APT traffic construction and detection method for virtual power plant

As an important infrastructure of carbon peaking and carbon neutrality goals, virtual power plant (VPP) is likely to be the target of advanced persistent threat (APT), at the same time, the lack of APT data of VPP makes it difficult to realize APT detection in VPP. Thus, this paper proposed an APT traffic construction and detection method for VPP. Firstly, transfer component analysis (TCA) is used to select similar traffic features in different domains and reduce the difference in data distribution, so as to construct a traffic dataset suitable for APT detection in VPP. Then, based on sequence generative adversarial nets (SeqGAN), data augmentation is carried out on minority class traffic to improve the detection performance of APT in corresponding stages, forward and reverse min-max normalization is introduced to reduce the computational complexity and improve the data augmentation ability of SeqGAN. Finally, an APT detection method based on information gain-adaptive boosting (IG-Adaboost) is proposed to further improve the overall detection performance of APT. The experimental results show that the proposed method can construct traffic data suitable for APT detection in VPP, realize effective detection of VPP’s APT, and achieve the highest detection accuracy of 98.47%.