Electric power information network security risk assessment method and system

Abstract

The invention discloses an electric power information network security risk assessment method and system, and relates to the technical field, and the system comprises the following components: S100, data acquisition, S200, artificial intelligence algorithm analysis, S300, fusion model, S400, risk assessment and S500, prediction model. According to the method, future security threats are predicted through the Markov chain Monte Carlo method and the fusion neural network algorithm, the security state of the power information network is comprehensively defined as the state space of the MCMC, and the transition probability model between the states is constructed, so that the conversion condition and probability between different states can be finely analyzed, and the security threats of the power information network can be predicted. And dynamic and accurate prediction of future security threats is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of power information network security, and specifically provides a method and system for assessing power information network security risks. Background Art

[0002] With the intelligent and networked development of the power system, the power information network has become an indispensable and important part of the power system. However, the security issues of the power information network have become increasingly prominent, and network attacks and data leakage security incidents occur frequently, posing a serious threat to the stable operation of the power system and the continuity of power supply.

[0003] In traditional technologies, traditional prediction models often lack dynamics and flexibility when predicting future security threats. They cannot adjust the prediction results in a timely manner according to the changes in real-time data and network status, so they cannot achieve accurate prediction of future security threats. Therefore, it is particularly important to develop a method and system for assessing power information network security risks. Summary of the Invention

[0004] The purpose of the present invention is to make up for the deficiencies of the existing technology, and provides a method and system for assessing power information network security risks. The system realizes the intelligent assessment and dynamic and accurate prediction of power information network security risks by integrating neural network algorithms and Markov chain Monte Carlo methods.

[0005] In order to solve the above technical problems, the present invention provides the following technical solution: A method for assessing power information network security risks, characterized in that the specific steps of the method are as follows;

[0006] S100, Data acquisition: Deploy data acquisition devices at key nodes and devices of the power information network to collect multi-dimensional data, including network traffic data, device operation parameters, user operation records, system logs, and power business process data, to form a set of historical security event data and real-time monitoring data. The acquisition frequency depends on the dynamic characteristics of each component of the power information network. The network traffic data is collected at microsecond intervals, and the device operation parameters are collected at second intervals. Preprocess the collected data. First, perform data cleaning, remove noise data by constructing an outlier detection model based on probability distribution, and eliminate duplicate data using the hash algorithm; then perform data standardization;

[0007] S200, Artificial intelligence algorithm analysis: Use the integrated neural network algorithm to learn and analyze the preprocessed data. This algorithm integrates the long short-term memory network (MG-LSTM) and the convolutional neural network (PT-CNN);

[0008] The formula of MG-LSTM is as follows:

[0009] i t= σ(W xi x t + W hi h t-1 + W ci c t-1 + b i )

[0010] f t = σ(W xf x t + W hf h t-1 + W cf c t-1 + b f )

[0011] g t = tanh(W xg x t + W hg h t-1 + W cg c t-1 + b g )

[0012] o t = σ(W xo x t + W ho h t-1 + W co c t-1 + b o )

[0013] c t = f t c t-1 + i t g t

[0014] h t = o t tanh(c t )

[0015] where i t , f t , g t , o t are the activation values of the input gate, forget gate, candidate memory cell, and output gate respectively, σ is the sigmoid function, tanh is the hyperbolic tangent function, x t is the input vector at the current time step, h t-1 is the hidden state at the previous time step, c t-1 is the memory cell at the previous time step. The MG-LSTM additionally introduces the power service relevance gate r t and the risk importance gate s t ;

[0016] r t = σ(W xr x t + W hr h t-1 + W cr c t-1 + b r )

[0017] s t = σ(W xs x t + W hs h t-1 + W cs c t-1 + b s )

[0018] c t = (f t c t-1 + i t g t ) × r t × s t

[0019] Method for determining parameters W and b: The W xi , W hi , W ci , b i parameters related to traditional LSTM are obtained by training the initial values using the backpropagation algorithm on the data subset with time series characteristics and marked security events in the historical data of the power information network. The newly introduced W xr、 W hr , W cr、 The importance levels are divided according to the degree of influence on the continuity and stability of power supply, the security risk levels are determined according to the loss degree of historical security accidents to the power system, and the weights are allocated according to the power business and security risk quantification indicators. For example, the key power dispatching business has a high weight in r t , and the data related to the risk factors that have caused major power outages has a high weight in s t ;

[0020] PT-CNN part: Design PT-CNN for the spatial characteristics of the power information network data. In the convolutional layer, let the power network topology graph be G = (V, E), where V is the set of nodes and E is the set of edges. The connectivity of node v i is d(v i ). The size k of the convolutional kernel is determined according to the statistical distribution of the node connectivity, the stride s is determined according to the network hierarchical relationship, and the weights of the convolutional kernel are determined through the joint analysis of the power network topology structure and historical security events. The initial values of the weights of the convolutional kernels corresponding to the edges connecting key devices are high, and the weights of the convolutional kernels related to the network areas frequently involved in historical security events are optimized during training;

[0021] S300, Fusion Model: Fuse the outputs of MG-LSTM and PT-CNN. The fusion formula is:

[0022] F = α × MG-LSTM output + β × PT-CNN output

[0023] Where α and β are fusion weights, which are obtained through collaborative training on a large amount of power information network data with labeled security risk levels. During training, the weights are dynamically adjusted according to the contribution degrees of the two algorithms to the risk assessment accuracy;

[0024] S400, Risk Assessment: Based on the fusion result, use an evaluation model based on fuzzy logic to evaluate the current security risk level of the power information network. This model maps the fusion result to a fuzzy set. The membership function of the fuzzy set is determined according to the physical meaning of the power information network security risk and industry standards. For risk factors that may cause power outage accidents, their weights are high in the high-risk membership function. After fuzzy reasoning and defuzzification operations, the security risk level is obtained;

[0025] S500, Prediction Model: Use the trained model to predict future security threats to the power information network. The prediction model combines the Markov chain Monte Carlo method with the above-mentioned fusion neural network algorithm. The MCMC method models the changing trends of the time series and spatial characteristics of the power information network data, and the result of the fusion neural network algorithm is used as prior information. The prediction formula is:

[0026] P(S t+1 |S t ,D) = ∫P(S t+1 |S t ,θ)P(θ|D)dθ

[0027] Where P(S t+1 |S t ,D) is the probability of the security threat state S t at the future time t + 1 under the current state S t+1 and data D. θ is the model parameter. P(S t+1 |S t ,θ) is the conditional probability based on the model parameter, and P(θ|D) is the parameter posterior probability. The prediction is achieved by training the model parameters and probability distributions through a large amount of historical and real-time data.

[0028] Furthermore, in the data collection step of S100, for the collection of power business process data, the deep packet inspection technology is combined with the power business protocol parsing algorithm. The specific method is as follows:

[0029] S101, Deep Packet Inspection Technology: Set monitoring points at network interfaces, deeply analyze the passing data packets, extract the header information and payload content of the data packets, and use a feature matching algorithm to identify whether it is traffic related to power services. The features include the unique identifiers and instruction formats specific to power service protocols, and the communication protocol of the power SCADA system, whose control instruction format has obvious features in the data packet payload. Build a regular expression pattern to accurately identify relevant data packets;

[0030] S102, Power Service Protocol Parsing Algorithm: Develop parsing algorithms for different power service protocols. Taking the IEC60870-5-104 protocol as an example, according to its application layer protocol specifications, split the data packet payload by specific byte order and length, extract information elements, and further parse the information body to obtain power equipment status information and control command content. Through in-depth parsing, data at all links of the power service process are obtained, including but not limited to equipment control operations and status feedback, providing data support for risk assessment. During parsing, a checksum verification mechanism is adopted to verify the parsed data. If the verification fails, mark the data packet as abnormal data for subsequent special processing or discarding.

[0031] Furthermore, in the power service relevance gate r of MG-LSTM in S200 t The training data preparation process is as follows:

[0032] S201, Classify power services into critical services, important services, and general services according to their impact on the continuity and stability of power supply. Critical services include power dispatching and grid protection, which directly affect the stable operation of the power system. Important services such as power market transactions and electricity metering play important roles in power operation. General services include power equipment maintenance and management, which have relatively little impact;

[0033] S202, For each service category, collect network data related to it from different devices and systems of the power information network;

[0034] S203, Mark the collected data. Based on the service execution status and its association with security events, mark the data related to normal service operations as normal, and mark the data related to service operations during security events or leading to security events as abnormal;

[0035] S204, Organize the marked service data in time series to form a training dataset for training the power service relevance gate r t , During training, adjust the parameters of r t to enable the model to accurately distinguish the relevance of different service category data to security risks. When critical service data is related to security events in r t , the output value is closer to 1, and when general service data is normal, the output value is closer to 0.

[0036] Furthermore, the parameter update mechanism of the risk importance gate s of the S200 in the MG-LSTM is as follows: t is as follows:

[0037] S205, establish a risk importance knowledge base to store detailed information of historical safety accidents, including but not limited to accident types, accident causes, affected power equipment and business scopes, and the degree of losses caused by the accidents;

[0038] S206, quantify different types of safety risk factors according to the information in the knowledge base, and the quantification indicators include but not limited to risk occurrence frequency, power outage scope caused, and economic losses;

[0039] S207, during training, when new safety event data is input, match the safety risk factors involved in the data with the information in the knowledge base, and calculate the risk importance score of the current data. Feed the score back to the risk importance gate s t Adjust the parameters of s through the backpropagation algorithm t so that s t can dynamically adjust the output value according to the risk factors contained in the current data, and the output value of s for high-risk importance data t is closer to 1, effectively updating the memory unit

[0040] Furthermore, in the S200 in the power topology-aware convolutional neural network (PT-CNN), the initialization of the convolutional kernel weights is based on the hierarchical analysis method of the power network topology structure as follows:

[0041] S208, perform hierarchical processing on the power network topology graph G=(V, E), adopt a hierarchical algorithm based on graph theory, and divide the nodes into different levels according to the functions of different devices in the power network and their positions in power transmission and control;

[0042] S209, for the nodes within each level, analyze their connection relationships and communication modes. The communication links between high-level nodes are complex and have high bandwidth, which are used to transmit a large amount of power control instructions and status information. Low-level nodes communicate with local devices with small amounts of data. Based on this, determine the initial distribution of the convolutional kernel weights within each level. For the convolutional kernels related to high-level nodes, the weight values are initialized to larger values at the positions corresponding to the core power control instructions and key status information to highlight the importance of this information in risk assessment. For the convolutional kernels related to low-level nodes, the weights are initialized according to the local device safety sensitivity;

[0043] S210. In the connection area between different levels, considering the security risks of data transmission between levels, for the convolution kernel weights corresponding to the edges connecting high-level and low-level nodes, initialize them according to the data flow direction and security protection requirements. Through this method of initializing convolution kernel weights based on topological layering, PT-CNN can better capture security-related information in the power network topology structure at the initial stage of training.

[0044] Furthermore, in the fusion model of S300, the specific process of co-training and adjusting the fusion weights α and β is as follows:

[0045] S301. At the beginning of training, according to experience or the results of pre-experiments on a small-scale dataset, assign initial values to α and β. If a preliminary analysis shows that the time series features account for a large proportion in risk assessment, the initial value of α can be set to 0.6 and the initial value of β to 0.4. e ;

[0046] S302. Divide the power information network data with labeled security risk levels into multiple training batches, and each batch contains samples of different types of power business scenarios and security event situations.

[0047] S303. In each training batch, use the models containing only MG-LSTM, only PT-CNN, and the fusion of both to process the data respectively, obtain their respective risk assessment results, compare these results with the labeled true risk levels, and calculate the evaluation errors.

[0048] S304. If in a certain batch, the difference between the evaluation error when MG-LSTM is used alone and the evaluation error contributed by the MG-LSTM part in the fusion model is greater than the difference between the evaluation error when PT-CNN is used alone and the evaluation error contributed by the PT-CNN part in the fusion model, then appropriately increase the value of α and at the same time decrease the value of β. Otherwise, the adjustment direction is opposite, and the adjustment amplitude is determined according to the size of the error difference and the preset adjustment step. Through this co-training adjustment process, the fusion model can dynamically adjust the weights according to the performance advantages and disadvantages of the two algorithms under different data conditions, improving the accuracy of risk assessment.

[0049] Furthermore, in the evaluation model based on fuzzy logic of S400, the method for determining the membership function of the fuzzy set is as follows:

[0050] S401. According to the power industry standards and the actual situation of power information network security, divide the security risk levels into four levels: low risk, medium risk, high risk, and extremely high risk.

[0051] Low risk indicates a minor abnormal situation that has basically no impact on the operation of the power system.

[0052] Medium risk indicates a situation that may cause short-term failures of local power equipment or small-scale power supply fluctuations.

[0053] A high risk indicates a situation that may cause a large - scale power outage or have a serious impact on critical power operations;

[0054] An extremely high risk indicates a situation that may lead to the paralysis of the entire power system and cause catastrophic consequences to society and the economy;

[0055] S402, The characteristics of the low - risk level include occasional small - flow abnormal data in the network and slight performance fluctuations of a single non - critical device;

[0056] The medium - risk level involves an increase in network latency in some areas and temporary error alarms of a small number of critical devices;

[0057] The high - risk level includes faults in critical network links, serious performance degradation of multiple critical devices, or signs of interruption in power service processes;

[0058] The extremely high - risk level is manifested as the out - of - control of the core power dispatching system and the serious paralysis of the main power transmission network;

[0059] S403, For each risk level, a corresponding membership function is constructed. Taking the triangular membership function as an example, for the low - risk level, the membership degree is 1 under normal conditions. When small - flow abnormal data or slight performance fluctuations of a single non - critical device occur, the membership degree changes between 0 and 1 according to the degree of abnormality. When the abnormal situation exceeds a certain threshold, the membership degree drops to 0. For the medium - risk level, when there is an increase in network latency in some areas or temporary error alarms of a small number of critical devices, the membership degree starts to increase from 0. When the severity of the situation reaches the set value, the membership degree reaches 1. If the situation deteriorates, the membership degree decreases until it drops to 0 when the characteristics of the high - risk level appear. The membership functions of the high - risk and extremely high - risk levels are the same. In this way, the output results of the fusion neural network algorithm are accurately mapped into the corresponding risk - level fuzzy sets, providing a quantitative method that conforms to the actual situation of the power information network for risk assessment.

[0060] Furthermore, in the prediction step of S500, the specific implementation of combining the Markov chain Monte Carlo method and the fusion neural network algorithm is as follows:

[0061] S501, The security state of the power information network is comprehensively defined as the state space of MCMC. Each state in this state space precisely represents the overall security situation of the power information network at a specific moment, covering the network topology structure state, device operation state, service process state, and the occurrence of security events;

[0062] S502. Based on a large amount of historical power information network data, construct a transition probability model between states, and carefully analyze the conditions and probabilities of conversion between different states. This requires considering various factors. When new attack pattern features that have not appeared in historical data emerge, the probability of transitioning to a high-risk security state will increase significantly. The transition probability is estimated by accurately counting the frequencies of state transitions in historical data, while fully considering the dynamic changes of power services and the impact of complex factors such as network topology adjustments on the transition probability.

[0063] S503. Integrate the results output by the neural network algorithm as the prior information of the MCMC method, which plays a key guiding role in the entire prediction process. Specifically, the in-depth analysis results of the neural network on the current power information network data, including risk assessment values and potential risk pattern recognition content, are used to finely adjust the transition probability and state space distribution in the MCMC model. Through this close combination, the MCMC method can make full use of the real-time analysis ability of the neural network to more accurately predict the security threat state of the power information network at future moments, thereby realizing the dynamic and accurate prediction of security risks in the complex and changeable power information network environment.

[0064] On the other hand, a power information network security risk assessment system, characterized in that the system includes a data acquisition module, an artificial intelligence algorithm analysis module, a fusion model, a risk assessment module, and a prediction module;

[0065] The data acquisition module: Deploy data acquisition devices at key nodes and devices of the power information network to collect multi-dimensional data, covering network traffic data, device operation parameters, user operation records, system logs, and power service process data, forming a collection of historical security event data and real-time monitoring data. The acquisition frequency depends on the dynamic characteristics of each component of the power information network. Network traffic data is collected at microsecond intervals, and device operation parameters are collected at second intervals. Preprocess the collected data. First, perform data cleaning, remove noise data by constructing an outlier detection model based on probability distribution, and eliminate duplicate data using the hash algorithm; then perform data standardization;

[0066] The artificial intelligence algorithm analysis module: Use the integrated neural network algorithm to learn and analyze the preprocessed data. This algorithm integrates the long short-term memory network (MG-LSTM) and the convolutional neural network (PT-CNN);

[0067] The formula of MG-LSTM is as follows:

[0068] i t =σ(W xi x t +W hi h t-1 +W cic t-1 +b i )

[0069] f t =σ(W xf x t +W hf h t-1 +W cf c t-1 +b f )

[0070] g t =tanh(W xg x t +W hg h t-1 +W cg c t-1 +b g )

[0071] o t =σ(W xo x t +W ho h t-1 +W co c t-1 +b o )

[0072] c t =f t c t-1 +i t g t

[0073] h t =o t tanh(c t )

[0074] where i t , f t , g t , o t are the activation values of the input gate, forget gate, candidate memory cell, and output gate respectively, σ is the sigmoid function, tanh is the hyperbolic tangent function, x t is the input vector at the current time step, h t-1 is the hidden state at the previous time step, c t-1 is the memory cell at the previous time step. The MG-LSTM additionally introduces the power service relevance gate r t and the risk importance gate s t ;

[0075] r t =σ(W xr x t +W hr ht-1 +W cr c t-1 +b r )

[0076] s t = σ(W xs x t +W hs h t-1 +W cs c t-1 +b s )

[0077] c t = (f t c t-1 +i t g t ) × r t ×s t

[0078] Method for determining parameters W and b: The W xi , W hi , W ci , b i parameters related to the traditional LSTM are obtained by training the initial values with the backpropagation algorithm on the data subset with time series characteristics and marked security events in the historical data of the power information network. The newly introduced W xr、 W hr、 W cr、 The importance levels are divided according to the impact on the continuity and stability of power supply, the security risk levels are determined according to the loss degree of historical security accidents to the power system, and the weights are allocated according to the power business and security risk quantification indicators. For example, the key power dispatching business has a high weight in r t , and the data related to the risk factors that have caused major power outages has a high weight in s t ;

[0079] PT-CNN part: PT-CNN is designed for the spatial characteristics of the power information network data. In the convolutional layer, let the power network topology graph be G = (V, E), where V is the set of nodes and E is the set of edges. The connectivity of node v i is d(v i ). The size k of the convolutional kernel is determined according to the statistical distribution of the node connectivity, the stride s is determined according to the network hierarchical relationship, and the weights of the convolutional kernel are determined through the joint analysis of the power network topology structure and historical security events. The initial values of the weights of the convolutional kernels corresponding to the edges connecting key devices are high, and the weights of the convolutional kernels related to the network areas frequently involved in historical security events are optimized during training;

[0080] The fusion model: The outputs of MG-LSTM and PT-CNN are fused, and the fusion formula is:

[0081] F = α × MG - LSTM output + β × PT - CNN output

[0082] Wherein, α and β are fusion weights, which are obtained by co - training a large amount of power information network data with labeled security risk levels, and the weights are dynamically adjusted according to the contribution degrees of the two algorithms to the accuracy of risk assessment during training;

[0083] The risk assessment module: Based on the fusion result, use an evaluation model based on fuzzy logic to evaluate the current security risk level of the power information network. This model maps the fusion result to a fuzzy set, and the membership function of the fuzzy set is determined according to the physical meaning of the power information network security risk and industry standards. For risk factors that may cause power outage accidents, their weights are high in the high - risk membership function. After fuzzy reasoning and defuzzification operations, the security risk level is obtained;

[0084] The prediction model: Use the trained model to predict future security threats to the power information network. The prediction model combines the Markov chain Monte Carlo method with the above - mentioned fusion neural network algorithm. The MCMC method models the change trends of the time series and spatial characteristics of the power information network data, and the result of the fusion neural network algorithm is used as prior information. The prediction formula is:

[0085] P(S t+1 |S t ,D) = ∫P(S t+1 |S t ,θ)P(θ|D)dθ

[0086] Wherein, P(S t+1 |S t ,D) is the probability of the security threat state S t at the future time t + 1 under the current state S t+1 and data D. θ is the model parameter. P(S t+1 |S t ,θ) is the conditional probability based on the model parameter, and P(θ|D) is the parameter posterior probability. The prediction is realized by training a large amount of historical and real - time data to determine the model parameters and probability distributions.

[0087] Compared with the prior art, a power information network security risk assessment method and system have the following beneficial effects:

[0088] First, the present invention predicts future security threats through the Markov chain Monte Carlo method and the fusion neural network algorithm. By comprehensively defining the security state of the power information network as the state space of MCMC and constructing a transition probability model between states, it can finely analyze the conversion conditions and probabilities between different states, and realize dynamic and accurate prediction of future security threats.

[0089] II. The present invention deploys data acquisition devices at key nodes and devices in the power information network through a data acquisition module, which can comprehensively and real-time collect multi-dimensional data, including network traffic data, device operation parameters, user operation records, system logs, and power business process data. After preprocessing these data, a fusion neural network algorithm is used for in-depth learning analysis, fully considering the time series characteristics and spatial characteristics of the power information network data, thereby improving the accuracy of risk assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0091] Figure 1 Operation flowchart of a power information network security risk assessment method;

[0092] Figure 2 Operation flowchart of a power information network security risk assessment system. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0093] The following will clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0094] Embodiment 1

[0095] This embodiment describes that a certain substation, as an important part of the power transmission system, its information network undertakes the core tasks of monitoring, control, and data acquisition. Given the key role of the information network in the operation of the substation, it is crucial to conduct a comprehensive security risk assessment to ensure the safe and stable operation of the substation.

[0096] Carefully deploy data acquisition devices at key nodes and devices in the substation to ensure that multi-dimensional information such as network traffic data, device operation parameters, and user operation records can be comprehensively captured. The data acquisition frequency needs to be scientifically set according to the dynamic characteristics of each component in the substation. For example, network traffic data may need to be collected at microsecond intervals, while device operation parameters may be collected at second intervals. Preprocess the collected data, including data cleaning, data deduplication, and data standardization, to provide a high-quality data basis for subsequent analysis.

[0097] The fused neural network algorithm is selected to perform in-depth learning analysis on the preprocessed data. The MG-LSTM formula is as follows:

[0098] i t = σ(W xi x t + W hi h t-1 + W ci c t-1 + b i )

[0099] f t = σ(W xf x t + W hf h t-1 + W cf c t-1 + b f )

[0100] g t = tanh(W xg x t + W hg h t-1 + W cg c t-1 + b g )

[0101] o t = σ(W xo x t + W ho h t-1 + W co c t-1 + b o )

[0102] c t = f t c t-1 + i t g t

[0103] h t = o t tanh(c t )

[0104] Among them, i t , f t , g t , o t are the activation values of the input gate, forget gate, candidate memory cell, and output gate respectively. σ is the sigmoid function, tanh is the hyperbolic tangent function, x t is the input vector at the current moment, h t-1 is the hidden state at the previous moment, ct-1 is the memory unit of the previous moment. MG-LSTM additionally introduces the power business relevance gate r t and risk importance gates t ;

[0105] Parameters W and b determination method: W related to traditional LSTM xi , W hi , W ci 、b i The parameters are initialized by training the subset of data with time series characteristics and marked security events in the historical data of the power information network using the back propagation algorithm. The newly introduced W xr、 W hr , W cr、 The importance level is divided according to the degree of impact on the continuity and stability of power supply. The safety risk level is determined by the degree of loss to the power system caused by historical safety accidents. The weight is allocated according to the power business and safety risk quantitative indicators. For example, the key power dispatching business is t The data on risk factors with high medium weight and causing major power outages are in s t Medium weight high, PT-CNN part: PT-CNN is designed for the spatial characteristics of power information network data. In the convolution layer, the power network topology is G = (V, E), V is the node set, E is the edge set, and node v i The connectivity is d(v i ), the convolution kernel size k is determined according to the statistical distribution of node connectivity, the step size s is determined according to the network hierarchical relationship, the convolution kernel weight is determined by the joint analysis of the power network topology and historical security events, the initial value of the convolution kernel weight corresponding to the edge connecting key equipment is high, and the convolution kernel weights related to the network area frequently involved in historical security events are optimized during training, with special attention paid to the power business process data and equipment operation status data of the substation to explore potential security risks. By training a subset of data with time series characteristics and marked security events in the historical data of the substation information network, the power business relevance gate and risk importance gate parameters tailored to the characteristics of the substation are obtained. These parameters can reflect the relevance of different business category data to security risks, as well as the importance level of different security risk factors. In the convolutional neural network part, the spatial characteristics of the substation information network data are designed, and the power network topology and historical security event information are used to determine the size, step size and weight distribution of the convolution kernel, so as to more accurately capture the security-related information in the substation information network.

[0106] The outputs of the long short-term memory network and the convolutional neural network are organically integrated, and the outputs of MG-LSTM and PT-CNN are integrated. The fusion formula is:

[0107] F = α × MG - LSTM output + β × PT - CNN output

[0108] Where α and β are fusion weights, obtained through collaborative training on a large amount of power information network data with labeled security risk levels. During training, the weights are dynamically adjusted according to the contribution degrees of the two algorithms to the accuracy of risk assessment. By leveraging their respective advantages in time - series analysis and spatial feature capture, the accuracy of risk assessment is improved. The fusion weights are dynamically adjusted to adapt to the characteristics of the substation information network and the algorithm performance differences under different data conditions. This adjustment process is achieved through collaborative training based on a large amount of substation information network data with labeled security risk levels.

[0109] Based on the fusion result, a fuzzy - logic - based evaluation model is used to evaluate the security risk level of the current substation information network. The membership function of the fuzzy set is determined according to the physical meaning of the security risk of the substation and industry standards to ensure the accuracy and rationality of the evaluation result. For example, for risk factors that may cause power outage accidents, their weights in the high - risk membership function will be higher.

[0110] Using the trained model to predict the future security threats of the substation information network, combining the Markov chain Monte Carlo method with the fusion neural network algorithm to model the change trends of the time - series and spatial features of the substation information network data, P(S t+1 |S t ,D) = ∫P(S t+1 |S t ,θ)P(θ|D)dθ

[0111] Where P(S t+1 |S t ,D) is the probability of the security threat state S t at the future time t + 1 under the current state S t+1 and data D. θ is the model parameter. P(S t+1 |S t ,θ) is the conditional probability based on the model parameter, and P(θ|D) is the parameter posterior probability, to achieve accurate prediction of future security threats. This prediction process can provide strong support for the security management and decision - making of the substation.

[0112] Example 2

[0113] This embodiment describes a large-scale power plant with multiple generator sets. Its information network is responsible for monitoring the operating status of the generator sets, transmitting control instructions, and managing the power production process. Since the operation of the power plant has an important impact on the national economy, the security of its information network is particularly important. To ensure the safe production of the power plant and avoid generator set shutdowns or power production interruptions caused by information network security issues, it is necessary to conduct regular security risk assessments on its information network.

[0114] Deploy data collection devices at key nodes and important equipment in the power plant to ensure that the data collection devices have high performance, high reliability, and high security, and can collect data in real time and accurately, including the network transmission rate, packet size, protocol type, including the temperature, pressure, and vibration parameters of the generator sets, and the operating status of the control system, including user login information, operation permissions, operation content, including system startup, shutdown, error logs, and power business process data: including data for each link of power production, transmission, and distribution. Clean the collected data to remove invalid, duplicate, or abnormal data, deduplicate the data to ensure its uniqueness, and standardize the data to convert data in different formats and dimensions into a unified format and dimension for subsequent analysis.

[0115] Construct a fusion neural network algorithm using Long Short-Term Memory (LSTM) and Convolutional Neural Network (CNN). The LSTM network is used to capture the long-term dependencies of time series data. The MG-LSTM formula is as follows:

[0116] i t =σ(W xi x t +W hi h t-1 +W ci c t-1 +b i )

[0117] f t =σ(W xf x t +W hf h t-1 +W cf c t-1 +b f )

[0118] g t =tanh(W xg x t +W hg h t-1 +W cg c t-1 +b g )

[0119] o t = σ(W xo x t + W ho h t-1 + W co c t-1 + b o )

[0120] c t = f t c t-1 + i t g t

[0121] h t = o t tanh(c t )

[0122] Among them, i t , f t , g t , o t are the activation values of the input gate, forget gate, candidate memory cell, and output gate respectively. σ is the sigmoid function, tanh is the hyperbolic tangent function, x t is the input vector at the current moment, h t-1 is the hidden state at the previous moment, c t-1 is the memory cell at the previous moment. The CNN network is used to extract the spatial features of the data. A PT-CNN is designed for the spatial features of the power information network data. In the convolutional layer, let the power network topology graph be G = (V, E), where V is the set of nodes and E is the set of edges. The degree of connection of node v i is d(v i ). The size k of the convolutional kernel is determined according to the statistical distribution of the node connection degrees, the stride s is determined according to the network hierarchical relationship, and the weights of the convolutional kernel are determined through the joint analysis of the power network topology structure and historical security events. The initial value of the weights of the convolutional kernel corresponding to the edges connecting key devices is high, and the weights of the convolutional kernels related to the network areas frequently involved in historical security events are optimized during training. According to the business characteristics and security risk levels of power plants, historical data is collected as training samples, and the training samples are used to train the fusion neural network algorithm, adjust the algorithm parameters, and improve the accuracy of risk assessment. The cross-validation method is used to optimize the algorithm to avoid overfitting or underfitting. For the spatial features of the power plant information network data, a convolutional layer is designed, and the weights and size of the convolutional kernel are determined through the joint analysis of the power plant network topology structure and historical security events. The spatial features of the data are extracted through convolutional operations to provide key information for subsequent risk assessment.

[0123] Fuse the outputs of the LSTM network and the CNN network, and fuse the outputs of the MG-LSTM and the PT-CNN. The fusion formula is:

[0124] F = α × MG - LSTM output + β × PT - CNN output

[0125] Where α and β are fusion weights, which are obtained through collaborative training of a large amount of power information network data with labeled security risk levels. During the training, the weights are dynamically adjusted according to the contribution degrees of the two algorithms to the accuracy of risk assessment. According to the contribution degrees of the two algorithms to the accuracy of risk assessment, the fusion weights are dynamically adjusted. The weighted average and weighted summation methods are used for fusion to obtain the final risk assessment result. The fusion model is verified using verification samples to evaluate the accuracy and reliability of the model. The model is adjusted and optimized according to the verification results to improve the performance of the model.

[0126] Based on the fusion result, an evaluation model based on fuzzy logic is used to evaluate the security risk of the power plant information network. The fuzzy logic evaluation model can handle uncertain information and improve the accuracy of risk assessment. According to the business characteristics and actual situation of the power plant, the security risk levels are divided into low risk, medium risk, high risk, and extremely high risk. Higher weights are given to risk factors that may cause generator set shutdown or power production interruption. Using the fuzzy inference method, based on the risk assessment result and the risk factor weights, the security risk level is obtained. The defuzzification method is used to convert the fuzzy risk level into a specific numerical value or grade label.

[0127] A prediction model is constructed using the trained fusion neural network algorithm and the Markov chain Monte Carlo method (MCMC). The MCMC method can simulate the random change process of data and improve the accuracy and reliability of prediction. Combining the time series and spatial characteristics of the power plant information network data, the change trend of the data is modeled. The result of the fusion neural network algorithm is used as prior information. The prediction formula is: P(S t+1 |S t ,D) = ∫P(S t+1 |S t ,θ)P(θ|D)dθ, where P(S t+1 |S t ,D) is the probability of the security threat state S t at the future time t + 1 under the current state S t+1 and the data D. θ is the model parameter. P(S t+1 |S t, θ) is the conditional probability based on the model parameters, and P(θ|D) is the parameter posterior probability. The model parameters and probability distribution are determined through training with a large amount of historical and real-time data to achieve prediction, improve the accuracy of prediction, analyze the prediction results, identify potential information network security threats, and formulate corresponding preventive measures and emergency plans according to the prediction results to ensure the safe production of the power plant.

[0128] For those skilled in the art, it is obvious that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic characteristics of the present invention. Therefore, from any point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the appended claims rather than the above description. Therefore, all changes falling within the meaning and scope of the equivalent elements of the claims are intended to be embraced within the present invention. Any reference signs in the claims should not be construed as limiting the claims involved.

Claims

1. A method for assessing the security risk of power information network, characterized in that: The specific steps of this method are: S100, data collection: deploy data collection devices at key nodes and devices of the power information network to collect multi-dimensional data, including network traffic data, equipment operating parameters, user operation records, system logs and power business process data, to form a collection of historical security event data and real-time monitoring data. The collection frequency depends on the dynamic characteristics of each component of the power information network. Network traffic data is collected at microsecond intervals, and equipment operating parameters are collected at second intervals. The collected data is pre-processed by first cleaning the data, removing noise data by building an outlier detection model based on probability distribution, and using a hash algorithm to eliminate duplicate data; then data standardization is performed; S200, AI algorithm analysis: using a fusion neural network algorithm to learn and analyze preprocessed data, which combines a long short-term memory network (MG-LSTM) and a convolutional neural network (PT-CNN); The MG-LSTM formula is as follows: i t =σ(W xi x t +W hi h t-1 +W ci c t-1 +b i ) f t =σ(W xf x t +W hf h t-1 +W cf c t-1 +b f ) g t =tanh(W xg x t +W hg h t-1 +W cg c t-1 +b g ) o t =σ(W xo x t +W ho h t-1 +W co c t-1 +b o ) c t =f t c t-1 +i t g t h t =o t fishy t ) Among them, i t 、f t , g t , o t are the activation values ​​of the input gate, forget gate, candidate memory unit, and output gate, respectively. σ is the sigmoid function, tanh is the hyperbolic tangent function, and x t is the input vector at the current moment, h t-1 is the hidden state at the previous moment, c t-1 is the memory unit of the previous moment. MG-LSTM additionally introduces the power business relevance gate r t and risk importance gates t ; r t =σ(W xr x t +W hr h t-1 +W cr c t-1 +b r ) s t =σ(W xs x t +W hs h t-1 +W cs c t-1 +b s ) c t =(f t c t-1 +i t g t )×r t ×s t Parameters W and b determination method: W related to traditional LSTM xi , W hi , W ci 、b i The parameters are initialized by training the subset of data with time series characteristics and marked security events in the historical data of the power information network using the back propagation algorithm. The newly introduced W xr、 W hr , W cr The importance level is divided according to the degree of impact on the continuity and stability of power supply. The safety risk level is determined according to the degree of loss to the power system caused by historical safety accidents. The weight is allocated according to the power business and safety risk quantitative indicators. For example, the key power dispatching business is t The data on risk factors with high medium weight and causing major power outages are in s t Medium weight is high; PT-CNN: PT-CNN is designed based on the spatial characteristics of power information network data. In the convolution layer, the power network topology is G = (V, E), where V is the node set, E is the edge set, and node v i The connectivity is d(v i ), the convolution kernel size k is determined according to the statistical distribution of node connectivity, the step size s is determined according to the network hierarchy, the convolution kernel weight is determined by the joint analysis of the power network topology and historical security events, the initial value of the convolution kernel weight corresponding to the edge connecting key equipment is high, and the convolution kernel weight related to the network area frequently involved in historical security events is optimized during training; S300, fusion model: The outputs of MG-LSTM and PT-CNN are fused. The fusion formula is: F=α×MG-LSTM output +β×PT-CNN output Among them, α and β are fusion weights, which are obtained through collaborative training of a large amount of power information network data with labeled safety risk levels. During the training, the weights are dynamically adjusted according to the contribution of the two algorithms to the accuracy of risk assessment. S400, risk assessment: Based on the fusion results, the current power information network security risk level is assessed using an assessment model based on fuzzy logic. The model maps the fusion results to fuzzy sets. The fuzzy set membership function is determined according to the physical meaning of power information network security risk and industry standards. For risk factors that may cause power outages, they have high weights in the high-risk membership function, and the security risk level is obtained through fuzzy reasoning and defuzzification operations; S500, prediction model: Use the trained model to predict future power information network security threats. The prediction model combines the Markov chain Monte Carlo method with the above-mentioned fusion neural network algorithm. The MCMC method models the time series and spatial feature change trends of power information network data, and the fusion neural network algorithm results are used as prior information. The prediction formula is: P(S t+1 |S t ,D)=∫P(S t+1 |S t ,θ)P(θ|D)dθ Among them, P(S t+1 |S t ,D) is in the current state S t and data D, the security threat state S at the future time t+1 t+1 The probability of θ is the model parameter, P(S t+1 |S t ,θ) is the conditional probability based on the model parameters, P(θ|D) is the posterior probability of the parameters, and prediction is achieved by determining the model parameters and probability distribution through training with a large amount of historical and real-time data.

2. According to claim 1, a method for assessing the security risk of an electric power information network is characterized in that: In the data collection step, S100 uses deep packet inspection technology combined with a power business protocol parsing algorithm to collect power business process data. The specific method is as follows: S101, deep packet inspection technology: set monitoring points at the network interface, conduct in-depth analysis of the data packets passing through, extract the header information and payload content of the data packets, and use a feature matching algorithm to identify whether it is power business related traffic. The features include identifiers and instruction formats unique to the power business protocol. The control instruction format of the power SCADA system communication protocol has obvious features in the data packet payload. The relevant data packets are accurately identified by constructing a regular expression pattern. S102, power business protocol parsing algorithm: develop parsing algorithms for different power business protocols, taking the IEC60870-5-104 protocol as an example, according to its application layer protocol specification, split the data packet payload according to a specific byte order and length, extract the information elements, and further parse the information body to obtain the power equipment status information and control command content. Through in-depth analysis, data from all aspects of the power business process are obtained, including but not limited to equipment control operations and status feedback, to provide data support for risk assessment. A checksum verification mechanism is used in the analysis to verify the parsed data. If the verification fails, the data packet is marked as abnormal data and subsequently processed specially or discarded.

3. According to claim 1, a method for assessing the security risk of an electric power information network is characterized in that: The S200 in the MG-LSTM power business correlation gate t The training data preparation process is as follows: S201: Electricity business is divided into key business, important business and general business according to the degree of impact on the continuity and stability of electricity supply. Key business includes power dispatching and power grid protection, which directly affect the stable operation of the power system. Important business includes power market transactions and electricity metering, which play an important role in power operation. General business includes power equipment maintenance and management, which have relatively small impact. S202, for each business category, collecting network data related thereto from different devices and systems of the power information network; S203, marking the collected data, based on the business execution status and the association with the security incident, marking the business operation-related data that is executed normally as normal, and marking the business operation-related data that occurs during the security incident or causes the security incident as abnormal; S204, sorting the marked business data in time series to form a training data set for training the power business correlation gate t , during training, adjust r t The parameters of the model enable the model to accurately distinguish the relevance of different business category data to security risks. t The output value is closer to 1 when it is related to security incidents, and the output value of general business data is closer to 0 under normal circumstances.

4. According to claim 1, a method for assessing the security risk of electric power information network is characterized in that: The S200 risk importance gate in MG-LSTM t The parameter update mechanism is as follows: S205, establish a risk importance knowledge base to store detailed information on historical safety accidents, including but not limited to the type of accident, cause of the accident, affected power equipment and business scope, and extent of loss caused by the accident; S206, quantifying different types of safety risk factors based on the knowledge base information, where the quantitative indicators include but are not limited to the frequency of risk occurrence, the scope of power outage caused, and economic losses; S207: During training, when new security event data is input, the current data risk importance score is calculated based on the security risk factors involved in the data and the knowledge base information. The score is fed back to the risk importance gate. t Adjust s through the back-propagation algorithm t The parameters make s t The output value can be dynamically adjusted according to the risk factors contained in the current data, and the s of high-risk and important data t The output value is closer to 1, effectively updating the memory cell 5. According to claim 1, a method for assessing the security risk of electric power information network is characterized in that: In the power topology-aware convolutional neural network (PT-CNN) described in S200, the initialization of the convolution kernel weight is based on the hierarchical analysis method of the power network topology structure as follows: S208, performing hierarchical processing on the power network topology graph G = (V, E), using a hierarchical algorithm based on graph theory, and dividing the nodes into different levels according to the functions of different devices in the power network and their positions in power transmission and control; S209, for the nodes in each level, analyze their connection relationship and communication mode. The communication link between high-level nodes is complex and high-bandwidth, used to transmit a large amount of power control instructions and status information. The low-level nodes communicate with local devices, and the amount of data is small. Based on this, the initial distribution of convolution kernel weights in each level is determined. The weight values ​​of the convolution kernels related to the high-level nodes are initialized to larger values ​​at the positions corresponding to the core power control instructions and key status information, highlighting the importance of this information in risk assessment. The weights of the convolution kernels related to the low-level nodes are initialized according to the security sensitivity of the local devices. S210, in the connection areas between different levels, the security risks of data transmission between levels are considered, and the convolution kernel weights corresponding to the edges connecting high-level and low-level nodes are initialized according to the data flow and security protection requirements. Through this convolution kernel weight initialization method based on topological layering, PT-CNN can better capture security-related information in the topological structure of the power network in the early stage of training.

6. According to claim 1, a method for assessing the security risk of electric power information network is characterized in that: In the fusion model of S300, the collaborative training adjustment process of the fusion weights α and β is specifically as follows: S301, at the beginning of training, according to experience or small-scale data set pre-experimental results, assign initial values ​​of α and β. If the preliminary analysis shows that time series characteristics account for a large proportion in risk assessment, the initial value of α can be set to 0.6 and the initial value of β can be set to 0.

4. e ; S302, dividing the power information network data with marked security risk levels into multiple training batches, each batch containing samples of different types of power business scenarios and security incident situations; S303, in each training batch, the data are processed using a model containing only MG-LSTM, only PT-CNN, and a fusion of the two models, respectively, to obtain respective risk assessment results, and these results are compared with the annotated true risk levels to calculate the assessment error; S304, if in a certain batch, the difference between the evaluation error when MG-LSTM is used alone and the evaluation error contributed by the MG-LSTM part in the fusion model is greater than the difference between the evaluation error when PT-CNN is used alone and the evaluation error contributed by the PT-CNN part in the fusion model, then the value of α is appropriately increased and the value of β is reduced. Otherwise, the adjustment direction is opposite, and the adjustment amplitude is determined according to the error difference and the preset adjustment step. Through this collaborative training and adjustment process, the fusion model can dynamically adjust the weights according to the performance advantages and disadvantages of the two algorithms under different data conditions.

7. According to claim 1, a method for assessing the security risk of electric power information network is characterized in that: In the evaluation model based on fuzzy logic, the method for determining the membership function of the fuzzy set in S400 is as follows: S401, based on the power industry standards and the actual situation of power information network security, divide the security risk level into four levels: low risk, medium risk, high risk and extremely high risk; Low risk means minor abnormal conditions that have little impact on power system operations; Medium risk means situations that may cause temporary failure of local power equipment or fluctuations in power supply over a small area; High risk indicates situations that could cause widespread power outages or have serious impacts on critical power operations; Very high risk represents a situation that could lead to the collapse of the entire power system, with catastrophic consequences for society and the economy; S402, low-risk level features include occasional abnormal small traffic data in the network and slight performance fluctuations of a single non-critical device; The medium risk level involves increased network latency in some areas and temporary error alarms on a small number of key devices; High risk levels include failures in key network links, severe performance degradation of multiple key devices, or signs of disruption in power business processes; The extremely high risk level is manifested by the loss of control of the core power dispatching system and the serious paralysis of the power transmission backbone network; S403, construct a corresponding membership function for each risk level. Taking the triangular membership function as an example, for the low risk level, the membership is 1 under normal conditions. When there is small flow abnormal data or a slight performance fluctuation of a single non-critical device, the membership varies between 0 and 1 according to the degree of abnormality. When the abnormal situation exceeds a certain threshold, the membership drops to 0. For the medium risk level, when there is an increase in network delay in some areas or a temporary error alarm of a small number of critical devices, the membership starts to increase from 0. When the severity of the situation reaches the set value, the membership reaches 1. If the situation worsens, the membership decreases until it drops to 0 when the characteristics of the high risk level appear.

8. According to claim 1, a method for assessing the security risk of electric power information network is characterized in that: In the prediction step of S500, the specific implementation of combining the Markov chain Monte Carlo method with the fusion neural network algorithm is as follows: S501, comprehensively defining the security state of the power information network as the state space of MCMC, each state in this state space accurately represents the overall security situation of the power information network at a specific moment, covering the network topology state, equipment operation state, business process state and security event occurrence; S502, based on a large amount of historical power information network data, build a transition probability model between states, and carefully analyze the conditions and probabilities of transitions between different states. This requires considering multiple factors. When new attack pattern features that have not appeared in historical data appear, the probability of transitioning to a high-risk security state will increase significantly. The transition probability is estimated by accurately counting the frequency of different state transitions in historical data, while fully considering the impact of dynamic changes in power business and complex factors such as adjustment of network topology on the transition probability; S503, the result of the fusion neural network algorithm output is used as the prior information of the MCMC method, which plays a key guiding role in the entire prediction process. Specifically, the deep analysis results of the neural network on the current power information network data, including risk assessment values ​​and potential risk pattern recognition content, are used to fine-tune the transition probability and state space distribution in the MCMC model.

9. A power information network security risk assessment system according to any one of claims 1 to 8, characterized in that: The system includes a data acquisition module, an artificial intelligence algorithm analysis module, a fusion model and risk assessment module, and a prediction module. The data acquisition module: deploys data acquisition devices at key nodes and devices of the power information network to collect multi-dimensional data, including network flow data, equipment operating parameters, user operation records, system logs and power business process data, to form a collection of historical security event data and real-time monitoring data. The frequency of acquisition depends on the dynamic characteristics of each component of the power information network. Network flow data is collected at microsecond intervals, and equipment operating parameters are collected at second intervals. The collected data is pre-processed by first cleaning the data, removing noise data by building an outlier detection model based on probability distribution, and eliminating duplicate data by using a hash algorithm; and then performing data standardization; Artificial intelligence algorithm analysis module: Use the fusion neural network algorithm to learn and analyze the pre-processed data. The algorithm integrates the long short-term memory network (MG-LSTM) and the convolutional neural network (PT-CNN); The MG-LSTM formula is as follows: i t =σ(W xi x t +W hi h t-1 +W ci c t-1 +b i ) f t =σ(W xf x t +W hf h t-1 +W cf c t-1 +b f ) g t =tanh(W xg x t +W hg h t-1 +W cg c t-1 +b g ) o t =σ(W xo x t +W ho h t-1 +W co c t-1 +b o ) c t =f t c t-1 +i t g t h t =o t fishy t ) Among them, i t 、f t , g t , o t are the activation values ​​of the input gate, forget gate, candidate memory unit, and output gate, respectively. σ is the sigmoid function, tanh is the hyperbolic tangent function, and x t is the input vector at the current moment, h t-1 is the hidden state at the previous moment, c t-1 is the memory unit of the previous moment. MG-LSTM additionally introduces the power business relevance gate r t and risk importance gates t ; r t =σ(W xr x t +W hr h t-1 +W cr c t-1 +b r ) s t =σ(W xs x t +W hs h t-1 +W cs c t-1 +b s ) c t =(f t c t-1 +i t g t )×r t ×s t Parameters W and b determination method: W related to traditional LSTM xi , W hi , W ci 、b i The parameters are initialized by training the subset of data with time series characteristics and marked security events in the historical data of the power information network using the back propagation algorithm. The newly introduced W xr、 W hr , W cr The importance level is divided according to the degree of impact on the continuity and stability of power supply. The safety risk level is determined according to the degree of loss to the power system caused by historical safety accidents. The weight is allocated according to the power business and safety risk quantitative indicators. For example, the key power dispatching business is t The data on risk factors with high medium weight and causing major power outages are in s t Medium weight is high; PT-CNN: PT-CNN is designed based on the spatial characteristics of power information network data. In the convolution layer, the power network topology is G = (V, E), where V is the node set, E is the edge set, and node v i The connectivity is d(v i ), the convolution kernel size k is determined according to the statistical distribution of node connectivity, the step size s is determined according to the network hierarchy, the convolution kernel weight is determined by the joint analysis of the power network topology and historical security events, the initial value of the convolution kernel weight corresponding to the edge connecting key equipment is high, and the convolution kernel weight related to the network area frequently involved in historical security events is optimized during training; Fusion model: The outputs of MG-LSTM and PT-CNN are fused. The fusion formula is: F=α×MG-LSTM output +β×PT-CNN output Among them, α and β are fusion weights, which are obtained through collaborative training of a large amount of power information network data with labeled safety risk levels. During the training, the weights are dynamically adjusted according to the contribution of the two algorithms to the accuracy of risk assessment. Risk assessment module: Based on the fusion results, the current power information network security risk level is assessed using an assessment model based on fuzzy logic. The model maps the fusion results to fuzzy sets. The fuzzy set membership function is determined according to the physical meaning of power information network security risks and industry standards. For example, risk factors that may cause power outages have high weights in the high-risk membership function, and the security risk level is obtained through fuzzy reasoning and defuzzification operations. Prediction model: Use the trained model to predict future power information network security threats. The prediction model combines the Markov chain Monte Carlo method with the above-mentioned fusion neural network algorithm. The MCMC method models the time series and spatial feature change trends of power information network data, and the fusion neural network algorithm results are used as prior information. The prediction formula is: P(S t+1 |S t ,D)=∫P(S t+1 |S t ,θ)P(θ|D)dθ Among them, P(S t+1 |S t ,D) is in the current state S t and data D, the security threat state S at the future time t+1 t+1 The probability of θ is the model parameter, P(S t+1 |S t ,θ) is the conditional probability based on the model parameters, P(θ|D) is the posterior probability of the parameters, and prediction is achieved by determining the model parameters and probability distribution through training with a large amount of historical and real-time data.

Images