水经济运行系统用户异常行为检测模型研究

Research of user abnormal behavior recognition model for water economy operating system

摘要

水经济运行系统是水资源管理的重要工具，能够极大地提升电站的运行效率，系统的用户行为直接影响到水经济运行系统的运行状态和数据的准确性。通过系统日志对用户行为的实时监测和分析，可以及时发现潜在的安全威胁。研究从系统日志中挖掘用户异常行为发生的共性，提出了基于Transformer的水经济运行系统用户异常行为检测模型(T-UABI-WEOS)。在不牺牲数据原有信息的前提下，采用特征融合预处理方法优化了数据的表达形式，使得特征之间的相互作用得到了有效的体现，而不是单纯地被独立对待。考虑到用户行为数据的不平衡问题，引入变分自编码器模型(Variational Auto-Encoder, VAE),对异常序列数据进行学习，进而由已训练的VAE模型生成的模拟异常序列数据平衡数据集，以此来增强模型的训练效果。试验结果显示，相较于传统数据预处理方法，该方法能提高模型的预测精度达6%左右。试验对比了不同的深度学习模型，模型T-UABI-WEOS表现出了更高的准确率和较低的误报率。研究成果为电力行业提供了科学的决策支持，通过实时检测出某些用户的行为存在异常，从而及时发现潜在的安全威胁，并采取相应的防范措施，可以更好地应对网络安全事件，确保电力系统的稳定运行和国家的安全稳定。

Abstract

The water economic operation system is an important tool for water resources management and can greatly improve the operating efficiency of power stations. However, user behavior directly affects the system's operating status and data accuracy. Through real-time monitoring and analysis of user behavior via system logs, potential security threats can be discovered in a timely manner. The commonalities of abnormal user behaviors found in system logs were studied. A Transformer-based user abnormal behavior identification model for water economic operation system(T-UABI-WEOS) was proposed. Without sacrificing the original information of the data, the feature fusion preprocessing method is used to optimize the expression form of the data, so that the interaction between features is effectively reflected, rather than simply being treated independently. Considering the imbalance of user behavior data, a variational auto-encoder(VAE) model to learn from normal sequence data was introduced. The trained VAE model then generates simulated abnormal sequence data to balance the dataset, thus enhancing the training effect of the model. Experimental result show that the proposed method achieves a 6% improvement in prediction accuracy over traditional data preprocessing method. Additionally, the experiment compared different deep learning models, and the model T-UABI-WEOS showed higher accuracy and lower false alarm rate. The result demonstrated that T-UABI-WEOS achieved higher accuracy and a lower false alarm rate. The research result provide scientific decision-making support for the electric power industry. By identifying abnormal user behavior in real-time, potential security threats can be discovered promptly, allowing for the implementation of corresponding preventative measures. The approach can better address network security incidents and ensure the stable operation of the power grid, ultimately contributing to national security and stability.

关键词

用户行为日志 / 特征融合 / 异常检测 / 水经济运行系统

Key words

user behavior log / feature fusion / anomaly detection / water economy operating system

Author summay

唐茂林(1984—), 男, 高级工程师, 学士, 主要研究领域为火电优化调控、电力企业安全管理。E-mail: [e-mail]

基金资助

国家能源集团青海电力有限公司项目“千万千瓦级全清洁能源安全自主可控智能管控系统研究与工程示范”(GJNY-22-108)