CN114785573A - Intelligent substation process layer network abnormal flow detection method based on deep learning - Google Patents

Intelligent substation process layer network abnormal flow detection method based on deep learning Download PDF

Info

Publication number
CN114785573A
CN114785573A CN202210357838.0A CN202210357838A CN114785573A CN 114785573 A CN114785573 A CN 114785573A CN 202210357838 A CN202210357838 A CN 202210357838A CN 114785573 A CN114785573 A CN 114785573A
Authority
CN
China
Prior art keywords
network
data
time
process layer
deep learning
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
CN202210357838.0A
Other languages
Chinese (zh)
Inventor
章坚民
肖振远
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou Dianzi University
Original Assignee
Hangzhou Dianzi University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou Dianzi University filed Critical Hangzhou Dianzi University
Priority to CN202210357838.0A priority Critical patent/CN114785573A/en
Publication of CN114785573A publication Critical patent/CN114785573A/en
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/048—Activation functions
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/142—Denial of service attacks against network infrastructure

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Biophysics (AREA)
  • Molecular Biology (AREA)
  • Biomedical Technology (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • Computational Linguistics (AREA)
  • Software Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses an intelligent substation process layer network abnormal flow detection method based on deep learning, which is used for collecting substation process layer network time sequence flow data under different operation conditions, respectively extracting time domain and time-frequency domain characteristics, and obtaining sample data containing sampling time, sample types and time domain characteristics and time-frequency domain characteristics after normalization processing. And training the constructed LSTM neural network by using the sample data to determine the structural parameters and the hyper-parameters of the model. And the dimension of the model output vector is the number of the flow types of the process layer network of the transformer substation. And finally, detecting the network flow data of the transformer substation process layer by adopting the detection model to obtain a corresponding data type result. According to the method, the flow detection of the process level network of the transformer substation is combined with deep learning, so that the accuracy of abnormal flow detection of the process level network of the transformer substation is effectively improved, and the misjudgment rate and the missing rate of detection are reduced.

Description

Intelligent substation process layer network abnormal flow detection method based on deep learning
Technical Field
The application belongs to the technical field of network security, relates to network security management of an intelligent substation, and particularly relates to a method for detecting abnormal flow of a process layer network of the intelligent substation based on deep learning.
Background
The intelligent substation communication network effectively manages and controls the substation equipment, and automation and modernization management of the substation are achieved. The communication between different devices in the substation network follows the IEC 61850 standard. The process layer network covers the SMV and GOOSE message information of the sampled and measured values, is connected with intelligent equipment of the process layer and the interlayer, is also used as a connection link for communicating the electric quantity of the power system and reflecting the communication traffic of each device, and is the most critical communication network for realizing the sensing and control functions of the industrial control domain of the intelligent power grid.
In a normal operation process, the process layer network data flow of the intelligent substation is mainly periodic data flow and a small amount of random data flow, and is occasionally accompanied by sudden data flow influencing the flow peak value of the data flow, so that the overall characteristics show obvious periodicity and irregular variability. Two factors affecting normal operation are provided, one is a factor affecting the communication performance of the process layer network, such as abnormal communication equipment, and the influence result is reflected on the change of the data flow of the process layer network. For example, a network performance-oriented attack represented by DoS attack can obviously increase the flow of a data stream in a short time, thereby affecting and deteriorating the real-time function of the data stream, even making the data stream invalid, and forming a serious threat to the safe and stable operation of a power grid. And secondly, abnormal faults represented by poor contact of the merging unit and the like can cause the flow of the data stream to show a reduction trend, so that information such as a sampling value, a switch state, an equipment state and the like is abnormal in uploading, and hidden dangers are brought to operations such as normal monitoring sensing and control execution of a transformer substation. The fluctuation of the network data flow of the transformer substation can generate different fluctuations along with the occurrence of abnormity or attack, and when the potential threat of the abnormity of the network data flow of the transformer substation is worsened, the network abnormity, communication faults and even serious power failure accidents which endanger the reliability of power supply can be caused.
In the prior art, a time domain statistics-based method is mostly adopted for the research of the intelligent substation network data flow abnormity detection. And modeling by adopting a statistical analysis model, analyzing historical flow data, and constructing an interval threshold of normal data flow, thereby realizing abnormal detection of the data flow. However, the method based on the threshold principle often has the problems of difficult threshold setting, high false judgment or missing detection in detection and the like, so that an artificial intelligence technology including deep learning is introduced, the method has the advantages that the intrinsic characteristics of data can be identified and integrated into modeling, and a series of problems caused by unreasonable threshold setting are overcome. The deep learning method has advantages in processing data sets with large data volume and high data dimensionality. At present, related research aiming at abnormal detection of process layer network data flow of an intelligent substation is less, most of the related research is concerned about detection research of network flow of a substation control layer of the substation, and meanwhile, the research on abnormal detection of the process layer network flow of the substation by using a deep learning method is not involved.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides the method for detecting the abnormal flow of the process layer network of the intelligent substation based on deep learning, the characteristics of the process layer network flow are extracted, and the deep learning method is introduced, so that the detection accuracy of the abnormal flow can be improved, and the detection misjudgment rate and the detection omission rate are reduced.
The intelligent substation process layer network abnormal flow detection method based on deep learning specifically comprises the following steps:
step 1, collecting network time sequence flow data of a transformer substation process layer, wherein the network time sequence flow data comprises normal data and abnormal data, and constructing a training data set with labels.
And 2, extracting time domain characteristics and time-frequency domain characteristics from each sample in the training data set, and performing normalization processing to obtain characteristic sample data comprising sampling time, data types, time domain characteristics and time-frequency domain characteristics. And cascading the LSTM neural network with a layer of MLP network, and then inputting characteristic sample data to perform network training to obtain a detection model.
And 3, inputting the network time sequence flow data of the transformer substation process layer into the detection model trained in the step 2 to obtain the type of the corresponding network time sequence flow data.
Preferably, in step 2, time domain features are extracted by sliding time windows and time-frequency domain features are extracted by wavelet packet decomposition.
Preferably, the time domain features include time window features and trend features of adjacent time instants, and the time-frequency domain features are wavelet packet decomposition coefficients.
The invention has the following beneficial effects:
the deep learning method is introduced, so that data samples with large data volume and high dimensionality can be processed, and the limitation that the traditional machine learning method only can process data samples with small data volume and low dimensionality is overcome; the introduction of various feature extraction methods is helpful for comprehensively reflecting the change characteristics of the time sequence flow, and a single feature extraction method sometimes has the advantage that the time sequence data change characteristics are difficult to completely describe; the research on the data flow of the process layer network of the transformer substation is helpful for analyzing the running states of the process layer and the bay layer devices connected in the network, and the abnormal flow detection can be combined to discover whether the devices are abnormal or are attacked by the network.
Drawings
Fig. 1 is a flow chart of a method for detecting abnormal flow of a process layer network of an intelligent substation based on deep learning;
FIG. 2 is a network topology diagram of a typical intelligent substation type T1-1;
FIG. 3 is a schematic diagram of the LSTM neural network structure.
Detailed Description
The invention is further explained below with reference to the drawings;
in this embodiment, training and testing of the network model are performed in a Python 3.7 environment, the network model is built by using a Keras 2.3.1 environment library, and the network model is calculated and implemented by using a tensrflow 2.2.0.
As shown in fig. 1, the method for detecting abnormal flow of the process level network of the intelligent substation based on deep learning includes the following steps:
step 1, carrying out analog simulation on a T1-1 type transformer substation by using OPNET, and collecting process layer network data streams of the transformer substation under three scenes of normal conditions, DoS attacks and MU poor contact. As shown in fig. 2, the T1-1 type transformer station includes 1 bus, 1 transformer, 1 incoming line and 2 outgoing lines, and the network structure can be divided into 3 intervals: the transformer mainly comprises a space 1, and a space 2 and a space 3 which are respectively formed by two outgoing lines. Each bay consists of a merging unit, breaker IEDs, protection and control IEDs. The devices within each bay communicate with other devices through the internal switch.
(1) And (3) in a normal condition: the process layer network data flow of the intelligent substation is mainly periodic data flow and a small amount of random data flow, and is accompanied by sudden data flow influencing the flow peak value of the data flow, and the overall characteristics of the process layer network data flow of the intelligent substation show obvious periodicity and irregular variability. The periodic data flow belongs to a typical time-driven data flow and can be simulated by using periodic messages with a transmission interval, a specified length and a size. The random data flow is triggered by an event which randomly occurs in the system operation, belongs to typical external event-driven data, and a mathematical model of the random data flow can be simulated by Poisson distribution with k messages arriving in a time interval t and a probability obeying parameter of lambda. The bursty data flow can be simulated by adopting Pareto heavy tail distribution and an ON/OFF model.
(2) Dos attack: namely, denial of service (Dos), refers to that an IED with Dos attack injects a large amount of useless data into a process layer network, occupies available bandwidth of equipment, and causes that normal data streams in a network cannot be transmitted on time. The size and the sending frequency of useless messages sent by the IED with Dos attack can be simulated by random numbers with different probability distributions.
(3) MU poor contact: as a condition that IED equipment in a process level is abnormal, the message sending rate of data flow generated by poor MU contact is lower than normal frequency, the message length is not consistent with the normal message length, random numbers with different probability distributions are selected to simulate the message length and the arrival number of data packets in unit time by a method similar to DoS attack simulation, the message length is simulated by uniform distribution of fixed upper and lower limits, and the message sending rate is simulated by exponential distribution.
In the process of acquiring data samples through simulation experiments, two major types of abnormal data sources, namely DoS attack and MU poor contact, are set in detail first so as to acquire more reliable and comprehensive data samples, and as shown in tables 1 and 2, the data flow forwarding amount on the switch at an interval 2 in the process layer network has 5 durations and 6 abnormal degrees respectively under the two types of abnormal conditions, and 60 groups of data are acquired in total. Considering different moments when single abnormity occurs and in order to ensure that the obtained data samples are as complete as possible, the value which should be adjusted to be similar in the source simulation of each group of data sets is repeatedly tested for 5 times. Under normal conditions, the data source is the same as the simulation set time of the abnormal data stream samples, the data set samples with the same quantity are obtained, and the sampling data interval of each group is 1 s.
Figure BDA0003582576730000031
Figure BDA0003582576730000041
TABLE 1
Figure BDA0003582576730000042
TABLE 2
And 2, performing time domain feature extraction on the data flow samples obtained in the step 1 by adopting a sliding time window, wherein the length L of the sliding time window is 150s, the time interval delta t of each time of moving the time window is 1 second, 32200 data flow samples are obtained in total, the proportion of the samples in normal, DoS attack and MU poor contact is close to 2:1:1, and the proportion of the normal data samples to the abnormal data samples is balanced. And dividing a training, verifying and testing data set according to the ratio of 8:1: 1.
And extracting the time-frequency domain characteristics of the data flow F (t) by a wavelet packet decomposition method:
Figure BDA0003582576730000043
where t denotes the time t, /)nBeing wavelet basis functions, dj,l,nIs the ith wavelet packet coefficient of the nth node of the jth layer.
The characteristics specifically obtained are shown in table 3:
Figure BDA0003582576730000044
TABLE 3
And then, normalizing the extracted characteristic x to eliminate the influence brought by the unit:
Figure BDA0003582576730000045
wherein x is*Normalizing the processed characteristic value, xmin、xmaxThe minimum and maximum values of the feature are respectively.
And 3, a data set consisting of the network flow characteristics of the process layer of the transformer substation is typical multi-dimensional time sequence data, and a proper deep learning neural network model needs to be selected for classification detection. Common time series data deep learning neural network models comprise an MLP full-connection neural network, an RNN recurrent neural network, an LSTM long-short term memory recurrent neural network and the like. It should be noted that, as the time series data increases, increasing the number or level of MLP neurons will result in too many network parameters and poor overfitting effect; however, RNN has a problem of gradient disappearance or gradient explosion. The LSTM long-short term memory recurrent neural network has outstanding advantages in this respect, and is suitable for being used as a classification detection model of a time sequence data set, and the LSTM long-short term memory recurrent neural network can be used for memorizing valuable information and abandoning redundant information by learning information of previous and later periods related to current data in sample data, thereby reducing the learning difficulty.
The method uses an LSTM neural network and an MLP network as a detection model together, the number of neurons in an input layer of the network of the model is the dimension of an input vector, and the number of neurons in an output layer corresponds to the number of data traffic types.
Wherein the LSTM neural network includes an input layer, a hidden layer, and an output layer. Each neuron in the hidden layer is a memory unit, and each memory unit is composed of a forgetting gate f, an input gate i, an output gate o and an internal memory unit c. In LSTMThe structure of the components is shown in fig. 3. Specifically, the input includes a time series input data sample x at time ttThe output value h of the previous momentt-1And gate control unit state ct-1(ii) a Outputting an output value h including time ttAnd gate control unit state ct。
The forgetting gate f is used for controlling the sequence input x at the moment ttAnd the output h of the previous hidden layert-1Degree of forgetting:
ft＝σ(Wfxt+Wfht-1+bf) (3)
wherein f istIs the calculation result of the forgetting gate f at the time t; wfIs the weight matrix of the forgetting gate f; bfIs a biased term for the forgetting gate f. σ () represents a Sigmoid excitation function.
Input gate i for controlling input xtAnd the output h of the previous hidden layert-1Extent of refresh to memory cell:
it＝σ(Wixt+Wiht-1+bi) (4)
wherein itThe calculation result of the input gate i at the time t; w is a group ofiIs the weight matrix of the input gate i; biIs the offset term for input gate i.
An internal memory cell c:
c't＝tanh(Wcxt+Wcht-1+bc) (5)
ct＝ftct-1+itc't (6)
wherein, c'tIs the calculation result of the internal memory unit c at time t; wcIs a weight matrix of the internal memory cell c; b is a mixture ofcIs the bias term for the internal memory cell c; tanh represents the activation function.
Output gate o for controlling internal memory cell state ctOutput to the current output value htDegree of (c):
ot＝σ(Woxt+Woht-1+bo) (7)
ht＝ottanh(ct) (8)
wherein o istIs the calculation result of the output gate o at time t; woIs the weight matrix of the output gate o; boIs the bias term for the output gate o. The final output of the LSTM neural network is determined by the output of the output gate together with the output of the state of the internal memory cell.
Before network training, the following parameters need to be determined:
(1) structural parameters
The structural parameters include the number m of LSTM internal neurons and the number n of MLP internal neurons. The difference between the values of the two parameters will affect the structure of the constructed neural network, and further affect the accuracy of training, and the like, and m is set to 150, and n is set to 200.
(2) Hyper-parameter
The hyper-parameters comprise batch training number Bs and iteration times EPLearning rate α, random deactivation rate DP。
The batch training number Bs is the number of samples taken each time in model training, loss is calculated firstly in the training process, and then network weight and bias are updated according to an optimization algorithm. If Bs is too small, the model training speed will be slow. If the value of Bs is too large, the weight of the network cannot be updated well. Therefore, it is necessary to select an appropriate value so that the training speed and weight update are optimized. Bs is set to 32 in this example.
Number of iterations EPThe number of times of training using all samples in the training set. If E isPIf the value is too small, the model training is not sufficient, and the training accuracy is not sufficient. If E isPIf the value is too large, the model is over-trained, resulting in low test accuracy. In this example, set EP＝1200。
The learning rate α affects the convergence of the model training process. If the value of α is too small, the convergence rate will be slow. If the value of α is too large, the gradient may oscillate around the minimum value, and thus cannot converge to the minimum value. In this example, α is set to 1.
Random deactivation rate DPThe method aims to solve the over-fitting problem in the neural network training process, eliminate the probability of each neuron in a certain layer, inactivate part of neurons, simplify the neural network structure and effectively prevent over-fitting. Setting D in this exampleP＝0.1。
Inputting the training set obtained in the step 2 into the LSTM neural network for network training, and verifying the training effect of the network by using a verification set. Where the kth sample is xk＝[xk1,xk2,xk3,…,xkm]Including the sampling instant, the sample type, 17 time domain features and 8 time-frequency domain features. After passing through the LSTM neural network, the obtained output vector is xj＝[xj1,xj2,xj3,…,xjl]And then input into the MLP network. The output layer of the MLP network adopts softmax activation function, and finally a probability vector y can be obtainedj＝[y1,y2,y3,…,ys]Indicating the probability that sample j belongs to a different data type.
And 4, detecting the data in the test set by using the LSTM neural network trained in the step 3, storing a detection result, and evaluating the performance of the model by adopting three indexes of an accuracy rate ACC, a false alarm rate FPR and a false alarm rate FNR.
Figure BDA0003582576730000071
Figure BDA0003582576730000072
Figure BDA0003582576730000073
TP represents the number of abnormal data samples identified as abnormal data; TN represents the number of normal data samples identified as normal data; FN is the number of abnormal data samples which are not correctly identified; FP is the number of misjudged normal type traffic as abnormal data samples.
The accuracy ACC represents the proportion of correctly classified data samples to the total data set, and the overall effectiveness of the algorithm is reflected; the false alarm rate FPR represents the proportion of the number of normal samples that are misclassified as abnormal to the normal data set of the test set. The false negative rate FNR indicates the number of abnormal samples that are misclassified as normal as a proportion of the abnormal samples that are classified as normal data sets. Good detection should have high accuracy, low false alarm rate and low false negative rate.
In this embodiment, the detection is performed by a fully-connected neural network (MLP), a Recurrent Neural Network (RNN), an LSTM network based on a single time domain feature, and an LSTM network based on a time-frequency domain feature, respectively, and the comparison results are shown in table 4:
Figure BDA0003582576730000074
TABLE 4
Wherein LSTM-I and LSTM-II respectively represent an LSTM network based on time domain features only and an LSTM network based on time-frequency domain features. As can be seen from table 4, the accuracy of the detection method combining feature extraction and LSTM of the present application is significantly higher than that of MLP and RNN, and the detection effect is also higher than that of LSTM under single feature extraction, which is more advantageous in terms of low false alarm rate and low false negative rate, and reduces the detection false positive rate and false negative rate.
The above examples are merely representative of embodiments of the present application, and the description thereof is more specific and detailed, but not to be construed as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent shall be subject to the appended claims.

Claims (6)

1. The intelligent substation process layer network abnormal flow detection method based on deep learning is characterized in that: the method specifically comprises the following steps:
step 1, collecting network time sequence flow data of a transformer substation process layer, wherein the network time sequence flow data comprises normal data and abnormal data, and constructing a flow data set with a label;
step 2, extracting time domain characteristics and time-frequency domain characteristics from each sample in the flow data set, and obtaining characteristic sample data including sampling time, data types, time domain characteristics and time-frequency domain characteristics after normalization processing; cascading an LSTM neural network with a layer of MLP network, and inputting characteristic sample data into the network for training to obtain a detection model;
and 3, inputting the network time sequence flow data of the transformer substation process layer into the detection model trained in the step 2 to obtain the type of the corresponding network time sequence flow data.
2. The intelligent substation process layer network abnormal flow detection method based on deep learning of claim 1 is characterized in that: in step 2, time domain features are extracted through a sliding time window, and time-frequency domain features are extracted through wavelet packet decomposition.
3. The intelligent substation process layer network abnormal flow detection method based on deep learning of claim 1 or 2 is characterized in that: the features extracted in step 2 are shown in table 1:
Figure FDA0003582576720000011
table 1.
4. The intelligent substation process layer network abnormal flow detection method based on deep learning of claim 1 is characterized in that: the detection model comprises an input layer, a hidden layer and an output layer; wherein the number of neurons in the input layer is the dimension of the input vector, and the number of neurons in the output layer is the number of data traffic types.
5. The intelligent substation process layer network abnormal flow detection method based on deep learning of claim 1 or 4 is characterized in that: before network training, structural parameters and hyper-parameters are required to be determined; the structural parameters comprise the number m of LSTM internal neurons and the number n of MLP internal neurons, and the hyper-parameters comprise the number of batch training Bs and the number of iteration times EPLearning rate α, random deactivation rate DP。
6. The intelligent substation process layer network abnormal flow detection method based on deep learning of claim 5 is characterized in that: setting m 150, n 200, Bs 32, EP＝1200，α＝1，DP＝0.1。
CN202210357838.0A 2022-04-06 2022-04-06 Intelligent substation process layer network abnormal flow detection method based on deep learning Withdrawn CN114785573A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210357838.0A CN114785573A (en) 2022-04-06 2022-04-06 Intelligent substation process layer network abnormal flow detection method based on deep learning

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210357838.0A CN114785573A (en) 2022-04-06 2022-04-06 Intelligent substation process layer network abnormal flow detection method based on deep learning

Publications (1)

Publication Number Publication Date
CN114785573A true CN114785573A (en) 2022-07-22

Family

ID=82428089

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210357838.0A Withdrawn CN114785573A (en) 2022-04-06 2022-04-06 Intelligent substation process layer network abnormal flow detection method based on deep learning

Country Status (1)

Country Link
CN (1) CN114785573A (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115412455A (en) * 2022-07-28 2022-11-29 南京航空航天大学 Server multi-performance index abnormity detection method and device based on time sequence
CN116170339A (en) * 2023-02-27 2023-05-26 苏州浪潮智能科技有限公司 Flow data detection method and device
CN117278336A (en) * 2023-11-22 2023-12-22 北京邮电大学 Abnormal flow detection method and system for Internet of things equipment based on time-frequency domain transformation
CN117354042A (en) * 2023-11-14 2024-01-05 龙坤(无锡)智慧科技有限公司 Method for monitoring abnormal flow of edge gateway equipment in dynamic monitoring mode

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115412455A (en) * 2022-07-28 2022-11-29 南京航空航天大学 Server multi-performance index abnormity detection method and device based on time sequence
CN115412455B (en) * 2022-07-28 2023-12-19 南京航空航天大学 Method and device for detecting abnormality of multiple performance indexes of server based on time sequence
CN116170339A (en) * 2023-02-27 2023-05-26 苏州浪潮智能科技有限公司 Flow data detection method and device
CN117354042A (en) * 2023-11-14 2024-01-05 龙坤(无锡)智慧科技有限公司 Method for monitoring abnormal flow of edge gateway equipment in dynamic monitoring mode
CN117278336A (en) * 2023-11-22 2023-12-22 北京邮电大学 Abnormal flow detection method and system for Internet of things equipment based on time-frequency domain transformation
CN117278336B (en) * 2023-11-22 2024-02-13 北京邮电大学 Abnormal flow detection method and system for Internet of things equipment based on time-frequency domain transformation

Similar Documents

Publication Publication Date Title
CN114785573A (en) Intelligent substation process layer network abnormal flow detection method based on deep learning
CN112202736B (en) Communication network anomaly classification method based on statistical learning and deep learning
CN111585948B (en) Intelligent network security situation prediction method based on power grid big data
CN112333194B (en) GRU-CNN-based comprehensive energy network security attack detection method
CN111598179B (en) Power monitoring system user abnormal behavior analysis method, storage medium and equipment
CN111901340B (en) Intrusion detection system and method for energy Internet
CN112215279B (en) Power grid fault diagnosis method based on immune RBF neural network
CN116610998A (en) Switch cabinet fault diagnosis method and system based on multi-mode data fusion
CN116205265A (en) Power grid fault diagnosis method and device based on deep neural network
Zheng Intrusion detection based on convolutional neural network
Ren et al. Research on fault location of process-level communication networks in smart substation based on deep neural networks
CN118051827A (en) Power grid fault prediction method based on deep learning
CN111740998A (en) Network intrusion detection method based on stacked self-encoder
Wen et al. A network security situation awareness method based on gru in big data environment
CN115664804B (en) LDoS attack detection method based on radial basis function neural network
CN114915496B (en) Network intrusion detection method and device based on time weight and deep neural network
Jin et al. Anomaly detection in electricity cyber infrastructures
CN115456106A (en) High-voltage circuit breaker fault diagnosis model optimization method
Tan et al. Using hidden markov models to evaluate the real-time risks of network
Wang et al. A HMM-based method for anomaly detection
Huang et al. An intelligent fault diagnosis method for CNN-SVM circuit breaker based on quantum particle swarm optimization
CN118503973B (en) Method and system for detecting data tampering attack of power system
Yichun et al. Research on intrusion detection system based on IRBF
Meng et al. Network Intrusion Detection Model Based on Artificial Intelligence
Zhao et al. Power grid false data injection attack detection method based on S transform and LSTM

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WW01 Invention patent application withdrawn after publication
WW01 Invention patent application withdrawn after publication

Application publication date: 20220722