基于流量日志的电力信息网络设备异常行为检测技术研究OA

With the continuous advancement of power informatization and intelligence,the power information network has evolved from a traditional physical system to a complex digital ecosystem.In order to accurately identify and prevent potential threats faced by key equipment in the power information network,quickly detect and respond to abnormal situations that may affect the power system,this paper proposes an algorithm for detecting abnormal behavior of similar equipment in the power information network.Firstly,the original traffic access logs are used to construct a equipment access sequence tree,describe equipment access behavior,calculate the edit distance matrix of the equipment access sequence tree,and characterize the behavioral differences and similarities between different equipments.On this basis,the automatic adjustment on stable-membership-based auto-tuning multi-peak clustering algorithm(SMMP)is improved and density based outlier detection algorithm is introduced to discover abnormal equipment behavior.The effectiveness of the proposed method is verified by collecting equipment access traffic log datasets in the power information network.The experimental results show that the method performs well in processing large datasets,and compared with methods such as One Class SVM and Isolation Forest,it shows significant improvements in accuracy,recall,F1 index,false alarm rate,and other indicators.It can provide technical support for identifying equipment abnormal behavior risks in the power information network.