Nuclear power network security situation awareness and health degree assessment method and device

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to a nuclear power network security situation awareness and health degree assessment method and device. According to the nuclear power network security situation awareness and health degree assessment method provided by the invention, an intelligent situation awareness platform is constructed by integrating multivariate data fusion, time sequence feature extraction, field matching and association analysis. Compared with a traditional method, the method introduces a self-attention mechanism and a multi-task learning model, so as to improve the precision of feature fusion and event classification. Besides, through an online learning and transfer learning mechanism, the system can continuously optimize an algorithm and adapt to a dynamically changing network environment, so that powerful support is provided for safe operation of a nuclear power network.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and in particular relates to a method and device for nuclear power network security situation awareness and health assessment. Background Art

[0002] With the development of digitalization and networking of nuclear power systems, cybersecurity has become a vital part of nuclear power operations. Nuclear power networks contain a large amount of critical infrastructure and sensitive data, making them high-value targets for potential cyber attacks. Due to the complexity and diversity of nuclear power networks, traditional security monitoring methods are difficult to cope with complex attack patterns and increasing security threats.

[0003] In the field of cybersecurity situational awareness, deep learning models have gradually become a hot topic of research due to their powerful feature extraction and classification capabilities. By modeling large-scale data, deep learning algorithms can extract key features from complex data and then identify potential security threats. However, the data sources of nuclear power networks are diverse and the data features are complex. How to effectively integrate and process these data to improve the accuracy and real-time performance of situational awareness is still a current technical difficulty.

[0004] In order to achieve comprehensive monitoring and intelligent analysis of nuclear power network security, many studies have explored methods of multimodal data fusion and time series feature extraction. However, traditional feature fusion methods often fail to fully capture the correlation between different data sources, resulting in limited accuracy of situational awareness. In addition, in terms of event classification and health assessment, most existing methods rely on manually designed features or simple models, which are difficult to cope with complex network attack scenarios. Summary of the invention

[0005] In order to overcome the problems existing in related technologies, a method and device for nuclear power network security situation awareness and health assessment are provided.

[0006] According to one aspect of an embodiment of the present disclosure, a method for nuclear power network security situation awareness and health assessment is provided, the method comprising:

[0007] Step 101, data collection and data preprocessing, collecting data from multiple sources of the nuclear power system, and standardizing and denoising the collected data;

[0008] Step 102, feature extraction, using a shared encoder to extract features from the preprocessed data, and converting data from different sources into multiple series of low-dimensional feature data;

[0009] Step 103, extracting time series features, using a long short-term memory network, a gated recurrent unit or a time series convolutional network to process multiple series of low-dimensional feature data to obtain multiple series of time series features, where the time series features of each series represent the characteristics of the series type data changing over time;

[0010] Step 104, field matching, constructing a feature matching layer, and using a comparative learning method to perform similarity matching between the fields in the traffic data and the log data, and obtaining the features of the traffic data and the log data whose similarity exceeds a similarity threshold;

[0011] Step 105, correlation analysis, introduces a self-attention mechanism in the feature matching layer, processes traffic data and log data whose feature similarity is higher than a preset threshold, identifies the correlation between network traffic and events in the log, and thus reveals complex attack patterns;

[0012] Step 106, feature fusion, using a self-attention mechanism to perform weighted fusion on the time series features from different data sources to obtain a unified fused time series feature representation;

[0013] Step 107, event classification, using a multi-task learning model to process the fused unified temporal feature representation and classify the attack behavior;

[0014] Step 108, health assessment, performs a health scoring task for the possible attack behaviors obtained through classification, combines the classification results with the network status and historical data, and determines the health score of the current network through an integrated learning model.

[0015] In a possible implementation, the method further includes:

[0016] Step 109, result output, the system displays the classification results and health scores through a visual interface, and provides graphical reports and real-time alerts.

[0017] In a possible implementation, the method further includes:

[0018] Step 110, decision support, based on the health score and classification results, a decision support system is used to provide security strategy recommendations and early warning prompts.

[0019] In a possible implementation, in step 101, the data collected from multiple sources of the nuclear power system include network traffic, probe data, and interface logs.

[0020] In a possible implementation, in step 103, two recursive neural networks, namely a long short-term memory network and a gated recurrent unit, are used to capture long-time span dependencies; and a temporal convolutional network is used to capture local features in a time series through a convolution operation.

[0021] In one possible implementation, in step 106, the self-attention mechanism first performs a weighted operation on the input time series features from different data sources. This weighting is achieved by calculating the similarity or correlation between different features. The weighted features are combined into a fused unified time series feature representation that includes the time series features of the original data and integrates the key correlation information in these features.

[0022] According to another aspect of an embodiment of the present disclosure, a nuclear power network security situation awareness and health assessment device is provided, the device comprising:

[0023] Data collection and data preprocessing module, used to collect data from multiple sources of nuclear power system, and standardize and remove noise from the collected data;

[0024] A feature extraction module is used to extract features from the preprocessed data using a shared encoder, and convert data from different sources into multiple series of low-dimensional feature data;

[0025] A time series feature extraction module is used to process multiple series of low-dimensional feature data using a long short-term memory network, a gated recurrent unit or a time series convolutional network to obtain multiple series of time series features. The time series features of each series represent the characteristics of the series type data changing over time.

[0026] The field matching module is used to construct a feature matching layer, and through a comparative learning device, the fields in the flow data and the log data are matched for similarity, and the features of the flow data and the log data whose similarity exceeds a similarity threshold are obtained;

[0027] The association analysis module is used to introduce the self-attention mechanism in the feature matching layer, process the traffic data and log data whose feature similarity is higher than the preset threshold, identify the association between network traffic and events in the log, and thus reveal complex attack patterns;

[0028] The feature fusion module is used to perform weighted fusion of time series features from different data sources using a self-attention mechanism to obtain a unified fused time series feature representation;

[0029] The event classification module is used to process the fused unified temporal feature representation using a multi-task learning model and classify attack behaviors;

[0030] The health assessment module is used to perform health scoring tasks based on the possible attack behaviors obtained through classification, combine the classification results with the network status and historical data, and determine the health score of the current network through an integrated learning model.

[0031] According to another aspect of an embodiment of the present disclosure, a nuclear power network security situation awareness and health assessment device is provided, the device comprising:

[0032] processor;

[0033] a memory for storing processor-executable instructions;

[0034] Wherein, the processor is configured to execute the above method.

[0035] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0036] The beneficial effects of the present disclosure are: in response to the problems existing in related technologies, the nuclear power network security situation awareness and health assessment method provided by the present disclosure builds an intelligent situation awareness platform by integrating multivariate data fusion, time series feature extraction, field matching and association analysis. Compared with traditional methods, the present disclosure introduces a self-attention mechanism and a multi-task learning model to improve the accuracy of feature fusion and event classification. In addition, through online learning and transfer learning mechanisms, the system can continuously optimize the algorithm and adapt to the dynamically changing network environment, thereby providing strong support for the safe operation of nuclear power networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a nuclear power network security situation awareness and health assessment method shown in an embodiment of the present disclosure.

[0038] Figure 2 It is a block diagram of a nuclear power network security situation awareness and health assessment device shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0039] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0041] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0042] Figure 1 1 is a flow chart of a method for nuclear power network security situation awareness and health assessment shown in an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, etc. The embodiment of the present disclosure does not limit the type of terminal device. Figure 1 As shown, the method includes:

[0043] Step 101, data collection and data preprocessing, collects data from multiple sources of the nuclear power system, and performs standardization and denoising on the collected data, thereby ensuring the consistency of input data and reducing the interference of noise on the model.

[0044] As an example of this embodiment, the data collected from multiple sources of the nuclear power system may include network traffic, probe data, interface logs, etc. These data are of various types and complex in structure. Data preprocessing is to standardize and denoise the collected multimodal data and process missing data, so as to ensure the consistency of input data and reduce the interference of noise on the model.

[0045] Step 102, feature extraction, uses a shared encoder (the shared encoder can be, for example, a convolutional neural network CNN or a multi-layer perceptron MLP) to extract features from the preprocessed data. Data from different sources are converted into multiple series of low-dimensional feature data to facilitate subsequent deep learning model processing.

[0046] Step 103, time series feature extraction, uses a long short-term memory network (LSTM), a gated recurrent unit (GRU) or a temporal convolutional network (TCN) to process multiple series of low-dimensional feature data to obtain multiple series of time series features. The time series features of each series represent the characteristics of the series type data changing over time.

[0047] For example, for network traffic data and log data, after being processed by the time series feature extraction module, these data will generate a series of independent time series feature representations. For example, network traffic data will form a time series feature representing the traffic change rate after time series feature extraction, while log data may form a time series feature of event frequency or abnormal trigger time.

[0048] In network security situation awareness, time series data often carries rich contextual information, such as the changing trend of network traffic, the order of occurrence of log events, etc. In order to make full use of these time dependencies, the present disclosure uses long short-term memory networks, gated recurrent units and temporal convolutional networks to process feature data, thereby capturing the time dependencies in the data, such as the changing trend of network traffic or the event sequence in the log.

[0049] Among them, two recurrent neural networks (RNNs), long short-term memory networks and gated recurrent units, are used to capture long-term dependencies, thereby analyzing features in long time series, such as gradual trends in the network or attack patterns with long durations. The temporal convolutional network is used to capture local features in time series through convolution operations, which can efficiently handle short-term dependencies and feature changes within the time window. Identify abnormal behaviors or rapidly changing event patterns that occur in a short period of time.

[0050] Through the joint application of these models, the present disclosure can extract time series features from the data and capture complex patterns of the data in the time dimension, such as abnormal traffic surges at a specific time point or frequent error events in the log. The extraction of time series features provides the system with a deep insight into the time evolution of data, helping to identify long-term latent threats and short-term attack outbreaks.

[0051] Step 104, field matching, constructs a feature matching layer, and uses a contrastive learning method to perform similarity matching on the fields in the traffic data and the log data to obtain traffic data and log data features whose similarity exceeds a similarity threshold.

[0052] In the present disclosure, contrastive learning can be represented as an unsupervised learning method, which learns effective feature representation by comparing the similarities of different data samples, and is used in network security to match security logs and traffic records from different sources.

[0053] Traffic data provides a key basis for identifying external attack behaviors and abnormal communication patterns. For example, traffic data provides detailed information about network communications, such as the source, destination, transmission protocol, communication time, etc. of data packets. This information can help identify abnormal behaviors in the network, such as unauthorized access, data leakage, etc. Log data records the operating status, error reports, user operations, etc. of the system and applications. This information is crucial to understanding the operational details within the system and can reveal abnormal events or potential threats occurring within the system. Although traffic data and log data come from different sources, they have potential correlations in time dimensions and behavior patterns. For example, abnormal traffic within a specific time period may be associated with specific error events in the system log. Through comparative learning, the present disclosure can capture these hidden correlation features and achieve more accurate threat detection and event correlation analysis.

[0054] Step 105, association analysis, introduces a self-attention mechanism in the feature matching layer, prioritizes the flow data and log data with the highest feature similarity, and ensures the accuracy of the association analysis. The association between network traffic and events in the log is identified, thereby revealing complex attack patterns.

[0055] In the present disclosure, correlation analysis is used to discover correlations between different logs and traffic events, thereby helping to identify complex attack behavior chains.

[0056] Step 106, feature fusion, uses a self-attention mechanism to perform weighted fusion on the time series features from different data sources to obtain a unified fused time series feature representation. This method ensures that the key associations between different modal data are not ignored.

[0057] Before fusion, the time series features from different data sources are independent of each other. Although they represent different data sources, the potential correlation between them may not be fully utilized. In order to better integrate this information, the present disclosure uses a self-attention mechanism to perform weighted fusion on these time series features. The purpose of this process is to associate key information from different sources in a unified feature space and ensure that the features that are most important to the current task (such as anomaly detection) receive higher attention.

[0058] For example, the self-attention mechanism will first perform a weighted operation on the input time series features from different data sources. This weighting is achieved by calculating the similarity or correlation between different features. The weighted features will be combined into a unified time series feature representation, which is richer than a single time series feature and contains potential correlation information between different data sources. The fused unified time series feature representation not only contains the time series features of the original data, but also integrates the key correlation information in these features, which can provide more comprehensive input for subsequent field matching and correlation analysis modules, further improving the overall detection capability and accuracy of the system. In the process of fusion of features, the features from different data sources are first fused.

[0059] Step 107, event classification, uses a multi-task learning model to process the fused unified time series feature representation and classify network security events. The multi-task learning model is based on a deep residual network (ResNet) or a graph neural network (GNN), combined with network topology and traffic patterns, to classify possible attack behaviors.

[0060] In the present disclosure, a graph neural network (GNN) can be represented as a deep learning model that can process graph structured data and is used to model the relationship between nodes in a network, such as device connection topology. Multi-task learning can be represented as learning multiple related tasks simultaneously, so that the model can share information and improve the overall performance of classification and health assessment.

[0061] Step 108, health assessment, performs health scoring tasks for the possible attack behaviors obtained through classification, combines the classification results with the network status and historical data, and determines the health score of the current network through an ensemble learning model. The ensemble learning model integrates the prediction results of multiple models to improve the accuracy and reliability of the score.

[0062] Step 109, result output, the system displays the classification results and health scores through a visual interface, intuitively reflecting the current safety situation of the nuclear power network. Graphical reports and real-time alarms are provided to display complex data and analysis results in a graphical way, helping operation and maintenance personnel to quickly understand the system status and more intuitively understand and respond to safety incidents.

[0063] Step 110, decision support, based on the health score and classification results, the decision support system provides security strategy suggestions and early warning prompts to help decision makers take preventive measures in advance and reduce potential risks. Support operation and maintenance personnel to make accurate security decisions based on real-time data and historical trends.

[0064] The decision support system (DSS) uses big data analysis and machine learning results to provide targeted security policy recommendations and improve the efficiency of responding to cyber attacks.

[0065] The method disclosed in this disclosure can achieve comprehensive nuclear power network security situation awareness through the collaborative work of the above steps, covering multiple links such as data collection and preprocessing, time series analysis, feature matching, event classification and health assessment. The organic combination of various modules enables the system to identify and respond to potential threats in real time and accurately, and through visualization and decision support functions, it helps operation and maintenance personnel take effective safety measures to ensure the safe and stable operation of the nuclear power system.

[0066] According to another aspect of an embodiment of the present disclosure, a nuclear power network security situation awareness and health assessment device is provided, the device comprising:

[0067] Data collection and data preprocessing module, used to collect data from multiple sources of nuclear power system, and standardize and remove noise from the collected data;

[0068] A feature extraction module is used to extract features from the preprocessed data using a shared encoder, and convert data from different sources into multiple series of low-dimensional feature data;

[0069] A time series feature extraction module is used to process multiple series of low-dimensional feature data using a long short-term memory network, a gated recurrent unit or a time series convolutional network to obtain multiple series of time series features. The time series features of each series represent the characteristics of the series type data changing over time.

[0070] The field matching module is used to construct a feature matching layer, and through a comparative learning device, the fields in the flow data and the log data are matched for similarity, and the features of the flow data and the log data whose similarity exceeds a similarity threshold are obtained;

[0071] The association analysis module is used to introduce the self-attention mechanism in the feature matching layer, process the traffic data and log data whose feature similarity is higher than the preset threshold, identify the association between network traffic and events in the log, and thus reveal complex attack patterns;

[0072] The feature fusion module is used to perform weighted fusion of time series features from different data sources using a self-attention mechanism to obtain a unified fused time series feature representation;

[0073] The event classification module is used to process the fused unified temporal feature representation using a multi-task learning model and classify attack behaviors;

[0074] The health assessment module is used to perform health scoring tasks based on the possible attack behaviors obtained through classification, combine the classification results with the network status and historical data, and determine the health score of the current network through an integrated learning model.

[0075] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0076] Figure 2 1900 is a block diagram of a nuclear power network security situation awareness and health assessment device shown in an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0077] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0078] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0079] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0080] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0081] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0082] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0083] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0084] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0085] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0086] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0087] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for nuclear power network security situation awareness and health assessment, characterized in that: The method comprises: Step 101, data collection and data preprocessing, collecting data from multiple sources of the nuclear power system, and standardizing and denoising the collected data; Step 102, feature extraction, using a shared encoder to extract features from the preprocessed data, and converting data from different sources into multiple series of low-dimensional feature data; Step 103, extracting time series features, using a long short-term memory network, a gated recurrent unit or a time series convolutional network to process multiple series of low-dimensional feature data to obtain multiple series of time series features, where the time series features of each series represent the characteristics of the series type data changing over time; Step 104, field matching, constructing a feature matching layer, and using a comparative learning method to perform similarity matching between the fields in the traffic data and the log data, and obtaining the features of the traffic data and the log data whose similarity exceeds a similarity threshold; Step 105, correlation analysis, introduces a self-attention mechanism in the feature matching layer, processes traffic data and log data whose feature similarity is higher than a preset threshold, identifies the correlation between network traffic and events in the log, and thus reveals complex attack patterns; Step 106, feature fusion, using a self-attention mechanism to perform weighted fusion on the time series features from different data sources to obtain a unified fused time series feature representation; Step 107, event classification, using a multi-task learning model to process the fused unified temporal feature representation and classify the attack behavior; Step 108, health assessment, performs a health scoring task for the possible attack behaviors obtained through classification, combines the classification results with the network status and historical data, and determines the health score of the current network through an integrated learning model.

2. The method according to claim 1, characterized in that The method further comprises: Step 109, result output, the system displays the classification results and health scores through a visual interface, and provides graphical reports and real-time alerts.

3. The method according to claim 1, characterized in that The method further comprises: Step 110, decision support, based on the health score and classification results, a decision support system is used to provide security strategy recommendations and early warning prompts.

4. The method according to claim 1, characterized in that In step 101, data collected from multiple sources of a nuclear power system include network traffic, probe data, and interface logs.

5. The method according to claim 1, characterized in that In step 103, two recursive neural networks, long short-term memory network and gated recurrent unit, are used to capture long-time span dependencies; and a temporal convolutional network is used to capture local features in a time series through convolution operations.

6. The method according to claim 1, characterized in that In step 106, the self-attention mechanism first performs a weighted operation on the input time series features from different data sources. This weighting is achieved by calculating the similarity or correlation between different features. The weighted features are combined into a fused unified time series feature representation that includes the time series features of the original data and integrates the key correlation information in these features.

7. A nuclear power network security situation awareness and health assessment device, characterized in that: The device comprises: Data collection and data preprocessing module, used to collect data from multiple sources of nuclear power system, and standardize and remove noise from the collected data; A feature extraction module is used to extract features from the preprocessed data using a shared encoder, and convert data from different sources into multiple series of low-dimensional feature data; A time series feature extraction module is used to process multiple series of low-dimensional feature data using a long short-term memory network, a gated recurrent unit or a time series convolutional network to obtain multiple series of time series features. The time series features of each series represent the characteristics of the series type data changing over time. The field matching module is used to construct a feature matching layer, and through a comparative learning device, the fields in the flow data and the log data are matched for similarity, and the features of the flow data and the log data whose similarity exceeds a similarity threshold are obtained; The association analysis module is used to introduce the self-attention mechanism in the feature matching layer, process the traffic data and log data whose feature similarity is higher than the preset threshold, identify the association between network traffic and events in the log, and thus reveal complex attack patterns; The feature fusion module is used to perform weighted fusion of time series features from different data sources using a self-attention mechanism to obtain a unified fused time series feature representation; The event classification module is used to process the fused unified temporal feature representation using a multi-task learning model and classify attack behaviors; The health assessment module is used to perform health scoring tasks based on the possible attack behaviors obtained through classification, combine the classification results with the network status and historical data, and determine the health score of the current network through an integrated learning model.

8. A nuclear power network security situation awareness and health assessment device, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 6.

9. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images