Network security strategy arrangement and disposal method and system for power monitoring system

Abstract

The present invention discloses a method and system for organizing and handling network security policies for an electric power monitoring system. The method monitors security events of devices within the electric power monitoring system; matches security events with a preset policy library. If the match is successful, the security handling policy corresponding to the security event is obtained from the preset policy library. If the match is unsuccessful, an approximate solution of the policy is calculated based on a genetic algorithm; the security handling policy corresponding to the security event is visually organized based on the approximate solution of the policy; and security handling is implemented based on the obtained security handling policy. The present invention implements behavioral analysis and monitoring and early warning of devices within the electric power monitoring system. The matching method based on the genetic algorithm efficiently calculates approximate handling policies from a large number of alarms, truly realizing active defense of the electric power monitoring system, and solving the main security threats currently facing the electric power monitoring system from the perspectives of monitoring, early warning, and emergency response.

Description

Technical Field

[0001] The present invention relates to a method and system for arranging and handling network security strategies of an electric power monitoring system, and belongs to the field of network security control. Background Art

[0002] For the power monitoring system, the number of information assets is increasing, and the correlation and complexity of the system are constantly increasing. Although the current power monitoring system has certain capabilities of active defense, in-depth defense, and resilient defense, it still faces challenges in system construction and transformation: there are too many network security incident alarms, and effective alarms are drowned out, which cannot effectively help security operation and maintenance and analysis personnel; there is a lack of professional security attack and defense and analysis capabilities, and the experience of disposal personnel in security analysis and judgment is difficult to solidify; security response and disposal time is too long and inefficient; there is a lack of standardized response and disposal processes; there is a lack of quantifiable indicators for security operation and disposal efficiency; there is a lack of overall design and planning, and the linkage between equipment and platforms is limited. Summary of the Invention

[0003] Aiming at the lack of standardized response and handling processes in current power monitoring systems, the present invention provides a method and system for organizing and handling network security policies for power monitoring systems.

[0004] To achieve the above objectives, the present invention adopts the following technical solutions.

[0005] In a first aspect, the present invention provides a method for orchestrating and handling network security policies for a power monitoring system, comprising: monitoring security events of devices within the power monitoring system;

[0006] Match security events with the preset policy library. If the match is successful, the corresponding security handling policy for the security event is obtained from the preset policy library. If the match is unsuccessful, the approximate solution of the policy corresponding to the security event is calculated based on the genetic algorithm, and the corresponding security handling policy for the security event is obtained through visual arrangement based on the approximate solution of the policy.

[0007] Perform security disposal on the internal equipment of the power monitoring system based on the obtained security disposal strategy.

[0008] Furthermore, the internal equipment of the power monitoring system includes at least one of a server, a workstation device, a database device, a network device and a security protection device.

[0009] Furthermore, based on the approximate solution of the policy, visual arrangement is used to obtain the security handling strategy corresponding to the security incident, including:

[0010] Manual decision-making and orchestration are performed on the approximate solution of the strategy of the security incident through a visual interface, and the orchestration results obtained by manual decision-making and orchestration are used as the security disposal strategy corresponding to the security incident, and the orchestration results obtained by manual decision-making and orchestration are stored in a preset strategy library.

[0011] Furthermore, the strategy approximate solution corresponding to the security incident is calculated based on the genetic algorithm, including:

[0012] According to the event content field of the security event, the existing security disposal strategies in the preset strategy library are matched. The gene level of the single gene chromosome individuals corresponding to each existing security disposal strategy is set according to the matching similarity, and the weight of each single gene chromosome individual is set. The sum of all gene chromosome individual weights is 1;

[0013] Determining a fitness function of the gene chromosome individual according to the weight and gene level of the gene chromosome individual, and determining the fitness of the gene chromosome individual using the fitness function;

[0014] According to the fitness of the gene chromosome individuals, each gene chromosome individual is selected, and hybridization and mutation operations are performed on each gene chromosome individual to evolve to the next generation; the next generation is repeatedly selected, hybridized and mutated until the termination condition is met, then the evolution stops, the optimal gene chromosome individual is output, and the optimal gene chromosome individual is determined as the strategy approximate solution corresponding to the security event.

[0015] Furthermore, the fitness function is expressed as follows:

[0016]

[0017] in is the fitness of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations, is the i-th gene chromosome individual of the k-th generation; W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual.

[0018] Based on the above technical solution, the fitness function in other embodiments is expressed as follows:

[0019]

[0020] in is the fitness of the kth generation population with a single gene chromosome individual, k = 1, ..., Km, Km is the maximum number of iterations, W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual, N k is the population size of the kth generation.

[0021] In a second aspect, the present invention further provides a network security policy arrangement and disposal system for a power monitoring system, comprising an attack identification module, a policy adaptive arrangement module, a visual arrangement module, and a disposal module; wherein:

[0022] The attack identification module is used to monitor security events of internal equipment of the power monitoring system;

[0023] The policy adaptive orchestration module is used to match security events with the preset policy library. If the match is successful, the security handling policy corresponding to the security event is obtained from the preset policy library. If the match is unsuccessful, an approximate solution of the policy corresponding to the security event is calculated based on a genetic algorithm.

[0024] The visual orchestration module is used to obtain the security handling strategy corresponding to the security incident by visual orchestration according to the policy approximate solution;

[0025] The processing module is used to perform security processing on the internal equipment of the power monitoring system based on the obtained security processing strategy.

[0026] Furthermore, the strategy adaptive orchestration module includes a genetic algorithm calculation module, and the genetic algorithm calculation module is used to:

[0027] According to the event content field of the security event, the existing security disposal strategies in the preset strategy library are matched. The gene level of the single gene chromosome individuals corresponding to each existing security disposal strategy is set according to the matching similarity, and the weight of each single gene chromosome individual is set. The sum of all gene chromosome individual weights is 1;

[0028] Determining a fitness function of the gene chromosome individual according to the weight and gene level of the gene chromosome individual, and determining the fitness of the gene chromosome individual using the fitness function;

[0029] According to the fitness of each gene chromosome individual, each gene chromosome individual is selected, and hybridization and mutation operations are performed on each gene chromosome individual to evolve to the next generation; the next generation is repeatedly selected, hybridized and mutated until the termination condition is met, then the evolution stops, the optimal gene chromosome individual is output, and the optimal gene chromosome individual is determined as the strategy approximate solution corresponding to the security event.

[0030] Furthermore, the fitness function used by the genetic algorithm calculation module is expressed as follows:

[0031]

[0032] in is the fitness of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations, is the i-th gene chromosome individual of the k-th generation; W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual.

[0033] Based on the above technical solution, the fitness function used by the genetic algorithm calculation module in other embodiments is expressed as follows:

[0034]

[0035] in is the fitness of the single gene chromosome individual in the kth generation population, W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations.

[0036] The beneficial effects achieved by the present invention are:

[0037] The method and system for organizing and handling network security policies for a power monitoring system provided by the present invention realize behavioral analysis and monitoring and early warning of the internal equipment of the power monitoring system. The matching method based on the genetic algorithm efficiently calculates approximate handling strategies from massive alarms, truly realizing active defense of the power monitoring system, and solving the main security threats currently faced by the power monitoring system from the perspectives of monitoring, early warning and emergency response.

[0038] The present invention monitors the security incidents of the internal equipment of the power monitoring system, builds a security incident handling workflow in series and parallel, deeply integrates people, security technology and processes through adaptive orchestration technology, automatically triggers different security devices to perform response actions, and achieves a more comprehensive, end-to-end understanding of the context of security incidents. It helps to convert complex incident response processes and tasks into consistent, repeatable, measurable and effective workflows, and transform passive emergency response into automated continuous response; visual operation ensures the accuracy of policy matching and improves the clarity and real-time performance of security emergency handling. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 A schematic diagram of the process flow of the security policy adaptive orchestration and handling system provided by an embodiment of the present invention;

[0040] Figure 2 A schematic diagram of an approximate solution flow based on a genetic algorithm calculation strategy provided by an embodiment of the present invention;

[0041] Figure 3 A schematic diagram of a visual orchestration process for a security handling strategy provided by an embodiment of the present invention;

[0042] Figure 4 A schematic diagram of the process flow of the security policy adaptive orchestration and handling method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The present invention will be further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention.

[0044] Example 1: A network security strategy arrangement and disposal system for a power monitoring system, comprising an attack identification engine (i.e., an attack identification module), a strategy adaptive arrangement engine (i.e., a strategy adaptive arrangement module), a visualization arrangement engine (i.e., a visualization arrangement module), and a disposal engine (i.e., a disposal module). The system executes the following steps: Figure 1 The security policy adaptive orchestration and handling process shown includes:

[0045] Step 1: The attack identification engine monitors security events of internal equipment in the power monitoring system.

[0046] Monitor the security events of each device in the power monitoring system collected by the network security monitoring device, analyze the security events, and clarify the data source and data type.

[0047] The types of collection objects and security event contents mainly include: server and workstation equipment monitoring login and logout, CPU memory usage, USB insertion and removal, etc.; database equipment monitoring database table space usage, database operation status, etc.; network equipment monitoring IP connection information, MAC address conflicts, etc.; security protection equipment monitoring attack alarms, access that does not comply with security policies, etc.

[0048] The format for parsing security events is: <Level><Space>Date<Space>Time<Space>Device or System<Space>Behavior<Space>Reason. The "Level" field uses numbers to represent the alarm level, and the corresponding relationship is: 1 represents emergency, 2 represents important, 3 represents monitoring, 4 represents general, and 5 represents notification; the "Device or System" field represents the device identifier that generated the event, which can be the device's host name, IP address, or IP address plus host name, which is determined by different collection objects; the "Behavior" field is defined as the type of device that generates or uploads the event, and the corresponding relationship is shown in Table 1; the "Reason" field is defined as the specific event content, which is composed of: <Event Type><Space><Event Subtype><Space><Content>. According to the technical specifications of network security monitoring devices, the "Content" field divides security events into four categories: equipment failure, security event, operation abnormality, and human operation. Example: <1> 2021-08-12 20:12:23 svr01 SVR 5 25 TCP 10.1.1.1 4099 10.2.2.2 80, svr01 is the server name identifier.

[0049] Table 1 Device type value definition table

[0050] FW Firewall FID Lateral positive isolation device BID Lateral reverse isolation device SVR server SW switch VEAD Vertical encryption device AV Antivirus system IDS Intrusion Detection System DB database DCD Network security monitoring device

[0051] After the attack identification engine identifies the event source, event type, and event content, it pushes the details to the policy adaptive orchestration engine.

[0052] Step 2: The policy adaptive orchestration engine matches security events with the preset policy library. If the match is successful, the security disposal policy corresponding to the security event is obtained from the preset policy library and pushed to the disposal engine. If the match fails, the policy approximate solution is calculated based on the genetic algorithm and pushed to the visual orchestration engine.

[0053] Taking security incidents pushed by the attack identification engine as an example, the policy adaptive orchestration engine uses polling to match the security incident's source, type, level, and content fields with the alarm level, alarm content, and other fields of the existing security response policies in the preset policy library (see Table 2). A successful match indicates that a corresponding response policy exists in the preset policy library for the security incident. The corresponding security response policy is retrieved from the preset policy library and pushed to the response engine for processing. A failed match indicates that no corresponding security response policy exists in the preset policy library for the security incident. An approximate solution for the corresponding policy must be calculated using a genetic algorithm and pushed to the visual orchestration engine for manual decision-making and orchestration.

[0054] Table 2 Security event alarm description

[0055]

[0056]

[0057] Taking the security incident pushed by the attack identification engine as an example, the strategy approximate solution corresponding to the security incident in the preset strategy library is calculated based on the genetic algorithm. Figure 2 ):

[0058] Step 1) There are N gene chromosome individuals in the preset strategy library (one treatment strategy corresponds to one gene chromosome individual, and the weight of each gene chromosome individual is set. The weight of each gene chromosome individual is a random increasing sequence starting from 0 and the sum is 1). The event content field of the security event is matched with the similar alarm content field of the strategy in the preset strategy library to obtain the matching similarity. According to the matching similarity, the gene level of each gene chromosome individual is set in an increasing sequence starting from 0.

[0059] Step 2) determining the fitness function of the gene chromosome individual according to the weight and gene level of the gene chromosome individual, and determining the fitness of the gene chromosome individual using the fitness function;

[0060] In a specific embodiment, the fitness function can be calculated according to the following formula (1):

[0061]

[0062] Where W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual, is the individual with the i-th gene chromosome in the k-th generation.

[0063] The fitness of each gene chromosome individual can be calculated based on the above individual fitness function. In other embodiments, the relative fitness of the gene chromosome individual is used as the fitness of each gene chromosome individual, and the fitness of a single gene chromosome individual in the kth generation population is calculated according to formula (2):

[0064]

[0065] in is the fitness of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations, is the individual with the i-th gene chromosome in the k-th generation;

[0066] Step 3) Selection operation: Arrange the fitness of all gene chromosome individuals in the parent population from high to low, and eliminate the 20 individuals with the lowest fitness.

[0067] Step 4) Crossover and mutation operations: Crossover operation starts from Multiple pairs of individuals with the same or similar fitness are selected, and a recombination operation is performed between two individuals with a predetermined probability of 70% to generate two new individuals. The weights of the new individuals are appropriately adjusted to ensure that the sum of the gene weights within the individuals is 1, and this process is repeated. The mutation operation is based on a certain mutation rate P. M Randomly perform multiple flips on the realization of an individual to generate a new individual with a mutation rate of P M Is a random number that obeys the normal distribution. When the number of iterations is less than or equal to 15, P M = normrnd(0.2,0.1), normrnd represents the normal distribution random number. When the number of iterations is greater than 15, P M = normrnd(0.3,0.3), repeat this process. Then merge into step 2) to determine the individual with the highest fitness Eventually a new generation of groups is formed Record the individual with the highest fitness

[0068] Step 5) If the genetic algebra meets the termination condition, the evolution stops and the output is As the approximate optimal gene chromosome individual, otherwise let k = k + 1 and go to step 2).

[0069] Termination criteria: The algorithm only verifies the termination criteria after the 15th generation. The k-th generation termination criteria are evaluated using three parameters: standard deviation, maximum fitness, and minimum fitness. The standard deviation of the population samples is less than 0.025, the maximum fitness of the k-th generation population is equal to the maximum fitness of the previous k-8 generations, and the difference between the minimum fitness of the k-th generation population and the minimum fitness of the previous k-5 generations is no more than 10%.

[0070] The optimal individual calculated based on the genetic algorithm is the approximate solution to the policy corresponding to the security incident and is pushed to the visual orchestration engine.

[0071] Step 3: The visual orchestration engine orchestrates the approximate solution of the strategy through manual decision-making to obtain the security handling strategy corresponding to the security incident; and stores the security handling strategy in the preset strategy library.

[0072] The visual orchestration engine is based on the approximate solution of the strategy calculated by the genetic algorithm in step 2. Through manual decision-making and combined with the visual interface, the approximate solution of the strategy is intuitively arranged, modified and improved. After the arrangement is completed, it is stored in the preset strategy library. Later, it can be considered that the handling strategy corresponding to the security incident is the strategy stored in the preset strategy library after visual arrangement, so as to achieve the purpose of continuously enriching the preset strategy library to deal with different types of security incidents. Figure 3 As shown, the visual orchestration engine includes a policy component library and a policy orchestrator. The policy component library is a graphical collection of policy components with editable properties. The policy orchestrator uses a visual interface to statically edit policy components by dragging and dropping, including editing properties and position order, and selecting the log sources, security rules, forensic tools, and response methods involved in the analysis. Furthermore, each node can also be customized to derive new policy processes. For example, a secondary authentication business process can be added. Using the mouse, policy components can be added and the order in which they are executed can be set, thus forming a secondary authentication policy.

[0073] Step 4: The processing engine calls the security processing strategy to realize automated processing.

[0074] The handling engine calls the handling strategy corresponding to the security incident from the preset strategy library to perform automated security handling. Different handling methods are adopted for different monitoring objects, including issuing action instructions, work orders and email notifications.

[0075] Different treatment methods are used for different treatment objects, and different action instructions are issued. For security devices, instructions such as blocking illegal access are issued through a custom proprietary protocol; for network devices, instructions such as closing suspicious connection ports are issued through a network management protocol; and for host devices, instructions such as disconnecting and disabling ports are issued through a custom proprietary protocol.

[0076] Security actions that are currently unsupported or require manual intervention can also be pushed to the responsible person through work order notifications, such as patching vulnerabilities or cleaning virus files on the terminal. Upon receiving the work order, the responsible person can then take the appropriate action. Email alerts include notifications of important events and notifications of automated response results.

[0077] Corresponding to the above embodiment, the network security strategy arrangement and disposal system of the power monitoring system is provided. In this embodiment, a network security strategy arrangement and disposal method of the power monitoring system is provided. Figure 4 Shown, including:

[0078] Monitor security events of equipment within the power monitoring system;

[0079] Match security events with the preset policy library. If the match is successful, the corresponding security handling policy is obtained. If the match is unsuccessful, the approximate solution of the policy corresponding to the security event is calculated based on the genetic algorithm, and the corresponding security handling policy is obtained through visual arrangement based on the approximate solution of the policy.

[0080] Perform security disposal on the internal equipment of the power monitoring system based on the obtained security disposal strategy.

[0081] In a specific embodiment, the internal equipment of the power monitoring system includes at least one of a server, a workstation device, a database device, a network device and a security protection device.

[0082] Based on the approximate solution of the policy, a visual arrangement is used to obtain the security handling strategy corresponding to the security incident, including:

[0083] Manual decision-making and orchestration are performed on the approximate solution of the strategy of the security incident through a visual interface, and the orchestration results obtained by manual decision-making and orchestration are used as the security disposal strategy corresponding to the security incident, and the orchestration results obtained by manual decision-making and orchestration are stored in a preset strategy library.

[0084] Calculate approximate solutions to security incident policies based on genetic algorithms, including:

[0085] According to the event content field of the security event, the existing security disposal strategies in the preset strategy library are matched. The gene level of the single gene chromosome individuals corresponding to each existing security disposal strategy is set according to the matching similarity, and the weight of each single gene chromosome individual is set. The sum of all gene chromosome individual weights is 1;

[0086] Determining a fitness function of the gene chromosome individual according to the weight and gene level of the gene chromosome individual, and determining the fitness of the gene chromosome individual using the fitness function;

[0087] According to the fitness of each gene chromosome individual, each gene chromosome individual is selected, and hybridization and mutation operations are performed on each gene chromosome individual to evolve to the next generation; the next generation is repeatedly selected, hybridized and mutated until the termination condition is met, then the evolution stops, the optimal gene chromosome individual is output, and the optimal gene chromosome individual is determined as the strategy approximate solution corresponding to the security event.

[0088] In this embodiment, the fitness function is expressed as follows:

[0089]

[0090] Where W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual, is the fitness of the single-gene chromosome individual in the k-th generation population, k = 1,…,Km, Km is the maximum number of iterations.

[0091] In other embodiments, the fitness function is expressed as follows:

[0092]

[0093] in is the fitness of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations, is the individual with the i-th gene chromosome in the k-th generation.

[0094] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the corresponding processes in the embodiments of the above-described method may refer to the specific working processes of each module in the aforementioned system, which will not be repeated here.

[0095] The above method matches the security events of the internal equipment of the power monitoring system with the preset policy library. If the match is successful, the security handling policy corresponding to the security event is obtained from the preset policy library, thereby building a security event handling workflow in series and parallel.

[0096] For security handling strategies that do not correspond to security incidents, the approximate solution of the strategy corresponding to the security incident is calculated based on the genetic algorithm, and the security handling strategy corresponding to the security incident is obtained through visual arrangement based on the approximate solution of the strategy; the active defense of the power monitoring system is truly realized, and the main security threats currently faced by the power monitoring system are solved from the perspectives of monitoring, early warning and emergency response.

[0097] The above method uses a visual interface to perform manual decision-making and orchestration on the approximate solution of the security incident strategy. Through adaptive orchestration technology, people, security technology and processes are deeply integrated, and different security devices are automatically triggered to execute response actions, achieving a more comprehensive and end-to-end understanding of the security incident context. It helps to transform complex incident response processes and tasks into consistent, repeatable, measurable and effective workflows, and transform passive emergency response into automated continuous response; visual operation ensures the accuracy of policy matching and improves the clarity and real-time nature of security emergency disposal.

[0098] This method significantly improves the monitoring, early warning, and emergency response capabilities of current power monitoring systems, effectively enhancing management and reducing safety risks. Furthermore, the method is highly versatile and applicable to a variety of industries, including petrochemicals, chemicals, transportation, and metallurgy, meeting the diverse monitoring, early warning, visualization, and safety management needs of industrial control systems.

[0099] Based on the same inventive concept, an embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the power monitoring system network security policy orchestration and disposal method provided in the above embodiment are described.

[0100] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0101] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0104] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which are all protected by the present invention.

Claims

1. A method for organizing and handling network security strategies for power monitoring systems, characterized in that: include: Monitor security events of equipment within the power monitoring system; Match security events with the preset policy library. If the match is successful, the corresponding security handling policy for the security event is obtained from the preset policy library. If the match is unsuccessful, the approximate solution of the policy corresponding to the security event is calculated based on the genetic algorithm, and the corresponding security handling policy for the security event is obtained through visual arrangement based on the approximate solution of the policy. Among them, the strategy approximate solution corresponding to the security incident is calculated based on the genetic algorithm, including: According to the event content field of the security event, the existing security disposal strategies in the preset strategy library are matched. The gene level of the single gene chromosome individuals corresponding to each existing security disposal strategy is set according to the matching similarity, and the weight of each single gene chromosome individual is set. The sum of all gene chromosome individual weights is 1; Determining a fitness function of the gene chromosome individual according to the weight and gene level of the gene chromosome individual, and determining the fitness of the gene chromosome individual using the fitness function; According to the fitness of the gene chromosome individuals, each gene chromosome individual is selected, and hybridization and mutation operations are performed on each gene chromosome individual to evolve to the next generation; the next generation selection, hybridization and mutation operations are repeated until the termination condition is met, then the evolution stops, the optimal gene chromosome individual is output, and the optimal gene chromosome individual is determined as the policy approximate solution corresponding to the security event; Wherein, the fitness function is expressed as follows: in is the fitness of the single gene chromosome individual in the kth generation population, W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations; Perform security disposal on the internal equipment of the power monitoring system based on the obtained security disposal strategy.

2. The method for arranging and handling network security strategies for a power monitoring system according to claim 1 is characterized in that: The internal equipment of the power monitoring system includes at least one of a server, a workstation device, a database device, a network device and a security protection device.

3. The method for organizing and handling network security strategies of a power monitoring system according to claim 1, characterized in that: Based on the approximate solution of the policy, a visual arrangement is used to obtain the security handling strategy corresponding to the security incident, including: Manual decision-making and orchestration are performed on the approximate solution of the strategy of the security incident through a visual interface, and the orchestration results obtained by manual decision-making and orchestration are used as the security disposal strategy corresponding to the security incident, and the orchestration results obtained by manual decision-making and orchestration are stored in a preset strategy library.

4. The method for organizing and handling network security strategies of a power monitoring system according to claim 1, characterized in that: The fitness function is expressed as follows: in is the fitness of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations, is the i-th gene chromosome individual of the k-th generation; W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual.

5. The network security strategy arrangement and handling system of the power monitoring system is characterized by: It includes attack identification module, policy adaptive orchestration module, visual orchestration module and disposal module; among them: The attack identification module is used to monitor security events of internal equipment of the power monitoring system; The policy adaptive orchestration module is used to match security events with the preset policy library. If the match is successful, the security handling policy corresponding to the security event is obtained from the preset policy library. If the match is unsuccessful, an approximate solution of the policy corresponding to the security event is calculated based on a genetic algorithm. The strategy adaptive orchestration module includes a genetic algorithm calculation module, which is used to: According to the event content field of the security event, the existing security disposal strategies in the preset strategy library are matched. The gene level of the single gene chromosome individuals corresponding to each existing security disposal strategy is set according to the matching similarity, and the weight of each single gene chromosome individual is set. The sum of all gene chromosome individual weights is 1; Determining a fitness function of the gene chromosome individual according to the weight and gene level of the gene chromosome individual, and determining the fitness of the gene chromosome individual using the fitness function; Select each gene chromosome individual according to its fitness, perform hybridization and mutation operations on each gene chromosome individual, and evolve to the next generation; repeat the selection, hybridization, and mutation operations on the next generation until the termination condition is met, then stop the evolution, output the optimal gene chromosome individual, and determine the optimal gene chromosome individual as the strategy approximate solution corresponding to the security event; The visual orchestration module is used to obtain the security handling strategy corresponding to the security incident by visual orchestration according to the policy approximate solution; The processing module is used to perform security processing on the internal equipment of the power monitoring system based on the obtained security processing strategy.

6. The network security strategy arrangement and handling system for the power monitoring system according to claim 5 is characterized in that: The fitness function formula used by the genetic algorithm calculation module is as follows: in is the fitness of the i-th gene chromosome individual, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations, is the i-th gene chromosome individual of the k-th generation; W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual.

7. The network security strategy arrangement and handling system for the power monitoring system according to claim 5 is characterized in that: The fitness function formula of the gene chromosome individual used by the genetic algorithm calculation module is as follows: Where W i is the weight of the i-th gene chromosome individual, C i is the gene level of the i-th gene chromosome individual, is the fitness of the single gene chromosome individuals in the kth generation population, N k is the population size of the kth generation, k=1,…,Km, Km is the maximum number of iterations.

Images