An Incremental Learning-based Approach for Log Anomaly Detection in Electric Power Communication Networks

With the rapid development of power communication networks, the data generated by communication management systems is becoming increasingly large and complex, resulting in challenges related to data complexity and catastrophic forgetting. How to identify network security vulnerabilities and control operational risks through incremental log anomaly detection has become crucial for ensuring the stable operation of power grid. To address the above issues, we propose an incremental learning-based log anomaly detection method for power communication networks. Firstly, our method employs the next-generation communication management system (SG-TMS2.0) to collect log data from the power grid. Then, a log anomaly detection model with Mogrifier LSTM is applied to capture sequence dependencies within the data collected. By leveraging the incremental learning algorithm, Dark Experience Replay (DER), the model is incrementally updated by integrating real-time log data to adjust its parameters. The model is incrementally updated by integrating real-time log data to adjust its parameters. Experiments on real-world data demonstrate that our method significantly improves the accuracy of anomaly detection while substantially reducing time complexity. This makes it well-suited for meeting the real-time requirements of risk analysis in power communication networks.