Security situational awareness of power information networks based on machine learning algorithms

Figures & data

Table 1. Network Security Situation Level Table.

Category (c)	Safety index	Safety level	Detailed description
1	0∼0.2	Security	There is no potential for traditional harmful attack behaviour, no threat from viruses, and no known vulnerabilities
2	0.2∼0.4	Mild risk	A few unneeded port openings or vulnerabilities, along with risky actions like scanning, have a minimal impact
3	0.4∼0.75	General risks	With more risks and weaknesses that could have an impact, there is a higher chance that external attackers will be successful in their invasion
4	0.75∼0.9	Moderate risk	The rise in activities like network attacks and virus software can result in system failures and jeopardise the system's ability to run steadily
5	0.9∼1.0	Highly dangerous	The regular operation of the power system may be threatened at any time by harmful viruses or other weaknesses

Figure 1. RBF neural network structure.

Table 2. Acquisition data format.

Network Data Samples	Network behaviour
$x_{11},x_{12},\dots ,x_{1d}$	$y_1$
$x_{21},x_{22},\dots ,x_{2d}$	$y_2$
$\dots$	$\dots$
$x_{n1},x_{n2},\dots ,x_{nd}$	$y_n$

Figure 2. Algorithm flow chart.

Figure 3. Power information network security situational awareness structure.

Table 3. Types of Attacks and Corresponding Sample Numbers.

	Corresponding sample quantity
Various types of attacks	Training Set	Test Set
Normal	846	226
Smurf	693	139
Teardrop	78	21
Back	499	103
Neptune	594	63
Ips weep	387	57
Portos weep	89	41
Buffer_ overflow	22	10
Warez client	145	22

Figure 4. Recognition rate by attack type.

Table 4. Evaluation results for each method.

Method	FNR/%	FPR/% of each method	Total accuracy rate/%
LDA-RBF	4.92	5	95.395
RBF	6.94	4.5	94.36
Reference	7.42	9.17	92.38

Table 5. Quantitative values of threat events.

Threat Event	Threat value	Event
Normal	0	Not have
Probe	0.3	Port monitoring and scanning
R2L	0.5	Illegal attempt to log in to the host
Dos	0.7	Conduct a denial-of-service attack
U2L	0.9	Illegal acquisition of host or administrator privileges

Figure 5. Comparison of output results.

Figure 6. Error values for each test sample.

Table 6. Results of error evaluation indicators.

Method	MAE	MSE	RMSE
LDA-RBF	0.0689	0.0195	0.2623
RBF	0.1987	0.0791	0.4457

Figure 7. Power information network environment.

Table 7. Network Traffic Statistics under Normal Conditions.

Traffic statistics	Number of sub-sections/KB	Number of data packets	Utilisation rate/%	Bit rate/kbps	Packets per second
Total flow rate	696	1622	0.008	6.673	4
Broadcast traffic	5	43	0	0	0
Multicast traffic	692	1.6	0.008	6.673	4
Average packet length	440 bytes

Table 8. Packet statistics under normal.

Packet distribution size	Number of sub-sections/KB	Number of data packets	Utilisation rate/%	Bit rate/kbps	Packets per second
$\le$64	0	0	0	0	0
65–127	5	43	0	0	0
128–255	42	216	0.002	1.377	2
256–511	261	724	0.006	5.310	3
512–1023	368	621	0	0	0
1024–1517	25	22	0	0	0
$\ge$1518	0	0	0	0	0

Table 9. Time delay test results.

	Close		Divide
Test items	Remote selection	Remote execution	Remote selection	Remote execution
Delay/m s	500	485	485	516
	484	485	484	516
	516	484	485	515
Average/m s	500	485	485	516

Table 10. Network traffic statistics under attack.

Traffic statistics	Bytes/KB	Number of data packets	Utilisation rate/%	Bit rate/kbps	Packets per second
Total flow rate	15	28	0.007	6.081	4
Broadcast traffic	35.46	460	0.002	769	2
Multicast traffic	10.46	44	0.006	5.313	3
Average packet length	561

Table 11. Packet statistics under attack.

Packet distribution size	Bytes/KB	Number of data packets	Utilisation rate/%	Bit rate/kbps	Packets per second
$\le$64	32.376	519	0	0	0
65–127	1.068	14.5	0.002	769	2
128–255	261	1.4	0	0	0
256–511	654	1.9	0.006	5.313	3
512–1023	329	484	0	0	0
1024–1517	501	451	0	0	0
$\ge$1518	11.7	9	0	0	0

Table 12. Delay test results under attack.

		Execution delay/m s
Serial number	Test items	Joint preset	Joint execution	Split preset	Split execution
1	Attack Testing	900	922	906	906

Table 13. Sample Set.

	Number of samples
Sample set	Training Set	Test Set
Normal	181	54
Brute force	89	17
Port scanning	186	32
Denial of service	181	39
Flow network exception	159	29
Protocol exception	164	49
Business anomaly	257	87

Figure 8. Identification results for each attack in the information network.

Table 14. Comparison of methods.

Method	FNR/%	FPR/%	Overall accuracy rate/%
LDA-RBF	6.08	5.8	94.01
RBF	15.39	15.10	84.68

Data availability

The experimental data used to support the findings of this study are available from the corresponding author upon request.