A method and system for analyzing security risk status of the perception layer of power Internet of Things

Abstract

A method for analyzing the security risk status of the perception layer of the electric power Internet of Things, characterized in that the method comprises the following steps: Step 1, collecting and storing relevant information of all terminal devices in the perception layer of the electric power Internet of Things; Step 2, obtaining multiple device status type tags based on the relevant information, and determining the security risk of the terminal device; Step 3, obtaining the network traffic anomaly and network access abnormal behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; Step 4, using a visualization method to classify and display the device status type information, security risk information, network traffic anomaly information and network access abnormal behavior information obtained in Step 2 and Step 3. The analysis results of the method of the present invention are comprehensive and accurate, the analysis process is intelligent and fast, and it also has a good visualization effect, thereby improving the security level of the system.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things, and more specifically, to a method and system for analyzing security risk status of a perception layer of an electric power Internet of Things. Background Art

[0002] The Internet of Things is based on the Internet, using radio frequency identification, QR codes, infrared sensors, GPS and other devices, through wireless data communication and other means to achieve mutual connection of devices, and access to the Internet in a certain way, and finally construct an intelligent network covering everything. The power Internet of Things is the specific manifestation and application of the Internet of Things in the power industry. By connecting power users and their equipment, power grid companies and their equipment, power generation companies and their equipment, suppliers and their equipment, it generates shared data, thereby serving users, power grids, power plants, suppliers and government society. Therefore, the power Internet of Things can use the power grid as a hub, play a platform and sharing role, create greater opportunities for the development of the entire industry and more market players, and provide more valuable services.

[0003] Generally speaking, the power Internet of Things includes a four-layer structure: perception layer, network layer, platform layer, and application layer. The perception layer is the bottom layer of the power Internet of Things and is composed of the infrastructure that supports the power Internet of Things. Since the perception layer involves on-site collection equipment, smart terminals, local communication access, and edge IoT agents, it has the characteristics of diverse terminal types and wide distribution range.

[0004] However, in the existing technology, the perception layer of the power Internet of Things still faces many security risks. First, embedded systems are prone to risks. On the one hand, the existence of complex factors such as system tailoring, application customization, difficulty in online upgrades, and proprietary communication protocols makes most perception devices have a large number of security risks and security vulnerabilities. On the other hand, due to limited software and hardware computing resources, in order to ensure real-time performance and availability, the power Internet of Things system often fails to consider information security requirements too much in the early stages of design, which makes most of the distribution network terminals currently in service and on sale in an unprotected state.

[0005] Secondly, the terminal equipment of the power Internet of Things is not very secure. Manufacturers of power Internet of Things equipment are less aware of the risks, and many terminal equipment manufacturers lack security awareness and security capabilities, which makes them insufficiently consider security during the design and development of terminal software and hardware, resulting in some terminals without message authentication and integrity identification mechanisms. This makes it impossible for terminal devices to determine whether business instructions are forged or maliciously tampered with. Therefore, attackers may cause equipment to malfunction through illegal instructions, and attackers can illegally use or destroy smart terminals without authorization, thereby reducing the security of the perception layer.

[0006] Third, there are risks in the physical environment of the power Internet of Things. The Internet of Things devices in the power Internet of Things are usually deployed in multiple power grid links such as transmission, distribution, and use. These smart terminals or devices usually exist in unattended or unsafe and uncontrollable environments, which makes it easy for attackers to directly access the devices to carry out physical damage, or to forge them by cloning them, or to steal information, tamper with software, and remotely control them through various means such as short-range or long-range, thus reducing the security of the perception layer of the Internet of Things.

[0007] Therefore, there is an urgent need for a method and system for analyzing the security risk status of the perception layer of the power Internet of Things, which can analyze and monitor the anomalies of the perception layer of the power Internet of Things, promptly discover and eliminate abnormal activities of terminal devices, and reduce the security risks of the perception layer. Summary of the invention

[0008] In order to solve the deficiencies in the prior art, the purpose of the present invention is to provide a new method and system for analyzing the security risk status of the perception layer of the power Internet of Things, which determines the device status type by collecting various relevant information of the terminal device, and identifies the security risks of the terminal device based on different types, as well as identifies the terminal's traffic anomalies and network access anomalies through network-related feature models, thereby providing a visual alarm service.

[0009] The present invention adopts the following technical solution.

[0010] The first aspect of the present invention relates to a method for analyzing the security risk status of the perception layer of the electric power Internet of Things, wherein the method comprises the following steps: Step 1, collecting and storing relevant information of all terminal devices in the perception layer of the electric power Internet of Things; Step 2, obtaining multiple device status type labels based on the relevant information, and determining the security risk of the terminal device; Step 3, obtaining the network traffic anomaly and network access anomaly of the terminal device based on a pre-generated network traffic feature model and a network access behavior feature model; Step 4, using a visualization method to classify and display the device status type information, security risk information, network traffic anomaly information and network access anomaly behavior information obtained in Steps 2 and 3.

[0011] Preferably, the relevant information includes deterministic information and network traffic information; the deterministic information includes the unique device identification number, device manufacturer, device type, device model, software and hardware version information, service type, open service port and MAC address of the surviving device; the network traffic information includes characteristic information, and the characteristic information includes the protocol type, IP address, MAC address, port, and identification information of the traffic device.

[0012] Preferably, obtaining the device status type based on relevant information also includes: step 2.1, extracting characteristic information from the network traffic information and performing deduplication processing based on the terminal device; step 2.2, comparing and analyzing the deterministic information and the characteristic information, removing the characteristic information of the deterministic device, and thus obtaining non-deterministic information; step 2.3, judging the device status type based on the deterministic information and the non-deterministic information.

[0013] Preferably, step 2.3 also includes: step 2.3.1, pre-generating a device fingerprint library based on historically collected feature information, comparing the non-deterministic information with the device fingerprint in the device fingerprint library to obtain the device type and device model of the non-deterministic device corresponding to the non-deterministic information, and the similarity between the device fingerprint in the device fingerprint library; step 2.3.2, obtaining a deterministic device based on the deterministic information, comparing the deterministic information with the information in the registered device library to obtain registered deterministic devices and unregistered deterministic devices; step 2.3.3, comparing the non-deterministic information with the information in the registered device library to obtain registered non-deterministic devices and unregistered non-deterministic devices; step 2.3.4, obtaining the similarity calculated in step 2.3.1, when the similarity is greater than or equal to 70%, the device is identified as a counterfeit device, otherwise it is an illegal device.

[0014] Preferably, determining the security risk of the terminal device also includes: step 2.4, based on the similarity calculated in step 2.3, evaluating the risk coefficient of the counterfeit device and the risk coefficient of the illegal device; step 2.5, searching the vulnerability library based on the evaluation results, and marking the device security vulnerabilities.

[0015] Preferably, obtaining the network traffic anomaly of the terminal device also includes: step 3.1, classifying and counting the network traffic information, and identifying the traffic sequence therein; step 3.2, pre-generating a network traffic feature model based on historically obtained relevant information; step 3.3, inputting the identified traffic sequence into the network traffic feature model to obtain the network traffic anomaly of the terminal device.

[0016] Preferably, the network traffic feature model includes a traffic threshold model, a network link feature parameter model, and a sequence feature model.

[0017] Preferably, obtaining the abnormal network access behavior of the terminal device also includes: step 3.4, based on the historically collected network traffic information and the deterministic information, using a learning algorithm to pre-establish a network access behavior feature model; step 3.5, inputting the identified traffic sequence into the network access behavior feature model to obtain the abnormal network access behavior of the terminal device.

[0018] Preferably, step 4 also includes: storing the device status type, device risk factor, device security vulnerability, network traffic anomaly and network access abnormal behavior information in different data tables respectively; directly or indirectly reading and displaying the data in the data table based on a visualization method.

[0019] The second aspect of the present invention relates to a security risk status analysis system for the perception layer of an electric power Internet of Things as in the first aspect of the present invention, wherein the system includes a data acquisition module, a storage pool, a feature model library, a risk analysis module and a status display module; wherein the data acquisition module is used to collect relevant information of all terminal devices in the perception layer of the electric power Internet of Things and store the relevant information in the storage pool; the feature model library includes a registered device library, a network traffic feature model library and a network access behavior feature model library; the risk analysis module is used to obtain the device status type based on the relevant information, determine the security risk of the terminal device, and obtain the network traffic anomaly and network access abnormal behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; the status display module is used to classify and display the device status type information, security risk information, network traffic anomaly information and network access abnormal behavior information using a visualization method.

[0020] The beneficial effect of the present invention is that, compared with the prior art, the method and system for analyzing the security risk status of the perception layer of the electric power Internet of Things in the present invention can comprehensively analyze and determine the status type, security risk and network anomaly of the terminal device by collecting various types of information of the terminal device, and provide abnormal risk warnings through visualization methods. Since the method in the present invention adopts a detection method that combines certainty and uncertainty, the accuracy of the network security risk analysis of the perception layer of the electric power Internet of Things is enhanced, thereby avoiding the false alarm and missed alarm caused by the illegal replacement of the terminal device or prevention when the terminal device is in a temporary downtime or offline state. The analysis results of the method of the present invention are comprehensive and accurate, the analysis process is intelligent and fast, and it also has a good visualization effect, which improves the security level of the system.

[0021] The beneficial effects of the present invention also include:

[0022] 1. The present invention collects the status information data and network traffic data of the terminal devices in the perception layer of the power Internet of Things, and uses statistical analysis, feature models, black and white list behavior models, machine learning and other analysis methods from three aspects: the security risk status of the terminal devices, network traffic anomalies, and network access behavior anomalies. It comprehensively analyzes the security risks of the perception layer of the power Internet of Things, further enhances the intelligence and accuracy of the security risk analysis, and can significantly reduce the false alarm rate of security risk warnings.

[0023] 2. Collect the deterministic information and network traffic information of the terminal device, and obtain the non-deterministic information of the terminal device by comparing the two types of information, thereby effectively distinguishing the non-deterministic devices that may exist in the network. Through the method of the present invention, on the one hand, there is no need to perform additional analysis on the deterministic devices, thereby simplifying the data processing process; on the other hand, it is possible to perform additional data analysis processes for non-deterministic devices, thereby further accurately judging the risk factors and security vulnerabilities of non-deterministic devices. Therefore, the method of the present invention is compatible with the simplicity and effectiveness of the data processing process, with fast processing speed and good effect.

[0024] 3. The present invention further divides counterfeit devices and illegal devices from non-deterministic devices, and sets different risk coefficients based on different types of devices. Therefore, the method in the present invention can more accurately assess the security risks of the equipment, provide clearer reference suggestions for equipment managers, and help machine or operation and maintenance personnel to control equipment risks.

[0025] 4. The vulnerability library-based method is used to judge the security vulnerabilities of the equipment. The vulnerability library is easy to maintain and upgrade, and it is more convenient to discover the security risks of the equipment at any time. The feature model is used as the analysis method for network traffic anomalies and network access behavior anomalies. This feature model combines the traditional intrusion detection attack feature library, the industrial Internet of Things attack feature library, and the network traffic sequence features and network access behavior white model library established for the business types unique to the perception layer subnet of the power Internet of Things, thereby improving the accuracy of traffic anomaly and behavior anomaly analysis.

[0026] 5. Use database methods to store data processing results, and use visual methods to classify and display information related to security risks in layers, making the processing results more intuitive and easy to understand.

[0027] 6. In the present invention, although the collected initial data is large in content and of many types, after the initial data is processed by methods such as deduplication, it can meet the requirements of periodic repeated cycle detection. Therefore, the security risk status analysis method in the present invention can dynamically and real-time obtain the security status of each device in the system, making dynamic analysis and monitoring possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A schematic diagram of the steps in a method for analyzing the security risk status of a perception layer of an electric power Internet of Things according to the present invention;

[0029] Figure 2 The present invention is a schematic diagram of the implementation process of a method for analyzing security risk status of the perception layer of the power Internet of Things. DETAILED DESCRIPTION

[0030] The present application is further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present application.

[0031] The terminal devices included in the perception layer of the power Internet of Things used in the present invention are various. For example, the terminal devices include charging POS (Point Of Sale), ATM (Automatic Teller Machine), power transmission status monitoring terminal, substation status monitoring terminal, power consumption information collection terminal, video terminal, smart meter, Internet of Things security access control terminal, RTU (Remote Terminal Unit) and FTU (Feeder Terminal Unit), etc. These devices usually realize connection with the Internet of Things platform and data transmission through the core switch located in the perception layer.

[0032] Figure 1 This is a schematic diagram of the steps in the method for analyzing the security risk status of the perception layer of the power Internet of Things of the present invention. Figure 1 As shown, a method for analyzing the security risk status of the perception layer of the power Internet of Things, wherein the method includes steps 1 to 4.

[0033] Step 1: Collect and store relevant information of all terminal devices in the power Internet of Things perception layer.

[0034] Preferably, the relevant information includes deterministic information and network traffic information.

[0035] Specifically, in the perception layer network of the power Internet of Things, the Internet of Things platform can use the HTTP protocol to send data collection requests to terminal devices through network communication. At this time, after receiving the request, the terminal device that survives in the perception layer network will return the device's own deterministic information to the Internet of Things platform based on the data collection request. Usually, this type of information is returned in the form of an HTML page, which includes the device's unique identification number, device manufacturer, etc. in the deterministic information. In another case, if the device cannot provide the device's own deterministic information as required by the data collection request, it returns empty information, that is, a NULL value, or does not respond to the collection request. The deterministic information collected in this way can be stored as data in the surviving device's deterministic information library.

[0036] Preferably, the deterministic information includes the unique device identification number, device manufacturer, device type, device model, software and hardware version information, service type, open service port and MAC address of the surviving device.

[0037] In addition, if a physical switch is added to the perception layer network and the physical switch is connected to the mirror port of the core switch in the perception layer network, the network traffic data of the perception layer can be collected by mirroring through bypass deployment. The collection of network traffic data achieved through this deployment method will not cause any interference to the normal communication of the perception network, and there is no need to change the original network architecture. The network traffic information collected in this way can be stored as data in the network traffic library.

[0038] In one embodiment of the present invention, since the amount of network traffic data is very large, it can be stored in the form of several traffic package files.

[0039] In order to implement the analysis method in the present invention, a large amount of historical data may be needed, and sometimes the collected relevant data may need to be temporarily cached. Therefore, a storage pool can be set up in the present invention to store relevant data. In the present invention, since the relevant information mainly includes two categories: deterministic information and network traffic information, the storage pool also correspondingly includes two databases: a surviving device determination information library and a network traffic library. With the optimization or improvement of the method in the present invention, other types of databases can also be stored in the storage pool. The storage pool can use the relational database MYSQL in the prior art to store different data.

[0040] Step 2: Obtain multiple device status type tags based on relevant information and determine the security risk of the terminal device.

[0041] The multiple device status type labels described in the present invention are generated based on the classification of devices and according to the device types. In the present invention, the device status type labels include deterministic device labels, non-deterministic device labels, registered device labels, unregistered device labels, illegal device labels, and counterfeit device labels. Since there are multiple classification methods and there is no absolute conflict between them, multiple labels can be assigned to each device at the same time.

[0042] According to the two types of data collected in two completely different ways in step 1 of the present invention, the present invention can compare and analyze the two types of data and extract non-deterministic information from the network traffic information. According to the deterministic information, non-deterministic information, and other pre-generated data information, the state type of the device can be determined, and the security risk of the device can be obtained according to the different types of devices.

[0043] Figure 2 The following is a schematic diagram of the implementation process of a method for analyzing the security risk status of the perception layer of the power Internet of Things in the present invention. Figure 2As shown, preferably, obtaining the device status type based on relevant information also includes: step 2.1, extracting characteristic information from the network traffic information and performing deduplication processing based on the terminal device; step 2.2, comparing and analyzing the deterministic information and the characteristic information, removing the characteristic information of the deterministic device, and thus obtaining the non-deterministic information; step 2.3, judging the device status type based on the deterministic information and the non-deterministic information.

[0044] In one embodiment of the present invention, all terminal devices legally connected to the perception layer network of the power Internet of Things should be registered in the registered device library. When the device in the present invention is in a survival state, that is, the device is online, and can return the deterministic information of the device in real time to the device deterministic information collection request issued using the HTTP protocol, the device deterministic information is collected and stored in the survival device deterministic information library, and the device can be called a deterministic device. On the contrary, other devices that are in a survival state but cannot return deterministic information should be non-deterministic devices.

[0045] Specifically, when a device is online but does not comply with the deterministic information collection specifications and cannot return the device's deterministic information in real time to a device deterministic information collection request issued using the HTTP protocol, the device's characteristic information, that is, non-deterministic information, needs to be obtained through analysis of the device's real-time network traffic. In other words, non-deterministic information can be obtained by comparing the characteristic information and deterministic information.

[0046] In one embodiment of the present invention, after a deterministic device is identified, the legitimacy of the device needs to be further determined by comparing it with a registered device library. For example, the characteristic information of the device can be identified, the device type and model information can be extracted, and the registered device library can be further compared to determine whether the device has executed the registration procedure. For offline devices existing in the perception layer network, the characteristic information of these offline devices can be obtained by analyzing the historical network traffic within a specified time period, and the device type and model can be identified through the characteristic information of the device and further compared with the registered device library to determine whether the device is registered. In other words, some deterministic devices may be unregistered devices that have not yet been registered. And some offline devices that are neither deterministic devices nor non-deterministic devices may also be registered devices. In addition, the specified time period refers to a historical time period within 12 hours, 1 day, etc. specified according to the network management policy.

[0047] There may be some terminal devices connected without registration in the perception layer network of the power Internet of Things. These devices are generally called unregistered devices. Specifically, among the unregistered devices, some deterministic devices that can return deterministic information according to the specifications may be included. In addition, other unregistered devices include illegal devices and counterfeit devices.

[0048] Illegal devices refer to some devices that are connected without registration and can communicate with other devices in the perception layer of the power Internet of Things. It is understandable that unregistered deterministic devices, although they can return deterministic information after receiving information collection requests from the perception layer network, cannot achieve regular communication with other devices in an unregistered state. Therefore, these unregistered devices that can achieve communication connections can be considered illegal devices.

[0049] In addition, for some illegal devices, the characteristic information used in the process of network communication imitates the characteristic information of some legal devices, that is, the registered devices. The specific judgment method is that the characteristic information of this part of illegal devices has a certain degree of similarity or even is exactly the same as the information recorded in the fingerprint in the device fingerprint library, so this part of illegal devices can be called counterfeit devices. In one embodiment of the present invention, for illegal devices and counterfeit devices, risk coefficients can be given according to the similarity of their characteristic information, so as to realize the alarm function through the risk coefficient. This part of the content will be described in detail below.

[0050] It can be understood that the deterministic information collected in step 1 is the relevant information of the terminal devices that are currently running and meet the deterministic information collection specifications. It can also be understood that these terminal devices are alive, that is, online devices. Offline devices will not return any information to the deterministic information collection request, and terminal devices that do not meet the deterministic information collection specifications will not return any information to the deterministic information collection request. Therefore, the information of offline devices and terminal devices that do not meet the deterministic information collection specifications, such as non-deterministic information, can only be obtained by analyzing the collected network traffic. However, the network traffic information collected in step 1 may include information of various terminal devices that do not meet the information collection specifications, such as some counterfeit devices and illegal devices, and network traffic information recorded when sending counterfeit requests or illegal requests to the Internet of Things platform or other devices in the Internet of Things.

[0051] Therefore, by comparing deterministic information and network traffic information, relevant information about these non-deterministic devices can be obtained. However, since the amount of network traffic information is very large and there are many repeated contents, the method in step 2.1 can be used to extract the characteristic information of the terminal devices before the comparison. Specifically, characteristic information can be extracted from each piece of network traffic information, and then the characteristic information can be deduplicated to obtain characteristic information without data redundancy.

[0052] Preferably, the network traffic information includes characteristic information, and the characteristic information includes the protocol type, IP address, MAC address, port, and identification information of the traffic device.

[0053] Specifically, network traffic information is information that must be generated during network transmission. Characteristic information of terminal devices related to terminal devices can be extracted from a large amount of network traffic information. The identification information, also known as Banner information, may include OS (Operating System) version, software and hardware version, device manufacturer information, device type, device model and other information. The identification information may vary depending on the type and brand of the terminal device. However, usually this information can be used to record the relevant basic information of the device, so it can be used as the basic data collected in the security risk status analysis method of the present invention.

[0054] After the feature information is extracted, the method in step 2.2 can be used to compare and analyze it with the deterministic information, and the data that the terminal device in the feature information can correspond to the terminal device in the deterministic information can be deleted, and the remaining data content is the non-deterministic information finally obtained. In one embodiment of the present invention, the data that the Banner information in the feature information is the same as the deterministic information can be deleted, for example, the MAC addresses of the two devices are compared, and after the information with the same MAC address is found, the deletion operation is performed on this part of the data.

[0055] Although the network traffic information contains a lot of content, the two steps in the present invention can be used to process redundant data, which can greatly reduce the amount of valid data, so that the non-deterministic information finally generated is sufficient to achieve a quick and accurate assessment of security risks, network anomalies and the like.

[0056] Preferably, step 2.3 also includes: step 2.3.1, pre-generating a device fingerprint library based on historically collected feature information, comparing the non-deterministic information with the device fingerprint in the device fingerprint library to obtain the device type and device model of the non-deterministic device corresponding to the non-deterministic information, and the similarity between the device fingerprint in the device fingerprint library; step 2.3.2, obtaining a deterministic device classification based on the deterministic information, comparing the deterministic information with the information in the registered device library to obtain registered deterministic devices and unregistered deterministic devices; step 2.3.3, comparing the non-deterministic information with the information in the registered device library to obtain registered non-deterministic devices and unregistered non-deterministic devices; step 2.3.4, obtaining the similarity calculated in step 2.3.1, when the similarity is greater than or equal to 70%, the device is identified as a counterfeit device, otherwise it is an illegal device.

[0057] Specifically, the present invention can classify the types of devices according to multiple different dimensions. For example, devices can be classified into live devices and offline devices, registered devices and unregistered devices, deterministic devices and non-deterministic devices, counterfeit devices, illegal devices, etc.

[0058] The device classification method in the present invention can be determined based on the specific definitions of the various device classifications described above. The method can classify a large number of devices in the perception layer network of the power Internet of Things from multiple different angles, and generate multiple different type labels for each device according to multiple classification methods. For example, one device can be a deterministic device and an unregistered device at the same time, and another device can be a counterfeit device and an unregistered device at the same time.

[0059] In the present invention, a device fingerprint library can be generated in advance, and the device fingerprint library is pre-extracted from the device historical feature information. Specifically, the historical feature information can be extracted from the historically collected network traffic information, and the device fingerprint can be generated according to the data recorded in the historical feature information. The device fingerprint is unique and can be used to identify the corresponding device in the perception layer network.

[0060] By comparing the non-deterministic information input with the device fingerprint stored in the device fingerprint library one by one, the identity information of some non-deterministic devices can be fully confirmed. In addition, for some non-deterministic devices that cannot be fully determined, the similarity between them and some device fingerprints can be calculated through a similarity algorithm, and the device status risk can be determined based on the similarity value. It can be understood that, generally speaking, terminal devices in the perception layer network that are offline or downtime cannot provide the deterministic information of the device itself to the Internet of Things platform. Even if a terminal device meets the deterministic collection specifications, when the device is offline, it cannot provide the deterministic information of the device itself to the Internet of Things platform in real time. The information of the device can only be obtained by analyzing the historical network traffic within a specified time period, and the non-deterministic information of the device is still obtained. Therefore, the power Internet of Things perception layer security risk status analysis system can only obtain the terminal device information that is currently in normal operation in the perception layer network and meets the deterministic collection specifications, and other terminal devices that are currently offline, downtime or running in the perception layer subnet that do not meet the deterministic information collection specifications will be collected by other methods, such as network traffic information methods.

[0061] By comparing and removing duplications between network traffic information and deterministic information, non-deterministic information can be obtained. The non-deterministic information may include some devices that are currently offline or down, some terminal devices that do not meet the deterministic information collection specifications, and some counterfeit devices and illegal devices.

[0062] Specifically, in this embodiment, only terminal devices that run in real time and comply with the deterministic information collection specifications, including registered and unregistered information, can be collected into the surviving device determination information library. Other terminal devices, including terminal devices that run in real time but do not comply with the deterministic information collection specifications, offline terminal devices that comply with the deterministic information collection specifications, and offline terminal devices that do not comply with the deterministic information collection specifications, the non-deterministic information of these devices needs to be obtained through analysis of network traffic.

[0063] In addition, it should be noted that, in this embodiment, similarity calculation is a percentage obtained by weighted calculation and comparison of different data items in the feature information.

[0064] In one embodiment of the present invention, the characteristic information may include the protocol type, IP address, MAC address, port, and identification information of the traffic device. The identification information (i.e., banner information) includes various information such as OS version, software and hardware version, device manufacturer information, device type, and device model. A typical method for weighting and calculating the similarity of these data items in the characteristic information is: according to the empirical value, the weight coefficient value of each data item is assigned as {(protocol type, 0.05), (IP address, 0.3), (MAC address, 0.2), (port, 0.05), (OS version, 0.05), (software and hardware version, 0.1), (device manufacturer information, 0.05), (device type, 0.1), (device model, 0.1)}, when the characteristic information is compared with a fingerprint in the device fingerprint library to calculate the similarity, if the characteristic information data item is equal to a fingerprint data item, the data item is calculated and assigned a value of 1, otherwise it is assigned a value of 0, and if the characteristic information data item is empty, it is also assigned a value of 0. For example, when a feature information data item is compared with a fingerprint and the calculation result is (1, 1, 1, 1, 0, 0, 1, 1, 1), then its similarity = 1x0.05+1x0.3+1x0.2+1x0.05+0x0.05+0x0.1+1x0.05+1x0.1+1x0.1=0.85.

[0065] In the present invention, the device security vulnerabilities can be specifically evaluated based on the following items, and the project content includes the business type of the device, open service ports, OS version, software and hardware versions, device type, and device model.

[0066] In addition, a comprehensive registered device library can be pre-generated in the present invention, and the comprehensive registered device library can include relevant information of all registered terminal devices. Specifically, various types of terminal devices in the perception layer need to be centrally registered when they first access the perception layer network, and the centralized registration information of the terminal devices will be stored in the registered device library. In one embodiment of the present invention, the centralized registration information of the terminal device may include the unique device identification number, device manufacturer, device type, device model, software and hardware version information, service type, open service port, MAC address and other content similar to the deterministic information. This information will be stored in a relational database.

[0067] Preferably, determining the security risk of the terminal device also includes: step 2.4, evaluating the risk coefficient of the counterfeit device and the risk coefficient of the illegal device based on the similarity calculated in step 2.3; step 2.5, searching the vulnerability library based on the evaluation results, and marking the device security vulnerabilities.

[0068] In one embodiment of the present invention, in addition to analyzing the status of various devices, the risk coefficient of the device can also be calculated for counterfeit devices and illegal devices; counterfeit devices and illegal devices are terminal devices that cannot be matched to registered devices in the registered device library, but the characteristic information of counterfeit devices and illegal devices are similar to a fingerprint in the device fingerprint library, and their similarity values ​​are the similarity between their characteristic information and each fingerprint match in the fingerprint library, that is, the maximum value of the weighted calculation value of each characteristic item. In this embodiment, if a certain device is the most matched with the registered device library, that is, the similarity between the devices at the maximum similarity exceeds 70%, then the device is identified as a counterfeit device, otherwise it is identified as an illegal device. The risk coefficient value of the device = 1-similarity. For example, in the above calculation example, the similarity of the characteristic information of a certain device is 0.85, then the calculated result of the risk coefficient of the device is (1-0.85) = 0.15.

[0069] It should be noted that the risk factor is only a numerical value used to indicate the risk level of counterfeit devices or illegal devices. When the similarity is lower, the accuracy of identifying the unregistered device as an illegal device is higher; when the similarity is higher, the accuracy of identifying the unregistered device as an illegal device is lower. This risk factor has nothing to do with the security vulnerabilities of the device.

[0070] In this embodiment, known security vulnerabilities corresponding to different business types, open service ports, OS versions, software and hardware versions, device types, and device models are stored in a vulnerability library in advance. The vulnerability library is generated based on the internationally used CVE vulnerability library combined with manually mined vulnerabilities. In this embodiment, after identifying the deterministic information and characteristic information of the device, the vulnerability library is searched to mark the possible security vulnerabilities of the device.

[0071] Step 3: Acquire the abnormal network traffic situation and abnormal network access behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model.

[0072] In the present invention, the data content generated in step 1 and step 2 can be analyzed according to the feature model stored in the feature model library to realize the judgment of network abnormality and abnormal network access behavior.

[0073] Preferably, obtaining the network traffic anomaly of the terminal device also includes: step 3.1, classifying and counting the network traffic information, and identifying the traffic sequence therein; step 3.2, pre-generating a network traffic feature model based on historically obtained relevant information; step 3.3, inputting the identified traffic sequence into the network traffic feature model to obtain the network traffic anomaly of the terminal device.

[0074] In this embodiment, traffic packets under different protocol types can be counted according to the classification of the protocol types of the network traffic transport layer and the application layer. In one embodiment of the present invention, TCP traffic packets and UDP traffic packets can be counted according to the transport layer protocols TCP and UDP respectively; and HTTP, SNMP, FTP, TFTP, telnet, https and other special application layer protocol traffic packets of the power Internet of Things perception layer such as dedicated IP protocols such as meter reading terminals, concentrators, collectors, etc. can be counted according to the application layer protocol type of the network traffic.

[0075] After completing the classification statistics, the traffic sequence can be identified for each different classification type in a way that is suitable for the protocol. For example, for the connection-oriented transport layer protocol TCP, the traffic sequence packets for establishing a connection in three handshakes can be identified; for application layer protocols such as HTTP, the traffic packet sequences in different transmission stages such as POST and GET operations can be identified; for different business types in the perception layer of the power Internet of Things, such as data upload at the meter reading terminal and camera control at the management platform, the traffic packet sequences in different access stages can be identified.

[0076] Preferably, the network traffic characteristic model includes a traffic threshold model, a network link characteristic parameter model, and a sequence characteristic model. Among them, the traffic threshold model and the network link characteristic parameter model are based on historical traffic data, a certain attribute of network access statistics count, and a normal network parameter range is established based on network management experience, including the number of network connections of a specific type, network utilization, packet loss rate, number of conflicts, total number of business type visits, etc. When the traffic parameters of one or more networks exceed the normal range, an alarm is generated. The sequence characteristic model divides network traffic into two categories: normal traffic and abnormal traffic according to the known normal access traffic sequence model and the known worm attack and DoS network attack traffic sequence model, and alarms for abnormal traffic.

[0077] In one embodiment of the present invention, based on the historically collected network traffic information, a network traffic feature model of different types and different terminal devices can be analyzed and acquired through manual or automatic analysis methods, such as one or more of statistical analysis, signal analysis, and correlation analysis. The model can be a traffic threshold model, a network link feature parameter model, a sequence feature model, etc. These traffic analysis feature models can be stored in a traffic analysis model library, and based on the models in the traffic analysis model library, anomaly analysis of network traffic in the perception layer subnet can be implemented.

[0078] Preferably, obtaining the abnormal network access behavior of the terminal device also includes: step 3.4, based on the historically collected network traffic information and the deterministic information, using a learning algorithm to pre-establish a network access behavior feature model; step 3.5, inputting the identified traffic sequence into the network access behavior feature model to obtain the abnormal network access behavior of the terminal device. According to the traffic sequence obtained in step 3.1, it can be compared with the model data in the network access behavior feature model to analyze the access anomaly in the perception layer network.

[0079] Specifically, the present invention can analyze and establish network access behavior feature models of different types of devices and different terminal devices through artificial learning algorithms or machine learning algorithms. Specifically, the learning algorithm can adopt one of decision tree learning, Bayesian network learning, and cluster learning. Using the above learning algorithm, a network access behavior feature model of different types of devices accessing different business types is automatically established by learning a large amount of normal access behavior traffic, or a network access behavior white model of different business types is established through artificial analysis (the model content includes network behavior name, network behavior protocol type, network behavior port range feature, network behavior address range feature, network behavior flow sequence feature), or an attack black model (including attack behavior name, attack behavior protocol type, attack behavior port range feature, attack behavior address range feature, attack behavior flow sequence feature) is established through a traditional attack feature library (such as an intrusion detection feature library of an intrusion detection system IDS) and an industrial Internet of Things attack feature library. These models can simplify large and complex network traffic into a limited number of network access behavior models, and realize the analysis of abnormal network access behavior by storing them in a feature model library.

[0080] In this embodiment, the network access behavior model is automatically established by analyzing and learning a large amount of historical traffic of normal access behaviors using a machine learning algorithm, such as one or more of decision tree learning, Bayesian network learning, and cluster learning. The machine learning algorithm analyzes and extracts common feature values ​​from a large amount of normal access behavior traffic to establish a network access behavior model for different types of devices accessing different types of services. The structure of the model includes a model identifier, a protocol type, a device type, a service type, a source address, a source port, a destination address, a destination port, and a command sequence.

[0081] In this embodiment, based on the network access behavior feature model established by automatic learning, a behavior white model is further established for the network access of a specific business type in the perception layer subnet of the power Internet of Things through manual analysis. The model structure includes the network behavior name, network behavior protocol type, network behavior port range feature, network behavior address range feature, and network behavior flow sequence feature. The behavior white model more accurately describes the flow packet features of this type of normal network access behavior. By matching the behavior white model, this type of normal network access behavior can be quickly determined, speeding up the process of behavior analysis.

[0082] In this embodiment, in order to more accurately and quickly identify common network attack behaviors, the traditional intrusion detection attack feature library and the industrial Internet of Things attack feature library are introduced. Through manual analysis of these two feature libraries, an attack black model is further established. The model structure includes attack behavior name, attack behavior protocol type, attack behavior port range feature, attack behavior address range feature, and attack behavior flow sequence feature. By matching the attack black model, such abnormal network attack behaviors can be quickly locked.

[0083] The feature model is used as the analysis method for network traffic anomalies and network access behavior anomalies. The feature model combines the traditional intrusion detection attack feature library, the industrial Internet of Things attack feature library, the network traffic sequence features established for the business types unique to the power Internet of Things perception layer subnet, and the network access behavior white model library. The matching of the behavior white model and the attack black model improves the speed and accuracy of the behavior analysis, and the feature model established by machine learning helps to analyze unknown network abnormal behaviors.

[0084] Step 4: Use a visualization method to classify and display the device status type information, security risk information, network traffic anomaly information, and network access abnormal behavior information obtained in steps 2 and 3.

[0085] Preferably, step 4 also includes: storing the device status type, device risk factor, device security vulnerability, network traffic anomaly and network access abnormal behavior information in different data tables respectively; directly or indirectly reading and displaying the data in the data table based on a visualization method.

[0086] In the present invention, the device status type, device risk factor, device security vulnerability, network traffic anomaly and network access abnormal behavior information can be stored in different MYSQL databases. Then, the corresponding data items in the MYSQL database are called according to specific needs through a visualization method, so that the information can be displayed in a classified and hierarchical manner in a visualization manner.

[0087] In the present invention, by setting a fixed time and periodically repeating the method in steps 1-4 at each fixed time, dynamic analysis and monitoring of the security risk status of the perception layer network of the power Internet of Things can be achieved.

[0088] The second aspect of the present invention relates to a security risk status analysis system for the perception layer of the electric power Internet of Things as described in the first aspect of the present invention. The system includes a data acquisition module, a storage pool, a feature model library, a risk analysis module and a status display module; wherein the data acquisition module is used to collect relevant information of all terminal devices in the perception layer of the electric power Internet of Things and store the relevant information in the storage pool; the feature model library includes a registered device library, a device fingerprint library, a network traffic feature model library and a network access behavior feature model library; the risk analysis module is used to obtain the device status type based on the relevant information, determine the security risk of the terminal device, and obtain the network traffic anomaly and network access abnormal behavior of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; the status display module is used to classify and display the device status type information, security risk information, network traffic anomaly information and network access abnormal behavior information by using a visualization method.

[0089] Specifically, the data collection module includes a deterministic information collection unit and a network traffic mirror collection unit, which are used to collect deterministic information and network traffic information respectively. The storage pool includes a surviving device determination information library and a network traffic library, which are used to store deterministic information and network traffic information respectively.

[0090] In one embodiment of the present invention, the feature model library also includes a registered device library, a device fingerprint library, a network traffic feature model library, and a network access behavior feature model library. The registered device library and the device fingerprint library both use a relational database to store relevant data, while the network traffic feature model library and the network access behavior feature model library can be stored in the form of files.

[0091] In one embodiment of the present invention, the risk analysis module may include a security risk analysis unit, a traffic analysis unit, and a behavior analysis unit. The risk analysis unit is used to identify different types of devices, analyze and identify the security risks of individual devices, and transmit the analysis results to the status display module. The traffic analysis unit is used to analyze the network traffic anomalies existing in the perception layer network, and transmit the analysis results to the status display module. The behavior analysis unit is used to analyze the abnormal network access behaviors existing in the perception layer network, and transmit the analysis results to the status display module.

[0092] In one embodiment of the present invention, after receiving the device classification and security risk information, network traffic anomaly, and network access abnormal behavior information transmitted by the risk analysis module, the status display module displays the information in a classified and hierarchical manner in a visual manner.

[0093] In one embodiment of the present invention, the network traffic mirroring collection module in the security risk status analysis system of the power Internet of Things perception layer is implemented in the form of a network switch, and other modules and units in the analysis system are centrally implemented in a single independent general-purpose computer system; the network switch that implements the network traffic mirroring collection module is connected to the computer system that implements other modules and subsystems through a network.

[0094] It is understandable that when the perception layer network is large in scale and needs to process massive amounts of network traffic data, the power Internet of Things perception layer security risk status analysis system can also be connected in a distributed manner to implement the network structure described above.

[0095] The beneficial effect of the present invention is that, compared with the prior art, the method and system for analyzing the security risk status of the perception layer of the electric power Internet of Things in the present invention can comprehensively analyze and determine the status type, security risk and network anomaly of the terminal device by collecting various types of information of the terminal device, and provide abnormal risk warnings through visualization methods. Since the method in the present invention adopts a detection method that combines certainty and uncertainty, the accuracy of the network security risk analysis of the perception layer of the electric power Internet of Things is enhanced, thereby avoiding the false alarm and missed alarm caused by the illegal replacement of the terminal device or prevention when the terminal device is in a temporary downtime or offline state. The analysis results of the method of the present invention are comprehensive and accurate, the analysis process is intelligent and fast, and it also has a good visualization effect, which improves the security level of the system.

[0096] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.

Claims

1. A method for analyzing security risk status of the perception layer of the power Internet of Things, characterized in that: The method comprises the following steps: Step 1: Collect and store relevant information of all terminal devices in the power Internet of Things perception layer; Step 2, obtaining a plurality of device status type tags based on the relevant information, and determining the security risk of the terminal device; the relevant information includes deterministic information and network traffic information; include, Step 2.1, extracting characteristic information from network traffic information and performing deduplication processing based on the terminal device; Step 2.2, performing comparative analysis on the deterministic information and the characteristic information, removing the characteristic information of the deterministic device, thereby obtaining non-deterministic information; Step 2.3, determining the device state type based on the deterministic information and the non-deterministic information; The step 2.3 also includes: Step 2.3.1, pre-generate a device fingerprint library based on historically collected feature information, compare the non-deterministic information with the device fingerprint in the device fingerprint library to obtain the device type and device model of the non-deterministic device corresponding to the non-deterministic information and the similarity between the device fingerprint in the device fingerprint library; Step 2.3.2, obtaining a deterministic device based on the deterministic information, and comparing the deterministic information with information in a registered device library to obtain registered deterministic devices and unregistered deterministic devices; Step 2.3.3, comparing the non-deterministic information with the information in the registered device library to obtain registered non-deterministic devices and unregistered non-deterministic devices; Step 2.3.4, obtaining the similarity calculated in step 2.3.1, when the similarity is greater than or equal to 70%, the device is identified as a counterfeit device, otherwise it is an illegal device; Step 2.4, based on the similarity calculated in step 2.3, evaluating the risk factor of the counterfeit device and the risk factor of the illegal device; Step 2.5, searching a vulnerability library based on the evaluation results, and marking device security vulnerabilities; Step 3, obtaining the network traffic anomaly and network access anomaly of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; include, Step 3.1, classify and count the network traffic information and identify the traffic sequence therein; Step 3.2, pre-generating a network traffic feature model based on the relevant information obtained historically; Step 3.3, inputting the identified traffic sequence into a network traffic feature model to obtain the network traffic anomaly of the terminal device; Step 3.4, based on the historically collected network traffic information and the deterministic information, a network access behavior feature model is pre-established using a learning algorithm; Step 3.5, inputting the identified traffic sequence into the network access behavior feature model to obtain the abnormal network access behavior of the terminal device; Step 4: Use a visualization method to classify and display the device status type information, security risk information, network traffic anomaly information, and network access abnormal behavior information obtained in steps 2 and 3.

2. According to the method for analyzing security risk status of the perception layer of the power Internet of Things described in claim 1, it is characterized by: The deterministic information includes the unique device identification number, device manufacturer, device type, device model, software and hardware version information, service type, open service port and MAC address of the surviving device; The network traffic information includes characteristic information, and the characteristic information includes the protocol type, IP address, MAC address, port, and identification information of the traffic device.

3. According to the method for analyzing security risk status of the perception layer of the power Internet of Things described in claim 2, it is characterized by: The network traffic feature model includes a traffic threshold model, a network link feature parameter model, and a sequence feature model.

4. According to the method for analyzing security risk status of the perception layer of the power Internet of Things described in claim 3, it is characterized by: The step 4 also includes: The device status type, device risk factor, device security vulnerability, network traffic anomaly, and network access abnormal behavior information are stored in different data tables respectively; Read the data in the data table directly or indirectly and display it based on visualization methods.

5. A security risk status analysis system for the perception layer of the power Internet of Things, characterized by: The system adopts a method for analyzing security risk status of a power Internet of Things perception layer according to any one of claims 1 to 4; The system includes a data acquisition module, a storage pool, a feature model library, a risk analysis module and a status display module; wherein, The data acquisition module is used to collect relevant information of all terminal devices in the power Internet of Things perception layer and store the relevant information in the storage pool; The feature model library includes a registered device library, a network traffic feature model library and a network access behavior feature model library; The risk analysis module is used to obtain the device status type based on the relevant information, determine the security risk of the terminal device, and obtain the network traffic anomaly and network access anomaly of the terminal device based on the pre-generated network traffic feature model and network access behavior feature model; The status display module is used to classify and display device status type information, security risk information, network traffic abnormality information and network access abnormal behavior information using a visual method.

Images