Security protection method and device for power business, and storage medium

Abstract

The invention relates to the technical field of Internet of Things security, in particular to a power business-oriented security protection method and device and a storage medium, and the method comprises the steps: recognizing abnormal access information through an intrusion detection system according to detection-required data obtained from a block chain platform; performing data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information; analyzing the risk of the abnormal access information according to the detection required data in combination with the sensitivity score of the abnormal access information, and analyzing the user behavior deviation degree in combination with the current access record to obtain a risk assessment result of the abnormal access information; and setting a danger threshold according to a danger evaluation result, and judging whether the abnormal access information belongs to a dangerous behavior or not. The false alarm rate of the IDS system is reduced by performing secondary evaluation on the abnormal behaviors, and the identification capability of the abnormal behaviors is improved by updating the signature library of the IDS system.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to a security protection method, device and storage medium for electric power business. Background Art

[0002] With the development of smart grid and Internet of Things technologies and the growing global demand for sustainable and clean energy, the power system has become more complex and interconnected, and the amount of business data has also increased dramatically. At the same time, with the popularization of computer technology in the power system, this has made power business data face more security threats, such as hacker attacks, data leakage, and illegal access. The security protection of power business data is of vital importance, which is not only related to the stable operation of the power grid and the continuity of power supply, but also involves national energy security and economic security. The management and protection of power business data must keep pace with the times to adapt to new technologies and market environments. Therefore, a security protection method for power business data is needed.

[0003] Traditional power business data security protection measures usually use intrusion detection systems (IDS) and intrusion prevention systems (IPS) to protect database security. Intrusion detection systems (IDS) monitor networks and systems in real time to detect and respond to potential security threats and attacks. However, the intrusion detection system (IDS) itself has a high false alarm rate, that is, it mistakenly identifies normal browsing records as attacks, which requires administrators to spend a lot of time to deal with, especially when facing a large amount of data, which will seriously affect the response speed to real threats. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a security protection method, device and storage medium for power business.

[0005] According to the first aspect of the embodiment of the present application, a security protection method for power services is provided, and the technical solution adopted is specifically as follows:

[0006] Build a blockchain platform for power business, and connect the intrusion detection system to the blockchain platform to collect the data required for detection;

[0007] The intrusion detection system identifies abnormal access information based on the data required for the detection;

[0008] Performing data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information;

[0009] Analyze the danger of the abnormal access information based on the data required for the detection and the sensitivity score of the abnormal access information, and analyze the degree of user behavior deviation based on the current access records to obtain a danger assessment result of the abnormal access information;

[0010] According to the risk assessment result, a risk threshold is set to determine whether the abnormal access information belongs to a risky behavior;

[0011] If the risk assessment result is less than the risk threshold, the corresponding abnormal access information does not belong to dangerous behavior, the abnormal access information is updated in the signature library of the intrusion detection system, an updated signature library is obtained, and the updated signature library is stored in the blockchain platform.

[0012] In some embodiments of the present invention, the method further includes: if the risk assessment result is greater than or equal to the risk threshold, the corresponding abnormal access information belongs to a dangerous behavior, and an automatic response and alarm are performed on the blockchain platform.

[0013] In some embodiments of the present invention, the data required for detection includes user authority level, data sample type, login address, access timestamp, access duration, and access frequency.

[0014] In some embodiments of the present invention, performing data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information includes:

[0015] Extracting power service data from the abnormal access information, and obtaining keywords from the power service data;

[0016] Analyze the semantics and context information of each keyword in the text to obtain a sensitivity score for each keyword;

[0017] The sensitivity score of the abnormal access information is obtained by combining the sensitivity scores of all keywords in the power business data.

[0018] In some embodiments of the present invention, the risk assessment result of the abnormal access information is obtained by analyzing the risk of the abnormal access information based on the data required for detection and the sensitivity score of the abnormal access information, and analyzing the degree of user behavior deviation in combination with the current access record, including:

[0019] Analyze the danger of the abnormal access information according to the user authority level of the data required for the detection and the sensitivity score of the abnormal access information;

[0020] According to the data required for the detection, a user access habit model is constructed for the historical access habits of the current user corresponding to the abnormal access information, and the degree of user behavior deviation is obtained in combination with the current access records;

[0021] A risk assessment result of the abnormal access information is obtained according to the risk and the degree of deviation of the user behavior.

[0022] In some embodiments of the present invention, based on the data required for detection, a user access habit model is constructed for the historical access habits of the current user corresponding to the abnormal access information, and the degree of user behavior deviation is obtained in combination with the current access record, including:

[0023] Constructing a user access habit model for the historical access habits of the current user corresponding to the abnormal access information according to the historical data sample type, historical login address, historical access timestamp, historical access duration, and historical access frequency in the data required for the detection;

[0024] According to the user access habit model, combined with the current access record, the degree of user behavior deviation is obtained.

[0025] In some embodiments of the present invention, obtaining the degree of user behavior deviation based on the user access habit model and in combination with the current access record includes:

[0026] Compare the data sample type in the user's current access record with the common historical access data sample type to obtain the sample type difference;

[0027] Compare the login address in the user's current access record with the commonly used historical login address to obtain the address difference;

[0028] Compare the difference between the interval between the user's current access time and the last access time with the historical average access cycle to obtain the cycle difference;

[0029] Compare the user's current access time with the average historical access time to get the time difference;

[0030] Compare the user's current access timestamp with the commonly used historical access timestamps to obtain the timestamp difference;

[0031] The degree of user behavior deviation is obtained according to the sample type difference, the address difference, the cycle difference, the duration difference, and the timestamp difference.

[0032] In some embodiments of the present invention, the TF-IDF algorithm is used to obtain keywords in the power business data; and the natural language processing technology is used to analyze the semantics and context information of each keyword in the text.

[0033] According to a second aspect of an embodiment of the present application, a safety protection device for electric power services is provided, the device comprising: the device comprising a memory and a processor, wherein:

[0034] The memory is used to store program code;

[0035] The processor is used to read the program code stored in the memory and execute the security protection method for power business described in the first aspect of the embodiment of the present application.

[0036] According to a third aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored; the computer program is executed by a processor to implement the security protection method for power business as described in the first aspect of the embodiment of the present application.

[0037] Compared with the prior art, the present invention provides a security protection method, device and storage medium for power business, which has the following beneficial effects:

[0038] The present invention constructs a blockchain platform for power business, and connects an intrusion detection system to the blockchain platform to collect data required for detection; the intrusion detection system identifies abnormal access information based on the data required for detection; performs data sensitivity analysis on the abnormal access information to obtain a sensitivity score for the abnormal access information; analyzes the danger of the abnormal access information based on the data required for detection and the sensitivity score of the abnormal access information, and analyzes the degree of user behavior deviation based on the current access records to obtain a risk assessment result for the abnormal access information; and sets a risk threshold based on the risk assessment result to determine whether the abnormal access information is a dangerous behavior. The false alarm rate of the IDS system is reduced by performing a secondary assessment on abnormal behavior, and the signature library of the IDS system is updated to improve the ability to identify abnormal behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A basic flow chart of a security protection method for power business provided by an embodiment of the present invention;

[0041] Figure 2A basic flow chart of a method for determining the processing priority of abnormal access information provided by an embodiment of the present invention;

[0042] Figure 3 A basic flow chart of a method for obtaining risk assessment results of abnormal access information provided by an embodiment of the present invention;

[0043] Figure 4 A basic flow chart of a method for obtaining the degree of deviation of user behavior provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the specific implementation method, structure, features and effects of a security protection method, device and storage medium for power business proposed by the present invention in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0045] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. Terms such as "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a circuit structure, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such article or device. In the absence of further restrictions, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the article or device including the element.

[0046] The following is a detailed description of a specific solution of a security protection method for electric power business provided by the present invention in conjunction with the accompanying drawings.

[0047] See also Figure 1 , which shows the basic process of a security protection method for power business provided by an embodiment of the present invention.

[0048] like Figure 1 As shown, an embodiment of the present invention provides a security protection method for power services, which specifically includes:

[0049] S100: Build a blockchain platform for power business and connect the intrusion detection system to the blockchain platform to collect the data required for detection.

[0050] Power business data usually includes many important data such as customer power application, power supply plan and reply, design documents and review results, mid-term inspection results, completion inspection results, etc. Use the existing blockchain technology to build a blockchain platform for power business, and use the blockchain platform to communicate and collaborate between different power business participants to ensure that all operations and progress are visible to each other in the process of promoting power business. And connect the intrusion detection system (IDS system) on the blockchain platform.

[0051] Develop a data sharing interface or API for the blockchain platform, and open the interface to the intrusion detection system (IDS system). The IDS system accesses and obtains the on-chain data through the data sharing interface or API. When the participants upload and view data on the blockchain, the blockchain platform will record the process of each operation and collect relevant data, including the corresponding access user information (including user authority level), data sample type, login address, access timestamp, access duration, access frequency, historical access times, network traffic data and other related information, and write this information into the system log for storage. When the IDS system performs real-time detection, the data required for detection can be obtained by accessing the system log of any block on the blockchain platform. Among them, the data required for detection includes user authority level, data sample type, login address, access timestamp, access duration, and access frequency.

[0052] S200: The intrusion detection system identifies abnormal access information based on the data required for detection.

[0053] The intrusion detection system (IDS system) is used to perform real-time detection on the network traffic data and system log data of the blockchain platform. The intrusion detection system (IDS system) identifies abnormal access information based on the data required for detection. When the IDS system identifies abnormal behavior, it sends a trigger signal to the smart contract in the blockchain, which contains abnormal access information, that is, detailed information about the abnormal behavior. The smart contract in the blockchain platform will automatically respond to the current abnormal access information according to the preset operation, that is, evaluate the degree of danger of the information and defend according to the evaluation level.

[0054] It should be noted that when facing a known type of attack, the IDS system will detect whether there is the same or similar intrusion behavior in the network by comparing the known attack characteristics (attack signatures) to determine whether an intrusion has occurred.

[0055] S300: Perform data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information.

[0056] During the operation of the blockchain platform system, the IDS system may identify multiple abnormal access information in a short period of time, and the IDS system may send multiple trigger signals to the smart contract in a short period of time. In order to minimize the loss, it is necessary to analyze the target data of each abnormal access information and determine the processing priority of different abnormal access information.

[0057] When a smart contract receives multiple trigger signals, it first performs data sensitivity analysis on the abnormal access information of different access behaviors to determine the data sensitivity of the target data of the abnormal access information in the blockchain system. The higher the data sensitivity of the target data of the abnormal access information, the higher the priority for processing and response. At the same time, since the access behavior is determined to be abnormal behavior by the IDS system, the possibility that the abnormal behavior is an intrusion behavior is higher.

[0058] Based on the above analysis, the embodiment of the present invention performs data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information, and then determines the processing priority of the abnormal access information according to the sensitivity score of the abnormal access information.

[0059] See also Figure 2 , which shows the basic process of a method for determining the processing priority of abnormal access information provided by an embodiment of the present invention.

[0060] like Figure 2 As shown, data sensitivity analysis is performed on the abnormal access information to obtain a sensitivity score of the abnormal access information, and then the processing priority of the abnormal access information is determined according to the sensitivity score of the abnormal access information, including:

[0061] S301: extracting power business data from abnormal access information, and obtaining keywords from the power business data.

[0062] First, the power business data in the abnormal access information is extracted, that is, the target data of the abnormal access behavior, and then the TF-IDF (term frequency-inverse document frequency) algorithm is used to obtain the keywords in the power business data corresponding to the i-th abnormal access information.

[0063] S302: Analyze the semantics and context information of each keyword in the text to obtain a sensitivity score for each keyword.

[0064] The natural language processing technology is used to analyze the semantics and contextual information of each keyword in the power business data, and the sensitivity of each keyword in the power business data is evaluated to obtain the sensitivity score Mg of each keyword in the power business data corresponding to the i-th abnormal access information. i,j ,Mg i,jrepresents the sensitivity score of the jth keyword in the power business data corresponding to the i-th abnormal access information. The sensitivity score of the keyword is quantified using the existing technology, which will not be repeated here.

[0065] S303: Combine the sensitivity scores of all keywords in the power business data to obtain a sensitivity score of the abnormal access information.

[0066] Combined with the sensitivity scores of all keywords in the power business data corresponding to the ith abnormal access information, the sensitivity score Mg of the ith abnormal access information is calculated i , which is the sensitivity score of the current access behavior. The calculation formula for the sensitivity score of the i-th abnormal access information is:

[0067]

[0068] In the formula, Mg i represents the sensitivity score of the i-th abnormal access information, Mg i,j represents the sensitivity score of the jth keyword in the power business data corresponding to the ith abnormal access information, and u represents the total number of keywords in the power business data corresponding to the ith abnormal access information.

[0069] S304: Sort the sensitivity scores of all abnormal access information to determine the processing priority of the abnormal access information.

[0070] The sensitivity scores of all abnormal access information are sorted from large to small to obtain the sensitivity sorting results of all abnormal access information, and the processing priority of the abnormal access information is determined. The dangerousness of the user's behavior is evaluated in order according to the processing priority.

[0071] S400: Analyze the danger of abnormal access information based on the data required for detection and the sensitivity score of abnormal access information, and analyze the degree of user behavior deviation based on current access records to obtain a danger assessment result of the abnormal access information.

[0072] The danger level of user access behavior needs to be evaluated based on multiple factors, namely, different access rights, different access targets, and different historical access habits of visitors, which will make the access behavior show different danger levels. For IDS systems, since IDS systems rely too much on the matching results of access information and signature libraries, it is impossible to accurately define the difference between these behavior changes and intrusion behaviors. In summary, it is also necessary to evaluate abnormal access information to determine whether the abnormal behavior is an intrusion.

[0073] Data is extracted from the traffic data and system logs of the blockchain platform, including the identity of the visitor of the current abnormal behavior, the duration of the visit, the access target, etc., and the dangerousness of the current abnormal behavior is evaluated based on multiple factors to determine whether the IDS system may make an incorrect judgment, resulting in the identification of normal behavior as abnormal behavior.

[0074] Based on the above analysis, the embodiment of the present invention analyzes the danger of abnormal access information based on the data required for detection and the sensitivity score of the abnormal access information, and analyzes the degree of user behavior deviation in combination with the current access records to obtain a risk assessment result of the abnormal access information.

[0075] See also Figure 3 , which shows the basic process of a method for obtaining risk assessment results of abnormal access information provided by an embodiment of the present invention.

[0076] like Figure 3 As shown, based on the data required for detection, combined with the sensitivity score of abnormal access information, the danger of abnormal access information is analyzed, and the degree of user behavior deviation is analyzed in combination with the current access records to obtain the danger assessment results of abnormal access information, including:

[0077] S401: Analyze the danger of abnormal access information based on the user authority level of the data required for detection and the sensitivity score of the abnormal access information.

[0078] When the user authority level is low and the sensitivity score of the corresponding abnormal access information is high, the risk of the access behavior corresponding to the abnormal access information is higher. Therefore, according to the user authority level of the data required for detection and the sensitivity score of the abnormal access information, the risk of the abnormal access information is analyzed. The quantitative formula for the risk of abnormal access information is:

[0079]

[0080] Where P i represents the danger reflected by the relationship between the user authority level corresponding to the i-th abnormal access information and the sensitivity score of the abnormal access information, Mg i represents the sensitivity score of the ith abnormal access information, L represents the user permission level corresponding to the ith abnormal access information, norm represents the linear normalization function, and exp represents the exponential function with the natural constant e as the base.

[0081] Mg i represents the sensitivity score of the i-th abnormal access information, Mg iThe higher the value, the greater the data sensitivity of the power business data corresponding to the abnormal access information, and the higher the corresponding danger; L represents the user authority level corresponding to the i-th abnormal access information. The lower L is, the smaller the access user authority corresponding to the abnormal access information is, and the higher the corresponding danger is; e -L It indicates the correction factor of user authority level to danger, that is, the higher the user authority, the lower the relative danger when accessing all data.

[0082] S402: Based on the data required for detection, a user access habit model is constructed for the historical access habits of the current user corresponding to the abnormal access information, and the degree of user behavior deviation is obtained in combination with the current access records.

[0083] According to the historical data sample type, historical login address, and historical access timestamp [t 1 ,t 2 ,…,t n ,…,t N ], historical visit duration [T 1 ,T 2 ,…,T n ,…,T N ], historical access frequency f, where t n Indicates the nth historical access timestamp of the user corresponding to the abnormal access information, T n Indicates the nth historical access duration of the user corresponding to the abnormal access information, and N indicates the number of historical accesses of the user corresponding to the abnormal access information; a user access habit model is constructed based on the historical access habits of the current user corresponding to the abnormal access information using a neural network algorithm. According to the user access habit model, combined with the current access record, the degree of user behavior deviation is obtained. Among them, the current access record includes the current data sample type, the current login address, the current access timestamp t i 、Current access time T i .

[0084] See also Figure 4 , which shows the basic process of a method for obtaining the degree of deviation of user behavior provided by an embodiment of the present invention.

[0085] like Figure 4 As shown, further, according to the user access habit model, combined with the current access record, the degree of user behavior deviation is obtained, including:

[0086] S4021: Compare the data sample type in the user's current access record with the commonly used historical access data sample type to obtain the sample type difference.

[0087] Compare the data sample type in the user's current access record corresponding to the i-th abnormal access information with the common historical access data sample type to obtain the sample type difference YZ corresponding to the i-th abnormal access information i .

[0088] S4022: Compare the login address in the user's current access record with the commonly used historical login addresses to obtain address differences.

[0089] Compare the login address in the user's current access record corresponding to the i-th abnormal access information with the commonly used historical login address to obtain the address difference D corresponding to the i-th abnormal access information. i .

[0090] The sample type difference YZ obtained in step S4021 is summarized i The address difference D from the address obtained in step S4022 i , specifies that the sample type currently accessed is consistent with the user's access habit model YZ i The value is 1, otherwise YZ i The value is 0; and when the login address is consistent with the user's access habit model D i The value is 1, otherwise D i The value is 0. It should be noted that the sample type difference YZ i It is determined through the database index of the blockchain platform. When the data sample index accessed by the user is different from the data sample index frequently accessed by the user, it is considered that the current user access is inconsistent with the user's historical access habit model; address difference D i It can be obtained by using a hash function. If the hash values ​​generated by two login addresses after being processed by the hash function are different, it can be determined that there is a difference in the original data of the two login addresses.

[0091] S4023: Compare the interval between the user's current access time and the last access time with the difference in the historical average access cycle to obtain the cycle difference.

[0092] Compare the interval Δt between the current access time and the last access time of the user corresponding to the i-th abnormal access information i The average visit cycle , where f represents the historical access frequency of the user corresponding to the i-th abnormal access information, and calculates the interval Δt between the user's current access time and the last access time i The average visit cycle The absolute value of the difference is used to obtain the cycle difference corresponding to the i-th abnormal access information.

[0093] S4024: Compare the user's current access time with the average historical access time to obtain the time difference.

[0094] Compare the user's current access time T corresponding to the i-th abnormal access information i Average historical visit duration Calculate the current access time T i Average historical visit duration The absolute value of the difference, get the duration difference

[0095] S4025: Compare the user's current access timestamp with the commonly used historical access timestamps to obtain the timestamp difference.

[0096] Compare the standardized deviation between the user's current access timestamp corresponding to the i-th abnormal access information and the commonly used historical access timestamps, that is, calculate the user's current access timestamp t i With all common historical access timestamps t n The absolute value of the difference is |t i -t n |, then sum and average to get Where N represents the number of commonly used historical access timestamps, and then the standard deviation σ of all commonly used historical access timestamps t Ratio, get the timestamp difference

[0097] S4026: Obtain the degree of user behavior deviation based on sample type differences, address differences, cycle differences, duration differences, and timestamp differences.

[0098] According to the sample type difference YZ corresponding to the i-th abnormal access information i 、Address difference D i , cycle difference Duration Difference Timestamp Difference Get the user behavior deviation degree CL corresponding to the i-th abnormal access information i .

[0099] Furthermore, the user behavior deviation degree CL corresponding to the i-th abnormal access information i The quantitative formula is:

[0100]

[0101] In the formula, CL i represents the degree of user behavior deviation corresponding to the i-th abnormal access information, YZ i represents the sample type difference corresponding to the i-th abnormal access information, D i represents the address difference corresponding to the i-th abnormal access information, Δt irepresents the interval between the current access time and the last access time of the user corresponding to the ith abnormal access information, f represents the historical access frequency of the user corresponding to the ith abnormal access information, T i Indicates the current access duration of the user corresponding to the i-th abnormal access information, represents the average historical access time of the user corresponding to the i-th abnormal access information, t i Indicates the user's current access timestamp corresponding to the i-th abnormal access information, t n represents the nth historical access timestamp of the user corresponding to the ith abnormal access information, N represents the number of common historical access timestamps of the user corresponding to the ith abnormal access information, σ t It represents the standard deviation of the user's commonly used historical access timestamps corresponding to the i-th abnormal access information, norm represents the linear normalization function, and exp represents the exponential function with the natural constant e as the base.

[0102] Since the sample type currently accessed is consistent with the user access habit model, YZ i The value is 1, otherwise YZ i The value is 0; and when the login address is consistent with the user's access habit model D i The value is 1, otherwise D i The value is 0, then (YZ i +D i ) has three values: 0, 1, and 2, and (YZ i +D i )The larger the value, the smaller the deviation of the corresponding user behavior; It indicates the difference between the time interval between the user's current access time and the last access time and the average access period. The greater the difference between the access interval and the average access interval, the greater the deviation of the user's behavior. Indicates the change in the user's current access time. The greater the change in access time, the greater the deviation in user behavior. It indicates the standardized deviation degree between the user's current access timestamp and the common access timestamp. The larger the standardized deviation degree, the greater the difference between the user's previous access time and the higher the deviation degree of user behavior.

[0103] S403: Obtain a risk assessment result of the abnormal access information according to the risk and the degree of deviation of the user behavior.

[0104] Combine the user's current abnormal access behavior with the user's access habit model H i The difference between the i-th abnormal access information and the user behavior deviation degree CL i , and the risk P reflected by the relationship between the user authority level corresponding to the i-th abnormal access information and the sensitivity score of the abnormal access information i, perform risk assessment on the abnormal behavior identified by the current IDS system, and obtain the risk assessment result W of the abnormal behavior corresponding to the i-th abnormal access information i , where the risk assessment result W i The calculation formula is:

[0105] W i =P i ×CL i

[0106] Where W i represents the risk assessment result of the abnormal behavior corresponding to the i-th abnormal access information, P i The relationship between the user authority level corresponding to the i-th abnormal access information and the sensitivity score of the abnormal access information reflects the danger, CL i Indicates the degree of user behavior deviation corresponding to the i-th abnormal access information.

[0107] S500: According to the risk assessment result, a risk threshold is set to determine whether the abnormal access information is a risky behavior.

[0108] If the detection rules of the IDS system are too strict or incorrectly configured, normal network activities may be mistakenly identified as attacks. By evaluating the danger level of abnormal behavior, the normal access records that are mistakenly identified are screened out and the signature library Q of the IDS system is checked. i Update and utilize the new signature library Q i+1 Monitor blockchain platform traffic data and system logs for abnormal behavior.

[0109] Therefore, firstly, according to the risk assessment result W of the abnormal behavior corresponding to the i-th abnormal access information i , the danger threshold can be set to 0.4 to determine whether abnormal access information is a dangerous behavior.

[0110] S600: If the risk assessment result is less than the risk threshold, the corresponding abnormal access information does not belong to dangerous behavior, the abnormal access information is updated in the signature library of the intrusion detection system, an updated signature library is obtained, and the updated signature library is stored in the blockchain platform.

[0111] If the risk assessment result is less than the risk threshold, that is, W i When <0.4, the corresponding abnormal access information does not belong to dangerous behavior. The abnormal access information is updated in the signature library of the intrusion detection system (IDS system), and the updated signature library is obtained. The updated signature library is stored in the blockchain platform and distributed to each block. Then the new signature library is used to monitor the subsequent abnormal behavior in real time on the blockchain platform traffic data and system logs.

[0112] S700: If the risk assessment result is greater than or equal to the risk threshold, the corresponding abnormal access information is considered a dangerous behavior, and an automatic response and alarm are performed on the blockchain platform.

[0113] If the risk assessment result is greater than or equal to the risk threshold, that is, W i When the value is ≥0.4, the corresponding abnormal access information is a dangerous behavior, and the blockchain platform automatically responds and alarms. When the abnormal access information is a dangerous behavior, that is, when an intrusion occurs, the blockchain platform automatically responds to different degrees and operations according to the intensity and degree of danger of the intrusion, such as isolating the infected system, updating firewall rules, disconnecting malicious connections, etc. It should be noted that the above automatic response measures are all automatically carried out through smart contracts. While the blockchain platform automatically responds, it alarms multiple participants on the blockchain platform so that the administrator can deal with the intrusion in a timely manner.

[0114] Based on the same inventive concept as the above method, this embodiment also provides a security protection device for power business, the device includes: the device includes a memory and a processor, wherein: the memory is used to store program code; the processor is used to read the program code stored in the memory, and execute to build a blockchain platform for power business, and connect the intrusion detection system to the blockchain platform to collect data required for detection; the intrusion detection system identifies abnormal access information according to the data required for detection; performs data sensitivity analysis on the abnormal access information to obtain a sensitivity score for the abnormal access information; analyzes the danger of the abnormal access information according to the data required for detection and the sensitivity score of the abnormal access information, and analyzes the degree of user behavior deviation in combination with the current access records to obtain a risk assessment result of the abnormal access information; sets a risk threshold according to the risk assessment result to determine whether the abnormal access information belongs to a dangerous behavior; if the risk assessment result is less than the risk threshold, the corresponding abnormal access information does not belong to a dangerous behavior, and the abnormal access information is updated in the signature library of the intrusion detection system to obtain an updated signature library, and the updated signature library is stored in the blockchain platform.

[0115] Based on the same inventive concept as the above method, this embodiment also provides a computer-readable storage medium on which a computer program is stored; the computer program is executed by a processor to realize the construction of a blockchain platform for power business, and an intrusion detection system is connected to the blockchain platform to collect data required for detection; the intrusion detection system identifies abnormal access information based on the data required for detection; performs data sensitivity analysis on the abnormal access information to obtain a sensitivity score for the abnormal access information; analyzes the dangerousness of the abnormal access information based on the data required for detection and the sensitivity score of the abnormal access information, and analyzes the degree of user behavior deviation based on the current access records to obtain a risk assessment result of the abnormal access information; sets a risk threshold based on the risk assessment result to determine whether the abnormal access information belongs to a dangerous behavior; if the risk assessment result is less than the risk threshold, the corresponding abnormal access information does not belong to a dangerous behavior, and the abnormal access information is updated in the signature library of the intrusion detection system to obtain an updated signature library, and the updated signature library is stored in the blockchain platform.

[0116] It should be noted that the sequence of the above embodiments of the present invention is only for description and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0117] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A security protection method for power business, characterized in that: The method comprises: Build a blockchain platform for power business, and connect the intrusion detection system to the blockchain platform to collect the data required for detection; The intrusion detection system identifies abnormal access information based on the data required for the detection; Performing data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information; Analyze the danger of the abnormal access information based on the data required for the detection and the sensitivity score of the abnormal access information, and analyze the degree of user behavior deviation based on the current access records to obtain a danger assessment result of the abnormal access information; According to the risk assessment result, a risk threshold is set to determine whether the abnormal access information belongs to a risky behavior; If the risk assessment result is less than the risk threshold, the corresponding abnormal access information does not belong to dangerous behavior, the abnormal access information is updated in the signature library of the intrusion detection system, an updated signature library is obtained, and the updated signature library is stored in the blockchain platform.

2. The security protection method for electric power business according to claim 1 is characterized in that: The method also includes: if the risk assessment result is greater than or equal to the risk threshold, the corresponding abnormal access information belongs to a dangerous behavior, and an automatic response and alarm are performed on the blockchain platform.

3. The security protection method for electric power business according to claim 1 is characterized in that: The data required for the detection includes user authority level, data sample type, login address, access timestamp, access duration, and access frequency.

4. The security protection method for electric power business according to claim 1 is characterized in that: Performing data sensitivity analysis on the abnormal access information to obtain a sensitivity score of the abnormal access information includes: Extracting power service data from the abnormal access information, and obtaining keywords from the power service data; Analyze the semantics and context information of each keyword in the text to obtain a sensitivity score for each keyword; The sensitivity score of the abnormal access information is obtained by combining the sensitivity scores of all keywords in the power business data.

5. The security protection method for electric power business according to claim 3 is characterized in that: According to the data required for the detection, combined with the sensitivity score of the abnormal access information, the dangerousness of the abnormal access information is analyzed, and the degree of user behavior deviation is analyzed in combination with the current access record to obtain the dangerousness assessment result of the abnormal access information, including: Analyze the danger of the abnormal access information according to the user authority level of the data required for the detection and the sensitivity score of the abnormal access information; According to the data required for the detection, a user access habit model is constructed for the historical access habits of the current user corresponding to the abnormal access information, and the degree of user behavior deviation is obtained in combination with the current access records; A risk assessment result of the abnormal access information is obtained according to the risk and the degree of deviation of the user behavior.

6. The security protection method for electric power business according to claim 5 is characterized in that: According to the data required for the detection, a user access habit model is constructed for the historical access habits of the current user corresponding to the abnormal access information, and the degree of user behavior deviation is obtained in combination with the current access records, including: Constructing a user access habit model for the historical access habits of the current user corresponding to the abnormal access information according to the historical data sample type, historical login address, historical access timestamp, historical access duration, and historical access frequency in the data required for the detection; According to the user access habit model, combined with the current access record, the degree of user behavior deviation is obtained.

7. The security protection method for electric power business according to claim 6 is characterized in that: According to the user access habit model, combined with the current access record, the degree of user behavior deviation is obtained, including: Compare the data sample type in the user's current access record with the common historical access data sample type to obtain the sample type difference; Compare the login address in the user's current access record with the commonly used historical login address to obtain the address difference; Compare the difference between the interval between the user's current access time and the last access time with the historical average access cycle to obtain the cycle difference; Compare the user's current access time with the average historical access time to get the time difference; Compare the user's current access timestamp with the commonly used historical access timestamps to obtain the timestamp difference; The degree of user behavior deviation is obtained according to the sample type difference, the address difference, the cycle difference, the duration difference, and the timestamp difference.

8. The security protection method for electric power business according to claim 4 is characterized in that: The TF-IDF algorithm is used to obtain keywords in the power business data; and the semantics and context information of each keyword in the text is analyzed using natural language processing technology.

9. A safety protection device for power business, characterized in that: The device comprises a memory and a processor, wherein: The memory is used to store program codes; The processor is used to read the program code stored in the memory and execute the security protection method for power business as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon; the computer program is executed by a processor to implement a security protection method for electric power business as described in any one of claims 1 to 8.

Images