Intelligent detection method and system for security vulnerabilities of terminal layer of power internet of things

Abstract

The invention discloses an intelligent detection method and system for security vulnerabilities of a terminal layer of an electric power internet of things, and relates to the technical field of security protection of the electric power internet of things, and the method comprises the steps: collecting multi-dimensional information and network traffic characteristics of terminal equipment of the electric power internet of things, constructing an equipment fingerprint database, carrying out the comparison verification of the equipment, and obtaining a security vulnerability of the terminal layer of the electric power internet of things according to a verification result; the method comprises the following steps: classifying network traffic, identifying an abnormal traffic sequence, extracting behavior parameters of network traffic abnormity and network access abnormity, carrying out association analysis on the abnormal parameters, labeling equipment, and generating a security vulnerability detection report. The technical problem that potential security vulnerabilities are difficult to find and repair in time due to the fact that complex abnormal behaviors in a device layer and network traffic cannot be effectively recognized and handled in the prior art is solved, real-time and accurate security vulnerability detection is achieved by constructing a device fingerprint database and carrying out traffic classification and abnormal behavior analysis, and the security vulnerability detection efficiency is improved. Therefore, the technical effect of improving the security of the terminal layer of the power Internet of Things is achieved.

Description

Technical Field

[0001] The present invention relates to the field of power Internet of Things security protection technology, and in particular to a method and system for intelligent detection of security vulnerabilities in the terminal layer of the power Internet of Things. Background Art

[0002] With the rapid development of power Internet of Things (IoT) technology, the intelligence and automation of power systems are constantly improving, and terminal devices play a vital role in the IoT. However, due to the complex interconnection between devices and the transmission of large amounts of data, the IoT system faces serious security risks.

[0003] Existing security protection methods primarily focus on the network or device level and typically rely on static rules and signature libraries for traffic monitoring, making them unable to adapt to dynamically changing attack patterns. Furthermore, existing technologies lack comprehensive analysis of device behavior and network traffic, making it difficult to effectively identify abnormal behavior or potential vulnerabilities at the device and network layers, resulting in the delay in timely detection and remediation of security risks. Therefore, using intelligent methods to conduct comprehensive, real-time analysis of device behavior and network traffic to identify and remediate security vulnerabilities has become a major challenge in the security protection of the power Internet of Things. Summary of the Invention

[0004] This application provides an intelligent detection method and system for security vulnerabilities at the terminal layer of the power Internet of Things, which is used to solve the technical problem that existing technologies are unable to effectively identify and respond to complex abnormal behaviors in the device layer and network traffic, resulting in potential security vulnerabilities being difficult to discover and repair in a timely manner.

[0005] The first aspect of the present application provides an intelligent detection method for security vulnerabilities in the terminal layer of the power Internet of Things, the method comprising: collecting multi-dimensional information of devices in the terminal layer of the power Internet of Things, capturing network traffic information of devices in the terminal layer of the power Internet of Things for feature extraction, and constructing a device fingerprint library based on network traffic features combined with the multi-dimensional information; performing device comparison and verification through the device fingerprint library, classifying the network traffic information according to the verification results, identifying abnormal traffic sequences, analyzing according to the abnormal traffic sequences, and obtaining multiple abnormal parameters, the multiple abnormal parameters including network traffic abnormality parameters and network access abnormal behavior parameters; performing correlation analysis based on the network traffic abnormality parameters and the network access abnormal behavior parameters, marking the devices in the terminal layer of the power Internet of Things according to the correlation results, and generating a security vulnerability detection report.

[0006] The second aspect of the present application provides an intelligent detection system for security vulnerabilities in the terminal layer of the power Internet of Things, the system comprising: a device fingerprint library construction module, the device fingerprint library construction module is used to collect multi-dimensional information of devices in the terminal layer of the power Internet of Things, capture network traffic information of devices in the terminal layer of the power Internet of Things for feature extraction, and construct a device fingerprint library based on network traffic features combined with the multi-dimensional information; an abnormal parameter identification module, the abnormal parameter identification module is used to perform device comparison and verification through the device fingerprint library, classify the network traffic information according to the verification results, identify abnormal traffic sequences, analyze according to the abnormal traffic sequences, and obtain multiple abnormal parameters, the multiple abnormal parameters including network traffic abnormal parameters and network access abnormal behavior parameters; a security vulnerability detection module, the security vulnerability detection module is used to perform correlation analysis based on the network traffic abnormal parameters and the network access abnormal behavior parameters, mark the devices in the terminal layer of the power Internet of Things according to the correlation results, and generate a security vulnerability detection report.

[0007] One or more technical solutions provided in this application have at least the following technical effects or advantages: The present application provides an intelligent detection method and system for security vulnerabilities at the terminal layer of the power Internet of Things, which relate to the technical field of security protection of the power Internet of Things. By collecting multi-dimensional information and network traffic characteristics of power Internet of Things terminal devices, a device fingerprint library is constructed and device comparison and verification are performed. According to the verification results, network traffic is classified, and network traffic anomalies and network access abnormal behavior parameters are identified and extracted. By correlation analysis of these abnormal parameters, the devices are labeled and a security vulnerability detection report is generated. This solves the technical problem that the existing technology cannot effectively identify and respond to complex abnormal behaviors in the device layer and network traffic, resulting in potential security vulnerabilities being difficult to discover and repair in a timely manner. It realizes accurate security vulnerability detection and risk assessment by constructing a device fingerprint library and performing traffic classification and abnormal behavior analysis, thereby improving the real-time and accuracy of security protection at the terminal layer of the power Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0009] Figure 1 A flow chart of the intelligent detection method for security vulnerabilities at the terminal layer of the power Internet of Things provided in an embodiment of the present application; Figure 2 Schematic diagram of the structure of the intelligent detection system for terminal-layer security vulnerabilities in the power Internet of Things provided in an embodiment of the present application.

[0010] Description of the accompanying drawings: device fingerprint library construction module 11, abnormal parameter identification module 12, security vulnerability detection module 13. DETAILED DESCRIPTION

[0011] This application provides an intelligent detection method and system for security vulnerabilities at the terminal layer of the power Internet of Things, which is used to solve the technical problem that existing technologies are unable to effectively identify and respond to complex abnormal behaviors in the device layer and network traffic, resulting in potential security vulnerabilities being difficult to discover and repair in a timely manner.

[0012] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0013] It should be noted that the terms "first", "second", etc. in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0014] Example 1, as Figure 1 As shown, the present application provides an intelligent detection method for security vulnerabilities at the terminal layer of the power Internet of Things, which includes: P10: Collect multi-dimensional information of devices in the power Internet of Things terminal layer, capture network traffic information of devices in the power Internet of Things terminal layer for feature extraction, and build a device fingerprint library based on network traffic features combined with the multi-dimensional information.

[0015] Furthermore, step P10 in the embodiment of the present application further includes: P11: Capture the network traffic information of the equipment in the terminal layer of the power Internet of Things through the mirror port. The network traffic information is a bidirectional network traffic data packet. Perform feature analysis according to the transmission time interval of the bidirectional network traffic data packet to generate network traffic features; P12: Perform noise reduction and deduplication processing based on the network traffic features to obtain a traffic feature sequence; P13: Encode and combine the multi-dimensional information according to the traffic feature sequence to construct a multi-dimensional fingerprint vector, perform similarity grouping based on the multi-dimensional fingerprint vector, and construct the device fingerprint library.

[0016] It should be understood that the first step of this application is to collect multi-dimensional information of devices in the terminal layer of the power Internet of Things, and build a device fingerprint library based on network traffic characteristics to achieve accurate identification and legitimacy judgment of the devices. Specifically, the multi-dimensional information includes the device's unique identification number, device manufacturer, model and firmware version information. The device's unique identification number is the unique identifier of the device, which is used to distinguish different devices; the device manufacturer and model information reflects the production background and technical specifications of the device; the firmware version information involves the software level of the device, which is an important basis for the realization of device functions and security protection. These information together constitute the basic identity characteristics of the device, providing an important basis for subsequent device identification and legitimacy judgment.

[0017] Specifically, the network traffic information of the devices in the terminal layer of the power Internet of Things is first captured through the mirror port. Network traffic information is a direct reflection of the communication behavior of the device in the network and contains rich behavioral characteristics. The network traffic information captured in this step is a bidirectional network traffic data packet, that is, it includes data packets sent and received by the device. By analyzing the bidirectional network traffic data packet, the network interaction behavior of the device can be fully understood. Based on the bidirectional network traffic data packet, feature analysis is performed according to the transmission time interval to generate network traffic features. The transmission time interval refers to the time interval for the transmission of the data packet in the network. This feature reflects the network communication rhythm and behavior pattern of the device. By analyzing the transmission time interval, the behavioral characteristics of the device in network communication can be extracted, laying the foundation for further feature extraction and analysis.

[0018] Next, noise reduction and deduplication are performed based on network traffic characteristics. Network traffic packets contain a wealth of information, with protocol type, port number, packet length, and transmission frequency being key features. The protocol type reflects the communication protocol followed by the packet and is the fundamental rule of network communication; the port number identifies the specific service interface of the device in network communication; the packet length reflects the amount of data transmitted per communication; and the transmission frequency reflects the frequency of device communication. Together, these features constitute the core characteristics of the device's network behavior. By hashing these features to generate a unique identifier, complex feature information can be converted into a concise and unique identifier, facilitating subsequent processing and analysis. Merging duplicate features based on a time window effectively removes duplicate feature information and reduces the interference of redundant data on analysis results. The deduplicated feature sequence is bound to the device's unique identification number to construct a traffic feature sequence. This process organically combines device identity with network behavior characteristics, providing a more comprehensive feature basis for accurate device identification.

[0019] Finally, the multi-dimensional information is encoded and combined according to the traffic feature sequence. Based on the encoded combination of device identity and behavioral features, a multi-dimensional fingerprint vector is constructed. The multi-dimensional fingerprint vector is a comprehensive reflection of the device identity and behavioral features. By encoding and combining the multi-dimensional information with the traffic feature sequence, a comprehensive and unique device feature vector can be generated. Similarity grouping is performed based on the multi-dimensional fingerprint vector to construct a device fingerprint library. Among them, similarity grouping is the process of classifying devices according to the similarity of multi-dimensional fingerprint vectors. By calculating the similarity between device fingerprints, the system can automatically group devices with similar network behaviors. Commonly used similarity measurement methods include Euclidean distance and cosine similarity, which can accurately identify whether there are significant differences in the network behavior of devices. Finally, the system established a device fingerprint library through similarity grouping. The library stores various information about the device, including device type, model, firmware version, and its network behavior characteristics.

[0020] In summary, this step achieves comprehensive identification and legitimacy verification of terminal-layer devices in the power IoT through a combined analysis of multi-dimensional device information and network traffic characteristics. This method not only accurately identifies device types but also analyzes their communication behavior, providing strong data support for subsequent security testing, risk assessment, and vulnerability identification.

[0021] Furthermore, step P13 of the embodiment of the present application further includes: P13-1: Analyze based on the multi-dimensional information and extract device model information and firmware version information; P13-2: Combine and encode the device model information and firmware version information to generate a device type label; P13-3: Map and analyze based on the multi-dimensional fingerprint vector and the device type label to construct a device fingerprint feature matrix; P13-4: Perform coarse clustering according to the device fingerprint feature matrix, determine the initial cluster center, calculate the similarity of the device fingerprint feature matrix according to the initial cluster center, and divide the device fingerprint category; P13-5: Construct a device fingerprint index table according to the device fingerprint category, associate and integrate the device fingerprint index table, and obtain the device fingerprint library.

[0022] Optionally, the operation process of step P13 may be further refined to achieve more accurate and efficient device fingerprint library construction.

[0023] First, the collected multi-dimensional information is parsed to extract the device model and firmware version information. The device model directly reflects the device's hardware characteristics, while the firmware version reflects the device's software configuration status. Both are key elements for device identification. By parsing multi-dimensional information, this basic information can be accurately obtained, providing data support for the subsequent generation of device type labels.

[0024] Next, the extracted device model information and firmware version information are combined and encoded. Specifically, the hardware model is mapped to a 3-digit industry classification code, which reflects the industry category of the device and facilitates subsequent classification management. Simultaneously, the firmware version number is concatenated with the industry classification code to generate a 16-bit device type tag. This tag is a compact representation of the device's identity, enabling quick differentiation between different device types and versions, and providing a standardized identifier for the construction of a device fingerprint library.

[0025] Subsequently, a mapping analysis is performed based on the multidimensional fingerprint vector and the device type label to construct a device fingerprint feature matrix. Specifically, the device type label and the multidimensional fingerprint vector are bitwise concatenated to generate a 128-dimensional composite fingerprint vector. This composite fingerprint vector integrates the device's identity information and behavioral characteristics, comprehensively reflecting the device's characteristics. The device fingerprint feature matrix is the core data structure of the device fingerprint library, enabling efficient device retrieval and classification.

[0026] Furthermore, coarse clustering is performed according to the device fingerprint feature matrix to determine the initial cluster centers. For example, the K-means++ algorithm can be used for coarse clustering. This algorithm can improve the efficiency and accuracy of clustering by optimizing the selection of initial cluster centers. At the same time, the number of initial cluster centers is determined according to the elbow rule. The elbow rule is a commonly used method for selecting the number of cluster centers. By observing the changing trend of the sum of squared errors (SSE) within the cluster, the inflection point where the error decreases most gently is found, thereby determining the number of clusters. This method ensures the validity of the clustering results and can better identify the similarities between devices. Once the initial cluster centers are determined, the system will perform similarity calculations on the device fingerprint feature matrix and divide the device fingerprints into different device fingerprint categories based on the similarity.

[0027] Finally, a device fingerprint index table is constructed according to device fingerprint category, and the device fingerprint index tables are linked and integrated to obtain the device fingerprint library. The device fingerprint index table is an index structure of device fingerprint categories. By indexing the data in the device fingerprint feature matrix according to category, it can achieve rapid retrieval and management of device fingerprints. Multiple device fingerprint index tables are linked and integrated to form a complete device fingerprint library. The device fingerprint library is a collection of device identity and behavioral characteristics. Through this library, it can achieve accurate identification and legitimacy determination of terminal-level devices in the power Internet of Things, providing strong protection for the safe operation of the power Internet of Things.

[0028] P20: Perform device comparison verification through the device fingerprint library, classify the network traffic information according to the verification result, identify abnormal traffic sequences, analyze according to the abnormal traffic sequences, and obtain multiple abnormal parameters, wherein the multiple abnormal parameters include network traffic abnormality parameters and network access abnormal behavior parameters.

[0029] Furthermore, step P20 in this embodiment of the present application further includes: P21: Perform divergence calculation based on the multi-dimensional fingerprint vector of the device in the terminal layer of the power Internet of Things and the device fingerprint library, perform comparative verification based on the divergence calculation result, and generate a verification result; P22: Classify the network traffic information based on the verification result, perform deviation analysis according to multiple traffic categories, and determine suspicious device traffic; P23: Perform session reorganization based on the suspicious device traffic, extract traffic session features, perform continuous detection according to the traffic session features, and determine continuous outliers; P24: Aggregate the continuous outliers according to the time window to determine the abnormal traffic sequence.

[0030] Specifically, after building the device fingerprint library, device verification is performed against the library. The core of this verification is to confirm the device's identity and legitimacy by comparing its fingerprint information. Specifically, a divergence calculation is performed based on the device's multidimensional fingerprint vector and the data in the device fingerprint library. KL divergence (Kullback-Leibler divergence) is used as a metric to calculate the degree of difference between the current device's multidimensional fingerprint vector and the fingerprint vectors of registered devices in the library. KL divergence is a statistical method that measures the difference between two probability distributions and effectively reflects the similarity or difference between device fingerprints. The divergence calculation results are used to compare and verify whether the current device matches any legitimate device in the library, generating a verification result. For example, if the current device's fingerprint is similar or identical to any device in the fingerprint library, the device is considered legitimate. Otherwise, the system further analyzes the device for abnormal behavior.

[0031] Based on the verification results, network traffic information is classified. Network traffic is divided into multiple traffic categories, such as normal traffic, known abnormal traffic, and unknown traffic. Deviation analysis is performed for each traffic category, comparing the degree of deviation between the current traffic characteristics and the normal traffic characteristics for that category. Deviation analysis determines whether there is traffic from suspicious devices. Suspicious device traffic refers to traffic that significantly deviates from normal traffic patterns and may indicate potential security threats or abnormal behavior.

[0032] For traffic from identified suspicious devices, further session reassembly is performed. Session reassembly involves reassembling scattered traffic packets into a logical sequence to restore the complete communication session. Through session reassembly, traffic session characteristics are extracted, including but not limited to session duration, data transfer volume, and interaction frequency. Based on these traffic session characteristics, continuous detection is performed to identify continuous outliers. Continuous outliers are data points whose traffic characteristics consistently deviate from the normal range within a certain time frame. These outliers may be a direct indicator of abnormal traffic.

[0033] Finally, the identified consecutive outliers are aggregated according to time windows. Time windows are a technique used to analyze time series data. By dividing and aggregating consecutive outliers along the time dimension, it is possible to more clearly identify patterns and regularities in abnormal traffic. Through time window aggregation, abnormal traffic sequences are ultimately identified. Abnormal traffic sequences are defined as those with persistently abnormal traffic characteristics and distinct patterns within a specific time range. These sequences are the focus of further analysis and processing.

[0034] Through the above steps, the embodiment of the present application realizes a complete process from device comparison and verification to abnormal traffic sequence identification, which can efficiently identify and analyze the network abnormal traffic of the power Internet of Things terminal devices, thereby effectively detecting potential security vulnerabilities and ensuring the network security of the power Internet of Things.

[0035] Furthermore, according to the abnormal traffic sequence, multiple abnormal parameters are obtained. Step P20 of the embodiment of the present application further includes: P25: Extract traffic timing characteristics, perform bandwidth utilization analysis on the devices at the terminal layer of the power Internet of Things based on the abnormal traffic sequence combined with the traffic timing characteristics, and determine network traffic anomaly parameters, which include bandwidth utilization deviation; P26: Construct a device communication topology diagram, perform propagation analysis on the devices at the terminal layer of the power Internet of Things according to the abnormal traffic sequence combined with the device communication topology diagram, and determine network access abnormal behavior parameters, which include abnormal lateral propagation paths; P27: Conduct confrontation based on the bandwidth utilization deviation and the abnormal lateral propagation path, reconstruct the traffic pattern for error calculation, and generate an anomaly score; P28: According to the anomaly score, fuse the bandwidth utilization deviation and the abnormal lateral propagation path to construct the multiple anomaly parameters.

[0036] In a possible embodiment of the present application, step P20 further expands the analysis process of abnormal traffic sequences by extracting multiple abnormal parameters to more comprehensively evaluate the network behavior of the terminal layer devices of the power Internet of Things.

[0037] Specifically, after the identification of abnormal traffic sequences is completed, these sequences are further analyzed in depth to extract multiple abnormal parameters. First, the traffic time series features are extracted. These features reflect the changing patterns of traffic in the time series, such as the periodicity and burstiness of traffic. Combining the abnormal traffic sequences and traffic time series features, the bandwidth utilization of the devices at the terminal layer of the power Internet of Things is analyzed. By analyzing the bandwidth usage of the devices during the abnormal traffic period, the network traffic anomaly parameters are determined, among which the key indicator is the bandwidth utilization deviation. The bandwidth utilization deviation refers to the degree of difference between the bandwidth utilization of the device during the abnormal traffic period and the bandwidth utilization under normal conditions. This parameter can intuitively reflect the device's occupation of bandwidth resources during the network traffic anomaly.

[0038] Furthermore, a device communication topology diagram was constructed. This diagram reflects the communication relationships and network structure between devices in the terminal layer of the Power Internet of Things, demonstrating how each device exchanges information through different paths. Device propagation analysis was performed by combining the abnormal traffic sequence and the device communication topology diagram. By analyzing the propagation paths of abnormal traffic between devices, parameters of abnormal network access behavior were identified, with abnormal lateral propagation paths being the key indicator. Abnormal lateral propagation paths refer to abnormal communication paths between devices during periods of abnormal traffic flow, which may indicate malicious behavior or abnormal interactions between devices.

[0039] Next, adversarial analysis is performed based on bandwidth utilization deviations and abnormal lateral propagation paths, and traffic patterns are reconstructed. This adversarial analysis simulates different traffic attack patterns and variations in normal traffic patterns, helping the system identify possible sources of attack or abnormal behavior. After reconstructing the traffic pattern, the system uses error calculation to evaluate the difference between the reconstructed traffic pattern and the actual traffic flow, generating an anomaly score. This score quantifies the severity of the device's abnormal behavior. A higher score indicates a greater deviation from normal behavior and a greater potential security risk.

[0040] Finally, based on the anomaly score, the bandwidth utilization deviation and the abnormal lateral propagation path are combined to construct multiple anomaly parameters. These anomaly parameters not only include single traffic anomaly indicators but also encompass the abnormal behavior characteristics of the device within the network topology. By integrating these parameters, a more comprehensive assessment of the device's network behavior anomalies can be achieved, providing richer data support for subsequent security vulnerability identification and risk assessment.

[0041] Furthermore, step P28 of the embodiment of the present application further includes: P28-1: Construct a three-dimensional feature space, perform joint calculations based on the three-dimensional feature space, and determine the feature joint probability distribution data; P28-2: Based on the feature joint probability distribution data, map the anomaly score, the bandwidth utilization deviation, and the abnormal lateral propagation path to the three-dimensional feature space for spatiotemporal alignment, perform weight allocation according to the spatiotemporal alignment results, and determine multiple weight coefficients; P28-3: Combined with the anomaly score, the bandwidth utilization deviation and the abnormal lateral propagation path are fused according to the multiple weight coefficients to construct the multiple anomaly parameters.

[0042] Optionally, the fusion process of multiple abnormal parameters can be further refined to achieve a comprehensive evaluation of abnormal parameters by constructing a three-dimensional feature space and a weight distribution mechanism.

[0043] First, after the anomaly score is generated, a three-dimensional feature space is constructed. In this three-dimensional space, the X-axis represents the anomaly score value, which is used to quantify the degree of abnormality of the device behavior; the Y-axis represents the bandwidth deviation, which reflects the degree of deviation between the device bandwidth utilization and the normal value; the Z-axis represents the propagation path risk level, which is used to measure whether there is an abnormal propagation pattern in the communication path between the device and other devices. These three dimensions together describe the network behavior of the device, including the degree of abnormality of its communication, the usage of bandwidth resources, and the security of the data propagation path. Based on the three-dimensional feature space, the anomaly score, bandwidth utilization deviation, and propagation path risk level are jointly calculated to determine the feature joint probability distribution data. The feature joint probability distribution data reflects the distribution pattern of these three features in the three-dimensional space, providing a basis for subsequent spatiotemporal alignment and weight allocation.

[0044] Next, based on the joint probability distribution data of the features, the anomaly score, bandwidth utilization deviation, and abnormal lateral propagation path are mapped to the three-dimensional feature space. Through the mapping operation, these feature values are converted into coordinate points in three-dimensional space. Weights are then assigned based on the spatiotemporal alignment results. Spatiotemporal alignment involves adjusting the weight coefficients of the feature values based on their positional relationships in three-dimensional space to reflect the importance of different features in the assessment of abnormal behavior. Through spatiotemporal alignment, multiple weight coefficients are determined, which are used in the subsequent parameter fusion process.

[0045] Finally, combined with the anomaly score, the bandwidth utilization deviation and abnormal lateral propagation path are fused according to the multiple weight coefficients. Specifically, each feature is weighted according to the weight coefficient, and then the weighted feature values are comprehensively calculated to construct the multiple anomaly parameters. These anomaly parameters integrate the feature information of the anomaly score, bandwidth utilization deviation, and abnormal lateral propagation path, and can more comprehensively reflect the abnormal network behavior of the device. Through this fusion method, not only the original information of each feature is retained, but the importance of key features is also highlighted through the weight distribution mechanism, thereby improving the accuracy and reliability of the anomaly parameters.

[0046] P30: Perform correlation analysis based on the network traffic anomaly parameters and the network access anomaly behavior parameters, mark the devices at the power Internet of Things terminal layer according to the correlation results, and generate a security vulnerability detection report.

[0047] Furthermore, step P30 in the embodiment of the present application further includes: P31: Perform correlation analysis based on the network traffic anomaly parameters and the network access anomaly behavior parameters to construct a multidimensional correlation matrix; P32: Calculate the dynamic correlation coefficients between the network traffic anomaly parameters and the network access anomaly behavior parameters based on the multidimensional correlation matrix; P33: Retrieve the historical behavior baseline based on the device fingerprint library to evaluate the correlation influence weights of the network traffic anomaly parameters and the network access anomaly behavior parameters; P34: Perform multidimensional vulnerability matching on the network traffic anomaly parameters and the network access anomaly behavior parameters according to the dynamic correlation coefficient combined with the correlation influence weight, and generate multiple data labels, wherein the multiple data labels include security vulnerability type labels and vulnerability risk level labels; P35: Use the vulnerability risk level labels to label and analyze the devices at the terminal layer of the power Internet of Things to generate a dynamic risk score, which has vulnerability location information; P36: Formulate repair priority recommendations based on the dynamic risk score combined with the security vulnerability type label, and generate the security vulnerability detection report according to the vulnerability location information and the repair priority recommendations.

[0048] It should be understood that through the correlation analysis of network traffic anomaly parameters and network access abnormal behavior parameters, a multi-dimensional analysis matrix is constructed to evaluate the security of power Internet of Things terminal devices.

[0049] After extracting and integrating abnormal parameters, we first conduct correlation analysis based on abnormal network traffic parameters and abnormal network access behavior parameters. By constructing a multidimensional correlation matrix, we integrate different types of abnormal parameters to form a comprehensive view of abnormal behavior correlation. The multidimensional correlation matrix can include dimensions such as abnormal parameter type, device ID, and timestamp, enabling analysis of relationships between abnormal parameters from multiple perspectives.

[0050] Next, based on the multidimensional correlation matrix, the dynamic correlation coefficients between abnormal network traffic parameters and abnormal network access behavior parameters are calculated. The dynamic correlation coefficient reflects the strength of the correlation between different abnormal parameters and can be dynamically adjusted based on time series changes. By calculating the dynamic correlation coefficient, significant correlations between abnormal parameters can be identified, providing a basis for further vulnerability matching.

[0051] Furthermore, based on the device fingerprint database, historical behavior baselines are retrieved to assess the associated impact weights of abnormal network traffic parameters and abnormal network access behavior parameters. Historical behavior baselines represent the behavioral characteristics of devices during normal operation. By comparing these with current abnormal parameters, the impact of these abnormal parameters on normal device operation can be assessed. The associated impact weights reflect the importance of each abnormal parameter in the overall security assessment. By combining historical behavior baselines, these weights can be more accurately determined.

[0052] Subsequently, a multi-dimensional vulnerability matching is performed on the parameters of abnormal network traffic and abnormal network access behavior based on the dynamic correlation coefficient combined with the associated impact weight. This matching process generates multiple data labels, including security vulnerability type labels and vulnerability risk level labels. The security vulnerability type label identifies the specific vulnerability type, such as buffer overflow and SQL injection; the vulnerability risk level label categorizes the vulnerability by severity, such as high risk, medium risk, and low risk. These data labels provide the foundation for subsequent security vulnerability annotation.

[0053] Next, vulnerability risk level labels are applied to devices at the power IoT terminal layer to generate a dynamic risk score. This dynamic risk score not only considers the severity of the vulnerability itself but also incorporates the risk of the vulnerability's location. Power IoT devices face varying risks depending on their location within the network. Therefore, the dynamic risk score more accurately reflects the device's overall security risk level and includes vulnerability location information, effectively establishing a correlation between the score and the vulnerability's location.

[0054] Finally, based on the dynamic risk score and security vulnerability type tags, remediation priority recommendations are developed. These remediation priority recommendations guide operations and maintenance personnel to prioritize high-risk vulnerabilities, thereby improving the efficiency of security vulnerability remediation. Based on the vulnerability location information and remediation priority recommendations, a security vulnerability detection report is generated. This report details the vulnerability status, vulnerability risk level, remediation recommendations, and corresponding remediation priority for each device, providing a complete security vulnerability analysis and remediation plan.

[0055] Through the above steps, the present embodiment implements a complete process from abnormal parameter correlation analysis to security vulnerability detection report generation. This process provides accurate data support for security management in the IoT environment, helping device managers to promptly discover and fix potential security vulnerabilities, thereby improving the overall security of the system.

[0056] Furthermore, step P31 of the embodiment of the present application further includes: P31-1: Perform time domain alignment on the network traffic anomaly parameters and the network access anomaly behavior parameters to obtain parameter alignment results; P31-2: According to the parameter alignment results, fill in the network traffic anomaly parameters as matrix rows and fill in the network access anomaly behavior parameters as matrix columns, and extract multiple pairs of parameter groups based on the matrix rows and the matrix columns; P31-3: Perform distance calculation based on the multiple pairs of parameter groups to obtain time-regularized distances, and use the time-regularized distances as the initial element values of the matrix; P31-4: Perform causal tests on the network traffic anomaly parameters and the network access anomaly behavior parameters to generate causal correlation strength; P31-5: Use the causal correlation strength as a directed weight edge and combine it with the initial element values of the matrix to construct the multidimensional correlation matrix.

[0057] Specifically, the construction process of the multidimensional correlation matrix can be further refined, and through operations such as time domain alignment, parameter group extraction, distance calculation, and causal testing, refined correlation analysis of network traffic anomaly parameters and network access anomaly behavior parameters can be achieved.

[0058] First, the parameters of abnormal network traffic and abnormal network access behavior are aligned in the time domain. Since these two parameters may originate from different time series and have different sampling frequencies and timestamps, they need to be aligned to the same time base through time domain alignment. Specifically, a common time window is selected and the two parameter series are interpolated or resampled within this time window to obtain the parameter alignment result. This process ensures temporal consistency between the parameters in subsequent analysis, laying the foundation for accurate correlation analysis.

[0059] Next, based on the parameter alignment results, the network traffic anomaly parameters are entered as matrix rows, and the network access anomaly behavior parameters are entered as matrix columns. This constructs a preliminary matrix framework, where the rows and columns represent different parameter types. Based on the intersection points of the matrix rows and columns, multiple pairs of parameter groups are extracted, each consisting of the points where the rows and columns intersect. This process cross-combines the network traffic anomaly parameters and the network access anomaly behavior parameters, providing the data foundation for subsequent distance calculation and correlation analysis.

[0060] Furthermore, distance calculation is performed based on the multiple pairs of parameter groups. Specifically, the distance between each pair of parameter groups is calculated, for example, Euclidean distance, Manhattan distance or other suitable measurement methods can be used. Through distance calculation, a time-warped distance is obtained, which reflects the similarity or difference between the parameter groups in the time series. The time-warped distance is used as the initial element value of the matrix and filled into the multidimensional association matrix. This process provides a quantitative basis for subsequent association strength analysis.

[0061] Furthermore, causal testing is performed on the parameters of abnormal network traffic and abnormal network access behavior. The purpose of causal testing is to determine whether a causal relationship exists between two parameters and the strength of the causal relationship. Granger causality tests or other causal analysis methods can be used to generate causal association strength. Causal association strength is a quantitative indicator used to measure whether changes in one parameter significantly affect changes in another. Through this process, the system can provide a higher level of causal understanding for subsequent analysis, allowing correlation analysis to go beyond superficial statistical relationships and delve into the actual causal relationships between parameters.

[0062] Finally, the causal association strength is used as a directed weighted edge, combined with the initial element values of the matrix to construct the multidimensional association matrix. Specifically, the causal association strength is used as a directed weighted edge between the elements in the matrix to represent the direction and strength of the causal relationship between the parameters. Combined with the time-warped distance (the initial element value of the matrix), a multidimensional association matrix is constructed. Each element in the matrix contains dual information of time difference and causal relationship, so that the entire matrix can more accurately reflect the complex interactions and influences between network traffic and access behavior. Through the construction of the multidimensional association matrix, the system can identify potential security vulnerabilities and abnormal behavior patterns, providing a more accurate basis for subsequent security detection and risk assessment.

[0063] Furthermore, step P31-4 of the embodiment of the present application also includes: P31-41: According to the parameter alignment result, the network traffic anomaly parameters and the network access anomaly behavior parameters are processed for stability, and a multi-dimensional time series data set is constructed; P31-42: Causal calculations are performed on the network traffic anomaly parameters and the network access anomaly behavior parameters based on the multi-dimensional time series data set, and a directed causal network topology graph is constructed; P31-43: The causal direction of the directed causal network topology graph is verified, and the weight of the directed causal network topology graph is optimized according to the causal direction verification result to construct the causal correlation strength.

[0064] Optionally, the process of constructing the causal correlation strength can be further refined, and through operations such as stationarity processing, causal calculation, and weight optimization, an accurate analysis of the causal relationship between abnormal network traffic parameters and abnormal network access behavior parameters can be achieved.

[0065] First, based on the parameter alignment results, the parameters of abnormal network traffic and abnormal network access behavior are subjected to stationarity processing. Stationarity processing is a critical step in time series analysis, as non-stationary time series data can lead to misjudgments of causal relationships. Specifically, the original parameter series can be converted into a stationary time series through differencing, logarithmic transformation, or other stationarization methods. This constructs a multidimensional time series dataset containing the stationarized parameters of abnormal network traffic and abnormal network access behavior. This dataset provides a stable data foundation for subsequent causal calculations and ensures the reliability of the analysis results.

[0066] Next, based on a multi-dimensional time series dataset, causal calculations are performed on the parameters of abnormal network traffic and abnormal network access behavior. The purpose of causal calculations is to determine whether a causal relationship exists between parameters and the direction of that relationship. Granger causality tests, transfer entropy, or other causal analysis methods can be used to quantify the causal relationship between parameters. Through causal calculations, a directed causal network topology is constructed, with nodes representing parameters and directed edges representing the direction of causal relationships. This directed causal network topology intuitively displays the causal network structure between parameters, providing a foundation for further verification of causal direction and weight optimization.

[0067] Furthermore, the directed causal network topology is validated for causal direction. This verification aims to verify the rationality of the directions of directed edges and avoid erroneous causal relationships caused by data noise or statistical errors. For example, it can be determined whether network traffic anomalies lead to changes in access behavior, or vice versa. The causal direction in the directed causal network topology can be verified using cross-validation, causal inference algorithms (such as the PC algorithm or FCI algorithm), or other verification methods. Based on the causal direction verification results, the directed causal network topology is weighted and optimized. Weight optimization aims to assign different weights to directed edges based on the strength and reliability of the causal relationships. For example, the weights of each edge in the network are adjusted based on the importance of the causal relationship. Edges with larger weights represent more influential causal relationships, while edges with smaller weights represent weaker associations. Through weight optimization, the causal correlation strength is constructed. This strength not only reflects the direction of the causal relationship between parameters but also quantifies the strength of the causal relationship. This more accurately describes the causal relationship between parameters and provides a more reliable basis for the subsequent construction of a multidimensional correlation matrix.

[0068] This process provides a solid foundation for subsequent security vulnerability detection and risk assessment, enabling more accurate identification and response to abnormal device behavior.

[0069] In summary, the embodiments of the present application have at least the following technical effects: This application collects multi-dimensional information and network traffic information of terminal-layer devices in the power Internet of Things, extracts features and builds a device fingerprint library, uses the fingerprint library to compare and verify devices, classifies network traffic and identifies abnormal traffic sequences, analyzes and obtains abnormal network traffic parameters and abnormal network access behavior parameters, further labels devices through correlation analysis, and generates security vulnerability detection reports.

[0070] The technical effect of achieving accurate security vulnerability detection and risk assessment by building a device fingerprint library and performing traffic classification and abnormal behavior analysis has been achieved, thereby improving the real-time and accuracy of security protection.

[0071] Example 2, based on the same inventive concept as the intelligent detection method for security vulnerabilities at the terminal layer of the power Internet of Things in the previous embodiment, Figure 2 As shown, this application provides an intelligent detection system for security vulnerabilities at the terminal layer of the power Internet of Things. The system and method embodiments in the embodiments of this application are based on the same inventive concept. The system includes: The device fingerprint library construction module 11 is used to collect multi-dimensional information of devices in the power Internet of Things terminal layer, capture the network traffic information of devices in the power Internet of Things terminal layer for feature extraction, and construct a device fingerprint library based on the network traffic characteristics and the multi-dimensional information.

[0072] The abnormal parameter identification module 12 is used to perform device comparison verification through the device fingerprint library, classify the network traffic information according to the verification result, identify abnormal traffic sequences, analyze according to the abnormal traffic sequences, and obtain multiple abnormal parameters, wherein the multiple abnormal parameters include network traffic abnormality parameters and network access abnormal behavior parameters.

[0073] The security vulnerability detection module 13 is used to perform correlation analysis based on the network traffic anomaly parameters and the network access abnormal behavior parameters, mark the devices at the terminal layer of the power Internet of Things according to the correlation results, and generate a security vulnerability detection report.

[0074] Furthermore, the device fingerprint library construction module 11 is further configured to perform the following steps: The network traffic information of the equipment in the terminal layer of the power Internet of Things is captured through the mirror port. The network traffic information is a bidirectional network traffic data packet. Feature analysis is performed on the bidirectional network traffic data packet according to the transmission time interval to generate network traffic features; noise reduction and deduplication processing is performed based on the network traffic features to obtain a traffic feature sequence; the multi-dimensional information is encoded and combined according to the traffic feature sequence to construct a multi-dimensional fingerprint vector, and similarity grouping is performed based on the multi-dimensional fingerprint vector to construct the device fingerprint library.

[0075] Furthermore, the device fingerprint library construction module 11 is further configured to perform the following steps: Based on the multi-dimensional information, analysis is performed to extract device model information and firmware version information; the device model information and firmware version information are combined and encoded to generate a device type label; mapping analysis is performed based on the multi-dimensional fingerprint vector and the device type label to construct a device fingerprint feature matrix; coarse clustering is performed according to the device fingerprint feature matrix to determine the initial cluster center, and similarity calculation is performed on the device fingerprint feature matrix based on the initial cluster center to divide the device fingerprint category; a device fingerprint index table is constructed according to the device fingerprint category, and the device fingerprint index table is associated and integrated to obtain the device fingerprint library.

[0076] Furthermore, the abnormal parameter identification module 12 is further configured to perform the following steps: A divergence calculation is performed based on the multidimensional fingerprint vector of the device in the terminal layer of the power Internet of Things and the device fingerprint library, and a comparison and verification is performed based on the divergence calculation result to generate a verification result; the network traffic information is classified according to the verification result, and deviation analysis is performed according to multiple traffic categories to determine suspicious device traffic; session reorganization is performed based on the suspicious device traffic, traffic session features are extracted, continuous detection is performed according to the traffic session features, and continuous outliers are determined; the continuous outliers are aggregated according to the time window to determine the abnormal traffic sequence.

[0077] Furthermore, the abnormal parameter identification module 12 is further configured to perform the following steps: Extract traffic timing characteristics, perform bandwidth utilization analysis on the devices at the terminal layer of the power Internet of Things based on the abnormal traffic sequence in combination with the traffic timing characteristics, and determine network traffic anomaly parameters, wherein the network traffic anomaly parameters include bandwidth utilization deviation; construct a device communication topology diagram, perform propagation analysis on the devices at the terminal layer of the power Internet of Things according to the abnormal traffic sequence in combination with the device communication topology diagram, and determine network access abnormal behavior parameters, wherein the network access abnormal behavior parameters include abnormal lateral propagation paths; conduct confrontation based on the bandwidth utilization deviation and the abnormal lateral propagation path, reconstruct the traffic pattern for error calculation, and generate an anomaly score; according to the anomaly score, fuse the bandwidth utilization deviation and the abnormal lateral propagation path to construct the multiple anomaly parameters.

[0078] Furthermore, the abnormal parameter identification module 12 is further configured to perform the following steps: Construct a three-dimensional feature space, perform joint calculations based on the three-dimensional feature space, and determine feature joint probability distribution data; based on the feature joint probability distribution data, map the anomaly score, the bandwidth utilization deviation, and the abnormal lateral propagation path to the three-dimensional feature space for spatiotemporal alignment, perform weight allocation according to the spatiotemporal alignment result, and determine multiple weight coefficients; in combination with the anomaly score, fuse the bandwidth utilization deviation and the abnormal lateral propagation path according to the multiple weight coefficients to construct the multiple anomaly parameters.

[0079] Furthermore, the security vulnerability detection module 13 is further configured to perform the following steps: Based on the network traffic anomaly parameters and the network access anomaly behavior parameters, correlation analysis is performed to construct a multidimensional correlation matrix; based on the multidimensional correlation matrix, the dynamic correlation coefficients of the network traffic anomaly parameters and the network access anomaly behavior parameters are calculated; based on the device fingerprint library, the historical behavior baseline is retrieved to evaluate the correlation influence weights of the network traffic anomaly parameters and the network access anomaly behavior parameters; according to the dynamic correlation coefficient combined with the correlation influence weight, multidimensional vulnerability matching is performed on the network traffic anomaly parameters and the network access anomaly behavior parameters to generate multiple data labels, and the multiple data labels include security vulnerability type labels and vulnerability risk level labels; the vulnerability risk level labels are used to label and analyze the devices at the terminal layer of the power Internet of Things to generate a dynamic risk score, and the dynamic risk score has vulnerability location information; based on the dynamic risk score combined with the security vulnerability type label, a repair priority recommendation is formulated, and the security vulnerability detection report is generated according to the vulnerability location information and the repair priority recommendation.

[0080] Furthermore, the security vulnerability detection module 13 is further configured to perform the following steps: The network traffic anomaly parameters and the network access anomaly behavior parameters are aligned in time domain to obtain parameter alignment results; according to the parameter alignment results, the network traffic anomaly parameters are filled in as matrix rows, and the network access anomaly behavior parameters are filled in as matrix columns, and multiple pairs of parameter groups are extracted based on the matrix rows and the matrix columns; distance calculation is performed based on the multiple pairs of parameter groups to obtain time-regularized distances, and the time-regularized distances are used as initial element values of the matrix; causal tests are performed on the network traffic anomaly parameters and the network access anomaly behavior parameters to generate causal correlation strengths; the causal correlation strengths are used as directed weight edges, and combined with the initial element values of the matrix to construct the multidimensional correlation matrix.

[0081] Furthermore, the security vulnerability detection module 13 is further configured to perform the following steps: According to the parameter alignment result, the network traffic anomaly parameters and the network access anomaly behavior parameters are processed for stationarity to construct a multidimensional time series data set; based on the multidimensional time series data set, causal calculations are performed on the network traffic anomaly parameters and the network access anomaly behavior parameters to construct a directed causal network topology graph; causal direction verification is performed on the directed causal network topology graph, and weight optimization is performed on the directed causal network topology graph according to the causal direction verification result to construct the causal correlation strength.

[0082] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

[0084] This specification and drawings are merely illustrative of the present application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of this application. Thus, this application is intended to include such modifications and variations as fall within the scope of this application and its equivalents.

Claims

1. An intelligent detection method for security vulnerabilities at the terminal layer of the power Internet of Things, characterized by: The method comprises: Collect multi-dimensional information of devices in the power Internet of Things terminal layer, capture network traffic information of devices in the power Internet of Things terminal layer for feature extraction, and build a device fingerprint library based on network traffic features combined with the multi-dimensional information; Performing device comparison verification through the device fingerprint library, classifying the network traffic information according to the verification result, identifying abnormal traffic sequences, and analyzing the abnormal traffic sequences to obtain multiple abnormal parameters, wherein the multiple abnormal parameters include network traffic abnormality parameters and network access abnormal behavior parameters; Based on the network traffic anomaly parameters and the network access anomaly behavior parameters, correlation analysis is performed, and the devices at the terminal layer of the power Internet of Things are marked according to the correlation results to generate a security vulnerability detection report.

2. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 1 is characterized in that: Collecting multi-dimensional information of devices in the power Internet of Things terminal layer, capturing network traffic information of devices in the power Internet of Things terminal layer for feature extraction, and building a device fingerprint library based on network traffic features combined with the multi-dimensional information, the method includes: Capturing network traffic information of devices in the terminal layer of the power Internet of Things through a mirrored port, the network traffic information is a bidirectional network traffic data packet, and performing feature analysis on the bidirectional network traffic data packet according to the transmission time interval to generate network traffic features; Performing noise reduction and deduplication processing based on the network traffic characteristics to obtain a traffic feature sequence; The multi-dimensional information is encoded and combined according to the traffic feature sequence to construct a multi-dimensional fingerprint vector, and similarity grouping is performed based on the multi-dimensional fingerprint vector to construct the device fingerprint library.

3. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 2 is characterized in that: The method includes encoding and combining the multi-dimensional information according to the traffic feature sequence to construct a multi-dimensional fingerprint vector, performing similarity grouping based on the multi-dimensional fingerprint vector, and constructing the device fingerprint library. Analyze the multi-dimensional information to extract device model information and firmware version information; Combining and encoding the device model information and the firmware version information to generate a device type tag; Performing mapping analysis on the multi-dimensional fingerprint vector and the device type label to construct a device fingerprint feature matrix; Performing coarse clustering according to the device fingerprint feature matrix to determine an initial cluster center, performing similarity calculation on the device fingerprint feature matrix based on the initial cluster center, and dividing the device fingerprint into categories; A device fingerprint index table is constructed according to the device fingerprint category, and the device fingerprint index table is associated and integrated to obtain the device fingerprint library.

4. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 2 is characterized in that: Performing device comparison verification using the device fingerprint library, classifying the network traffic information based on the verification result, and identifying abnormal traffic sequences, the method includes: Perform divergence calculation based on the multidimensional fingerprint vector of the device in the power Internet of Things terminal layer and the device fingerprint library, perform comparison and verification based on the divergence calculation result, and generate a verification result; Classifying the network traffic information according to the verification result, performing deviation analysis according to multiple traffic categories, and determining suspicious device traffic; Reorganize the session based on the suspicious device traffic, extract traffic session features, perform continuous detection based on the traffic session features, and determine continuous outliers; The continuous outliers are aggregated according to a time window to determine the abnormal traffic sequence.

5. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 1 is characterized in that: Analyzing the abnormal traffic sequence to obtain multiple abnormal parameters includes: Extracting traffic time series features, performing bandwidth utilization analysis on devices at the power Internet of Things terminal layer based on the abnormal traffic sequence combined with the traffic time series features, and determining network traffic anomaly parameters, wherein the network traffic anomaly parameters include bandwidth utilization deviation; Construct a device communication topology diagram, perform propagation analysis on the devices at the power Internet of Things terminal layer according to the abnormal traffic sequence combined with the device communication topology diagram, and determine network access abnormal behavior parameters, wherein the network access abnormal behavior parameters include abnormal lateral propagation paths; According to the bandwidth utilization deviation and the abnormal lateral propagation path, the traffic pattern is reconstructed to perform error calculation and generate an anomaly score; According to the anomaly score, the bandwidth utilization deviation and the abnormal lateral propagation path are fused to construct the multiple anomaly parameters.

6. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 5 is characterized in that: According to the anomaly score, the bandwidth utilization deviation and the abnormal lateral propagation path are integrated to construct the multiple anomaly parameters, the method comprising: Constructing a three-dimensional feature space, performing joint calculation based on the three-dimensional feature space, and determining feature joint probability distribution data; Based on the feature joint probability distribution data, the anomaly score, the bandwidth utilization deviation, and the abnormal lateral propagation path are mapped to the three-dimensional feature space for spatiotemporal alignment, and weights are assigned according to the spatiotemporal alignment results to determine multiple weight coefficients; In combination with the anomaly score, the bandwidth utilization deviation and the abnormal lateral propagation path are fused according to the multiple weight coefficients to construct the multiple anomaly parameters.

7. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 1 is characterized in that: Based on the network traffic anomaly parameters and the network access anomaly behavior parameters, correlation analysis is performed, and devices at the power Internet of Things terminal layer are marked according to the correlation results to generate a security vulnerability detection report. The method includes: Perform correlation analysis based on the network traffic anomaly parameters and the network access anomaly behavior parameters to construct a multidimensional correlation matrix; Calculating a dynamic correlation coefficient between the network traffic anomaly parameter and the network access anomaly behavior parameter based on the multidimensional correlation matrix; Retrieving a historical behavior baseline based on the device fingerprint library to evaluate the associated impact weights of the network traffic anomaly parameters and the network access anomaly behavior parameters; According to the dynamic correlation coefficient and the association influence weight, multi-dimensional vulnerability matching is performed on the network traffic anomaly parameters and the network access abnormal behavior parameters to generate multiple data labels, wherein the multiple data labels include a security vulnerability type label and a vulnerability risk level label; The vulnerability risk level labels are used to label and analyze the devices at the terminal layer of the power Internet of Things to generate a dynamic risk score, which contains vulnerability location information; A repair priority suggestion is formulated based on the dynamic risk score and the security vulnerability type label, and the security vulnerability detection report is generated according to the vulnerability location information and the repair priority suggestion.

8. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 7 is characterized in that: Based on the network traffic anomaly parameters and the network access anomaly behavior parameters, correlation analysis is performed to construct a multidimensional correlation matrix, the method comprising: Performing time domain alignment on the network traffic anomaly parameters and the network access anomaly behavior parameters to obtain a parameter alignment result; According to the parameter alignment result, the network traffic anomaly parameters are filled as matrix rows, the network access abnormal behavior parameters are filled as matrix columns, and multiple pairs of parameter groups are extracted according to the matrix rows and the matrix columns; Performing distance calculation based on the multiple pairs of parameter groups to obtain a time-warping distance, and using the time-warping distance as an initial element value of a matrix; Performing causal testing on the network traffic anomaly parameters and the network access anomaly behavior parameters to generate causal correlation strength; The causal association strength is used as a directed weight edge and combined with the initial element values of the matrix to construct the multidimensional association matrix.

9. The intelligent detection method for terminal layer security vulnerabilities of the power Internet of Things according to claim 8, characterized in that: Performing a causal test on the network traffic anomaly parameter and the network access anomaly behavior parameter to generate a causal correlation strength, the method comprising: According to the parameter alignment result, the network traffic anomaly parameters and the network access anomaly behavior parameters are subjected to stationarity processing to construct a multi-dimensional time series data set; Performing causal calculation on the network traffic anomaly parameters and the network access anomaly behavior parameters based on the multi-dimensional time series data set, and constructing a directed causal network topology graph; The directed causal network topology graph is subjected to causal direction verification, and the directed causal network topology graph is weighted optimized according to the causal direction verification result to construct the causal association strength.

10. The intelligent detection system for security vulnerabilities at the terminal layer of the power Internet of Things is characterized by: The system comprises: A device fingerprint library construction module is used to collect multi-dimensional information of devices in the power Internet of Things terminal layer, capture network traffic information of devices in the power Internet of Things terminal layer for feature extraction, and construct a device fingerprint library based on network traffic features and the multi-dimensional information; an abnormal parameter identification module, the abnormal parameter identification module being configured to perform device comparison verification using the device fingerprint library, classify the network traffic information according to the verification result, identify abnormal traffic sequences, and analyze the abnormal traffic sequences to obtain multiple abnormal parameters, the multiple abnormal parameters including network traffic abnormality parameters and network access abnormal behavior parameters; A security vulnerability detection module is used to perform correlation analysis based on the network traffic anomaly parameters and the network access abnormal behavior parameters, mark the devices at the terminal layer of the power Internet of Things according to the correlation results, and generate a security vulnerability detection report.

Images