Adaptive Response Technology for Threats in Power IoT Terminals Based on Reinforcement Learning

The power Internet of Things (IoT) terminal is an integral part of the power system and faces a complex network attack scenario. When the power system detects a network attack, it needs to generate disposal scripts to respond to the attack. Traditional network threat response technologies struggle to handle new types of network attacks, so introducing artificial intelligence algorithms to generate disposal scripts is necessary to enhance response success rates. However, power IoT terminals typically have limited computing resources and struggle to execute artificial intelligence algorithms. To address this issue, this paper proposes a power IoT threat response technology based on reinforcement learning, employing a client-server architecture. Here, the client represents the power IoT terminal requiring threat response, while the server functions as the threat disposal center within the power system. Upon receiving threat information, the threat disposal center initially processes it into the necessary response actions. Subsequently, it invokes the reinforcement learning algorithm to produce the operation sequence required by the client to respond and generates distinct disposal scripts tailored to the system environment of each power IoT terminal. These scripts are then distributed to the clients for response. After executing the disposal script, the clients compute the reinforcement learning reward value based on execution results and transmit it back to the server. The server adjusts the response action sequence based on the reward value received from the client and regenerates the disposal script. This iterative process continues until the client successfully completes the threat response. Experiments demonstrate that the power IoT threat response architecture proposed in this paper achieved a 100% response success rate in two threat response scenarios, conclusively showcasing its effectiveness in completing power IoT threat response tasks.