{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T00:02:52Z","timestamp":1790294572872,"version":"4.1.0"},"reference-count":26,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T00:00:00Z","timestamp":1782691200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,9,25]],"date-time":"2026-09-25T00:00:00Z","timestamp":1790294400000},"content-version":"vor","delay-in-days":88,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"Guangxi Power Grid Co., Ltd"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Sci Rep"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>With the application of domestic trusted operating systems in the field of power grid, the security threats it faces are increasingly complex. Aiming at the security protection requirements of power grid edge equipment operating system, a comprehensive framework integrating memory forensics and malicious attack type discrimination is proposed. In memory forensics, a memory mirroring mechanism based on full encryption is designed to ensure the legal validity and non-repudiation of forensic data. According to the memory-side characteristics, an interpretability model is proposed to analyze the core fields such as process behavior patterns and abnormal kernel objects in the attacked memory image of the power grid edge device, and the unknown attack types are classified by using the core characteristics of the attacked memory image and gradient lifting algorithm. Due to the lack of prior knowledge on the analysis of malicious attacks suffered by memory images, training malicious attack identification models can assist in the efficient automated operation of power grid system memory forensics and provide more reference samples for traceability forensics. Experimental results show that when using only a single type of sample for training, the proposed method has a recognition accuracy of 99.9% for memory subjected to malicious attacks, and a specific classification accuracy of 99.99% for unknown malicious attacks, which is significantly better than traditional machine learning. A classification method for memory subjected to malicious attacks.<\/jats:p>","DOI":"10.1038\/s41598-026-58890-4","type":"journal-article","created":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T19:25:30Z","timestamp":1782761130000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["An interpretable memory forensics framework for unknown attack identification in power grid edge devices"],"prefix":"10.1038","volume":"16","author":[{"given":"Biao","family":"Liang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yongxing","family":"Lai","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yongming","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wanling","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mingjie","family":"Xu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ge","family":"Jin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,6,29]]},"reference":[{"key":"58890_CR1","unstructured":"Peihua, X. & Ziyu, L. Operating system and beidou application replacement strategies and achievements in the process of localization of information technology innovation in power enterprises. In Typical Cases and Proceedings of Localization of Information Technology Innovation in Power Enterprises (2025), 132\u2013136 (China Resources New Energy (Beipiao) Wind Power Co., Ltd.;, 2025)."},{"key":"58890_CR2","unstructured":"Xiaojun, Z. Exploring documents on hairless al-weapon attacks. Netw. Networks Inf. 133\u2013136 (2021)."},{"key":"58890_CR3","first-page":"40","volume":"39","author":"M Caixia","year":"2023","unstructured":"Caixia, M. Data traceability and evidence collection model design based on blockchain technology. J. China People\u2019s Police Univ. 39, 40\u201345 (2023).","journal-title":"J. China People\u2019s Police Univ."},{"key":"58890_CR4","first-page":"1428","volume":"55","author":"D Jisheng","year":"2025","unstructured":"Jisheng, D. et al. An anonymous blockchain transaction scheme based on sm9 national cryptographic standard. Sci. China: Inf. Sci. 55, 1428\u20131446 (2025).","journal-title":"Sci. China: Inf. Sci."},{"key":"58890_CR5","doi-asserted-by":"publisher","first-page":"20","DOI":"10.19968\/j.cnki.hnkj.1003-5168.2024.20.004","volume":"51","author":"L Qinan","year":"2024","unstructured":"Qinan, L. & Kaiwen, Z. Application of sm2 linkable ring signatures in anonymous electronic voting systems. Henan Sci. Technol. 51, 20\u201325. https:\/\/doi.org\/10.19968\/j.cnki.hnkj.1003-5168.2024.20.004 (2024).","journal-title":"Henan Sci. Technol."},{"key":"58890_CR6","unstructured":"Yongfa, L. et al. Research and practice on security traceability and control technology for power mobile applications and terminals.  Inf. Secur. Commun. Confidentiality  94\u2013100 (2022)."},{"key":"58890_CR7","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Liu, Z. & Bai, J. Network attack detection model based on linux memory forensics. In 2022 14th International Conference on Measuring Technology and Mechatronics Automation (ICMTMA), 931\u2013935 (IEEE, 2022).","DOI":"10.1109\/ICMTMA54903.2022.00189"},{"key":"58890_CR8","doi-asserted-by":"crossref","unstructured":"Wickramasekara, A. & Scanlon, M. A framework for integrated digital forensic investigation employing autogen ai agents. In 2024 12th International Symposium on Digital Forensics and Security (ISDFS), 01\u201306 (IEEE, 2024).","DOI":"10.1109\/ISDFS60797.2024.10527235"},{"key":"58890_CR9","doi-asserted-by":"crossref","unstructured":"Chen, R., Lin, H., Lin, Q. & Ju, H. An automated memory image forensic scheme for linux systems based on containerization technology. In 2024 IEEE Cyber Science and Technology Congress (CyberSciTech), 201\u2013206 (IEEE, 2024).","DOI":"10.1109\/CyberSciTech64112.2024.00040"},{"key":"58890_CR10","doi-asserted-by":"crossref","unstructured":"Dangi, S., Ghanshala, K. & Sharma, S. Holmes: Artificial intelligence enabled expert system for efficient acquisition and analysis using live memory forensics. In 2024 International Conference on Innovations and Challenges in Emerging Technologies (ICICET), 1\u20135 (IEEE, 2024).","DOI":"10.1109\/ICICET59348.2024.10616275"},{"key":"58890_CR11","doi-asserted-by":"crossref","unstructured":"Leng, T. et al. Meminspect: Memory forensics for investigating fileless attacks.  In 2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 946\u2013955 (IEEE, 2023).","DOI":"10.1109\/TrustCom60117.2023.00134"},{"key":"58890_CR12","doi-asserted-by":"crossref","unstructured":"Nair, S.\u00a0J. & Syam, S.\u00a0R. Automated malware detection using memory forensics. In 2024 15th International Conference on Computing Communication and Networking Technologies (ICCCNT), 1\u20135 (IEEE, 2024).","DOI":"10.1109\/ICCCNT61001.2024.10725096"},{"key":"58890_CR13","first-page":"416","volume":"39","author":"Z Jingcheng","year":"2022","unstructured":"Jingcheng, Z., Lunwen, W. & Tao, W. A node importance ranking method based on local features. Comput. Simul. 39, 416\u2013421 (2022).","journal-title":"Comput. Simul."},{"key":"58890_CR14","doi-asserted-by":"publisher","first-page":"221","DOI":"10.1007\/s10207-025-01137-6","volume":"24","author":"K Kumpf","year":"2025","unstructured":"Kumpf, K. et al. Tackling smart city security: deep learning approach utilizing feature selection and two-level cooperative framework optimized by adapted metaheuristics algorithm. Int. J. Inf. Secur. 24, 221 (2025).","journal-title":"Int. J. Inf. Secur."},{"key":"58890_CR15","doi-asserted-by":"publisher","first-page":"2549581","DOI":"10.1080\/09540091.2025.2549581","volume":"37","author":"N Savanovic","year":"2025","unstructured":"Savanovic, N. et al. Hybrid CNN XGBoost intrusion detection approach tuned by modified sine cosine algorithm towards better cloud security. Connect. Sci. 37, 2549581 (2025).","journal-title":"Connect. Sci."},{"key":"58890_CR16","doi-asserted-by":"publisher","first-page":"705","DOI":"10.1007\/s10586-025-05378-x","volume":"28","author":"M Zivkovic","year":"2025","unstructured":"Zivkovic, M. et al. Addressing smart city security: machine and deep learning methodology combining feature selection and two-tier cooperative framework tuned by metaheuristics. Clust. Comput. 28, 705 (2025).","journal-title":"Clust. Comput."},{"key":"58890_CR17","doi-asserted-by":"publisher","first-page":"25198","DOI":"10.1109\/ACCESS.2025.3537407","volume":"13","author":"A Stojkovic","year":"2025","unstructured":"Stojkovic, A., Nikolic, B., Zivkovic, M. & Bacanin, N. Photovoltaic farm production forecasting: Modified metaheuristic optimized long short-term memory-based networks approach. IEEE Access 13, 25198\u201325222 (2025).","journal-title":"IEEE Access"},{"key":"58890_CR18","doi-asserted-by":"crossref","unstructured":"Markovic, V., Jovanovic, L., Zivkovic, M., Radomirovic, B., Njegus, A., Abdel-Salam, M., Simic, V. & Bacanin, N. Attention augmented recurrent architectures for solar energy production forecasting. Appl. Soft Comput. 114119 (2025).","DOI":"10.1016\/j.asoc.2025.114119"},{"key":"58890_CR19","doi-asserted-by":"publisher","first-page":"58","DOI":"10.14004\/j.cnki.ckt.2025.0174","volume":"21","author":"Y Yanxia","year":"2025","unstructured":"Yanxia, Y. Research on the interpretability of machine learning models in the big data environment. Comput. Knowl. Technol. 21, 58\u201360+63. https:\/\/doi.org\/10.14004\/j.cnki.ckt.2025.0174 (2025).","journal-title":"Comput. Knowl. Technol."},{"key":"58890_CR20","doi-asserted-by":"publisher","first-page":"445","DOI":"10.16383\/j.aas.c240218","volume":"51","author":"W Hui","year":"2025","unstructured":"Hui, W. et al. A multimodal interpretable image classification method based on visual attributes. Acta Autom. Sinica 51, 445\u2013456. https:\/\/doi.org\/10.16383\/j.aas.c240218 (2025).","journal-title":"Acta Autom. Sinica"},{"key":"58890_CR21","unstructured":"Chang, H., Guoxia, X. & Lizhen, D. A camouflaged target detection method based on dynamic top-k feature selection and cross tensor decomposition (2025)."},{"key":"58890_CR22","doi-asserted-by":"publisher","first-page":"313","DOI":"10.19769\/j.zdhy.2025.10.084","volume":"66","author":"Q Yanyan","year":"2025","unstructured":"Yanyan, Q. et al. A data security encryption method for power communication networks based on the national cryptographic algorithm sm4. Autom. Appl. 66, 313\u2013315+318. https:\/\/doi.org\/10.19769\/j.zdhy.2025.10.084 (2025).","journal-title":"Autom. Appl."},{"key":"58890_CR23","first-page":"39","volume":"45","author":"L Shiqing","year":"2024","unstructured":"Shiqing, L., Lei, S., Shuxin, C. & Honglie, Z. Design and implementation of digital signature technology based on sm3 & sm2 algorithms in hospital business systems. Software 45, 39\u201341 (2024).","journal-title":"Software"},{"key":"58890_CR24","doi-asserted-by":"publisher","unstructured":"Xu, Z., Xia, H., Xiaotong, Z., Zhenzhen, L. & Lin, M. Research on total phosphorus prediction in reservoirs based on interpretable machine learning methods. J. Aquatic Ecol. 1\u201314, https:\/\/doi.org\/10.15928\/j.1674-3075.202407250001 (2025).","DOI":"10.15928\/j.1674-3075.202407250001"},{"key":"58890_CR25","unstructured":"Jinhao, W. et al. A transient stability assessment method for power systems based on improved xgboost and its interpretive analysis. J. Taiyuan Univ. Technol. 1\u201315."},{"key":"58890_CR26","first-page":"26","volume":"53","author":"W Lu","year":"2025","unstructured":"Lu, W. & Xiaorong, C. Improving ensemble learning algorithms for imbalanced data. Comput. Digit. Eng. 53, 26\u201330 (2025).","journal-title":"Comput. Digit. Eng."}],"container-title":["Scientific Reports"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-58890-4","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-58890-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-58890-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T23:48:59Z","timestamp":1790293739000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-58890-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,29]]},"references-count":26,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["58890"],"URL":"https:\/\/doi.org\/10.1038\/s41598-026-58890-4","relation":{},"ISSN":["2045-2322"],"issn-type":[{"value":"2045-2322","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,29]]},"assertion":[{"value":"21 January 2026","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 June 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 June 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"The authors declare no competing interests.","order":1,"name":"Ethics","label":"Competing interests","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"29843"}}