raw terminal data to the cloud for training. Federated learning, multimodal behavior recognition, and zero-trust security technologies offer solutions to this problem, but existing solutions struggle to adapt to the specific technical challenges of high security, real-time requirements, and heterogeneous user behavior in power grid dispatching. Compared with existing power grid dispatch terminal authentication methods, this invention achieves bidirectional adaptation between common features of dispatch behavior across the entire network and personalized operation features of local users by dynamically adjusting the modal feature extraction model through cloud-based federated aggregation and updating of globally shared network weights. This avoids the defects of recognition aging and insufficient generalization ability that occur with long-term use of traditional static models, significantly improving the accuracy of user behavior feature representation. Furthermore, by using a pre-set locally stored benchmark holographic profile of legitimate users and user behavior embedding vectors for trust assessment, it can comprehensively and meticulously depict the differences in real-time operation behavior of dispatchers, effectively avoiding the security vulnerabilities of one-sided identification of single behavioral features and easy imitation, and improving the reliability of identity trust determination. At the same time, authentication decisions are made based on trust scores and dispatch command types, simplifying verification for low-risk browsing operations and tightening authentication standards for high-risk remote control operations, balancing the operational efficiency and security requirements of power grid dispatch business, and improving the security and real-time performance of power grid dispatch terminal authentication. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating the steps of a power grid dispatch terminal authentication method according to Embodiment 1 of the present invention. Figure 2 This is a flowchart illustrating the steps of a power grid dispatch terminal authentication method provided in Embodiment 2 of the present invention. Figure 3 is a structural block diagram of a power grid scheduling terminal authentication system provided in the third embodiment of the present invention; Figure 4 is a structural block diagram of an electronic device provided in the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0017] The embodiments of the present invention provide a power grid scheduling terminal authentication method, system, device, medium and product, which are used to solve the technical problem that the traditional centralized behavior recognition model needs to aggregate the original terminal data to the cloud for training, which brings privacy leakage and compliance risks. Federated learning, multimodal behavior recognition and zero-trust security technologies provide solutions to this problem, but existing solutions are difficult to adapt to the special scenarios of power grid scheduling with high security, real-time performance and heterogeneous user behaviors.

[0018] To make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0019] Please refer to Figure 1 , Figure 1 which is a step flowchart of a power grid scheduling terminal authentication method provided in the first embodiment of the present invention.

[0020] A power grid scheduling terminal authentication method provided by the present invention includes: Step 101: Acquire the real-time data flow of the power grid scheduling terminal, the type of scheduling instruction and the globally shared network weight, and preprocess the real-time data flow to obtain the corresponding standard terminal data flow.

[0021] The power grid scheduling terminal refers to the mobile operation terminal and the scheduling workstation supporting the power grid OMS system, which are used for remotely browsing power grid load screens, issuing scheduling instructions such as opening and closing remote controls, and can access the regulation master station across the Internet and the DMZ isolation zone.

[0022] The real-time data flow refers to a set of three types of original behavior time-series data continuously collected by the non-intrusive resident perception process of the terminal, including keystroke time-series data, mouse track time-series data and eye movement gaze point data.

[0023] The scheduling instruction type refers to the classification identifier of the business operation executed by the scheduling terminal, which is divided into a low-risk screen browsing category and a high-risk circuit breaker opening and closing remote control category, and is used to match the preset business risk coefficient and drive the dynamic adjustment of the adaptive authentication threshold.

[0024] Globally shared network weights refer to the model's general layer parameters distributed by the cloud-based federated aggregation server after encrypted weighted aggregation. These parameters correspond to the convolutional and LSTM basic extraction layer weights in the Attention-LSTM+CNN feature extraction network, storing the general behavioral features of the entire network scheduler. All terminals can reuse these weights synchronously, while local personalized layer parameters do not participate in the synchronization of these weights.

[0025] Standard terminal data streams refer to standardized structured time-series data of keystrokes, mouse movements, and eye movements that have undergone filtering, outlier removal, interpolation resampling, and timing alignment processing, resulting in a unified sampling frequency, synchronized time axis, and no invalid noise.

[0026] In this embodiment of the invention, the local acquisition link of the power grid dispatching terminal and the cloud communication channel are continuously monitored. The real-time data stream of the power grid dispatching terminal, the type of dispatching instruction currently being executed by the dispatcher, and the globally shared network weights periodically issued by the cloud federated aggregation server are collected simultaneously. The real-time data stream is preprocessed to obtain the corresponding standard terminal data stream.

[0027] It should be noted that the preprocessing of the real-time data stream is as follows: First, the Kalman filter algorithm is used to filter out invalid coordinate noise caused by mouse hardware jitter. Then, isolated outlier input sessions with keystroke intervals exceeding a preset threshold are removed. Finally, the original data of the three types of sampling frequencies (mouse, eye movement, and keystroke) that are inconsistent are uniformly resampled to the 100Hz standard frequency through cubic spline interpolation. This completes the time axis alignment calibration of the full modality data and outputs a standard terminal data stream with time synchronization, noise removal, and uniform sampling frequency.

[0028] Step 102: Adjust the global shared network of the preset modal feature extraction model according to the global shared network weights to obtain the corresponding target modal feature extraction model.

[0029] In this embodiment of the invention, the weights of the global shared network are replaced layer by layer with the original parameters of the global shared network of the preset modal feature extraction model to obtain the corresponding target modal feature extraction model.

[0030] Step 103: Extract multimodal features from the standard terminal data stream using the target modality feature extraction model and global shared network weights to obtain the corresponding user behavior embedding vector.

[0031] User behavior embedding vectors refer to fixed-dimensional dense vectors generated after mapping by the target modality feature extraction model. These vectors do not contain any original biological information that can be directly reconstructed, but they have strong identity differentiation.

[0032] In this embodiment of the invention, keystroke timing data is used to construct a keystroke behavior feature vector containing key dwell time and key flight time. The trajectory curvature and motion acceleration of mouse trajectory timing data are calculated to construct a corresponding mouse behavior feature vector. Eye-tracking fixation point data is used to construct a corresponding visual heatmap matrix. Temporal features of the keystroke behavior feature vector and mouse behavior feature vector are extracted using a long short-term memory network of the target modality feature extraction model, resulting in a first temporal feature vector and a second temporal feature vector. Spatial features of the visual heatmap matrix are extracted using a convolutional neural network of the target modality feature extraction model, resulting in a corresponding visual spatial feature map. The first temporal feature vector, the second temporal feature vector, and the visual spatial feature map are fused using a multimodal attention network of the target modality feature extraction model to obtain a corresponding user behavior embedding vector.

[0033] Step 104: Based on the preset local storage legitimate user baseline holographic profile and user behavior embedding vector, perform trust assessment to obtain the corresponding trust score.

[0034] The local storage legitimate user baseline holographic profile refers to the standard behavior embedding vector that is fixed and stored in the local trusted storage area after the terminal completes the full training of the federated model for the first time. It is generated by fusing the scheduler's long-term historical compliant operation behavior and serves as the sole reference benchmark for determining the legitimacy of the operator's identity. It is not transmitted to the outside world throughout the entire process.

[0035] Trust score refers to the normalized value output after trust assessment, which directly reflects the credibility of the behavior matching between the current operator and the legitimate dispatcher. The higher the value, the stronger the legitimacy of the identity.

[0036] In this embodiment of the invention, a mixture of cosine similarity and Mahalanobis distance is calculated between the user behavior embedding vector and a preset locally stored legitimate user baseline holographic profile. The mixture of cosine similarity and Mahalanobis distance is input into a preset instantaneous confidence function to obtain the corresponding instantaneous confidence score. Based on a smooth decay weight, the pre-acquired historical instantaneous confidence score and the instantaneous confidence score are weighted to obtain the corresponding trust score.

[0037] It should be noted that the instantaneous confidence function is as follows: ; in, For instantaneous confidence level, For cosine similarity, It is a mixed metric for Mahalanobis distance.

[0038] Step 105: Make an authentication decision based on the trust score and the type of dispatch instruction to obtain the corresponding access control policy, and adjust the power grid dispatch terminal according to the access control policy.

[0039] Access control policies refer to the terminal security management rules output after authentication decisions, and are divided into three categories: silent access, lightweight two-factor authentication, and high-risk blocking.

[0040] In this embodiment of the invention, a preset business risk coefficient mapping table is retrieved using the scheduling instruction type to obtain the corresponding risk coefficient. A dynamic authentication threshold for real-time business scenarios is calculated nonlinearly based on the risk coefficient. An authentication decision is made based on the authentication threshold and a basic low-risk threshold, resulting in a corresponding access control policy. The operation permissions of the scheduling interface, the instruction issuance path, and the session security status in the power grid dispatching terminal are adjusted in real time according to the access control policy.

[0041] In this embodiment of the invention, the real-time data stream, dispatch command type, and global shared network weight of the power grid dispatch terminal are acquired. The real-time data stream is preprocessed to obtain the corresponding standard terminal data stream. The global shared network of the preset modal feature extraction model is adjusted according to the global shared network weight to obtain the corresponding target modal feature extraction model. Multimodal feature extraction is performed on the standard terminal data stream using the target modal feature extraction model and the global shared network weight to obtain the corresponding user behavior embedding vector. Trust assessment is performed based on a preset locally stored legitimate user baseline holographic profile and the user behavior embedding vector to obtain the corresponding trust score. Authentication is determined based on the trust score and dispatch command type to obtain the corresponding access control policy. The power grid dispatch terminal is then adjusted according to the access control policy. This overcomes the problem that traditional centralized behavior recognition models require aggregating raw terminal data to the cloud for training, which poses privacy and compliance risks. Federated learning, multimodal behavior recognition, and zero-trust security technologies provide solutions to this problem, but existing solutions are difficult to adapt to the special technical challenges of high security, real-time requirements, and heterogeneous user behavior in power grid dispatching. Compared with existing power grid dispatch terminal authentication methods, this invention achieves bidirectional adaptation between common features of dispatch behavior across the entire network and personalized operation features of local users by dynamically adjusting the modal feature extraction model through cloud-based federated aggregation and updating of globally shared network weights. This avoids the defects of recognition aging and insufficient generalization ability that occur with long-term use of traditional static models, significantly improving the accuracy of user behavior feature representation. Furthermore, by using a pre-set locally stored benchmark holographic profile of legitimate users and user behavior embedding vectors for trust assessment, it can comprehensively and meticulously depict the differences in real-time operation behavior of dispatchers, effectively avoiding the security vulnerabilities of one-sided identification of single behavioral features and easy imitation, and improving the reliability of identity trust determination. At the same time, authentication decisions are made based on trust scores and dispatch command types, simplifying verification for low-risk browsing operations and tightening authentication standards for high-risk remote control operations, balancing the operational efficiency and security requirements of power grid dispatch business, and improving the security and real-time performance of power grid dispatch terminal authentication.

[0042] Please see Figure 2 , Figure 2 This is a flowchart illustrating the steps of a power grid dispatch terminal authentication method provided in Embodiment 2 of the present invention.

[0043] This invention provides a power grid dispatch terminal authentication method, comprising: Step 201: Obtain the real-time data stream, dispatch instruction type, and global shared network weight of the power grid dispatch terminal, preprocess the real-time data stream, and obtain the corresponding standard terminal data stream.

[0044] In this embodiment of the invention, the real-time data stream, dispatch instruction type and global shared network weight of the power grid dispatch terminal are obtained. Kalman filtering is used to eliminate hardware noise of mouse trajectory on the real-time data stream, invalid keystroke sessions with intervals exceeding the threshold are eliminated, and then the sampling frequency of multimodal data is unified and the timing is aligned by cubic spline interpolation. After processing, a regular, noise-free, and timing-synchronized standard terminal data stream is output.

[0045] Step 202: Adjust the global shared network of the preset modal feature extraction model according to the global shared network weights to obtain the corresponding target modal feature extraction model.

[0046] In this embodiment of the invention, the global shared network parameters of the preset modal feature extraction model are replaced according to the global shared network weights, so that the local model can retain its personalized cognitive ability while simultaneously obtaining the general feature extraction ability after cloud-integrated collective intelligence, and thus obtain the corresponding target modal feature extraction model.

[0047] Step 203: Extract multimodal features from the standard terminal data stream using the target modality feature extraction model and global shared network weights to obtain the corresponding user behavior embedding vector.

[0048] Furthermore, the target modality feature extraction model includes a global sharing network and a multimodal attention network, and the standard terminal data stream includes keystroke timing data, mouse trajectory timing data, and eye-tracking fixation point data. Step 203 includes the following sub-steps: S11. Construct the corresponding keystroke behavior feature vector using keystroke timing data, and extract kinematic features from mouse trajectory timing data to obtain the corresponding mouse behavior feature vector.

[0049] Keystroke timing data refers to the original records of keyboard key events captured in real time by the non-intrusive sensing process of the power grid dispatching terminal. Each record contains the key value code, the system timestamp when the key is pressed, and the system timestamp when the key is released.

[0050] Mouse trajectory time-series data refers to the position sequence of the cursor in the screen coordinate system and the corresponding timestamp recorded by the power grid dispatch terminal sensing process at a fixed sampling frequency. Each sampling point contains the horizontal coordinate, vertical coordinate and time information.

[0051] The keystroke behavior feature vector refers to a numerical vector formed by concatenating the dwell time series and flight time series extracted from multiple consecutive keystroke operations. This vector encodes the dispatcher's keystroke rhythm pattern in a fixed-dimensional mathematical form.

[0052] Mouse behavior feature vectors are numerical vectors formed by concatenating acceleration and curvature sequences extracted from mouse trajectories. They encode the dynamic characteristics and path geometry of the scheduler's cursor movement in a fixed dimension.

[0053] In this embodiment of the invention, the keystroke timing data includes the key value code, press timestamp, and release timestamp for each key pressed by the scheduler during keyboard operation. For this set of data, the dwell time (i.e., the duration of the same key from press to release) and flight time (i.e., the time interval between the release of one key and the press of the next) between adjacent key pairs are calculated sequentially. The dwell time sequence and flight time sequence corresponding to each set of consecutive key operations are concatenated to form a keystroke behavior feature vector. Furthermore, kinematic feature extraction is performed on the mouse trajectory timing data to obtain the corresponding mouse behavior feature vector (i.e., calculating the instantaneous velocity and instantaneous acceleration at each moment using the time difference and displacement of adjacent coordinate points, solving for the trajectory curvature through the rate of change of the angle between adjacent displacement vectors to reflect the smoothness of cursor movement and path curvature characteristics, and concatenating the calculated acceleration sequence and curvature sequence to form the mouse behavior feature vector).

[0054] It should be noted that the expression for the length of stay is as follows: ; in, For the first i The dwell time of each button. For the first i The timing of each button press For the first i The moment a button is released i This is the first index of the key.

[0055] The expression for flight time: ; in, For the first i The button and the first j Flight time between buttons For the first j The moment a button is released j This is the second index of the key.

[0056] The expression for the trajectory curvature is as follows: ; in, For trajectory curvature, The first derivative of the x-axis. The first derivative of the ordinate. The second derivative of the x-axis. Let be the second derivative of the ordinate.

[0057] S12. Construct the corresponding visual heatmap matrix using eye-tracking fixation point data.

[0058] Eye-tracking fixation data refers to the dispatcher's gaze direction and fixation position information captured in real time by the front-facing camera of the power grid dispatching terminal or an external eye-tracking sensor. After coordinate mapping, it is converted into a sequence of fixation point positions in the two-dimensional coordinate system of the screen. Each fixation point includes the horizontal coordinate, vertical coordinate and timestamp of the screen, which is the basic data source reflecting the spatial distribution of the dispatcher's visual attention.

[0059] The visual heatmap matrix refers to a two-dimensional numerical matrix that covers the entire scheduling interface. It is generated by smoothing and diffusing all eye-tracking fixation points through a Gaussian kernel, and then accumulating the partition density by combining the boundary mask of the region of interest in the UI layout coordinate set. The value of each element in the matrix quantifies the visual attention intensity accumulated at the corresponding screen position within the session time window. This matrix rearranges the originally discrete and disordered eye-tracking trajectories into a structured feature map with clear spatial semantics.

[0060] In this embodiment of the invention, each gaze point coordinate in the eye-tracking gaze point data is used as the center, and a Gaussian kernel function is used to generate a smooth spatial influence diffusion of each gaze point. The contribution is then attenuated by distance and superimposed onto the full-screen pixel grid. Combined with the boundary mask of each region of interest in the UI layout coordinate set, the cumulative density value of gaze points falling into each key region of interest is calculated to obtain the corresponding visual heatmap matrix.

[0061] It should be noted that the UI layout coordinate set refers to the structured layout description data of the current business interface of the power grid dispatch terminal, which is pre-loaded and stored locally on the terminal. It defines the type identifier and geometric boundary range of each interactive or information display area within the dispatch screen, including the coordinate frames of key interest areas such as the load curve display area, alarm event window, equipment remote control operation area, and menu navigation bar. This is used to map the original gaze point coordinates to specific business semantic areas. The Gaussian kernel function is a weighted diffusion function that smoothly decays outwards in a Gaussian distribution centered on the gaze point coordinates. Its physical meaning lies in simulating the physiological characteristic that human visual attention is not concentrated on a single point but covers a certain surrounding range. This function can transform discrete single gaze points into a continuous spatial influence field, with higher weights closer to the center of the gaze point and lower weights farther away, providing a smooth contribution allocation mechanism for subsequent interest area density statistics.

[0062] S13. Temporal features are extracted from the keystroke behavior feature vector and the mouse behavior feature vector through the long short-term memory network of the global shared network, respectively, to obtain the corresponding first temporal feature vector and second temporal feature vector.

[0063] The first temporal feature vector refers to the fixed-dimensional dense vector output after the keystroke behavior feature vector is extracted by the first long short-term memory network. It numerically encodes the stable keystroke rhythm pattern of the scheduler within the observation time window.

[0064] The second temporal feature vector refers to the fixed-dimensional dense vector output after the mouse behavior feature vector is extracted by the second long short-term memory network. It encodes the cursor control style and motion inertia characteristics of the scheduler within the observation time window in numerical form, and is strictly aligned with the first temporal feature vector in the time dimension.

[0065] Long Short-Term Memory (LSTM) networks are a variant of recurrent neural networks specifically designed for processing sequential data. By introducing three gating units—input gate, forget gate, and output gate—as well as a cell state transfer path into the network structure, LSTM networks enable controlled memorization of key information and active forgetting of redundant information in long sequences. This effectively overcomes the gradient vanishing problem in traditional recurrent neural networks when processing long sequences and is suitable for extracting stable identity features hidden in continuous behavioral data such as keystroke rhythm and mouse movement trajectory.

[0066] In this embodiment of the invention, the keystroke behavior feature vector and the mouse behavior feature vector are respectively input into the long short-term memory network of the global shared network. The long short-term memory network captures the continuous temporal dependencies in operations such as keystroke interval and mouse movement acceleration, and respectively mines the temporal change patterns within the two types of behaviors to obtain the corresponding first temporal feature vector and second temporal feature vector.

[0067] S14. Spatial features are extracted from the visual heatmap matrix using a convolutional neural network with a globally shared network to obtain the corresponding visual spatial feature map.

[0068] Convolutional Neural Networks (CNNs) are a class of deep learning networks specifically designed to process data with a grid structure. They automatically learn local spatial features in the data by sliding convolutional kernels across the input data to perform weighted summation operations within the local receptive field. They also use multi-layer stacking to gradually abstract higher-level semantic information. CNNs are suitable for extracting translation-invariant spatial pattern features from two-dimensional matrices such as images and heatmaps.

[0069] Visual spatial feature map refers to the two-dimensional feature tensor output by the visual heatmap matrix after multi-layer feature extraction and downsampling by a convolutional neural network. It encodes the spatial structural patterns with the most identity-distinguishing value in the visual attention distribution in the form of a compressed spatial grid.

[0070] In this embodiment of the invention, the visual heatmap matrix is ​​input into the convolutional neural network of the global shared network. The gaze heat distribution of different screen areas within the visual heatmap matrix is ​​scanned by multiple convolutional kernels. Spatial dimension features such as eye movement gaze area and gaze range are extracted. Meaningless background noise pixels are filtered out, and spatial representation information with identity discrimination is compressed and retained to obtain the corresponding visual spatial feature map.

[0071] S15. The first temporal feature vector, the second temporal feature vector, and the visual space feature map are fused using a multimodal attention network to obtain the corresponding user behavior embedding vector.

[0072] Multimodal attention networks refer to feature fusion submodules deployed in a globally shared network. They are used to adaptively measure the relative importance of feature vectors from three different physical modalities—keystroke, mouse, and eye-tracking—in identity recognition tasks. By learning attention weights, they weight and fuse multimodal features to highlight high-discrimination modalities and suppress interference from low-discrimination or noisy modalities.

[0073] In this embodiment of the invention, the first temporal feature vector, the second temporal feature vector, and the visual spatial feature map are input into a multimodal attention network. The adaptive weights corresponding to the first temporal feature vector, the second temporal feature vector, and the visual spatial feature map are calculated by the multimodal attention network. The first temporal feature vector, the second temporal feature vector, and the visual spatial feature map are weighted, concatenated, and fused according to the adaptive weights to obtain the corresponding user behavior embedding vector.

[0074] It should be noted that the specific expression for the adaptive weights is: ; in, For adaptive weights, For the first k The learnable query vector corresponding to each modality As the first learnable parameter, This is the first time-series feature vector. This is the second time-series feature vector. For visual spatial feature maps, As the second learnable parameter, This serves as the query vector index identifier when traversing the three modalities (kb (first temporal feature vector index), ms (second temporal feature vector index), and vis (visual spatial feature map index)).k For the index of the vector or feature map.

[0075] Step 204: Calculate the cosine similarity and Mahalanobis distance mixture metric between the user behavior embedding vector and the preset local storage legal user baseline holographic profile.

[0076] Cosine similarity is a measure of the degree of consistency between two non-zero vectors in direction. It is obtained by calculating the dot product of the two vectors and dividing it by the product of their magnitudes. Its value ranges from [-1, 1]. The closer the value is to 1, the more consistent the directions of the two vectors are. In behavior authentication scenarios, it is used to evaluate the macroscopic matching degree between the current operation behavior pattern and the baseline pattern of legitimate users in the overall direction. It is not sensitive to the magnitude scaling of feature vectors.

[0077] Mahalanobis distance, a hybrid metric, is a distance measurement method that considers the correlation within the feature space. By introducing the covariance matrix of the sample distribution when calculating the distance, it performs scale normalization and decorrelation processing on each dimension of the feature. Unlike Euclidean distance, which treats each dimension equally, Mahalanobis distance can effectively eliminate the influence of differences in scale and linear correlation between feature dimensions. In behavior authentication scenarios, it is used to evaluate the degree of deviation between the current behavior embedding vector and the legitimate user baseline vector in terms of probability distribution. The smaller the value, the lower the deviation.

[0078] In this embodiment of the invention, the cosine similarity between the user behavior embedding vector and the preset local storage legal user baseline holographic portrait is calculated, and the Mahalanobis distance mixture metric between the user behavior embedding vector and the preset local storage legal user baseline holographic portrait is calculated.

[0079] Step 205: Sum the preset matching baseline value and the Mahalanobis distance mixed metric to obtain the corresponding first sum value.

[0080] The matching baseline value refers to a preset fixed constant greater than 0, which is used to convert Mahalanobis distance from an absolute value measure to a relative ratio measure. It is usually set to 1.

[0081] In this embodiment of the invention, the sum between the preset matching benchmark value and the Mahalanobis distance hybrid metric is calculated to obtain the corresponding first sum.

[0082] Step 206: Ratio the matching baseline value with the first sum value to obtain the corresponding first ratio.

[0083] In this embodiment of the invention, the ratio between the matching reference value and the first sum value is calculated to obtain the corresponding first ratio.

[0084] Step 207: Based on the preset confidence weight, perform a weighted operation on the cosine similarity and the first ratio to obtain the corresponding instantaneous confidence.

[0085] Confidence weight refers to a preset fixed weighting coefficient, which corresponds to the two matching indicators, cosine similarity and first ratio, and is used to balance the contribution of the two types of measurement results in identity matching judgment.

[0086] Instantaneous confidence score refers to the original matching score calculated solely based on the current real-time behavioral characteristics within a single time window.

[0087] In this embodiment of the invention, the cosine similarity and the first ratio are weighted based on a preset confidence weight to obtain the corresponding instantaneous confidence score. For example, instantaneous confidence score = cosine similarity * confidence weight + (1 - confidence weight) * first ratio.

[0088] Step 208: Based on the smooth decay weight, perform a weighted calculation on the pre-acquired historical instantaneous confidence and instantaneous confidence to obtain the corresponding trust score.

[0089] Historical instantaneous confidence refers to the instantaneous confidence at the previous moment, and its initial value is usually 1.

[0090] The smooth decay weight refers to the preset coefficient used in the exponentially weighted moving average algorithm to control the decay rate of historical information. Its value ranges from 0 to 1, and is usually 0.9.

[0091] In this embodiment of the invention, a weighted calculation is performed on the pre-acquired historical instantaneous confidence level and the instantaneous confidence level based on a smooth decay weight to obtain the corresponding trust score. For example, the trust score = 0.9 * historical instantaneous confidence level + 0.1 * instantaneous confidence level.

[0092] Step 209: Make an authentication decision based on the trust score and the type of dispatch instruction to obtain the corresponding access control policy, and adjust the power grid dispatch terminal according to the access control policy.

[0093] Furthermore, step 209 includes the following sub-steps: S21. Use the scheduling instruction type to retrieve the preset business risk coefficient mapping table to obtain the corresponding risk coefficient.

[0094] The business risk coefficient mapping table refers to a static lookup table pre-configured locally on the terminal, which stores the binding relationship between various scheduling instructions and corresponding quantitative risk values.

[0095] The risk coefficient refers to a numerical value that quantitatively represents the safety hazard level of the current dispatch operation. The more critical the operation and the more likely it is to cause power grid failure, the higher the corresponding risk coefficient value.

[0096] In this embodiment of the invention, the dispatch instruction type is used as the retrieval keyword to perform a precise matching query on the preset business risk coefficient mapping table in the local security storage area of ​​the power grid dispatch terminal, so as to obtain the corresponding risk coefficient.

[0097] S22. Perform difference processing between the preset safety threshold and the preset basic low-risk threshold to obtain the corresponding first difference.

[0098] The security threshold refers to the preset highest standard trust score, which represents the optimal identity matching standard that needs to be achieved under high-risk operations. It is the upper limit benchmark value for dynamic threshold calculation.

[0099] The basic low-risk threshold refers to the preset minimum security trust baseline, which serves as a fixed threshold for determining whether a terminal enters a high-risk blocking state. Low-risk browsing operations are judged based on this threshold by default.

[0100] In this embodiment of the invention, the difference between a preset safety threshold and a preset basic low-risk threshold is calculated to obtain the corresponding first difference.

[0101] S23. Multiply the first difference by the square of the risk coefficient to obtain the corresponding certification benchmark value.

[0102] The certification baseline value refers to the floating increment output after multiplying the first difference value by the square of the risk coefficient value. It is an adjustment value added to the dynamic certification threshold above the base threshold.

[0103] In this embodiment of the invention, the product between the first difference and the square of the risk coefficient is calculated to obtain the corresponding certification benchmark value.

[0104] S24. Add the basic low-risk threshold to the certification benchmark value to obtain the corresponding certification threshold.

[0105] The authentication threshold refers to a real-time trust assessment standard dynamically generated based on business risks. The higher the risk, the larger the value. Only when the trust score exceeds this value is the user deemed completely trustworthy.

[0106] In this embodiment of the invention, the sum of the basic low-risk threshold and the certification benchmark value is calculated to obtain the corresponding certification threshold.

[0107] S25. Make authentication decisions based on the authentication threshold and the basic low-risk threshold to obtain the corresponding access control policy.

[0108] Furthermore, S25 includes the following sub-steps: S251. When the trust score is greater than the authentication threshold, the first control policy is determined as the corresponding access control policy.

[0109] The first control strategy refers to the access control strategy for the power grid dispatch terminal under the high confidence state where the trust score is greater than the authentication threshold. This strategy maintains the smooth operation of all normal operating permissions and instruction issuance links of the dispatch terminal, does not interfere with the dispatcher's interaction or restrict permissions, and only silently records the authentication decision result to the audit log in the background, providing users with a seamless operating experience with zero awareness.

[0110] In this embodiment of the invention, when the trust score is greater than the authentication threshold, it indicates that the matching degree between the current operator's behavioral characteristics and the holographic profile of the legitimate user not only meets the basic security requirements, but also exceeds the stringent threshold after dynamic adjustment under the current business scenario. That is, the legitimacy of the operator's identity is in the high confidence interval, and the first control policy is determined as the corresponding access control policy.

[0111] S252. When the trust score is less than or equal to the authentication threshold, determine whether the trust score is greater than the basic low-risk threshold.

[0112] In this embodiment of the invention, when the trust score is less than or equal to the authentication threshold, it indicates that the current operator's behavior matching degree has failed to meet the stringent threshold required by the current business risk level, that is, the legitimacy of the operator's identity can no longer be maintained in the high confidence interval. However, at this time, it cannot be directly determined as an illegal operation, and it is necessary to determine whether the trust score is greater than the basic low risk threshold.

[0113] S253. When the trust score is greater than the basic low-risk threshold, the second control policy is determined as the corresponding access control policy.

[0114] The second control strategy refers to the access control strategy executed by the system in the gray state where the trust score is higher than the basic low-risk threshold but lower than or equal to the authentication threshold. This strategy keeps the current operation screen and context state uninterrupted, while triggering a lightweight interactive verification mechanism such as a secondary confirmation pop-up or eye-tracking calibration, so that the subsequent session direction can be determined after supplementary behavioral features are collected to complete the auxiliary judgment.

[0115] In this embodiment of the invention, when the trust score is greater than the basic low-risk threshold, the current behavior is slightly abnormal but has not reached the high-risk hijacking level, and the second control policy is determined as the corresponding access control policy.

[0116] S254. When the trust score is less than or equal to the basic low-risk threshold, the third control policy shall be determined as the corresponding access control policy.

[0117] The third control strategy refers to the highest level of access control strategy executed by the system in an extremely abnormal state where the trust score is less than or equal to the basic low-risk threshold. This strategy locks the scheduling terminal operation interface within milliseconds, cuts off all control command transmission links, pushes an identity anomaly alarm to the upper-level situational awareness platform, and forcibly suspends the session until a security reset is completed through strong biometric authentication such as face or fingerprint before operation can be resumed.

[0118] In this embodiment of the invention, when the trust score is less than or equal to the basic low-risk threshold, it indicates that the matching degree between the current operator's behavioral characteristics and the legitimate user's baseline profile has seriously deviated from the normal range. The magnitude of the difference is far beyond what can be explained by random noise or physiological fluctuations. It is highly likely to correspond to malicious security events such as the terminal being controlled by unauthorized personnel, the session being hijacked, or automated attack scripts being injected. In this scenario, any lightweight interactive verification method is meaningless because attackers may completely bypass pop-up confirmation or simulate eye-tracking data and determine the third control policy as the corresponding access control policy.

[0119] Furthermore, it also includes: A1. Obtain the operating status of the power grid dispatch terminal. When the operating status is idle, obtain the private dataset of the historical holographic profile of the power grid dispatch terminal.

[0120] The operating status refers to the overall status of the power grid dispatch terminal's current computing resource availability and interactive activities. The terminal resource monitoring module continuously monitors the central processing unit utilization, memory usage, and foreground interactive task execution to determine whether it is busy or idle. This status is used to control the timing of offline computing-intensive tasks such as federated training and model fine-tuning, and to avoid resource contention with online authentication services.

[0121] The historical holographic profile private dataset refers to the set of all legal behavior embedding vectors accumulated and persistently stored in the local trusted and secure storage area by the power grid dispatch terminal in each round of federated training. It contains the behavioral feature records of the dispatcher in different periods and operating scenarios since the system went online. It is only used for model fine-tuning and difficult example learning on the terminal's local side and is not transmitted to the outside world at all.

[0122] In this embodiment of the invention, the operating status of the power grid dispatching terminal is obtained. When the operating status is idle, it indicates that there is no dispatcher interaction operation on the current terminal and the computing resources are sufficient. Only then does the system have the conditions to start the offline optimization task and obtain the private dataset of the historical holographic profile of the power grid dispatching terminal.

[0123] A2. Based on the preset cross-entropy loss function, the target modality feature extraction model is trained using a private dataset of historical holographic images to obtain the corresponding global shared update amount.

[0124] The global shared update amount refers to the summation result of parameter gradients extracted only from the global shared network part after the terminal has trained the target modality feature extraction model on its local private dataset for several rounds. This update amount encodes the direction and magnitude of parameter adjustments that the global shared network should make after training on the local data of the current terminal.

[0125] In this embodiment of the invention, a private dataset of historical holographic images is used as training samples. The current parameters of the target modality feature extraction model are used as the initial state. Several rounds of stochastic gradient descent optimization iterations are performed locally on the terminal. During backpropagation, only the parameter gradients generated by the globally shared network are retained, while the gradients generated by the local personalized network are not included in the upload scope and are only kept locally for independent updates of the personalized layer itself. Finally, the sum of the gradients of each layer of the globally shared network is used as the globally shared update amount. A preset cross-entropy loss function is used to measure the degree of difference between the model's predicted probability distribution of legitimate identity labels and the true labels.

[0126] A3. Use a preset encryption algorithm to encrypt the globally shared update amount to obtain the corresponding ciphertext gradient data packet.

[0127] The encryption algorithm (i.e., Paillier homomorphic encryption algorithm) refers to an asymmetric probabilistic encryption algorithm based on the compound residue class hard problem. It has the property of additive homomorphism, that is, the addition operation on the ciphertext field corresponds to the addition operation on the plaintext field, and the exponentiation operation on the ciphertext field corresponds to the scalar multiplication operation on the plaintext field. This allows the cloud aggregation server to directly perform weighted summation operation on the ciphertext gradients from multiple terminals without decrypting the ciphertext. It is the core cryptographic tool for realizing privacy-preserving federated aggregation.

[0128] The ciphertext gradient data packet refers to the data structure generated by encrypting all gradient values ​​in the globally shared update quantity using the Paillier homomorphic encryption algorithm and then formatting and packaging them according to a predefined communication protocol. This data packet contains three parts: the terminal device identifier, the current federated communication round number, and the serialized ciphertext gradient payload.

[0129] In this embodiment of the invention, the Paillier homomorphic encryption algorithm built into the power grid dispatching terminal is invoked, and the global shared update is encrypted bit by bit using the global public key. All encrypted gradient data is then encapsulated and integrated to generate a ciphertext gradient data packet.

[0130] It should be noted that the specific expression for the Paillier homomorphic encryption algorithm is as follows: ; in, For encrypted gradient data packets, For globally shared update volume, This is the global public key for the power grid dispatch terminal. k For the terminal index, t For time indexing.

[0131] A4. Send the encrypted gradient data packet to the preset cloud aggregation server for decryption to obtain the corresponding decryption global shared update volume.

[0132] Decrypting the globally shared update amount refers to the original terminal gradient update parameters obtained after the ciphertext gradient data packet has been decrypted.

[0133] In this embodiment of the invention, the power grid dispatch terminal sends the encrypted gradient data packet to a preset cloud aggregation server through a secure encrypted transmission channel. The cloud aggregation server calls its built-in exclusive private key to decrypt the compliant encrypted gradient data packet, strips off the encrypted encapsulation information, restores the original gradient parameter information, and accurately parses to obtain the lossless decrypted global shared update amount.

[0134] A5. By using a cloud aggregation server to perform weighted aggregation of the decryption global shared update quantity and the corresponding terminal global shared update quantity, a new global shared network weight is obtained. Then, the process jumps to the step of adjusting the global shared network of the preset modal feature extraction model according to the global shared network weight to obtain the corresponding target modal feature extraction model.

[0135] The terminal-wide shared update volume refers to the network parameter gradient update data generated by each power grid dispatch terminal through local dataset training, encrypted, uploaded, and decrypted.

[0136] In this embodiment of the invention, the cloud aggregation server aggregates the global shared update volume uploaded by all power grid dispatch terminals across the entire network, performs weighted fusion aggregation calculation on all decrypted global shared update volumes, iteratively generates updated global shared network weights, and jumps to execute the step of adjusting the global shared network of the preset modal feature extraction model according to the global shared network weights to obtain the corresponding target modal feature extraction model.

[0137] It should be noted that the weighted fusion aggregation calculation is specifically as follows: ; in, To ensure global sharing of network weights, For local datasets, For the datasets participating in the weighted aggregation calculation terminal, K This represents the total number of power grid dispatch terminals.

[0138] In this embodiment of the invention, the real-time data stream, dispatch command type, and global shared network weight of the power grid dispatch terminal are acquired. The real-time data stream is preprocessed to obtain the corresponding standard terminal data stream. The global shared network of the preset modal feature extraction model is adjusted according to the global shared network weight to obtain the corresponding target modal feature extraction model. Multimodal feature extraction is performed on the standard terminal data stream using the target modal feature extraction model and the global shared network weight to obtain the corresponding user behavior embedding vector. Trust assessment is performed based on a preset locally stored legitimate user baseline holographic profile and the user behavior embedding vector to obtain the corresponding trust score. Authentication is determined based on the trust score and dispatch command type to obtain the corresponding access control policy. The power grid dispatch terminal is then adjusted according to the access control policy. This overcomes the problem that traditional centralized behavior recognition models require aggregating raw terminal data to the cloud for training, which poses privacy and compliance risks. Federated learning, multimodal behavior recognition, and zero-trust security technologies provide solutions to this problem, but existing solutions are difficult to adapt to the special technical challenges of high security, real-time requirements, and heterogeneous user behavior in power grid dispatching. Compared with existing power grid dispatch terminal authentication methods, this invention achieves bidirectional adaptation between common features of dispatch behavior across the entire network and personalized operation features of local users by dynamically adjusting the modal feature extraction model through cloud-based federated aggregation and updating of globally shared network weights. This avoids the defects of recognition aging and insufficient generalization ability that occur with long-term use of traditional static models, significantly improving the accuracy of user behavior feature representation. Furthermore, by using a pre-set locally stored benchmark holographic profile of legitimate users and user behavior embedding vectors for trust assessment, it can comprehensively and meticulously depict the differences in real-time operation behavior of dispatchers, effectively avoiding the security vulnerabilities of one-sided identification of single behavioral features and easy imitation, and improving the reliability of identity trust determination. At the same time, authentication decisions are made based on trust scores and dispatch command types, simplifying verification for low-risk browsing operations and tightening authentication standards for high-risk remote control operations, balancing the operational efficiency and security requirements of power grid dispatch business, and improving the security and real-time performance of power grid dispatch terminal authentication.

[0139] Please see Figure 3 , Figure 3 This is a structural block diagram of a power grid dispatch terminal authentication system provided in Embodiment 3 of the present invention.

[0140] The present invention provides a power grid dispatch terminal authentication system, comprising: The acquisition module 301 is used to acquire the real-time data stream, dispatch instruction type and global shared network weight of the power grid dispatch terminal, and preprocess the real-time data stream to obtain the corresponding standard terminal data stream. The adjustment module 302 is used to adjust the global shared network of the preset modal feature extraction model according to the global shared network weights to obtain the corresponding target modal feature extraction model; The extraction module 303 is used to extract multimodal features from the standard terminal data stream through the target modal feature extraction model and the global shared network weights to obtain the corresponding user behavior embedding vector; The evaluation module 304 is used to perform trust evaluation based on the preset local storage benchmark holographic profile of legitimate users and user behavior embedding vector, and obtain the corresponding trust score; The authentication module 305 is used to make authentication decisions based on trust scores and dispatch instruction types, obtain corresponding access control policies, and adjust the power grid dispatch terminal according to the access control policies.

[0141] Furthermore, the target modality feature extraction model includes a global sharing network and a multimodal attention network, and the standard terminal data stream includes keystroke timing data, mouse trajectory timing data, and eye-tracking fixation point data. The extraction module 303 includes: The first extraction submodule is used to construct the corresponding keystroke behavior feature vector using keystroke timing data, and to extract kinematic features from mouse trajectory timing data to obtain the corresponding mouse behavior feature vector. A corresponding visual heatmap matrix was constructed using eye-tracking fixation point data; The second extraction submodule is used to extract temporal features from the keystroke behavior feature vector and the mouse behavior feature vector through the long short-term memory network of the globally shared network, respectively, to obtain the corresponding first temporal feature vector and second temporal feature vector; The third extraction submodule is used to extract spatial features from the visual heatmap matrix through a convolutional neural network of a globally shared network to obtain the corresponding visual spatial feature map. The fusion submodule is used to fuse the first temporal feature vector, the second temporal feature vector, and the visual spatial feature map through a multimodal attention network to obtain the corresponding user behavior embedding vector.

[0142] Furthermore, evaluation module 304 includes: The matching submodule is used to calculate the cosine similarity and Mahalanobis distance hybrid metric between the user behavior embedding vector and the preset local storage legal user baseline holographic portrait, respectively. The preset matching baseline value and the Mahalanobis distance hybrid metric are summed to obtain the corresponding first sum value; The first ratio is obtained by comparing the matching baseline value with the first sum value. Based on the preset confidence weight, the cosine similarity and the first ratio are weighted and calculated to obtain the corresponding instantaneous confidence. The scoring submodule is used to perform a weighted calculation on the pre-acquired historical instantaneous confidence and instantaneous confidence based on smooth decay weights to obtain the corresponding trust score.

[0143] Furthermore, authentication module 305 includes: The dynamic authentication submodule is used to retrieve the preset business risk coefficient mapping table using the scheduling instruction type to obtain the corresponding risk coefficient; The difference between the preset safety threshold and the preset basic low-risk threshold is processed to obtain the corresponding first difference; The first difference is multiplied by the square of the risk coefficient to obtain the corresponding certification benchmark value; The basic low-risk threshold is summed with the certification benchmark value to obtain the corresponding certification threshold. The authentication decision submodule is used to make authentication decisions based on the trust score according to the authentication threshold and the basic low-risk threshold, and obtain the corresponding access control policy.

[0144] Furthermore, the authentication decision submodule includes: The first decision unit is used to determine the first control policy as the corresponding access control policy when the trust score is greater than the authentication threshold. When the trust score is less than or equal to the authentication threshold, it is then determined whether the trust score is greater than the basic low-risk threshold. The second decision unit is used to determine the second control policy as the corresponding access control policy when the trust score is greater than the basic low-risk threshold. The third decision unit is used to determine the third control strategy as the corresponding access control strategy when the trust score is less than or equal to the basic low-risk threshold.

[0145] Furthermore, it also includes: The federated module is used to obtain the operating status of the power grid dispatch terminal. When the operating status is idle, it obtains the private dataset of the historical holographic profile of the power grid dispatch terminal. Based on the preset cross-entropy loss function, the target modality feature extraction model is trained using a private dataset of historical holographic images to obtain the corresponding global shared update amount; The globally shared update volume is encrypted using a preset encryption algorithm to obtain the corresponding ciphertext gradient data packet; The encrypted gradient data packet is sent to a preset cloud aggregation server for decryption, and the corresponding decryption global shared update volume is obtained. The global shared update quantity of decryption and the corresponding global shared update quantity of the terminal are weighted and aggregated by the cloud aggregation server to obtain the new global shared network weight. Then, the process jumps to the step of adjusting the global shared network of the preset modal feature extraction model according to the global shared network weight to obtain the corresponding target modal feature extraction model.

[0146] Please see Figure 4 , Figure 4This is a structural block diagram of an electronic device provided in Embodiment 4 of the present invention.

[0147] An electronic device according to an embodiment of the present invention includes: a memory 401 and a processor 402. The memory 401 stores a computer program. When the computer program is executed by the processor 402, the processor 402 executes the power grid dispatch terminal authentication method as described in any of the above embodiments.

[0148] Memory 401 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Memory 401 has storage space 403 for program code 413 for performing any of the method steps described above. For example, storage space 403 for program code may include individual program codes 413 for implementing the various steps in the methods described above. This program code may be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, CDs, memory cards, or floppy disks. The program code may be compressed, for example, in a suitable form. When run by a computing processing device, this code causes the computing processing device to perform the various steps in the methods described above. This program code may be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, CDs, memory cards, or floppy disks. The program code may be compressed, for example, in a suitable form. When this code is run by a computing processing device, it causes the device to perform the various steps in the power grid dispatch terminal authentication method described above.

[0149] Embodiment 5 of the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the power grid dispatch terminal authentication method as described in any of the above embodiments.

[0150] Embodiment 6 of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions, wherein when the program instructions are executed by a computer, the computer performs the power grid dispatch terminal authentication method as described in any of the above embodiments.

[0151] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0152] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0153] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0154] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0155] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0156] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A power grid dispatch terminal authentication method, characterized in that, include: The real-time data stream, dispatch instruction type, and global shared network weight of the power grid dispatch terminal are obtained, and the real-time data stream is preprocessed to obtain the corresponding standard terminal data stream. The global shared network of the preset modal feature extraction model is adjusted according to the global shared network weights to obtain the corresponding target modal feature extraction model; Multimodal features are extracted from the standard terminal data stream using the target modal feature extraction model and the global shared network weights to obtain the corresponding user behavior embedding vector; Trust assessment is performed based on a preset local storage benchmark holographic profile of legitimate users and the user behavior embedding vector to obtain a corresponding trust score; An authentication decision is made based on the trust score and the type of scheduling instruction to obtain the corresponding access control policy, and the power grid scheduling terminal is adjusted according to the access control policy.

2. The power grid dispatch terminal authentication method according to claim 1, characterized in that, The target modality feature extraction model includes a global shared network and a multimodal attention network. The standard terminal data stream includes keystroke timing data, mouse trajectory timing data, and eye-tracking fixation point data. The step of extracting multimodal features from the standard terminal data stream using the target modality feature extraction model and the weights of the global shared network to obtain the corresponding user behavior embedding vector includes: The keystroke timing data is used to construct the corresponding keystroke behavior feature vector, and kinematic features are extracted from the mouse trajectory timing data to obtain the corresponding mouse behavior feature vector. The corresponding visual heatmap matrix is ​​constructed using the eye-tracking fixation point data; Temporal features of the keystroke behavior feature vector and the mouse behavior feature vector are extracted by the long short-term memory network of the global shared network to obtain the corresponding first temporal feature vector and second temporal feature vector. Spatial features are extracted from the visual heatmap matrix using the convolutional neural network of the global shared network to obtain the corresponding visual spatial feature map; The first temporal feature vector, the second temporal feature vector, and the visual spatial feature map are fused using the multimodal attention network to obtain the corresponding user behavior embedding vector.

3. The power grid dispatch terminal authentication method according to claim 1, characterized in that, The step of performing trust assessment based on a preset locally stored legitimate user baseline holographic profile and the user behavior embedding vector to obtain a corresponding trust score includes: Calculate the cosine similarity and Mahalanobis distance mixture metric between the user behavior embedding vector and the preset local storage legal user baseline holographic profile, respectively; The preset matching benchmark value and the Mahalanobis distance hybrid metric are summed to obtain the corresponding first sum value; The matching benchmark value is compared with the first sum value to obtain the corresponding first ratio value; Based on the preset confidence weight, the cosine similarity and the first ratio are weighted and calculated to obtain the corresponding instantaneous confidence. Based on the smooth decay weight, the pre-acquired historical instantaneous confidence and the instantaneous confidence are weighted and calculated to obtain the corresponding trust score.

4. The power grid dispatch terminal authentication method according to claim 1, characterized in that, The step of making an authentication decision based on the trust score and the scheduling instruction type to obtain the corresponding access control policy includes: The corresponding risk coefficient is obtained by retrieving the preset business risk coefficient mapping table using the scheduling instruction type; The difference between the preset safety threshold and the preset basic low-risk threshold is processed to obtain the corresponding first difference; The first difference is multiplied by the square of the risk coefficient to obtain the corresponding certification benchmark value; The basic low-risk threshold is summed with the authentication benchmark value to obtain the corresponding authentication threshold; The authentication decision is made based on the authentication threshold and the basic low-risk threshold, and the corresponding access control policy is obtained.

5. The power grid dispatch terminal authentication method according to claim 4, characterized in that, The step of making an authentication decision based on the trust score according to the authentication threshold and the basic low-risk threshold to obtain the corresponding access control policy includes: When the trust score is greater than the authentication threshold, the first control policy is determined as the corresponding access control policy. When the trust score is less than or equal to the authentication threshold, it is determined whether the trust score is greater than the basic low-risk threshold. When the trust score is greater than the basic low-risk threshold, the second control policy is determined as the corresponding access control policy. When the trust score is less than or equal to the basic low-risk threshold, the third control strategy is determined as the corresponding access control strategy.

6. The power grid dispatch terminal authentication method according to claim 1, characterized in that, Also includes: The operating status of the power grid dispatch terminal is obtained. When the operating status is idle, the historical holographic profile private dataset of the power grid dispatch terminal is obtained. Based on the preset cross-entropy loss function, the target modality feature extraction model is trained using the historical holographic portrait private dataset to obtain the corresponding global shared update amount; The globally shared update quantity is encrypted using a preset encryption algorithm to obtain the corresponding ciphertext gradient data packet; The encrypted gradient data packet is sent to a preset cloud aggregation server for decryption to obtain the corresponding decryption global shared update amount; The cloud aggregation server performs weighted aggregation of the decryption global shared update quantity and the corresponding terminal global shared update quantity to obtain a new global shared network weight, and then jumps to execute the step of adjusting the global shared network of the preset modal feature extraction model according to the global shared network weight to obtain the corresponding target modal feature extraction model.

7. A power grid dispatch terminal authentication system, characterized in that, include: The acquisition module is used to acquire the real-time data stream, dispatch instruction type and global shared network weight of the power grid dispatch terminal, and preprocess the real-time data stream to obtain the corresponding standard terminal data stream. The adjustment module is used to adjust the global shared network of the preset modal feature extraction model according to the weight of the global shared network to obtain the corresponding target modal feature extraction model; The extraction module is used to extract multimodal features from the standard terminal data stream using the target modal feature extraction model and the global shared network weights to obtain the corresponding user behavior embedding vector; The evaluation module is used to perform trust evaluation based on the preset local storage benchmark holographic profile of legitimate users and the user behavior embedding vector, and obtain the corresponding trust score; The authentication module is used to make an authentication decision based on the trust score and the scheduling instruction type, obtain the corresponding access control policy, and adjust the power grid dispatching terminal according to the access control policy.

8. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the power grid dispatch terminal authentication method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the power grid dispatch terminal authentication method as described in any one of claims 1-6.

10. A computer program product, characterized in that, The computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, wherein when the program instructions are executed by a computer, the computer performs the power grid dispatch terminal authentication method as described in any one of claims 1-6.

Images