Power metering system network security situation analysis method and system based on big data

Abstract

The invention provides an electric power metering system network security situation analysis method and system based on big data, and relates to the technical field of electric power system information security. According to the method, network traffic, system logs, security alarms, asset information, vulnerability records and external threat intelligence are collected, a security data lake is constructed, and security situation factors are extracted; outputting an anomaly detection result and a threat classification result by using the unsupervised anomaly detection model and the supervised threat classification model; calculating an asset security risk value and an overall security risk value by combining the vulnerability severity and the asset importance, and generating an overall security index, an attack threat level and a vulnerability level; and a time sequence prediction model is further constructed based on the network security situation indexes, and future situation prediction and security early warning are realized. According to the invention, comprehensive perception, accurate analysis and active defense of the network security situation can be realized.

Description

Technical Field

[0001] This invention relates to the field of power system information security technology, and in particular to a method and system for network security situation analysis of power metering systems based on big data. Background Technology

[0002] With the rapid development of smart grids, power metering systems (such as Advanced Metering Architectures, AMIs) have evolved from traditional closed and isolated systems into open and interconnected network environments. Hundreds of millions of smart meters, data concentrators, metering data management systems, and other terminal devices are connected to the power communication network, continuously generating a large amount of metering business data and operation logs. While improving the intelligence level and refined management capabilities of the power grid, this also exposes power metering systems to complex and ever-changing cyberspace threats.

[0003] In recent years, cyberattacks targeting power metering systems, such as data theft, botnet control of electricity meters, malicious firmware updates, and denial-of-service attacks, have occurred frequently. The attack chains are becoming increasingly covert, persistent, and collaborative, posing a serious threat to the safe and stable operation of the power system and the protection of user data privacy.

[0004] Existing cybersecurity protection measures for power metering systems mostly remain at the level of boundary protection and static policies, which have significant limitations: First, the logs and alarms generated by security devices (such as firewalls and intrusion detection systems, IDS) and business systems (such as metering data management systems) are independent of each other, forming data silos. They lack a unified big data platform and correlation analysis mechanism, making it difficult to detect complex collaborative attacks across devices and levels in a timely manner. Second, traditional methods are mostly based on passive matching using rules or feature libraries, resulting in static protection strategies that are difficult to effectively deal with unknown threats and variant APT attacks, and cannot fully utilize new machine learning models to proactively identify abnormal behavior. Third, existing solutions generally lack the ability to quantitatively assess and predict trends in overall security status, failing to transform abstract security risks into intuitive situation indices and levels. This makes it difficult for security managers to fully grasp current and future risk levels, resulting in insufficient basis for decision-making and early warning. Fourth, given the large number of power metering terminals and the exponential growth in the scale of data generated, traditional data processing technologies lack the real-time or near-real-time analysis capabilities to support the unified processing and comprehensive analysis of multi-source data from the network layer, host layer, application layer, and vulnerability layer in a big data environment.

[0005] Therefore, there is an urgent need in this field for an analytical method that can achieve the fusion of multi-source heterogeneous security data on a big data platform, combine unsupervised anomaly detection with supervised threat classification to carry out intelligent analysis, and quantitatively assess and predict the network security status of power metering systems, in order to overcome the above limitations. Summary of the Invention

[0006] To overcome the shortcomings of existing technologies, the purpose of this invention is to provide a method and system for analyzing the cybersecurity situation of power metering systems based on big data. By constructing a unified data lake system and integrating multiple security elements, it achieves comprehensive perception, accurate analysis, and dynamic prediction of the cybersecurity situation of power metering systems.

[0007] To achieve the above objectives, the present invention provides the following solution:

[0008] A method for network security situation analysis of power metering systems based on big data, comprising:

[0009] The system collects network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence from the power metering system. It then cleans, normalizes, and correlates the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence to form a security data lake.

[0010] Based on the security data lake, security posture elements are extracted from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database to obtain a set of security posture elements.

[0011] An unsupervised anomaly detection model and a supervised threat classification model are constructed. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results. The set of security situation elements is input into the supervised threat classification model to obtain threat classification results.

[0012] Based on the anomaly detection results and the threat classification results, a correlation analysis is performed. Combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information, the asset security risk value of each asset and the overall security risk value of the power metering system are calculated.

[0013] The asset security risk value and the overall security risk value are mapped to network security situation indicators, and the network security situation indicators are displayed on a visual interface; the network security situation indicators include the overall security index, attack threat level, and vulnerability level;

[0014] A time series prediction model is constructed based on the network security situation indicators to predict the network security situation indicators within a preset time period. When the prediction result exceeds a preset threshold, a security warning message is generated and pushed to security management personnel.

[0015] Preferably, the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence are cleaned, normalized, and correlated to form a security data lake, including:

[0016] The network traffic data and the system log data are sequentially time-aligned according to a uniform time granularity to obtain time-aligned network traffic data and time-aligned system log data.

[0017] The duplicate records in the time-aligned network traffic data, the time-aligned system log data, and the security device alarm data are deduplicated to obtain deduplicated network traffic data, deduplicated system log data, and deduplicated security device alarm data.

[0018] The network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence that have been deduplicated are filled with missing fields using preset imputation rules to obtain network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence that have been filled with missing fields.

[0019] Based on the asset identifier, the asset information that has undergone missing field filling is associated with the vulnerability records in the vulnerability database that has undergone missing field filling. The network traffic data that has undergone missing field filling, the system log data that has undergone missing field filling, the security device alarm data that has undergone missing field filling, the asset information that has undergone missing field filling, the vulnerability records in the vulnerability database that have undergone missing field filling, and the external threat intelligence that has undergone missing field filling are stored in a distributed data storage cluster to form the security data lake.

[0020] Preferably, based on the security data lake, security posture elements are extracted from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database to obtain a set of security posture elements, including:

[0021] The connection duration, connection direction, and port number are extracted from the network traffic data in the secure data lake; the network layer elements include the connection duration, connection direction, and port number.

[0022] Login events, access events, and permission change events are extracted from the system log data in the secure data lake; the host layer elements include the login events, access events, and permission change events.

[0023] The alarm type, alarm level, and alarm count are extracted from the security device alarm data in the security data lake; the application layer elements include the alarm type, alarm level, and alarm count.

[0024] Extract the vulnerability ID, vulnerability impact scope, and vulnerability severity from the vulnerability records in the vulnerability database of the security data lake; the vulnerability layer elements include the vulnerability ID, the vulnerability impact scope, and the vulnerability severity;

[0025] The network layer elements, host layer elements, application layer elements, and vulnerability layer elements are combined into a feature vector according to a preset feature order, and the feature vector is used as the security situation element; the security situation element set is composed of multiple security situation elements.

[0026] Preferably, an unsupervised anomaly detection model and a supervised threat classification model are constructed. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results, and the set of security situation elements is input into the supervised threat classification model to obtain threat classification results, including:

[0027] The security situation elements in the set of security situation elements within the historical time period are used as unsupervised training samples to train the unsupervised anomaly detection model in an unsupervised manner, so as to obtain an unsupervised anomaly detection model for outputting the anomaly detection results; the unsupervised anomaly detection model is a model built based on an autoencoder structure.

[0028] The labeled attack types corresponding to the security situation elements are used as supervision labels. The security situation elements and the supervision labels are combined to form a supervision training sample. The supervised threat classification model is trained in a supervised manner to obtain a supervised threat classification model for outputting the threat classification results. The supervised threat classification model is a model built based on a multi-layer neural network structure.

[0029] Preferably, based on the anomaly detection results and the threat classification results, a correlation analysis is performed. Combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information, the asset security risk value of each asset and the overall security risk value of the power metering system are calculated, including:

[0030] Based on the association between the asset information and the vulnerability records in the vulnerability database, the severity of the vulnerability is mapped to a vulnerability weight, and vulnerability weights are assigned to each vulnerability record in the vulnerability database.

[0031] The importance of the assets is mapped to asset weights, and asset weights are assigned to each asset information.

[0032] Based on the vulnerability records in the vulnerability database associated with each of the asset information, the corresponding vulnerability weights and corresponding asset weights are weighted and fused to obtain the asset security risk value corresponding to each of the asset information.

[0033] The security risk values ​​of each asset are aggregated according to their respective power metering systems to obtain the overall security risk value of the power metering system.

[0034] Preferably, the asset security risk value and the overall security risk value are mapped to network security situation indicators, and the network security situation indicators are displayed on a visual interface, including:

[0035] The asset security risk value and the overall security risk value are normalized to obtain the normalized asset security risk value and the normalized overall security risk value.

[0036] According to the preset classification rules, the normalized overall security risk value is mapped to the overall security index, and the normalized asset security risk value is mapped to the attack threat level and the vulnerability level.

[0037] The overall security index, attack threat level, and vulnerability level are displayed on the visualization interface according to the time, asset, and geographical dimensions.

[0038] Preferably, according to preset classification rules, the normalized overall security risk value is mapped to the overall security index, and the normalized asset security risk value is mapped to the attack threat level and the vulnerability level, including:

[0039] A nonlinear transformation is performed on the normalized overall security risk value and the normalized asset security risk value to calculate the system continuous security index and the asset continuous risk score, thereby obtaining the system continuous security index and the asset continuous risk score; the system continuous security index and the asset continuous risk score satisfy the following: ;in, This is the normalized overall security risk value. This is the normalized asset safety risk value. The system continuous security index is used to generate the overall security index. For the continuous risk score of assets used to generate the attack threat level and the vulnerability level, A system risk enhancement coefficient greater than 1 The asset weight coefficient is between 0 and 1;

[0040] The system continuous security index is determined within a range according to a preset set of system index grading thresholds, and the determination result is used as the overall security index. The asset continuous risk score is determined within a range according to a preset set of asset risk grading thresholds, and the determination result is used as the attack threat level and the vulnerability level.

[0041] Preferably, a time series prediction model is constructed based on the network security situation indicators to predict the network security situation indicators within a preset time period. When the prediction result exceeds a preset threshold, a security warning is generated and pushed to security management personnel, including:

[0042] The network security situation indicators within a historical time period are used as input sequences to train the time series prediction model, so as to obtain a time series prediction model for outputting prediction results.

[0043] Multiple preset thresholds are set according to the value range of the overall security index, and different preset thresholds correspond to different levels of security warning information;

[0044] When generating the security warning information, the warning notification method is selected according to the attack threat level. Specifically, when the attack threat level is higher than the first level threshold, the security warning information is sent to the security management personnel simultaneously via SMS and email. When the attack threat level is within the level range that is not higher than the first level threshold, the security warning information is displayed on the visualization interface in the form of an alarm pop-up.

[0045] Preferably, after obtaining the network security situation indicators, the method further includes:

[0046] The network security situation indicators are associated and stored with the data in the security data lake to form historical samples of the security data lake containing the network security situation indicators. These samples are used to iteratively optimize the unsupervised anomaly detection model, the supervised threat classification model, and the time series prediction model.

[0047] A network security situation analysis system for power metering systems based on big data, comprising:

[0048] The data acquisition and preprocessing module is used to collect network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence from the power metering system. It cleans, normalizes, and correlates the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence to form a security data lake.

[0049] The multi-layer element extraction module is used to extract security posture elements from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database based on the security data lake, so as to obtain a set of security posture elements.

[0050] The dual-model security analysis module is used to construct an unsupervised anomaly detection model and a supervised threat classification model. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results, and the set of security situation elements is input into the supervised threat classification model to obtain threat classification results.

[0051] The risk assessment and correlation analysis module is used to perform correlation analysis based on the anomaly detection results and the threat classification results, and to calculate the asset security risk value of each asset and the overall security risk value of the power metering system by combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information.

[0052] The situation indicator generation and visualization module is used to map the asset security risk value and the overall security risk value into network security situation indicators, and to display the network security situation indicators on a visualization interface; the network security situation indicators include the overall security index, attack threat level, and vulnerability level;

[0053] The situation prediction and early warning module is used to construct a time series prediction model based on the network security situation indicators, predict the network security situation indicators within a preset time period, generate security early warning information when the prediction result exceeds a preset threshold, and push it to security management personnel.

[0054] The present invention discloses the following technical effects:

[0055] The present invention collects network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence, and performs cleaning, normalization, and correlation processing on the above data to form a unified security data lake, breaking through the bottleneck of data isolation and difficult linkage analysis in the background art. By realizing the fusion of multi-source heterogeneous data in the same data space, the present invention significantly improves the availability, relevance, and analyzability of the security data of the power metering system, providing a stable data foundation for subsequent extraction and intelligent analysis of high-dimensional situation elements.

[0056] The present invention constructs an unsupervised anomaly detection model and a supervised threat classification model based on the security data lake, and respectively performs anomaly detection and threat identification on the security situation element set to achieve the collaborative identification ability for known attacks and unknown attacks. Different from the defect of the background art that only relies on the feature library or fixed rules and is difficult to discover new attacks, the present invention forms complementary advantages by introducing a dual-model structure, can discover abnormal behaviors without prior features, and at the same time perform accurate attack classification when there is known attack semantics, enabling the security analysis of the power metering system to have self-adaptability and dynamic learning ability.

[0057] The present invention conducts correlation analysis on the anomaly detection results and threat classification results, and calculates the asset security risk value and the overall security risk value in combination with the vulnerability severity and asset importance, thus breaking through the problem in the background art of "difficult to correlate multi-source data and unable to quantify the overall risk". The correlation analysis mechanism of the present invention can identify cross-device and cross-layer linkage attack activities, and map the attack impact to the asset layer and system layer, realizing the quantitative assessment of the network security risk of the power metering system, and greatly improving the accuracy and interpretability of risk assessment.

[0058] The present invention maps the asset security risk value and the overall security risk value into an overall security index, an attack threat level, and a vulnerability level, realizes the structured output of the network security situation indicators of the power metering system and displays them on a visualization interface, overcoming the defects of the traditional security system such as chaotic information presentation and lack of a unified index system. The quantifiable index system formed by the present invention enables managers to observe the security status from the overall level and locate high-risk points from the asset level, thus enhancing the intuitiveness, manageability, and practicability of situation awareness.

[0059] The present invention constructs a time series prediction model based on the network security situation indicators, and automatically generates and pushes security warning information when the prediction result exceeds a preset threshold, solving the deficiency in the background art of "only being able to passively handle attacks and unable to give early warnings". The prediction mechanism of the present invention can identify the rising trend of potential risks, realize the forward-looking judgment of the future network security status, change the traditional passive response mode of the power metering system to an active warning mode, and improve the timeliness and controllability of the overall security defense. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 A flowchart of the method provided in an embodiment of the present invention;

[0062] Figure 2 This is a schematic diagram of the system structure provided in an embodiment of the present invention. Detailed Implementation

[0063] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0064] The purpose of this invention is to provide a method and system for network security situation analysis of power metering systems based on big data. Based on multi-layer feature extraction, dual-model intelligent analysis and risk quantification and early warning mechanism, the power metering system has the ability to identify complex attack behaviors in real time and to defend against them proactively.

[0065] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0066] Figure 1 The method flowchart provided in the embodiments of the present invention is as follows: Figure 1 As shown, this invention provides a method for network security situation analysis of power metering systems based on big data, including:

[0067] Step 100: Collect network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence from the power metering system. Clean, normalize, and correlate the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence to form a security data lake.

[0068] Step 200: Based on the security data lake, extract security posture elements from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from asset information and vulnerability records in the vulnerability database to obtain a set of security posture elements;

[0069] Step 300: Construct an unsupervised anomaly detection model and a supervised threat classification model. Input the set of security situation elements into the unsupervised anomaly detection model to obtain anomaly detection results, and input the set of security situation elements into the supervised threat classification model to obtain threat classification results.

[0070] Step 400: Based on the anomaly detection results and threat classification results, perform correlation analysis, combine the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information, calculate the asset security risk value of each asset and the overall security risk value of the power metering system;

[0071] Step 500: Map the asset security risk value and the overall security risk value to network security posture indicators, and display the network security posture indicators on the visualization interface; the network security posture indicators include the overall security index, attack threat level, and vulnerability level;

[0072] Step 600: Construct a time series prediction model based on network security situation indicators to predict network security situation indicators within a preset time period. When the prediction result exceeds a preset threshold, generate a security warning message and push it to security management personnel.

[0073] Specifically, in step 100 of this embodiment, the system first collects network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence generated during the operation of the power metering system. Data from different sources is then aligned according to a unified time granularity. A unified time granularity is a time interval formed by dividing the time axis at fixed intervals, used to merge data with different sampling frequencies to a consistent time scale. In this embodiment, the unified time granularity can be set to 1 minute, which can be reduced to 10 seconds in scenarios with higher real-time requirements. By reading the timestamps of various data records and mapping them to the corresponding time granularity intervals, time-aligned network traffic data and system log data are obtained, ensuring that data within the same time period has correlation and analytical consistency.

[0074] After time alignment, this embodiment performs duplicate record identification and deduplication on the time-aligned network traffic data, time-aligned system log data, and security device alarm data. Duplicate records refer to multiple records with identical source address, destination address, and port number combinations within the same time granularity. This embodiment can match and judge the above three key fields within each time granularity to obtain three types of deduplicated data. Based on this, missing fields in the deduplicated data, asset information, vulnerability records in the vulnerability database, and external threat intelligence are filled using preset imputation rules. Continuous numerical fields can be imputed based on valid observations within at least five adjacent time granularities; status fields can be filled using the most recent valid status information; and classification fields can be filled using default classification values ​​based on business rules. After imputation, all types of data have complete fields, avoiding analytical bias caused by missing fields.

[0075] After filling in missing fields, this embodiment associates the filled asset information with vulnerability records in the filled vulnerability database based on asset identifiers. Asset identifiers uniquely identify actual asset objects in the power metering system, such as smart meters, data concentrators, or core metering servers. One-to-one or one-to-many associations can be established through asset identifiers, forming a mapping structure between assets and vulnerabilities. Subsequently, the processed network traffic data, system log data, security device alarm data, asset information, vulnerability records, and external threat intelligence are uniformly stored in a distributed data storage cluster. This cluster can consist of at least three storage nodes and can be expanded to at least five nodes to accommodate data growth. A security data lake is constructed based on this storage cluster to centrally store the cleaned, normalized, and associated data. In this embodiment, the security data lake can continuously store multi-source data for at least 30 days, providing a unified and stable data foundation for subsequent security situation element extraction and model analysis.

[0076] Optionally, after forming the secure data lake in step 100, step 20 of this embodiment extracts network layer elements, host layer elements, application layer elements, and vulnerability layer elements categorized by type based on network traffic data, system log data, security device alarm data, asset information, and vulnerability records in the vulnerability database. Network layer elements are used to describe the behavioral characteristics of communication connections in the power metering system. In this embodiment, connection duration, connection direction, and port number are extracted from network traffic data. Connection duration characterizes the duration of continuous communication between the same source and destination addresses; connection direction distinguishes between uplink and downlink communication flows; and port number distinguishes between different application service types. In an optional quantitative implementation, connection duration can be recorded at millisecond granularity, and the value range of connection duration can be set from 0 to 3,600,000. Connection direction can use dual values ​​to identify uplink and downlink, and port number can be limited to the range of 0 to 65,535. Commonly used service ports can be separately marked to enhance the distinguishability of subsequent analysis.

[0077] In this embodiment, host-layer elements are used to describe the security characteristics of various host devices in the power metering system in terms of operational behavior and access control. A set of host-layer elements is formed by extracting login events, access events, and permission change events from system log data. Login events record information about user or process login operations, access events record access to critical resources, and permission change events record changes in account or process permission levels. Application-layer elements describe the detection of abnormal behavior by security devices at the business level. A set of application-layer elements is formed by extracting alarm types, alarm levels, and alarm counts from security device alarm data. Alarm types distinguish different attack categories, alarm levels characterize the urgency of alarms, and alarm counts reflect the frequency of similar alarms within a certain time period. In an optional quantitative implementation, login events can record at least 10 recent login results, permission change events can record at least 5 recent permission adjustment behaviors, alarm levels can be graded from level 1 to level 5, and alarm counts can be statistically analyzed in time windows of at least 5 minutes to improve the time sensitivity of security posture characterization.

[0078] In this embodiment, vulnerability layer elements are used to describe the known vulnerabilities corresponding to the asset and their potential impact. A vulnerability layer element set is formed by extracting vulnerability IDs, vulnerability impact ranges, and vulnerability severity from vulnerability records in the vulnerability database. The vulnerability ID uniquely identifies the vulnerability entry, the vulnerability impact range characterizes the functional modules or asset types affected by the vulnerability, and the vulnerability severity reflects the level of security impact on the system when the vulnerability is exploited. After extracting network layer elements, host layer elements, application layer elements, and vulnerability layer elements, this embodiment combines these elements into a feature vector according to a preset feature order. The feature vector represents the comprehensive security status within a unified space, at a specific time granularity, and within a specific asset range. This embodiment defines each feature vector as a security posture element, and multiple security posture elements constitute a security posture element set. In an optional quantitative implementation, each security posture element can contain no fewer than 10 feature values, and in practical applications, it can contain 15 to 20 feature values. Under a unified time granularity of 1 minute, no fewer than 60 security posture elements can be formed within 1 hour to support the statistically stable training and inference of subsequent anomaly detection models and threat classification models.

[0079] Further, after obtaining the set of security situation elements in step 200, step 300 of this embodiment first constructs and trains the unsupervised anomaly detection model. The unsupervised anomaly detection model employs an autoencoder structure, which is a neural network structure containing an encoding part and a decoding part. The encoding part compresses the input security situation elements into a low-dimensional latent representation space, and the decoding part reconstructs the input security situation elements based on the low-dimensional latent representation. The degree of anomaly is characterized by comparing the difference between the reconstructed result and the original input. In this embodiment, security situation elements considered to be in a relatively normal state in terms of business operations within a historical time period are selected as unsupervised training samples. Each security situation element is input into the autoencoder structure for multiple rounds of iterative training, enabling the autoencoder structure to reconstruct the security situation elements corresponding to normal samples as accurately as possible. This allows the reconstruction error to be used as a basis for anomaly detection results. In an optional quantitative implementation, security situation elements from the most recent 30 days can be selected as training samples. Each security situation element contains no less than 15 feature values. The autoencoder structure can include one input layer, two encoding hidden layers, two decoding hidden layers, and one output layer. The number of neurons in each hidden layer can be set to 32 to 64. The number of training rounds can be set to 100 to 200. The batch size can be set to 64 samples. The learning rate can be set to 0.001.

[0080] In this embodiment, after training the unsupervised anomaly detection model, the set of security situation elements for the current time period is sequentially input into the trained autoencoder structure. The reconstruction error of each security situation element is calculated, and the reconstruction error is compared with a preset anomaly judgment threshold. When the reconstruction error exceeds the anomaly judgment threshold, the corresponding anomaly detection result is output, indicating that the network behavior corresponding to the security situation element has an abnormal risk. The anomaly judgment threshold is used to distinguish the reconstruction error range of normal samples and abnormal samples. In this embodiment, the anomaly judgment threshold can be determined based on the reconstruction error distribution during the training phase. For example, a value located in the high percentile region of the normal sample reconstruction error distribution can be selected as the anomaly judgment threshold to improve the detection rate of abnormal behavior while ensuring an acceptable false alarm rate. In an optional quantitative implementation, the value corresponding to the 95th percentile of the training sample reconstruction error can be selected as the anomaly judgment threshold, and it can be adjusted between the 90th and 99th percentiles according to business needs to adapt to the balance requirements between the number of false alarms and the risk of missed alarms in different power metering systems.

[0081] In this embodiment, a multi-layer neural network structure is used to construct a classification model for outputting threat classification results for the supervised threat classification model. The multi-layer neural network structure refers to a feedforward neural network structure formed by sequentially connecting an input layer, multiple hidden layers, and an output layer. It is used to output corresponding attack type or normal type labels based on the input security situation elements. This embodiment uses pre-labeled attack types that correspond one-to-one with the security situation elements as supervisory labels. The security situation elements and supervisory labels are combined to form supervised training samples, which are then input into the multi-layer neural network structure for supervised training. This allows the network parameters to gradually converge to a state capable of distinguishing between different attack types and normal types. After training, the set of security situation elements for the current time period is input into the trained multi-layer neural network structure, which outputs the corresponding threat classification results to characterize the current network behavior as belonging to a specific attack type or whether it is normal behavior. In one optional quantitative implementation, the multi-layer neural network structure may include one input layer, two to three hidden layers, and one output layer. The number of neurons in each hidden layer may be set to 64 to 128. The number of categories in the output layer may be set to no less than four and can be extended to eight to support the differentiation of multiple attack types. The supervised training samples may be attack samples and normal samples confirmed by humans or external systems within the last 7 to 30 days. The number of training rounds may be set to 50 to 150. The batch size may be set to 64 to 128 samples. The learning rate may be set to 0.001, thereby ensuring classification accuracy while taking into account convergence speed and stability.

[0082] Furthermore, in this embodiment, after obtaining the anomaly detection results and threat classification results in step 300, step 400 first constructs an association analysis object at the asset dimension. Specifically, this embodiment uses asset information as a basis, associating each piece of asset information with network traffic data, system log data, security device alarm data, and vulnerability records in the vulnerability database in the security data lake, forming an asset security view based on a single asset. The asset security view is used to centrally describe the anomaly detection results, threat classification results, and vulnerabilities existing on a certain asset within a given time period. The anomaly detection results reflect whether the asset exhibits abnormal behavior within that time period, the threat classification results reflect the attack type or normal state corresponding to the abnormal behavior, and the vulnerability records in the vulnerability database describe the known vulnerability entries existing on the asset. In an optional quantitative implementation, the time period of the asset security view can be divided into time windows of no less than 5 minutes. Within one time window, no less than 1 and no less than 10 anomaly detection result and threat classification result records can be associated, and no less than 1 and no less than 5 vulnerability records can be associated to support a fine-grained description of asset security risks.

[0083] In this embodiment, to incorporate vulnerability severity and asset importance into quantitative risk assessment, vulnerability severity is mapped to vulnerability weights, and asset importance is mapped to asset weights. Vulnerability weights characterize the potential impact of a single vulnerability exploited on asset security. This embodiment classifies vulnerability severity into five levels, with corresponding vulnerability weights of 1, 3, 5, 7, and 9, to differentiate between low-risk and high-risk impacts. Asset weights characterize the operational importance of assets within the power metering system. This embodiment classifies asset importance into three levels, with corresponding asset weights of 1, 2, and 3, to differentiate between ordinary assets, important assets, and critical assets. During correlation analysis, this embodiment combines anomaly detection results and threat classification results with vulnerability weights and asset weights. When an asset simultaneously exhibits both high-risk attack type threat classification results and high-severity vulnerability records within a given time window, its contribution to the asset's security risk value significantly increases. In an optional quantitative implementation, based on the combination of basic vulnerability weights and asset weights, assets that simultaneously meet the criteria of high-risk threat classification and high-severity vulnerabilities may have their asset security risk value increased by no less than 50% and no more than 100% to reflect the prominent risk level of such assets.

[0084] In this embodiment, after calculating the asset security risk value, the asset security risk values ​​of each asset are aggregated according to their respective power metering systems to obtain the overall security risk value of the power metering system. This embodiment can first obtain the asset security risk value at the asset level within each time window, and then summarize and standardize all asset security risk values ​​at the system level to obtain the overall security risk value characterizing the overall security status of the power metering system. The overall security risk value reflects the comprehensive risk level of the entire power metering system in terms of network behavior, attack activities, and vulnerability exposure within a certain time range. In an optional quantitative implementation, when the number of assets included in the power metering system is between 100 and 10,000, the weighted aggregation result of the asset security risk values ​​can be standardized according to the range of 0 to 100, so that the overall security risk value falls within the range of 0 to 100, where 0 represents extremely low risk and 100 represents extremely high risk. In practical applications, the overall security risk value can be divided into no fewer than four risk levels to provide a quantitative basis for subsequent network security situation indicator generation and early warning threshold setting.

[0085] In this embodiment, after obtaining the asset security risk value of each asset and the overall security risk value of the power metering system in step 400, step 500 first normalizes the aforementioned risk values ​​to allow for comparison and subsequent classification within a unified numerical range. Normalization refers to proportionally converting the original risk values ​​to a pre-defined target range based on a preset reference range, making risk values ​​from different sources and of different orders of magnitude comparable. In this embodiment, the minimum and maximum values ​​of all asset security risk values ​​and the overall security risk value over a historical period can be selected as the reference range, mapping the risk values ​​to a closed interval of 0 to 100, where 0 represents the lowest risk and 100 represents the highest risk. In an optional quantitative implementation, the reference historical time period can be set to the most recent 30 days or 90 days. When the initial range of the asset security risk value is 0 to 1000 and the initial range of the overall security risk value is 0 to 1000, normalization is applied to map them to normalized asset risk values ​​and system normalized risk values ​​within the range of 0 to 100, respectively, for subsequent classification.

[0086] In this embodiment, after normalization, the normalized overall security risk value is mapped to an overall security index according to a preset grading rule, and the normalized asset security risk value is mapped to an attack threat level and a vulnerability level. The overall security index is used to summarize the overall security status of the power metering system in the current time period in a single numerical form. In this embodiment, the normalized overall security risk value can be directly used as the overall security index, and the value range of 0 to 100 is divided into several level ranges. For example, 0 to 25 corresponds to a safe state, 25 to 50 corresponds to a state of concern, 50 to 75 corresponds to an alarm state, and 75 to 100 corresponds to a severe alarm state. The attack threat level is used to characterize the intensity of the threat faced by an asset in terms of attack behavior. In this embodiment, a discrete level of no less than 3 and no less than 5 levels can be set according to the normalized asset security risk value. For example, level 1 is low threat, level 2 is medium threat, level 3 is high threat, and level 4 is extremely high threat. The vulnerability level is used to characterize the degree of weakness of an asset in terms of vulnerability exposure. In this embodiment, the portion of the asset security risk value contributed by vulnerability-related factors can be used separately for classification, setting vulnerability levels from 1 to 4 to distinguish between assets with fewer and less impactful vulnerabilities and assets with multiple high-risk vulnerabilities. In an optional quantitative implementation, assets with a normalized asset security risk value of less than 20 can be classified as attack threat level 1, 20 to 50 as level 2, 50 to 80 as level 3, and above 80 as level 4; assets with a normalized risk value contributed by vulnerability factors of less than 15 can be classified as vulnerability level 1, and assets above 60 can be classified as vulnerability level 4, thereby achieving refined classification on a quantitative basis.

[0087] In this embodiment, after obtaining the overall security index, attack threat level, and vulnerability level, the network security situation indicators are displayed on the visualization interface according to the time, asset, and geographical dimensions. The time dimension is used to show the change in network security situation over time. In this embodiment, the time axis can be divided according to a fixed time granularity, such as 1 minute, 5 minutes, or 15 minutes as a time scale, displaying the corresponding overall security index or the number of alarms at each time scale position. The asset dimension is used to display the attack threat level and vulnerability level of various assets from the perspective of asset classification or asset list. In this embodiment, assets can be grouped according to asset type, region, or business importance, and the situation indicators of different asset groups in the current time period and historical time periods can be displayed in matrix or list form. The geographical dimension is used to intuitively reflect the risk concentration area from a spatial distribution perspective. In this embodiment, based on the geographical area covered by the power metering system, the overall security index or the number of high-threat, high-vulnerability assets can be overlaid on the geographical area division map, with color depth or marker density representing the security status of different areas. In an optional quantitative implementation, the visualization interface can simultaneously display the overall security index curve for the past 24 hours, the average attack threat level bar distribution by asset type over the past 7 days, and the vulnerability level distribution for no less than 10 geographical areas divided by power supply area, enabling maintenance personnel to comprehensively assess the network security status of the power metering system from no less than three dimensions.

[0088] Exemplary, in step 500 of this embodiment, the normalized overall security risk value and the normalized asset security risk value are nonlinearly transformed to obtain the system continuous security index and the asset continuous risk score. Specifically, after mapping the normalized overall security risk value to the range of 0 to 100, this embodiment introduces a system risk enhancement coefficient to amplify values ​​close to the high-risk area, thereby enhancing the sensitivity to high-risk states. The system risk enhancement coefficient is used to control the degree of amplification, and its value is greater than 1. In an optional quantitative implementation, it can be set to 1.5 to 3.0. When the normalized overall security risk value is low, the system continuous security index changes almost linearly. When the normalized overall security risk value is higher than 70, the increase in the system continuous security index increases significantly, thereby numerically highlighting the high-risk state. This embodiment simultaneously weights and combines the normalized asset safety risk value and the normalized overall safety risk value according to a certain ratio to obtain the asset continuous risk score. The asset continuous risk score is used to reflect the superimposed impact of the individual asset's own risk and the overall risk of the entire power metering system. The asset weight coefficient is used to control the proportion of the asset's own risk and the overall system risk in the combined result. The asset weight coefficient is between 0 and 1. In an optional quantitative implementation, it can be set to 0.6 to 0.8. When the asset weight coefficient is 0.7, the normalized asset safety risk value is 60, and the normalized overall safety risk value is 80, the asset continuous risk score is closer to the asset safety risk value and is appropriately shifted upward to reflect the impact of the increase in the overall system risk.

[0089] In this embodiment, after obtaining the system continuous security index, the system continuous security index is interval-based according to a preset system index grading threshold set, and the interval-based judgment result is mapped to the overall security index. The system index grading threshold set is used to divide continuous values ​​into several security level intervals, so that operation and maintenance personnel can quickly judge the current overall security status of the system. In this embodiment, the system continuous security index from 0 to 100 can be divided into 4 level intervals. In an optional quantitative implementation, 0 to 25 can be divided into the first level, which indicates that the system is in a safe state; 25 to 50 can be divided into the second level, which indicates that the system needs attention; 50 to 75 can be divided into the third level, which indicates that the system has obvious risks and needs to be alerted; and 75 to 100 can be divided into the fourth level, which indicates that the system is in a critical alarm state and needs to take immediate intervention measures. In this embodiment, the overall security index can be directly set to the level number or the representative value after segmentation that corresponds to the continuous security index of the system. For example, the first level corresponds to an overall security index of 1, the second level corresponds to an overall security index of 2, and so on. In some implementations, the midpoint of each interval can also be selected as the representative value. For example, the first level corresponds to an overall security index of 12 and the second level corresponds to an overall security index of 37, thereby maintaining the intuitiveness of the hierarchical structure while retaining certain continuous change characteristics.

[0090] In this embodiment, after obtaining the continuous risk score of the asset, the continuous risk score is range-based according to a preset set of asset risk classification thresholds. The range-based classification results are mapped to attack threat level and vulnerability level, respectively. The continuous risk score of the asset is used to characterize the overall risk level of a single asset within the current time period, taking into account abnormal behavior, attack type, and vulnerability exposure. In this embodiment, the continuous risk score of the asset from 0 to 100 can be divided into attack threat levels of no less than 3 and no less than 5. In an optional quantitative implementation, 0 to 20 can be classified as attack threat level 1, indicating a low attack threat; 20 to 50 can be classified as level 2, indicating a medium threat; 50 to 80 can be classified as level 3, indicating a high threat; and 80 to 100 can be classified as level 4, indicating an extremely high attack threat. Regarding vulnerability levels, this embodiment can separate the risk component contributed by vulnerability-related factors from the asset continuous risk score and construct a separate vulnerability classification threshold set. In an optional quantitative implementation, assets with a vulnerability-related risk component of less than 15 can be classified as vulnerability level 1, indicating fewer vulnerabilities and less impact; 15 to 40 can be classified as level 2, 40 to 60 as level 3, and above 60 as level 4, indicating that the asset has multiple high-severity vulnerabilities and is easily exploitable. Finally, the corresponding attack threat level and vulnerability level are stored in the network security situation indicator, which together with the overall security index constitutes the basic data used to drive subsequent visualization and early warning strategy configuration.

[0091] In this embodiment, after obtaining network security situation indicators such as the overall security index, attack threat level, and vulnerability level in step 500, these network security situation indicators are associated with network traffic data, system log data, security device alarm data, asset information, and vulnerability records in the vulnerability database for the corresponding time period in the security data lake, forming a historical sample of the security data lake containing network security situation indicator annotations. Association storage refers to attaching a network security situation indicator annotation corresponding to its time window to each multi-source data record in the security data lake, enabling a one-to-one correspondence between the original behavioral data, asset data, and vulnerability data in the security data lake and the overall security index, attack threat level, and vulnerability level. In this way, a data structure with annotation attributes can be constructed within the security data lake, which is used to record the risk status of the power metering system in different time windows. In an optional quantitative implementation, the network security situation indicators can be written into the historical sample of the security data lake in 5-minute time windows, forming no less than 288 annotated data records per day. When the security data lake storage period is 30 days, no less than 8,640 historical samples can be formed to support model training and iterative optimization.

[0092] In this embodiment, the historical samples of the security data lake can be used for continuous iterative optimization of the unsupervised anomaly detection model, the supervised threat classification model, and the time series prediction model. For the unsupervised anomaly detection model, this embodiment can update the statistical distribution of normal behavior based on the non-abnormal time window data recorded in the historical samples, thereby improving the model's generalization ability under new business conditions. For the supervised threat classification model, it can supplement the learning of attack types or behavioral patterns not previously included based on the attack threat levels recorded in the historical samples. For the time series prediction model, it can update the model parameters using the overall security index of continuous time series in the historical samples, so that the model can more accurately reflect the trend characteristics of network security situation changes over time. In an optional quantitative implementation, the model can be iterated and optimized every 24 hours. When the number of historical samples exceeds 10,000, a sampling method can be used to select no less than 2,000 historical samples as the model update dataset, thereby controlling the training time and computing resource consumption while maintaining the improvement of model accuracy, so that the model can adapt to the changes in the security situation of the power metering system under different operating environments in the long term.

[0093] Furthermore, in this embodiment, after obtaining the overall security index, attack threat level, and vulnerability level in step 500, step 600 constructs a time series prediction model based on the network security situation indicators to predict the trend of situation changes in the future time period. The time series prediction model is used to learn the evolution of network security situation over time. In this embodiment, a long short-term memory (LSTM) neural network structure can be used as the time series prediction model. LSTM is a recurrent neural network structure suitable for processing data with time dependencies, which retains states over a longer time range by introducing memory units. In this embodiment, the overall security index, attack threat level, and vulnerability level continuously collected within a historical time period are selected as the input sequence. Multiple network security situation indicators at consecutive time granularities are used as a set of input samples to train the time series prediction model, enabling the model to predict the overall security index within a preset future time period based on the current and past trends in the overall security index and the frequency of high-level attack threat levels. In an optional quantitative implementation, the time granularity can be set to 5 minutes, the input sequence length can be set to 12 time steps, corresponding to the network security situation over the past 60 minutes, the training samples can be selected from continuous indicator data of the most recent 30 days, the time series prediction model can include no less than 2 layers of long short-term memory hidden layers, each layer containing 32 to 64 memory units, and the number of training rounds can be set to 50 to 150 times to achieve a balance between convergence speed and prediction accuracy.

[0094] In this embodiment, after obtaining the prediction results output by the time series prediction model, multiple preset thresholds are set according to the value range of the overall security index. Different preset thresholds correspond to different levels of security warning information, and the warning notification method is selected in conjunction with the attack threat level. The multiple preset thresholds are used to divide the continuous predicted overall security index into different risk level intervals. In this embodiment, several thresholds can be set within the overall security index range of 0 to 100. In an optional quantitative implementation, 40 can be set as the first preset threshold, 60 as the second preset threshold, and 80 as the third preset threshold. When the prediction result is lower than 40, no warning is triggered; when the prediction result is between 40 and 60, a low-level security warning information is generated; when the prediction result is between 60 and 80, a medium-level security warning information is generated; and when the prediction result is higher than 80, a high-level security warning information is generated. For high-level security alerts, this embodiment selects the notification method based on the attack threat level. When the predicted attack threat level within the corresponding time period is expected to be higher than the first-level threshold, a security alert is sent to security management personnel simultaneously via SMS and email. When the predicted attack threat level is within the range not exceeding the first-level threshold, the security alert is only displayed as an alarm pop-up on the visual interface. In an optional quantitative implementation, the attack threat level can be divided into levels 1 to 4. When the number of assets expected to have a level 3 or 4 attack threat level within the corresponding time period exceeds 10% of the total number of assets, a combined SMS and email notification is triggered. When the proportion of assets expected to have a level 2 attack threat level is between 5% and 10%, only an alarm pop-up on the visual interface is triggered, which is used to ensure timely alerts while avoiding excessive disruption to security management personnel.

[0095] In this embodiment, multi-source heterogeneous security data generated during the operation of the power metering system is first collected and fused. This data includes network traffic data, system log data, security device alarm data, asset information, vulnerability records in a vulnerability database, and external threat intelligence, covering security attributes at the network layer, host layer, application layer, and external threat environment. To ensure consistency and comparability of data from different sources and with different structures, this embodiment employs extraction, transformation, and loading processes to clean, normalize, and correlate the data, storing it uniformly in a security data lake. The security data lake is a logical storage space for storing pre-processed multi-source security data, enabling unified access and reuse organized by time, asset, and event. In actual data collection, this embodiment can persist data to disk at second or minute intervals to ensure the security data lake reflects the system's security status in real time.

[0096] In this embodiment, after forming a security data lake, network layer elements, host layer elements, application layer elements, and vulnerability layer elements are extracted from network traffic data, system log data, security device alarm data, and asset and vulnerability records, respectively, to construct security posture elements to characterize the system status. Network layer elements describe abnormal communication behavior characteristics, such as abnormal access frequency, abnormal port usage, and scanning behavior; host layer elements describe abnormal situations in device operation and resource usage, such as unauthorized file access, abnormal login, or process behavior; application layer elements characterize abnormal requests, unauthorized calls, or injection signs in the business system; vulnerability layer elements combine asset information with vulnerability database records to quantify the system's weaknesses in vulnerability exposure. The combination of these elements from different dimensions forms a security posture element set to support subsequent anomaly detection, threat identification, and risk assessment. In actual processing, this embodiment can generate at least one complete security posture element set every 5 minutes.

[0097] In this embodiment, an unsupervised anomaly detection model and a supervised threat classification model are constructed based on a set of security posture elements to discover unknown threats and identify known attack types. The unsupervised anomaly detection model learns the multidimensional behavioral patterns of the system under normal conditions and identifies behaviors that deviate from the normal pattern. The supervised threat classification model learns historically labeled attack categories to identify the specific threat type corresponding to the current security posture elements. To further improve the synergy of the analysis, this embodiment uses a correlation analysis engine to correlate anomaly detection results, threat classification results, and vulnerability exposure information from different dimensions and time windows to identify complex attack chains across hosts and networks. Subsequently, considering the severity of vulnerabilities, the importance of assets, and the degree of behavioral anomalies, the dynamic security risk value of individual assets and the overall security risk value of the entire power metering system are obtained. This embodiment can update the risk value on a minute-by-minute or hour-by-hour basis, keeping the system security status real-time and perceptible.

[0098] In this embodiment, dynamic risk values ​​are mapped to intuitive network security posture indicators, including three dimensions: overall security index, attack threat level, and vulnerability level. The overall security index summarizes the overall risk level of the system; the attack threat level reflects the likelihood and intensity of attacks on assets; and the vulnerability level characterizes the structural risks of assets in terms of vulnerability exposure. This embodiment displays these indicators through a visual interface in the form of trend curves, regional heatmaps, and topology situation maps, enabling security managers to comprehensively understand the system's security status from the dimensions of time, space, and asset structure. Based on long-term historical situation data, this embodiment constructs a time-series prediction model to predict future trends in the overall security index. When the predicted risk exceeds a preset threshold, an early warning message is generated and pushed to security managers via SMS, email, or visual alerts, realizing a shift from passive response to proactive predictive defense.

[0099] Corresponding to the above methods, such as Figure 2 As shown, this embodiment also provides a network security situation analysis system for power metering systems based on big data, including:

[0100] The data acquisition and preprocessing module is used to collect network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence from the power metering system. It cleans, normalizes, and correlates the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence to form a security data lake.

[0101] The multi-layer element extraction module is used to extract security posture elements from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database based on the security data lake, so as to obtain a set of security posture elements.

[0102] The dual-model security analysis module is used to construct an unsupervised anomaly detection model and a supervised threat classification model. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results, and the set of security situation elements is input into the supervised threat classification model to obtain threat classification results.

[0103] The risk assessment and correlation analysis module is used to perform correlation analysis based on the anomaly detection results and the threat classification results, and to calculate the asset security risk value of each asset and the overall security risk value of the power metering system by combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information.

[0104] The situation indicator generation and visualization module is used to map the asset security risk value and the overall security risk value into network security situation indicators, and to display the network security situation indicators on a visualization interface; the network security situation indicators include the overall security index, attack threat level, and vulnerability level;

[0105] The situation prediction and early warning module is used to construct a time series prediction model based on the network security situation indicators, predict the network security situation indicators within a preset time period, generate security early warning information when the prediction result exceeds a preset threshold, and push it to security management personnel.

[0106] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0107] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for network security situation analysis of power metering systems based on big data, characterized in that, include: The system collects network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence from the power metering system. It then cleans, normalizes, and correlates the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence to form a security data lake. Based on the security data lake, security posture elements are extracted from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database to obtain a set of security posture elements. An unsupervised anomaly detection model and a supervised threat classification model are constructed. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results. The set of security situation elements is input into the supervised threat classification model to obtain threat classification results. Based on the anomaly detection results and the threat classification results, a correlation analysis is performed. Combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information, the asset security risk value of each asset and the overall security risk value of the power metering system are calculated. The asset security risk value and the overall security risk value are mapped to network security situation indicators, and the network security situation indicators are displayed on a visual interface; the network security situation indicators include the overall security index, attack threat level, and vulnerability level; A time series prediction model is constructed based on the network security situation indicators to predict the network security situation indicators within a preset time period. When the prediction result exceeds a preset threshold, a security warning message is generated and pushed to security management personnel.

2. The method for network security situation analysis of power metering systems based on big data as described in claim 1, characterized in that, The network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence are cleaned, normalized, and correlated to form a security data lake, including: The network traffic data and the system log data are sequentially time-aligned according to a uniform time granularity to obtain time-aligned network traffic data and time-aligned system log data. The duplicate records in the time-aligned network traffic data, the time-aligned system log data, and the security device alarm data are deduplicated to obtain deduplicated network traffic data, deduplicated system log data, and deduplicated security device alarm data. The network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence that have been deduplicated are filled with missing fields using preset imputation rules to obtain network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence that have been filled with missing fields. Based on the asset identifier, the asset information that has undergone missing field filling is associated with the vulnerability records in the vulnerability database that has undergone missing field filling. The network traffic data that has undergone missing field filling, the system log data that has undergone missing field filling, the security device alarm data that has undergone missing field filling, the asset information that has undergone missing field filling, the vulnerability records in the vulnerability database that have undergone missing field filling, and the external threat intelligence that has undergone missing field filling are stored in a distributed data storage cluster to form the security data lake.

3. The method for network security situation analysis of power metering systems based on big data as described in claim 1, characterized in that, Based on the security data lake, security posture elements are extracted from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database, resulting in a set of security posture elements, including: The connection duration, connection direction, and port number are extracted from the network traffic data in the secure data lake; the network layer elements include the connection duration, connection direction, and port number. Login events, access events, and permission change events are extracted from the system log data in the secure data lake; the host layer elements include the login events, access events, and permission change events. The alarm type, alarm level, and alarm count are extracted from the security device alarm data in the security data lake; the application layer elements include the alarm type, alarm level, and alarm count. Extract the vulnerability ID, vulnerability impact scope, and vulnerability severity from the vulnerability records in the vulnerability database of the security data lake; the vulnerability layer elements include the vulnerability ID, the vulnerability impact scope, and the vulnerability severity; The network layer elements, host layer elements, application layer elements, and vulnerability layer elements are combined into a feature vector according to a preset feature order, and the feature vector is used as the security situation element; the security situation element set is composed of multiple security situation elements.

4. The method for network security situation analysis of power metering systems based on big data according to claim 1, characterized in that, An unsupervised anomaly detection model and a supervised threat classification model are constructed. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results. The set of security situation elements is input into the supervised threat classification model to obtain threat classification results, including: The security situation elements in the set of security situation elements within the historical time period are used as unsupervised training samples to train the unsupervised anomaly detection model in an unsupervised manner, so as to obtain an unsupervised anomaly detection model for outputting the anomaly detection results; the unsupervised anomaly detection model is a model built based on an autoencoder structure. The labeled attack types corresponding to the security situation elements are used as supervision labels. The security situation elements and the supervision labels are combined to form a supervision training sample. The supervised threat classification model is trained in a supervised manner to obtain a supervised threat classification model for outputting the threat classification results. The supervised threat classification model is a model built based on a multi-layer neural network structure.

5. The method for network security situation analysis of power metering systems based on big data according to claim 1, characterized in that, Based on the anomaly detection results and the threat classification results, a correlation analysis is performed. Combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information, the asset security risk value of each asset and the overall security risk value of the power metering system are calculated, including: Based on the association between the asset information and the vulnerability records in the vulnerability database, the severity of the vulnerability is mapped to a vulnerability weight, and vulnerability weights are assigned to each vulnerability record in the vulnerability database. The importance of the assets is mapped to asset weights, and asset weights are assigned to each asset information. Based on the vulnerability records in the vulnerability database associated with each of the asset information, the corresponding vulnerability weights and corresponding asset weights are weighted and fused to obtain the asset security risk value corresponding to each of the asset information. The security risk values ​​of each asset are aggregated according to their respective power metering systems to obtain the overall security risk value of the power metering system.

6. The method for network security situation analysis of power metering systems based on big data according to claim 1, characterized in that, The asset security risk value and the overall security risk value are mapped to cybersecurity situation indicators, and these cybersecurity situation indicators are displayed on a visual interface, including: The asset security risk value and the overall security risk value are normalized to obtain the normalized asset security risk value and the normalized overall security risk value. According to the preset classification rules, the normalized overall security risk value is mapped to the overall security index, and the normalized asset security risk value is mapped to the attack threat level and the vulnerability level. The overall security index, attack threat level, and vulnerability level are displayed on the visualization interface according to the time, asset, and geographical dimensions.

7. The method for network security situation analysis of power metering systems based on big data as described in claim 6, characterized in that, According to preset classification rules, the normalized overall security risk value is mapped to the overall security index, and the normalized asset security risk value is mapped to the attack threat level and the vulnerability level, including: A nonlinear transformation is performed on the normalized overall security risk value and the normalized asset security risk value to calculate the system continuous security index and the asset continuous risk score, thereby obtaining the system continuous security index and the asset continuous risk score; the system continuous security index and the asset continuous risk score satisfy the following: ;in, This is the normalized overall security risk value. This is the normalized asset safety risk value. The system continuous security index is used to generate the overall security index. For the continuous risk score of assets used to generate the attack threat level and the vulnerability level, A system risk enhancement coefficient greater than 1 The asset weight coefficient is between 0 and 1; The system continuous security index is determined within a range according to a preset set of system index grading thresholds, and the determination result is used as the overall security index. The asset continuous risk score is determined within a range according to a preset set of asset risk grading thresholds, and the determination result is used as the attack threat level and the vulnerability level.

8. The method for network security situation analysis of power metering systems based on big data according to claim 1, characterized in that, A time-series prediction model is constructed based on the aforementioned network security situation indicators to predict the network security situation indicators within a preset time period. When the prediction result exceeds a preset threshold, a security warning is generated and pushed to security management personnel, including: The network security situation indicators within a historical time period are used as input sequences to train the time series prediction model, so as to obtain a time series prediction model for outputting prediction results. Multiple preset thresholds are set according to the value range of the overall security index, and different preset thresholds correspond to different levels of security warning information; When generating the security warning information, the warning notification method is selected according to the attack threat level. Specifically, when the attack threat level is higher than the first level threshold, the security warning information is sent to the security management personnel simultaneously via SMS and email. When the attack threat level is within the level range that is not higher than the first level threshold, the security warning information is displayed on the visualization interface in the form of an alarm pop-up.

9. The method for network security situation analysis of power metering systems based on big data according to claim 1, characterized in that, After obtaining the aforementioned network security posture indicators, the following are also included: The network security situation indicators are associated and stored with the data in the security data lake to form historical samples of the security data lake containing the network security situation indicators. These samples are used to iteratively optimize the unsupervised anomaly detection model, the supervised threat classification model, and the time series prediction model.

10. A network security situation analysis system for power metering systems based on big data, characterized in that, include: The data acquisition and preprocessing module is used to collect network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence from the power metering system. It cleans, normalizes, and correlates the network traffic data, system log data, security device alarm data, asset information, vulnerability records in the vulnerability database, and external threat intelligence to form a security data lake. The multi-layer element extraction module is used to extract security posture elements from network layer elements, host layer elements, application layer elements, and vulnerability layer elements constructed from the asset information and vulnerability records in the vulnerability database based on the security data lake, so as to obtain a set of security posture elements. The dual-model security analysis module is used to construct an unsupervised anomaly detection model and a supervised threat classification model. The set of security situation elements is input into the unsupervised anomaly detection model to obtain anomaly detection results, and the set of security situation elements is input into the supervised threat classification model to obtain threat classification results. The risk assessment and correlation analysis module is used to perform correlation analysis based on the anomaly detection results and the threat classification results, and to calculate the asset security risk value of each asset and the overall security risk value of the power metering system by combining the vulnerability severity corresponding to the vulnerability records in the vulnerability database and the asset importance corresponding to the asset information. The situation indicator generation and visualization module is used to map the asset security risk value and the overall security risk value into network security situation indicators, and to display the network security situation indicators on a visualization interface; the network security situation indicators include the overall security index, attack threat level, and vulnerability level; The situation prediction and early warning module is used to construct a time series prediction model based on the network security situation indicators, predict the network security situation indicators within a preset time period, generate security early warning information when the prediction result exceeds a preset threshold, and push it to security management personnel.

Images