Electric power Internet of Things safety response method and system based on risk assessment

Abstract

The invention provides an electric power Internet of Things security response method and system based on risk assessment, and the method comprises the steps: obtaining a heterogeneous security data set, and carrying out the data processing of the heterogeneous security data set based on a preset data processing rule, and obtaining a standardized data set; according to ATTamp; according to a CK causal relationship analysis method, pattern matching is carried out on the standardized data set, and whether a potential threat scene exists or not is recognized; if the potential threat scene exists, performing time sequence correlation analysis on the threat scene according to a preset correlation graph to obtain a correlation analysis result; performing link analysis on the correlation analysis result to obtain a key attack path; inputting the key attack path and the Internet of Things terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model judges whether an abnormal behavior exists or not; if it is judged that the abnormal behavior exists, safety response is carried out based on preset response measures, and the operation safety of the Internet of Things terminal is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a risk assessment-based power Internet of Things security response method and system. Background Art

[0002] IoT terminal security management faces the challenges of complex and ever-changing threat environments and massive heterogeneous data. Different types of security data have different formats, making it difficult to directly perform correlation analysis. How to effectively identify and respond to security risks in this situation has become an urgent problem to be solved. Parsing and correlation analysis of heterogeneous data are difficult, making it difficult to fully and accurately grasp the security situation. At the same time, there are many types of IoT terminals, and it is difficult to unify security baselines, resulting in a lack of accuracy in the determination of abnormal behaviors. Attack methods are constantly evolving, and traditional static rules are difficult to adapt to the dynamically changing threat situation. It is also a major problem to realize intelligent analysis and early warning of threats in massive data. Furthermore, how to effectively integrate security data of different dimensions and build a comprehensive and three-dimensional security situation awareness capability is also a thorny problem. These problems are interrelated and affect each other, forming technical difficulties in IoT terminal security management. How to ensure security while taking into account system availability and management efficiency has become a contradiction that needs to be balanced. This requires innovation and breakthroughs in multiple links such as data processing, threat analysis, and anomaly detection to cope with increasingly severe security challenges. Summary of the invention

[0003] In response to the above technical problems, the present application provides a risk assessment-based power Internet of Things security response method and system to improve the security of Internet of Things terminal operation.

[0004] In a first aspect, an embodiment of the present application provides a risk assessment-based power Internet of Things security response method, including:

[0005] Acquire heterogeneous security datasets;

[0006] Performing data processing on the heterogeneous security data set based on preset data processing rules to obtain a standardized data set;

[0007] According to the ATT&CK causal analysis method, pattern matching is performed on the standardized data set to identify whether there is a potential threat scenario;

[0008] If there is a potential threat scenario, a temporal correlation analysis is performed on the threat scenario according to a preset correlation map to obtain a correlation analysis result, wherein the correlation map is constructed by the IoT device and the corresponding network data;

[0009] Perform link analysis on the correlation analysis results to obtain key attack paths;

[0010] Inputting the critical attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, wherein the abnormal behavior classification model is constructed based on a random forest algorithm;

[0011] If abnormal behavior is detected, a security response is performed based on the preset response measures.

[0012] The embodiment of the present application provides a risk assessment-based power Internet of Things security response method, which realizes effective identification of abnormal behaviors and timely responses based on the processing and analysis of heterogeneous security data sets, and effectively improves the security of the operation of Internet of Things terminals. Among them, the heterogeneous security data sets are first processed to provide high-quality basic data for the subsequent identification of abnormal behaviors. Then, the embodiment of the present application designs two risk assessments to ensure the accuracy of the security response. Among them, the ATT&CK causal relationship analysis method is used to identify whether there are potential threat scenarios for the Internet of Things terminal. When it is confirmed that there are potential threat scenarios, the key attack paths are further extracted from the threat scenarios, and the abnormal behaviors are identified in combination with the Internet of Things terminal access behavior data. By combining the dual identification of threat scenarios and abnormal behaviors, the ability of the Internet of Things terminal to capture risks and the speed of security response are improved, thereby effectively improving the security of the operation of the Internet of Things terminal.

[0013] In a possible implementation, the performing data processing on the heterogeneous security data set based on a preset data processing rule to obtain a standardized data set includes:

[0014] Using a parsing operator to parse the data format of the heterogeneous security data set to obtain a first structured data set, wherein the first structured data set includes the Internet of Things terminal access behavior data;

[0015] Performing association analysis on each data in the first structured data set to construct a corresponding data relationship map;

[0016] Using a label operator to perform semantic analysis on the data relationship graph, extracting corresponding keywords and entities, and combining a preset ontology library and knowledge graph to semantically annotate each data in the first structured data set, to obtain a second structured data set with semantic annotations;

[0017] Performing ETL standardization processing on the second structured data set according to a preset standardization template, converting heterogeneous data in the second structured data set into a preset format in the standardization template, and obtaining a formatted data set;

[0018] Data fusion is performed on the multi-source heterogeneous data in the formatted data set, and information of the same entity is merged to obtain the standardized data set.

[0019] The embodiment of the present application provides a data processing method, through data format analysis, semantic annotation, ETL standardization processing and multi-source heterogeneous data fusion and other operations, so that the standardized data set after data processing has obvious semantic features and a standardized format suitable for analysis and identification. Through data format analysis, heterogeneous data can be converted into structured data, and preliminary structured data content can be obtained, providing a data basis for a series of subsequent operations. Then, through the association analysis operation, the logical relationship between each data can be captured from the huge first structured data set, and then a relationship map that can represent the logical relationship of each data can be constructed. The relationship map has a form and content connection with the preset ontology library and knowledge map, so it can be retrieved in the ontology library and knowledge map based on the keywords and entities in the relationship map, so as to extract the corresponding ontology concepts, and semantically annotate each data in the first structured data set according to the ontology concept. The data with semantic annotations can make the subsequent risk assessment more accurate. Finally, through standardization processing and data fusion, the second structured data set with semantic annotations is further processed, so that the final standardized data set conforms to the preset normalized data structure, which is convenient for the identification and processing of subsequent models.

[0020] In a possible implementation, the standardized data set is pattern matched according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario, including:

[0021] Performing timestamp normalization processing on the standardized data set to obtain a standardized data set with a timestamp;

[0022] Using a sliding time window to perform time series segmentation on the standardized data set with timestamps to obtain a data subset after time series segmentation;

[0023] According to a preset threat scenario template library, pattern matching is performed on the data subset to confirm whether there is a potential threat scenario by identifying potential attack tactics and techniques.

[0024] In an embodiment of the present application, by performing time series segmentation on the standardized data set, each time window in the standardized data set is classified, and then the data in each time window can be identified separately by pattern matching, thereby improving the accuracy and rationality of threat scenario identification.

[0025] Further, performing a time series correlation analysis on the threat scenario according to a preset correlation map to obtain a correlation analysis result includes:

[0026] Using the PrefixSpan algorithm to perform temporal correlation analysis on the threat scenario according to the correlation graph, and extracting several frequently occurring event sequences;

[0027] According to the sequence of events, combined with the interaction mode between the devices and the preset tactical sequence, a complete attack behavior chain is determined;

[0028] According to the attack behavior chain, the final correlation analysis result is determined.

[0029] In the embodiment of the present application, the PrefixSpan algorithm is applied to perform time series association analysis. The advantage of the PrefixSpan algorithm is that it can handle the orderliness in sequence data. Compared with association rule mining, sequence pattern mining can mine deeper knowledge, capture a more complete chain of attack behaviors, and provide precise guidance for subsequent threat responses.

[0030] Furthermore, the link analysis is performed on the correlation analysis results to obtain the key attack path, including:

[0031] Using a depth-first search algorithm to perform link analysis on the association analysis results to obtain an attack path graph, wherein the attack path graph includes nodes representing attack steps and edges representing attack transfer relationships;

[0032] According to the attack path diagram, the key attack path is obtained by calculating through the Dijkstra algorithm.

[0033] In an embodiment of the present application, a depth-first search algorithm and a Dijkstra algorithm are used to further extract key attack paths from the association analysis results. The key attack paths can intuitively display the attack status of each terminal device and improve the accuracy of subsequent abnormal behavior identification.

[0034] In a possible implementation, the inputting the key attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model so that the abnormal behavior classification model determines whether there is abnormal behavior, including:

[0035] Extracting behavior features from the IoT terminal access behavior data;

[0036] Comparing the behavior characteristics with a preset safety baseline, and calculating the deviation of the behavior characteristics;

[0037] The key attack path and the deviation are input into the abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior based on a preset abnormality determination rule.

[0038] The embodiment of the present application provides a method for identifying abnormal behavior. First, the access behavior data of the Internet of Things terminal is analyzed. By extracting the behavior features from the access behavior data of the Internet of Things terminal and comparing them with the preset security baseline, the deviation of the behavior features can be obtained. Then, combined with the key attack path determined in the previous step, it is comprehensively judged whether each terminal device has abnormal behavior from the two aspects of the degree of deviation of the behavior features and whether it is in the key attack path. Since the above-mentioned abnormal identification process is a process of making decisions after multiple judgments, and the random forest algorithm based on the decision tree is very suitable for the above-mentioned process, the present application uses the abnormal behavior classification model obtained by constructing the random forest algorithm to perform the above-mentioned abnormal identification process, and inputs the key attack path and the deviation into the trained abnormal behavior classification model, so that it can judge whether each terminal device has abnormal behavior.

[0039] Furthermore, the security response based on the preset response measures includes:

[0040] Send structured alarm information to the security management platform;

[0041] Call network device interfaces to implement access control based on source IP and destination port;

[0042] Send an offline instruction including the device identification and offline reason to the terminal management system.

[0043] In a possible implementation, the power Internet of Things security response method further includes regularly dynamically updating the security baseline and abnormality determination rules based on the response data of the security response, specifically:

[0044] After a preset time interval, the response data generated in the power Internet of Things security response process is obtained, wherein the response data includes response time, disposal results, and false alarm and missed alarm information;

[0045] ARIMA model is used to perform time series analysis on the response data to obtain response effect evaluation results and key indicator change trends;

[0046] Generate a corresponding evaluation report according to the change trend of the key indicators;

[0047] According to the response effect evaluation result and the change trend of the key indicators, the security baseline is updated by an online gradient descent method, and the threshold parameters in the security baseline are dynamically adjusted;

[0048] Based on the updated security baseline, a decision tree algorithm is used to update the abnormality determination rule.

[0049] The embodiment of the present application provides a method for dynamically updating a security baseline and anomaly determination rules. After a security response is performed, the response data in the security response process is obtained for time series analysis to obtain response effect evaluation results and key indicator change trends. The security baseline can then be further dynamically adjusted based on the response effect evaluation results and key indicator change trends. At the same time, the adjusted security baseline is combined with a decision tree algorithm, and the corresponding anomaly determination rules are updated. The embodiment of the present application achieves continuous improvement of the security response mechanism through regular evaluation and automated adjustment, thereby improving the security of the operation of IoT terminals.

[0050] In the second aspect, accordingly, the embodiment of the present application provides a power Internet of Things security response system based on risk assessment, including an acquisition module, a data processing module, a threat scenario identification module, a correlation analysis module, a link analysis module, an abnormal behavior judgment module and a security response module;

[0051] Wherein, the acquisition module is used to acquire heterogeneous security data sets;

[0052] The data processing module is used to process the heterogeneous security data set based on preset data processing rules to obtain a standardized data set;

[0053] The threat scenario identification module is used to perform pattern matching on the standardized data set according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario;

[0054] The association analysis module is used to perform a time-series association analysis on the threat scenario according to a preset association map if there is a potential threat scenario, and obtain an association analysis result, wherein the association map is constructed by the Internet of Things device and the corresponding network data;

[0055] The link analysis module is used to perform link analysis on the correlation analysis results to obtain key attack paths;

[0056] The abnormal behavior judgment module is used to input the key attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, wherein the abnormal behavior classification model is constructed based on a random forest algorithm;

[0057] The security response module is used to perform a security response based on preset response measures if it is determined that abnormal behavior exists.

[0058] In a possible implementation, the data processing module includes a parsing unit, a relationship graph construction unit, a semantic annotation unit, a standardization processing unit, and a data fusion unit;

[0059] The parsing unit is used to parse the data format of the heterogeneous security data set using a parsing operator to obtain a first structured data set, wherein the first structured data set includes the Internet of Things terminal access behavior data;

[0060] The relationship map construction unit is used to perform association analysis on each data in the first structured data set to construct a corresponding data relationship map;

[0061] The semantic annotation unit is used to perform semantic analysis on the data relationship graph using a label operator, extract corresponding keywords and entities, and perform semantic annotation on each data in the first structured data set in combination with a preset ontology library and knowledge graph to obtain a second structured data set with semantic annotations;

[0062] The standardization processing unit is used to perform ETL standardization processing on the second structured data set according to a preset standardization template, convert the heterogeneous data in the second structured data set into a preset format in the standardization template, and obtain a formatted data set;

[0063] The data fusion unit is used to perform data fusion on multi-source heterogeneous data in the formatted data set, merge information of the same entity, and obtain the standardized data set. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] Figure 1 : A flow chart of a risk assessment-based power Internet of Things security response method provided in an embodiment of the present application.

[0065] Figure 2 : A flowchart of data processing in a risk assessment-based power Internet of Things security response method provided in an embodiment of the present application.

[0066] Figure 3 : A flow chart of correlation analysis in a risk assessment-based power Internet of Things security response method provided in an embodiment of the present application.

[0067] Figure 4 : A flow chart of establishing a risk assessment model in a risk assessment-based power Internet of Things security response method provided in an embodiment of the present application.

[0068] Figure 5 : A structural diagram of a risk assessment-based power Internet of Things security response system provided in an embodiment of the present application.

[0069] Figure 6 : A structural diagram of a data processing module of a risk assessment-based power Internet of Things security response system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0071] It should be noted that the step numbers in the text are only for the convenience of explanation of the specific embodiments and do not serve to limit the order in which the steps are executed. In the description of this application, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0072] Embodiment 1:

[0073] like Figure 1 As shown, embodiment 1 provides a power Internet of Things security response method based on risk assessment, including steps S1-S7:

[0074] S1, obtain heterogeneous security datasets;

[0075] S2. Processing the heterogeneous security data set based on preset data processing rules to obtain a standardized data set;

[0076] S3. Perform pattern matching on the standardized data set according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario;

[0077] S4. If there is a potential threat scenario, a time series correlation analysis is performed on the threat scenario according to a preset correlation map to obtain a correlation analysis result, wherein the correlation map is constructed by the IoT device and the corresponding network data;

[0078] S5. Perform link analysis on the correlation analysis results to obtain key attack paths;

[0079] S6. Inputting the key attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, wherein the abnormal behavior classification model is constructed based on a random forest algorithm;

[0080] Step S7: If it is determined that abnormal behavior exists, a security response is performed based on a preset response measure.

[0081] The embodiment of the present application provides a risk assessment-based power Internet of Things security response method, which realizes effective identification of abnormal behaviors and timely responses based on the processing and analysis of heterogeneous security data sets, and effectively improves the security of the operation of Internet of Things terminals. Among them, the heterogeneous security data sets are first processed to provide high-quality basic data for the subsequent identification of abnormal behaviors. Then, the embodiment of the present application designs two risk assessments to ensure the accuracy of the security response. Among them, the ATT&CK causal relationship analysis method is used to identify whether there are potential threat scenarios for the Internet of Things terminal. When it is confirmed that there are potential threat scenarios, the key attack paths are further extracted from the threat scenarios, and the abnormal behaviors are identified in combination with the Internet of Things terminal access behavior data. By combining the dual identification of threat scenarios and abnormal behaviors, the ability of the Internet of Things terminal to capture risks and the speed of security response are improved, thereby effectively improving the security of the operation of the Internet of Things terminal.

[0082] In a possible implementation, in step S2, the heterogeneous security data set is processed based on a preset data processing rule to obtain a standardized data set, such as Figure 2 As shown, steps S201-S205 are included:

[0083] S201, using a parsing operator to perform data format parsing on the heterogeneous security data set to obtain a first structured data set, wherein the first structured data set includes the IoT terminal access behavior data;

[0084] S202, performing association analysis on each data in the first structured data set to construct a corresponding data relationship map;

[0085] S203, using a label operator to perform semantic analysis on the data relationship graph, extracting corresponding keywords and entities, and semantically annotating each data in the first structured data set in combination with a preset ontology library and knowledge graph to obtain a second structured data set with semantic annotations;

[0086] S204, performing ETL standardization processing on the second structured data set according to a preset standardization template, converting the heterogeneous data in the second structured data set into a preset format in the standardization template, and obtaining a formatted data set;

[0087] S205: Perform data fusion on the multi-source heterogeneous data in the formatted data set, merge the information of the same entity, and obtain the standardized data set.

[0088] The embodiment of the present application provides a data processing method, through data format analysis, semantic annotation, ETL standardization processing and multi-source heterogeneous data fusion and other operations, so that the standardized data set after data processing has obvious semantic features and a standardized format suitable for analysis and identification. Through data format analysis, heterogeneous data can be converted into structured data, and preliminary structured data content can be obtained, providing a data basis for a series of subsequent operations. Then, through the association analysis operation, the logical relationship between each data can be captured from the huge first structured data set, and then a relationship map that can represent the logical relationship of each data can be constructed. The relationship map has a form and content connection with the preset ontology library and knowledge map, so it can be retrieved in the ontology library and knowledge map based on the keywords and entities in the relationship map, so as to extract the corresponding ontology concepts, and semantically annotate each data in the first structured data set according to the ontology concept. The data with semantic annotations can make the subsequent risk assessment more accurate. Finally, through standardization processing and data fusion, the second structured data set with semantic annotations is further processed, so that the final standardized data set conforms to the preset normalized data structure, which is convenient for the identification and processing of subsequent models.

[0089] In a preferred embodiment, in steps S201-S202, network logs, system logs, and application logs are obtained according to heterogeneous security data types, and the heterogeneous security data is converted into first structured data including timestamp, source IP, destination IP, and protocol type through a hierarchical data access architecture composed of a data acquisition layer, a data cleaning layer, and a data standardization layer. The first structured data is subjected to a time series association analysis to construct a data relationship graph, wherein the nodes of the data relationship graph represent data entities, the edges represent the associations between entities, and the edge weights are calculated by the Jaccard coefficient. The data relationship graph is processed using a data preprocessing method, wherein for the access behavior data of the Internet of Things terminal, the device type, communication frequency, and data transmission volume characteristics corresponding to the access behavior data of the Internet of Things terminal are extracted. Furthermore, Graph Convolutional Network can be used to perform anomaly detection on the access behavior data of the Internet of Things terminal, and the abnormal access pattern is obtained by node feature extraction and edge feature aggregation. The danger level of the abnormal access behavior is determined according to a predefined security policy rule base, and the danger level is determined by the duration, impact range, and violation degree of the abnormal behavior.

[0090] Specifically, the accessed heterogeneous security data types are divided into different categories such as network logs, system logs, and application logs. The corresponding parsing operators are used to perform format parsing and field extraction for each type of data. The original data is converted into the first structured data containing fields such as timestamp, source IP, destination IP, and protocol type through the hierarchical data access architecture composed of data collection layer, data cleaning layer, and data standardization layer, which contains the access behavior data of the Internet of Things terminal. The data content of the first structured data is subjected to time series association analysis to identify the logical dependencies between data items, and a data relationship graph reflecting the interaction between entities is constructed. The graph nodes represent data entities, the edges represent the associations between entities, and the edge weights use the Jaccard coefficient to calculate the association strength. The constructed data relationship graph is subjected to data preprocessing, including data cleaning, missing value interpolation, and outlier processing. For the access behavior data of the Internet of Things terminal, considering the characteristics of limited device resources and fixed communication mode, the device type, communication frequency, data transmission volume and other features are extracted. Based on the preprocessed data, the Graph Convolutional Network is used to perform anomaly detection on the access behavior data of the Internet of Things terminal, and the abnormal access mode is captured through node feature extraction and edge feature aggregation, so as to identify potential security threats. For the detected abnormal access behavior, combined with the pre-defined security policy rule base, the danger level of the abnormal behavior is quantitatively evaluated. The evaluation indicators include the duration of the abnormal behavior, the scope of impact, the degree of violation, etc., and a security event description containing elements such as the abnormal type, degree of danger, and scope of impact is generated to provide a decision-making basis for subsequent security disposal.

[0091] In the process of heterogeneous secure data access, network logs use regular expressions to parse IP addresses and port information, system logs use delimiters to extract process IDs and operation types, and application logs use JSON parsers to extract user behavior data. In the hierarchical data access architecture, the data collection layer uses Flume Agent to collect distributed logs, the data cleaning layer uses MapReduce to filter invalid fields, and the data standardization layer converts timestamps to UTC format. The structured data contains fields such as {timestamp: "2024-09-0410:15:30", source IP: "192.168.1.100", destination IP: "10.0.0.1", protocol type: "TCP"}. Time series correlation analysis uses sliding time window technology with a window size of 5 minutes to identify the behavior pattern of continuous access to the same target IP. In the construction of the data relationship graph, nodes represent IP addresses, edges represent communication relationships, and edge weights are calculated using the Jaccard coefficient, such as the number of common target addresses of two IP addresses divided by the total number of target addresses. In the data preprocessing stage, linear interpolation is performed on missing timestamps, and the Z-score method is used for outlier detection, with a threshold of 3. For IoT terminals, features such as device type (such as temperature sensor, camera), communication frequency (average number of requests per hour), and data transmission volume (average number of bytes per communication) are extracted. The Graph Convolutional Network uses a two-layer convolutional structure with a hidden layer dimension of 64, an activation function of ReLU, a learning rate of 0.001, and 100 training rounds. The anomaly detection result includes an anomaly score, and scores above 0.8 are marked as potential threats. The security policy rule base contains predefined rules such as {Rule ID: "R001", Description: "Frequent access to sensitive servers", Threshold: "10 times / minute"}. The quantitative assessment of the danger level takes into account the duration of the anomaly (unit: minutes), the scope of impact (the number of affected IP addresses), and the degree of violation (the number of standard deviations exceeding normal behavior), and a comprehensive calculation is performed to obtain a danger score of 0-100. The generated security event description format is {Event ID: "E20240904001", Abnormal Type: "Abnormal Access Mode", Danger Level: 85, Impact Scope: "3 Subnets"}, which provides a basis for the security team to handle the situation.

[0092] In a preferred embodiment, in step S203, the connection relationship and weight information of the nodes in the data relationship graph are received; based on the connection relationship and weight information, the nodes are clustered using a label propagation algorithm to obtain node clusters with similar semantic features; and keywords and entities are extracted from the node clusters. Time series behavior records are obtained, and the time series behavior records are modeled using a long short-term memory network, and the time dependency is captured through the hidden layer state; the self-attention mechanism is combined to identify important time points and corresponding behavior features. Domain concepts and relationship definitions in a pre-built ontology library are obtained; word vectors of keywords and entities are calculated using TF-IDF; the semantic similarity between the word vector and the ontology concept is calculated using cosine similarity; and the ontology concept with the highest semantic similarity is selected as the annotation. Furthermore, the knowledge graph can be supplemented and optimized based on semantic annotation to achieve dynamic updating of the knowledge graph. According to semantic annotation, entity linking and relationship reasoning are performed in the knowledge graph; implicit relationships between entities are supplemented; and low-dimensional vector representations of entities and relationships are generated using the TransE algorithm. Determine whether the low-dimensional vector representation meets a preset threshold; if the low-dimensional vector representation meets the preset threshold, determine that the low-dimensional vector representation is a data representation with rich semantic information; if the low-dimensional vector representation does not meet the preset threshold, optimize the low-dimensional vector representation.

[0093] Specifically, according to the connection relationship and weight between nodes in the data relationship graph, the label propagation algorithm is used to cluster the nodes to obtain node clusters with similar semantic features, from which keywords and entities are extracted. In this process, the part-of-speech tagging operator is used to preprocess the node labels to improve the accuracy of clustering and extraction. For the time series behavior records, the long short-term memory network is used to model the behavior sequence, and the time dependency is captured through the hidden state. The self-attention mechanism is combined to identify the important time points and corresponding behavior features. The time label operator is used to annotate the behavior sequence in the time dimension to enhance the expression ability of the time series features. The domain concepts and relationship definitions are obtained from the pre-built ontology library, the word vectors are calculated using TF-IDF, and the semantic similarity between the extracted keywords, entities and ontology concepts is calculated by cosine similarity, and the ontology concept with the highest similarity is selected as the annotation. In this step, the time series behavior features are integrated, and the semantic role annotation operator is used to analyze the semantic roles of keywords and entities to improve the accuracy and context relevance of semantic annotation. Based on the annotated semantic information, entity linking and relational reasoning are performed in the knowledge graph to supplement the implicit relations between entities. The low-dimensional vector representation of entities and relations is generated by the TransE algorithm to obtain data representation with rich semantic information. The relational label operator is used to annotate the relations between entities to enhance the semantic expression ability of the knowledge graph. In the data relational graph processing, the part-of-speech tagging operator is first applied to the graph structure containing 10,000 nodes and 50,000 edges to convert the node labels into part-of-speech sequences. Subsequently, the label propagation algorithm is used for node clustering, with the number of iterations set to 50 and the convergence threshold set to 0.001, and finally 100 semantically similar node clusters are obtained. The five words with the highest TF-IDF value are extracted from each cluster as keywords, and entities such as names of people, places, and organizations are identified. In the analysis of time series behavior records, the time label operator is applied to the behavior sequence with a length of 1000 to convert the time information into a standardized timestamp. The model was built using a long short-term memory network, with the number of hidden units set to 128 and the input dimension set to 50, including behavioral features and time features, and a 4-layer network structure was used to capture time dependencies. In the self-attention mechanism, the number of attention heads was set to 8, and the attention field of view was 30 time steps, identifying 164 important time points and their corresponding behavioral features. In the semantic annotation process, the ontology library contained 5,000 concepts and 10,000 relationship definitions. The word vector was calculated using the TF-IDF algorithm, with a vector dimension of 300. Through cosine similarity calculation, the top three ontology concepts with the highest similarity were selected as candidate annotations for each keyword and entity. The semantic role annotation operator analyzed the sentence structure and identified roles such as actions, agents, and recipients, improving the accuracy of semantic annotation by 20%. In the knowledge graph processing stage, entity linking was performed in a graph containing 1 million entities and 5 million relationships, with a link accuracy of 85%. Relational reasoning supplemented 200,000 implicit relationships.The TransE algorithm is used to generate 200-dimensional vector representations of entities and relationships, with 1000 training rounds and a learning rate of 0.01. The relationship labeling operator classifies the supplementary relationships, including temporal relationships, spatial relationships, causal relationships, etc., which enhances the semantic expression ability of the knowledge graph and achieves a relationship classification accuracy of 78%. The resulting data representation contains rich semantic information, with an average of 50 attributes and 30 relationships associated with each entity.

[0094] In a preferred embodiment, in step S204, a preset standardized template is obtained, wherein the standardized template defines a unified data field and measurement unit; the second structured data is formatted according to the standardized template to obtain data in a standard format; a mapping rule matching the data in the standard format is obtained from a pre-established mapping rule library; the data in the standard format is converted using the mapping rule to obtain a normalized data structure that conforms to a predefined pattern; the normalized data structure is subjected to ETL normalization processing to obtain formatted data. In addition, a statistical anomaly detection method can be used to analyze the formatted data to identify abnormal values, missing values, and duplicate data; if abnormal data is identified, the abnormal data is processed.

[0095] Specifically, according to the security baseline of IoT terminals, a parsing rule base for heterogeneous security data is constructed, and corresponding structured solutions are formulated for different types of data sources. Key information and semantic tags are identified from the second structured data through regular expression matching and named entity recognition technology. In this process, the security baseline is used to define the key fields that need to be extracted to ensure that data parsing meets security requirements. Design standardized templates, define unified data fields, measurement units and representation methods, use Python's data type conversion function to convert the format of the extracted fields, unify the timestamp to UTC format, and unify the numerical units to the international system of units. Set data validation rules according to the security baseline and perform compliance checks on the converted data. Establish mapping rules from heterogeneous data to standard formats, use lookup tables or rule engines to automatically generate data conversion paths, and use the Word2Vec model to calculate semantic similarity for complex semantic conversions, and select the most matching standard expression. Incorporate security baseline requirements into mapping rules to ensure security during data conversion. Implement ETL standardization, use Apache Spark to improve data processing efficiency, identify and process outliers, missing values ​​and duplicate data through statistical anomaly detection methods, perform data compliance checks based on security baselines, and ultimately generate formatted data that conforms to predefined patterns.

[0096] During the implementation process, we first built a parsing rule base containing 500 rules based on the IoT terminal security baseline, covering 10 common data source types. Regular expression matching was used to extract structured information such as IP addresses, timestamps, and device IDs, with an accuracy of 95%. Named entity recognition uses a BiLSTM-CRF-based model to identify entities such as device names, operation types, and security events, with an F1 score of 0.92. The security baseline defines 50 key fields to ensure that data parsing meets security requirements. The standardized template contains 100 unified fields, and Python's datetime library is used to convert timestamps of different formats to UTC format. Unit conversion uses a unit conversion dictionary, covering 95% of common units. The data validation rules include 200 logical checks to verify the compliance of the converted data, with a pass rate of 98%. The mapping rules use a lookup table of 100,000 rules, covering 90% of the conversion scenarios. For complex semantic conversion, the Word2Vec model training corpus contains 1 million domain-related texts, with a word vector dimension of 300, and selects the standard expression with the highest cosine similarity. Security baseline requirements are integrated into mapping rules to ensure data desensitization and access control. ETL processing uses an Apache Spark cluster with 20 nodes, which increases data processing speed by 5 times. Anomaly detection uses the Z-score method, sets the threshold to 3 standard deviations, and identifies 2% of abnormal data. Missing value processing uses mean filling, and duplicate data is deduplicated through MD5 hashing. The final normalized data structure contains 200 fields with a compliance rate of 99.5%, providing a high-quality data foundation for subsequent analysis.

[0097] In a preferred embodiment, in step S205, a formatted data set is obtained, and each data field in the formatted data set is scored according to preset completeness, consistency, and accuracy scoring standards to obtain a data field scoring result. If the data field scoring result is lower than the preset threshold, the data field is processed by the mean filling and median filling methods to obtain a processed data field. For multi-source heterogeneous data, data format unification processing is performed to obtain data in a unified format through data format unification processing. A feature-based entity matching algorithm is applied to the data in the unified format, and duplicate data is identified and deleted through a hash algorithm to obtain deduplicated data; an entity linking method based on a probability model is used to match and merge the same entities from different sources in the deduplicated data to obtain a fused data set. A rule-based conflict identification method is applied to the fused data set to identify data contradictions in the fused data set; based on a pre-established timestamp and credibility strategy, the optimal data is selected from the data contradictions to generate a standardized data set.

[0098] Specifically, a rule-based scoring system is used to conduct a comprehensive check on the formatted data set. By setting scoring standards in three dimensions: completeness, consistency, and accuracy, each data field is scored. Considering the characteristics of different data sources, if the score is lower than the preset threshold, the field is marked. According to the marking results, the data that does not meet the quality requirements is processed using methods such as mean filling and median filling, including missing value filling, outlier correction, and format unification. For data that cannot be corrected, it is eliminated through data filters. For multi-source heterogeneous data, data format unification and field mapping are performed, and data type conversion is performed to prepare for subsequent fusion. The feature-based entity matching algorithm is used for data integration. First, the hash algorithm is used to identify and delete duplicate data, and then the entity linking method based on the probability model is used to match and merge the same entities from different sources, and to process entity representations in different formats. The rule-based conflict identification method is applied to the fused data set to identify and resolve conflicts between data, including resolving semantic conflicts between different data sources, and using a strategy based on timestamps and credibility to select the optimal data, and finally generate a fused standardized data set.

[0099] During the implementation process, we first used a rule-based scoring system to check the data quality, set scoring standards for completeness, consistency, and accuracy, and set the weights of each dimension to 0.4, 0.3, and 0.3 respectively. We scored 50 fields of 100,000 data records, and marked them as pending if the total score was less than 80 points. We adjusted the scoring rules according to the characteristics of different data sources, such as adding continuity scores to time series data sources. We cleaned the marked data, used mean filling to handle 15% of missing values, and median filling to handle 10% of outliers, and unified 95% of the date formats to the ISO 8601 standard. We identified outliers using the z-score method, set the threshold to 3 standard deviations, and eliminated 2% of extreme outlier data. We preprocessed multi-source heterogeneous data, converted 5 different formats of data into JSON format, performed field mapping, and solved 80% of the field naming inconsistencies. We used a feature-based entity matching algorithm to extract 10 key features of the entity, set the similarity threshold to 0.85, and successfully matched 92% of the entities. The entity linking method based on conditional random fields was used to train the model using 1 million annotated data, and the F1 score reached 0.88. 3% of duplicate data was removed by the MD5 hash algorithm. Finally, a conflict identification method containing 50 rules was applied to resolve 15% of data contradictions, including 10% of cross-source semantic conflicts. The strategy of timestamp priority and source credibility weighting was used to select the optimal data and generate the final standardized data set, which improved the data quality by 25% and achieved a fusion accuracy of 97%.

[0100] In a possible implementation, in step S3, pattern matching is performed on the standardized data set according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario, including:

[0101] Performing timestamp normalization processing on the standardized data set to obtain a standardized data set with a timestamp;

[0102] Using a sliding time window to perform time series segmentation on the standardized data set with timestamps to obtain a data subset after time series segmentation;

[0103] According to a preset threat scenario template library, pattern matching is performed on the data subset to confirm whether there is a potential threat scenario by identifying potential attack tactics and techniques.

[0104] In an embodiment of the present application, by performing time series segmentation on the standardized data set, each time window in the standardized data set is classified, and then the data in each time window can be identified separately by pattern matching, thereby improving the accuracy and rationality of threat scenario identification.

[0105] In an embodiment of the present application, by performing time series segmentation on the standardized data set, each time window in the standardized data set is classified, and then the data in each time window can be identified separately by pattern matching, thereby improving the accuracy and rationality of threat scenario identification.

[0106] Furthermore, in step S4, performing a temporal correlation analysis on the threat scenario according to a preset correlation map to obtain a correlation analysis result includes:

[0107] Using the PrefixSpan algorithm to perform temporal correlation analysis on the threat scenario according to the correlation graph, and extracting several frequently occurring event sequences;

[0108] According to the sequence of events, combined with the interaction mode between the devices and the preset tactical sequence, a complete attack behavior chain is determined;

[0109] According to the attack behavior chain, the final correlation analysis result is determined.

[0110] In the embodiment of the present application, the PrefixSpan algorithm is applied to perform time series association analysis. The advantage of the PrefixSpan algorithm is that it can handle the orderliness in sequence data. Compared with association rule mining, sequence pattern mining can mine deeper knowledge, capture a more complete chain of attack behaviors, and provide precise guidance for subsequent threat responses.

[0111] In a preferred embodiment, Figure 3As shown, in steps S3-S4, the fused standardized data set is obtained, the standardized data set is timestamped and normalized, and the standardized data set is segmented using a sliding time window to obtain a data subset after time series segmentation. According to the pre-established threat scenario template library, the data subset is pattern matched to identify potential attack tactics and techniques, and a preliminary threat scenario hypothesis is formed. A correlation map of IoT devices and network data is constructed, in which nodes represent devices and network entities, and edges represent interactive relationships. If a threat scenario is identified, the PrefixSpan algorithm is applied to perform time series correlation analysis on the threat scenario to extract frequently occurring event sequences. According to the event sequence, combined with the interaction mode between devices and the preset tactical sequence, a complete attack behavior chain is determined. The final correlation analysis result is determined through the attack behavior chain.

[0112] Specifically, the timestamp of the fused standardized data set is normalized, and the data is segmented using a sliding time window with a fixed size of 5 minutes. The window size is dynamically adjusted according to the characteristics of the attack behavior to obtain the data subset after time series segmentation. According to the tactics and techniques in the ATT&CK matrix, a threat scenario template library is constructed, and the data in each time window is matched using regular expression matching or a rule-based matching system to identify potential attack tactics and techniques, form a preliminary threat scenario hypothesis, and preliminarily associate the identified threat scenarios with related IoT devices and network data. The graph database technology is used to construct an association map of IoT devices and network data. The nodes represent devices and network entities, and the edges represent interaction relationships. The depth-first search or breadth-first search algorithm is used to find related entities and events, and the ATT&CK technology is mapped to the corresponding nodes and edges in the association map. The PrefixSpan algorithm is used to perform time series association analysis on the identified threat scenarios, extract frequently occurring event sequences, combine the interaction patterns between devices and the ATT&CK tactical sequence, identify the complete attack behavior chain, and output the final association analysis results.

[0113] During the implementation, the timestamps of the fused dataset containing 1 million records were first standardized to UTC format. A fixed-size sliding time window of 5 minutes was used, sliding every 30 seconds to generate a data subset of 12,000 time windows. A library containing 200 threat scenario templates covering 14 tactical categories was built based on the ATT&CK matrix. A regular expression matching system with 500 rules was used to perform pattern matching on the data in each time window, with an identification rate of 85%. In the initial association process, the identified threat scenarios were associated with 5,000 IoT devices and 10,000 network data records. A correlation map was constructed using the Neo4j graph database, containing 15,000 nodes and 50,000 edges. Nodes represent devices and network entities, and edges represent interactive relationships. A depth-first search algorithm was used with a maximum search depth of 10 to find related entities and events in the graph. On average, each threat scenario was associated with 20 entities. 100 technical points in ATT&CK were mapped to the map, with a coverage rate of 90%. The PrefixSpan algorithm was used for temporal correlation analysis, with the minimum support set to 0.01 and the maximum pattern length set to 10, and 1,000 frequent event sequences were extracted. Combining the interaction patterns between devices and the 12 tactical sequences of ATT&CK, 50 complete attack behavior chains were identified, each chain containing an average of 8 tactical steps, with a correlation accuracy of 92%. The final output of the correlation analysis results contains detailed attack paths, the devices and network entities involved, and the ATT&CK technology corresponding to each step, providing precise guidance for subsequent threat responses.

[0114] Furthermore, in step S5, link analysis is performed on the association analysis result to obtain a key attack path, including:

[0115] Using a depth-first search algorithm to perform link analysis on the association analysis results to obtain an attack path graph, wherein the attack path graph includes nodes representing attack steps and edges representing attack transfer relationships;

[0116] According to the attack path diagram, the key attack path is obtained by calculating through the Dijkstra algorithm.

[0117] In an embodiment of the present application, a depth-first search algorithm and a Dijkstra algorithm are used to further extract key attack paths from the association analysis results. The key attack paths can intuitively display the attack status of each terminal device and improve the accuracy of subsequent abnormal behavior identification.

[0118] In a possible implementation, in step S6, inputting the critical attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model so that the abnormal behavior classification model determines whether there is abnormal behavior, including:

[0119] Extracting behavior features from the IoT terminal access behavior data;

[0120] Comparing the behavior characteristics with a preset safety baseline, and calculating the deviation of the behavior characteristics;

[0121] The key attack path and the deviation are input into the abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior based on a preset abnormality determination rule.

[0122] The embodiment of the present application provides a method for identifying abnormal behavior. First, the access behavior data of the Internet of Things terminal is analyzed. By extracting the behavior features from the access behavior data of the Internet of Things terminal and comparing them with the preset security baseline, the deviation of the behavior features can be obtained. Then, combined with the key attack path determined in the previous step, it is comprehensively judged whether each terminal device has abnormal behavior from the two aspects of the degree of deviation of the behavior features and whether it is in the key attack path. Since the above-mentioned abnormal identification process is a process of making decisions after multiple judgments, and the random forest algorithm based on the decision tree is very suitable for the above-mentioned process, the present application uses the abnormal behavior classification model obtained by constructing the random forest algorithm to perform the above-mentioned abnormal identification process, and inputs the key attack path and the deviation into the trained abnormal behavior classification model, so that it can judge whether each terminal device has abnormal behavior.

[0123] Furthermore, in step S7, performing a security response based on a preset response measure includes:

[0124] Send structured alarm information to the security management platform;

[0125] Call network device interfaces to implement access control based on source IP and destination port;

[0126] Send an offline instruction including the device identification and offline reason to the terminal management system.

[0127] In a preferred embodiment, in steps S5-S7, the association analysis results are obtained, and the link analysis is performed using a depth-first search algorithm to obtain an attack path diagram, wherein the attack path diagram includes nodes representing attack steps and edges representing attack transfer relationships; based on the attack path diagram, the key attack path is calculated using the Dijkstra algorithm, and the key attack path is associated with the IoT terminal behavior data for analysis, wherein the IoT terminal behavior data includes access frequency, data traffic, and protocol type; behavioral features are extracted from the IoT terminal behavior data, and the behavioral features are compared with a predefined security baseline to determine the deviation of the behavioral features, and the security baseline is used to determine the deviation of the behavioral features. The full baseline includes the upper limit of access frequency, traffic threshold, and allowed protocol list; the random forest algorithm is used to construct abnormal behavior judgment rules, and the deviation degree and link characteristics of the key attack path are used as input features, combined with historical abnormal samples for training, to obtain an abnormal behavior classification model; if the abnormal behavior classification model determines that abnormal behavior exists, predefined response measures are triggered, and the predefined response measures include: sending structured alarm information to the security management platform, the structured alarm information includes device ID, abnormality type, and severity; calling the network device interface to implement access control based on source IP and target port; sending instructions containing device identification and offline reasons to the terminal management system.

[0128] Specifically, the depth-first search algorithm is used to perform link analysis on the association analysis results to construct an attack path graph. The nodes represent the attack steps and the edges represent the attack transfer relationship. The key attack path is calculated by the Dijkstra algorithm, and the attack path is associated with the behavior of the IoT terminal to identify high-risk terminals. The access behavior data of the IoT terminal is extracted, including features such as access frequency, data traffic, and protocol type. The data is compared with the pre-defined security baseline to calculate the deviation of the behavior characteristics. The security baseline includes specific indicators such as the access frequency upper limit, traffic threshold, and allowed protocol list. The abnormal behavior judgment rules are constructed based on the random forest algorithm. The deviation and link characteristics are used as input features. The training is combined with historical abnormal samples to obtain an abnormal behavior classification model. According to the abnormal behavior judgment results, the corresponding pre-defined response measures are triggered, including sending structured alarm information to the security management platform, including device ID, abnormal type, and severity, calling the network device interface to implement access control based on the source IP and target port, and sending instructions containing device identification and offline reasons to the terminal management system to achieve multi-level security protection. In actual application, we first perform a depth-first search on the attack path graph containing 10,000 nodes and 50,000 edges, with the search depth set to 20, and identify 100 potential attack paths. Then, we use the Dijkstra algorithm, set the node weight to the attack complexity, 1-10 points, and the edge weight to the attack success rate, between 0-1, to calculate 10 key attack paths. We associate these paths with the behavioral data of 5,000 IoT terminals and find 50 high-risk terminals. We extract access behavior data within 30 days for these terminals, including the average access frequency per hour, daily data traffic, and the type of protocol used. The security baseline is set to an upper limit of 100 access frequency / hour, a traffic threshold of 1GB / day, and the allowed protocols are HTTP, MQTT, and CoAP. When calculating the deviation, we use the Z-score method to mark behaviors exceeding 3 standard deviations as abnormal. The random forest algorithm is used to build an abnormal behavior judgment model. The input features include deviation and path features, such as path length, average node weight, etc. 10,000 historical samples are used for training, 100 decision trees are set, and the maximum depth is 10. The model achieves 95% accuracy on the test set. According to the judgment results, an alarm message in JSON format is sent to the security management platform, including {device ID, abnormality type, severity (level 1-5)}. For abnormalities with a severity greater than 3, the network device API is called to implement access control and a 5-minute ban time is set. At the same time, an offline instruction is sent to the terminal management system in the format of {device identification, offline reason code, timestamp}. The entire response process takes no more than 30 seconds on average, effectively reducing security risks.

[0129] In a possible implementation, the power Internet of Things security response method further includes regularly dynamically updating the security baseline and abnormality determination rules based on the response data of the security response, specifically:

[0130] After a preset time interval, the response data generated in the power Internet of Things security response process is obtained, wherein the response data includes response time, disposal results, and false alarm and missed alarm information;

[0131] ARIMA model is used to perform time series analysis on the response data to obtain response effect evaluation results and key indicator change trends;

[0132] Generate a corresponding evaluation report according to the change trend of the key indicators;

[0133] According to the response effect evaluation result and the change trend of the key indicators, the security baseline is updated by an online gradient descent method, and the threshold parameters in the security baseline are dynamically adjusted;

[0134] Based on the updated security baseline, a decision tree algorithm is used to update the abnormality determination rule.

[0135] The embodiment of the present application provides a method for dynamically updating a security baseline and anomaly determination rules. After a security response is performed, the response data in the security response process is obtained for time series analysis to obtain response effect evaluation results and key indicator change trends. The security baseline can then be further dynamically adjusted based on the response effect evaluation results and key indicator change trends. At the same time, the adjusted security baseline is combined with a decision tree algorithm, and the corresponding anomaly determination rules are updated. The embodiment of the present application achieves continuous improvement of the security response mechanism through regular evaluation and automated adjustment, thereby improving the security of the operation of IoT terminals.

[0136] In a preferred embodiment, response data of IoT terminal security events are obtained, and the response data includes response time, disposal results, and false positive and false negative information. ARIMA model is used to perform time series analysis based on the response data to obtain response effect evaluation results and key indicator change trends. The response effect evaluation results are used to update the security baseline through the online gradient descent method, and the threshold parameters are dynamically adjusted. The decision tree algorithm is used to process the security baseline. If the preset accuracy threshold is reached, the optimized anomaly determination rule is output. An adaptive security management mechanism is constructed based on the optimized anomaly determination rules, and the adaptive security management mechanism achieves continuous improvement through regular evaluation and automated adjustment.

[0137] Specifically, the response data of IoT terminal security incidents, including response time, disposal results, and false positives and negatives, are collected. The ARIMA model is used for time series analysis to evaluate the response effect, calculate the trend of key indicators, and automatically generate an evaluation report every week. According to the response effect evaluation results, the online gradient descent method is used to update the security baseline, dynamically adjust the threshold parameters, and use the decision tree algorithm to optimize the abnormality judgment rules to improve the accuracy and adaptability of the rules. Automatic adjustments are performed once a day. Distributed tracking tools are used to analyze bottlenecks in data parsing and processing processes, identify performance bottlenecks, optimize processing processes through parallel computing and data compression, improve data processing efficiency and real-time performance, and feed back optimization results to the update process of security baselines and judgment rules. A feedback-based adaptive security management mechanism is constructed to integrate the updated security baseline, optimized judgment rules, and improved processing processes into the existing security management system. Continuous improvement and closed-loop management are achieved through regular evaluation and automated adjustment, and a comprehensive performance and security effect evaluation is performed once a month. In actual applications, security incident response data of 5,000 IoT terminals are collected every hour, including indicators such as average response time, disposal success rate, and false alarm rate. The ARIMA (2,1,2) model was used to perform time series analysis and predict trends for the next 24 hours. The model parameters were determined using the maximum likelihood estimation method. The automatically generated weekly evaluation report showed that the response time was reduced from an average of 15 seconds to 10 seconds, and the success rate of handling was increased by 5%. Based on these results, the online gradient descent method with a learning rate of 0.01 was used to adjust the 10 key thresholds in the security baseline every day, such as dynamically adjusting the abnormal traffic threshold from 1GB / day to 1.2GB / day. At the same time, the CART decision tree algorithm was used to optimize the abnormal judgment rules based on 200 features and 100,000 historical records, and the accuracy was improved by 3%. The Jaeger distributed tracing tool was used for performance analysis, and it was found that the data parsing link took up 60% of the processing time. By introducing Apache Spark for parallel computing, the data processing capacity was increased from 10,000 / second to 50,000 / second. The optimized processing flow directly affects the frequency of security baseline updates, which is increased from once a day to once every 4 hours. The adaptive security management mechanism receives optimization results in real time through the RabbitMQ message queue and automatically adjusts the rule weight every 15 minutes. A comprehensive assessment is conducted every month, and the comprehensive score of 6 key indicators is calculated. If it is less than 80 points, the manual intervention process is triggered. The entire closed-loop management process has achieved an automation rate of 95%, significantly improving the efficiency of security management.

[0138] Further, such as Figure 4As shown, according to the types and characteristics of IoT terminals, corresponding security event feature libraries can be established for different types of terminals, and the multi-dimensional characteristics of security events can be extracted and analyzed to obtain security event determination rules for each type of terminal, forming a differentiated set of abnormal determination rules. In the real-time monitoring system, the abnormal determination rule set and historical alarm data are trained and learned to establish a multi-level risk assessment model. According to the type, degree of harm, and frequency of occurrence of security events, alarms are classified and prioritized. By tracking and evaluating the process and effects of security event handling, abnormal determination rules and graded response strategies are dynamically adjusted to continuously optimize security baselines and protective measures. Specifically:

[0139] Obtain the type and feature information of the IoT terminal, use the K-means algorithm to classify the IoT terminal, and obtain multiple terminal categories. According to the terminal category, build a corresponding security event feature library. For the security event feature library, extract the multi-dimensional features of the security event through the LSTM network, and determine the security event judgment rules for each type of terminal. Use the Drools rule engine to integrate the security event judgment rules into a differentiated set of anomaly judgment rules. If real-time monitoring data is received, use Apache Flink to perform streaming processing on the real-time monitoring data, including data cleaning, data conversion and feature extraction. Obtain historical alarm data, and perform data cleaning and standardization on the historical alarm data. Use the random forest algorithm to train a multi-level risk assessment model to determine the classification and priority of the alarm based on the type, degree of harm and frequency of occurrence of the security event.

[0140] During the implementation process, the K-means algorithm is used to classify the terminals according to the types and characteristics of the IoT terminals. A security event feature library is built for each type of terminal. The multi-dimensional features of security events are extracted through the LSTM network to obtain the security event judgment rules for each type of terminal. The Drools rule engine technology is used to integrate the security event judgment rules of different types of terminals into a differentiated set of abnormal judgment rules, and integrated with the real-time monitoring system through the API interface to realize the dynamic loading and execution of rules. Apache Flink is used for streaming data processing to clean, transform and extract features of real-time monitoring data. The historical alarm data is cleaned and standardized, and the random forest algorithm is used to train a multi-level risk assessment model to automatically classify and prioritize alarms according to the type, degree of harm and frequency of occurrence of security events. The ARIMA model is used to perform time series analysis and tracking evaluation of the security incident handling process and effect, and the Q-learning algorithm is used to dynamically adjust the abnormal judgment rules and graded response strategies to continuously optimize the security baseline and protection measures. In actual applications, 10,000 IoT terminals are first classified using the K-means algorithm, with the K value set to 5. After 50 iterations, 5 types of terminals are obtained. For each type of terminal, a security event feature library containing 100 features was built. A 2-layer LSTM network with 128 neurons in each layer was used to extract features of security events. The input window size was set to 30 to obtain the judgment rules for each type of terminal. The Drools rule engine was used to convert the judgment rules of 5 types of terminals into 500 executable rules, which were integrated with the real-time monitoring system through RESTful API. Apache Flink was used to process 10,000 data items per second for streaming, data cleaning and feature extraction. One million historical alarm data items were preprocessed to remove 5% of outliers and standardize features. The random forest algorithm used 100 decision trees with a maximum depth of 10 to train a 5-level alarm classification model with an accuracy of 92%. The ARIMA model parameters were set to (2,1,2), and the security event handling data of the past 30 days was analyzed to predict the trend of the handling effect in the next 7 days. The Q-learning algorithm sets the learning rate α to 0.1 and the discount factor γ to 0.9. Through 10,000 iterations of learning, 30 key rule parameters are dynamically adjusted. The rule set is updated every hour, the average response time is reduced from 15 seconds to 5 seconds, the false alarm rate is reduced by 10%, and the missed alarm rate is reduced by 15%, achieving continuous optimization of security protection measures.

[0141] Embodiment 2:

[0142] like Figure 5As shown, embodiment 2 provides a power Internet of Things security response system based on risk assessment, including an acquisition module 10, a data processing module 20, a threat scenario identification module 30, a correlation analysis module 40, a link analysis module 50, an abnormal behavior judgment module 60 and a security response module 70;

[0143] Wherein, the acquisition module 10 is used to acquire a heterogeneous security data set;

[0144] The data processing module 20 is used to process the heterogeneous security data set based on preset data processing rules to obtain a standardized data set;

[0145] The threat scenario identification module 30 is used to perform pattern matching on the standardized data set according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario;

[0146] The association analysis module 40 is used to perform a time series association analysis on the threat scenario according to a preset association map if there is a potential threat scenario, and obtain an association analysis result, wherein the association map is constructed by the Internet of Things device and the corresponding network data;

[0147] The link analysis module 50 is used to perform link analysis on the correlation analysis results to obtain key attack paths;

[0148] The abnormal behavior judgment module 60 is used to input the key attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, wherein the abnormal behavior classification model is constructed based on a random forest algorithm;

[0149] The security response module 70 is used to perform a security response based on a preset response measure if it is determined that abnormal behavior exists.

[0150] In one possible implementation, Figure 6 As shown, the data processing module includes a parsing unit 201, a relationship graph construction unit 202, a semantic annotation unit 203, a standardization processing unit 204 and a data fusion unit 205;

[0151] The parsing unit 201 is used to parse the data format of the heterogeneous security data set using a parsing operator to obtain a first structured data set, wherein the first structured data set includes the Internet of Things terminal access behavior data;

[0152] The relationship map construction unit 202 is used to perform association analysis on each data in the first structured data set to construct a corresponding data relationship map;

[0153] The semantic annotation unit 203 is used to perform semantic analysis on the data relationship graph using a label operator, extract corresponding keywords and entities, and perform semantic annotation on each data in the first structured data set in combination with a preset ontology library and knowledge graph to obtain a second structured data set with semantic annotations;

[0154] The standardization processing unit 204 is used to perform ETL standardization processing on the second structured data set according to a preset standardization template, convert the heterogeneous data in the second structured data set into a preset format in the standardization template, and obtain a formatted data set;

[0155] The data fusion unit 205 is used to perform data fusion on the multi-source heterogeneous data in the formatted data set, merge the information of the same entity, and obtain the standardized data set.

[0156] In a possible implementation, the threat scenario identification module 30 performs pattern matching on the standardized data set according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario, including:

[0157] Performing timestamp normalization processing on the standardized data set to obtain a standardized data set with a timestamp;

[0158] Using a sliding time window to perform time series segmentation on the standardized data set with timestamps to obtain a data subset after time series segmentation;

[0159] According to a preset threat scenario template library, pattern matching is performed on the data subset to confirm whether there is a potential threat scenario by identifying potential attack tactics and techniques.

[0160] Furthermore, the correlation analysis module 40 performs a temporal correlation analysis on the threat scenario according to a preset correlation map to obtain a correlation analysis result, including:

[0161] Using the PrefixSpan algorithm to perform temporal correlation analysis on the threat scenario according to the correlation graph, and extracting several frequently occurring event sequences;

[0162] According to the sequence of events, combined with the interaction mode between the devices and the preset tactical sequence, a complete attack behavior chain is determined;

[0163] According to the attack behavior chain, the final correlation analysis result is determined.

[0164] Furthermore, the link analysis module 50 performs link analysis on the correlation analysis result to obtain a key attack path, including:

[0165] Using a depth-first search algorithm to perform link analysis on the association analysis results to obtain an attack path graph, wherein the attack path graph includes nodes representing attack steps and edges representing attack transfer relationships;

[0166] According to the attack path diagram, the key attack path is obtained by calculating through the Dijkstra algorithm.

[0167] In a possible implementation, the abnormal behavior judgment module 60 inputs the critical attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, including:

[0168] Extracting behavior features from the IoT terminal access behavior data;

[0169] Comparing the behavior characteristics with a preset safety baseline, and calculating the deviation of the behavior characteristics;

[0170] The key attack path and the deviation are input into the abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior based on a preset abnormality determination rule.

[0171] Furthermore, the security response module 70 performs a security response based on a preset response measure, including:

[0172] Send structured alarm information to the security management platform;

[0173] Call network device interfaces to implement access control based on source IP and destination port;

[0174] Send an offline instruction including the device identification and offline reason to the terminal management system.

[0175] In a possible implementation, the power Internet of Things security response system further includes a dynamic update module, which is used to dynamically update the security baseline and abnormality determination rules according to the response data of the security response on a regular basis, including an acquisition unit, a time series analysis unit, an assessment report generation unit, a security baseline update unit, and an abnormality determination rule update unit;

[0176] The acquisition unit is used to acquire the response data generated in the power Internet of Things security response process after a preset time interval, and the response data includes the response time, the disposal result and the false alarm and missed alarm information;

[0177] The time series analysis unit is used to perform time series analysis based on the response data using an ARIMA model to obtain response effect evaluation results and key indicator change trends;

[0178] The evaluation report generating unit is used to generate a corresponding evaluation report according to the change trend of the key indicator;

[0179] The security baseline updating unit is used to update the security baseline through an online gradient descent method according to the response effect evaluation result and the key indicator change trend, and dynamically adjust the threshold parameters in the security baseline;

[0180] The abnormality determination rule updating unit is used to update the abnormality determination rule by using a decision tree algorithm based on the updated security baseline.

[0181] The embodiment of the present application provides a power Internet of Things security response system based on risk assessment. Based on the processing and analysis of heterogeneous security data sets, it realizes the effective identification of abnormal behaviors and responds in a timely manner, effectively improving the security of the operation of Internet of Things terminals. Among them, firstly, the heterogeneous security data sets are processed to provide high-quality basic data for the subsequent identification of abnormal behaviors. Then, the embodiment of the present application designs two risk assessments to ensure the accuracy of the security response. Among them, the ATT&CK causal relationship analysis method is used to identify whether there are potential threat scenarios for the Internet of Things terminal. When it is confirmed that there are potential threat scenarios, the key attack paths are further extracted from the threat scenarios, and the abnormal behavior is identified in combination with the Internet of Things terminal access behavior data. By combining the dual identification of threat scenarios and abnormal behaviors, the ability of the Internet of Things terminal to capture risks and the speed of security response are improved, thereby effectively improving the security of the operation of the Internet of Things terminal.

[0182] The more detailed working principle and step flow of this embodiment can refer to, but are not limited to, the relevant records of Embodiment 1.

[0183] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A risk assessment-based power Internet of Things security response method, characterized in that: include: Acquire heterogeneous security datasets; Performing data processing on the heterogeneous security data set based on preset data processing rules to obtain a standardized data set; According to the ATT&CK causal analysis method, pattern matching is performed on the standardized data set to identify whether there is a potential threat scenario; If there is a potential threat scenario, a temporal correlation analysis is performed on the threat scenario according to a preset correlation map to obtain a correlation analysis result, wherein the correlation map is constructed by the IoT device and the corresponding network data; Perform link analysis on the correlation analysis results to obtain key attack paths; Inputting the critical attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, wherein the abnormal behavior classification model is constructed based on a random forest algorithm; If abnormal behavior is detected, a security response is performed based on the preset response measures.

2. A risk assessment-based power Internet of Things security response method as claimed in claim 1, characterized in that: The performing data processing on the heterogeneous security data set based on a preset data processing rule to obtain a standardized data set includes: Using a parsing operator to parse the data format of the heterogeneous security data set to obtain a first structured data set, wherein the first structured data set includes the Internet of Things terminal access behavior data; Performing association analysis on each data in the first structured data set to construct a corresponding data relationship map; Using a label operator to perform semantic analysis on the data relationship graph, extracting corresponding keywords and entities, and combining a preset ontology library and knowledge graph to semantically annotate each data in the first structured data set, to obtain a second structured data set with semantic annotations; Performing ETL standardization processing on the second structured data set according to a preset standardization template, converting heterogeneous data in the second structured data set into a preset format in the standardization template, and obtaining a formatted data set; Data fusion is performed on the multi-source heterogeneous data in the formatted data set, and information of the same entity is merged to obtain the standardized data set.

3. A risk assessment-based power Internet of Things security response method as claimed in claim 1, characterized in that: According to the ATT&CK causal relationship analysis method, pattern matching is performed on the standardized data set to identify whether there is a potential threat scenario, including: Performing timestamp normalization processing on the standardized data set to obtain a standardized data set with a timestamp; Using a sliding time window to perform time series segmentation on the standardized data set with timestamps to obtain a data subset after time series segmentation; According to a preset threat scenario template library, pattern matching is performed on the data subset to confirm whether there is a potential threat scenario by identifying potential attack tactics and techniques.

4. A risk assessment-based power Internet of Things security response method as claimed in claim 1, characterized in that: The performing time series correlation analysis on the threat scenario according to the preset correlation map to obtain the correlation analysis result includes: Using the PrefixSpan algorithm to perform temporal correlation analysis on the threat scenario according to the correlation graph, and extracting several frequently occurring event sequences; According to the sequence of events, combined with the interaction mode between the devices and the preset tactical sequence, a complete attack behavior chain is determined; According to the attack behavior chain, the final correlation analysis result is determined.

5. A risk assessment-based power Internet of Things security response method as claimed in claim 1, characterized in that: The link analysis is performed on the correlation analysis results to obtain the key attack path, including: Using a depth-first search algorithm to perform link analysis on the association analysis results to obtain an attack path graph, wherein the attack path graph includes nodes representing attack steps and edges representing attack transfer relationships; According to the attack path diagram, the key attack path is obtained by calculating through the Dijkstra algorithm.

6. A risk assessment-based power Internet of Things security response method as claimed in claim 1, characterized in that: The step of inputting the key attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model so that the abnormal behavior classification model determines whether there is abnormal behavior, including: Extracting behavior features from the IoT terminal access behavior data; Comparing the behavior characteristics with a preset safety baseline, and calculating the deviation of the behavior characteristics; The key attack path and the deviation are input into the abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior based on a preset abnormality determination rule.

7. A risk assessment-based power Internet of Things security response method as claimed in claim 1, characterized in that: The security response based on the preset response measures includes: Send structured alarm information to the security management platform; Call network device interfaces to implement access control based on source IP and destination port; Send an offline instruction including the device identification and offline reason to the terminal management system.

8. The risk assessment-based power Internet of Things security response method according to claim 1, characterized in that: The power Internet of Things security response method also includes regularly updating the security baseline and abnormality determination rules dynamically according to the response data of the security response, specifically: After a preset time interval, the response data generated in the power Internet of Things security response process is obtained, wherein the response data includes response time, disposal results, and false alarm and missed alarm information; ARIMA model is used to perform time series analysis on the response data to obtain response effect evaluation results and key indicator change trends; Generate a corresponding evaluation report according to the change trend of the key indicators; According to the response effect evaluation result and the change trend of the key indicators, the security baseline is updated by an online gradient descent method, and the threshold parameters in the security baseline are dynamically adjusted; Based on the updated security baseline, a decision tree algorithm is used to update the abnormality determination rule.

9. A power Internet of Things security response system based on risk assessment, characterized in that: It includes acquisition module, data processing module, threat scenario identification module, correlation analysis module, link analysis module, abnormal behavior judgment module and security response module; Wherein, the acquisition module is used to acquire heterogeneous security data sets; The data processing module is used to process the heterogeneous security data set based on preset data processing rules to obtain a standardized data set; The threat scenario identification module is used to perform pattern matching on the standardized data set according to the ATT&CK causal relationship analysis method to identify whether there is a potential threat scenario; The association analysis module is used to perform a time-series association analysis on the threat scenario according to a preset association map if there is a potential threat scenario, and obtain an association analysis result, wherein the association map is constructed by the Internet of Things device and the corresponding network data; The link analysis module is used to perform link analysis on the correlation analysis results to obtain key attack paths; The abnormal behavior judgment module is used to input the key attack path and the IoT terminal access behavior data in the standardized data set into a preset abnormal behavior classification model, so that the abnormal behavior classification model determines whether there is abnormal behavior, wherein the abnormal behavior classification model is constructed based on a random forest algorithm; The security response module is used to perform a security response based on preset response measures if it is determined that abnormal behavior exists.

10. A risk assessment-based power Internet of Things security response system as claimed in claim 9, characterized in that: The data processing module includes a parsing unit, a relationship graph construction unit, a semantic annotation unit, a standardization processing unit and a data fusion unit; The parsing unit is used to parse the data format of the heterogeneous security data set using a parsing operator to obtain a first structured data set, wherein the first structured data set includes the Internet of Things terminal access behavior data; The relationship map construction unit is used to perform association analysis on each data in the first structured data set to construct a corresponding data relationship map; The semantic annotation unit is used to perform semantic analysis on the data relationship graph using a label operator, extract corresponding keywords and entities, and perform semantic annotation on each data in the first structured data set in combination with a preset ontology library and knowledge graph to obtain a second structured data set with semantic annotations; The standardization processing unit is used to perform ETL standardization processing on the second structured data set according to a preset standardization template, convert the heterogeneous data in the second structured data set into a preset format in the standardization template, and obtain a formatted data set; The data fusion unit is used to perform data fusion on multi-source heterogeneous data in the formatted data set, merge information of the same entity, and obtain the standardized data set.

Images