A method and system for detecting sensitive data of power dispatch automation based on big data

Abstract

The present invention discloses a method and system for detecting sensitive data based on big data electric power dispatch automation, which belongs to the technical field of electric power dispatching, and is characterized in that the method for detecting sensitive data based on big data electric power dispatch automation includes the following steps: S1, obtaining the following data sources: network full flow data, business system data, equipment alarm data and custom data; S2, behavior analysis; specifically including baseline analysis, time series analysis and risk assessment; S3, determination of abnormal behavior events; S4, scenario prediction alarm. Through the above technical scheme, the present invention uses big data and machine learning to continuously monitor user electricity consumption data, learn users' normal electricity consumption behavior, and at the same time promptly discover abnormal behavior of sensitive data within the system, and promptly alarm actions that deviate from normal behavior.

Description

Technical Field

[0001] The present invention belongs to the technical field of electric power dispatching, and in particular relates to a method and system for detecting sensitive data in electric power dispatching automation based on big data. Background Art

[0002] With the gradual expansion of the scale of power grids and the increasing degree of automation, power grid companies, especially those specialized in power dispatching automation, have entered a new era of dataization. With informatization comes the risk of sensitive information leakage, especially corporate power habits, customer information, and corporate privacy behavior.

[0003] Power dispatching automation mainly exchanges information with the outside world through the power dispatching data network and the power office network. Power dispatching automation data leaves information on the intranet. If this information is analyzed and used, it will pose a great threat to user privacy and power grid security. At the same time, massive data also increases the difficulty of information protection.

[0004] The advancement of power grid informatization, especially the indirect exchange of power dispatching automation data with the public network, has gradually increased, and there are docking interfaces with different platforms such as telecommunications, finance, and government. This requires accelerating the promotion of power dispatching automation data security and privacy protection needs. Under the premise of ensuring normal business, the security of power dispatching automation data should be protected at a reasonable cost. Business needs and risks coexist, and protection must seek a balance between business needs and risks. For data of different values ​​and attributes, different levels of protection measures should be implemented under different business needs to control protection costs. Summary of the invention

[0005] Technical solution, in order to solve the technical problems in the above-mentioned background technology: a method and system for detecting sensitive data in automated power dispatching based on big data is proposed. Through big data and machine learning, the user's electricity consumption data is continuously monitored to learn the user's normal electricity consumption behavior. At the same time, abnormal behavior of the sensitive data within the system is discovered in time, and timely alarms are issued for actions that deviate from normal behavior.

[0006] The first object of the present invention is to provide a method for detecting sensitive data based on big data power dispatch automation, comprising:

[0007] S1. Obtain the following data sources: network full flow data, business system data, equipment alarm data and custom data;

[0008] S2. Behavioral analysis, including baseline analysis, time series analysis and risk assessment, including:

[0009] The baseline analysis includes a numerical baseline and a nominal baseline;

[0010] The numerical baseline uses a numerical baseline for quantifiable indicators, which include historical inflow and outflow traffic, historical access port behavior, and historical access host behavior; the nominal baseline uses a nominal baseline for non-quantifiable indicators, which include account frequently used login areas, account usual login time, account frequently used IP addresses, and host historical open ports;

[0011] The time series analysis determines whether it is an abnormal operation at an abnormal time by comparing the timestamp of the access data with the historical access time, the active access time period, and the survival status;

[0012] The risk assessment determines whether there are abnormalities in sensitive data through matrix characteristics;

[0013] S3. Determination of abnormal behavior events; abnormal behavior events include:

[0014] Read the firewall and intrusion detection system logs to check whether there are any illegal external devices;

[0015] Illegal access to the database: Detect whether the user has illegally accessed and operated the database;

[0016] Abnormal transmission of sensitive data: Detect whether database data has been screenshoted and whether key data has been copied;

[0017] S4. Scenario prediction alarm.

[0018] Preferably: the network full flow data is: the request-response protocol content of the entire dispatching data network and the external interface of the power dispatching automation system, user dialogue information and file information flow;

[0019] The business system data is: to learn the normal behavior baseline of the account, discover its abnormal behavior, and collect activity data of identity authentication, authorization, accounting and audit system accounts, corporate office accounts and other business system accounts.

[0020] The device alarm data includes: process activity logs, network activity logs, and file operation logs of the host terminal; firewalls, intrusion detection systems, and website application-level defense systems transmitted through system logs;

[0021] The customized data includes terminals and terminal ports customized by the maintainer and sensitive services customized by the maintainer.

[0022] Preferably: S2 is specifically:

[0023] Definition 1: Numerical abnormal baseline monitoring method;

[0024] Definition 1.1 Unit numerical monitoring method;

[0025] The numerical data set to be monitored X = {x1, x2, x3…x n}, where x n ∈R n , i,n∈ positive integers, R represents a real number;

[0026] u i Represents the data set x i The mean of

[0027] σ 2 Represents the data set x i The variance of

[0028] p i (x) represents the data set X i The distribution function of the internal data,

[0029] Represents X i If they are all independent, the numerical array distribution function is p(X); if p(X)<ε, it is considered abnormal, where ε is the boundary value ε∈(0,1) set by the maintenance personnel;

[0030] Definition 1.2 Multivariate numerical monitoring method;

[0031] Numerical data set X to be monitored i ={x1,x2,x3…x n}, where x i , X i ∈R n , i,n∈positive integers, R represents a real number, Σ∈R n×n ;

[0032] q i (x) represents the data set X i The distribution function of the internal data;

[0033] Among them, x n There is a positive correlation between x n Negative phase between

[0034] Represents x i If they are not independent, the distribution function of the numeric array is p(X);

[0035] If q(X)<ε2, it is considered abnormal, where ε2 is the boundary value ε2∈(0,1) set by the maintenance personnel;

[0036] Definition 2: Time series anomaly analysis baseline;

[0037] Time series behavior data group X to be monitored i ={x1,x2,x3…x n}, x n Represents the nth access behavior, and defines m to represent x i Appears m times, n∈positive integer, m∈non-negative integer;

[0038] W(x i ) represents x i The activity level of in the time series;

[0039] H i (x) represents X i Level of confusion;

[0040] If H i (x)<ε3 is considered abnormal, where ε3 is the boundary value ε3∈(0,1) set by the maintenance personnel;

[0041] Definition 3,

[0042] Define the d eigenvalues ​​H of different attributes in 2 d (x), construct the risk monitoring matrix B, the eigenvalues ​​include IP port and data packet size;

[0043]

[0044] The feature matrix of the data to be monitored is {H K (1)…H K (d)}, and each column of the risk monitoring matrix B is calculated as defined in 3.1 to generate a new matrix C;

[0045] Definition 3.1

[0046]

[0047] C=[θ1…θ n ], indicating the abnormality of the features of each dimension;

[0048] If θ n <ε4 is considered abnormal, where ε is the boundary value ε4∈(0,1) set by the maintenance personnel, and the abnormality θ in C n The more there are, the higher the risk value of the monitored object.

[0049] Preferably: S4 specifically includes: constructing sensitive data event scenarios through abnormal event feature analysis results, including: former employees stealing sensitive data, internal personnel causing negligent damage, account theft leading to sensitive data leakage, and sensitive data being captured.

[0050] The second object of the present invention is to provide a sensitive data detection system for power dispatch automation based on big data, comprising:

[0051] Data acquisition module, which acquires the following data sources: network full flow data, business system data, equipment alarm data and custom data;

[0052] Analysis module, behavioral analysis; specifically including baseline analysis, time series analysis and risk assessment, including:

[0053] The baseline analysis includes a numerical baseline and a nominal baseline;

[0054] The numerical baseline uses a numerical baseline for quantifiable indicators, which include historical inflow and outflow traffic, historical access port behavior, and historical access host behavior; the nominal baseline uses a nominal baseline for non-quantifiable indicators, which include account frequently used login areas, account usual login time, account frequently used IP addresses, and host historical open ports;

[0055] The time series analysis determines whether it is an abnormal operation at an abnormal time by comparing the timestamp of the access data with the historical access time, the active access time period, and the survival status;

[0056] The risk assessment determines whether there are abnormalities in sensitive data through matrix characteristics;

[0057] Determination module, abnormal behavior event determination; abnormal behavior events include:

[0058] Read the firewall and intrusion detection system logs to check whether there are any illegal external devices;

[0059] Illegal access to the database: Detect whether the user has illegally accessed and operated the database;

[0060] Abnormal transmission of sensitive data: Detect whether database data has been screenshoted and whether key data has been copied;

[0061] Early warning module, scenario prediction alarm.

[0062] Preferably: the network full flow data is: the request-response protocol content of the entire dispatching data network and the external interface of the power dispatching automation system, user dialogue information and file information flow;

[0063] The business system data is: to learn the normal behavior baseline of the account, discover its abnormal behavior, and collect activity data of identity authentication, authorization, accounting and audit system accounts, corporate office accounts and other business system accounts.

[0064] The device alarm data includes: process activity logs, network activity logs, and file operation logs of the host terminal; firewalls, intrusion detection systems, and website application-level defense systems transmitted through system logs;

[0065] The customized data includes terminals and terminal ports customized by the maintainer and sensitive services customized by the maintainer.

[0066] Preferably: the specific analysis process of the analysis module is:

[0067] Definition 1: Numerical abnormal baseline monitoring method;

[0068] Definition 1.1 Unit numerical monitoring method;

[0069] The numerical data set to be monitored X = {x1, x2, x3…x n}, where x n ∈R n , i,n∈ positive integers, R represents a real number;

[0070] u i Represents the data set x i The mean of

[0071] σ 2 Represents the data set x i The variance of

[0072] p i (x) represents the data set X i The distribution function of the internal data,

[0073] Represents X i If they are all independent, the numerical array distribution function is p(X); if p(X)<ε, it is considered abnormal, where ε is the boundary value ε∈(0,1) set by the maintenance personnel;

[0074] Definition 1.2 Multivariate numerical monitoring method;

[0075] Numerical data set X to be monitored i ={x1,x2,x3…x n}, where x i , X i ∈R n , i,n∈positive integers, R represents a real number, Σ∈R n×n ;

[0076] q i (x) represents the data set X i The distribution function of the internal data;

[0077] Among them, x n There is a positive correlation between x n Negative phase between

[0078] Represents x i If they are not independent, the distribution function of the numeric array is p(X);

[0079] If q(X)<ε2, it is considered abnormal, where ε2 is the boundary value ε2∈(0,1) set by the maintenance personnel;

[0080] Definition 2: Time series anomaly analysis baseline;

[0081] Time series behavior data group X to be monitored i ={x1,x2,x3…x n}, x n Represents the nth access behavior, and defines m to represent x i Appears m times, n∈positive integer, m∈non-negative integer;

[0082] W(x i ) represents x i The activity level of in the time series;

[0083] H i (x) represents X i Level of confusion;

[0084] If H i (x)<ε3 is considered abnormal, where ε3 is the boundary value ε3∈(0,1) set by the maintenance personnel;

[0085] Definition 3,

[0086] Define the d eigenvalues ​​H of different attributes in 2 d (x), construct the risk monitoring matrix B, the eigenvalues ​​include IP port and data packet size;

[0087]

[0088] The feature matrix of the data to be monitored is {H K (1)…H K (d)}, and each column of the risk monitoring matrix B is calculated as defined in 3.1 to generate a new matrix C;

[0089] Definition 3.1

[0090]

[0091] C=[θ1…θ n ], indicating the abnormality of the features of each dimension;

[0092] If θ n <ε4 is considered abnormal, where ε is the boundary value ε4∈(0,1) set by the maintenance personnel, and the abnormality θ in C n The more there are, the higher the risk value of the monitored object.

[0093] Preferably, the early warning module specifically constructs sensitive data event scenarios through abnormal event feature analysis results, including: former employees stealing sensitive data, internal personnel causing negligent damage, account theft leading to sensitive data leakage, and sensitive data being captured.

[0094] The third invention objective of this patent is to provide a computer program that implements the above-mentioned method for detecting sensitive data in automated power dispatching based on big data.

[0095] The fourth invention objective of this patent is to provide an information data processing terminal that implements the above-mentioned method for detecting sensitive data based on big data-based power dispatching automation.

[0096] The fifth invention objective of this patent is to provide a computer-readable storage medium, including instructions, which, when executed on a computer, enables the computer to execute the above-mentioned method for detecting sensitive data based on big data-based automated power dispatching.

[0097] The advantages and positive effects of the present invention are:

[0098] The present invention is based on a method and system for detecting sensitive data in automated power dispatching based on big data. It uses machine learning methods to perform baseline detection. During the training process, it first describes the normal behavior of the account, thereby identifying the abnormal behavior of the account in real time and issuing corresponding alarms. These alarms are connected in series to provide corresponding clues and evidence for identifying high-risk accidents, forming a complete story line. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] Figure 1 A schematic diagram of the system structure of a preferred embodiment of the present invention; DETAILED DESCRIPTION

[0100] In order to further understand the content, features and effects of the present invention, the following embodiments are given as examples and described in detail with reference to the accompanying drawings.

[0101] See also Figure 1 , the specific plan is:

[0102] A method for detecting sensitive data in power dispatch automation based on big data, comprising the following steps:

[0103] S1. Obtain the following data sources: network full flow data, business system data, equipment alarm data and custom data; the data sources include:

[0104] Network full flow data: mainly collects the entire dispatching data network and the request-response protocol content (HTTP), user conversation information (SEESION) and file information flow of the external interface of the power dispatching automation system.

[0105] Business system data: To learn the normal behavior baseline of the account and detect its abnormal behavior, collect activity data (DPI) of identity authentication, authorization, accounting and audit system accounts (4A), enterprise office accounts (OA) accounts and other business system accounts.

[0106] Device alarm data: In order to learn the normal mode of the host and discover its abnormal behavior, collect the process activity log, network activity log, file operation log, etc. of the host terminal. Firewalls, intrusion detection systems (IDS), website application level defense systems (WAF) are transmitted through system logs (SYSLOG)

[0107] Customized data: mainly includes terminals and terminal ports customized by maintainers, as well as sensitive services customized by maintainers.

[0108] S2. Behavioral analysis, including baseline analysis, time series analysis and risk assessment, including:

[0109] The baseline analysis includes a numerical baseline and a nominal baseline;

[0110] The numerical baseline uses a numerical baseline for quantifiable indicators, which include historical inflow and outflow traffic, historical access port behavior, and historical access host behavior; the nominal baseline uses a nominal baseline for non-quantifiable indicators, which include account frequently used login areas, account usual login time, account frequently used IP addresses, and host historical open ports;

[0111] The time series analysis determines whether it is an abnormal operation at an abnormal time by comparing the timestamp of the access data with the historical access time, the active access time period, and the survival status;

[0112] The risk assessment determines whether there are abnormalities in sensitive data through matrix characteristics;

[0113] In this preferred embodiment, the behavior analysis specifically includes:

[0114] Definition 1: Numerical abnormal baseline monitoring method;

[0115] Definition 1.1 Unit numerical monitoring method;

[0116] The numerical data set to be monitored X = {x1, x2, x3…x n}, where x n ∈R n , i,n∈ positive integers, R represents a real number;

[0117] u i Represents the data set x i The mean of

[0118] σ 2 Represents the data set x i The variance of

[0119] p i (x) represents the data set X i The distribution function of the internal data,

[0120] Represents X i If they are all independent, the numerical array distribution function is p(X); if p(X)<ε, it is considered abnormal, where ε is the boundary value ε∈(0,1) set by the maintenance personnel;

[0121] Definition 1.2 Multivariate numerical monitoring method;

[0122] Numerical data set X to be monitored i ={x1,x2,x3…x n}, where x i , X i ∈R n , i,n∈positive integers, R represents a real number, Σ∈R n×n ;

[0123] q i (x) represents the data set X i The distribution function of the internal data;

[0124] Among them, x n There is a positive correlation between x n Negative phase between

[0125] Represents x i If they are not independent, the distribution function of the numeric array is p(X);

[0126] If q(X)<ε2, it is considered abnormal, where ε2 is the boundary value ε2∈(0,1) set by the maintenance personnel;

[0127] Definition 2: Time series anomaly analysis baseline;

[0128] Time series behavior data group X to be monitored i ={x1,x2,x3…x n}, x n Represents the nth access behavior, and defines m to represent x i Appears m times, n∈positive integer, m∈non-negative integer;

[0129] W(x i ) represents x i The activity level of in the time series;

[0130] H i (x) represents X i Level of confusion;

[0131] If H i (x)<ε3 is considered abnormal, where ε3 is the boundary value ε3∈(0,1) set by the maintenance personnel;

[0132] Definition 3,

[0133] Define the d eigenvalues ​​H of different attributes in 2 d (x), construct the risk monitoring matrix B, the eigenvalues ​​include IP port and data packet size;

[0134]

[0135] The feature matrix of the data to be monitored is {H K (1)…H K (d)}, and each column of the risk monitoring matrix B is calculated as defined in 3.1 to generate a new matrix C;

[0136] Definition 3.1

[0137]

[0138] C=[θ1…θ n ], indicating the abnormality of the features of each dimension;

[0139] If θ n <ε4 is considered abnormal, where ε is the boundary value ε4∈(0,1) set by the maintenance personnel, and the abnormality θ in C n The more there are, the higher the risk value of the monitored object;

[0140] S3. Determination of abnormal behavior events; abnormal behavior events include:

[0141] Read the firewall and intrusion detection system (IDS) system logs to see if there are any illegal external devices.

[0142] Illegal access to the database: Detect whether the user has illegally accessed and operated the database;

[0143] Abnormal transmission of sensitive data: Detect whether database data has been screenshoted and whether key data has been copied;

[0144] Read the firewall and intrusion detection system logs to check whether there are any illegal external devices;

[0145] S4, scenario prediction alarm, mainly through the analysis results of abnormal event characteristics, to construct sensitive data event scenarios, including: former employees stealing sensitive data, internal personnel negligent destruction, account theft leading to sensitive data leakage, and sensitive data being screenshot.

[0146] A sensitive data detection system for power dispatch automation based on big data, comprising:

[0147] Data acquisition module, which acquires the following data sources: network full flow data, business system data, equipment alarm data and custom data;

[0148] Analysis module, behavioral analysis; specifically including baseline analysis, time series analysis and risk assessment, including:

[0149] The baseline analysis includes a numerical baseline and a nominal baseline;

[0150] The numerical baseline uses a numerical baseline for quantifiable indicators, which include historical inflow and outflow traffic, historical access port behavior, and historical access host behavior; the nominal baseline uses a nominal baseline for non-quantifiable indicators, which include account frequently used login areas, account usual login time, account frequently used IP addresses, and host historical open ports;

[0151] The time series analysis determines whether it is an abnormal operation at an abnormal time by comparing the timestamp of the access data with the historical access time, the active access time period, and the survival status;

[0152] The risk assessment determines whether there are abnormalities in sensitive data through matrix characteristics;

[0153] Determination module, abnormal behavior event determination; abnormal behavior events include:

[0154] Read the firewall and intrusion detection system logs to check whether there are any illegal external devices;

[0155] Illegal access to the database: Detect whether the user has illegally accessed and operated the database;

[0156] Abnormal transmission of sensitive data: Detect whether database data has been screenshoted and whether key data has been copied;

[0157] Early warning module, scenario prediction alarm.

[0158] An information data processing terminal for implementing the above-mentioned sensitive data detection method for power dispatch automation based on big data.

[0159] A computer-readable storage medium includes instructions, which, when executed on a computer, enable the computer to execute the above-mentioned method for detecting sensitive data based on big data-based automated power dispatching.

[0160] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When the use is implemented in whole or in part in the form of a computer program product, the computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL) or wireless (e.g., infrared, wireless, microwave, etc.) mode) to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk SolidState Disk (SSD)), etc.

[0161] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention are within the scope of the technical solution of the present invention.

Claims

1. A method for detecting sensitive data based on big data power dispatch automation, characterized in that: The steps include: S1. Obtain the following data sources: network full flow data, business system data, equipment alarm data and custom data; S2. Behavioral analysis, including baseline analysis, time series analysis and risk assessment, including: The baseline analysis includes a numerical baseline and a nominal baseline; The numerical baseline uses a numerical baseline for quantifiable indicators, which include historical inflow and outflow traffic, historical access port behavior, and historical access host behavior; the nominal baseline uses a nominal baseline for non-quantifiable indicators, which include account frequently used login areas, account usual login time, account frequently used IP addresses, and host historical open ports; The time series analysis determines whether it is an abnormal operation at an abnormal time by comparing the timestamp of the access data with the historical access time, the active access time period, and the survival status; The risk assessment determines whether there are abnormalities in sensitive data through matrix characteristics; S3. Determination of abnormal behavior events; abnormal behavior events include: Read the firewall and intrusion detection system logs to check whether there are any illegal external devices; Illegal access to the database: Detect whether the user has illegally accessed and operated the database; Abnormal transmission of sensitive data: Detect whether database data has been screenshoted and whether key data has been copied; S4, scene prediction alarm; The S2 is specifically: Definition 1: Numerical abnormal baseline monitoring method; Definition 1.1 Unit numerical monitoring method; The numerical data set to be monitored X = {x1, x2, x3…x n }, where x n ∈R n , i,n∈ positive integers, R represents a real number; u i Represents the data set x i The mean of σ 2 Represents the data set x i The variance of p i (x) represents the data set X i The distribution function of the internal data, Represents X i If they are all independent, the numerical array distribution function is p(X); if p(X)<ε, it is considered abnormal, where ε is the boundary value ε∈(0,1) set by the maintenance personnel; Definition 1.2 Multivariate numerical monitoring method; Numerical data set to be monitored X i ={x1,x2,x3…x n }, where x i , X i ∈R n , i,n∈positive integers, R represents a real number, Σ∈R n×n ; q i (x) represents the data set X i The distribution function of the internal data; Among them, x n There is a positive correlation between x n Negative phase between Represents x i If they are not independent, the distribution function of the numeric array is p(X); If q(X)<ε2, it is considered abnormal, where ε2 is the boundary value ε2∈(0,1) set by the maintenance personnel; Definition 2: Time series anomaly analysis baseline; Time series behavior data group X to be monitored i ={x1,x2,x3…x n }, x n Represents the nth access behavior, and defines m to represent x i Appears m times, n∈positive integer, m∈non-negative integer; W(x i ) represents x i The activity level of in the time series; H i (x) represents X i Level of confusion; If H i (x)<ε3 is considered abnormal, where ε3 is the boundary value ε3∈(0,1) set by the maintenance personnel; Definition 3, Define the d eigenvalues ​​H of different attributes in 2 d (x), construct the risk monitoring matrix B, the eigenvalues ​​include IP port and data packet size; The feature matrix of the data to be monitored is {H K (1)…H K (d)}, and each column of the risk monitoring matrix B is calculated as defined in 3.1 to generate a new matrix C; Definition 3.1 C=[θ1…θ n ], indicating the abnormality of the features of each dimension; If θ n <ε4 is considered abnormal, where ε is the boundary value ε4∈(0,1) set by the maintenance personnel, and the abnormality θ in C n The more there are, the higher the risk value of the monitored object.

2. According to the method for detecting sensitive data of power dispatch automation based on big data in claim 1, it is characterized by: The network full flow data includes: the request-response protocol content of the entire dispatching data network and the external interface of the power dispatching automation system, user dialogue information and file information flow; The business system data is: to learn the normal behavior baseline of the account, discover its abnormal behavior, collect the activity data of the identity authentication, authorization, accounting and audit system accounts, enterprise office accounts and other business system accounts; The device alarm data includes: process activity logs, network activity logs, and file operation logs of the host terminal; firewalls, intrusion detection systems, and website application-level defense systems transmitted through system logs; The customized data includes terminals and terminal ports customized by the maintainer and sensitive services customized by the maintainer.

3. According to claim 1, the method for detecting sensitive data in power dispatch automation based on big data is characterized in that: The S4 is specifically: constructing sensitive data event scenarios through abnormal event feature analysis results, including: former employees stealing sensitive data, internal personnel negligent destruction, account theft leading to sensitive data leakage, and sensitive data being captured.

4. A sensitive data detection system for power dispatch automation based on big data, characterized by: include: Data acquisition module, which acquires the following data sources: network full flow data, business system data, equipment alarm data and custom data; Analysis module, behavioral analysis; specifically including baseline analysis, time series analysis and risk assessment, including: The baseline analysis includes a numerical baseline and a nominal baseline; The numerical baseline uses a numerical baseline for quantifiable indicators, which include historical inflow and outflow traffic, historical access port behavior, and historical access host behavior; the nominal baseline uses a nominal baseline for non-quantifiable indicators, which include account frequently used login areas, account usual login time, account frequently used IP addresses, and host historical open ports; The time series analysis determines whether it is an abnormal operation at an abnormal time by comparing the timestamp of the access data with the historical access time, the active access time period, and the survival status; The risk assessment determines whether there are abnormalities in sensitive data through matrix characteristics; Determination module, abnormal behavior event determination; abnormal behavior events include: Read the firewall and intrusion detection system logs to check whether there are any illegal external devices; Illegal access to the database: Detect whether the user has illegally accessed and operated the database; Abnormal transmission of sensitive data: Detect whether database data has been screenshoted and whether key data has been copied; Early warning module, scene prediction alarm The specific analysis process of the analysis module is as follows: Definition 1: Numerical abnormal baseline monitoring method; Definition 1.1 Unit numerical monitoring method; The numerical data set to be monitored X = {x1, x2, x3…x n }, where x n ∈R n , i,n∈ positive integers, R represents a real number; u i Represents the data set x i The mean of σ 2 Represents the data set x i The variance of p i (x) represents the data set X i The distribution function of the internal data, Represents X i If they are all independent, the numerical array distribution function is p(X); if p(X)<ε, it is considered abnormal, where ε is the boundary value ε∈(0,1) set by the maintenance personnel; Definition 1.2 Multivariate numerical monitoring method; Numerical data set to be monitored X i ={x1,x2,x3…x n }, where x i , X i ∈R n , i,n∈positive integers, R represents a real number, Σ∈R n×n ; q i (x) represents the data set X i The distribution function of the internal data; Among them, x n There is a positive correlation between x n Negative phase between Represents x i If they are not independent, the distribution function of the numeric array is p(X); If q(X)<ε2, it is considered abnormal, where ε2 is the boundary value ε2∈(0,1) set by the maintenance personnel; Definition 2: Time series anomaly analysis baseline; Time series behavior data group X to be monitored i ={x1,x2,x3…x n }, x n Represents the nth access behavior, and defines m to represent x i Appears m times, n∈positive integer, m∈non-negative integer; W(x i ) represents x i The activity level of in the time series; H i (x) represents X i Level of confusion; If H i (x)<ε3 is considered abnormal, where ε3 is the boundary value ε3∈(0,1) set by the maintenance personnel; Definition 3, Define the d eigenvalues ​​H of different attributes in 2 d (x), construct the risk monitoring matrix B, the eigenvalues ​​include IP port and data packet size; The feature matrix of the data to be monitored is {H K (1)…H K (ε)}, and each column of the risk monitoring matrix B is calculated as defined in 3.1 to generate a new matrix C; Definition 3.1 C=[θ1…θ n ], indicating the abnormality of the features of each dimension; If θ n <ε4 is considered abnormal, where ε is the boundary value ε4∈(0,1) set by the maintenance personnel, and the abnormality θ in C n The more there are, the higher the risk value of the monitored object.

5. According to the big data-based power dispatching automation sensitive data detection system of claim 4, it is characterized by: The network full flow data includes: the request-response protocol content of the entire dispatching data network and the external interface of the power dispatching automation system, user dialogue information and file information flow; The business system data is: to learn the normal behavior baseline of the account, discover its abnormal behavior, collect the activity data of the identity authentication, authorization, accounting and audit system accounts, enterprise office accounts and other business system accounts; The device alarm data includes: process activity logs, network activity logs, and file operation logs of the host terminal; firewalls, intrusion detection systems, and website application-level defense systems transmitted through system logs; The customized data includes terminals and terminal ports customized by the maintainer and sensitive services customized by the maintainer.

6. According to claim 4, the system for detecting sensitive data of electric power dispatch automation based on big data is characterized in that: The early warning module specifically constructs sensitive data event scenarios through abnormal event feature analysis results, including: former employees stealing sensitive data, internal personnel negligent damage, account theft leading to sensitive data leakage, and sensitive data being captured.

7. An information data processing terminal that implements the sensitive data detection method for automated power dispatching based on big data as described in any one of claims 1 to 3.

8. A computer-readable storage medium, comprising instructions, which, when executed on a computer, enables the computer to execute the method for detecting sensitive data based on big data power dispatch automation as described in any one of claims 1 to 3.

Images