A method and system for analyzing operation and maintenance risks of power monitoring system

Abstract

The present invention discloses a method for analyzing the operation and maintenance risks of an electric power monitoring system, the method comprising: obtaining text data of the operation behavior of a target object within a set time period; using a preset multi-level analysis model and a stream processing calculation framework to perform correlation analysis on the obtained text data to obtain a real-time score of the operation behavior of the target object; obtaining a threat index of the operation behavior based on the real-time score, and determining the risk level according to the threat index. The present invention can quickly confirm the operation and maintenance risks of the electric power monitoring system, greatly reducing the potential safety hazards of the electric power monitoring system.

Description

Technical Field

[0001] The invention relates to a method and system for analyzing operation and maintenance risks of an electric power monitoring system, and belongs to the technical field of power grids. Background Art

[0002] In the context of increasingly fierce network security confrontation and attacks, the power industry will face many challenges and opportunities; at the same time, domestic laws and regulations have also put forward higher requirements for network security in the power industry. Special inspections on security protection have found that more and more security issues in the current power monitoring system security protection system come from within, especially unauthorized operations of internal personnel in the operation and maintenance process, or operation and maintenance operations by unauthorized personnel will introduce additional risks into the power monitoring system. For example, mobile media and device access, illegal login and use of the host, and deletion of key directory files. Then it is very important to conduct a comprehensive security assessment of personnel behavior and operation and maintenance operations. However, the existing security audits of personnel behavior and operation and maintenance operations are based on analysis and research on a single moment and a single behavior record.

[0003] At present, the security protection system of the power monitoring system can collect and display dangerous operation records for personnel behavior and operation and maintenance operations according to certain rules, which improves safety to a certain extent and supports the network security construction of the power monitoring system. However, with the continuous deepening and expansion of business, operation behaviors have become more frequent and complex, and the problems that come with it have become increasingly prominent. The main problems include: the analysis of behavior records is still at a single level, and there is no effective integration and correlation analysis of various behavior records, and an objective comprehensive safety evaluation of behavior operations has not been made; the target object lacks a fast and timely means of discovering malicious behavior of internal personnel, and can only be discovered through the later audit of operation logs, which is inefficient and time-consuming, and cannot detect abnormalities and block them in the initial stage. Summary of the invention

[0004] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a method and system for analyzing the operation and maintenance risks of a power monitoring system, which can facilitate rapid confirmation of the impact of operating behaviors on the operation and maintenance risks of the power monitoring system, and greatly reduce the potential safety hazards of the power monitoring system. To achieve the above purpose, the present invention is implemented by adopting the following technical solutions:

[0005] In a first aspect, the present invention provides a method for analyzing operation and maintenance risks of a power monitoring system, the method comprising:

[0006] Obtain text data of the target object's operation behavior within a set time period;

[0007] Use the preset multi-level analysis model and stream processing computing framework to perform correlation analysis on the acquired text data to obtain real-time scores of the target object's operation behavior;

[0008] The threat index of the operation behavior is obtained based on the real-time scoring, and the risk level is determined according to the threat index.

[0009] In combination with the first aspect, further, the obtaining of text data of the operation behavior of the target object within a set time period includes:

[0010] Acquire real-time signals generated by the host, network equipment, security equipment and database in the power monitoring system in response to the operation behavior of the target object within a set time period;

[0011] The acquired real-time signal is parsed and formatted to obtain text data of the target object's operation behavior within a set time period.

[0012] In combination with the first aspect, further, the stream processing computing framework is a Spark stream processing framework, which adopts a Spark sliding window computing method, the window time length of the Spark sliding window is 10 minutes, and the sliding time interval is 10 seconds.

[0013] In combination with the first aspect, further, obtaining a real-time score of the target object's operation behavior includes:

[0014] Perform correlation analysis on the acquired text data of the target object's operation behavior and the preset multi-level analysis model to determine the type of the target object's operation behavior;

[0015] Based on the type of the target object's operation behavior, the weight corresponding to the type is matched from the preset multi-level analysis model, and the real-time score of the target object's operation behavior is calculated using the preset formula.

[0016] In combination with the first aspect, further, the preset formula is expressed by the following formula:

[0017]

[0018] In formula (1), X j Indicates the operation behavior corresponding to type j. When the operation behavior of the target object matches type j, then X j =1, otherwise X j =0; W j represents the weight corresponding to type j; Z represents the real-time score of the target object's operation behavior.

[0019] In combination with the first aspect, further, the weight corresponding to the type of the operation behavior is obtained by training through the following steps:

[0020] Initialize historical data, including m pieces of data, each piece of data includes n influencing factors, and get matrix A:

[0021]

[0022] In (2), the matrix A includes m rows of historical data, each row represents n operation behaviors of each data; the matrix A includes n columns of operation behaviors, each column represents the characteristic value of a certain operation behavior;

[0023] Take the element x in the i-th row and j-th column of matrix A ij , for element x ij Normalization is performed, and i∈{1,2,...m}, j∈{1,2,....n}; the normalized element x' ij Get the normalized matrix A';

[0024] Based on the normalized matrix A', calculate the proportion P of the i-th data in the j-th column operation behavior ij , calculated by the following formula:

[0025]

[0026] Calculate the entropy value of the j-th indicator and get it by the following formula:

[0027]

[0028] (4) In E j represents the entropy value of the j-th indicator; m represents the total number of samples, and there are m rows of records; based on the entropy value of the j-th indicator, the weight is determined:

[0029]

[0030] (5) In j represents the weight of the j-th indicator;

[0031] The preset multi-level analysis model has j columns of operation behaviors, and the weight of each column of operation behavior is W j , get the weight corresponding to the type of operation behavior.

[0032] In combination with the first aspect, further, determining the risk level according to the threat index includes:

[0033] The real-time score of the target object's operation behavior is mapped to a preset interval to obtain a mapping result of the real-time score in the interval, and the mapping result is the threat index of the operation behavior.

[0034] When the threat index is in the first interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is low risk;

[0035] When the threat index is in the second interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is medium risk;

[0036] When the threat index is in the third interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is high risk;

[0037] The minimum value of the first interval is the minimum value of the preset interval, the maximum value of the first interval is less than the minimum value of the second interval, the maximum value of the second interval is less than the minimum value of the third interval, and the maximum value of the third interval is the maximum value of the preset interval.

[0038] In combination with the first aspect, further, the method further includes:

[0039] The historical operation behavior data and real-time scores are stored in the distributed storage system, and the obtained risk levels are stored in the non-relational database Redis.

[0040] In a second aspect, the present invention provides a power monitoring system operation and maintenance risk analysis system, comprising:

[0041] Acquisition module: used to acquire text data of the target object's operation behavior within a set time period;

[0042] Processing module: used to use the preset multi-level analysis model and stream processing computing framework to perform correlation analysis on the acquired text data and obtain the real-time score of the target object's operation behavior;

[0043] Judgment module: used to obtain the threat index of the operation behavior based on real-time scoring and determine the risk level according to the threat index.

[0044] In a third aspect, the present invention provides a computer device, including a processor and a storage medium;

[0045] The storage medium is used to store instructions;

[0046] The processor is used to operate according to the instructions to execute the steps of the method described in the first aspect.

[0047] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0048] Compared with the prior art, the advantageous effects achieved by the method and system for analyzing the operation and maintenance risks of a power monitoring system provided by the embodiment of the present invention include:

[0049] The present invention obtains text data of the operation behavior of the target object within a set time period; uses a preset multi-level analysis model and a stream processing calculation framework to perform correlation analysis on the obtained text data to obtain a real-time score of the operation behavior of the target object; the present invention performs correlation analysis with the multi-level analysis model, can effectively integrate each isolated operation behavior, and perform real-time security assessment of the operation behavior of the target object based on the multi-level analysis model;

[0050] The present invention obtains the threat index of the operation behavior based on real-time scoring, and determines the risk level according to the threat index; the present invention can obtain the accurate value of the threat index of the operation behavior, can quickly confirm the operation and maintenance risk level of the power monitoring system, and the obtained risk level can objectively reflect the impact of the operation behavior on the operation and maintenance risk of the power monitoring system; the present invention facilitates the rapid confirmation of the abnormality of the power monitoring system, and greatly reduces the safety hazards of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is a flow chart of a method for analyzing operation and maintenance risks of a power monitoring system provided in Embodiment 1 of the present invention;

[0052] Figure 2 It is a structural diagram of a multi-level analysis model in a method for analyzing operation and maintenance risks of a power monitoring system provided in the first embodiment of the present invention;

[0053] Figure 3 This is a network architecture diagram of a method for analyzing operation and maintenance risks of a power monitoring system provided in Embodiment 1 of the present invention;

[0054] Figure 4 It is a network architecture diagram of obtaining target object operation behavior of a method for analyzing operation and maintenance risk of a power monitoring system provided in the first embodiment of the present invention;

[0055] Figure 5 It is a schematic diagram of the threat index trend of a method for analyzing the operation and maintenance risks of a power monitoring system provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0056] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0057] Embodiment 1:

[0058] like Figure 1 The embodiment of the present invention provides a method for analyzing operation and maintenance risks of a power monitoring system, comprising:

[0059] Obtain text data of the target object's operation behavior within a set time period;

[0060] Use the preset multi-level analysis model and stream processing computing framework to perform correlation analysis on the acquired text data to obtain real-time scores of the target object's operation behavior;

[0061] The threat index of the operation behavior is obtained based on the real-time scoring, and the risk level is determined according to the threat index.

[0062] The target object operation behaviors include abnormal login, plugging and unplugging of external devices, abnormal access, illegal opening of ports, modification of configuration, change of permissions and issuance of important operation instructions. The target object refers to the operator who performs the operation behavior.

[0063] like Figure 2 As shown in the figure, the target object operation behaviors specifically include:

[0064] ① Login anomaly refers to the existence of login anomalies when the target object logs into any one or more of the host, database, network equipment and security equipment of the power monitoring system, including local login failure of the target object, remote login failure of the target object and unauthorized target object login.

[0065] ② External device plugging and unplugging refers to the target object illegally plugging and unplugging the serial port devices and USB devices of the host in the power monitoring system.

[0066] ③ Access anomaly refers to one or more of the following operation behaviors of the target object in the power monitoring system, including abnormal access to services, abnormal access to data, access to multiple ports, illegal access to data, and use of SSH passwords.

[0067] Among them, abnormal access includes abnormal access to SMB service, abnormal access to SNMP service and abnormal access to FTP service.

[0068] The abnormal access data refers to illegal access to sensitive data and illegal export of data.

[0069] The access to multiple ports refers to the target object accessing multiple ports of the host simultaneously.

[0070] The use of SSH passwords refers to the target object using SSH viruses to invade the power monitoring system and conduct a large number of abnormal accesses, or the target object using SSH passwords to conduct a large number of accesses to the power monitoring system due to business needs. This abnormal operation behavior requires on-site confirmation by the operator.

[0071] ④ Illegal opening of ports refers to the illegal opening of ports by the target object in the power monitoring system host, including illegal opening of FTP protocol ports, illegal opening of TELENT protocol ports, illegal opening of TCP protocol ports and illegal opening of other ports. Illegal opening of ports will lead to network intrusion.

[0072] ⑤ Modifying the configuration means that the target object modifies the configuration file of the power monitoring system host, modifies the configuration items of the power monitoring system security equipment, modifies the configuration of the power monitoring system network equipment, and modifies the configuration of the power monitoring system database.

[0073] ⑥ Changing permissions refers to the target object changing the host's file access permissions, changing the host's file owner, and changing user permissions. Changing permissions will cause the system to crash; among them, changing the host's file access permissions includes changing file executable permissions, changing write file permissions, and changing read file permissions.

[0074] ⑦ Issuing important operation commands refers to the target object issuing dangerous operation commands to the host, database, and network equipment, including issuing operation commands to delete key files and issuing operation commands to maliciously change database data.

[0075] Specifically, the preset multi-level analysis model is set up with 7 modules according to the operation behavior of the target object, including login exception module, external device plug-in module, access exception module, illegal open port module, configuration modification module, permission change module and important operation instruction module.

[0076] like Figure 4 As shown, the text data of the operation behavior of the target object within the set time period is obtained, including:

[0077] Acquire real-time signals generated by the host, network equipment, security equipment and database in the power monitoring system in response to the operation behavior of the target object within a set time period;

[0078] The acquired real-time signal is parsed and formatted to obtain text data of the target object's operation behavior within a set time period.

[0079] like Figure 3 As shown, text data is acquired through the Kafka data pipeline. The Kafka data pipeline is equipped with an agent collection program. The agent collection program is used to collect real-time signals generated by the host, network equipment, security equipment and database in response to the operation behavior of the target object. The agent collection program executes collection commands or continuously receives data at fixed intervals.

[0080] like Figure 3 As shown, the stream processing computing framework is the Spark stream processing framework, which is equipped with computing logic, and the computing logic is the computing logic for obtaining the real-time scoring of the operation behavior of the target object. The Spark stream processing framework adopts the Spark sliding window computing method, and performs a real-time scoring of all the operation behaviors of the target object within the last 10 minutes every 10 seconds.

[0081] Get real-time scores of the target object's operational behavior, including:

[0082] Perform correlation analysis on the acquired text data of the target object's operation behavior and the preset multi-level analysis model to determine the type of the target object's operation behavior;

[0083] Based on the type of the target object's operation behavior, the weight corresponding to the type is matched from the preset multi-level analysis model, and the real-time score of the target object's operation behavior is calculated using the preset formula.

[0084] Specifically, the preset formula is expressed by the following formula:

[0085]

[0086] In formula (1), X j Indicates the operation behavior corresponding to type j. When the operation behavior of the target object matches type j, then X j =1, otherwise X j =0; W j represents the weight corresponding to type j; Z represents the real-time score of the target object's operation behavior.

[0087] The weights corresponding to the types of operation behaviors in the preset multi-level analysis model are trained through the following steps:

[0088] Step 1: Initialize historical data, including m pieces of data, each piece of data includes n influencing factors, and obtain matrix A:

[0089]

[0090] In (2), the matrix A includes m rows of historical data, each row represents n operation behaviors of each data; the matrix A includes n columns of operation behaviors, each column represents the characteristic value of a certain operation behavior.

[0091] Step 2: Take the element x in the i-th row and j-th column of matrix A. ij , for element x ij Normalize, and i∈{1,2,...m}, j∈{1,2,....n}; According to the entropy method, if the element x ij The greater the discretization degree, the greater the influence of the operation behavior corresponding to the element in the preset multi-level analysis model, and the greater the weight given to the element.

[0092] Specifically, the purpose of normalization is to eliminate the differences in meaning, measurement, and magnitude between elements. Normalization includes:

[0093] When the element x ij The larger the eigenvalue is, the smaller the difference between it and other indicators is. The normalization formula is:

[0094]

[0095] When the element x ij The smaller the eigenvalue is, the smaller the difference between it and other indicators is, and the normalization formula is:

[0096]

[0097] In (3) and (4), x' ij Represents the normalized element; x j represents the characteristic value of the operation behavior of the jth column, x max represents the maximum value of the characteristic value of the operation behavior in the jth column of historical data, x min Indicates the minimum value of the characteristic value of the operation behavior in the jth column in the historical data.

[0098] Step 3: From the normalized element x' ij Get the normalized matrix A'.

[0099] Based on the normalized matrix A', calculate the proportion P of the i-th data in the j-th column operation behavior ij , specific gravity P ij To measure x' ij The probability of a particular eigenvalue occurring is related to x' ij The eigenvalue size is irrelevant. ij Calculated by the following formula:

[0100]

[0101] Calculate the entropy value of the j-th indicator and get it by the following formula:

[0102]

[0103] (6) In E j represents the entropy value of the j-th indicator; m represents the total number of samples, and there are m rows of records; based on the entropy value of the j-th indicator, the weight is determined:

[0104]

[0105] (7) In j Represents the weight of the j-th indicator.

[0106] Step 4: The preset multi-level analysis model has j columns of operation behaviors, and the weight of each column of operation behavior is W j , get the weight corresponding to the type of operation behavior.

[0107] Determine the risk level based on the threat index, including:

[0108] The real-time score of the target object's operation behavior is mapped to a preset interval to obtain a mapping result of the real-time score in the interval, and the mapping result is the threat index of the operation behavior.

[0109] When the threat index is in the first interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is low risk;

[0110] When the threat index is in the second interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is medium risk;

[0111] When the threat index is in the third interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is high risk;

[0112] The minimum value of the first interval is the minimum value of the preset interval, the maximum value of the first interval is less than the minimum value of the second interval, the maximum value of the second interval is less than the minimum value of the third interval, and the maximum value of the third interval is the maximum value of the preset interval.

[0113] Specifically, the preset interval is [0, 100], then the first interval is [0, 43], the second interval is (43, 76], and the third interval is (76, 100].

[0114] like Figure 3 As shown, it also includes: storing historical operation behavior data and real-time scores in a distributed storage system, and storing the obtained risk levels in a non-relational database Redis.

[0115] The historical operation behavior data and real-time scores stored in the distributed storage system are easy to read and used to provide data support for troubleshooting.

[0116] Embodiment 2:

[0117] An embodiment of the present invention provides a power monitoring system operation and maintenance risk analysis system, including:

[0118] Acquisition module: used to acquire text data of the target object's operation behavior within a set time period;

[0119] Processing module: used to use the preset multi-level analysis model and stream processing computing framework to perform correlation analysis on the acquired text data and obtain the real-time score of the target object's operation behavior;

[0120] Judgment module: used to obtain the threat index of the operation behavior based on real-time scoring and determine the risk level according to the threat index.

[0121] The power monitoring system operation and maintenance risk analysis system also includes a display module for displaying the impact of the target object's operation behavior on the power monitoring system operation and maintenance risk within a set time period. The display module displays a yellow-green icon when the risk level is low; an orange-yellow icon when the risk level is medium; and a red icon when the risk level is high.

[0122] Embodiment three:

[0123] Using the method described in Example 1 and the system described in Example 2, taking the text data of the target object's operation behavior obtained by the relevant operating units of the State Grid Corporation from 09:25:06 to 12:20:21 on November 23, 2019 as an example, all operation behaviors of the target object in the last 10 minutes are scored in real time every 10 seconds, and the threat index of the operation behavior is obtained based on the real-time score.

[0124] like Figure 5 As shown, a line graph of the threat index within the time period is generated with time as the horizontal axis and the threat index as the vertical axis.

[0125] Specifically, from 09:26 to 09:50, the target object illegally opened ports, illegally exported data, and unplugged USB devices; from 09:54 to 10:15, the target object simultaneously accessed multiple ports of the host and the host's file access rights; from 10:20 to 10:28, the target object modified the configuration of the power monitoring system network equipment. Figure 5 It can be seen that the threat index increased significantly during the above time period. When the operation behavior ended, the threat index decreased. When the target object performed the operation behavior normally, the threat index was stable. The line chart of the threat index can clearly and intuitively show the changing trend of the threat index in the current time period.

[0126] Embodiment 4:

[0127] An embodiment of the present invention provides a computer device, including a processor and a storage medium;

[0128] The storage medium is used to store instructions;

[0129] The processor is used to operate according to the instructions to execute the steps of the method described in embodiment 1.

[0130] Embodiment five:

[0131] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the method described in the first embodiment are implemented.

[0132] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0133] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0134] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0135] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0136] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for analyzing the operation and maintenance risks of a power monitoring system, characterized in that: include: Acquiring text data of the operation behavior of the target object within a set time period; wherein the acquiring text data of the operation behavior of the target object within the set time period includes: Acquire real-time signals generated by the host, network equipment, security equipment and database in the power monitoring system in response to the operation behavior of the target object within a set time period; Parse and format the acquired real-time signal to obtain text data of the target object's operation behavior within a set time period; The text data is acquired through the Kafka data pipeline. The Kafka data pipeline is equipped with an agent collection program. The agent collection program is used to collect real-time signals generated by the host, network equipment, security equipment and database in response to the operation behavior of the target object. The agent collection program executes the collection command or continuously receives data at fixed intervals; Use the preset multi-level analysis model and stream processing computing framework to perform correlation analysis on the acquired text data to obtain real-time scores of the target object's operation behavior; The stream processing computing framework is a Spark stream processing framework, which uses a Spark sliding window computing method. The window time length of the Spark sliding window is 10 minutes, and the sliding time interval is 10 seconds. The real-time scoring of the operation behavior of the target object is obtained, including: Perform correlation analysis on the acquired text data of the target object's operation behavior and the preset multi-level analysis model to determine the type of the target object's operation behavior; Based on the type of the target object's operation behavior, the weight corresponding to the type is matched from the preset multi-level analysis model, and the real-time score of the target object's operation behavior is calculated using a preset formula; Wherein, the preset formula is expressed by the following formula: In formula (1), X j Indicates the operation behavior corresponding to type j. When the operation behavior of the target object matches type j, then X j =1, otherwise X j =0; W j represents the weight corresponding to type j; Z represents the real-time score of the target object's operation behavior; The threat index of the operation behavior is obtained based on the real-time scoring, and the risk level is determined according to the threat index; wherein the risk level is determined according to the threat index, including: Mapping the real-time score of the target object's operation behavior into a preset interval to obtain a mapping result of the real-time score within the interval, wherein the mapping result is a threat index of the operation behavior; When the threat index is in the first interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is low risk; When the threat index is in the second interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is medium risk; When the threat index is in the third interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is high risk; The minimum value of the first interval is the minimum value of the preset interval, the maximum value of the first interval is less than the minimum value of the second interval, the maximum value of the second interval is less than the minimum value of the third interval, and the maximum value of the third interval is the maximum value of the preset interval.

2. The method for analyzing operation and maintenance risks of a power monitoring system according to claim 1, characterized in that: The weights corresponding to the types of operation behaviors are trained through the following steps: Initialize the historical data, which includes m pieces of data, each piece of data includes n operation behaviors, and get the matrix A: In (1), the matrix A includes m rows of historical data, each row represents n operation behaviors of each data; the matrix A includes n columns of operation behaviors, each column represents the characteristic value of a certain operation behavior; Take the element x in the i-th row and j-th column of matrix A ij , for element x ij Normalization is performed, and i∈{1,2,...m}, j∈{1,2,....n}; the normalized element x' ij Get the normalized matrix A'; Based on the normalized matrix A', calculate the proportion P of the i-th data in the j-th column operation behavior ij , calculated by the following formula: Calculate the entropy value E of the j-th column operation behavior j , calculated by the following formula: Based on the entropy value of the jth indicator, determine the weight W of the jth column operation behavior j : The preset multi-level analysis model has j columns of operation behaviors, and the weight of each column of operation behavior is W j , get the weight corresponding to the type of operation behavior.

3. The method for analyzing operation and maintenance risks of a power monitoring system according to claim 1, characterized in that: The method further comprises: The historical operation behavior data and real-time scores are stored in the distributed storage system, and the obtained risk levels are stored in the non-relational database Redis.

4. A power monitoring system operation and maintenance risk analysis system, characterized in that: include: The acquisition module is used to acquire the text data of the operation behavior of the target object within a set time period; wherein the acquisition of the text data of the operation behavior of the target object within the set time period includes: Acquire real-time signals generated by the host, network equipment, security equipment and database in the power monitoring system in response to the operation behavior of the target object within a set time period; Parse and format the acquired real-time signal to obtain text data of the target object's operation behavior within a set time period; Processing module: used to use a preset multi-level analysis model and a stream processing computing framework to perform correlation analysis on the acquired text data, and obtain a real-time score of the target object's operation behavior; wherein the stream processing computing framework is a Spark stream processing framework, and a Spark sliding window calculation method is adopted, and the window time length of the Spark sliding window is 10 minutes, and the sliding time interval is 10 seconds; wherein, obtaining the real-time score of the target object's operation behavior includes: Perform correlation analysis on the acquired text data of the target object's operation behavior and the preset multi-level analysis model to determine the type of the target object's operation behavior; Based on the type of the target object's operation behavior, the weight corresponding to the type is matched from the preset multi-level analysis model, and the real-time score of the target object's operation behavior is calculated using a preset formula; Wherein, the preset formula is expressed by the following formula: In formula (1), X j Indicates the operation behavior corresponding to type j. When the operation behavior of the target object matches type j, then X j =1, otherwise X j =0; W j represents the weight corresponding to type j; Z represents the real-time score of the target object's operation behavior; Judgment module: used to obtain the threat index of the operation behavior based on the real-time score, and determine the risk level according to the threat index; wherein, determining the risk level according to the threat index includes: Mapping the real-time score of the target object's operation behavior into a preset interval to obtain a mapping result of the real-time score within the interval, wherein the mapping result is a threat index of the operation behavior; When the threat index is in the first interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is low risk; When the threat index is in the second interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is medium risk; When the threat index is in the third interval, the impact of all operation behaviors in the set time period on the operation and maintenance risk of the power monitoring system is high risk; The minimum value of the first interval is the minimum value of the preset interval, the maximum value of the first interval is less than the minimum value of the second interval, the maximum value of the second interval is less than the minimum value of the third interval, and the maximum value of the third interval is the maximum value of the preset interval.

5. A computer device, characterized in that: including processor and storage medium; The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the method according to any one of claims 1 to 3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

Images