Unsupervised Anomaly Behavior Detection in Power Information Network Based on Discriminative Semantic Transformation Sequences
Hao Cheng Yu, Wei Sun, J. Liu, Peng Gao · 2024
With the swift progression of modern power systems, more abnormal operations occur in power information networks, which are usually caused by erroneous operations or network attacks. Traditional security protection measures have adopted strict network security strategies, however, cannot capture covert unknown operations and lead to a constant threat. Given the extreme scarcity of abnormal samples in real-world production environments, we propose a new unsupervised detection method based on discriminative semantic transformation sequences. It first employs a log parsing approach based on a sliding window sequence that prevents parameter loss, ensuring the complete retention of the raw semantics and contextual information in the logs that are highly relevant to behavioral intentions. Then, an attention mechanism is used to analyze the correlation between paired elements in the log sequence, capturing the deeper behavioral intentions. Furthermore, by introducing a triplet loss function, the capacity of the detection model to differentiate between positive and negative samples has been improved. Experimental results demonstrate that, compared to the baseline, our approach yields a notable 7.8 % enhancement in the F1-score and achieves a significant 10.4 % reduction in the false positive rate. Additionally, it can flexibly determine the optimal hyperparameters for specific scenarios.