Power system network security situation monitoring system based on SVG (Static Var Generator) networking

Abstract

The invention relates to the technical field of power supply management, in particular to a power system network security situation monitoring system based on SVG (Static Var Generator) networking, comprising a data acquisition module used for acquiring power grid data and processing process data; the topology analysis module is used for acquiring an equipment node table and a connection relation table according to the power grid data and updating the equipment node table; the asset mapping module is used for acquiring a mapping result and calibrating updating of the equipment node table; the security analysis module is used for judging the security condition, deducing the dangerous attack according to the judgment result and correcting the calibration process of the updating of the equipment node table; and the analysis pushing module is used for sending the deduction result to a worker. The abnormal reason is found by acquiring the network security state of the physical equipment of the power grid, and the abnormal reason is pushed to the mobile terminal of the worker, so that the worker can adjust and repair the network security problem in time.

Description

Technical Field

[0001] The present invention relates to the technical field of power supply management, and in particular to a power system network security situation monitoring system based on SVG networking. Background Art

[0002] In modern power grids, SVG (static var generator) networking is gaining increasing popularity as a key technology for improving grid stability and optimizing power quality. Using power electronic conversion technology, SVG can quickly and accurately regulate reactive power, effectively mitigating grid voltage fluctuations, reducing line losses, and improving the grid's power factor. However, SVG networking faces numerous challenges in practical application. Firstly, the industry lacks unified, standardized SVG networking standards. SVG devices produced by different manufacturers exhibit significant differences in hardware design, software control algorithms, communication protocols, and interface formats. This lack of standardization makes it difficult to achieve seamless integration and collaboration between devices when building large-scale, complex SVG networking systems. Secondly, information loss in SVG networking is a significant issue. During grid operation, due to aging equipment, communication failures, and inadequate monitoring systems, key operating parameters of some SVG devices cannot be accurately and completely acquired, leading to inaccurate analysis of the SVG device's network status.

[0003] Chinese Patent Publication No. CN107171342B discloses a coordinated control method for dynamically replacing continuous reactive power with discrete reactive power. This method achieves coordinated control of continuous and discrete devices through dynamic replacement. When an existing AVC system is connected to an SVG device, the AVC system monitors the SVG device's real-time reactive power output and operating information in real time. The bus voltage corresponding to the SVG is regulated by the SVG device. When the SVG's real-time reactive power output reaches the capacity of the capacitor / reactor, the corresponding capacitor / reactor is activated or deactivated to replace the SVG output, maintaining the SVG's maximum reserve capacity. This method achieves a coordinated control method for the existing discrete reactive power compensation equipment in the AVC system and the newly added SVG device. Ultimately, the system maintains maximum reactive power reserve, effectively preventing the impact of rapid voltage fluctuations on the power grid and ensuring grid security. However, this solution fails to adapt to the non-standard and missing information inherent in SVG networking. This results in a mismatch between the physical assets of the power grid and the device nodes in the topology analysis results, and the accuracy of the device node table is low. Summary of the Invention

[0004] To this end, the present invention provides a power system network security situation monitoring system based on SVG networking, which is used to overcome the problem that the existing technology cannot adapt to the non-standards and information missing of SVG networking, resulting in the inability to accurately correspond to the physical assets of the power grid and the device nodes in the topology analysis results due to the non-standards and information missing of SVG networking, and the low accuracy of the device node table.

[0005] To achieve the above objectives, the present invention provides a power system network security situation monitoring system based on SVG networking, comprising: Data acquisition module, used to collect power grid data and processing process data; A topology analysis module, configured to obtain a topology analysis result based on the SVG primary wiring diagram in the power grid data. The topology analysis result includes a device node table and a connection relationship table, and is configured to update the device node table based on the processing data. The asset mapping module is used to obtain mapping results based on the network data table and topology analysis results in the power grid data, and is also used to calibrate the update of the device node table based on the processing data; The security analysis module is used to judge the security situation based on the power grid data, deduce dangerous attacks based on the judgment results, and correct the calibration process of the device node table update based on the processing data; Analysis push module, used to send the deduction results to staff.

[0006] Furthermore, the topology parsing module inputs the SVG primary wiring diagram in the power grid data into the topology parsing model to obtain a topology parsing result output by the topology parsing model, wherein the topology parsing result includes a device node table and a connection relationship table. The topology parsing module constructs the topology parsing model using a topology parsing model construction method, wherein the topology parsing model construction method includes: A convolutional neural network model is selected as the basic framework of the topology parsing model, and 70% of the topology parsing sample data set is divided into a topology parsing training set, 15% of the topology parsing learning sample data set is divided into a topology parsing verification set, and 15% of the topology parsing learning sample data set is divided into a topology parsing test set. The convolutional neural network model is trained according to the topology parsing training set, and the weight of the convolutional neural network model is updated by the backpropagation algorithm. After each epoch, the convolutional neural network model is verified using the topology parsing verification set to obtain a parsing verification loss value and a parsing verification accuracy rate. When the parsing verification loss value and the parsing verification accuracy rate meet the preset verification conditions, the convolutional neural network model is tested according to the topology parsing test set to obtain a parsing test accuracy rate. When the parsing test accuracy rate reaches the preset accuracy rate, the convolutional neural network model is output as a topology parsing model. The topology parsing module inputs the SVG primary wiring diagram into the topology parsing model and obtains the topology parsing result output by the topology parsing model. The topology parsing result includes a device node table and a connection relationship table.

[0007] Furthermore, the topology parsing module matches the abnormal data of the device node table in the processing data with the expert database, obtains the matching similarity P, compares the matching similarity P with the preset matching similarity P0, judges the data similarity based on the comparison result, and updates the device node table based on the judgment result, wherein: When P≥P0, the topology analysis module determines that the data similarity is similar, updates the device node table, and uses the device node data of the matched expert database as update data to update the device node table; When P<P0, the topology analysis module determines that the data similarity is dissimilar, does not update the device node table, and rematches the abnormal data of the device node table in the processing data with the expert database until P≥P0.

[0008] Furthermore, the asset mapping module inputs the network data table and topology analysis results in the power grid data into the asset mapping model to obtain the mapping results output by the asset mapping model. The asset mapping module constructs the asset mapping model through an asset mapping model construction method, and the asset mapping model construction method includes: A convolutional neural network model is selected as the basic framework of the asset mapping model, and 70% of the asset mapping sample data set is divided into a mapping training set, 20% of the mapping learning sample data set is divided into a mapping validation set, and 10% of the mapping learning sample data set is divided into a mapping test set. The convolutional neural network model is trained according to the mapping training set, and the weight of the convolutional neural network model is updated by the backpropagation algorithm. After each epoch, the convolutional neural network model is verified using the mapping validation set to obtain a mapping verification loss value and a mapping verification accuracy rate. When the mapping verification loss value and the mapping verification accuracy rate meet the preset verification conditions, the convolutional neural network model is tested according to the mapping test set to obtain a mapping test accuracy rate. When the mapping test accuracy rate reaches the preset accuracy rate, the convolutional neural network model is output as the asset mapping model. The asset mapping module inputs the network data table and the topology analysis result into the asset mapping model, and obtains the mapping result output by the asset mapping model.

[0009] Furthermore, the asset mapping module calculates the unmapped rate Q based on the number of unmatched mappings N and the total number of mappings M in the mapping results of the processing data, sets Q=N / M×100%, compares the unmapped rate Q with the preset unmapped rate Q0, judges the unmapped situation based on the comparison result, and calibrates the update of the device node table based on the judgment result, wherein: When Q≤Q0, the asset mapping module determines that the unmapped situation is normal and does not calibrate the update of the device node table; When Q>Q0, the asset mapping module determines that the unmapped situation is abnormal, calibrates the update of the device node table, and calibrates the preset matching similarity K0 through the calibration coefficient jz, setting jz=1.30-0.25×e -(Q-Q0) , e is the base of the natural logarithm, and the calibrated preset matching similarity K0j is obtained. Set K0j=jz×K0, replace the preset matching similarity K0 with the calibrated preset matching similarity K0j, and re-compare the matching similarity K with the preset matching similarity K0.

[0010] Furthermore, the security analysis module inputs the network traffic anomalies and host intrusion detection results in the power grid data into the security situation assessment model, obtains the security situation assessment value A output by the security situation assessment model, compares the security situation assessment value A with the preset security situation assessment value A0, judges the security situation based on the comparison result, and deduces the dangerous attack based on the judgment result, wherein: When A≤A0, the security analysis module determines that the security situation is safe and does not deduce dangerous attacks; When A>A0, the security analysis module determines that the security situation is dangerous, deduces the dangerous attack, converts the mapping result into mapping data, and inputs the network traffic anomaly, host intrusion detection result and mapping data into the attack deduction model, obtains the deduction result output by the attack deduction model, and transmits the deduction result to the analysis push module.

[0011] Furthermore, the security analysis module constructs a security situation assessment model through a security situation assessment model construction method, and the security situation assessment model construction method includes: The situation assessment data set is divided into a 70% evaluation training set, a 15% evaluation validation set, and a 15% evaluation test set. The evaluation training set is input into the recurrent neural network model to train the recurrent neural network model, and the evaluation validation set is input into the trained decision tree. The hyperparameters of the trained decision tree are iteratively optimized, and the evaluation test set is input into the iteratively optimized decision tree to perform a conflict analysis test on the iteratively optimized recurrent neural network model to obtain the evaluation test results. The total number of samples in the evaluation test set is set to b0, the number of correct evaluation test samples is set to b, and the evaluation test accuracy is set to B, B=b / b0. The evaluation test accuracy B is compared with the preset evaluation test accuracy B0. According to the comparison results, the training compliance of the iteratively optimized recurrent neural network model is judged, and the judgment result is output, where: When B≥B0, the security analysis module determines that the iteratively optimized recurrent neural network model training has met the standards, outputs the iteratively optimized recurrent neural network model as a situation assessment model, and provides the conflict detection model to the security analysis module; When B<B0, the security analysis module determines that the training of the iteratively optimized recurrent neural network model does not meet the standards, updates the situation assessment data set to obtain an updated situation assessment data set, and trains the recurrent neural network model, iteratively optimizes hyperparameters, and performs analysis and testing based on the updated situation assessment data set until the recurrent neural network model training meets the standards.

[0012] Furthermore, the security analysis module constructs an attack deduction model through an attack deduction model construction method, and the attack deduction model construction method includes: The attack simulation dataset is divided into a 70% simulation training set, a 20% simulation validation set, and a 10% simulation test set. The simulation training set is input into the decision tree model to train the decision tree model, and the simulation validation set is input into the trained decision tree model. The hyperparameters of the trained decision tree model are iteratively optimized. The simulation test set is input into the iteratively optimized decision tree model to perform a conflict analysis test on the iteratively optimized decision tree model to obtain the simulation test results. The total number of samples in the simulation test set is set to f0, the number of correct simulation test samples is set to f, and the simulation test accuracy is set to F, where F=f / f0. The simulation test accuracy F is compared with the preset simulation test accuracy F0. Based on the comparison results, the training compliance of the iteratively optimized decision tree model is judged, and the judgment result is output, where: When F≥F0, the security analysis module determines that the iteratively optimized decision tree model training meets the standards, outputs the iteratively optimized decision tree model as an attack deduction model, and provides the conflict detection model to the security analysis module; When F<F0, the security analysis module determines that the iteratively optimized decision tree model training does not meet the standards, updates the attack deduction data set to obtain an updated attack deduction data set, and trains the decision tree model based on the updated attack deduction data set, iteratively optimizes the hyperparameters, and performs analysis and testing until the decision tree model training meets the standards.

[0013] Furthermore, the safety analysis module compares the number of dangers L in the processing data with the preset number of dangers L0, judges the danger triggering situation according to the comparison result, and corrects the calibration process of the device node table update according to the judgment result, wherein: When L<L0, the safety analysis module determines that the danger triggering situation is normal, and does not modify the calibration process of the device node table update; When L≥L0, the safety analysis module determines that the dangerous trigger situation is a trigger anomaly, corrects the calibration process of the device node table update, and corrects the preset unmapped rate Q0 by the correction coefficient PL, setting PL=0.66+0.24×e -(L-L0) , obtain the corrected preset unmapped rate Q0x, set Q0x=PL×Q0, replace the preset unmapped rate Q0 with the corrected preset unmapped rate Q0x, and re-compare the unmapped rate Q with the preset unmapped rate Q0.

[0014] Furthermore, the analysis push module sends the deduction results of the safety analysis module to the staff and activates the equipment abnormality alarm.

[0015] Compared with the prior art, the beneficial effect of the present invention is that the system collects power grid data and processing data through the data acquisition module, so as to analyze the network security status of the physical equipment of the power grid and find the cause of the abnormality according to the network security status. The system also obtains the topological analysis result, i.e. the device node table and the connection relationship table, by parsing the SVG primary wiring diagram in the power grid data through the topological analysis module. This process clearly sorts out the connection mode and topological structure of various devices in the power grid, and converts the originally complex physical connection relationship of the power grid into an intuitive and quantifiable data table, which facilitates the system to digitally manage and analyze the power grid structure, and at the same time updates the device node table to avoid incomplete information in the device node table or non-standard information symbols. Inaccurate analysis may lead to deviations in subsequent analysis, thereby improving the adaptability of the power system network security situation monitoring system based on SVG networking. The system also uses the asset mapping module to achieve accurate correspondence between the physical assets of the power grid and the device nodes in the topology analysis results, and ensures the accuracy of the device node table update. The system also uses the security analysis module to judge the security situation based on the power grid data, and can monitor in real time whether there are any abnormal conditions in the power grid, discover potential risks in time, and avoid the occurrence of safety accidents. The system also uses the analysis push module to send the deduction results of the security analysis module to the staff, and activate the equipment abnormality alarm to notify the staff to repair and control the physical equipment of the power grid, so as to avoid production problems caused by abnormal physical equipment of the power grid. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Schematic diagram of the structure of the power system network security situation monitoring system based on SVG networking in this embodiment. DETAILED DESCRIPTION

[0017] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are merely used to explain the present invention and are not intended to limit the present invention.

[0018] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0019] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside", and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0020] Furthermore, it should be noted that, in the description of the present invention, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood in a broad sense. For example, they may refer to fixed connections, detachable connections, or integral connections; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; and internal communication between two components. Those skilled in the art will understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0021] See also Figure 1 FIG. 1 is a schematic diagram of the structure of a power system network security situation monitoring system based on SVG networking according to this embodiment. The system includes: Data acquisition module, used to collect power grid data and processing process data; A topology analysis module, configured to obtain topology analysis results based on the SVG primary wiring diagram in the power grid data. The topology analysis results include a device node table and a connection relationship table, and is configured to update the device node table based on the processing data. The topology analysis module is connected to the data acquisition module. An asset mapping module, configured to obtain mapping results based on the network data table and topology analysis results in the power grid data, and to calibrate updates to the device node table based on the processing data, the asset mapping module being connected to the topology analysis module; A security analysis module, configured to determine security conditions based on power grid data, deduce dangerous attacks based on the determination results, and revise the calibration process for updating the device node table based on the processing data. The security analysis module is connected to the asset mapping module. The analysis push module is used to send the deduction results to the staff, and the analysis push module is connected to the security analysis module.

[0022] Specifically, the power system network security situation monitoring system based on SVG networking is applied to the power grid equipment monitoring terminal. By analyzing the SVG primary wiring diagram, the network security status of the physical equipment of the power grid is obtained, and the cause of the abnormality is found according to the network security status. The abnormal cause is pushed to the mobile terminal of the staff so that the staff can adjust and repair the network security problem in time. The system collects the power grid data and processing process data through the data acquisition module, so as to subsequently analyze the network security status of the physical equipment of the power grid and find the cause of the abnormality according to the network security status. The system also obtains the topology analysis results, namely the device node table and the connection relationship table, by parsing the SVG primary wiring diagram in the power grid data through the topology analysis module. This process clearly sorts out the connection methods and topological structures of various devices in the power grid, and transforms the originally complex physical connection relationship of the power grid into an intuitive and quantifiable data table. , which facilitates the system to digitally manage and analyze the power grid structure, and at the same time updates the device node table to avoid deviations in subsequent analysis due to incomplete information in the device node table or non-standard information symbols, thereby improving the adaptability of the power system network security situation monitoring system based on SVG networking. The system also uses the asset mapping module to achieve accurate correspondence between the physical assets of the power grid and the device nodes in the topology analysis results, and ensures the accuracy of the device node table update. The system also uses the security analysis module to judge the security situation based on the power grid data, and can monitor in real time whether there are any abnormal conditions in the power grid, discover potential risks in time, and avoid the occurrence of safety accidents. The system also uses the analysis push module to send the deduction results of the security analysis module to the staff, and activate the equipment abnormality alarm to notify the staff to repair and control the physical equipment of the power grid to avoid production problems caused by abnormal physical equipment of the power grid.

[0023] Specifically, the power grid data includes SVG primary wiring diagrams, network data tables, network traffic anomalies and host intrusion detection results. The data acquisition module collects the SVG primary wiring diagrams and network data tables through the production management system. The SVG primary wiring diagram refers to the main electrical wiring diagram drawn in a scalable vector graphics format, which is used to describe the primary equipment connection relationship and topology structure of the power grid. The network data table refers to a table in the power grid equipment that describes the parameters and connection relationship of the network equipment. The production management system refers to a system for managing equipment records and production records in the power grid system. The data acquisition module collects network traffic anomalies through NetFlow. The network anomaly refers to an abnormal value in which the network traffic peak value of the power grid network equipment is higher than the average value. The full name of NetFlow in Chinese is network flow, which is a network traffic monitoring technology. The data acquisition module collects host intrusion detection results through Wazuh. The host intrusion detection result refers to the secondary detection result of the intrusion of the computer host by an external hacker. Number, the Wazuh refers to an enterprise-level security monitoring platform, focusing on threat detection, file integrity monitoring, host intrusion detection results, log analysis and compliance auditing. It integrates terminal security agents and central management servers through a distributed architecture to provide unified security visibility. The processing process data includes abnormal data of the device node table, the number of unmatched mappings, the total number of mappings and the number of dangerous times. The data acquisition module collects the abnormal data of the device node table through the computer's task log, the data acquisition module collects the number of unmatched mappings and the total number of mappings through the computer's task log, and the data acquisition module collects the number of dangerous times through the computer's task log. The abnormal data of the device node table refers to the data missing from the device node table and the data not expressed in accordance with the national standard. The number of unmatched mappings refers to the number of data that is not mapped in the network data table. The total number of mappings refers to the total number of data mapped in the network data table. The number of dangerous times refers to the number of times the security analysis module determines that the security situation is dangerous.

[0024] Specifically, the topology parsing module inputs the SVG primary wiring diagram in the power grid data into the topology parsing model, obtains the topology parsing result output by the topology parsing model, and the topology parsing result includes a device node table and a connection relationship table. The topology parsing module constructs the topology parsing model using a topology parsing model construction method, which includes: A convolutional neural network model is selected as the basic framework of the topology parsing model, and 70% of the topology parsing sample data set is divided into a topology parsing training set, 15% of the topology parsing learning sample data set is divided into a topology parsing verification set, and 15% of the topology parsing learning sample data set is divided into a topology parsing test set. The convolutional neural network model is trained according to the topology parsing training set, and the weight of the convolutional neural network model is updated by the backpropagation algorithm. After each epoch, the convolutional neural network model is verified using the topology parsing verification set to obtain a parsing verification loss value and a parsing verification accuracy rate. When the parsing verification loss value and the parsing verification accuracy rate meet the preset verification conditions, the convolutional neural network model is tested according to the topology parsing test set to obtain a parsing test accuracy rate. When the parsing test accuracy rate reaches the preset accuracy rate, the convolutional neural network model is output as a topology parsing model. The topology parsing module inputs the SVG primary wiring diagram into the topology parsing model and obtains the topology parsing result output by the topology parsing model. The topology parsing result includes a device node table and a connection relationship table.

[0025] Specifically, the topology parsing sample data set refers to a learning data set stored in the form of an SVG primary wiring diagram-topology parsing result, which is used to train a convolutional neural network model. The epoch refers to the process in which the convolutional neural network model completes a forward propagation and a backward propagation on the data recognition training set. The verification loss value refers to the loss value of the loss function in the convolutional neural network model when the data recognition verification set is input into the convolutional neural network model for verification. The verification accuracy rate refers to the ratio of the number of topology parsing results output after the topology parsing verification set is input into the convolutional neural network model that is consistent with the topology parsing results in the topology parsing verification set to the total number of samples in the topology parsing verification set. The preset verification condition refers to the fact that the verification loss value for 7 consecutive epochs has not decreased, and the verification accuracy rate has not Improvement, the parsing test accuracy refers to the ratio of the number of data test results output after the topology parsing test set is input into the convolutional neural network model and the data parsing results in the topology parsing test set to the total number of samples in the topology parsing test set, the preset accuracy refers to the preset value of the recognition test accuracy for judging whether the convolutional neural network model meets the output standard, such as the preset accuracy can be set to 98%, the device node table refers to a table used to describe the detailed digital information of the physical equipment of the power grid, the detailed digital information includes device ID, device type and device coordinates, the device ID refers to the name and code of the device, the device type refers to the type of device, the device coordinates refer to the geographical coordinates of the device, and the connection relationship table refers to a relationship table used to describe the path of the electrical connection between different devices.

[0026] Specifically, the topology analysis module obtains the device node table and the connection relationship table so as to Specifically, the topology parsing module matches the abnormal data of the device node table in the processing data with the expert database, obtains the matching similarity P, compares the matching similarity P with the preset matching similarity P0, judges the data similarity based on the comparison result, and updates the device node table based on the judgment result, wherein: When P≥P0, the topology analysis module determines that the data similarity is similar, updates the device node table, and uses the device node data of the matched expert database as update data to update the device node table; When P<P0, the topology analysis module determines that the data similarity is dissimilar, does not update the device node table, and rematches the abnormal data of the device node table in the processing data with the expert database until P≥P0.

[0027] Specifically, the expert database refers to a database that includes historical device node tables. This embodiment does not limit the specific implementation method of matching the abnormal data of the device node table in the processing process data with the expert database and obtaining the matching similarity. For example, one of the device ID, device type and device coordinates of the abnormal data of the device node table in the processing process data can be used as a search term to search in the expert database, and the entry corresponding to one of the device ID, device type and device coordinates in the expert database is obtained, and the remaining part is matched with the remaining part of the corresponding entry in the expert database, and the matching similarity is obtained according to the total number of entries c1 and the number of matching entries c2. The matching similarity P is calculated, and P is set to be c2 / c1×100%. The total number of entries refers to the sum of the remaining part of the corresponding entries in the expert database and the number of the entries. The number of matching entries refers to the number of entries in the expert database that are consistent with the entries of the abnormal data of the device node table in the processing process data. The preset matching similarity refers to a preset value for judging the data similarity. This embodiment does not limit the specific value of the preset matching similarity. For example, P0 is set to 70%. The data similarity refers to the similarity between the entries in the expert database and the entries of the abnormal data of the device node table in the processing process data. The similarity includes similarity and dissimilarity.

[0028] Specifically, the topology analysis module matches the abnormal data of the device node table in the processing data with the expert database, obtains the matching similarity, compares the matching similarity with the preset matching similarity, judges the data similarity based on the comparison result, and updates the device node table based on the judgment result, thereby supplementing and updating the data of the device node table, ensuring the data integrity and data accuracy of the device node table, and thus improving the accuracy of the network status analysis of the physical equipment of the power grid.

[0029] Specifically, the asset mapping module inputs the network data table and topology analysis results in the power grid data into the asset mapping model, obtains the mapping results output by the asset mapping model, and constructs the asset mapping model through the asset mapping model construction method. The asset mapping model construction method includes: A convolutional neural network model is selected as the basic framework of the asset mapping model, and 70% of the asset mapping sample data set is divided into a mapping training set, 20% of the mapping learning sample data set is divided into a mapping validation set, and 10% of the mapping learning sample data set is divided into a mapping test set. The convolutional neural network model is trained according to the mapping training set, and the weight of the convolutional neural network model is updated by the backpropagation algorithm. After each epoch, the convolutional neural network model is verified using the mapping validation set to obtain a mapping verification loss value and a mapping verification accuracy rate. When the mapping verification loss value and the mapping verification accuracy rate meet the preset verification conditions, the convolutional neural network model is tested according to the mapping test set to obtain a mapping test accuracy rate. When the mapping test accuracy rate reaches the preset accuracy rate, the convolutional neural network model is output as the asset mapping model. The asset mapping module inputs the network data table and the topology analysis result into the asset mapping model, and obtains the mapping result output by the asset mapping model.

[0030] Specifically, the asset mapping sample dataset refers to a learning dataset used to train a convolutional neural network model, stored in the form of a network data table and a topology analysis result-mapping result. The epoch refers to the process in which the convolutional neural network model completes one forward propagation and backpropagation on the data identification training set. The validation loss value refers to the loss value of the loss function in the convolutional neural network model when the data identification validation set is input into the convolutional neural network model for validation. The mapping validation accuracy rate refers to the ratio of the number of mapping results output after the data identification validation set is input into the convolutional neural network model that are consistent with the mapping results in the mapping validation set to the total number of samples in the mapping validation set. The preset validation condition refers to the fact that the validation loss value does not decrease and the validation accuracy rate does not increase for five consecutive epochs. The mapping test accuracy rate refers to the ratio of the number of data test results output after the mapping test set is input into the convolutional neural network model that are consistent with the data mapping results in the mapping test set to the total number of samples in the mapping test set. The preset accuracy rate refers to the preset value of the mapping test accuracy rate for determining whether the convolutional neural network model meets the output standard. For example, the preset accuracy rate can be set to 95%. The mapping result refers to the result of mapping the network data table to the table in the topology analysis result through the asset mapping model.

[0031] Specifically, the asset mapping module maps the network data table to the topology analysis result so as to subsequently check the security issues of the physical equipment of the power grid and accurately identify the problems of the physical equipment of the power grid.

[0032] Specifically, the asset mapping module calculates the unmapped rate Q based on the number of unmatched mappings N and the total number of mappings M in the mapping results of the processing data, sets Q=N / M×100%, compares the unmapped rate Q with the preset unmapped rate Q0, judges the unmapped situation based on the comparison result, and calibrates the update of the device node table based on the judgment result, where: When Q≤Q0, the asset mapping module determines that the unmapped situation is normal and does not calibrate the update of the device node table; When Q>Q0, the asset mapping module determines that the unmapped situation is abnormal, calibrates the update of the device node table, and calibrates the preset matching similarity K0 through the calibration coefficient jz, setting jz=1.30-0.25×e -(Q-Q0) , e is the base of the natural logarithm, and the calibrated preset matching similarity K0j is obtained. Set K0j=jz×K0, replace the preset matching similarity K0 with the calibrated preset matching similarity K0j, and re-compare the matching similarity K with the preset matching similarity K0.

[0033] Specifically, the preset unmapped rate refers to a preset value for judging the unmapped situation. This embodiment does not limit the specific value of the preset unmapped rate. Those skilled in the art can set it according to actual conditions, such as setting Q0=10%. The unmapped situation refers to whether the unmapped rate is normal based on the unmapped rate and the preset unmapped rate. The unmapped situation includes normal and abnormal conditions.

[0034] Specifically, the asset mapping module judges the unmapped situation through the results and calibrates the update of the device node table according to the judgment result. When the unmapped situation is abnormal, the preset matching similarity is calibrated by setting a calibration coefficient that increases with the increase of the unmapped rate, thereby improving the value of the preset matching similarity, improving the update accuracy of the device node table, and then improving the accuracy of subsequent mapping results, so that subsequent fault detection of physical equipment in the power grid is more accurate.

[0035] Specifically, the security analysis module inputs the network traffic anomalies and host intrusion detection results in the power grid data into the security situation assessment model, obtains the security situation assessment value A output by the security situation assessment model, compares the security situation assessment value A with the preset security situation assessment value A0, judges the security situation based on the comparison result, and deduces the dangerous attack based on the judgment result, wherein: When A≤A0, the security analysis module determines that the security situation is safe and does not deduce dangerous attacks; When A>A0, the security analysis module determines that the security situation is dangerous, deduces the dangerous attack, converts the mapping result into mapping data, and inputs the network traffic anomaly, host intrusion detection result and mapping data into the attack deduction model, obtains the deduction result output by the attack deduction model, and transmits the deduction result to the analysis push module.

[0036] Specifically, the preset security situation assessment value refers to a preset value for judging the security situation. This embodiment does not limit the specific numerical value of the preset security situation assessment value, such as setting A0=0.8. The security situation refers to whether the physical equipment of the power grid is safe based on the security situation assessment value and the preset security situation assessment value. The safety situation includes safety and danger. This embodiment does not limit the specific implementation method of converting the mapping result into mapping data, such as converting the content of the mapping result into text data through a computer, and using the text data as mapping data.

[0037] Specifically, the security analysis module judges the security situation and deduces dangerous attacks based on the judgment results, so as to subsequently analyze the abnormal causes of the physical equipment of the power grid, making it convenient for staff to perform network debugging on the physical equipment of the power grid according to the abnormal causes.

[0038] Specifically, the security analysis module constructs a security situation assessment model through a security situation assessment model construction method, and the security situation assessment model construction method includes: The situation assessment data set is divided into a 70% evaluation training set, a 15% evaluation validation set, and a 15% evaluation test set. The evaluation training set is input into the recurrent neural network model to train the recurrent neural network model, and the evaluation validation set is input into the trained decision tree. The hyperparameters of the trained decision tree are iteratively optimized, and the evaluation test set is input into the iteratively optimized decision tree to perform a conflict analysis test on the iteratively optimized recurrent neural network model to obtain the evaluation test results. The total number of samples in the evaluation test set is set to b0, the number of correct evaluation test samples is set to b, and the evaluation test accuracy is set to B, B=b / b0. The evaluation test accuracy B is compared with the preset evaluation test accuracy B0. According to the comparison results, the training compliance of the iteratively optimized recurrent neural network model is judged, and the judgment result is output, where: When B≥B0, the security analysis module determines that the iteratively optimized recurrent neural network model training has met the standards, outputs the iteratively optimized recurrent neural network model as a situation assessment model, and provides the conflict detection model to the security analysis module; When B<B0, the security analysis module determines that the training of the iteratively optimized recurrent neural network model does not meet the standards, updates the situation assessment data set to obtain an updated situation assessment data set, and trains the recurrent neural network model, iteratively optimizes hyperparameters, and performs analysis and testing based on the updated situation assessment data set until the recurrent neural network model training meets the standards.

[0039] Specifically, the situation assessment model refers to a recurrent neural network model that takes network traffic anomalies, host intrusion detection results and mapping results as input and outputs evaluation results. The situation assessment dataset refers to a data set used to construct the situation assessment model. The situation assessment dataset includes historically acquired network traffic anomalies, host intrusion detection results and security situation assessment values ​​corresponding to historically acquired network traffic anomalies and host intrusion detection results. The evaluation training set refers to a dataset divided from the situation assessment dataset for training the recurrent neural network model. The evaluation verification set refers to a dataset divided from the situation assessment dataset for verifying the training results of the recurrent neural network model. The evaluation test set refers to a dataset divided from the situation assessment dataset for testing the recurrent neural network model. The recurrent neural network model refers to a model infrastructure for constructing the situation assessment model. The evaluation test accuracy refers to the ratio of the number of correctly evaluated test samples to the total number of samples in the evaluation test set. The preset evaluation test accuracy refers to the preset value used to judge the training compliance of the iteratively optimized recurrent neural network model. This embodiment does not limit the preset evaluation test accuracy. Those skilled in the art can set it by themselves according to actual needs. It only needs to meet the requirements for judging the training compliance of the iteratively optimized recurrent neural network model. For example, the preset conflict analysis test accuracy B0 can be set to: 95%≤B0≤98%. The training compliance of the iteratively optimized recurrent neural network model refers to the accuracy compliance of the recurrent neural network model after training. The training compliance of the iteratively optimized recurrent neural network model includes compliance and non-compliance. The security situation assessment value refers to the result output after the network traffic anomaly value and the host intrusion detection result are input into the situation assessment model.

[0040] Specifically, the security analysis module constructs a security situation assessment model through a security situation assessment model construction method, so that the security analysis module outputs a security situation assessment value and judges the security situation according to the security situation assessment value.

[0041] Specifically, the security analysis module constructs an attack deduction model through an attack deduction model construction method, and the attack deduction model construction method includes: The attack simulation dataset is divided into a 70% simulation training set, a 20% simulation validation set, and a 10% simulation test set. The simulation training set is input into the decision tree model to train the decision tree model, and the simulation validation set is input into the trained decision tree model. The hyperparameters of the trained decision tree model are iteratively optimized. The simulation test set is input into the iteratively optimized decision tree model to perform a conflict analysis test on the iteratively optimized decision tree model to obtain the simulation test results. The total number of samples in the simulation test set is set to f0, the number of correct simulation test samples is set to f, and the simulation test accuracy is set to F, where F=f / f0. The simulation test accuracy F is compared with the preset simulation test accuracy F0. Based on the comparison results, the training compliance of the iteratively optimized decision tree model is judged, and the judgment result is output, where: When F≥F0, the security analysis module determines that the iteratively optimized decision tree model training meets the standards, outputs the iteratively optimized decision tree model as an attack deduction model, and provides the conflict detection model to the security analysis module; When F<F0, the security analysis module determines that the iteratively optimized decision tree model training does not meet the standards, updates the attack deduction data set to obtain an updated attack deduction data set, and trains the decision tree model based on the updated attack deduction data set, iteratively optimizes the hyperparameters, and performs analysis and testing until the decision tree model training meets the standards.

[0042] Specifically, the attack deduction model refers to a decision tree model that takes network traffic anomalies, host intrusion detection results and mapping results as input and takes deduction results as output. The attack deduction data set refers to a data set used to construct the attack deduction model. The attack deduction data set includes historically acquired network traffic anomalies, host intrusion detection results, mapping data and deduction results corresponding to historically acquired network traffic anomalies, host intrusion detection results and mapping data. The deduction training set refers to a data set divided from the attack deduction data set for training the decision tree model. The deduction verification set refers to a data set divided from the attack deduction data set for verifying the training results of the decision tree model. The deduction test set refers to a data set divided from the attack deduction data set for testing the decision tree model. The decision tree model refers to the model basis for constructing the attack deduction model. Architecture, the deduction test accuracy refers to the ratio of the number of correct deduction test samples to the total number of samples in the deduction test set, the preset deduction test accuracy refers to the preset value used to judge the training compliance of the iteratively optimized decision tree model, this embodiment does not limit the preset deduction test accuracy, technical personnel in this field can set it according to actual needs, and only need to meet the requirements for judging the training compliance of the iteratively optimized decision tree model. For example, the preset conflict analysis test accuracy F0 can be set to: 90%≤F0≤95%, the training compliance of the iteratively optimized decision tree model refers to the accuracy compliance of the decision tree model after training, the training compliance of the iteratively optimized decision tree model includes compliance and non-compliance, the deduction result refers to the result output after inputting network traffic anomalies, host intrusion detection results and mapping data into the attack deduction model.

[0043] Specifically, the security analysis module constructs an attack deduction model through an attack deduction model construction method, so that the security analysis module can deduce dangerous attacks and obtain the cause of abnormality of physical equipment in the power grid.

[0044] Specifically, the safety analysis module compares the number of dangers L in the processing data with the preset number of dangers L0, judges the danger triggering situation according to the comparison result, and corrects the calibration process of the device node table update according to the judgment result, wherein: When L<L0, the safety analysis module determines that the danger triggering situation is normal, and does not modify the calibration process of the device node table update; When L≥L0, the safety analysis module determines that the dangerous trigger situation is a trigger anomaly, corrects the calibration process of the device node table update, and corrects the preset unmapped rate Q0 by the correction coefficient PL, setting PL=0.66+0.24×e -(L-L0), obtain the corrected preset unmapped rate Q0x, set Q0x=PL×Q0, replace the preset unmapped rate Q0 with the corrected preset unmapped rate Q0x, and re-compare the unmapped rate Q with the preset unmapped rate Q0.

[0045] Specifically, the preset number of dangers refers to a preset value for judging the danger triggering situation. This embodiment does not limit the specific value of the preset number of dangers. For example, L0 can be set to 3 times. The danger triggering situation refers to whether the number of dangers is normal based on the number of dangers and the preset number of dangers. The danger triggering situation includes normal triggering and abnormal triggering.

[0046] Specifically, the analysis and push module judges the danger triggering situation and corrects the calibration process of updating the device node table according to the judgment result. When the danger triggering situation is a triggering exception, the preset unmapped rate is corrected by setting a correction coefficient that increases with the increase in the number of dangers, thereby reducing the value of the preset unmapped rate. In this way, when the number of dangers is large, the judgment accuracy of the unmapped situation is improved, thereby improving the accuracy of the device node table.

[0047] Specifically, the analysis push module sends the deduction results of the security analysis module to the staff and activates the equipment abnormality alarm.

[0048] Specifically, this embodiment does not limit the specific implementation method of sending the deduction results of the security analysis module to the staff. Those skilled in the art can set it up by themselves according to actual conditions. For example, the deduction results can be sent to the staff's mobile terminal via Wi-Fi signal transmission. The staff mobile terminal refers to the staff's mobile phone. This embodiment does not limit the specific implementation method of starting the equipment abnormality alarm. Those skilled in the art can set it up by themselves according to actual conditions, such as issuing a harsh beeping sound to remind the staff.

[0049] Specifically, the analysis push module sends the deduction results of the security analysis module to the staff and activates the equipment abnormality alarm to notify the staff to repair and control the physical equipment of the power grid to avoid production problems caused by the abnormality of the physical equipment of the power grid.

[0050] Thus far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art may make equivalent changes or substitutions to the relevant technical features, and the technical solutions after such changes or substitutions will fall within the scope of protection of the present invention.

Claims

1. A power system network security situation monitoring system based on SVG networking, characterized in that: include: Data acquisition module, used to collect power grid data and processing process data; A topology analysis module, configured to obtain a topology analysis result based on the SVG primary wiring diagram in the power grid data. The topology analysis result includes a device node table and a connection relationship table, and is configured to update the device node table based on the processing data. The asset mapping module is used to obtain mapping results based on the network data table and topology analysis results in the power grid data, and is also used to calibrate the update of the device node table based on the processing data; The security analysis module is used to judge the security situation based on the power grid data, deduce dangerous attacks based on the judgment results, and correct the calibration process of the device node table update based on the processing data; Analysis push module, used to send the deduction results to staff.

2. The SVG-based power system network security situation monitoring system according to claim 1 is characterized in that: The topology analysis module inputs the SVG primary wiring diagram in the power grid data into the topology analysis model, obtains the topology analysis result output by the topology analysis model, and the topology analysis result includes a device node table and a connection relationship table. The topology analysis module constructs the topology analysis model using a topology analysis model construction method, and the topology analysis model construction method includes: A convolutional neural network model is selected as the basic framework of the topology parsing model, and 70% of the topology parsing sample data set is divided into a topology parsing training set, 15% of the topology parsing learning sample data set is divided into a topology parsing verification set, and 15% of the topology parsing learning sample data set is divided into a topology parsing test set. The convolutional neural network model is trained according to the topology parsing training set, and the weight of the convolutional neural network model is updated by the backpropagation algorithm. After each epoch, the convolutional neural network model is verified using the topology parsing verification set to obtain a parsing verification loss value and a parsing verification accuracy rate. When the parsing verification loss value and the parsing verification accuracy rate meet the preset verification conditions, the convolutional neural network model is tested according to the topology parsing test set to obtain a parsing test accuracy rate. When the parsing test accuracy rate reaches the preset accuracy rate, the convolutional neural network model is output as a topology parsing model. The topology parsing module inputs the SVG primary wiring diagram into the topology parsing model and obtains the topology parsing result output by the topology parsing model. The topology parsing result includes a device node table and a connection relationship table.

3. The SVG-based power system network security situation monitoring system according to claim 2 is characterized in that: The topology analysis module matches the abnormal data of the device node table in the processing data with the expert database, obtains the matching similarity P, compares the matching similarity P with the preset matching similarity P0, judges the data similarity based on the comparison result, and updates the device node table based on the judgment result, wherein: When P≥P0, the topology analysis module determines that the data similarity is similar, updates the device node table, and uses the device node data of the matched expert database as update data to update the device node table; When P<P0, the topology analysis module determines that the data similarity is dissimilar, does not update the device node table, and rematches the abnormal data of the device node table in the processing data with the expert database until P≥P0.

4. The SVG-based power system network security situation monitoring system according to claim 3 is characterized in that: The asset mapping module inputs the network data table and topology analysis results in the power grid data into the asset mapping model, and obtains the mapping results output by the asset mapping model. The asset mapping module constructs the asset mapping model using an asset mapping model construction method, and the asset mapping model construction method includes: A convolutional neural network model is selected as the basic framework of the asset mapping model, and 70% of the asset mapping sample data set is divided into a mapping training set, 20% of the mapping learning sample data set is divided into a mapping validation set, and 10% of the mapping learning sample data set is divided into a mapping test set. The convolutional neural network model is trained according to the mapping training set, and the weight of the convolutional neural network model is updated by the backpropagation algorithm. After each epoch, the convolutional neural network model is verified using the mapping validation set to obtain a mapping verification loss value and a mapping verification accuracy rate. When the mapping verification loss value and the mapping verification accuracy rate meet the preset verification conditions, the convolutional neural network model is tested according to the mapping test set to obtain a mapping test accuracy rate. When the mapping test accuracy rate reaches the preset accuracy rate, the convolutional neural network model is output as the asset mapping model. The asset mapping module inputs the network data table and the topology analysis result into the asset mapping model, and obtains the mapping result output by the asset mapping model.

5. The SVG-based power system network security situation monitoring system according to claim 4 is characterized in that: The asset mapping module calculates the unmapped rate Q based on the number of unmatched mappings N and the total number of mappings M in the mapping results of the processing data, sets Q=N / M×100%, compares the unmapped rate Q with the preset unmapped rate Q0, judges the unmapped situation based on the comparison result, and calibrates the update of the device node table based on the judgment result, wherein: When Q≤Q0, the asset mapping module determines that the unmapped situation is normal and does not calibrate the update of the device node table; When Q>Q0, the asset mapping module determines that the unmapped situation is abnormal, calibrates the update of the device node table, and calibrates the preset matching similarity K0 through the calibration coefficient jz, setting jz=1.30-0.25×e -(Q-Q0) , e is the base of the natural logarithm, and the calibrated preset matching similarity K0j is obtained. Set K0j=jz×K0, replace the preset matching similarity K0 with the calibrated preset matching similarity K0j, and re-compare the matching similarity K with the preset matching similarity K0.

6. The SVG-based power system network security situation monitoring system according to claim 5 is characterized in that: The security analysis module inputs the network traffic anomalies and host intrusion detection results in the power grid data into the security situation assessment model, obtains the security situation assessment value A output by the security situation assessment model, compares the security situation assessment value A with the preset security situation assessment value A0, judges the security situation based on the comparison result, and deduces the dangerous attack based on the judgment result, wherein: When A≤A0, the security analysis module determines that the security situation is safe and does not deduce dangerous attacks; When A>A0, the security analysis module determines that the security situation is dangerous, deduces the dangerous attack, converts the mapping result into mapping data, and inputs the network traffic anomaly, host intrusion detection result and mapping data into the attack deduction model, obtains the deduction result output by the attack deduction model, and transmits the deduction result to the analysis push module.

7. The SVG-based power system network security situation monitoring system according to claim 6 is characterized in that: The security analysis module constructs a security situation assessment model through a security situation assessment model construction method, and the security situation assessment model construction method includes: The situation assessment data set is divided into a 70% evaluation training set, a 15% evaluation validation set, and a 15% evaluation test set. The evaluation training set is input into the recurrent neural network model to train the recurrent neural network model, and the evaluation validation set is input into the trained decision tree. The hyperparameters of the trained decision tree are iteratively optimized, and the evaluation test set is input into the iteratively optimized decision tree to perform a conflict analysis test on the iteratively optimized recurrent neural network model to obtain the evaluation test results. The total number of samples in the evaluation test set is set to b0, the number of correct evaluation test samples is set to b, and the evaluation test accuracy is set to B, B=b / b0. The evaluation test accuracy B is compared with the preset evaluation test accuracy B0. According to the comparison results, the training compliance of the iteratively optimized recurrent neural network model is judged, and the judgment result is output, where: When B≥B0, the security analysis module determines that the iteratively optimized recurrent neural network model training has met the standards, outputs the iteratively optimized recurrent neural network model as a situation assessment model, and provides the conflict detection model to the security analysis module; When B<B0, the security analysis module determines that the training of the iteratively optimized recurrent neural network model does not meet the standards, updates the situation assessment data set to obtain an updated situation assessment data set, and trains the recurrent neural network model, iteratively optimizes hyperparameters, and performs analysis and testing based on the updated situation assessment data set until the recurrent neural network model training meets the standards.

8. The SVG-based power system network security situation monitoring system according to claim 7 is characterized in that: The security analysis module constructs an attack deduction model through an attack deduction model construction method, and the attack deduction model construction method includes: The attack simulation dataset is divided into a 70% simulation training set, a 20% simulation validation set, and a 10% simulation test set. The simulation training set is input into the decision tree model to train the decision tree model, and the simulation validation set is input into the trained decision tree model. The hyperparameters of the trained decision tree model are iteratively optimized. The simulation test set is input into the iteratively optimized decision tree model to perform a conflict analysis test on the iteratively optimized decision tree model to obtain the simulation test results. The total number of samples in the simulation test set is set to f0, the number of correct simulation test samples is set to f, and the simulation test accuracy is set to F, where F=f / f0. The simulation test accuracy F is compared with the preset simulation test accuracy F0. Based on the comparison results, the training compliance of the iteratively optimized decision tree model is judged, and the judgment result is output, where: When F≥F0, the security analysis module determines that the iteratively optimized decision tree model training meets the standards, outputs the iteratively optimized decision tree model as an attack deduction model, and provides the conflict detection model to the security analysis module; When F<F0, the security analysis module determines that the iteratively optimized decision tree model training does not meet the standards, updates the attack deduction data set to obtain an updated attack deduction data set, and trains the decision tree model based on the updated attack deduction data set, iteratively optimizes the hyperparameters, and performs analysis and testing until the decision tree model training meets the standards.

9. The power system network security situation monitoring system based on SVG networking according to claim 8 is characterized in that: The safety analysis module compares the number of dangers L in the processing data with the preset number of dangers L0, judges the danger triggering situation according to the comparison result, and corrects the calibration process of the device node table update according to the judgment result, wherein: When L<L0, the safety analysis module determines that the danger triggering situation is normal, and does not modify the calibration process of the device node table update; When L≥L0, the safety analysis module determines that the dangerous trigger situation is a trigger anomaly, corrects the calibration process of the device node table update, and corrects the preset unmapped rate Q0 by the correction coefficient PL, setting PL=0.66+0.24×e -(L-L0) , obtain the corrected preset unmapped rate Q0x, set Q0x=PL×Q0, replace the preset unmapped rate Q0 with the corrected preset unmapped rate Q0x, and re-compare the unmapped rate Q with the preset unmapped rate Q0.

10. The power system network security situation monitoring system based on SVG networking according to claim 9 is characterized in that: The analysis push module sends the deduction results of the safety analysis module to the staff and activates the equipment abnormality alarm.

Images