Active defense system and method for unknown threat

Abstract

An active defense system and method for an unknown threat. The system comprises: an intelligent threat early warning module (10), an unknown threat detection module (20), and an adaptive defense processing module (30). The intelligent threat early warning module (10) is configured to perform threat prediction on a power grid situation data set acquired in real time from a power information network, so as to obtain threat early warning information, and send the threat early warning information to the unknown threat detection module (20); the unknown threat detection module (20) is configured to perform threat detection and analysis on acquired unknown threat network data when receiving the threat early warning information, generate a threat analysis report, and send the threat analysis report to the adaptive defense processing module (30); and the adaptive defense processing module (30) is configured to trigger, on the basis of the threat analysis report, a defense processing operation corresponding to a preset threat defense strategy.

Description

Active defense system and method for unknown threats

[0001] This application claims priority to the Chinese patent application filed with the China Patent Office on August 16, 2023, with application number 202311028145.8. The entire contents of the above application are incorporated by reference into this application. Technical Field

[0002] The present application relates to the technical field of power systems, for example, to an active defense system and method for unknown threats. Background Art

[0003] The power information network refers to a network in the power system that uses computer technology and communication technology to interconnect power equipment in order to realize functions such as intelligence, informatization and remote control.

[0004] The current network security risks faced by power information networks include: (1) network attacks. Hackers may enter the power information network through various means to attack and damage the system, such as distributed denial of service (DDoS) attacks, malware attacks, data tampering, etc. These attacks may cause power grid outages, data leakage and information security issues; (2) human operation errors. The power information network involves many human operations, such as system maintenance and network management. If an operation error occurs, it may cause system failure or information leakage; (3) social engineering attacks. Through disguise, deception, information collection and other means, information about the system or application is obtained to achieve the purpose of entering the computer system or network; (4) Internet of Things (IoT) device security issues. Commonly used IoT devices in the power information network have some security vulnerabilities, such as default passwords and failure to upgrade in time. These problems are easily exploited by attackers. In response to the above network security risks, security measures need to be taken to ensure the safe operation of the power information network.

[0005] While security technologies in related technologies can address some traditional network security issues, they are deficient in the construction of power information networks in three key areas: First, traditional power network security defense systems are mostly based on passive defense, relying on technologies such as antivirus software, firewalls, and identity authentication. For example, while firewall technology can effectively block most illegal intrusions by configuring certain security access rules, these configuration rules are static. Once attack methods diversify, security protection becomes less proactive and lacks detection flexibility. Second, from a technical perspective, power network security defenses primarily focus on perimeter defense, failing to comprehensively analyze threats and lacking agility to understand the overall cybersecurity threat landscape. This results in an inability to respond promptly to evolving attacks, reducing defense effectiveness. Third, traditional defense methods rely heavily on manual operations by operations and maintenance engineers, lacking autonomy.

[0006] Summary of the Invention

[0007] This application provides an active defense system and method for unknown threats to address the problems of lack of initiative and autonomy in the security technology of the power information network and incomplete defense, forming a more refined and adaptive security protection system, improving the monitoring and early warning capabilities of system security incidents, and enhancing the overall power network defense level.

[0008] This application provides an active defense system for unknown threats, which is applied to a power information network. The system includes:

[0009] Intelligent threat warning module, unknown threat detection module and adaptive defense disposal module;

[0010] The intelligent threat warning module is configured to perform threat prediction on a power grid situation data set collected in real time from the power information network to obtain threat warning information, and send the threat warning information to the unknown threat detection module;

[0011] The unknown threat detection module is configured to perform threat detection and analysis on the collected unknown threat network data upon receiving the threat warning information, generate a threat analysis report, and send the threat analysis report to the adaptive defense disposal module;

[0012] The adaptive defense handling module is configured to trigger a defense handling operation corresponding to a preset threat defense strategy according to the threat analysis report.

[0013] The present application also provides an active defense method for unknown threats, which is applied to an active defense system for unknown threats. The method includes:

[0014] Through the intelligent threat warning module, threat prediction is performed on the power grid situation data set collected in real time from the power information network to obtain threat warning information, and the threat warning information is sent to the unknown threat detection module;

[0015] When receiving the threat warning information, the unknown threat detection module performs threat detection and analysis based on the collected unknown threat network data to generate a threat analysis report; and sends the threat analysis report to the adaptive defense disposal module;

[0016] The adaptive defense handling module triggers a defense handling operation corresponding to a preset threat defense strategy according to the threat analysis report. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] FIG1A is a schematic diagram of the structure of an active defense system for unknown threats provided in Example 1 of the present application;

[0018] FIG1B is a structural block diagram of an intelligent threat warning module provided in Example 1 of the present application of the present invention;

[0019] FIG1C is a structural block diagram of an early warning unit based on situational awareness prediction according to the first embodiment of the present invention;

[0020] FIG1D is a structural block diagram of an unknown threat detection module provided in Example 1 of the present application of the present invention;

[0021] FIG1E is a structural block diagram of a threat analysis unit based on behavioral deep learning provided in Example 1 of the present application of the present invention;

[0022] FIG1F is a structural block diagram of an adaptive defense processing module provided in Example 1 of the present application of the present invention;

[0023] FIG2 is a schematic diagram of a process for generating a training sample set according to an example of the first embodiment of the present application;

[0024] FIG3 is a schematic diagram of a business process of an early warning unit based on big data prediction provided in Example 1 of the present application;

[0025] FIG4 is a schematic diagram of a log data collection process provided in Example 1 of the present application;

[0026] FIG5 is a schematic diagram of a threat intelligence sharing process in a blockchain provided in Example 1 of the present application;

[0027] FIG6 is a schematic diagram of another threat intelligence sharing process in a blockchain provided in Example 1 of the present application;

[0028] FIG7 is a flow chart of a method for detecting traffic encryption security according to an embodiment of the present application;

[0029] FIG8 is a schematic diagram of an execution process of adaptive security device linkage provided in Example 1 of the present application;

[0030] FIG9 is a schematic diagram of an execution process of an automated treatment unit provided in Example 1 of the present application;

[0031] FIG10 is a schematic structural diagram of an active defense system for unknown threats provided in Example 2 of the present application;

[0032] FIG11 is a schematic diagram of an execution process of a finite state machine provided in Example 2 of the present application;

[0033] FIG12 is a diagram of a threat chain structure based on abnormal behavior association provided in Example 2 of the present application. DETAILED DESCRIPTION

[0034] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] Example 1

[0036] FIG1A is a schematic structural diagram of an active defense system for unknown threats provided in Example 1 of the present application. The active defense system can be applied to an electric power information network to defend against unknown threats in the electric power information network. As shown in FIG1A , the system includes: an intelligent threat warning module 10, an unknown threat detection module 20, and an adaptive defense disposal module 30; the intelligent threat warning module 10 is configured to perform threat prediction on a power grid status data set collected in real time from the electric power information network to obtain threat warning information, and send the threat warning information to the unknown threat detection module 20; the unknown threat detection module 20 is configured to perform threat detection and analysis on the collected unknown threat network data upon receiving the threat warning information, generate a threat analysis report, and send the threat analysis report to the adaptive defense disposal module 30; the adaptive defense disposal module 30 is configured to trigger a defense disposal operation corresponding to a preset threat defense strategy according to the threat analysis report.

[0037] The intelligent threat warning module 10 is a module that predicts possible threats and issues warnings before network security issues occur; the unknown threat detection module 20 detects and analyzes data, behaviors or applications with unknown threats when network security issues occur; the function of the adaptive defense disposal module 30 is to provide early warning information and protection and disposal when network security threats occur.

[0038] The intelligent threat warning module 10 uses a pre-set warning mechanism to perform threat prediction on the grid situation dataset collected in real time from the power information network to obtain threat warning information, thereby providing proactive early warning of unknown threats. Warning mechanisms may include, but are not limited to, those based on situational awareness and network model predictions, those based on big data predictions, those based on alliance chain intelligence sharing, and other warning mechanisms. After obtaining threat warning information, the intelligent threat warning module 10 transmits it to the unknown threat detection module 20.

[0039] Upon receiving threat warning information, the unknown threat detection module 20 performs threat detection and analysis on the collected unknown threat network data according to pre-defined detection and analysis methods, generating a threat analysis report, thereby proactively detecting and comprehensively analyzing unknown threats. Detection methods include, but are not limited to, those based on deep learning models, those based on complex event processing frameworks, and those based on encrypted traffic. The unknown threat detection module 20 then sends the resulting threat analysis report to the adaptive defense and response module 30.

[0040] After receiving the threat analysis report, the adaptive defense handling module 30 triggers a defense handling operation corresponding to a preset threat defense strategy according to the threat analysis report, thereby realizing automatic defense against unknown threats.

[0041] An embodiment of the present application provides an active defense system for unknown threats, including: an intelligent threat warning module, an unknown threat detection module and an adaptive defense disposal module; the intelligent threat warning module is configured to perform threat prediction on a power grid status data set collected in real time from an electric power information network to obtain threat warning information, and send the threat warning information to the unknown threat detection module; the unknown threat detection module is configured to perform threat detection and analysis on the collected unknown threat network data upon receiving the threat warning information, generate a threat analysis report, and send the threat analysis report to the adaptive defense disposal module; the adaptive defense disposal module is configured to trigger a defense disposal operation corresponding to a preset threat defense strategy according to the threat analysis report. Through active warning, timely detection and automatic defense, the problems of lack of initiative and autonomy and incomplete defense of the security technology of the electric power information network are solved, a more refined and adaptive security protection system is formed, the monitoring and early warning capabilities of system security events are improved, and the overall defense level of the electric power network is improved.

[0042] In an optional embodiment, Figure 1B is a structural block diagram of an intelligent threat warning module provided in Example 1 of the present application of the present invention. Referring to Figure 1B, the intelligent threat warning module 10 includes: a warning unit 11 based on situational awareness prediction, a warning unit 12 based on big data prediction, a warning unit 13 based on alliance chain intelligence sharing, and a joint warning unit 14.

[0043] The early warning unit 11 based on situational awareness prediction is configured to predict the multi-source power grid situation data set collected from the power information network through a pre-trained complete situation prediction model to obtain a situation prediction result, and generate a first threat early warning information based on the situation prediction result; the early warning unit 12 based on big data prediction is configured to process the collected log data of the device through a pre-trained complete data mining model and feature extraction model to obtain a threat prediction result, and generate a second threat early warning information based on the threat prediction result; the early warning unit 13 based on alliance chain intelligence sharing is configured to obtain the threat intelligence data of the threatened node in the power information network through the alliance chain, and determine the third threat early warning information based on the threat intelligence data; the joint early warning unit 14 is configured to generate a joint early warning information based on the first threat early warning information, the second threat early warning information and the third threat early warning information, and send the joint early warning information to the unknown threat detection module 20.

[0044] Multi-source power grid status dataset refers to a power grid status dataset collected from different sources.

[0045] Devices refer to various types of security devices used in power grids, such as "intrusion prevention devices" and "web application firewalls".

[0046] A node refers to a power system terminal, and a threatened node is a threatened power system terminal.

[0047] The first threat warning information is the threat warning information predicted by the warning unit 11 based on situational awareness prediction; the second threat warning information is the threat warning information predicted by the warning unit 12 based on big data prediction; the third threat warning information is the threat warning information predicted by the warning unit 13 based on alliance chain intelligence sharing.

[0048] The early warning unit 11 based on situation awareness prediction uses a pre-trained and complete situation prediction model to predict the multi-source heterogeneous power grid situation data in the power information network to obtain a situation prediction result, and generates first threat early warning information based on the situation prediction result.

[0049] Exemplarily, the steps of obtaining a fully trained situation prediction model include: constructing a training sample set, constructing an initial situation prediction model, and iteratively training the initial situation prediction model using the training sample set.

[0050] The method of constructing a training sample set can be to extract, clean, convert, load, and other processing methods on the power grid status data set collected in historical time to construct a training sample set. In this embodiment, in order to make the discrete multi-source power grid status data set linearly correlated, a sliding window can be used to process the power grid status data set to obtain a training sample set. Figure 2 is a schematic diagram of an example training sample set generation process provided in Example 1 of the present application. As shown in Figure 2, the width of the sliding window is set to 5, and each time the window is collected, the data set corresponding to 5 days is collected, and the sliding window is 1 as a step size. After the sliding window is collected, the data set of 5 days in the window is collected, and the processing results of the data set collected in each window are used as a training sample set, thereby obtaining multiple linearly correlated training sample sets.

[0051] The initial situation prediction model may be constructed by using a bagging algorithm, wherein the initial situation prediction model is composed of five parallel v-Support Vector Machine (v-SVM) sub-models.

[0052] The process of iteratively training the initial situation prediction model using the training sample set can be as follows: the maximum number of iterations of the bagging method is set to 5; v-SVM is defined as a weak learning method, the v-SVM prediction sub-model is constructed using the bagging method, and the parameters of the v-SVM prediction sub-model sequence set are initialized. The prediction sub-model sequence set is expressed as follows: A = (A1, A2, A3, A4, A5);

[0053] A5 is the sequence of the fifth prediction sub-model. Initialized parameters include the kernel function parameters and sequence parameters of the sub-model. Half of the training samples are randomly sampled with replacement from the training sample set. These samples are used as prediction samples for the five prediction sub-models. The new sequence set of the five prediction sub-models obtained through training is: B = (B1, B2, B3, B4, B5); B5 is the new sequence of the fifth prediction sub-model.

[0054] Input additional training samples into the new sequence set to obtain a set of power grid situation prediction values ​​for the five prediction sub-models. Integrate the five situation prediction values, and use the integrated result as the situation prediction result of the situation prediction model. The integration method is to take the average of the five situation prediction values ​​as the situation prediction result corresponding to the training sample set of the final output. Calculate the loss function based on the situation prediction results and the labeled results in the training samples, and adjust the model parameters of the initial situation prediction model based on the loss function until a situation prediction model is obtained. For example, adjust the model parameters of the initial situation prediction model based on the loss function until the loss function reaches a minimum value, and then use the initial situation prediction model at this time as the situation prediction model.

[0055] The early warning unit 12 based on big data prediction processes the collected device log data through a pre-trained data mining model and feature extraction model to obtain second threat early warning information. The devices include but are not limited to host devices, network devices, and security devices.

[0056] Figure 3 is a schematic diagram of the structure of an early warning unit based on big data prediction provided in Example 1 of the present application. As shown in Figure 3, the early warning unit based on big data prediction 12 includes a data acquisition subunit, a data preprocessing subunit, a prediction model construction subunit, and a threat prediction subunit.

[0057] (1) Data collection subunit. Log data can be collected from host devices, network devices, and security devices. Figure 4 is a schematic diagram of a log data collection process provided by Example 1 of the present application. As shown in Figure 4, the log data not only includes the log information of assets during the normal operation period of the power grid, but also includes the log information before, during, and after the network security incident has occurred. The log information of the network security incident can help the threat prediction model learn the relationship between different types of devices and the relationship between each type of device and the network security incident when the network security incident occurs. The collection of log data can use the system log (Syslog) protocol. Syslog uses a hierarchical log message format, including information such as priority, timestamp, log source, and message content, so that unstructured data entries of each type of power grid device log-security incident number can be constructed in chronological order.

[0058] (2) Data preprocessing subunit. The processing operations on log data include but are not limited to data cleaning, data completion and data conversion. The data cleaning process is to delete data columns that are not related to the threat prediction task and entries with a large number of missing items; the data completion process uses methods such as average value completion and nearest completion for entries that only lack quantity items; data conversion can convert the collected unstructured data into unified structured data to facilitate the operation of subsequent data mining modules and feature extraction modules. For string-type non-numeric data, word vector conversion (Word to Vector, Word2Vec) and document vector conversion (Doc2Vec) methods are used to convert string-type non-numeric data into vectors. For discrete data, one-hot encoding method is used to make it continuous and convert it into a multi-dimensional vector.

[0059] (3) Prediction model construction subunit. Based on the collected and preprocessed data, a training set is formed to establish a data mining model based on machine learning methods and a feature extraction model based on deep learning. In the data mining part, the Light Gradient Boosting Machine (LightGBM) method is selected for training.

[0060] After multiple cross-validations, the model with the optimal parameters was selected and saved. For threat signature extraction, a deep neural network (DNN) was selected for training. During training, multi-batch gradient descent was used for convergence optimization. After multiple cross-validations, the model with the optimal parameters was selected and saved.

[0061] (4) Threat prediction subunit. Based on the established data mining model and feature extraction model, log data from designated devices within the power grid is collected at regular intervals. After preprocessing the log data, it is input into the data mining model and feature extraction model. The outputs of the data mining model and feature extraction model are weighted to obtain threat prediction results, and second threat warning information is generated based on the threat prediction results.

[0062] The early warning unit 13 based on alliance chain intelligence sharing is configured to obtain threat intelligence data of threatened nodes in the power information network through the alliance chain, and determine third threat early warning information according to the threat intelligence data.

[0063] Figure 5 is a schematic diagram of the structure of the early warning unit based on alliance chain intelligence sharing. As shown in Figure 5, the early warning unit 13 based on alliance chain intelligence sharing includes the following structure:

[0064] (1) Construct the application interaction layer. Under the sharing mechanism, each power system terminal acts as a node in the network. Each node can act as an information contributor to upload intelligence for other nodes in the network to download, and can also act as an intelligence acquirer to obtain intelligence-related information through the blockchain network. When a node in the power system network is attacked, the attack method and type, as well as other related information, are encapsulated into multiple pieces of intelligence and uploaded to the blockchain network. At this time, other power system nodes in the network can download this intelligence to update the existing defense strategy, achieving the purpose of threat warning and active defense. The application interaction layer encapsulates some basic functions to implement the above operations, such as common basic functions in the shared network, such as data upload and data query. These functions are encapsulated in the form of standard transactions and sent to the requesting node as a transaction. After the request is completed, the node stores the data on the blockchain.

[0065] (2) Blockchain layer. It includes peer-to-peer (P2P) network and blockchain. The transmission and processing of transactions can be completed in the P2P network. If you want to package the transmitted transactions (intelligence) into blocks for storage, you need to let these transactions pass the consensus protocol, then package them into blocks, and then upload them to the blockchain. The blockchain layer requires the joint maintenance of the power system nodes in the entire alliance chain network. If a region uses the same blockchain network, the nodes in the network can be divided into different types of groups according to the system type. The entire sharing mechanism does not have a dedicated administrator, but access control will be performed on untrusted power system nodes based on the behavior and identity of the power system. Some power system nodes can be given a relatively high reliability level at the beginning, and other power system nodes will dynamically adjust their reliability level based on their behavior. For power system nodes with low reliability, they are prohibited from participating in the maintenance of public intelligence, so that they cannot obtain the intelligence shared within the network.

[0066] In a consortium blockchain, each power system can be considered a node in the blockchain. Once the blockchain network is established, power systems in different regions can share threat intelligence resources through the network. Each regional power system organization can elect a regional power system representative based on their specific circumstances to represent their organization and apply to become a node in the blockchain. As a blockchain node, the regional power system representative is responsible for maintaining the blockchain ledger and sharing intelligence through the blockchain network. Each regional power system representative represents an organization in a unified intelligence sharing system. Threat intelligence sharing is handled by setting rules that achieve network-wide consensus (a consensus mechanism) and pre-deployed procedures. These pre-deployed procedures, also known as chaincode, are deployed into the blockchain to provide basic operations for each organization's representative member node. The storage of intelligence is divided into two parts: off-chain storage and on-chain storage. Off-chain storage is the same as the traditional centralized sharing mechanism. Some power systems within the organization will upload the collected network threat intelligence to the local database, and other power systems within the organization can download the threat intelligence through the local database. On-chain storage is that the power system representative of each organization uploads the threat intelligence in each organization's local database to the blockchain for other organizations in the blockchain to download the threat intelligence. The power system representative of each organization is also allowed to obtain the intelligence stored on the blockchain by other organizations, and then upload it to the local database of the organization for download by other nodes of the organization.

[0067] Figure 6 is a schematic diagram of a threat intelligence sharing process in a blockchain, as provided in Example 1 of this application. As shown in Figure 6 , intelligence transmission can be accomplished in the form of a transaction. Therefore, in a blockchain-based threat intelligence sharing mechanism, each piece of threat intelligence shared can be considered the initiation of a transaction, a standard intelligence sharing process. The sharing process is as follows:

[0068] (1) Transaction endorsement. If the power system wants to share a piece of intelligence data, the intelligence will be encapsulated into a transaction by the power system. The power system then sends the transaction to the endorsing node in the network, requesting that the transaction be uploaded to the blockchain. After receiving the request, the endorsing node first reads the current blockchain ledger locally, signs the blockchain state obtained after reading the ledger and the blockchain state after adding the transaction, and returns the signature to the power system.

[0069] (2) Organize into blocks. After receiving the data returned by the endorsement node, the power system program packages the data. Subsequently, all the organization nodes in the network will receive the broadcast of the data, forming a unified transaction pool. After receiving the data, the organization node begins to execute the pluggable consensus protocol that has been set up. Transactions that pass the consensus protocol will be packaged into a block.

[0070] (3) Confirmation and submission. The organizing node broadcasts the packaged block to all submitting nodes participating in the consensus for verification. If the majority of submitting nodes have verified the block, the block will be uploaded to the blockchain. The steps include: the nodes participating in the consensus verify the accuracy and legitimacy of the transaction information in the block, obtain the blockchain status obtained by the endorsing node after reading the blockchain ledger when submitting the transaction, compare the obtained blockchain status with the local blockchain status to see if they are consistent. If they are consistent, it is considered that there is no problem with this transaction, and send its own decision to other nodes participating in the consensus. After these verifications are completed, the block is added to the end of the blockchain, and the status of the ledger is also updated. The submitting node replies with a message to notify the power system that the submission is successful, the consensus is completed, and the power system nodes in the blockchain reach a consensus on the block's inclusion on the chain and ensure the synchronization of the blockchain ledger.

[0071] In one embodiment, Figure 1C is a structural block diagram of an early warning unit based on situational awareness and prediction provided in Example 1 of the present application of the present invention. Referring to Figure 1C, the early warning unit based on situational awareness and prediction 11 includes: a multi-source power grid situation data processing subunit 111, a situation prediction subunit 112 and a threat early warning subunit 113.

[0072] The multi-source power grid situation data processing subunit 111 is configured to collect multi-source power grid situation data, perform data conversion and data preprocessing on the multi-source power grid situation data, and obtain a multi-source power grid situation data set; the situation prediction subunit 112 is configured to input the multi-source power grid situation data set into a pre-trained situation prediction model to obtain a situation prediction result; the threat warning subunit 113 is configured to compare the situation prediction result with the situation critical value, and generate first threat warning information according to the comparison result.

[0073] The multi-source power grid situation data processing sub-unit 111 performs data conversion and data preprocessing on the collected multi-source power grid situation data. The multi-source power grid situation data conversion includes three parts: smoothing, scaling and generalization of the multi-source power grid situation data:

[0074] (1) Smoothing of multi-source power grid status data. Smoothing of multi-source power grid status data can remove irrelevant data and noise data in the multi-source power grid status data. The processing method used is the sliding average method. The core idea of ​​the sliding average method is to average a total of 2n+1 observations collected before and after the current data, and use the average value as a substitute for the current data. By smoothing the data and eliminating data that deviates significantly from the majority of the data, the multi-source power grid status data smoothing process can be completed.

[0075] (2) Scaling of multi-source power grid situation data. Scaling of multi-source power grid situation data is to process the same attribute value in a larger range so that it falls into a specific, smaller range. The scaling formula is as follows:

[0076] X scaled is the data scaling result, X sta Specify the zoom range for the data, X max is the maximum value of multi-source power grid situation data on an attribute, X min It is the minimum value of one attribute of multi-source power grid situation data.

[0077] (3) Generalization of multi-source power grid situation data. The generalization of multi-source power grid situation data can abstract the detailed information in the original concept layer of an attribute data and elevate it to a higher concept layer. The generalization process is as follows: ① Input the data table of the attribute data of the power grid situation; ② Set the generalization parameter ω; ③ Calculate the privacy protection threshold T of the data table; ④ Enumerate all the strategies in the data table, and directly filter out the strategies with strategy values ​​greater than the threshold T in the strategy enumeration to generate the strategy space of the remaining strategies; ⑤ For the generated strategy space, filter it through ω-approximate skyline to obtain the candidate strategy space; ⑥ Execute the skyline of the candidate strategy space to obtain the recommended strategy set; ⑦ Output the recommended strategy set and its corresponding generalization.

[0078] The situation prediction subunit 112 inputs the multi-source power grid situation data set into the five prediction sub-models in the pre-trained situation prediction model for situation prediction, obtains the power grid situation prediction values ​​of the five prediction sub-models, and takes the average of the five power grid situation prediction values ​​as the final situation prediction result.

[0079] The threat warning subunit 113 sets a critical value of the power grid terminal situation based on prior knowledge. When the situation prediction result output by the situation prediction subunit 112 exceeds the preset critical value, a first threat warning message is generated for threat warning.

[0080] In an optional embodiment, Figure 1D is a structural block diagram of an unknown threat detection module provided in Example 1 of the present application of the present invention. Referring to Figure 1D, the unknown threat detection module 20 includes: a threat detection unit 21 based on encrypted traffic, a threat detection unit 22 based on a complex event processing framework, and a threat analysis unit 23 based on behavioral deep learning.

[0081] The encrypted traffic-based threat detection unit 21 is configured to perform threat detection on the collected first unknown threat network data to obtain a first threat detection result; the first unknown threat network data includes: malicious traffic data of encrypted communications, encrypted attack behaviors or malicious applications; the threat detection unit 22 based on the complex event processing framework is configured to perform threat analysis on the collected second unknown threat network data according to threat event detection rules based on the complex time processing framework to obtain a second threat detection result; the second unknown threat network data includes log data of the threatened device; the threat analysis unit 23 based on behavioral deep learning is configured to perform deep learning on the first threat detection result and the second threat detection result to obtain a threat analysis report.

[0082] The unknown threat network data includes first unknown threat network data and second unknown threat network data.

[0083] The encrypted traffic-based threat detection unit 21 uses a traffic encryption security detection method to perform threat detection on the collected first unknown threat network data to obtain a first threat detection result. The first unknown threat network data includes: malicious traffic data of encrypted communications, encrypted attack behaviors or malicious applications. The traffic encryption security detection method conducts in-depth analysis and data observation on a large number of malicious samples that use encrypted communications, attack behaviors of multiple types of encrypted channels, and multiple malicious or illegal applications, and explores, tests and verifies multiple detection methods. Figure 7 is a flow chart of a traffic encryption security detection method provided in an embodiment of the present application. As shown in Figure 7, the traffic encryption security detection method includes:

[0084] (1) Collect real-time malicious samples. The key to ensuring the accuracy and timeliness of the detection engine lies in the accuracy and coverage of data collection. Data collection includes three channels: collecting from the actual network environment, simulating test data, and tracking the latest samples and the latest attack methods. The collected data includes malicious samples using encrypted communications, more than 200 families, covering multiple types of malicious behaviors, Secure Sockets Layer (SSL) versions and encryption algorithms; multiple types of attack software that can launch attacks in encrypted channels, and actual environment data, including: scanning detection, brute force cracking, Challenge Collapsar (CC) attacks, etc., multiple types of malicious application software and actual environment data, including: Tor, Freegate, Ultrasurf, etc.

[0085] (2) Analysis and organization of malicious samples. To ensure that the data set is complete and free of impurities, all collected data must be deeply analyzed and organized to ensure the quality of the data that is later transmitted to the artificial intelligence (AI) model training. Analysis tasks include: in-depth analysis of the functions, encryption mechanisms, communication methods, and hazards of malicious samples; analysis of the attack types, data formats, encryption methods, etc. of attacks and malware. Data processing includes two steps: one is to obtain sample communication data through sandboxes and virtual machines, and the other is to format the data.

[0086] (3) Classification of malicious behaviors. Malicious encrypted traffic is a broad concept that includes a variety of malicious behaviors. Each type of data has subtle differences in characteristics. To obtain higher accuracy, it is necessary to first distinguish the background and characteristics of each type of encrypted traffic. Through the analysis of massive malicious encrypted traffic, the data can be divided into three categories: First, malicious code uses encrypted communication traffic, including more than 200 families. The types of malicious code include: Trojan horses, ransomware, infectious viruses, worm viruses, downloaders, and others; the encrypted communication methods used by malicious code include six categories: connecting to the command and control (C&C) server, detecting the host network environment, normal communication of the mother program, hidden transit of white sites, worm propagation communication, etc. Second, malicious attack traffic in the encrypted channel, attack types include: detection scanning, brute force cracking, information theft, CC attacks, etc. Third, communication traffic of malicious or illegal encrypted applications, including: Tor, wall-breaking software, illegal virtual private networks (VPN), etc.

[0087] (4) Feature engineering. Feature engineering consists of three parts: feature construction, feature extraction, and feature selection. Feature engineering is key to ensuring high enough accuracy for the subsequent detection engine. During the feature engineering phase, deep feature extraction is performed simultaneously, and some features are trained using convolutional neural networks (CNN) and recurrent neural networks (RNN).

[0088] (5) Training the detection model. The methods used for model training include linear regression (LinReg), random forest (RandomForest), decision tree (DecTree), multilayer perceptron (MLP), support vector machine (SVM), logistic regression (LogReg), and convolutional neural network (CNN).

[0089] (6) Model iteration and optimization. After the initial model training is completed, the model should be continuously optimized. The optimization methods include parameter tuning, verification and testing of the selected model, as well as testing and iterative training with actual network traffic data. Finally, for each type of encrypted traffic, the best method and parameters are selected based on the actual test results to ensure accuracy.

[0090] (7) Reporting and Response. Once a potential threat is detected, an alert or report will be generated. Based on this information, the security team can take appropriate measures, such as blocking malicious traffic, isolating infected devices, or starting an investigation. For advanced threats, continuous monitoring may be required to ensure that the threat is completely eliminated.

[0091] (8) Data re-encryption. After decrypted traffic is analyzed and processed, the data is typically encrypted again and sent to its final destination. This helps ensure that the data maintains confidentiality and integrity throughout the transmission process.

[0092] The following is a specific example to illustrate the threat analysis based on encrypted traffic in this application, which includes the following steps:

[0093] Step 2.1.1: Use tcpdump to capture and save network packets on the power grid, and define them as {x1, x2, ..., x n}.

[0094] Step 2.1.2: Then use Wireshark to analyze the captured data packets on the power grid and define them as

[0095] Step 2.1.3: Use the CNN model to train a classifier to classify traffic behavior. The backbone of the classifier uses a 50-layer residual network (ResNet-50). This classifier is called F. For any input x entering F, it will output the corresponding label y and confidence score c.

[0096] By comparing the confidence score c with the set threshold λ, we determine whether the input x is abnormal, that is, whether the input x is abnormal traffic that poses a threat. When the confidence score c is less than the threshold λ, x is abnormal. Alternatively, when the model output probabilities are concentrated during the prediction process and the confidence score c is high, x is normal; when the model output probabilities are more evenly distributed and the confidence score c is low, x is abnormal.

[0097] Step 2.1.4: During the model evaluation and iteration phase, define a confusion matrix that divides the data into four scenarios: anomaly detected, anomaly not detected, normal data considered anomaly, and normal data not considered anomaly. For each scenario, define a cost value to assess the severity of the misjudgment.

[0098] Through the above operations, an abnormal threat in encrypted traffic has been successfully detected. Abnormal traffic may manifest as unknown protocols, unusual packet sizes or frequencies, or large influxes of traffic. A complete report should be submitted, providing as much detailed information as possible, including time, location, and scope of impact. After the report is completed, re-encrypt the data.

[0099] The threat detection unit 22 based on the complex event processing framework performs threat analysis on the collected second unknown threat network data according to the threat event detection rules based on the complex time processing framework to obtain a second threat detection result. In order to quickly discover data security events, it is necessary to process device logs in real time, so a complex event processing (CEP) rule engine developed based on a real-time streaming big data processing framework is required. Deploying a data security event monitoring scenario on a security operation platform requires the following steps: understanding the performance characteristics of data security events, inferring the field characteristics of device logs, summarizing event detection logic, and converting it into event processing language (EPL), integrating EPL into the CEP rule engine and executing it. After the above steps, the CEP rule engine can load the threat event detection rules of the security scenario. When the device log that meets the rule detection mode enters the CEP rule engine, it can trigger the generation of events.

[0100] Through real-time threat detection based on complex event processing, we can flexibly and efficiently handle the source analysis of threat scenarios and quickly restore the full picture of the leakage process, which plays an important role in responsibility positioning, environmental reinforcement, and security prevention.

[0101] In one embodiment, Figure 1E is a structural block diagram of a threat analysis unit based on behavioral deep learning provided in Example 1 of the present application of the present invention. Referring to Figure 1E, the threat analysis unit 23 based on behavioral deep learning includes: an alarm log generation subunit 231, a deconstruction subunit 232 and an analysis subunit 233.

[0102] The alarm log generation subunit 231 is configured to generate alarm information based on the first threat detection result and the second threat detection result, generate an alarm log based on the alarm information, and input the alarm log into the deconstruction subunit; the deconstruction subunit 232 is configured to form a threat chain based on the alarm log; the analysis subunit 233 is configured to perform negative causal association pruning and non-secondary event noise reduction on the threat chain to form a threat analysis report.

[0103] The alarm log generation subunit 231 generates alarm information based on the first threat detection result and the second threat detection result, and generates an alarm log based on the alarm information. The process is: perform threat analysis based on encrypted traffic on the first threat detection result output by the threat detection unit 21 based on encrypted traffic and the second threat detection result output by the threat detection unit 22 based on the complex event processing framework, perform real-time threat monitoring on complex events, generate power grid data security information and alarm information of attack types, perform deduplication and other pre-processing on the alarm information, and form an analyzable alarm log of a single-step attack, and then send the alarm log to the deconstruction subunit 232.

[0104] The deduplication preprocessing process may include: extracting alarm slice type, alarm service type, attack type, alarm start time, alarm end time, alarm type, source address, destination address, source port, destination port and other data from the alarm information. Since different monitoring source data may generate multiple redundant alarms, it is necessary to deduplicate the alarm information on the basis of retaining time information. The deduplication rule is: if the alarm service type, alarm slice type, attack type, Internet Protocol (IP) address, and port number of an alarm information are the same as those of another alarm information within a unit time, the latter alarm information is removed.

[0105] In the deconstruction subunit 232, the alarm log is input into the threat chain deconstruction module to form a threat chain. In the threat chain, each node represents an alarm. After structuring the node information, the alarm information is structured into several tree diagrams. At this point, the alarm information still contains a large amount of redundancy, which needs to be further removed through the sub-node aggregation method. The current tree diagram is traversed layer by layer using a breadth-based search method. Each layer of traversal uses the result of the previous layer as the starting point, traversing all nodes that can be accessed within a certain distance. In the case of redundant alarm information, using breadth-based search can find and remove duplicate alarm information layer by layer. In this way, the overall structure of the tree diagram can be obtained based on the breadth-based search traversal, and the threat structure chain can be constructed.

[0106] In the analysis subunit 233, the threat chain is pruned of negative causal relationships and noise reduction of non-secondary events to generate a threat analysis report. Abnormal data from power monitoring systems originates from a variety of different acquisition devices. Often, two consecutive alarm events have a negative causal relationship, necessitating negative causal rule pruning. For example, if "a DDos event" and "an illegal access event" cannot form a causal relationship, the two nodes corresponding to the two alarm events will be pruned. Excessive alarm events can cause alarm noise, so noise reduction of non-secondary events is also necessary to generate a threat analysis report.

[0107] In an optional embodiment, Figure 1F is a structural block diagram of an adaptive defense disposal module provided in Example 1 of the present application of the present invention. Referring to Figure 1F, the adaptive defense disposal module 30 includes: an adaptive device linkage unit 31 and an automated disposal unit 32.

[0108] The adaptive device linkage unit 31 is configured to determine the association information between device nodes and links based on the constructed network topology model, and update the threat defense strategy based on the association information; trigger the disposal operation corresponding to the updated threat defense strategy according to the threat analysis report; the automated disposal unit 32 is configured to trigger the security device to perform the disposal operation based on the threat analysis report and the pre-constructed threat event workflow.

[0109] The adaptive device linkage unit 31 links the devices in the power information network according to the network topology model, determines the association information between the device nodes and links, and then updates the threat defense strategy based on the association information; triggers the corresponding disposal operation of the updated threat defense strategy according to the threat analysis report.

[0110] The network topology model refers to the topology model of the power information network.

[0111] FIG8 is a schematic diagram of an execution process of adaptive security device linkage provided in the first embodiment of the present application. As shown in FIG8 , the process of adaptive security device linkage includes:

[0112] (1) Overall modeling of the power information network topology. The automatic discovery of the physical network topology reads the management information base (MIB) information of the device through the Simple Network Management Protocol (SNMP). By jointly analyzing the management information base of each device, the physical connection relationship between network elements is obtained, and then a logical topology model that reflects network security threats and network attack and defense status is automatically constructed. This model consists of the description of the nodes in the network, the network connection relationship, the attack rule library, and the attributes of the attacker. The process of generating an attack path from the attacker's perspective is a process of forward searching the network state space. At the same time, the greedy characteristics of the attacker must be guaranteed during the search process, and a forward, breadth-first attack path generation method is implemented to automatically generate a network attack graph.

[0113] (2) Network topology correlation analysis. Determine the correlation between network nodes and links, and update this correlation to the linkage condition set in the intelligent linkage policy library. When the network topology changes, correlation analysis can be used to identify which existing linkage policies are affected and which linkage policies need to be added or deleted, thereby achieving real-time updates of linkage policies.

[0114] To distinguish complex networks at a more granular level, we studied different network association characteristics, including clustering, mixing, and rich-club characteristics. Clustering characterizes the closeness between a node's neighbors. This method uses the clustering coefficient to characterize the parameters of the network's clustering characteristics.

[0115] Before introducing the clustering coefficient, the local clustering coefficient C(k) must be calculated:

[0116] Among them, m m (k) represents the average number of connections between neighbors of a node with node degree k.

[0117] Calculate the average clustering coefficient (mean clustering):

[0118] Among them, P(k) represents the probability that the degree of any node in the graph is k, that is, the distribution of the node degree.

[0119] Calculate the clustering coefficient C:

[0120] Among them, k2 represents the second-order moment of node degree, and represents the average node degree.

[0121] Currently, the average clustering coefficient is commonly used in research to measure clustering characteristics. However, this characterization parameter does not always accurately reflect the actual situation of the network. The clustering coefficient is the most accurate parameter to characterize the clustering characteristics of the network from a global perspective. In some cases, there may be inconsistencies between the average clustering coefficient and the clustering coefficient, that is, there are two a and b that satisfy But C a <C b It is recommended to use the clustering coefficient instead of the average clustering coefficient to characterize the clustering characteristics of the network.

[0122] (3) Adaptive learning of network security rules. The purpose of building and updating the network topology model and analyzing the network topology association is to design network security linkage defense strategies, update the policy library, generate specific security rules, and publish security rules based on the policy information of the policy library. This realizes the linkage between security devices and network security rules. When a business node triggers a security threat or security incident, it is necessary to promptly introduce a defense strategy to control the spread of security issues. Most network attacks start from the endpoint and infiltrate and change the endpoint through long-term delays, data collection, artificial intelligence and other means. These terminal nodes mostly refer to host devices such as servers, workstations, and monitoring hosts. In combination with network devices, security devices, agent programs and other security protection devices, active defense control is carried out on host devices with security risks. It is necessary to comprehensively use defense measures such as business deactivation, logical blocking, and physical isolation.

[0123] The active defense policy library is a linkage or combination of network topology and security defense measures. Based on the defense functions of security devices and hierarchical topology relationships, it adds trigger conditions for specific defense actions and matches them to the type of defense policy. These defense policies include malicious code protection, denial of service protection, network attack protection, sensitive operation control protection, and unauthorized access protection.

[0124] The automated handling unit 32 triggers the security device to perform handling operations based on the threat analysis report and the pre-built threat event workflow. FIG9 is a schematic diagram of the execution process of an automated handling unit 32 provided in the first embodiment of the present application. As shown in FIG9, through visual orchestration, personnel, security technology, and business processes are deeply integrated, and the workflow for handling security events is constructed in series and parallel through Playbook scripts, which automatically triggers different security devices to perform response actions. Based on a more comprehensive and end-to-end understanding of the security event context, it helps to convert complex event response processes and tasks into consistent, repeatable, measurable and effective workflows, and change passive emergency response to automated continuous response. The automated handling method can be divided into the following steps: (1) Alarm prediction. Alarm prediction is a process-based, continuous investigation, analysis, and response handling tracking and recording method that is applicable to a group of related behavioral events. By monitoring the log events of devices such as hosts, network devices, security devices, and business applications, attacks are identified and predicted. The case process processing function is used, and the prediction engine is combined to identify case tags and assign cases of different nature to different Playbook scripts. Different handling results are recorded and returned to the event analysis. For the same rule, the same type of behavior events that occur successively are aggregated under the same rule. The types of rules include but are not limited to intrusion, denial of service, illegal external connection, USB flash drive insertion, high-risk port access, malicious code, etc. This approach is conducive to calling the same Playbooks in a labeled manner for serialized response and execution. At the same time, the security performance of the response to the same event type is measured to determine the execution efficiency and accuracy, and the execution strategy is uniformly adjusted. (2) Script management. A Playbook is a "script" that records the workflow of a security engineer. In terms of response and handling, the script is created and saved through visual arrangement and referenced by the rules. Common scripts include forensics, global blocking, host isolation, work orders, email alerts, etc. The script is triggered when the conditions are met, and the response device is called to execute the response action. In the Soar engine, some triggering scripts are received and handled, and different Playbooks are assigned to cases of different natures. The Playbook is then modified and managed through custom rules and built-in rules.

[0125] (3) Security disposal. The automatically orchestrated ban is achieved by the device executing the response disposal action. The Playbook triggers different devices to execute the disposal action, and the response device is linked to respond with one click. The response devices include encryption devices, isolation devices, monitoring equipment and network devices. The response devices connected to the system can realize flexible device management functions, such as adding, editing, enabling and disabling. With the help of the response devices, the blocking tasks such as threat interception, blocking of suspicious access sources, isolation of compromised hosts, elimination of threats and reinforcement of uncompromised hosts can be completed.

[0126] (4) Work order notification. For response actions that are currently unsupported or require human intervention, such as patching vulnerabilities and cleaning virus files on terminals, these actions can be pushed to the responsible person via a work order. After receiving the work order, the responsible person will take action. Email alerts include notifications of important event generation and notifications of automated response and disposal results.

[0127] Example 2

[0128] FIG10 is a flow chart of an active defense method for unknown threats provided in Example 2 of the present application. The method can be applied to an active defense system for unknown threats. As shown in FIG10 , the method includes:

[0129] S1. Through the intelligent threat warning module, threat prediction is performed on the power grid status data set collected in real time from the power information network to obtain threat warning information, and the threat warning information is sent to the unknown threat detection module.

[0130] S2. When receiving threat warning information, the unknown threat detection module performs threat detection and analysis based on the collected unknown threat network data, generates a threat analysis report, and sends the threat analysis report to the adaptive defense disposal module.

[0131] S3. Through the adaptive defense disposal module, trigger the defense disposal operation corresponding to the preset threat defense strategy according to the threat analysis report.

[0132] The technical solution of the embodiment of the present application uses an intelligent threat warning module to perform threat prediction on the power grid status data set collected in real time from the power information network to obtain threat warning information, and send the threat warning information to the unknown threat detection module; when the threat warning information is received, the unknown threat detection module performs threat detection and analysis based on the collected unknown threat network data, generates a threat analysis report, and sends the threat analysis report to the adaptive defense disposal module; through the adaptive defense disposal module, triggers the defense disposal operation corresponding to the preset threat defense strategy according to the threat analysis report, forming a more refined and adaptive security protection system, improving the monitoring and warning capabilities of system security incidents, and improving the overall power network defense level.

[0133] Optionally, S1, performing threat prediction on a power grid status data set collected in real time from a power information network to obtain threat warning information, includes:

[0134] Step 1.1: Predict a multi-source power grid situation data set collected from the power information network by using a pre-trained situation prediction model to obtain a situation prediction result, and generate first threat warning information based on the situation prediction result.

[0135] Step 1.2: Process the collected device log data through a pre-trained data mining model and feature extraction model to obtain a threat prediction result, and generate a second threat warning information based on the threat prediction result.

[0136] Step 1.3: Obtain threat intelligence data of threatened nodes in the electric power information network through the alliance chain, and determine third threat warning information based on the threat intelligence data.

[0137] Step 1.4: Generate joint warning information based on the first threat warning information, the second threat warning information, and the third threat warning information, and send the joint warning information to the unknown threat detection module.

[0138] Step 1.1: The process of obtaining the situation prediction results by pre-training a complete situation prediction model and predicting the collected multi-source power grid situation data set includes:

[0139] Step 1.1.1: Collect historical multi-source power grid status data sets and perform preprocessing operations on the historical multi-source power grid status data sets. The preprocessing operations may include: multi-source data smoothing, multi-source data scaling, multi-source data generalization, and heterogeneous data integration.

[0140] Step 1.1.2: Use the sliding average method to smooth the multi-source data from the collected historical power grid status dataset. This involves averaging the 2n+1 observations before and after the current data and using this average as a proxy for the current data. This smoothing process eliminates data that deviates significantly from the majority of the data. Multi-source data smoothing eliminates irrelevant and noisy data from the multi-source power grid status dataset.

[0141] Step 1.1.3: Use the following formula to scale the multi-source data for the obtained power grid status dataset. This step processes the same attribute value within a large range to make it fall into a specific, smaller range.

[0142] Step 1.1.4: For the obtained power grid situation dataset, perform the following steps to generalize the data: ① Input a data table of attribute data; ② Set the generalization parameter ω; ③ Calculate the privacy protection threshold T of the data table; ④ Enumerate all the strategies in the data table, and directly filter out the strategies with strategy values ​​greater than the threshold T during the strategy enumeration to generate the strategy space of the remaining strategies; ⑤ For the generated strategy space, filter it through the ω-approximate skyline to obtain the candidate strategy space; ⑥ Execute the skyline of the candidate strategy space to obtain the recommended strategy set; ⑦ Output the recommended strategy set and its corresponding generalization.

[0143] Step 1.1.5: Perform heterogeneous data integration on the text data, Extensible Markup Language (XML) data, Character Separated Values ​​(CSV) data, and distributed storage system (Hadoop Database, Hbase) data in the obtained power grid status dataset.

[0144] Step 1.1.6: Use the obtained power grid status dataset as the initial training sample set. Use a sliding window to construct the initial training sample set so that the discrete multi-source power grid status dataset becomes linearly correlated.

[0145] Step 1.1.7: Use the prediction results from each training session as a training sample set, thereby obtaining multiple training sample sets. A situation prediction model is constructed using the bagging method. This model consists of five parallel v-SVM sub-models. This model can be used to predict power grid situation.

[0146] Step 1.2: Process the collected device log data using a pre-trained data mining model and feature extraction model to obtain threat prediction results. Generate second threat warning information based on the threat prediction results, including:

[0147] Step 1.2.1: Select host devices, network devices, and security devices for log data collection. Taking the Intrusion Prevention System (IPS) alarm log as an example, the IPS alarm log content format requirements are shown in Tables 1 and 2.

[0148] Table 1

[0149] Table 2

[0150] Example of the transmission log format: Device manufacturer|*Device type|*Log type|*Device Internet Protocol version 4 (IPV4)|*Device Internet Protocol version 6 (IPV6)|*Alarm level|*Standard category|*Alarm name|*Alarm time|*Source IP|*Source port|*Destination IP|*Destination port|*Transport protocol|*Number of alarms|*Policy action|*Enable IP blocking|*Hypertext Transfer Protocol (HTTP) request method|*Domain name|*Access path|*HTTP request or response information|*Network traffic packet|*Alarm additional information 1|*Alarm additional information 2|*Alarm additional information 3|*Alarm additional information 4|*Alarm additional information 5.

[0151] Step 1.2.2: For the log data collected in step 1.2.1, delete the data columns that are not related to the threat prediction task and the entries with a large number of missing items to complete the data cleaning work.

[0152] Step 1.2.3: For the log data obtained in step 1.2.2, for the entries that are only missing quantity items, use methods such as nearest filling to complete the data.

[0153] Step 1.2.4: For the log data obtained in step 1.2.3, use Word2Vec and Doc2Vec methods to convert non-numeric string data into vectors. For discrete data, use one-hot encoding to convert it into a continuous, multi-dimensional vector.

[0154] Step 1.2.5: Based on the log data obtained in Step 1.2.4, select the LightGBM method to train a data mining model based on machine learning. The key training parameters are shown in Table 3. After ten-fold cross-validation, select and save the model with the optimal parameters to obtain the data mining model based on machine learning.

[0155] Table 3

[0156] Step 1.2.6: Based on the log data obtained in step 1.2.4, select a deep neural network (DNN) for training. During training, use multi-batch gradient descent for convergence optimization. After ten-fold cross-validation, select and save the optimal parameter model to obtain the deep learning-based feature extraction model.

[0157] Step 1.3: obtaining threat intelligence data of the threatened nodes in the power information network through the alliance chain, and determining third threat warning information based on the threat intelligence data, including:

[0158] Step 1.3.1: The power system terminals in each region of the State Grid join the blockchain network through elections to establish an intelligence-sharing blockchain network. Each power system terminal acts as a node in the network, responsible for maintaining the blockchain ledger and handling the sharing of threat intelligence by setting up an achievable consensus mechanism and pre-deployed programs.

[0159] Step 1.3.2: When a power system is attacked, it can act as an intelligence contributor, encapsulating information such as the attack method and type into multiple pieces of intelligence (referred to as intelligence Info), which are then stored both on-chain and off-chain. On-chain storage involves initiating a transaction to upload the intelligence Info to the blockchain network.

[0160] Step 1.3.3: After receiving the request, the endorsing node first reads the blockchain ledger locally, signs the read blockchain state and the blockchain state after the transaction is added, and returns the signature to the power system that initiated the request.

[0161] Step 1.3.4: After receiving the signature, the power system that requested to upload the intelligence will package the data and send it to the organization node in the blockchain network to form a unified transaction pool and verify whether the transaction meets the consensus protocol.

[0162] Step 1.3.5: Transactions that pass the consensus protocol are packaged into the same block (denoted as Block). Other power system nodes participating in the consensus can now act as information acquirers, obtaining the Block containing the threat intelligence Info through the blockchain network. They verify the accuracy and legitimacy of the transaction information in the Block. After verification, the Block is added to the end of the blockchain and the ledger status is updated to achieve the purpose of threat warning and proactive defense.

[0163] Based on the power grid situation data, training is carried out to establish a threat warning module based on power terminal situation awareness, and this module is recorded as M1; based on the power grid equipment log data, training is carried out to establish an early warning module based on the big data prediction model integrated with business characteristics, and this module is recorded as M2; a client application for intelligence sharing built based on the blockchain method is installed, and this application is recorded as M3.

[0164] At each time interval, T1, grid status data is collected and input into M1, generating a grid status prediction value, R1. At each time interval, T2, grid device log data is collected and input into M2, generating a predicted number of security events, R2. At each time interval, T3, the amount of threat intelligence shared by other grid nodes in M3 during that time interval is checked, recording this amount as R3.

[0165] Step 1.4, generating joint warning information based on the first threat warning information, the second threat warning information, and the third threat warning information, and sending the joint warning information to the unknown threat detection module, includes:

[0166] Comprehensively evaluate R1, R2, and R3. The evaluation formula is: Re=(R1≤r)||(R2≥1)||(R3≥1);

[0167] Where r is the preset grid status threshold, and Re is the final Boolean evaluation result. When Re is False, the joint warning unit assumes there is no threat. When Re is True, the joint warning unit considers a threat possible, generates a joint warning message, and transmits it to the unknown threat detection module and the adaptive defense and disposal module for preventive measures.

[0168] Optionally, S2: upon receiving the threat warning information, performing threat detection and analysis based on the collected unknown threat network data to generate a threat analysis report, including:

[0169] Step 2.1: Perform threat detection on the collected first unknown threat network data to obtain a first threat detection result; the first unknown threat network data includes: malicious traffic data of encrypted communication, encrypted attack behavior or malicious application.

[0170] Step 2.2: Perform threat analysis on the collected second unknown threat network data according to the threat event detection rule based on the complex time processing framework to obtain a second threat detection result; the second unknown threat network data includes log data of the threatened device.

[0171] Step 2.3: Perform deep learning on the first threat detection result and the second threat detection result to obtain a threat analysis report.

[0172] Taking a data security threat detection scenario in an actual business as an example, step 2.1 performs threat detection on the collected first unknown threat network data to obtain a first threat detection result, including:

[0173] Step 2.1.1: Use tcpdump to capture and save network packets on the power grid, and define them as {x1, x2, ..., x n}.

[0174] Step 2.1.2: Then use Wireshark to analyze the captured data packets on the power grid and define them as

[0175] Step 2.1.3: Use the CNN model to train a classifier to classify traffic behavior. The backbone of this classifier is ResNet-50, and we call this classifier F. For any input x entering F, it outputs a corresponding label y and a confidence score c. By comparing the confidence score c with the set threshold λ, we determine whether the input x is abnormal, that is, whether the input x is abnormal traffic that poses a threat. When the confidence score c is less than the threshold λ, x is abnormal. Alternatively, when the model outputs relatively concentrated probabilities during the prediction process and the confidence score c is high, x is normal; when the model outputs relatively even probabilities and the confidence score c is low, x is abnormal.

[0176] Step 2.1.4: During the model evaluation and iteration phase, define a confusion matrix that divides the data into four scenarios: anomaly detected, anomaly not detected, normal data considered anomaly, and normal data not considered anomaly. For each scenario, define a cost value to assess the severity of the misjudgment.

[0177] Through the above operations, an abnormal threat in encrypted traffic has been successfully detected. Abnormal traffic may manifest as unknown protocols, unusual packet sizes or frequencies, or large influxes of traffic. A complete report should be submitted, providing as much detailed information as possible, including time, location, and scope of impact. After the report is completed, re-encrypt the data.

[0178] Step 2.2, performing threat analysis on the collected second unknown threat network data according to the threat event detection rule based on the complex time processing framework to obtain a second threat detection result, including:

[0179] Step 2.2.1: The attacker attempted to log in to a specific user's management and collaboration software, email, etc. using multiple known accounts and common passwords (User and Entity Behavior Analytics (UEBA) anomaly - logging into multiple different accounts from a single device). The attacker then browsed and downloaded sensitive information (downloaded a large number of files in a short period of time), such as server passwords and sensitive files, and subsequently compromised a number of servers, resulting in a serious data breach. This scenario involves three types of logs: login authentication, web access, and file transfer. Analysis shows that the logs in this scenario have the following characteristics:

[0180] Login authentication log: Authentication suddenly succeeded after multiple failures.

[0181] Web access logs: A device suddenly logs into multiple different accounts, deviating from its usual behavior.

[0182] File transfer log: Downloading a large number of files in a short period of time.

[0183] Step 2.2.2: Define the event detection logic using the EPL. The EPL is then loaded into the CEP rule engine. By parsing and verifying the EPL and other processes, a physical execution flow chart is generated and distributed to the worker nodes in the cluster. The worker nodes then begin executing the event detection rules. Generally, most CEP engines provide a state machine solution that performs pattern matching on real-time log streams according to event detection rules. The execution process of the finite state machine during the execution of the security event detection rules is shown in Figure 11.

[0184] The CEP rule engine continuously monitors the login authentication logs from the first step. If it detects a sudden successful login after multiple failed authentications, it identifies this as an anomaly and caches the anomalous login authentication logs, denoting them as Set A. Simultaneously, the source and destination IP addresses of the logs in Set A are monitored in real time. If a web access log contains a large number of different accounts logged in within a short period of time, and the number of logged-in accounts exceeds the normal baseline (or threshold), this is considered an anomalous web access log Set B. This yields two log sets, A and B, and the set resulting from correlating the elements in Sets A and B by source and destination IP addresses is denoted as the [A&B] pattern sequence.

[0185] Similarly, if the destination IP address in set A of the [A&B] pattern sequence continuously monitors whether there are file transfer logs matching the associated conditions, and if a large number of file transfers occur within a period of time after a successful login, set C is obtained, and ultimately the [A&B->C] pattern sequence is obtained. If the pattern sequence [A&B->C] is not empty, it indicates that the log has triggered the event detection rule, and the final data leakage alarm event after the successful account cracking is generated.

[0186] Figure 12 is a diagram of a threat chain structure based on abnormal behavior association provided by Example 2 of this application. As shown in Figure 12, step 2.3, deep learning is performed on the first threat detection result and the second threat detection result to obtain a threat analysis report, including:

[0187] Step 2.3.1: Combine the first threat detection result outputted in step 2.1.4 and the second threat detection result outputted in step 2.2.2 into an original alarm.

[0188] Step 2.3.2: Extract the alarm slice type, alarm service type, attack type, alarm start time, alarm end time, alarm type, source address, destination address, source port, destination port and other data from the original alarm, and deduplicate the original alarm while retaining the time information to obtain the alarm information.

[0189] Step 2.3.3: Structure the alert information into several tree diagrams. Use a breadth-based search method to traverse the current tree diagram layer by layer. Each layer of traversal starts from the result of the previous layer and traverses all nodes that can be reached within a certain distance. If there is redundancy in the alert information, using breadth-based search can find and remove duplicate alert information layer by layer. This allows the overall structure of the tree diagram to be obtained based on the breadth-based search traversal, and the threat structure chain can be constructed.

[0190] Step 2.3.4: Prune the threat structure chain based on negative causal rules to obtain a threat analysis report containing threat structure and threat categories.

[0191] Optionally, S130, triggering a defense handling operation corresponding to the updated preset threat defense strategy according to the threat analysis report, includes:

[0192] Step 3.1: Determine association information between device nodes and links based on the constructed network topology model, and update the threat defense strategy based on the association information; trigger a disposal operation corresponding to the updated threat defense strategy based on the threat analysis report.

[0193] Step 3.2: According to the threat analysis report and the pre-built threat event workflow, trigger the security device to perform a disposal operation.

[0194] Step 3.1 determines the association information between device nodes and links based on the constructed network topology model, and updates the threat defense strategy based on the association information, including:

[0195] Step 3.1.1: Read device information using the Simple Network Management Protocol (SNMP) and analyze the management information bases of multiple devices to determine the physical connection relationships between network elements. Then, automatically construct a logical topology model that reflects network security threats and network attack and defense status.

[0196] Step 3.1.2: Use the clustering coefficient to characterize the network's clustering characteristics, thereby determining the degree of association between network nodes and links. This association is then updated into the linkage condition set in the intelligent linkage policy library. When the network topology changes, association analysis can identify which existing linkage policies are affected and which ones need to be added or removed, enabling real-time updates of linkage policies.

[0197] Step 3.1.3: Build and update the network topology model. Analyzing network topology associations is done to design a coordinated network security defense strategy, update the policy library, generate specific security rules, and publish these rules based on the policy information in the policy library. This enables the linkage between security devices and network security rules.

[0198] Step 3.2: Based on the threat analysis report and pre-built threat event workflow, trigger the security device to perform disposal operations, including:

[0199] Step 3.2.1: Process the alarm information in the intelligent threat warning module and the threat categories in the unknown threat detection module, and perform alarm prediction. Combined with the prediction engine to identify case labels, assign cases of different natures to different Playbook scripts.

[0200] Step 3.2.2: The script is triggered when the conditions are met, and the response device is called to perform the response action.

[0201] Step 3.2.3: Use Playbook to trigger different devices to perform disposal actions, and link response devices to respond with one click. Response devices connected to the system can realize flexible device management functions.

[0202] Step 3.2.4: For response actions that are currently not supported or require manual participation, such as patching vulnerabilities and cleaning virus files on the terminal, they can be pushed to the responsible person via a work order. After receiving the work order, the responsible person will take relevant measures.

Claims

1. An active defense system for unknown threats, applied to a power information network, comprising: Intelligent threat warning module, unknown threat detection module and adaptive defense disposal module; The intelligent threat warning module is configured to perform threat prediction on the power grid situation data set collected in real time from the power information network to obtain threat warning information, and send the threat warning information to the unknown threat detection module; The unknown threat detection module is configured to perform threat detection and analysis on the collected unknown threat network data upon receiving the threat warning information, generate a threat analysis report, and send the threat analysis report to the adaptive defense disposal module; The adaptive defense handling module is configured to trigger a defense handling operation corresponding to a preset threat defense strategy according to the threat analysis report.

2. The system according to claim 1, wherein: The intelligent threat warning module includes: a warning unit based on situational awareness prediction, a warning unit based on big data prediction, a warning unit based on alliance chain intelligence sharing, and a joint warning unit; The early warning unit based on situation awareness prediction is configured to predict the collected multi-source power grid situation data set through a pre-trained complete situation prediction model to obtain a situation prediction result, and generate the first threat early warning information according to the situation prediction result; The early warning unit based on big data prediction is configured to process the collected log data of the device through a pre-trained data mining model and a feature extraction model to obtain a threat prediction result, and generate second threat early warning information according to the threat prediction result; The early warning unit based on alliance chain intelligence sharing is configured to obtain threat intelligence data of threatened nodes in the power information network through the alliance chain, and determine third threat early warning information according to the threat intelligence data; The joint warning unit is configured to generate joint warning information according to the first threat warning information, the second threat warning information and the third threat warning information, and send the joint warning information to the unknown threat detection module.

3. The system according to claim 2, wherein: The early warning unit based on situation awareness prediction includes: a multi-source power grid situation data processing subunit, a situation prediction subunit and a threat early warning subunit; The multi-source power grid situation data processing subunit is configured to collect multi-source power grid situation data, perform data conversion and data preprocessing on the multi-source power grid situation data, and obtain a multi-source power grid situation data set; The situation prediction subunit is configured to input the multi-source power grid situation data set into a pre-trained situation prediction model to obtain a situation prediction result; The threat warning subunit is configured to compare the situation prediction result with the situation critical value, according to The comparison result generates first threat warning information.

4. The system according to claim 1, wherein: The unknown threat detection module includes: a threat detection unit based on encrypted traffic, a threat detection unit based on a complex event processing framework, and a threat analysis unit based on behavioral deep learning; The encrypted traffic-based threat detection unit is configured to perform threat detection on the collected first unknown threat network data to obtain a first threat detection result; the first unknown threat network data includes: malicious traffic data of encrypted communication, encrypted attack behavior or malicious application; The threat detection unit based on the complex event processing framework is configured to perform threat analysis on the collected second unknown threat network data according to the threat event detection rule based on the complex time processing framework to obtain a second threat detection result; the second unknown threat network data includes log data of the threatened device; The threat analysis unit based on behavior deep learning is configured to perform deep learning on the first threat detection result and the second threat detection result to obtain a threat analysis report.

5. The system according to claim 4, wherein: The threat analysis unit based on behavior deep learning includes: an alarm log generation subunit, a deconstruction subunit and an analysis subunit; The alarm log generating subunit is configured to generate alarm information according to the first threat detection result and the second threat detection result, generate an alarm log according to the alarm information, and input the alarm log into the deconstructing subunit; The deconstruction subunit is configured to form a threat chain according to the alarm log; The analysis subunit is configured to perform negative causal association pruning and non-secondary event noise reduction on the threat chain to form a threat analysis report.

6. The system according to claim 1, wherein: The adaptive defense disposal module includes: an adaptive equipment linkage unit and an automated disposal unit; The adaptive device linkage unit is configured to determine association information between device nodes and links according to the constructed network topology model, update the threat defense strategy according to the association information; and trigger a disposal operation corresponding to the updated threat defense strategy according to the threat analysis report; The automated handling unit is configured to trigger the security device to perform a handling operation according to the threat analysis report and a pre-built threat event workflow.

7. An active defense method for unknown threats, including: Through the intelligent threat warning module, threat prediction is performed on the power grid situation data set collected in real time from the power information network to obtain threat warning information, and the threat warning information is sent to the unknown threat detection module; Through the unknown threat detection module, when the threat warning information is received, threat detection and analysis are performed based on the collected unknown threat network data to generate a threat analysis report; and sending the threat analysis report to the adaptive defense processing module; Through the adaptive defense handling module, a defense handling operation corresponding to a preset threat defense strategy is triggered according to the threat analysis report.

8. The method according to claim 7, wherein: The threat prediction of the power grid situation data set collected in real time from the power information network to obtain threat warning information includes: By pre-training a complete situation prediction model, the collected multi-source power grid situation data set is predicted to obtain a situation prediction result, and the first threat warning information is generated according to the situation prediction result; The collected log data of the device is processed by pre-trained data mining models and feature extraction models to obtain threat prediction results, and the second threat warning information is generated according to the threat prediction results; Acquire threat intelligence data of threatened nodes in the electric power information network through the alliance chain, and determine third threat warning information according to the threat intelligence data; Generate joint warning information according to the first threat warning information, the second threat warning information and the third threat warning information, and send the joint warning information to the unknown threat detection module.

9. The method according to claim 7, wherein: When the threat warning information is received, a threat analysis is performed based on the unknown threat network data to generate a threat analysis report, including: Performing threat detection on the collected first unknown threat network data to obtain a first threat detection result; the first unknown threat network data includes: malicious traffic data of encrypted communication, encrypted attack behavior or malicious application; Performing threat analysis on the collected second unknown threat network data according to the threat event detection rule based on the complex time processing framework to obtain a second threat detection result; the second unknown threat network data includes log data of the threatened device; Deep learning is performed on the first threat detection result and the second threat detection result to obtain a threat analysis report.

10. The method according to claim 7, wherein: Triggering a defense disposal operation corresponding to a preset threat defense strategy according to the threat analysis report includes: Determine association information between device nodes and links according to the constructed network topology model, and update the threat defense strategy according to the association information; trigger a disposal operation corresponding to the updated threat defense strategy according to the threat analysis report; According to the threat analysis report and the pre-built threat event workflow, the security device is triggered to perform a disposal operation.

Images