基于受限玻尔兹曼机的电力信息系统多源日志综合特征提取

Multi-Source Log Comprehensive Feature Extraction Based on Restricted Boltzmann Machine in Power Information System

为了充分利用电力信息系统中的异构数据源挖掘出电网中存在的安全威胁,本文提出了基于受限玻尔兹曼机(Restricted Boltzmann Machine,RBM)的多源日志综合特征提取方法,首先采用受限玻尔兹曼机神经网络对各类日志信息进行规范化编码,随后采用对比散度快速学习方法优化网络权值,利用随机梯度上升法最大化对数似然函数对RBM模型进行训练学习,通过对规范化编码后的日志信息进行处理,实现了数据降维并得到融合后的综合特征,有效解决了日志数据异构性带来的问题.通过在电力信息系统中搭建大数据威胁预警监测实验环境,并进行了安全日志综合特征提取及算法验证,实验结果表明,本文所提出的基于RBM的多源日志综合特征提取方法能用于聚类分析、异常检测等各类安全分析,在提取电力信息系统中日志特征时有较高的准确率,进而提高了网络安全态势预测的速度和预测精度.

In order to excavate security threats in power grid by making full use of heterogeneous data sources in power information system,this study proposes a multi-source log comprehensive feature extraction method based on Restricted Boltzmann Machine(RBM).Firstly,the RBM neural network is used to normalize coding all kinds of log information.Then,the contrast divergence fast learning method is used to optimize the network weight,and the stochastic gradient rise method is used to maximize the logarithmic likelihood function for the training and learning of the RBM model.The data dimension reduction is realized by processing the normalized coded log information.At the same time,the comprehensive features are obtained,which can effectively solve the problems caused by the heterogeneity of log data.The big data threat early warning monitoring experimental environment was set up in the power information system,and the comprehensive feature extraction and algorithm verification of the security log were carried out.Experimental results show that the proposed method can be applied to all kinds of security analysis,such as clustering analysis,anomaly detection,etc.,and it has high accuracy in extracting log features in power information system,which improves the speed and accuracy of network security situation prediction.