CN117240511A - Power grid terminal abnormality detection method - Google Patents
Power grid terminal abnormality detection method Download PDFInfo
- Publication number
- CN117240511A CN117240511A CN202311081328.6A CN202311081328A CN117240511A CN 117240511 A CN117240511 A CN 117240511A CN 202311081328 A CN202311081328 A CN 202311081328A CN 117240511 A CN117240511 A CN 117240511A
- Authority
- CN
- China
- Prior art keywords
- power grid
- cluster
- instruction
- data
- extracting
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 61
- 230000005856 abnormality Effects 0.000 title claims abstract description 20
- 230000006399 behavior Effects 0.000 claims abstract description 33
- 238000000034 method Methods 0.000 claims abstract description 23
- 238000004458 analytical method Methods 0.000 claims abstract description 5
- 239000013598 vector Substances 0.000 claims description 25
- 238000004422 calculation algorithm Methods 0.000 claims description 16
- 238000012549 training Methods 0.000 claims description 12
- 238000012545 processing Methods 0.000 claims description 10
- 238000007621 cluster analysis Methods 0.000 claims description 9
- 238000003064 k means clustering Methods 0.000 claims description 9
- 239000011159 matrix material Substances 0.000 claims description 9
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 6
- 238000012544 monitoring process Methods 0.000 claims description 6
- 238000005192 partition Methods 0.000 claims description 6
- 230000005540 biological transmission Effects 0.000 claims description 4
- 230000002776 aggregation Effects 0.000 claims description 3
- 238000004220 aggregation Methods 0.000 claims description 3
- 238000004364 calculation method Methods 0.000 claims description 3
- ZPUCINDJVBIVPJ-LJISPDSOSA-N ***e Chemical compound O([C@H]1C[C@@H]2CC[C@@H](N2C)[C@H]1C(=O)OC)C(=O)C1=CC=CC=C1 ZPUCINDJVBIVPJ-LJISPDSOSA-N 0.000 claims description 3
- 238000000513 principal component analysis Methods 0.000 claims description 3
- 238000005295 random walk Methods 0.000 claims description 3
- 230000009467 reduction Effects 0.000 claims description 3
- 238000012706 support-vector machine Methods 0.000 claims 1
- 230000002159 abnormal effect Effects 0.000 abstract description 5
- 238000004590 computer program Methods 0.000 description 9
- 238000010586 diagram Methods 0.000 description 7
- 230000006870 function Effects 0.000 description 5
- 230000008569 process Effects 0.000 description 5
- 230000003993 interaction Effects 0.000 description 3
- 238000003860 storage Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000011664 signaling Effects 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000009826 distribution Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000012804 iterative process Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000005259 measurement Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000013450 outlier detection Methods 0.000 description 1
- 239000000126 substance Substances 0.000 description 1
Classifications
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The application relates to a power grid terminal abnormality detection method, which comprises the following steps: carrying out protocol layer-by-layer analysis on the received power grid terminal message, and extracting network layer data and application layer instruction level characteristics; IP identification is carried out on the power grid terminal message, flow characteristics are extracted, and flow anomaly detection is achieved through an OCSVM; extracting key fields capable of identifying protocol features by extracting application layer instruction level features, and respectively matching with grammar semantic rules and an attack feature library to realize detection of malformed messages and attack messages; and extracting a behavior characteristic value of the business instruction, and detecting the illegal business instruction through a cluster detection model based on cluster learning. The method can detect the network side and the business instruction level abnormal safety event of the power grid terminal at the same time, and improves the safety of the power grid terminal.
Description
Technical Field
The application relates to the technical field of power grid information safety detection, in particular to a power grid terminal abnormality detection method.
Background
The characteristic values of the main service characteristic codes such as remote measurement and remote signaling quantity in the power grid are mainly discrete variables, and for the discrete variables, the normal value is a certain discrete value in the value range of the variable, and the abnormal data belong to the outliers, so that the abnormal data detection of the constant and the discrete variables can be converted into the detection of the outliers. Currently, detection algorithms for outliers are mainly based on four types of methods, namely statistics, distance, density and clustering. Compared with an outlier detection algorithm based on statistics, distance and density, a detection algorithm based on clustering can avoid selecting a statistical distribution model, fully considers local characteristics of data, and the time and space complexity of the clustering algorithm is linear or nearly linear, so that the real-time requirement of an industrial control system can be better met.
At present, network attack has become a novel weapon, hostile potential is realized by utilizing network attack to successfully destroy national key infrastructure such as electric power, and power grid intelligent terminal attack is generally aimed at specific protocol and specific business logic of electric power, has the characteristics of definite attack target, hidden operation, long latency and the like, and is generally implemented through a group or even a national level. At present, in the aspect of attack detection, the intelligent terminal system of the power grid mainly uses the mature technology of the traditional IT system to detect the security event at the network side, and cannot detect the abnormal security event aiming at the system business instruction level such as counterfeit control instructions.
Disclosure of Invention
The application aims to provide a power grid terminal abnormality detection method which can detect network side and business instruction level abnormal safety events of a power grid terminal at the same time, and improves the safety of the power grid terminal.
In order to achieve the above purpose, the technical scheme adopted by the application is as follows: a power grid terminal abnormality detection method includes:
carrying out protocol layer-by-layer analysis on the received power grid terminal message, and extracting network layer data and application layer instruction level characteristics;
IP identification is carried out on the power grid terminal message, flow characteristics are extracted, and flow anomaly detection is achieved through an OCSVM;
extracting key fields capable of identifying protocol features by extracting application layer instruction level features, and respectively matching with grammar semantic rules and an attack feature library to realize detection of malformed messages and attack messages; and extracting a behavior characteristic value of the business instruction, and detecting the illegal business instruction through a cluster detection model based on cluster learning.
Further, the grammar semantic rules are designed according to protocol specifications; and the attack feature library adopts a snort network attack rule library.
Further, the implementation method for detecting the illegal service instruction through the cluster detection model based on cluster learning comprises the following steps:
extracting service instruction behavior characteristic values from a large number of training message samples, wherein the service instruction behavior characteristic values comprise service instruction characteristic codes and service instruction frequencies, and providing the service instruction characteristic codes and service instruction frequencies for a clustering algorithm to learn;
each sample feature is learned through a K-Means clustering algorithm, so that the business instruction behavior features of the same class are gathered into the same cluster, classification of the business instruction behavior features is realized, a multi-class business instruction behavior cluster family is formed, and a trained cluster detection model is further obtained;
and in the monitoring stage, extracting the service instruction behavior characteristic value of the power grid terminal message acquired in real time, and then analyzing the extracted service instruction behavior characteristic value through a trained cluster detection model to judge whether the service characteristic abnormality occurs.
Further, aiming at the frequency cluster analysis of the business instructions of the intelligent terminal of the power grid, the method comprises the following steps:
1) Determining a cluster analysis object: performing cluster analysis on feature codes and frequencies of different service instructions of the intelligent power grid terminal;
2) Constructing a feature vector: constructing a five-dimensional feature vector < IP, type identification, transmission reason, information object address and unit time service instruction frequency > aiming at service instruction frequency, wherein the five-dimensional feature vector represents feature codes and feature code frequency for transmitting certain type of service instruction in unit time of a power grid intelligent terminal of certain IP;
3) Training sample data acquisition: collecting normal network data sample flow, analyzing and identifying the service instruction type, and counting the occurrence frequency in unit time;
4) Building a training vector set: generating a data set x= { X containing n five-dimensional data points according to a five-dimensional vector structure 1 ,x 2 ,…,x n }；
5) Clustering and constructing a cluster detection model: organizing data objects in a data set into K partitions C= { C by a K-Means clustering algorithm k I= … k }, each partition representing a class c k Each class c k With a class centre mu i Selecting Euclidean distance as similarity and distance judgment criterion, and calculating the cluster square sum from each point in the class to the cluster center; thereby constructing and obtaining a cluster detection model;
6) And (3) online detection of service instruction frequency: and classifying the detection vectors by using the clustering detection model established after training, and judging that the abnormality occurs if the detection vectors do not belong to any class group.
Further, the method is used for mainly processing text original data, image original data and log data aiming at a multi-source heterogeneous power grid terminal high-dimensional safety monitoring big data object; firstly extracting characteristics of original text data and original image data to form a feature matrix, then analyzing the internal structure of a correlation matrix or a covariance matrix of original variables through principal component analysis, and converting a plurality of variables into a few comprehensive variables, namely principal components, so as to achieve the purpose of dimension reduction; aiming at log data, constructing a correlation network according to the sequence adjacent relation of different event units in the log, based on a network embedded model of deep random walk, learning low-dimensional vector expression of key elements in the log, and based on the correlation and aggregation characteristics among the key elements in the calculation log, automatically finding out specific behavior patterns and abnormal behavior outliers; by processing the data of the intelligent terminal of the power grid, the abnormal behavior of the intelligent terminal of the power grid can be found.
Compared with the prior art, the application has the following beneficial effects: the method not only can monitor network layer flow abnormality, malformed message and attack message, but also can detect service characteristic abnormality, thereby improving the comprehensiveness of power grid terminal abnormality detection and the safety of power grid terminal.
Drawings
FIG. 1 is a schematic block diagram of a method implementation of an embodiment of the present application;
FIG. 2 is a flow chart of an implementation of detecting offending business instructions based on cluster learning in an embodiment of the present application;
FIG. 3 is a flowchart of a frequency cluster analysis implementation for a business instruction of a smart terminal of a power grid in an embodiment of the application;
fig. 4 is a flowchart of an implementation of processing grid terminal data in an embodiment of the present application.
Detailed Description
The application will be further described with reference to the accompanying drawings and examples.
It should be noted that the following detailed description is exemplary and is intended to provide further explanation of the application. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.
It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments according to the present application. As used herein, the singular is also intended to include the plural unless the context clearly indicates otherwise, and furthermore, it is to be understood that the terms "comprises" and/or "comprising" when used in this specification are taken to specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof.
As shown in fig. 1, this embodiment provides a method for detecting an abnormality of a power grid terminal, including:
1) And carrying out protocol layer-by-layer analysis on the received power grid terminal message, and extracting network layer data and application layer instruction level characteristics.
2) And carrying out IP identification on the power grid terminal message, extracting flow characteristics, and realizing flow anomaly detection through an OCSVM.
3) Extracting key fields capable of identifying protocol features by extracting application layer instruction level features, and respectively matching with grammar semantic rules and an attack feature library to realize detection of malformed messages and attack messages; and extracting a behavior characteristic value of the business instruction, and detecting the illegal business instruction through a cluster detection model based on cluster learning.
In this embodiment, the grammar semantic rules are designed according to a protocol specification. And the attack feature library adopts a snort network attack rule library.
The method constructs a real-time interaction anomaly detection framework of the power grid terminal, realizes the safety detection of network side flow in the real-time interaction process of the power grid intelligent terminal through flow anomaly detection, and realizes the safety detection of an application layer instruction level in the real-time interaction process of the power grid intelligent terminal through service instruction level detection.
As shown in fig. 2, the implementation method for detecting the illegal service instruction through the cluster detection model based on cluster learning is as follows:
1) Extracting message characteristics: and extracting service instruction behavior characteristic values, such as frequency, characteristic codes and the like, from a large number of training message samples, and providing the service instruction behavior characteristic values for a clustering algorithm to learn.
2) Cluster learning: and learning each sample characteristic through a K-Means clustering algorithm to gather the business instruction behavior characteristics of the same class into the same cluster, so as to realize classification of the business instruction behavior characteristics, form a multi-class business instruction behavior cluster family, and further obtain a trained cluster detection model.
The K-Means clustering algorithm is a iterative process that aims to minimize the sum of squares of all sample-to-cluster center distances in the cluster domain.
The business behaviors of the same class are gathered into the same cluster through a K-Means clustering algorithm, so that the functional classification of the business instruction behaviors is realized. Clustering forms a set of business instruction behaviors of multiple classes, such as: remote control commands, telemetry commands, electric energy calling commands, remote parameter reading and writing, file transmission and the like.
3) And in the monitoring stage, extracting the service instruction behavior characteristic value of the power grid terminal message acquired in real time, and then analyzing the extracted service instruction behavior characteristic value through a trained cluster detection model to judge whether the service characteristic abnormality occurs.
As shown in fig. 3, the frequency cluster analysis process for the service instruction of the intelligent terminal of the power grid includes the following steps:
1) Determining a cluster analysis object: and carrying out cluster analysis on the feature codes and the frequency of different service instructions (such as change remote signaling, change remote sensing and control) of the intelligent power grid terminal.
2) Constructing a feature vector: and constructing a five-dimensional feature vector < IP, type identification, transmission reason, information object address and unit time service instruction frequency > aiming at the service instruction frequency, wherein the five-dimensional feature vector represents feature codes and feature code frequency for transmitting a certain type of service instruction in unit time of a power grid intelligent terminal of a certain IP.
3) Training sample data acquisition: and collecting normal network data sample flow, analyzing and identifying the service instruction type, and counting the occurrence frequency in unit time.
4) Constructing a five-dimensional training vector set: generating a data set x= { X containing n five-dimensional data points according to a five-dimensional vector structure 1 ,x 2 ,…,x n }。
5) Clustering and constructing a cluster detection model: organizing data objects in a data set into K partitions C= { C by a K-Means clustering algorithm k I= … k }, each partition representing a class c k Each class c k With a class centre mu i Selecting Euclidean distance as similarity and distance judgment criterion, and calculating the cluster square sum from each point in the class to the cluster center; thereby constructing and obtaining a cluster detection model.
6) And (3) online detection of service instruction frequency: and classifying the detection vectors by using the cluster detection model established in the training stage, and judging that the abnormality occurs if the detection vectors do not belong to any class group.
As shown in fig. 4, the method is used for high-dimensional security monitoring of large data objects aiming at multi-source heterogeneous power grid terminals, and mainly processes text original data, image original data, log data and the like. For original text data and image original data, firstly extracting the characteristics of the original text data and the image original data to form a feature matrix, then analyzing the internal structure of a correlation matrix or a covariance matrix of the original variables through principal component analysis, and converting a plurality of variables into a few comprehensive variables, namely principal components, thereby achieving the purpose of dimension reduction. Aiming at log data, constructing a correlation network according to the sequence adjacency and other relations of different event units in the log, based on a network embedded model of deep random walk, learning low-dimensional vector expression of key elements in the log, and based on the correlation and aggregation characteristics among the key elements in the calculation log, automatically finding out specific behavior patterns and abnormal behavior outliers; by processing the data of the intelligent terminal of the power grid, the abnormal behavior of the intelligent terminal of the power grid can be found.
According to the application, the characteristic vector covering the control domain, the application layer function code, the instruction direction and the instruction sending time is constructed by analyzing and extracting the service message protocol characteristics of the intelligent terminal of the power grid. On the basis, classification of terminal business behaviors is achieved by using a K-means clustering algorithm, and a power grid intelligent terminal business behavior model is built. By combining with the service instruction of the power grid terminal, the service instruction is compared in real time based on the model, the instruction level attack is found, the online identification of the instruction level attack is realized, and the problem of identification of a large number of novel instruction level attacks in the intelligent power grid terminal is solved.
The application also provides a power grid terminal abnormality detection system, which comprises a memory, a processor and computer program instructions which are stored on the memory and can be run by the processor, wherein the method steps can be realized when the processor runs the computer program instructions.
It will be appreciated by those skilled in the art that embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The above description is only a preferred embodiment of the present application, and is not intended to limit the application in any way, and any person skilled in the art may make modifications or alterations to the disclosed technical content to the equivalent embodiments. However, any simple modification, equivalent variation and variation of the above embodiments according to the technical substance of the present application still fall within the protection scope of the technical solution of the present application.
Claims (5)
1. The power grid terminal abnormality detection method is characterized by comprising the following steps of:
carrying out protocol layer-by-layer analysis on the received power grid terminal message, and extracting network layer data and application layer instruction level characteristics;
IP identification is carried out on the power grid terminal message, flow characteristics are extracted, and flow anomaly detection of the power grid terminal is achieved through a single-class support vector machine (OCSVM);
extracting key fields capable of identifying protocol features by extracting application layer instruction level features, and respectively matching with grammar semantic rules and an attack feature library to realize detection of malformed messages and attack messages; and extracting a behavior characteristic value of the business instruction, and detecting the illegal business instruction through a cluster detection model based on cluster learning.
2. The power grid terminal anomaly detection method according to claim 1, wherein the grammar semantic rules are designed according to protocol specifications; and the attack feature library adopts a snort network attack rule library.
3. The method for detecting the abnormality of the power grid terminal according to claim 1, wherein the implementation method for detecting the illegal service instruction through the cluster detection model based on cluster learning is as follows:
extracting service instruction behavior characteristic values from a large number of training message samples, wherein the service instruction behavior characteristic values comprise service instruction characteristic codes and service instruction frequencies, and providing the service instruction characteristic codes and service instruction frequencies for a clustering algorithm to learn;
each sample feature is learned through a K-Means clustering algorithm, so that the business instruction behavior features of the same class are gathered into the same cluster, classification of the business instruction behavior features is realized, a multi-class business instruction behavior cluster family is formed, and a trained cluster detection model is further obtained;
and in the monitoring stage, extracting the service instruction behavior characteristic value of the power grid terminal message acquired in real time, and then analyzing the extracted service instruction behavior characteristic value through a trained cluster detection model to judge whether the service characteristic abnormality occurs.
4. The method for detecting the abnormality of the power grid terminal according to claim 3, wherein the frequency clustering analysis for the service instruction of the intelligent terminal of the power grid comprises the following steps:
1) Determining a cluster analysis object: performing cluster analysis on feature codes and frequencies of different service instructions of the intelligent power grid terminal;
2) Constructing a feature vector: constructing a five-dimensional feature vector < IP, type identification, transmission reason, information object address and unit time service instruction frequency > aiming at service instruction frequency, wherein the five-dimensional feature vector represents feature codes and feature code frequency for transmitting certain type of service instruction in unit time of a power grid intelligent terminal of certain IP;
3) Training sample data acquisition: collecting normal network data sample flow, analyzing and identifying the service instruction type, and counting the occurrence frequency in unit time;
4) Building a training vector set: generating a data set x= { X containing n five-dimensional data points according to a five-dimensional vector structure 1 ,x 2 ,…,x n }；
5) Clustering and constructing a cluster detection model: organizing data objects in a data set into K partitions C= { C by a K-Means clustering algorithm k I= … k }, each partition representing a class c k Each class c k With a class centre mu i Selecting Euclidean distance as similarity and distance judgment criterion, and calculating the cluster square sum from each point in the class to the cluster center; thereby constructing and obtaining a cluster detection model;
6) And (3) online detection of service instruction frequency: and classifying the detection vectors by using the clustering detection model established after training, and judging that the abnormality occurs if the detection vectors do not belong to any class group.
5. The power grid terminal anomaly detection method according to claim 1, wherein the method is used for monitoring large data objects aiming at multi-source heterogeneous power grid terminals in a high-dimensional safety manner, and mainly processing text original data, image original data and log data; firstly extracting characteristics of original text data and original image data to form a feature matrix, then analyzing the internal structure of a correlation matrix or a covariance matrix of original variables through principal component analysis, and converting a plurality of variables into a few comprehensive variables, namely principal components, so as to achieve the purpose of dimension reduction; aiming at log data, constructing a correlation network according to the sequence adjacent relation of different event units in the log, based on a network embedded model of deep random walk, learning low-dimensional vector expression of key elements in the log, and based on the correlation and aggregation characteristics among the key elements in the calculation log, automatically finding out specific behavior patterns and abnormal behavior outliers; by processing the data of the intelligent terminal of the power grid, the abnormal behavior of the intelligent terminal of the power grid can be found.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311081328.6A CN117240511A (en) | 2023-08-25 | 2023-08-25 | Power grid terminal abnormality detection method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311081328.6A CN117240511A (en) | 2023-08-25 | 2023-08-25 | Power grid terminal abnormality detection method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117240511A true CN117240511A (en) | 2023-12-15 |
Family
ID=89088820
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311081328.6A Pending CN117240511A (en) | 2023-08-25 | 2023-08-25 | Power grid terminal abnormality detection method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117240511A (en) |
-
2023
- 2023-08-25 CN CN202311081328.6A patent/CN117240511A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Ektefa et al. | Intrusion detection using data mining techniques | |
| CN109522716B (en) | Network intrusion detection method and device based on time sequence neural network | |
| CN106778259B (en) | Abnormal behavior discovery method and system based on big data machine learning | |
| Tesfahun et al. | Intrusion detection using random forests classifier with SMOTE and feature reduction | |
| CN111585948B (en) | Intelligent network security situation prediction method based on power grid big data | |
| CN111598179B (en) | Power monitoring system user abnormal behavior analysis method, storage medium and equipment | |
| CN107360152A (en) | A kind of Web based on semantic analysis threatens sensory perceptual system | |
| CN114124482B (en) | Access flow anomaly detection method and equipment based on LOF and isolated forest | |
| CN105376193A (en) | Intelligent association analysis method and intelligent association analysis device for security events | |
| CN112528277A (en) | Hybrid intrusion detection method based on recurrent neural network | |
| CN114915478B (en) | Network attack scene identification method, system and storage medium of intelligent park industrial control system based on multi-agent distributed correlation analysis | |
| CN111901340A (en) | Intrusion detection system and method for energy Internet | |
| Chandrasekhar et al. | Confederation of fcm clustering, ann and svm techniques to implement hybrid nids using corrected kdd cup 99 dataset | |
| CN113067798B (en) | ICS intrusion detection method and device, electronic equipment and storage medium | |
| CN117081858B (en) | Intrusion behavior detection method, system, equipment and medium based on multi-decision tree | |
| CN113918367A (en) | Large-scale system log anomaly detection method based on attention mechanism | |
| CN104836805A (en) | Network intrusion detection method based on fuzzy immune theory | |
| Saheed et al. | An efficient hybridization of k-means and genetic algorithm based on support vector machine for cyber intrusion detection system | |
| CN116248362A (en) | User abnormal network access behavior identification method based on double-layer hidden Markov chain | |
| CN116318878A (en) | Assessment method for security risk of power information network | |
| CN112019529A (en) | New forms of energy power network intrusion detection system | |
| CN115842636A (en) | Network abnormal behavior monitoring method and device based on time sequence characteristics | |
| Nalavade et al. | Evaluation of k-means clustering for effective intrusion detection and prevention in massive network traffic data | |
| CN115514581B (en) | Data analysis method and equipment for industrial internet data security platform | |
| CN117240511A (en) | Power grid terminal abnormality detection method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |