Power network security defense method and device based on digital twinning

Abstract

The invention discloses a power network security defense method and device based on digital twinning, and belongs to the technical field of network security, and the method comprises the steps: obtaining the power data of a power network in real time; constructing a digital twinborn simulation environment of the power network according to the power data; extracting electric power characteristic data in a digital twinborn simulation environment; performing layer-by-layer risk analysis on the power feature data according to each layer of hyperplane function of a preset decision tree, and determining a risk type and a risk matrix of the power network; in a digital twin simulation environment, reconstructing a propagation path of the current attack according to the risk matrix; and generating a security defense strategy of the power network according to the risk type and the propagation path. Therefore, by implementing the method and the device, the problem of low accuracy of power network risk detection in the prior art can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a power network security defense method and device based on digital twinning. BACKGROUND

[0002] The current power network security is in a key stage of digital transformation and security integration. Although there is a relatively perfect partition and domain architecture and security device deployment system, there are still problems such as incomplete asset identification, difficult control of horizontal traffic, extensive permission management, and fragmented alarm information, which makes it difficult to deal with advanced persistent threats (APT) and internal and external coordinated attacks.

[0003] The current power network security protection is still mainly based on traditional border defense, and the existing detection mode of the power network mainly carries out independent risk monitoring for a single device, without considering the coupling relationship between devices, which makes it impossible to identify the characteristics of risk extension and diffusion along the device association link. Therefore, the traditional power network risk detection method cannot simulate the evolution path of risk between multiple devices, and the dynamic diffusion process of risk is completely missed, resulting in low accuracy of power network risk detection. SUMMARY

[0004] The present application provides a power network security defense method and device based on digital twinning, which can solve the problem of low accuracy of power network risk detection in the prior art.

[0005] In order to solve the above technical problems, the present application provides a power network security defense method based on digital twinning, comprising:

[0006] Real-time acquisition of power data of the power network; wherein the power data includes device operation parameters, network traffic data and user operation behavior;

[0007] According to the power data, a digital twin simulation environment of the power network is constructed;

[0008] Extracting power feature data in the digital twin simulation environment;

[0009] According to the hyperplane function of each layer of the preset decision tree, the power feature data is analyzed layer by layer to determine the risk type and risk matrix of the power network;

[0010] In the digital twin simulation environment, the propagation path of the current attack is reconstructed according to the risk matrix;

[0011] According to the risk type and the propagation path, a security defense strategy of the power network is generated.

[0012] As a preferred solution, the constructing the digital twin simulation environment of the power network according to the power data comprises:

[0013] Obtaining a topology graph of the power network;

[0014] Establishing a topological relationship between a plurality of nodes and a plurality of distribution lines according to the topology graph;

[0015] Determining topological information of the plurality of nodes and the plurality of distribution lines according to the power data;

[0016] Constructing the digital twin simulation environment of the power network according to the topological relationship and the topological information.

[0017] As a preferred solution, the extracting power feature data in the digital twin simulation environment comprises:

[0018] Performing feature extraction on device operation parameters in the digital twin simulation environment to obtain device state features; wherein the device state features comprise substation device operation state features, generator set state features, distribution line operation state features, and node operation state features;

[0019] Performing feature extraction on network flow data in the digital twin simulation environment to obtain network flow features; wherein the network flow features comprise network flow protocol distribution, network flow abnormal protocol quantity, network flow failed connection times, packet loss rate, retransmission rate, and average packet size;

[0020] Performing feature extraction on user operation behavior in the digital twin simulation environment to obtain log-related features; wherein the log-related features comprise security device log failed login times and USB connection times;

[0021] Data fusion of the device state features, the network flow features, and the log-related features to form power feature data.

[0022] As a preferred solution, the performing layer-by-layer risk analysis on the power feature data according to each layer hyperplane function of a preset decision tree to determine the risk type and risk matrix of the power network comprises:

[0023] Performing first risk analysis on the power feature data according to a first layer hyperplane function of a preset decision tree to determine whether the power network is normal;

[0024] When it is determined that the power network is normal, outputting that the risk type of the power network is normal;

[0025] When it is judged to be abnormal, a second risk analysis is performed on the power feature data according to a second layer hyperplane function of a preset decision tree, to determine whether the risk type of the power network is a preset first abnormal type;

[0026] When it is judged to be the preset first abnormal type, it is output that the risk type of the power network is the preset first abnormal type, and a corresponding risk matrix is output;

[0027] When it is judged not to be the preset first abnormal type, a further risk analysis is performed on the power feature data according to a next layer hyperplane function of the preset decision tree, until the risk type and the risk matrix of the power network are determined.

[0028] As a preferred solution, the generation process of each layer hyperplane function of the preset decision tree is as follows:

[0029] According to a binary tree structure as a basic framework of the preset decision tree;

[0030] Normal feature data and abnormal feature data corresponding to a plurality of abnormal types are collected to construct a feature matrix and a label matrix;

[0031] The mean and variance of each column data in the feature matrix are calculated, and the feature matrix is standardized to obtain a standardized matrix;

[0032] For each layer of the preset decision tree, a classification objective function and a constraint condition are constructed respectively; wherein the classification objective function includes a to-be-solved hyperplane normal vector;

[0033] Based on the standardized matrix and the constraint condition, the classification objective function is solved to solve the to-be-solved hyperplane normal vector, and each layer hyperplane function of the preset decision tree is determined.

[0034] As a preferred solution, the determination of the risk matrix includes:

[0035] According to the digital twin simulation environment, the importance of each node in the digital twin simulation environment is determined;

[0036] According to the risk type of the power network, the attack risk degree of each node in the digital twin simulation environment is determined;

[0037] According to the importance and attack risk degree of each node, the risk value of each node is calculated;

[0038] According to the risk value of each node, the risk matrix of the power network is constructed.

[0039] As a preferred solution, the reconstruction of the propagation path of the current attack in the digital twin simulation environment according to the risk matrix includes:

[0040] According to the risk matrix, a risk value of each power distribution line in the digital twin simulation environment is determined;

[0041] Based on the risk value of each power distribution line, a dynamic weight matrix of the power network is constructed;

[0042] Based on the dynamic weight matrix, a propagation path of the current attack is reconstructed using a breadth-first search algorithm.

[0043] As a preferred solution, based on the dynamic weight matrix, the propagation path of the current attack is reconstructed using a breadth-first search algorithm, comprising:

[0044] The node with the largest risk value in the digital twin simulation environment is determined as the starting abnormal node of the propagation path;

[0045] According to the dynamic weight matrix, the priority power distribution line with the largest weight value is determined among the several power distribution lines connected to the starting abnormal node;

[0046] Along the priority power distribution line, the next abnormal node connected to the starting abnormal node in the propagation path is determined;

[0047] By analogy, the propagation path of the current attack is reconstructed.

[0048] As a preferred solution, the security defense strategy of the power network is generated according to the risk type and the propagation path, comprising:

[0049] According to the risk type, a corresponding defense strategy template is matched in a preset strategy rule library;

[0050] The defense measures are determined in combination with the propagation path and the defense strategy template, so that the security defense operation is performed on each node in the propagation path according to the defense measures.

[0051] Correspondingly, the application provides a power network security defense device based on digital twinning, comprising a data acquisition module, a digital twin construction module, a feature extraction module, a risk analysis module, a propagation path reconstruction module and a security defense module.

[0052] The data acquisition module is used to acquire power data of the power network in real time; wherein the power data includes device operation parameters, network traffic data and user operation behavior;

[0053] The digital twin construction module is used to construct a digital twin simulation environment of the power network according to the power data;

[0054] The feature extraction module is used to extract power feature data in the digital twin simulation environment;

[0055] The risk analysis module is used to perform layer-by-layer risk analysis on the power characteristic data according to the hyperplane functions of each layer of the preset decision tree, and to determine the risk type and risk matrix of the power network.

[0056] The propagation path reconstruction module is used to reconstruct the propagation path of the current attack based on the risk matrix in the digital twin simulation environment.

[0057] The security defense module is used to generate a security defense strategy for the power network based on the risk type and the propagation path.

[0058] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0059] This invention provides a power network security defense method based on digital twins. It involves acquiring real-time power network data; constructing a digital twin simulation environment for the power network based on the power data; extracting power feature data within the digital twin simulation environment; performing layer-by-layer risk analysis on the power feature data according to the hyperplane functions of each layer of a pre-defined decision tree to determine the risk type and risk matrix of the power network; reconstructing the propagation path of the current attack based on the risk matrix within the digital twin simulation environment; and generating a power network security defense strategy based on the risk type and propagation path. This invention constructs a digital twin based on real-time power network data, performs risk assessment based on the power feature data extracted from the digital twin simulation environment, and reconstructs the attack propagation path within the digital twin simulation environment based on the risk assessment results. It considers the inter-device coupling relationships and simulates the evolution path of risks across multiple devices, thereby more comprehensively identifying attacked network nodes and effectively improving the accuracy of power network risk detection. Attached Figure Description

[0060] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0061] Figure 1 A flowchart illustrating an embodiment of the power network security defense method based on digital twin provided by the present invention;

[0062] Figure 2 A schematic diagram of the structure of one embodiment of the decision tree provided by the present invention;

[0063] Figure 3 This is a schematic diagram of an embodiment of the power network security defense device based on digital twins provided by the present invention. Detailed Implementation

[0064] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0066] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0067] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0068] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0069] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0070] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0071] See Figure 1 To address the issue of low accuracy in power network risk detection in existing technologies, an embodiment of the present invention provides a power network security defense method based on digital twins. This method includes steps 101 to 106, each step of which is detailed below:

[0072] Step 101: Acquire power data from the power network in real time; wherein the power data includes equipment operating parameters, network traffic data, and user operation behavior.

[0073] In this embodiment of the invention, power data from the power network can be collected through acquisition agents deployed on power terminal equipment, network boundaries, and core nodes, via channels such as industrial Ethernet and private wireless networks. Power data includes equipment operating parameters, network traffic data, and user operation behaviors. Equipment operating parameters include the operating status of substation equipment (circuit breakers, transformers, relay protection devices, etc.), generator set status data (speed, voltage, current, etc.), and the operating status of distribution lines and nodes. Network traffic data includes protocol type, data packet size, packet header information, latency, packet loss rate, and traffic statistics. User operation behaviors include login time and command permissions.

[0074] In this embodiment of the invention, after collecting power data from the power network, multi-source heterogeneous data fusion is performed to ensure data integrity and timeliness. Next, data preprocessing (including noise reduction, format conversion, and time synchronization) is carried out, and then the national cryptographic algorithm SM4 is used to encrypt the data for transmission, thereby ensuring the integrity of the original data and providing comprehensive raw data support for subsequent digital twin modeling and security analysis.

[0075] Step 102: Based on the power data, construct a digital twin simulation environment for the power network.

[0076] In this embodiment of the invention, a two-way interactive model of "physical entity-virtual mapping" is constructed based on the collected store data. The constructed digital twin simulation environment synchronizes the state changes of the physical network, such as device start-up and shutdown, and line switching, and supports three-dimensional visualization and simulation.

[0077] As a preferred embodiment, a digital twin simulation environment for the power network is constructed based on the power data, including:

[0078] Obtain the topology of the power network;

[0079] Based on the aforementioned topology diagram, establish the topological relationships between several nodes and several power distribution lines;

[0080] Based on the power data, determine the topology information of several nodes and several power distribution lines;

[0081] Based on the topological relationships and the topological information, a digital twin simulation environment for the power network is constructed.

[0082] In this embodiment of the invention, a digital twin simulation environment for a power network is constructed. First, a topology map of the power network is acquired. Based on the topology map, the connection methods between various devices in the power network can be determined, thereby establishing the topological relationships between power grid nodes (generators, substations, load nodes, etc.) and connecting lines in the digital twin simulation environment. The collected power data can dynamically update the topology information, reflecting equipment start-up and shutdown, line status changes, network traffic changes, etc., completing the virtual mapping of the power network and realizing dynamic visualization and simulation of the power system's operating status, thus assisting in security situation awareness and risk prediction.

[0083] Step 103: Extract power characteristic data from the digital twin simulation environment.

[0084] As a preferred embodiment, extracting power characteristic data in the digital twin simulation environment includes:

[0085] Feature extraction is performed on the equipment operating parameters in the digital twin simulation environment to obtain equipment status features; wherein, the equipment status features include substation equipment operating status features, generator set operating status features, power distribution line operating status features, and node operating status features;

[0086] Feature extraction is performed on network traffic data in the digital twin simulation environment to obtain network traffic characteristics; wherein, the network traffic characteristics include network traffic protocol distribution, number of abnormal network traffic protocols, number of failed network connections, packet loss rate, retransmission rate, and average packet size;

[0087] Feature extraction is performed on user operation behavior in the digital twin simulation environment to obtain log-related features; wherein, the log-related features include the number of failed logins and the number of USB connections in the security device logs;

[0088] The device status characteristics, network traffic characteristics, and log-related characteristics are fused to form power characteristic data.

[0089] In this embodiment of the invention, the digital twin simulation environment includes collected power data. Therefore, feature extraction can be performed on equipment operating parameters, network traffic data, and user operation behavior to detect security risks based on the extracted features. Specifically, equipment status features can be extracted from equipment operating parameters, network traffic features from network traffic data, and log-related features from user operation behavior. Fusing the equipment status features, network traffic features, and log-related features generates power feature data for risk detection.

[0090] Step 104: Based on the hyperplane functions of each layer of the preset decision tree, perform layer-by-layer risk analysis on the power characteristic data to determine the risk type and risk matrix of the power network.

[0091] As a preferred embodiment, based on the hyperplane functions of each layer of the preset decision tree, a layer-by-layer risk analysis is performed on the power characteristic data to determine the risk type and risk matrix of the power network, including:

[0092] Based on the first hyperplane function of the preset decision tree, a first risk analysis is performed on the power characteristic data to determine whether the power network is normal.

[0093] When the judgment is normal, the risk type of the power network is output as normal;

[0094] When an anomaly is detected, a second risk analysis is performed on the power characteristic data based on the second-layer hyperplane function of the preset decision tree to determine whether the risk type of the power network is a preset first anomaly type.

[0095] When the risk type is determined to be the preset first anomaly type, the risk type of the power network is output as the preset first anomaly type, and the corresponding risk matrix is ​​output.

[0096] When it is determined that the power characteristic data is not the preset first anomaly type, further risk analysis is performed on the power characteristic data according to the next layer hyperplane function of the preset decision tree until the risk type and risk matrix of the power network are determined.

[0097] In this embodiment of the invention, decision trees are used to identify the risk types of the power network, thereby determining the risk matrix of the power network. Since different risk types are linearly inseparable in the simulation environment, a soft-margin support vector machine (SVM) model based on a Gaussian kernel function can be used for classification.

[0098] As an example of an embodiment of the present invention, seeFigure 2 This is a schematic diagram of an embodiment of the decision tree provided by the present invention. Since the power network is normal in most cases, the normal data is first separated during the first soft-split support vector machine (SVM) classification; then, the abnormal case 1 data is separated during the second soft-split SVM classification; each time, the data is divided into one side for abnormal cases and the other side for the remaining abnormal cases. In the final classification, the last known abnormal case is assigned to the left child node, and the unknown abnormal cases are assigned to the right child node. At the end of each classification, the left child node is marked as +1, and the right child node is marked as -1. Specifically, when using the soft-split SVM classification model, the hyperplane functions of each layer are used to perform risk analysis on the power characteristic data.

[0099] As a preferred embodiment, the generation process of the hyperplane functions of each layer of the preset decision tree is as follows:

[0100] The binary tree structure is used as the basic architecture for the pre-defined decision tree.

[0101] Collect normal feature data and abnormal feature data corresponding to several types of anomalies, and construct feature matrix and label matrix;

[0102] Calculate the mean and variance of each column of data in the feature matrix, and then standardize the feature matrix to obtain a standardized matrix.

[0103] For each layer of the preset decision tree, a classification objective function and constraints are constructed respectively; wherein, the classification objective function includes the hyperplane normal vector to be determined;

[0104] Based on the standardized matrix and the constraints, the classification objective function is solved to obtain the normal vector of the hyperplane to be determined, and the hyperplane functions of each layer of the preset decision tree are determined.

[0105] In this embodiment of the invention, by training a soft-margin support vector machine model, the hyperplane functions of each layer of a preset decision tree can be determined. First, a binary tree structure is used to design the preset decision tree. Then, feature data of the power network under normal conditions and feature data under various abnormal risks are collected to construct feature matrix A and label matrix Y.

[0106]

[0107] Y = (y1 y2…y N ) T

[0108] In the formula, N represents the number of data collections, i.e., the number of training set samples; M represents the number of features selected; a represents the feature value of the sample; and y represents the label value of each sample. y∈{+1,-1} represents the classification result of the sample, i.e., the result after the decision tree completes one classification. In each classification by the decision tree, y=+1 can be set as normal data and y=-1 as abnormal data.

[0109] To improve model performance and reduce data noise, feature engineering is required. First, missing values ​​in the initial matrix are removed, followed by normalization.

[0110] First, the mean μ and variance δ of each column of the initial matrix need to be calculated. Then, the values ​​of the initial matrix are processed using the following method:

[0111]

[0112] In the formula, b is the processed feature value; a is the feature value of the sample; μ is the sample mean; and δ is the sample variance.

[0113] Then, the processed feature values ​​are standardized:

[0114]

[0115] In the formula, x is the standardized eigenvalue.

[0116] Based on the standardized eigenvalues, the standardized matrix X is obtained:

[0117]

[0118] The normalized matrix is ​​used to train the soft-margin support vector machine model.

[0119] In the training process of the soft-margin support vector machine model, the classification objective function and constraints of each layer in the decision tree are first determined. The classification objective function is:

[0120]

[0121] In the formula, w is the hyperplane normal vector; C is the penalty coefficient, used to control the balance between error classification and margin; ξ i ≥0 is the relaxation factor, which represents the allowable error range for the i-th sample.

[0122] The constraints are:

[0123] y i [w T φ(x i )+b]≥1-ξ i ,ξ≥0,i=1,2,...,N

[0124] When the input data is noisy, there will be some outliers. A smaller penalty coefficient C will cause the support vector machine model to tend towards a "soft margin." This type of margin allows for more misclassifications, which can improve the model's generalization ability and reduce the risk of overfitting. Therefore, at the beginning of model training, you can choose to start the penalty coefficient C from 0.1 or 1.

[0125] During the initial classification, the first-level classification hyperplane of the decision tree is f. (1) (x)w T φ(x)+b separates the data from the normal case. The hyperplane normal vector w and the bias term b are the unknowns, which can be solved using the Lagrange multiplier method.

[0126] Specifically, we first introduce parameters λ and μ, and equate solving the classification objective function with solving the following equation:

[0127]

[0128] The constraint is equivalent to the following formula:

[0129]

[0130] Introducing the Gaussian kernel function K(x) i ,x j )=exp(-γ||x i -x j || 2 )=φ(x i )φ(x j ), where γ ranges from (0,1], and can be taken within this range.

[0131] The following describes how to use the Sequential Minimal Optimization (SMO) algorithm to solve all the Lagrange multipliers λ in equation (3):

[0132] First, assume that all values ​​of λ are 0;

[0133] Then, in each iteration, choose any two λ values. i and λ j Introduce two variables L and H. If y i =y j Then L = max(0, λ) j +λ i -C), H=min(C,λ) i +λ j If y i ≠y j Then L = max(0, λ) j -λ iH = min(C, C + λ) j -λ i );

[0134] The next step is to calculate the new λ. j , in,

[0135]

[0136] η=2exp(-γ||x i -x j || 2 )-exp(-γ||x i -x i || 2 )-exp(-γ||x j -x j || 2 ).

[0137] Will Substitute the values ​​into the range calculated by the constraint conditions; if the range is exceeded, trim it to L or H.

[0138] Calculate the new λ i ,

[0139] Update bias term b,

[0140] Repeat the above process until all λ satisfy the KKT (Karush-Kuhn-Tucker) conditions, thus obtaining the calculation result; the KKT conditions are as follows:

[0141]

[0142] λ i [y i (w T φ(x i )+b)-1+ξ i ] = 0, i = 1, 2, ..., N

[0143] μ i ξ i =0,i=1,2,...,Nμ i ≥0, i=1,2,...,N

[0144] When all the calculated λ values ​​are substituted into... The normal vector w of the support vector machine hyperplane of the first-level decision tree can then be obtained. Here, φ(x) is the transformation function from low dimension to high dimension, and b is the bias term.

[0145] Therefore, the support vector machine hyperplane function of the first-level decision tree is:

[0146]

[0147] Using the second-layer decision tree to separate outlier case 1 from the remaining outliers, the optimal splitting hyperplane function of the second layer is obtained as follows:

[0148]

[0149] This method is used to segment the data until the final outlier N and unknown outliers are identified. If the classification result is unsatisfactory, the kernel function K(x) can be changed. i ,x j The model is adjusted using the penalty coefficient C until it can fit the training set data well.

[0150] As a preferred embodiment, the determination of the risk matrix includes:

[0151] Based on the digital twin simulation environment, determine the importance of each node in the digital twin simulation environment;

[0152] Based on the risk type of the power network, determine the attack risk level of each node in the digital twin simulation environment;

[0153] Calculate the risk value of each node based on its importance and the degree of attack risk;

[0154] A risk matrix for the power network is constructed based on the risk value of each node.

[0155] In this embodiment of the invention, after determining the risk types of the power network, the risk value of each node in the digital twin simulation environment can be calculated, thereby constructing a risk matrix for the power network. The risk value of each node in the digital twin simulation environment consists of two parts: the node's importance and the attack risk level. The node's importance is determined based on the business criticality of the node's equipment and is predefined. For example, the importance of a dispatch center node is 10, and the importance of a regular monitoring terminal node is 3. The node's importance value can range from 1 to 10, with higher values ​​indicating greater equipment importance. The attack risk level corresponds to different risk types. Based on different risk types, all abnormal situations are first uniformly scored, with values ​​ranging from 0 to 10. Higher values ​​indicate a more severe potential attack on the equipment.

[0156] In this embodiment of the invention, after obtaining the importance of each node and the attack risk level of each node according to the determined risk type, the risk value of the node can be calculated according to the formula NodeRisk = Importance_Score × Threat_Score. Wherein, NodeRisk is the node risk value; Importance_Score is the importance of the node; and Threat_Score is the attack risk level of the node.

[0157] Step 105: In the digital twin simulation environment, reconstruct the propagation path of the current attack based on the risk matrix.

[0158] As a preferred embodiment, the step of reconstructing the propagation path of the current attack based on the risk matrix in the digital twin simulation environment includes:

[0159] Based on the risk matrix, determine the risk value of each power distribution line in the digital twin simulation environment;

[0160] Based on the risk value of each distribution line, a dynamic weight matrix of the power network is constructed;

[0161] Based on the dynamic weight matrix, a breadth-first search algorithm is used to reconstruct the propagation path of the current attack.

[0162] In this embodiment of the invention, reconstructing the propagation path of the current attack first requires calculating the risk value of each power distribution line in the digital twin simulation environment based on the risk value of each node in the risk matrix. Specifically, the risk value of the power distribution line is calculated based on the risk values ​​of the nodes at both ends of the power distribution line:

[0163] NodeRisk'=α·Avg.NodeRisk+β·FlowRisk

[0164] In the formula, NodeRisk' is the risk value of the power distribution line; Avg.NodeRisk is the average risk value of the nodes at both ends of the power distribution line; FlowRisk is the number of abnormal communications between the nodes at both ends of the power distribution line; α and β are coefficients that can be taken between 0 and 1.

[0165] After calculating the risk value of the distribution lines, a dynamic weight matrix W for the power network is constructed:

[0166]

[0167] In the formula, q represents the total number of nodes; w ij The value represents the weight of the power distribution line between node i and node j.

[0168] Collect logs from all anomaly-related node devices segmented by soft-split support vector machine to obtain a threat event log set:

[0169] Event = (Node src Node dst (T,Type,Threat)

[0170] In the formula, Node_src is the event source node; Node_dst is the event target node; T is the timestamp (accurate to milliseconds), used to determine the propagation order; Type is the risk type (such as scanning, access attempt, malicious code execution, etc.); Threat is the risk value (range [0,10]).

[0171] Retrieve event sequences by time:

[0172] EventSeq = {e1, e2, ..., e n}T(e i )≤T(e i+1 )

[0173] In the formula, e represents the event mentioned above; T represents the event timestamp.

[0174] By using the Breadth First Search (BFS) algorithm combined with timestamps and a dynamic weight matrix, the propagation path and event sequence of the current attack can be reconstructed.

[0175] As a preferred embodiment, based on the dynamic weight matrix, a breadth-first search algorithm is used to reconstruct the propagation path of the current attack, including:

[0176] The node with the highest risk value in the digital twin simulation environment is identified as the starting abnormal node of the propagation path;

[0177] Based on the dynamic weight matrix, the priority power distribution line with the largest weight value is determined among several power distribution lines connected to the initial abnormal node.

[0178] Along the priority power distribution line, determine the next abnormal node in the propagation path that is connected to the initial abnormal node;

[0179] By analogy, the propagation path of the current attack can be reconstructed.

[0180] In this embodiment of the invention, the node with the highest risk value is first determined as the starting abnormal node of the propagation path. Then, based on the dynamic weight matrix, the power distribution line with the highest weight value is determined among multiple power distribution lines linked to the starting abnormal node. The next abnormal node in the propagation path is determined along this power distribution line, thereby reconstructing the propagation path of the current attack.

[0181] In this embodiment of the invention, the following conditions must be met each time a node connected to the current node is searched:

[0182] (1) When traversing adjacent nodes, the source node must be guaranteed to be Node src Node of destination dst All of them satisfy the value of the Event event.

[0183] (2) In the traversed path, the event timestamps between each passing node must satisfy:

[0184] T dst ≥T src +Δt

[0185] In the formula, Δt is the propagation delay of the link (which can be obtained by link monitoring or preset).

[0186] Step 106: Generate a security defense strategy for the power network based on the risk type and the propagation path.

[0187] As a preferred embodiment, a security defense strategy for the power network is generated based on the risk type and the propagation path, including:

[0188] Based on the risk type, the corresponding defense strategy template is matched from the preset strategy rule base;

[0189] Defense measures are determined by combining the propagation path and the defense strategy template, and security defense operations are performed on each node on the propagation path according to the defense measures.

[0190] In this embodiment of the invention, after determining the risk type and the propagation path of the current attack, a preset policy rule base is invoked to match the risk type with the defense policy template in the preset policy rule base. Based on the matched defense policy template, defense measures for each node on the propagation path are determined. Then, security defense operations are performed on each node through security device control interfaces, zero-trust access policy adjustments, micro-segmentation isolation and blocking, etc. Finally, the defense execution process is replayed in the digital twin simulation environment to confirm that the protection measures are effective and do not affect business operations.

[0191] Implementing the above embodiments has the following effects:

[0192] This invention provides a power network security defense method based on digital twins. It involves acquiring real-time power network data; constructing a digital twin simulation environment for the power network based on the power data; extracting power feature data within the digital twin simulation environment; performing layer-by-layer risk analysis on the power feature data according to the hyperplane functions of each layer of a pre-defined decision tree to determine the risk type and risk matrix of the power network; reconstructing the propagation path of the current attack based on the risk matrix within the digital twin simulation environment; and generating a power network security defense strategy based on the risk type and propagation path. This invention constructs a digital twin based on real-time power network data, performs risk assessment based on the power feature data extracted from the digital twin simulation environment, and reconstructs the attack propagation path within the digital twin simulation environment based on the risk assessment results. It considers the inter-device coupling relationships and simulates the evolution path of risks across multiple devices, thereby more comprehensively identifying attacked network nodes and effectively improving the accuracy of power network risk detection.

[0193] like Figure 3 As shown, based on the above method embodiments, corresponding apparatus embodiments are provided;

[0194] An embodiment of the present invention provides a power network security defense device based on digital twin, comprising: a data acquisition module, a digital twin construction module, a feature extraction module, a risk analysis module, a propagation path reconstruction module, and a security defense module;

[0195] The data acquisition module is used to acquire power data from the power network in real time; wherein, the power data includes equipment operating parameters, network traffic data, and user operation behavior;

[0196] The digital twin construction module is used to construct a digital twin simulation environment for the power network based on the power data;

[0197] The feature extraction module is used to extract power feature data in the digital twin simulation environment;

[0198] The risk analysis module is used to perform layer-by-layer risk analysis on the power characteristic data according to the hyperplane functions of each layer of the preset decision tree, and to determine the risk type and risk matrix of the power network.

[0199] The propagation path reconstruction module is used to reconstruct the propagation path of the current attack based on the risk matrix in the digital twin simulation environment.

[0200] The security defense module is used to generate a security defense strategy for the power network based on the risk type and the propagation path.

[0201] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement the power network security defense method based on digital twin provided by any of the above-described method embodiments of the present invention.

[0202] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0203] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A power network security defense method based on digital twins, characterized in that, include: Real-time acquisition of power data from the power network; wherein, the power data includes equipment operating parameters, network traffic data, and user operation behavior; Based on the power data, construct a digital twin simulation environment for the power network; Extract power characteristic data from the digital twin simulation environment; Based on the hyperplane functions of each layer of the preset decision tree, a layer-by-layer risk analysis is performed on the power characteristic data to determine the risk type and risk matrix of the power network; In the digital twin simulation environment, the propagation path of the current attack is reconstructed based on the risk matrix; Based on the risk type and the propagation path, a security defense strategy for the power network is generated.

2. The power network security defense method based on digital twins according to claim 1, characterized in that, The process of constructing a digital twin simulation environment for the power network based on the power data includes: Obtain the topology of the power network; Based on the aforementioned topology diagram, establish the topological relationships between several nodes and several power distribution lines; Based on the power data, determine the topology information of several nodes and several power distribution lines; Based on the topological relationships and the topological information, a digital twin simulation environment for the power network is constructed.

3. The power network security defense method based on digital twins according to claim 1, characterized in that, The extraction of power characteristic data in the digital twin simulation environment includes: Feature extraction is performed on the equipment operating parameters in the digital twin simulation environment to obtain equipment status features; wherein, the equipment status features include substation equipment operating status features, generator set operating status features, power distribution line operating status features, and node operating status features; Feature extraction is performed on network traffic data in the digital twin simulation environment to obtain network traffic characteristics; wherein, the network traffic characteristics include network traffic protocol distribution, number of abnormal network traffic protocols, number of failed network connections, packet loss rate, retransmission rate, and average packet size; Feature extraction is performed on user operation behavior in the digital twin simulation environment to obtain log-related features; wherein, the log-related features include the number of failed logins and the number of USB connections in the security device logs; The device status characteristics, network traffic characteristics, and log-related characteristics are fused to form power characteristic data.

4. The power network security defense method based on digital twins according to claim 1, characterized in that, The step of performing layer-by-layer risk analysis on the power characteristic data based on the hyperplane functions of each layer of the preset decision tree to determine the risk type and risk matrix of the power network includes: Based on the first hyperplane function of the preset decision tree, a first risk analysis is performed on the power characteristic data to determine whether the power network is normal. When the judgment is normal, the risk type of the power network is output as normal; When an anomaly is detected, a second risk analysis is performed on the power characteristic data based on the second-layer hyperplane function of the preset decision tree to determine whether the risk type of the power network is a preset first anomaly type. When the risk type is determined to be the preset first anomaly type, the risk type of the power network is output as the preset first anomaly type, and the corresponding risk matrix is ​​output. When it is determined that the power characteristic data is not the preset first anomaly type, further risk analysis is performed on the power characteristic data according to the next layer hyperplane function of the preset decision tree until the risk type and risk matrix of the power network are determined.

5. The power network security defense method based on digital twins according to claim 4, characterized in that, The generation process of the hyperplane functions at each layer of the preset decision tree is as follows: The binary tree structure is used as the basic architecture for the pre-defined decision tree. Collect normal feature data and abnormal feature data corresponding to several types of anomalies, and construct feature matrix and label matrix; Calculate the mean and variance of each column of data in the feature matrix, and then standardize the feature matrix to obtain a standardized matrix. For each layer of the preset decision tree, a classification objective function and constraints are constructed respectively; wherein, the classification objective function includes the hyperplane normal vector to be determined; Based on the standardized matrix and the constraints, the classification objective function is solved to obtain the normal vector of the hyperplane to be determined, and the hyperplane functions of each layer of the preset decision tree are determined.

6. The power network security defense method based on digital twins according to claim 4, characterized in that, The determination of the risk matrix includes: Based on the digital twin simulation environment, determine the importance of each node in the digital twin simulation environment; Based on the risk type of the power network, determine the attack risk level of each node in the digital twin simulation environment; Calculate the risk value of each node based on its importance and the degree of attack risk; A risk matrix for the power network is constructed based on the risk value of each node.

7. The power network security defense method based on digital twins according to claim 6, characterized in that, In the digital twin simulation environment, reconstructing the propagation path of the current attack based on the risk matrix includes: Based on the risk matrix, determine the risk value of each power distribution line in the digital twin simulation environment; Based on the risk value of each distribution line, a dynamic weight matrix of the power network is constructed; Based on the dynamic weight matrix, a breadth-first search algorithm is used to reconstruct the propagation path of the current attack.

8. The power network security defense method based on digital twins according to claim 7, characterized in that, The process of reconstructing the propagation path of the current attack based on the dynamic weight matrix using a breadth-first search algorithm includes: The node with the highest risk value in the digital twin simulation environment is identified as the starting abnormal node of the propagation path; Based on the dynamic weight matrix, the priority power distribution line with the largest weight value is determined among several power distribution lines connected to the initial abnormal node. Along the priority power distribution line, determine the next abnormal node in the propagation path that is connected to the initial abnormal node; By analogy, the propagation path of the current attack can be reconstructed.

9. The power network security defense method based on digital twins according to claim 8, characterized in that, The step of generating a security defense strategy for the power network based on the risk type and the propagation path includes: Based on the risk type, the corresponding defense strategy template is matched from the preset strategy rule base; Defense measures are determined by combining the propagation path and the defense strategy template, and security defense operations are performed on each node on the propagation path according to the defense measures.

10. A power network security defense device based on digital twins, characterized in that, include: The system includes a data acquisition module, a digital twin construction module, a feature extraction module, a risk analysis module, a propagation path reconstruction module, and a security defense module. The data acquisition module is used to acquire power data from the power network in real time; wherein, the power data includes equipment operating parameters, network traffic data, and user operation behavior; The digital twin construction module is used to construct a digital twin simulation environment for the power network based on the power data; The feature extraction module is used to extract power feature data in the digital twin simulation environment; The risk analysis module is used to perform layer-by-layer risk analysis on the power characteristic data according to the hyperplane functions of each layer of the preset decision tree, and to determine the risk type and risk matrix of the power network. The propagation path reconstruction module is used to reconstruct the propagation path of the current attack based on the risk matrix in the digital twin simulation environment. The security defense module is used to generate a security defense strategy for the power network based on the risk type and the propagation path.

Images