Network security risk monitoring system and method of power monitoring system

Abstract

The invention relates to the technical field of power monitoring systems, in particular to a network security risk monitoring system and method for a power monitoring system, and the system comprises a network security monitoring end and a network security management end. The network security monitoring end is used for collecting operation information and security events of equipment in a power system, merging the information and the security events in real time and sending the information and the security events to the network security management end, and the network security management end is used for receiving the information and performing centralized processing and analysis so as to timely discover and process potential network security risks. Potential network attacks can be found and organized in time, the system is protected from being damaged by hacker viruses and other software, events are rapidly processed, and losses are reduced; and meanwhile, comprehensive monitoring and management of the power monitoring system can be realized, and the workload of operation and maintenance personnel is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power monitoring systems, and in particular to a network security risk monitoring system and a method for an electric power monitoring system. Background Art

[0002] The power monitoring system is an intelligent, digital management platform that uses computer technology, network communication technology, and automation control technology to conduct real-time monitoring, data collection, data processing, and control of the power system. Through power monitoring, the power system can be comprehensively monitored and managed, the stability and reliability of the power system can be improved, and the safe operation of the power system can be guaranteed.

[0003] The network monitoring system is an important part of ensuring the safe and stable operation of the power system. It monitors and analyzes security incidents and potential threats in the power monitoring network, provides timely security warnings and response mechanisms, and ensures the network security of the power system.

[0004] In the Chinese invention patent application with announcement number CN113746852A and titled "A network security risk monitoring system and method for an electric power monitoring system", a network security risk monitoring system and method for an electric power monitoring system are disclosed. The network security of the electric power system is divided into regions, its network equipment is physically isolated, and different processing methods are adopted according to the rapid response to external intrusions and internal errors. This is conducive to adopting different protection measures according to the intrusion method when facing external intrusions, and requires power personnel to quickly deploy and investigate, while improving the network security awareness of power personnel and reducing the network security risks caused by internal errors. However, the network traffic, intrusion behavior and abnormal activities of the electric power monitoring system cannot be monitored in real time during network security risk monitoring, which increases the risk, and the personnel entering the system cannot be efficiently screened, affecting network security.

[0005] Therefore, there is an urgent need for a network security risk monitoring system and method for an electric power monitoring system to solve the above-mentioned problems. Summary of the invention

[0006] The present invention provides a network security risk monitoring system and method for an electric power monitoring system, which overcomes the deficiencies of the above-mentioned prior art and can effectively solve the problems in the prior art that network security risk monitoring cannot monitor the network traffic, intrusion behavior and abnormal activities of the electric power monitoring system in real time, and cannot efficiently screen the personnel entering the system.

[0007] One of the technical solutions of the present invention is achieved through the following measures: A network security risk monitoring system for a power monitoring system, comprising: The network security monitoring terminal is used to collect the operation information and security events of the equipment in the power system, and send them to the network security management terminal in real time; The network security management terminal is used to receive information and conduct centralized processing and analysis to facilitate timely detection and handling of potential network security risks.

[0008] The following is a further optimization and / or improvement of one of the above-mentioned technical solutions: The network security monitoring terminal may include a data acquisition module and a data analysis and alarm module; Among them, the data acquisition module is used to collect operation information and safety events from power monitoring equipment; Among them, the data analysis and alarm module is used to conduct in-depth analysis of the collected data and identify potential security risks and threats.

[0009] The information collected by the above data collection module may include user login information, operation behavior information, network connection information, system configuration information, permission change information, hardware configuration information, hardware status information, peripheral access information, and network device topology information and online time.

[0010] The network security management terminal may include a user access module, a system log management module, an emergency response module and a security protection module; Among them, the user access module is used to formulate user access rules and set user permissions to ensure that users can smoothly perform data operations while preventing illegal access and unauthorized operations; Among them, the system log management module is used to record and back up every operation of the system so as to trace and investigate security incidents; Among them, the emergency response module is used to establish a complete emergency response mechanism and formulate emergency plans and drill plans; Among them, the security protection module is used for network communication security and data encryption and transmission to ensure the network security and stable operation of the power monitoring system.

[0011] The user access module can use identity authentication, access control and authority management technical means to achieve user and authority management; The system log management module can use log collection, storage, analysis and display methods to achieve comprehensive management of system logs.

[0012] The second technical solution of the present invention is achieved by the following measures: A network security risk monitoring method for a power monitoring system comprises the following steps: Provided is a network security risk monitoring system for an electric power monitoring system, wherein the network security risk monitoring system for an electric power monitoring system is the network security risk monitoring system for an electric power monitoring system described above; The data collection module in the network security monitoring terminal collects operation information and security events from the power monitoring equipment, and conducts in-depth analysis on the collected data to identify potential security risks and threats; The analyzed data is sent to the network security management terminal, and the user identity, authority and access control of the system are managed through the user access module to ensure that only legitimate users can access the data; When a threat or abnormal behavior is detected, the emergency response module will promptly issue an alarm and initiate the response process; During access, the system log management module records operation logs and security event logs to provide a basis for subsequent accident investigations, and sets up an encryption module to encrypt power monitoring data for higher security.

[0013] The following is a further optimization and / or improvement of the second technical solution of the above invention: The CPU utilization, memory usage, network port traffic, and user login information can be analyzed. When an abnormality or potential security risk occurs, the system will generate an alarm message and handle it through relevant personnel; based on the preset thresholds and rules, it will be determined whether a new reporting event needs to be generated.

[0014] Rapid response to security incidents can be achieved by pre-setting alarm rules and thresholds combined with intelligent analysis algorithms; wherein, the pre-setting alarm rules and thresholds include the following steps: Collect data and analyze and process the data using statistical analysis and other methods to find out the distribution patterns, abnormal points and potential security risks of the data, and determine reasonable alarm thresholds based on the analysis results; Define specific alarm conditions based on determined thresholds, set different alarm levels and select appropriate notification methods based on the severity and impact of the alarm.

[0015] The above alarm conditions can be set to trigger an alarm when the monitoring indicators exceed or fall below the set threshold. The alarm levels include urgent, important and general, and the notification methods include SMS, email and instant messaging tools.

[0016] The present invention can monitor the network traffic, intrusion behavior and abnormal activities of the power monitoring system in real time through the settings of the user access module, system log management module, emergency response module and security protection module, can timely discover and organize potential network attacks, protect the system from hacker viruses and other software, and can enhance risk response capabilities. When a security incident occurs, it can quickly start the emergency response mechanism, quickly handle the incident and reduce losses. At the same time, through strict access control policies, unauthorized personnel are restricted from accessing and modifying data, preventing data leakage and illegal use. Through automated monitoring and management, comprehensive monitoring and management of the power monitoring system can be achieved, reducing the workload of operation and maintenance personnel. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a structural schematic diagram of a network security risk monitoring system of an electric power monitoring system in an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The present invention is not limited by the following embodiments, and specific implementation methods can be determined based on the technical solution of the present invention and actual conditions.

[0019] The present invention will be further described below in conjunction with embodiments: Embodiment 1: As attached Figure 1 As shown, the network security risk monitoring system of the power monitoring system includes: The network security monitoring terminal is used to collect the operation information and security events of the equipment in the power system, and send them to the network security management terminal in real time; The network security management terminal is used to receive information and conduct centralized processing and analysis to facilitate timely detection and handling of potential network security risks.

[0020] In this embodiment, the network security monitoring terminal includes a data acquisition module and a data analysis and alarm module; Among them, the data acquisition module is used to collect operation information and safety events from power monitoring equipment; Among them, the data analysis and alarm module is used to conduct in-depth analysis of the collected data and identify potential security risks and threats.

[0021] In this embodiment, the data acquisition module uses the intrusion detection system and the firewall log method to capture and process data information in real time. In this embodiment, the information collected by the data acquisition module includes user login information, operation behavior information, network connection information, system configuration information, permission change information, hardware configuration information, hardware status information, peripheral access information, and network device topology information and online time. These data information are collected through the network security monitoring device, which can support multiple device types and interfaces.

[0022] In this embodiment, the data analysis and alarm module analyzes CPU utilization, memory usage, network port traffic, and user login information. When an abnormality or potential security risk occurs, the system will generate alarm information and process it through relevant personnel; based on the preset thresholds and rules, it is determined whether a new reporting event needs to be generated.

[0023] In this embodiment, the data analysis and alarm module realizes rapid response to security events by presetting alarm rules and thresholds in combination with intelligent analysis algorithms; wherein, the presetting alarm rules and thresholds are divided into two stages; Phase 1: Collect data and analyze and process the data using statistical analysis and other methods to find out the distribution patterns, abnormal points and potential security risks of the data, and determine reasonable alarm thresholds based on the analysis results; Phase 2: Define specific alarm conditions based on the determined thresholds, set different alarm levels according to the severity and impact of the alarm, and select appropriate notification methods.

[0024] In this embodiment, the alarm condition is set to trigger an alarm when the monitoring indicator exceeds or falls below a set threshold. The alarm levels include urgent, important and general, and the notification methods include SMS, email and instant messaging tools.

[0025] In this embodiment, the network security management terminal includes a user access module, a system log management module, an emergency response module, and a security protection module; Among them, the user access module is used to formulate user access rules and set user permissions to ensure that users can smoothly perform data operations while preventing illegal access and unauthorized operations; Among them, the system log management module is used to record and back up every operation of the system so as to trace and investigate security incidents; Among them, the emergency response module is used to establish a complete emergency response mechanism and formulate emergency plans and drill plans; Among them, the security protection module is used for network communication security and data encryption and transmission to ensure the network security and stable operation of the power monitoring system.

[0026] In this embodiment, the user access module uses identity authentication, access control and authority management technical means to achieve user and authority management; In this embodiment, the system log management module adopts log collection, storage, analysis and display means to achieve comprehensive management of system logs.

[0027] The network security risk monitoring system of the power monitoring system collects operation information and security events from the power monitoring equipment through the data acquisition module in the network security monitoring terminal, and conducts in-depth analysis of the collected data to identify potential security risks and threats; the analyzed data is sent to the network security management terminal, and the user access module is used to manage the user identity, authority and access control of the system to ensure that only legitimate users can access it; when threats or abnormal behaviors are found, the emergency response module will issue an alarm in time and initiate the response process; when accessing, the system log management module records the operation log and security event log to provide a basis for subsequent accident investigations, and an encryption module is set to encrypt the power monitoring data to make it more secure.

[0028] The network security risk monitoring system of the power monitoring system can monitor the network traffic, intrusion behavior and abnormal activities of the power monitoring system in real time through the settings of user access module, system log management module, emergency response module and security protection module, and can timely discover and organize potential network attacks, protect the system from hacker viruses and other software, and enhance risk response capabilities. When a security incident occurs, it can quickly start the emergency response mechanism to quickly handle the incident and reduce losses. At the same time, through strict access control policies, unauthorized personnel are restricted from accessing and modifying data, preventing data leakage and illegal use. Through automated monitoring and management, comprehensive monitoring and management of the power monitoring system can be achieved, reducing the workload of operation and maintenance personnel.

[0029] Embodiment 2: This embodiment discloses a network security risk monitoring method for a power monitoring system, comprising the following steps: Provided is a network security risk monitoring system for an electric power monitoring system, wherein the network security risk monitoring system for an electric power monitoring system is the network security risk monitoring system for an electric power monitoring system described above; The data collection module in the network security monitoring terminal collects operation information and security events from the power monitoring equipment, and conducts in-depth analysis on the collected data to identify potential security risks and threats; The analyzed data is sent to the network security management terminal, and the user identity, authority and access control of the system are managed through the user access module to ensure that only legitimate users can access the data; When a threat or abnormal behavior is detected, the emergency response module will promptly issue an alarm and initiate the response process; During access, the system log management module records operation logs and security event logs to provide a basis for subsequent accident investigations, and sets up an encryption module to encrypt power monitoring data for higher security.

[0030] In this embodiment, the CPU utilization, memory usage, network port traffic, and user login information are analyzed. When an abnormality or potential security risk occurs, the system will generate an alarm message and handle it through relevant personnel; based on the preset thresholds and rules, it is determined whether a new reporting event needs to be generated.

[0031] In this embodiment, a quick response to a security incident is achieved by presetting alarm rules and thresholds in combination with an intelligent analysis algorithm; wherein the presetting alarm rules and thresholds includes the following steps: Collect data and analyze and process the data using statistical analysis and other methods to find out the distribution patterns, abnormal points and potential security risks of the data, and determine reasonable alarm thresholds based on the analysis results; Define specific alarm conditions based on determined thresholds, set different alarm levels and select appropriate notification methods based on the severity and impact of the alarm.

[0032] In this embodiment, the alarm condition is set to trigger an alarm when the monitoring indicator exceeds or falls below a set threshold. The alarm levels include urgent, important and general, and the notification methods include SMS, email and instant messaging tools.

[0033] The network security risk monitoring method of the power monitoring system can monitor the network traffic, intrusion behavior and abnormal activities of the power monitoring system in real time, can timely discover and organize potential network attacks, protect the system from hacker viruses and other software, and can enhance risk response capabilities. When a security incident occurs, it can quickly start the emergency response mechanism to quickly handle the incident and reduce losses. At the same time, through strict access control policies, unauthorized personnel are restricted from accessing and modifying data, preventing data leakage and illegal use. Through automated monitoring and management, comprehensive monitoring and management of the power monitoring system can be achieved, reducing the workload of operation and maintenance personnel.

[0034] The above technical features constitute the embodiments of the present invention, which have strong adaptability and implementation effect. Non-essential technical features can be added or reduced according to actual needs to meet the requirements of different situations.

Claims

1. A network security risk monitoring system for an electric power monitoring system, characterized in that include: The network security monitoring terminal is used to collect the operation information and security events of the equipment in the power system, and send them to the network security management terminal in real time; The network security management terminal is used to receive information and conduct centralized processing and analysis to facilitate timely detection and handling of potential network security risks.

2. The network security risk monitoring system of the power monitoring system according to claim 1 is characterized in that The network security monitoring terminal includes a data acquisition module and a data analysis and alarm module; Among them, the data acquisition module is used to collect operation information and safety events from power monitoring equipment; Among them, the data analysis and alarm module is used to conduct in-depth analysis of the collected data and identify potential security risks and threats.

3. The network security risk monitoring system of the power monitoring system according to claim 2 is characterized in that The information collected by the data collection module includes user login information, operation behavior information, network connection information, system configuration information, permission change information, hardware configuration information, hardware status information, peripheral access information, and network device topology information and online time.

4. The network security risk monitoring system of the power monitoring system according to claim 1, 2 or 3, characterized in that The network security management terminal includes user access module, system log management module, emergency response module and security protection module; Among them, the user access module is used to formulate user access rules and set user permissions to ensure that users can smoothly perform data operations while preventing illegal access and unauthorized operations; Among them, the system log management module is used to record and back up every operation of the system so as to trace and investigate security incidents; Among them, the emergency response module is used to establish a complete emergency response mechanism and formulate emergency plans and drill plans; Among them, the security protection module is used for network communication security and data encryption and transmission to ensure the network security and stable operation of the power monitoring system.

5. The network security risk monitoring system of the power monitoring system according to claim 4 is characterized in that The user access module uses identity authentication, access control and authority management technologies to achieve user and authority management.

6. The network security risk monitoring system of the power monitoring system according to claim 4 is characterized in that The system log management module uses log collection, storage, analysis and display methods to achieve comprehensive management of system logs.

7. A network security risk monitoring method for an electric power monitoring system, characterized in that The following steps are involved: Provided is a network security risk monitoring system for an electric power monitoring system, wherein the network security risk monitoring system for an electric power monitoring system is the network security risk monitoring system for an electric power monitoring system according to any one of claims 1 to 6; The data collection module in the network security monitoring terminal collects operation information and security events from the power monitoring equipment, and conducts in-depth analysis on the collected data to identify potential security risks and threats; The analyzed data is sent to the network security management terminal, and the user identity, authority and access control of the system are managed through the user access module to ensure that only legitimate users can access the data; When a threat or abnormal behavior is detected, the emergency response module will promptly issue an alarm and initiate the response process; During access, the system log management module records operation logs and security event logs to provide a basis for subsequent accident investigations, and sets up an encryption module to encrypt power monitoring data for higher security.

8. The network security risk monitoring method of the power monitoring system according to claim 7 is characterized in that Analyze CPU utilization, memory usage, network port traffic, and user login information. When an abnormality or potential security risk occurs, the system will generate an alarm message and handle it through relevant personnel. Determine whether a new reporting event needs to be generated based on preset thresholds and rules.

9. The network security risk monitoring method of the power monitoring system according to claim 7 or 8, characterized in that By presetting alarm rules and thresholds, combined with intelligent analysis algorithms, a rapid response to security incidents can be achieved; wherein, the presetting alarm rules and thresholds include the following steps: Collect data and analyze and process the data using statistical analysis and other methods to find out the distribution patterns, abnormal points and potential security risks of the data, and determine reasonable alarm thresholds based on the analysis results; Define specific alarm conditions based on determined thresholds, set different alarm levels and select appropriate notification methods based on the severity and impact of the alarm.

10. The network security risk monitoring method of the power monitoring system according to claim 9 is characterized in that The alarm condition is set to trigger an alarm when the monitoring indicator exceeds or falls below the set threshold. The alarm levels include urgent, important and general, and the notification methods include SMS, email and instant messaging tools.

Images