System and method for monitoring and analyzing security event logs of power grid communication network in real time

Abstract

The invention discloses a security event log real-time monitoring and analyzing system and method for a power grid communication network, and relates to the technical field of network security management. The causal relationship graph building module is used for building a causal relationship graph of the target power grid communication network; the multi-dimensional correlation analysis module is used for collecting and analyzing multi-source heterogeneous log data in real time; the abnormal security event identification module is used for identifying an abnormal security event according to the causal relationship graph and the multi-dimensional correlation analysis result; and the attack chain tracking response module is used for tracking the attack chain. According to the method, the technical problem that the existing power grid communication network security monitoring lacks tracking of abnormal event evolution from the time dimension and cannot accurately identify and track a multi-stage attack chain is solved, and the effects of dynamically tracking the evolution process of the abnormal event and identifying a potential attack chain by establishing a time causal chain graph are achieved. And the detection precision and the response speed of the attack behavior are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security management, and in particular to a system and method for real-time monitoring and analysis of security event logs of a power grid communication network. Background Art

[0002] With the increasing complexity and diversity of power grid communication networks, traditional security event monitoring methods face increasing challenges. Existing systems typically focus solely on single event characteristics, lacking in-depth analysis of the temporal and causal relationships between events. Most systems identify security threats solely through static rules or event-based anomaly detection. This approach often fails to promptly detect multi-stage, complex attack chains, particularly latent threats within them. Furthermore, existing systems lack dynamic tracking of event evolution and are unable to conduct comprehensive analysis based on event temporal changes, thus limiting the accurate identification and response to complex attack behaviors within power grid communication networks. Summary of the Invention

[0003] The present application provides a system and method for real-time monitoring and analysis of security event logs of power grid communication networks, which are used to solve the technical problems that existing power grid communication network security monitoring is usually limited to a single event itself, lacks tracking of the evolution of abnormal events from a temporal dimension, and cannot accurately identify and track multi-stage attack chains.

[0004] In a first aspect, the present application provides a real-time monitoring and analysis system for security event logs of a power grid communication network, the system comprising: a log sample collection module for collecting and preprocessing historical multi-source heterogeneous log samples for a target power grid communication network; a causal relationship graph construction module for using the preprocessed historical multi-source heterogeneous log samples as a data source to infer and construct a causal relationship graph for the target power grid communication network, the causal relationship graph comprising multiple security event categories and corresponding sets of associated propagation paths; a multidimensional correlation analysis module for collecting multi-source heterogeneous log data of the target power grid communication network in real time based on a preset time window, and performing multidimensional correlation analysis based on the temporal characteristics, event correlation, and device behavior patterns of the multi-source heterogeneous log data to generate a multidimensional correlation analysis result; an abnormal security event identification module for identifying and obtaining abnormal security events of the target power grid communication network based on the causal relationship graph and the multidimensional correlation analysis result, the abnormal security events being marked with an event type identifier; and an attack chain tracing and response module for tracing the attack chain for the abnormal security event and automatically generating a security response strategy based on the attack chain tracing result.

[0005] The second aspect of the present application provides a real-time monitoring and analysis method for security event logs of a power grid communication network, the method comprising: collecting historical multi-source heterogeneous log samples for a target power grid communication network and preprocessing them; using the preprocessed historical multi-source heterogeneous log samples as a data source, inferring and constructing a causal relationship graph of the target power grid communication network, the causal relationship graph containing multiple security event categories and corresponding sets of associated propagation paths; based on a preset time window, collecting multi-source heterogeneous log data of the target power grid communication network in real time, and performing multi-dimensional correlation analysis based on the timing characteristics, event correlation and device behavior patterns of the multi-source heterogeneous log data to generate multi-dimensional correlation analysis results; identifying and obtaining abnormal security events of the target power grid communication network based on the causal relationship graph and the multi-dimensional correlation analysis results, the abnormal security events having an event type identifier; performing attack chain tracing on the abnormal security events, and automatically generating a security response strategy based on the attack chain tracing results.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages: The system and method for real-time monitoring and analysis of security event logs of a power grid communication network provided in the present application relate to the field of network security management technology. By collecting and preprocessing historical multi-source heterogeneous log samples, a causal relationship map of the power grid communication network is constructed, which includes security event categories and propagation paths. Log data is collected in real time, multi-dimensional correlation analysis is performed, abnormal security events are identified and their types are labeled, and attack chains are tracked based on the causal relationship map and analysis results, and security response strategies are automatically generated. This solves the technical problem that the existing power grid communication network security monitoring is usually limited to a single event itself, lacks tracking of the evolution of abnormal events from a time dimension, and cannot accurately identify and track multi-stage attack chains. This achieves the technical effect of dynamically tracking the evolution process of abnormal events and accurately identifying potential attack chains by constructing a causal relationship map and multi-dimensional correlation analysis, thereby improving the detection accuracy and response speed of attack behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0008] Figure 1 A schematic diagram of the structure of a real-time monitoring and analysis system for security event logs of a power grid communication network provided in an embodiment of the present application; Figure 2 A flow chart of a method for real-time monitoring and analysis of security event logs of a power grid communication network provided in an embodiment of the present application.

[0009] Explanation of the accompanying symbols: log sample collection module 10, causal relationship map construction module 20, multi-dimensional correlation analysis module 30, abnormal security event identification module 40, attack chain tracking and response module 50. DETAILED DESCRIPTION

[0010] The present application provides a system and method for real-time monitoring and analysis of security event logs of power grid communication networks, which are used to solve the technical problems that existing power grid communication network security monitoring is usually limited to a single event itself, lacks tracking of the evolution of abnormal events from a temporal dimension, and cannot accurately identify and track multi-stage attack chains.

[0011] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0012] It should be noted that the terms "first", "second", etc. in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0013] Example 1, as Figure 1 As shown, the present application provides a real-time monitoring and analysis system for security event logs of a power grid communication network, the system comprising: The log sample collection module 10 is used to collect historical multi-source heterogeneous log samples from the target power grid communication network and perform pre-processing.

[0014] Specifically, the main function of the log sample collection module 10 of the present application is to collect historical multi-source heterogeneous log samples for the target power grid communication network and perform necessary preprocessing to ensure the efficiency and accuracy of subsequent analysis.

[0015] First, the target power grid communication network is usually composed of multiple devices and systems, covering multiple levels such as substations, control centers, and communication networks. The log data generated by these systems are of various types and formats, including equipment operation logs, operation logs, network traffic logs, and security event logs. These log data can be regarded as multi-source heterogeneous log samples, which are characterized by a wide range of sources, different formats, and complex content.

[0016] Log samples are collected from these devices and systems in real time, including information such as system operating status, equipment fault alarms, communication data packets, and operation records. However, raw log data may contain irrelevant information, redundant records, and format differences. Direct analysis will lead to inconsistent results. Therefore, preprocessing is a necessary step to ensure data quality and the effectiveness of subsequent analysis. During data preprocessing, data denoising is first required. This step removes redundant records in the logs by filtering out irrelevant data generated by the system, such as periodic heartbeat signals or debugging information, to ensure that the core data being analyzed reflects the true status of the power grid communication network. At the same time, the formats of the collected log data vary. To facilitate subsequent unified processing, log data in different formats is formatted, for example, by converting the log data into a standardized text format (such as JSON or XML) or extracting key information and storing it as structured data.

[0017] Because individual devices in a power grid communication network may experience time synchronization discrepancies, timestamp synchronization becomes a critical step in log preprocessing. By time-aligning the log data generated by each device, ensuring that all log data falls within the same time window, the order of events can be accurately reflected. Furthermore, log data may contain missing values ​​or incomplete records. Appropriate algorithms can be used for data cleaning, such as using predictive algorithms to fill in missing data or eliminating unnecessary, invalid data according to pre-set rules. Ultimately, after these preprocessing steps, the collected log data is converted into a structured, uniformly formatted, high-quality dataset, providing reliable data support for modules within the system, such as causal analysis and abnormal event detection.

[0018] The causal relationship graph building module 20 is used to use the pre-processed historical multi-source heterogeneous log samples as data sources to infer and construct a causal relationship graph of the target power grid communication network. The causal relationship graph includes multiple security event categories and corresponding associated propagation path sets.

[0019] Furthermore, the causal relationship graph building module 20 of the present application is also used to perform the following steps: P21: Extract key information items of each log from the historical multi-source heterogeneous log samples; P22: Based on the key information items, extract log event entities as nodes, analyze the correlation between event entities, construct directed edges, and generate an initial log event graph structure; P23: Perform correlation calculation and path mining on the initial log event graph structure to identify potential correlations between different devices and different events, including temporal sequence relationships and behavioral influence logic; P24: Based on the temporal sequence relationships and behavioral influence logic, screen out node pairs that meet causal trigger conditions, construct causal edges in the initial log event graph structure, and assign weights to causal edges to generate an initial causal relationship map; P25: Structural compression is performed on the initial causal relationship map to generate the causal relationship map.

[0020] It should be understood that the causal relationship graph construction module 20 of this application is responsible for constructing a causal relationship graph from pre-processed historical multi-source heterogeneous log samples to provide detailed causal association information for subsequent security incident analysis. The work of this module includes the collection and cleaning of log data to the construction, optimization, and compression of the graph to form an effective causal relationship graph structure. The following are the detailed execution steps of this module: First, key information items for each log are extracted from the preprocessed log samples. These key information items include but are not limited to timestamp, event type, device identification, operation behavior, source address, and destination address. This information forms the basis for subsequent analysis and can help the system quickly locate the core content of the log. Subsequently, based on the extracted key information items, the module further extracts log event entities as nodes. An event entity refers to a subject that can independently represent a security event or behavior, such as a device failure, user login, or data transmission. By analyzing the correlation between event entities and identifying the logical relationships between events, such as sequence and triggering relationships, directed edges are constructed to generate the initial log event graph structure. This process involves semantic understanding and pattern matching of log data, aiming to transform complex log data into a structured graph model.

[0021] Next, correlation calculation and path mining are performed on the initial log event graph structure to identify potential relationships between different devices and events. These relationships include temporal order and behavioral influence logic, that is, how one event triggers or influences another. By calculating the correlation between events, the strength of the correlation between them can be quantified, thereby screening event pairs with potential causal relationships. Path mining is used to discover the propagation paths between events, revealing the diffusion process of events in the power grid communication network.

[0022] Based on temporal order and behavioral influence logic, node pairs that meet causal triggering conditions are selected and causal edges are constructed within the initial log event graph. Causal edges represent causal relationships between events, indicating whether one event is a direct or indirect cause of another. Causal edges are assigned weights, which reflect the strength and credibility of the causal relationship. Weights can be calculated based on various factors, such as the correlation between events, temporal intervals, and event frequency. This process generates an initial causal relationship graph.

[0023] Finally, the initial causal graph undergoes structural compression to generate the final causal graph. Structural compression aims to remove redundant information and noise, optimize the graph structure, and improve readability and analytical efficiency. This compression process can be achieved by merging similar nodes, removing low-weight edges, and optimizing paths. The resulting causal graph is a concise, efficient, and accurate graphical model that accurately reflects the causal relationships of security incidents in power grid communication networks. It provides an important reference for system anomaly detection and attack chain tracing. This process not only improves the system's analytical capabilities but also ensures that security incidents are identified and responded to promptly and accurately.

[0024] Furthermore, the causal relationship graph building module 20 of the present application is further configured to perform the following steps when compressing the structure of the initial causal relationship graph: P25-1: Perform graph clustering on the initial causal relationship graph to identify multiple security event subgraphs and form multiple event propagation path sets; P25-2: Match the core nodes in the multiple event propagation path sets with the preset security event category library to complete event type labeling, and summarize the identified nodes and their associated paths to form a complete causal relationship graph.

[0025] Optionally, in the process of structurally compressing the initial causal relationship graph, the causal relationship graph construction module 20 further refines the graph structure through graph clustering and event type labeling to improve the readability and practicality of the graph, so as to facilitate subsequent event analysis and security response.

[0026] First, graph clustering is performed on the initial causal relationship graph. Graph clustering groups nodes in a graph according to certain similarities or correlations. The goal is to group highly correlated events together to form multiple security event subgraphs. In the log data of the power grid communication network, different types of events may have different propagation patterns. Therefore, through graph clustering, the event propagation path within a specific security event category is identified. For example, some security events may originate from equipment failures or configuration issues, while others may be caused by external attacks. Through graph clustering, different event categories are divided into different subgraphs, which reflect the different propagation patterns of events in the network. The nodes and edges within each event subgraph represent the order in which events occurred, the interactions between devices, and their impact on the network.

[0027] After obtaining multiple sets of event propagation paths, the core nodes in each set of event propagation paths are matched with the preset security event category library. The preset security event category library includes common types of power grid communication network security events, such as illegal access, configuration tampering, DDoS attacks, equipment failures, etc. By matching with the category library, an event type label is assigned to the core nodes in each event subgraph to identify the event. For example, if an event propagation path involves a large number of device configuration changes and abnormal operations, it can be labeled as a "configuration tampering" type; if the propagation path contains a large number of network traffic anomalies and source IP anomalies, the path can be labeled as a "DDoS attack." Labeling event types not only helps with subsequent event classification, but also improves the interpretability of causal graphs.

[0028] Finally, nodes with event type identifiers and their associated paths are aggregated to form a complete causal relationship map. This map not only demonstrates the causal relationships between events but also clearly identifies the occurrence patterns and propagation paths of different event types. Identified nodes and their associated paths provide an effective basis for subsequent event detection, attack chain tracing, and response strategy generation.

[0029] Through further refinement of graph clustering and event type annotation, the causal graph construction module 20 optimizes the structure of the initial graph, simplifies data presentation in complex networks, and makes security event analysis in power grid communication networks more efficient and accurate. Furthermore, the causal graph, which identifies event types, provides powerful support for subsequent modules, enabling rapid identification and response based on different security event types, thereby improving overall security protection capabilities.

[0030] Furthermore, the causal relationship graph building module 20 of the present application is further configured to perform the following steps when generating the initial log event graph structure: P22-1: Divide the historical multi-source heterogeneous log samples into multiple continuous time windows according to the preset time granularity, and construct a local event graph in each continuous time window to capture the causal relationship characteristics within a short period; P22-2: Based on the causal relationship characteristics, extract the sequence of event occurrence, the network topology path between triggering devices, similar operation behaviors or shared context fields, calculate the initial correlation between nodes, and generate the initial log event graph structure.

[0031] Specifically, in the process of generating the initial log event graph structure, the causal relationship graph building module 20 can further improve the accuracy and precision of the graph structure by refining the steps, ensuring that the relationship between events can clearly reflect the event propagation process.

[0032] First, the collected historical multi-source heterogeneous log samples are divided into time windows. Since security events in power grid communication networks are typically continuous in time, historical log data can be divided into multiple continuous time windows according to a preset time granularity (such as minutes or hours). The log data in each time window represents events that occurred within a short time period. Within each time window, a local event graph can be independently constructed to capture the causal relationship characteristics between events within this time period. By dividing the logs into small time windows, it is possible to more accurately analyze the changing trends of events within a short period and their interactions with other events, avoiding the increased complexity caused by long time spans.

[0033] Then, based on the causal features captured within each time window, the module extracts key information such as the chronological order of events, the network topological paths between triggering devices, and similar operational behaviors or shared context fields. The chronological order of events reflects the temporal dependencies between them and is a crucial basis for causal analysis. The network topological paths between triggering devices reveal the propagation paths of events within the network, helping to understand the spread and impact of events. Similar operational behaviors or shared context fields provide clues to potential connections between events. For example, similar operational behaviors by the same user on different devices may indicate a potential security threat. Based on this key information, the module calculates initial correlations between nodes and generates the initial log event graph structure. This initial correlation can be calculated using various methods, such as time interval-based weighting and a decay function based on network topological path length, to quantify the strength of the connections between nodes.

[0034] Through the above steps, the causal relationship graph construction module 20 can efficiently capture the dynamic changes between events within a short time period, ensuring that the event relationships within each time window are accurately modeled. This process not only improves the accuracy of graph construction but also lays a solid foundation for subsequent attack chain analysis and abnormal event detection. Furthermore, event graphs based on local time windows can effectively avoid interference factors that may occur in long-span data, making event analysis more focused and accurate.

[0035] Furthermore, the causal relationship graph building module 20 of the present application is further configured to perform the following steps when assigning weights to causal edges: P24-1: For node pairs that satisfy the temporal sequence relationship, their causal strength is further determined through the causal impact scoring model, and based on the causal strength, corresponding causal weight coefficients are assigned to the directed edges in the initial log event graph structure to generate multiple causal edges; P24-2: All causal edges are scored and sorted, and the edge set that exceeds the preset causal strength threshold is retained, and the causal path structure is optimized through shortest path analysis; P24-3: For causal edges with long time intervals, no obvious causal logic support or weak interactive influence, threshold filtering + sparse graph optimization mechanism is used to eliminate them.

[0036] It should be understood that, in the process of assigning weights to causal edges, the causal relationship graph building module 20 can ensure, through a series of detailed steps, that the generated causal relationship graph can accurately reflect the real impact relationship between events.

[0037] First, further analysis is performed on node pairs that satisfy a temporal order relationship. In the initial log event graph structure, the temporal order relationship between different event nodes has already been established. However, to improve accuracy, a causal impact scoring model can be used to quantify the causal strength of these node pairs. This causal impact scoring model calculates the causal strength of each event pair by considering multiple factors, such as the scope of influence between nodes, the order of events, and the impact of the triggering event. For example, if event A directly causes event B, then event A is considered to have a strong causal influence on event B. The key to this step is assigning causal weight coefficients to directed edges in the event graph based on causal strength. These weight coefficients quantify the causal strength of each edge, transforming the edges in the graph from simple connecting lines to weighted expressions of influence. This approach generates multiple weighted causal edges, allowing the graph to more accurately reflect the influence between events.

[0038] Next, all generated causal edges are ranked by score, and a set of important edges is selected based on a causal strength threshold. This ranking helps identify which causal edges play a core role in the graph and which are marginal factors. High-scoring causal edges represent a strong propagation effect or influence within the overall event chain and should be retained. Low-scoring causal edges, on the other hand, may have a weak influence or be less significant in the causal relationship between events. After selecting edges with high causal strength, the causal paths can be optimized using shortest path analysis. Shortest path analysis calculates the shortest propagation path from event A to event B, optimizing the causal chain structure and ensuring that the paths in the graph best reflect the event propagation logic. This not only reduces redundant information but also improves the interpretability and analytical efficiency of causal paths.

[0039] Finally, causal edges with long time intervals, no clear causal logic support, or weak interactive influence are removed. Causal edges with excessive time spans, unclear logical relationships between events, or weak interactive influence between devices are cleaned up through threshold filtering and sparse graph optimization. Threshold filtering is based on a pre-set causal strength threshold. Causal edges below this threshold are deemed insufficiently influential and are therefore removed. The sparse graph optimization mechanism, on the other hand, exploits the sparsity of the graph to remove redundant edges that contribute little to the graph structure and causal analysis. This step simplifies the causal graph, removes unnecessary complexity, ensures graph simplicity and computational efficiency, and improves the accuracy and response speed of subsequent analysis.

[0040] Through these refined steps, the causal graph building module 20 not only ensures that the graph can accurately reflect the causal relationship strength and propagation path between events in the process of assigning weights to causal edges, but also improves the efficiency and practicality of the graph through optimization and elimination mechanisms, providing accurate and efficient data support for subsequent security incident identification, attack chain tracking and response strategy generation.

[0041] The multidimensional correlation analysis module 30 is used to collect multi-source heterogeneous log data of the target power grid communication network in real time based on a preset time window, and perform multidimensional correlation analysis based on the temporal characteristics, event correlation and device behavior patterns of the multi-source heterogeneous log data to generate multidimensional correlation analysis results.

[0042] Furthermore, the multidimensional association analysis module 30 of the present application is further configured to perform the following steps: P31: The collected real-time log data is organized and encoded in chronological order to construct a log event sequence, and a time density vector, an event interval vector, and a periodic fluctuation feature are constructed for each type of log as event time features; P32: A static behavior profile is constructed based on the historical behavior of each device, and the device baseline pattern is summarized to construct device behavior features; P33: The contextual information between log events is extracted to construct an event co-occurrence matrix and a behavior collaboration matrix as event correlation features; P34: Based on the extracted event time features, device behavior features, and event correlation features, the multidimensional correlation analysis results are constructed.

[0043] Specifically, the core task of the multi-dimensional correlation analysis module 30 of this application is to extract multi-dimensional event features through in-depth analysis of multi-source heterogeneous log data collected in real time from the power grid communication network, thereby effectively identifying potential security incidents. This module's working steps not only focus on the temporal nature of time series data, but also involve the changing patterns of device behavior and the correlation between events, providing comprehensive data support for subsequent security incident monitoring and anomaly detection.

[0044] First, the collected real-time log data is sorted and encoded in chronological order to form a clear log event sequence. The key goal of this process is to arrange each event in the log data in the order of occurrence to ensure the continuity and consistency of the time dimension. Next, by constructing a time density vector, an event interval vector, and a periodic fluctuation feature for each type of log data, these features represent the time pattern and time distribution characteristics of the event. For example, the time density vector can show the frequency of events in a certain time period, the event interval vector reveals the time interval between adjacent events, and the periodic fluctuation feature helps identify the periodic pattern of events. Through the extraction of these time features, module 30 can effectively capture the temporal regularity and abnormal fluctuations of events, providing time dimension support for subsequent analysis.

[0045] Next, a static behavioral profile is constructed based on the historical behavioral data of each device. This behavioral profile includes the typical behavioral patterns of each device in different time periods, such as common operation types, operating time, and type of data processed. It can help the module identify the baseline pattern of the device, that is, the normal behavioral pattern of the device. By summarizing and comparing the behaviors of multiple devices, personalized device behavioral characteristics are established for each device. For example, a certain device usually collects data during a specific time period every day, while another device may perform a large number of control operations during system maintenance. The purpose of constructing device behavioral characteristics is to provide a reference model of device behavior for subsequent anomaly detection. By comparing real-time behavior with the baseline pattern, abnormal changes in device behavior can be quickly identified.

[0046] Furthermore, contextual information between log events is extracted to construct an event co-occurrence matrix and a behavior collaboration matrix to capture the correlation between events. The event co-occurrence matrix describes the frequency of co-occurrence of different events within the same time window, revealing the common characteristics between events; while the behavior collaboration matrix analyzes the collaborative working relationships between different devices, helping to understand the mutual influence between devices. By constructing event correlation features, the system can analyze the interrelationships between events at a macro level and identify potential attack paths or abnormal behavior patterns.

[0047] Ultimately, a multidimensional correlation analysis is generated by combining temporal, device behavioral, and event correlation features. This process integrates information from the temporal, device behavioral, and event correlation dimensions to form a comprehensive, three-dimensional analytical framework. The multidimensional correlation analysis results not only include event timing information and device behavior patterns, but also reveal potential correlations between events, providing rich data support and analytical basis for subsequent abnormal security event identification and attack chain tracing.

[0048] The abnormal security event identification module 40 is used to identify and obtain abnormal security events of the target power grid communication network based on the causal relationship graph and the multi-dimensional correlation analysis results, and the abnormal security events are marked with event type identifiers.

[0049] Furthermore, the abnormal security event identification module 40 of the present application is further configured to perform the following steps: P41: The extracted event time features, device behavior features, and event correlation features are input into the multidimensional anomaly detection model, the event combination in the real-time log stream is scored, and multiple high-anomaly score events are output; P42: The multiple high-anomaly score events are compared with the known paths in the causal relationship graph, the path credibility is integrated with the degree of deviation of the current device behavior, the associated risk level is output, and it is marked as a candidate abnormal security event.

[0050] Optionally, the core task of the abnormal security event identification module 40 of the present application is to effectively identify abnormal security events in the power grid communication network based on the previously constructed causal relationship map and multi-dimensional correlation analysis results. These events need to be clearly identified with the event type to facilitate subsequent analysis and response.

[0051] First, the extracted event time features, device behavior features, and event correlation features are input into a multidimensional anomaly detection model. A multidimensional anomaly detection model is an algorithm based on machine learning or statistical analysis that comprehensively considers features from multiple dimensions to assign anomaly scores to event combinations in real-time log streams. By learning from a large amount of historical data, the model can identify the differences between normal and abnormal behavior patterns and output an anomaly score for each event combination. A higher anomaly score indicates a greater deviation from normal behavior, making it more likely to be an anomaly. This process allows multiple events with high anomaly scores to be screened from massive amounts of real-time log data, providing a foundation for further analysis.

[0052] Next, the output of multiple high-anomaly scoring events is compared with the known paths in the previously constructed causal relationship graph. Because the causal relationship graph contains multiple known event propagation paths, new abnormal events can be compared with these paths to assess their similarity to historical attack chains. This comparison process not only checks whether the event belongs to a known path, but also combines the path credibility and the degree of deviation from the current device behavior to calculate the risk level of the event. Specifically, if an event occurs in a known attack chain and its propagation path has a high credibility, the risk level of the event will be increased; conversely, if the event has a weak correlation with the known path or the deviation of the device behavior is small, the risk level of the event will be relatively low. In this way, the most potentially threatening abnormal security events are identified.

[0053] Ultimately, after comparison and risk assessment, the associated risk level is output, and high-risk events are marked as candidate abnormal security events. These candidate events will be further included in the subsequent security response mechanism for security personnel to conduct detailed investigations or trigger automated response measures.

[0054] Through this series of steps, the abnormal security event identification module 40 can efficiently identify possible security threats from large amounts of log data and classify them according to their risk level, providing reliable support for subsequent security incident response. The innovation of this module lies in its ability to effectively identify multiple types of abnormal events by combining multi-dimensional anomaly detection with path comparison of causal relationship graphs, thereby improving the accuracy and efficiency of security monitoring.

[0055] Furthermore, the abnormal security event identification module 40 of the present application is further configured to perform the following steps: P43: Based on the candidate abnormal security events output by the multi-dimensional anomaly detection model, short-term isolated single-point events are eliminated, and the candidate event set with multiple repeated triggers, concentrated event outbreaks or multi-device collaboration characteristics is retained; P44: Combined with the path position, predecessor / successor event pattern and device role of the candidate event in the causal relationship graph, a corresponding event type label is assigned to each candidate event; P45: Based on the historical precedent frequency of the candidate event, the current network topology criticality, the importance of the affected object and the deviation amplitude of the device behavior, a corresponding risk level label is assigned to each candidate event; P46: The marked candidate event is compared with the historical attack chain in the causal relationship graph for path consistency analysis. If the candidate event is located in a known propagation path, the previous and next event links are automatically completed to generate the abnormal security event; P47: Structured description information is generated for the abnormal security event as input for subsequent attack chain tracking and response strategy generation.

[0056] In a possible embodiment of the present application, the abnormal security event identification module 40 of the present application can further ensure the accuracy and practicality of the identification results through a series of refined steps in the process of identifying abnormal security events.

[0057] First, a preliminary screening of candidate abnormal security events based on the output of the multidimensional anomaly detection model is performed. Typically, anomaly event detection models output a large number of events, some of which may be short-lived, isolated, single-point events and lack sufficient risk indicators. Therefore, by analyzing the repetitiveness and correlation of these events, we can eliminate short-lived, isolated, single-point events and retain candidate events that exhibit multiple repetitive triggering, concentrated outbreaks, or multi-device coordination. Repeatedly triggered events indicate that they may be persistent threats to the system, while concentrated outbreaks or multi-device coordinated events may indicate potential attack activity and are therefore considered higher-priority security events.

[0058] Next, based on the candidate event's path position in the causal graph, the preceding / successor event pattern, and the device role, a corresponding event type label is assigned to each candidate event. Each event in the causal graph has a clear triggering pattern and propagation path, which demonstrates the logical relationship between events. Therefore, an event type label can be automatically assigned to each candidate event based on the path where the candidate event is located, the correlation between its preceding and succeeding events, and the role of the relevant device when the event occurs. For example, if an event occurs in a path with abnormal network traffic, it will be labeled as a DDoS attack; if the event occurs in a path where multiple device configurations are changed, it may be labeled as configuration tampering. In this way, different types of security events can be efficiently identified, improving the targeted nature of subsequent processing.

[0059] Next, each candidate event is assigned a risk level label based on its historical precedent frequency, the criticality of the current network topology, the importance of the affected object, and the magnitude of the device behavior deviation. These factors together determine the severity and potential risk of the event. For example, an event with a high historical precedent frequency may indicate a high frequency of that type of attack or failure. If a key node in the network topology is affected, it may mean a more serious security risk. The magnitude of the device behavior deviation indicates whether the device is operating abnormally. Taking these factors into consideration, each candidate event is assigned a risk level label, such as high, medium, or low, to help security teams prioritize high-risk events.

[0060] Subsequently, the candidate events marked with risk levels are compared with historical attack chains in the causal relationship graph for path consistency analysis to determine whether the candidate event falls within a known attack path. If the candidate event matches the characteristics of a historical attack chain, the module automatically completes the chain of preceding and following events to form a complete attack chain. For example, a certain event may be an intermediate link in an attack chain. By comparing the paths in the graph, the cause and effect of the attack chain can be automatically inferred, the attack chain structure can be completed, and an abnormal security event can be generated. This approach significantly improves the ability to identify multi-stage attacks, especially for complex attack activities and latent threats, providing more accurate tracing capabilities.

[0061] Finally, the generated abnormal security events are converted into structured descriptions. This information contains all key information about the abnormal event, such as event type, risk level, occurrence time, affected devices, associated paths, and attack chains. This structured information serves as input for subsequent attack chain tracing and response strategy generation, and is used by the system's automated response mechanisms or security experts. This process provides the security team with detailed event context and impact analysis, enabling rapid response.

[0062] The attack chain tracing and response module 50 is used to perform attack chain tracing for the abnormal security event and automatically generate a security response strategy based on the attack chain tracing result.

[0063] Furthermore, the attack chain tracing response module 50 of the present application is further configured to perform the following steps: P51: Taking the abnormal security event as the starting point, perform reverse graph traversal in the causal relationship graph, combine the triggering order of the event and the propagation edge weight, trace back to its potential source event node, and identify the starting point of the attack chain; P52: Based on the time sequence of the causal edge and the device interaction mode, build a complete attack propagation link along the graph path. Each node in the link contains the event type, affected device, trigger time and associated risk score; P53: Perform credibility assessment on the constructed attack propagation link, filter low-probability false paths, and retain high-confidence attack chains; P54: According to the event type combination, impact range and key node role in the attack chain, match the corresponding security response template from the preset response strategy knowledge base; P55: Combined with the current network status, the number of affected devices and the risk level, adjust the parameters of the matched strategy template to generate a structured security response strategy.

[0064] Optionally, the attack chain tracing response module 50 of the present application is responsible for conducting in-depth attack chain tracing of identified abnormal security events in the entire security event monitoring system, and automatically generating a security response strategy based on the tracing results.

[0065] This process begins with the abnormal security event as the starting point, and a reverse graph traversal is performed within the causal relationship graph. The core goal of this step is to trace back to the potential source event node by analyzing the triggering sequence of events and the weights of the propagation edges, thereby identifying the starting point of the attack chain. The weights of the propagation edges represent the degree of influence between events. Edges with greater influence typically indicate more critical attack sources. Therefore, based on these weights, the source of the attack chain can be precisely located in the causal relationship graph and the propagation path of the attack can be effectively tracked.

[0066] Once the source event of an attack chain is identified, it can be constructed along the paths in the causal graph to form a complete attack propagation chain. By combining the temporal order of causal edges with the interaction patterns between devices, the event type, triggering device, occurrence time, and associated risk score for each node are determined. Each node represents a key link in the attack chain. This information accurately depicts the entire attack process, helping the system understand the event's propagation method, impact scope, and interactions between devices. This step-by-step deduction not only reveals the temporal relationship between events but also reflects the role and importance of different devices and events in the attack chain.

[0067] Next, the credibility of each path in the attack chain is assessed, filtering out those with low probability or implausibility. This assessment incorporates factors such as the path's propagation probability, the plausibility of inter-device interactions, and similarity to historical attack patterns to ensure that the retained attack chain paths are authentic and threatening. This process effectively eliminates irrelevant, false positives, and focuses on the most promising attack paths.

[0068] After the attack chain path is determined, the system automatically matches the corresponding response template from a pre-defined security response policy knowledge base, taking into account the event type, impact scope, and key device roles involved. This allows for rapid selection of appropriate response strategies and generation of specific countermeasures for different attack types. Matched policy templates will include network protection measures, device isolation, traffic restrictions, and other protective measures, with priority and execution order adjusted based on the characteristics of the attack chain.

[0069] Finally, the matching security response policy template is dynamically adjusted based on the real-time status of the power grid communication network, the number of affected devices, and the risk level of the incident. Specifically, the response policy's execution priority, scope, and timing are adjusted based on the network topology, device importance, and the severity of the security incident. The adjusted policy is output in a structured format and automatically transmitted to relevant devices or control platforms within the power grid system, ensuring swift and accurate implementation of response measures, ultimately preventing and mitigating security incidents.

[0070] Through these steps, the attack chain tracking and response module 50 can automate the entire process from identifying abnormal security events to generating response strategies, enabling the power grid communication network to quickly and effectively protect and respond to complex security threats.

[0071] In summary, the embodiments of the present application have at least the following technical effects: This application collects and preprocesses historical multi-source heterogeneous log samples to construct a causal relationship map of the target power grid communication network. The map contains multiple security event categories and propagation paths. Based on a preset time window, multi-source heterogeneous log data is collected in real time and multi-dimensional correlation analysis is performed to generate analysis results. Based on the causal relationship map and correlation analysis results, abnormal security events are identified and their types are labeled. For abnormal security events, attack chains are tracked and security response strategies are automatically generated based on the tracking results.

[0072] The technical effect is achieved by constructing a causal relationship map and multi-dimensional correlation analysis, dynamically tracking the evolution of abnormal events, and accurately identifying potential attack chains, thereby improving the detection accuracy and response speed of attack behaviors.

[0073] The second embodiment is based on the same inventive concept as the real-time monitoring and analysis system for security event logs of the power grid communication network in the above embodiment. Figure 2 As shown, the present application provides a method for real-time monitoring and analysis of security event logs of a power grid communication network. The system and method embodiments in the present application are based on the same inventive concept. The method includes: For the target power grid communication network, historical multi-source heterogeneous log samples are collected and preprocessed; the preprocessed historical multi-source heterogeneous log samples are used as data sources to infer and construct a causal relationship map of the target power grid communication network, and the causal relationship map contains multiple security event categories and corresponding associated propagation path sets; based on a preset time window, multi-source heterogeneous log data of the target power grid communication network is collected in real time, and multi-dimensional correlation analysis is performed based on the temporal characteristics, event correlation and device behavior patterns of the multi-source heterogeneous log data to generate multi-dimensional correlation analysis results; based on the causal relationship map and the multi-dimensional correlation analysis results, abnormal security events of the target power grid communication network are identified and obtained, and the abnormal security events are marked with event type identification; for the abnormal security events, attack chain tracing is performed, and a security response strategy is automatically generated based on the attack chain tracing results.

[0074] Furthermore, the pre-processed historical multi-source heterogeneous log samples are used as data sources to infer and construct a causal relationship graph of the target power grid communication network. The causal relationship graph contains multiple security event categories and corresponding associated propagation path sets, including: Extract key information items of each log from the historical multi-source heterogeneous log samples; based on the key information items, extract log event entities as nodes, analyze the correlation between event entities, construct directed edges, and generate an initial log event graph structure; perform correlation calculation and path mining on the initial log event graph structure to identify potential correlation relationships between different devices and different events, including temporal sequence relationships and behavioral influence logic; based on the temporal sequence relationships and behavioral influence logic, screen out node pairs that meet causal trigger conditions, construct causal edges in the initial log event graph structure, assign weights to the causal edges, and generate an initial causal relationship map; perform structural compression on the initial causal relationship map to generate the causal relationship map.

[0075] Furthermore, the initial causal relationship graph is structurally compressed, including: The initial causal relationship graph is clustered to identify multiple security event subgraphs and form multiple event propagation path sets; the core nodes in the multiple event propagation path sets are matched with the preset security event category library to complete the event type labeling, and the identified nodes and their associated paths are summarized to form a complete causal relationship graph.

[0076] Furthermore, an initial log event graph structure is generated, including: The historical multi-source heterogeneous log samples are divided into multiple continuous time windows according to a preset time granularity, and a local event graph is constructed in each continuous time window to capture the causal relationship characteristics within a short period. Based on the causal relationship characteristics, the sequence of event occurrence, the network topology path between triggering devices, similar operation behaviors or shared context fields are extracted, the initial correlation between nodes is calculated, and the initial log event graph structure is generated.

[0077] Furthermore, weights are assigned to causal edges, including: For node pairs that satisfy the temporal sequence relationship, their causal strength is further determined through a causal impact scoring model, and based on the causal strength, corresponding causal weight coefficients are assigned to the directed edges in the initial log event graph structure to generate multiple causal edges; all causal edges are scored and sorted, and the edge set that exceeds the preset causal strength threshold is retained, and the causal path structure is optimized through shortest path analysis; for causal edges with long time intervals, no obvious causal logic support, or weak interactive influence, threshold filtering + sparse graph optimization mechanism is used to eliminate them.

[0078] Furthermore, based on a preset time window, multi-source heterogeneous log data of the target power grid communication network is collected in real time, and multi-dimensional correlation analysis is performed based on the time series characteristics, event correlation and device behavior patterns of the multi-source heterogeneous log data to generate multi-dimensional correlation analysis results, including: The collected real-time log data is organized and encoded in chronological order to construct a log event sequence, and a time density vector, an event interval vector and a periodic fluctuation feature are constructed for each type of log as event time features. A static behavior profile is constructed based on the historical behavior of each device, and the device baseline pattern is summarized to construct the device behavior feature. The contextual information between log events is extracted, and an event co-occurrence matrix and a behavior collaboration matrix are constructed as event correlation features. The multidimensional correlation analysis results are constructed based on the extracted event time features, device behavior features and event correlation features.

[0079] Furthermore, according to the causal relationship graph and the multi-dimensional correlation analysis results, identifying and obtaining abnormal security events of the target power grid communication network includes: The extracted event time features, device behavior features, and event correlation features are input into a multidimensional anomaly detection model, and the event combinations in the real-time log stream are scored to output multiple high-anomaly score events. These multiple high-anomaly score events are compared with the known paths in the causal relationship graph, and the path credibility is integrated with the degree of deviation of the current device behavior to output the associated risk level and mark them as candidate abnormal security events.

[0080] Furthermore, according to the causal relationship graph and the multi-dimensional correlation analysis results, identifying and obtaining abnormal security events of the target power grid communication network includes: Based on the candidate abnormal security events output by the multi-dimensional anomaly detection model, short-term isolated single-point events are eliminated, and the candidate event set with multiple repeated triggers, concentrated event outbreaks or multi-device collaboration characteristics is retained; the corresponding event type label is assigned to each candidate event in combination with the path position, predecessor / successor event pattern and device role of the candidate event in the causal relationship graph; the corresponding risk level label is assigned to each candidate event based on the historical precedent frequency of the candidate event, the current network topology criticality, the importance of the affected object and the deviation amplitude of the device behavior; the marked candidate event is compared with the historical attack chain in the causal relationship graph for path consistency analysis. If the candidate event is located in a known propagation path, the previous and next event links are automatically completed to generate the abnormal security event; structured description information is generated for the abnormal security event as input for subsequent attack chain tracking and response strategy generation.

[0081] Furthermore, for the abnormal security event, the attack chain is traced, and a security response strategy is automatically generated based on the attack chain tracing results, including: Taking the abnormal security event as the starting point, a reverse graph traversal is performed in the causal relationship graph, and the potential source event node is traced back to identify the starting point of the attack chain in combination with the triggering order of the event and the propagation edge weight; based on the time sequence of the causal edge and the device interaction mode, a complete attack propagation link is constructed along the graph path, and each node in the link contains the event type, affected device, trigger time and associated risk score; the constructed attack propagation link is credibility evaluated, low-probability false paths are filtered, and high-confidence attack chains are retained; according to the event type combination, impact range and key node role in the attack chain, the corresponding security response template is matched from the preset response strategy knowledge base; based on the current network status, the number of affected devices and the risk level, the parameters of the matched strategy template are adjusted to generate a structured security response strategy.

[0082] It should be noted that the order in which the embodiments of the present application are presented is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. Furthermore, the foregoing descriptions of specific embodiments of this specification are provided. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential sequence shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0083] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

[0084] This specification and drawings are merely illustrative of the present application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of this application. Thus, this application is intended to include such modifications and variations as fall within the scope of this application and its equivalents.

Claims

1. A real-time monitoring and analysis system for security event logs of power grid communication networks, characterized by: The system comprises: The log sample collection module is used to collect historical multi-source heterogeneous log samples and perform preprocessing on the target power grid communication network; A causal relationship graph construction module is used to use the pre-processed historical multi-source heterogeneous log samples as a data source to infer and construct a causal relationship graph of the target power grid communication network, wherein the causal relationship graph includes multiple security event categories and corresponding associated propagation path sets; A multidimensional correlation analysis module is used to collect multi-source heterogeneous log data of the target power grid communication network in real time based on a preset time window, and perform multidimensional correlation analysis based on the time series characteristics, event correlation and device behavior patterns of the multi-source heterogeneous log data to generate multidimensional correlation analysis results; An abnormal security event identification module is used to identify and obtain abnormal security events of the target power grid communication network based on the causal relationship map and the multi-dimensional correlation analysis results, wherein the abnormal security events are marked with event type identifiers; The attack chain tracing response module is used to trace the attack chain for the abnormal security event and automatically generate a security response strategy based on the attack chain tracing results.

2. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 1, characterized in that: The causal relationship graph building module is also used to: Extracting key information items of each log from the historical multi-source heterogeneous log samples; Based on the key information items, log event entities are extracted as nodes, and the correlation between event entities is analyzed to construct directed edges to generate an initial log event graph structure; Performing correlation calculation and path mining on the initial log event graph structure to identify potential correlation relationships between different devices and different events, including temporal sequence relationships and behavior impact logic; Based on the temporal sequence relationship and behavior impact logic, node pairs that meet the causal trigger conditions are screened out, causal edges are constructed in the initial log event graph structure, and weights are assigned to the causal edges to generate an initial causal relationship graph; The initial causal relationship graph is structurally compressed to generate the causal relationship graph.

3. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 2, characterized in that: When compressing the structure of the initial causal relationship graph, the causal relationship graph building module is further used to: Performing graph clustering on the initial causal relationship graph to identify multiple security event subgraphs and form multiple event propagation path sets; The core nodes in the set of multiple event propagation paths are matched with the preset security event category library to complete the event type labeling, and the identified nodes and their associated paths are summarized to form a complete causal relationship map.

4. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 2, characterized in that: When executing the generation of the initial log event graph structure, the causal relationship graph building module is further used to: Divide the historical multi-source heterogeneous log samples into multiple continuous time windows according to a preset time granularity, and construct a local event graph in each continuous time window to capture the causal relationship characteristics within a short period; Based on the causal relationship features, the order of event occurrence, the network topology path between triggering devices, similar operation behaviors or shared context fields are extracted, the initial correlation between nodes is calculated, and the initial log event graph structure is generated.

5. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 2, characterized in that: When assigning weights to causal edges, the causal relationship graph building module is further used to: For node pairs that satisfy the temporal sequence relationship, the causal strength is further determined using a causal impact scoring model, and corresponding causal weight coefficients are assigned to the directed edges in the initial log event graph structure based on the causal strength to generate multiple causal edges; Score and sort all causal edges, retain the edge set that exceeds the preset causal strength threshold, and optimize the causal path structure through shortest path analysis; For causal edges with long time intervals, no obvious causal logic support, or weak interaction effects, threshold filtering + sparse graph optimization mechanism is used to eliminate them.

6. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 1, characterized in that: The multidimensional association analysis module is also used for: The collected real-time log data is sorted and encoded in chronological order to construct a log event sequence. For each type of log, a time density vector, an event interval vector, and a periodic fluctuation feature are constructed as event time features. Build static behavior profiles based on the historical behavior of each device, summarize device baseline patterns, and construct device behavior characteristics; Extract contextual information between log events and construct event co-occurrence matrix and behavior collaboration matrix as event correlation features; The multi-dimensional correlation analysis result is constructed based on the extracted event time features, device behavior features and event correlation features.

7. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 1, characterized in that: The abnormal security event identification module is also used to: The extracted event time features, device behavior features, and event correlation features are input into a multi-dimensional anomaly detection model to score the event combinations in the real-time log stream and output multiple high-anomaly score events. The multiple high-abnormal score events are compared with the known paths in the causal relationship map, the path credibility is integrated with the degree of deviation of the current device behavior, the associated risk level is output, and they are marked as candidate abnormal security events.

8. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 7, characterized in that: The abnormal security event identification module is also used to: Based on the candidate abnormal security events output by the multi-dimensional anomaly detection model, short-term isolated single-point events are eliminated, and a set of candidate events with multiple repeated triggers, concentrated event outbreaks, or multi-device collaboration features are retained; Based on the candidate event's path position in the causal relationship graph, the preceding / successor event pattern, and the device role, each candidate event is assigned a corresponding event type label; Assign a corresponding risk level label to each candidate event based on the historical precedent frequency of the candidate event, the criticality of the current network topology, the importance of the affected object, and the deviation of device behavior; Perform path consistency comparison analysis on the marked candidate events and the historical attack chains in the causal relationship graph. If the candidate event is located in a known propagation path, the previous and subsequent event links are automatically completed to generate the abnormal security event. The abnormal security event generates structured description information as input for subsequent attack chain tracking and response strategy generation.

9. The real-time monitoring and analysis system for security event logs of a power grid communication network according to claim 1, characterized in that: The attack chain tracking response module is further configured to: Taking the abnormal security event as the starting point, reverse graph traversal is performed in the causal relationship graph, combining the triggering sequence of the event and the propagation edge weight, backtracking its potential source event node, and identifying the starting point of the attack chain; Based on the temporal order of causal edges and the device interaction pattern, a complete attack propagation chain is constructed along the graph path. Each node in the chain contains the event type, affected device, trigger time, and associated risk score. Conduct credibility assessment on the constructed attack propagation chain, filter low-probability false paths, and retain high-confidence attack chains; Based on the event type combination, impact scope, and key node roles in the attack chain, the corresponding security response template is matched from the preset response strategy knowledge base; Based on the current network status, number of affected devices and risk level, the parameters of the matched policy template are adjusted to generate a structured security response strategy.

10. A method for real-time monitoring and analysis of security event logs of a power grid communication network, characterized in that: The method comprises: For the target power grid communication network, historical multi-source heterogeneous log samples are collected and preprocessed; Using the pre-processed historical multi-source heterogeneous log samples as data sources, inferring and constructing a causal relationship graph of the target power grid communication network, wherein the causal relationship graph includes multiple security event categories and corresponding associated propagation path sets; Based on a preset time window, multi-source heterogeneous log data of the target power grid communication network is collected in real time, and multi-dimensional correlation analysis is performed based on the time series characteristics, event correlation and device behavior patterns of the multi-source heterogeneous log data to generate multi-dimensional correlation analysis results; Identify and obtain abnormal security events of the target power grid communication network based on the causal relationship graph and the multi-dimensional correlation analysis results, wherein the abnormal security events are marked with event type identifiers; For the abnormal security incident, the attack chain is tracked, and a security response strategy is automatically generated based on the attack chain tracking results.

Images