A method and system for evaluating cyberspace security of power monitoring system

Abstract

The present invention discloses a method and system for evaluating the cyberspace security of an electric power monitoring system, including: establishing a security rating database, obtaining the security information of each influencing factor in real time, and storing the security information of each factor in the security rating database; calculating the initial security score of the security information of each factor according to the security information of each factor and the influencing factor and penalty factor of each factor; calculating the final score of the security information of each factor according to the security information of each factor, using multiple penalty factors of the security information of each factor, and the initial security score of the security information of each factor; calculating the security score of the cyberspace based on the final score of the security information of each factor, and determining the security level of the cyberspace according to the security score of the cyberspace. The present invention scores the cyberspace security from multiple dimensions and angles, so that the network security can be dynamically quantified and the accuracy of the evaluation results is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for evaluating the cyberspace security of an electric power monitoring system. Background Art

[0002] The power monitoring system is basically composed of computers, communication equipment, and measurement and control units. It provides a basic platform for real-time data collection, switch status detection and remote control of the power distribution system. It can form an arbitrarily complex monitoring system with detection and control equipment, and plays a core role in power distribution monitoring. It can help enterprises eliminate islands, reduce operating costs, improve production efficiency, and speed up the response to abnormalities in the power distribution process.

[0003] The application function modules of the power monitoring system mainly include: telemetry, telesignaling, remote control, relay protection, electrical protection, power quality management, lighting and ventilation control, tunnel and traffic monitoring linkage, energy management, distribution automation, operation auxiliary management, substation environment monitoring, etc. Accurate dynamic evaluation of the network security status of the power monitoring system can improve the safety factor of the network and ensure the good and stable operation of the network.

[0004] Obtaining network-related information and quantifying the information are prerequisites for dynamic network security assessment. Traditional methods achieve assessment by obtaining key factors such as assets, threats, and vulnerabilities in network security and calculating corresponding values. However, they cannot dynamically quantify network security and there is a problem of large deviation in security assessment. Summary of the invention

[0005] Therefore, the technical problem to be solved by the present invention is to overcome the defects of the existing methods for evaluating cyberspace security in the prior art, which are incapable of dynamically quantifying network security and having large deviations in security evaluation, thereby providing a method and system for evaluating the cyberspace security of a power monitoring system.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for evaluating the cyberspace security of an electric power monitoring system, comprising: obtaining security information of each element that affects the security of the cyberspace, and storing the security information of each element in an established security rating database; calculating an initial security score for the security information of each element based on the security information of each element in the security rating database and the influencing factor and penalty factor of each element; calculating a final score for the security information of each element based on the security information of each element in the security rating database, using multiple penalty factors of the security information of each element, and the initial security score of the security information of each element; calculating the security score of the cyberspace based on the final score of the security information of each element, and determining the security level of the cyberspace based on the security score of the cyberspace.

[0008] In one embodiment, the security information of the factors affecting the security of the network space includes: device security information, protocol security information and policy security information.

[0009] In one embodiment, the process of calculating the initial security score of the security information of each element based on the security information of each element in the security rating database and the influencing factor and penalty factor of each element includes: grading the equipment in the power monitoring system according to the equipment security information; obtaining the preset grade weight corresponding to each grade, and calculating the initial security score of each grade of equipment based on the number of equipment at each grade, the influencing factor of the security information, and the preset grade weight corresponding to each grade; taking the ratio of the influencing factor of the protocol security information to the number of protocols used in the cyberspace as the initial security score of the protocol security information; taking the ratio of the influencing factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information.

[0010] In one embodiment, the process of calculating the final score of the security information of each element using the penalty factor and the initial security score of the security information of each element includes: obtaining the corresponding weighted value of the security information of each element under each penalty factor based on the security information of each element; calculating the final score of the security information of each element based on the corresponding weighted value of the security information of each element under each penalty factor, the initial security score, and the number of penalty factors of the security information of each element.

[0011] In one embodiment, the penalty factors of device security information include: risk factor penalty factor, network availability penalty factor, network breach rate penalty factor, impact device penalty factor, device impact time penalty factor, attack tool quantity penalty factor, and attack time penalty factor.

[0012] In one embodiment, the penalty factors of the protocol security information include: a protocol vulnerability quantity penalty factor, a protocol authentication penalty factor, a protocol authority distinction penalty factor, a protocol broadcast suppression penalty factor, a protocol encryption penalty factor, and a protocol programmability penalty factor.

[0013] In one embodiment, the penalty factors of the policy security information include: a system password penalty factor, a system firewall penalty factor, a system access control penalty factor, a system backup and recovery penalty factor, a system audit penalty factor, and a system vulnerability check penalty factor.

[0014] In a second aspect, an embodiment of the present invention provides an evaluation device for the cyberspace security of an electric power monitoring system, comprising: an information acquisition module, used to establish a security rating database, acquire in real time the security information of each element that affects the security of the cyberspace, and store the security information of each element in the security rating database, wherein the security rating database is also used to store publicly available risk factor information; an initial scoring module, used to calculate the initial security score of the security information of each element based on the security information of each element in the security rating database and the influencing factor and penalty factor of each element; a final scoring module, used to calculate the final score of the security information of each element based on the security information of each element in the security rating database, using multiple penalty factors of the security information of each element, and the initial security score of the security information of each element; a rating module, used to calculate the security score of the cyberspace based on the final score of the security information of each element, and determine the security level of the cyberspace based on the security score of the cyberspace.

[0015] In one embodiment, the initial scoring device includes: a first calculation unit, used to grade the equipment in the power monitoring system according to the equipment security information; obtain the preset grade weight corresponding to each grade, and calculate the initial security score of each grade of equipment according to the number of equipment at each grade, the impact factor of the security information, and the preset grade weight corresponding to each grade; a second calculation unit, used to use the ratio of the impact factor of the protocol security information to the number of protocols used in the network space as the initial security score of the protocol security information; a third calculation unit, used to use the ratio of the impact factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information.

[0016] In one embodiment, the final scoring module includes: a weighting module, which is used to obtain the corresponding weighted value of the security information of each element under each penalty factor based on the security information of each element; and a final scoring module, which is used to calculate the final score of the security information of each element based on the corresponding weighted value of the security information of each element under each penalty factor, the initial security score, and the number of penalty factors of the security information of each element.

[0017] In a third aspect, an embodiment of the present invention provides a computer device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method for assessing the cyberspace security of a power monitoring system according to the first aspect of the embodiment of the present invention.

[0018] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the method for assessing the cyberspace security of a power monitoring system according to the first aspect of the embodiment of the present invention.

[0019] The technical solution of the present invention has the following advantages:

[0020] 1. The method and system for evaluating the cyberspace security of the power monitoring system provided by the present invention establish a security rating database, obtain the security information of each factor affecting the security of the cyberspace in real time, and store the security information of each factor in the security rating database; calculate the initial security score of the security information of each factor according to the security information of each factor in the security rating database and the influencing factor and penalty factor of each factor; calculate the final score of the security information of each factor according to the security information of each factor in the security rating database, using multiple penalty factors of the security information of each factor, and the initial security score of the security information of each factor; calculate the security score of the cyberspace based on the final score of the security information of each factor, and determine the security level of the cyberspace according to the security score of the cyberspace. The present invention scores the cyberspace security from multiple dimensions and angles, so that the network security can be dynamically quantified and the accuracy of the evaluation results is improved.

[0021] 2. The method and system for evaluating the cyberspace security of the power monitoring system provided by the present invention classify the equipment in the power monitoring system according to the equipment security information; obtain the preset level weight corresponding to each level, and calculate the initial security score of each level of equipment according to the number of equipment at each level, the impact factor of the security information, and the preset level weight corresponding to each level; use the ratio of the impact factor of the protocol security information to the number of protocols used in the cyberspace as the initial security score of the protocol security information; use the ratio of the impact factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information. The present invention scores the cyberspace security in multiple dimensions based on the equipment security information, protocol security information, and policy security information, comprehensively considers and sets the impact factor of each security information, and finally calculates the initial security score of each security information, thereby improving the accuracy of the evaluation results.

[0022] 3. The method and system for evaluating the cyberspace security of the power monitoring system provided by the present invention set multiple penalty factors for each type of security information, and use the penalty factors to score and calculate the security information again, and finally obtain the final score of the security information based on the initial security score and the score of the penalty factor, thereby achieving comprehensive consideration of the impact of various penalty factors on network security from multiple angles, so as to obtain the most complete and comprehensive evaluation method and system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A flowchart of a specific example of an evaluation method provided by an embodiment of the present invention;

[0025] Figure 2 A flowchart of another specific example of the evaluation method provided by an embodiment of the present invention;

[0026] Figure 3 A flowchart of another specific example of the evaluation method provided by an embodiment of the present invention;

[0027] Figure 4 A flowchart of a specific example of an evaluation device provided by an embodiment of the present invention;

[0028] Figure 5 A composition diagram of a specific example of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, it can also be the internal connection of two components, it can be a wireless connection, or it can be a wired connection. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0031] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0032] Example 1

[0033] The embodiment of the present invention provides a method for evaluating the cyberspace security of an electric power monitoring system. Figure 1 As shown, it includes steps S11 to S14, which are specifically as follows:

[0034] Step S11: Obtain security information of each element that affects the security of cyberspace, and store the security information of each element in an established security rating database.

[0035] Specifically, before establishing a security rating database, the network space to be tested needs to be connected so that it can communicate normally. The security rating database of an embodiment of the present invention stores and regularly updates the publicly disclosed risk factor information online. The risk factor information includes: vulnerabilities, Trojans, viruses and other information in public databases such as NVD and CVE.

[0036] Specifically, the present embodiment stores security information of various factors affecting network security detected by the system to be tested in an established security rating database, and the security information of each factor will change dynamically with the change of network status and configuration; since the equipment security in the power monitoring system is mainly affected by the equipment security information, the protocol security is mainly affected by the protocol security information, and the policy security is mainly affected by the policy security information, the security information of the factors affecting the security of cyberspace in the embodiment of the present invention includes: equipment security information, protocol security information and policy security information.

[0037] Specifically, device security information may include the number of device connections, type of stored information, device permissions, vulnerabilities, the number of Trojans and viruses, the number of network disconnections, the duration of network disconnections, the number of attacks, the number of successful attacks, the status of security rating database inclusion, the number of affected devices, the total number of devices to be tested, the time the devices were affected, the testing time, the number of attack tools, the time taken to attack, etc.

[0038] Specifically, protocol security information may include the number of protocols, number of vulnerabilities, authentication mechanism, authority differentiation, data transmission encryption, broadcast suppression, programmability, etc.

[0039] Specifically, policy security information may include user passwords or password complexity, the number of all users, firewalls, firewall configurations, access control policies, backup and recovery mechanisms, security audits, regular vulnerability checks and repairs, vulnerability check and repair frequency, etc.; finally, the sum of the equipment, protocol, and policy security scores is the total network security score in the power monitoring system, and then it is rated according to the corresponding strategies.

[0040] Step S12: Calculate the initial safety score of the safety information of each element according to the safety information of each element in the safety rating database and the influencing factor and penalty factor of each element.

[0041] Specifically, the embodiment of the present invention analyzes the three major factors affecting the security of the power monitoring system (equipment security, protocol security and policy security), and allocates security impact factors to the equipment, protocols and policies in the cyberspace according to actual conditions. For example: the security information of the equipment, the security information of the protocol and the impact factors of the security information of the protocol are A1=30, A2=40 and A3=50 respectively, satisfying A1+A2+A3=100.

[0042] Specifically, Figure 2 As shown, step S12 is executed by steps S21 to S23, which are specifically as follows:

[0043] Step S21: Classify the equipment in the power monitoring system according to the equipment safety information; obtain the preset grade weight corresponding to each grade, and calculate the initial safety score of each grade of equipment according to the number of equipment at each grade, the influencing factor of the safety information, and the preset grade weight corresponding to each grade.

[0044] Specifically, the embodiment of the present invention classifies devices in the network space according to the device security information obtained in real time. The classification may be based on the importance of the device. The devices may be divided into three levels: A, B, and C. A-level devices meet at least one of the following conditions: (1) devices with a number of other devices directly connected that is greater than or equal to 10, (2) devices with information stored in the form of passwords, etc., and (3) devices with the authority of an administrator in the power monitoring system. B-level devices must meet the following two conditions: (1) devices with a number of other devices directly connected that is less than 10 and greater than or equal to 5, and (2) devices with information stored in the form of important business information, or devices adjacent to A-level devices. C-level devices are devices other than the above-mentioned A-level devices and B-level devices.

[0045] Specifically, the initial safety score T of each level of equipment is calculated based on the number of equipment at each level, the preset level weight corresponding to each level, and the impact factor of equipment safety information. o , the calculation formula is as follows:

[0046]

[0047] Among them, A1 represents the impact factor of equipment safety information, C A , C B , C C Respectively represents the number of Class A, Class B, and Class C equipment. 11 , A 12 , A 13 These are the preset grade weights for Class A, Class B, and Class C equipment respectively. The specific preset grade weights are set according to actual conditions and are not limited here.

[0048] Step S22: The ratio of the impact factor of the protocol security information to the number of protocols used in the network space is used as the initial security score of the protocol security information.

[0049] Specifically, the initial security score T of the protocol security information P The calculation formula is as follows:

[0050]

[0051] Among them, A2 represents the impact factor of protocol security information, C P Represents the number of protocols used in cyberspace.

[0052] Step S23: taking the ratio of the impact factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information.

[0053] Specifically, the initial security score T of the policy security information S The calculation formula is as follows:

[0054]

[0055] Wherein, A3 represents the impact factor of the policy security information, and N1 is the number of penalty factors of the policy security information.

[0056] Step S13: Calculate the final score of the safety information of each element according to the safety information of each element in the safety rating database, using multiple penalty factors of the safety information of each element and the initial safety score of the safety information of each element.

[0057] Specifically, since the security of each element is affected by multiple factors, the embodiment of the present invention sets multiple penalty factors for each element, scores the security information of each element in multiple dimensions, and combines the initial score of the security information of each element to finally obtain the final score of the security information of each element, such as Figure 3 As shown, step S13 is performed by steps S31 to S32, which are specifically as follows:

[0058] Step S31: according to the security information of each element, obtain the corresponding weighted value of the security information of each element under each penalty factor.

[0059] Specifically, the penalty factors for device security information include: risk factor penalty factor P1, network availability penalty factor P2, network breach rate penalty factor P3, impact device penalty factor P4, device affected time penalty factor P5, attack tool quantity penalty factor P6, and attack time penalty factor P7.

[0060] Specifically, the embodiment of the present invention analyzes the equipment safety information of the power monitoring system according to actual conditions, and then determines the segmentation and weights of P1, P2, P3, P4, P5, P6, and P7, wherein P1, P2, P3, P4, P5, P6, and P7 are independent of each other, and the segmentation of each penalty factor of the equipment safety information is shown in Formulas (4) to (12), wherein each segmentation basis and the basis for setting the weighted value corresponding to each segment are set according to actual conditions and are not limited here.

[0061]

[0062] Among them, P1 represents the penalty factor of device vulnerabilities, Trojans, and viruses, n1 is the sum of the number of vulnerabilities, Trojans, and viruses on the device, and e represents that the security rating database of the vulnerability, Trojan, or virus is already recorded. Indicates that the security rating database status of this vulnerability, Trojan, or virus is not recorded.

[0063]

[0064] Among them, P2 represents the network availability penalty factor, U represents the network availability, and the network availability calculation formula is as follows:

[0065]

[0066] Among them, a represents the number of network disconnections caused by device vulnerabilities, Trojans, and viruses during the test time, and b represents the network disconnection time caused by device vulnerabilities, Trojans, and viruses during the test time. Since the network disconnection time and the number of network disconnections are of different orders of magnitude, the cube root of the network disconnection time is taken, and a≥0, b≥0 is satisfied.

[0067]

[0068] Among them, P3 represents the network attack rate penalty factor, R represents the network attack rate, and the network attack rate calculation formula is as follows:

[0069]

[0070] Among them, C I is the number of successful attacks on the network under test during the test time, C T is the number of attacks on the network under test during the test time. I =C T When =0, let R=0.

[0071]

[0072] Among them, P4 represents the penalty factor affecting the device, m represents the number of devices directly connected to this device, and M represents the total number of devices to be tested, satisfying M=C A +C B +C C .

[0073]

[0074] Among them, P5 represents the penalty factor of the device affected time, t1 represents the device affected time, and T represents the test time.

[0075]

[0076] Among them, P6 represents the penalty factor of the number of attack tools, and n2 represents the number of attack tools used to carry out the attack.

[0077]

[0078] Among them, P7 represents the penalty factor of attack time, and t2 represents the attack time.

[0079] Specifically, the penalty factors of protocol security information include: protocol vulnerability number penalty factor Q1, protocol authentication penalty factor Q2, protocol authority distinction penalty factor Q3, protocol broadcast suppression penalty factor Q4, protocol encryption penalty factor Q5, and protocol programmability penalty factor Q6.

[0080] The embodiment of the present invention analyzes the protocol security information of the power monitoring system according to actual conditions, and then determines the segmentation and weights of Q1, Q2, Q3, Q4, Q5, and Q6, wherein Q1, Q2, Q3, Q4, Q5, and Q6 are independent of each other, and the segmentation of each penalty factor of the protocol security information is shown in Formulas (13) to (18), wherein each segmentation basis and the weighted value setting basis corresponding to each segment are set according to actual conditions and are not limited here.

[0081]

[0082] Among them, Q1 represents the penalty factor of the number of protocol vulnerabilities, and n3 is the number of network protocol vulnerabilities to be tested.

[0083]

[0084] Among them, Q2 represents the protocol authentication penalty factor, G represents that the protocol has an authentication mechanism, Indicates that the protocol has no authentication mechanism.

[0085]

[0086] Among them, Q3 represents the penalty factor for protocol authority distinction, V represents the protocol has authority distinction, Indicates that the protocol has no authority distinction.

[0087]

[0088] Among them, Q4 represents the protocol broadcast suppression penalty factor, J represents the protocol has broadcast suppression, Indicates that the protocol has no broadcast suppression.

[0089]

[0090] Among them, Q5 represents the protocol encryption penalty factor.

[0091]

[0092] Among them, Q6 represents the protocol programmability penalty factor, I represents the protocol is programmable, Indicates that the protocol is not programmable.

[0093] Specifically, the penalty factors of the policy security information include: system password penalty factor R1, system firewall penalty factor R2, system access control penalty factor R3, system backup and recovery penalty factor R4, system audit penalty factor R5, and system vulnerability check penalty factor R6.

[0094] Specifically, the embodiment of the present invention analyzes the strategy safety signal of the power monitoring system according to the actual situation, and then determines the segmentation and weights of R1, R2, R3, R4, R5, and R6, wherein R1, R2, R3, R4, R5, and R6 are independent of each other, and the segmentation of each penalty factor of the strategy safety signal is shown in Formula (19) to Formula (24), wherein each segmentation basis and the weighted value setting basis corresponding to each segment are set according to the actual situation and are not limited here.

[0095]

[0096] Among them, R1 represents the system password penalty factor, N C It indicates the number of users in the system under test whose password length and password complexity (character types such as numbers, letters, and underscores) are greater than or equal to 3. N2 indicates the number of all registered users in the system under test.

[0097]

[0098] Among them, R2 represents the system firewall penalty factor, F represents that the system under test has a firewall, and E represents that the firewall of the system under test is correctly configured. Indicates that the system under test has no firewall. Indicates that the firewall configuration of the system under test is incorrect.

[0099]

[0100] Among them, R3 represents the system access control penalty factor, W represents that the system under test has an access control policy, Indicates that the system under test has no access control policy.

[0101]

[0102] Among them, R4 represents the system backup and recovery penalty factor, O means that the system under test has a backup and recovery mechanism, Indicates that the system under test has no backup and recovery mechanism.

[0103]

[0104] Among them, R5 represents the system audit penalty factor, H represents that the system under test has a security audit, Indicates that the system under test has no security audit.

[0105]

[0106] Among them, R6 represents the system vulnerability check penalty factor, D represents that the system under test has regular vulnerability checks and repairs, It indicates that the system under test has no regular vulnerability inspection and repair, and K indicates the frequency of vulnerability inspection and repair of the system under test.

[0107] Step S32: Calculate the final score of the security information of each element according to the corresponding weighted value of the security information of each element under each penalty factor, the initial security score, and the number of penalty factors of the security information of each element.

[0108] Specifically, the final score S1 of the device safety information is calculated according to the following formula, that is, the final score S1 of the device safety information minus the score corresponding to the penalty factor:

[0109]

[0110] Among them, S A Represents the total security score of all A-level devices in the cyberspace, S B Represents the total security score of all B-level devices in the cyberspace, S C Represents the total security score of all C-level devices in the cyberspace, T O3 Indicates the initial safety score of the A-level equipment safety information, T O2 Indicates the initial safety score of Class B equipment safety information, T O1 Indicates the initial safety score of the C-level device safety information, represents the jth penalty factor of the i-th Class A device, represents the jth penalty factor of the i-th Class B device, represents the jth penalty factor of the i-th C-level device, C A , C B , C C Represents the number of Class A, Class B, and Class C devices respectively.

[0111] Specifically, the final score S2 of the protocol security information is calculated according to the following formula, that is, the final score of the protocol security information minus the score corresponding to the protocol penalty factor:

[0112]

[0113] Among them, T P represents the initial security score of the protocol, Q (i,j) represents the jth penalty factor of the i-th protocol, C P Represents the number of protocols used in the network under test;

[0114] Specifically, the final score S3 of the policy security information is calculated according to the following formula, that is, the final score of the policy security information minus the score corresponding to the policy penalty factor:

[0115]

[0116] Among them, T Srepresents the initial security score of the strategy, R K Indicates the security policy penalty factor.

[0117] Step S14: Based on the final score of the security information of each element, the security score of the cyberspace is calculated, and the security level of the cyberspace is determined according to the security score of the cyberspace.

[0118] Specifically, the total network security score S of the system under test is calculated according to the following formula:

[0119] S=S1+S2+S3 (28)

[0120] Specifically, the embodiment of the present invention can obtain the network security rating L of the system to be tested according to the following formula, and can also be in other rating forms, which are not limited here:

[0121]

[0122] Example 2

[0123] The embodiment of the present invention provides a device for evaluating the cyberspace security of an electric power monitoring system. Figure 4 As shown, including:

[0124] Information acquisition module 1 is used to establish a security rating database, obtain the security information of each factor that affects the security of cyberspace in real time, and store the security information of each factor in the security rating database. The security rating database is also used to store publicly available risk factor information. This module executes the method described in step S11 of Example 1 and will not be repeated here.

[0125] The initial scoring module 2 is used to calculate the initial security score of the security information of each element based on the security information of each element in the security rating database and the influencing factor and penalty factor of each element; this module executes the method described in step S12 of Example 1, which will not be repeated here.

[0126] The final scoring module 3 is used to calculate the final score of the security information of each element based on the security information of each element in the security rating database, using multiple penalty factors of the security information of each element, and the initial security score of the security information of each element; this module executes the method described in step S13 in Example 1, which will not be repeated here.

[0127] Rating module 4 is used to calculate the security score of the cyberspace based on the initial security score and final score of the security information of each element, as well as the number of penalty factors of the security information of each element, and determine the security level of the cyberspace according to the security score of the cyberspace; this module executes the method described in step S14 in Example 1, which will not be repeated here.

[0128] In one embodiment, the initial scoring device includes:

[0129] The first calculation unit is used to classify the equipment in the power monitoring system according to the equipment safety information; obtain the preset level weight corresponding to each level, and calculate the initial safety score of each level of equipment according to the number of equipment at each level, the impact factor of the safety information, and the preset level weight corresponding to each level; this module executes the method described in step S21 in Example 1, which will not be repeated here.

[0130] The second calculation unit is used to use the ratio of the impact factor of the protocol security information to the number of protocols used in the network space as the initial security score of the protocol security information; this module executes the method described in step S22 in Example 1, which will not be repeated here.

[0131] The third calculation unit is used to use the ratio of the impact factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information; this module executes the method described in step S23 of Example 1, which will not be repeated here.

[0132] In one embodiment, the final scoring module includes:

[0133] The weighting module is used to obtain the corresponding weighted value of the security information of each element under each penalty factor according to the security information of each element; this module executes the method described in step S31 in Example 1, which will not be repeated here.

[0134] The final scoring module is used to calculate the final score of the security information of each element based on the corresponding weighted value of the security information of each element under each penalty factor, the initial security score, and the number of penalty factors of the security information of each element; this module executes the method described in step S32 in Example 1 and will not be repeated here.

[0135] Example 3

[0136] An embodiment of the present invention provides a computer device, such as Figure 5As shown, it includes: at least one processor 401, such as a CPU (Central Processing Unit), at least one communication interface 403, a memory 404, and at least one communication bus 402. Among them, the communication bus 402 is used to realize the connection and communication between these components. Among them, the communication interface 403 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 403 may also include a standard wired interface and a wireless interface. The memory 404 may be a high-speed RAM memory (Ramdom Access Memory, volatile random access memory) or a non-volatile memory (non-volatile memory), such as at least one disk memory. The memory 404 may also be at least one storage device located away from the aforementioned processor 401. Among them, the processor 401 can execute the evaluation method of the cyberspace security of the power monitoring system of Example 1. A set of program codes are stored in the memory 404, and the processor 401 calls the program code stored in the memory 404 to execute the evaluation method of the cyberspace security of the power monitoring system of Example 1.

[0137] The communication bus 402 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The communication bus 402 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 The fact that only one line is used in the diagram does not mean that there is only one bus or only one type of bus.

[0138] Among them, the memory 404 may include a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated: RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (English: hard disk drive, abbreviated: HDD) or a solid-state drive (English: solid-state drive, abbreviated: SSD); the memory 404 may also include a combination of the above types of memory.

[0139] The processor 401 may be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and a NP.

[0140] The processor 401 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0141] Optionally, the memory 404 is also used to store program instructions. The processor 401 can call the program instructions to implement the method for evaluating the cyberspace security of the power monitoring system in the embodiment 1 of the present application.

[0142] The embodiment of the present invention also provides a computer-readable storage medium, on which computer-executable instructions are stored, and the computer-executable instructions can execute the method for evaluating the cyberspace security of the power monitoring system of Example 1. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviated: HDD) or a solid-state drive (SSD), etc.; the storage medium can also include a combination of the above-mentioned types of memory.

[0143] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived from these are still within the scope of protection of the invention.

Claims

1. A method for evaluating the cyberspace security of a power monitoring system, characterized in that: include: Obtaining security information of each element that affects the security of the cyberspace, and storing the security information of each element in an established security rating database; Calculate an initial safety score for the safety information of each element according to the safety information of each element in the safety rating database and the influencing factor and penalty factor of each element; Calculate a final score of the safety information of each element according to the safety information of each element in the safety rating database, using multiple penalty factors of the safety information of each element and an initial safety score of the safety information of each element; Calculating a security score of the cyberspace based on the final score of the security information of each element, and determining a security level of the cyberspace according to the security score of the cyberspace; The security information of the elements that affect the security of the cyberspace includes: equipment security information, protocol security information and policy security information; The process of calculating the initial security score of the security information of each element according to the security information of each element in the security rating database and the influencing factor and penalty factor of each element includes: grading the equipment in the power monitoring system according to the equipment security information; obtaining the preset grade weight corresponding to each grade, and calculating the initial security score of the equipment at each grade according to the number of equipment at each grade, the influencing factor of the security information, and the preset grade weight corresponding to each grade; taking the ratio of the influencing factor of the protocol security information to the number of protocols used in the cyberspace as the initial security score of the protocol security information; taking the ratio of the influencing factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information.

2. The method for evaluating cyberspace security of a power monitoring system according to claim 1, characterized in that: Using the penalty factor and initial safety score of each element's safety information, the process of calculating the final score of each element's safety information includes: According to the security information of each element, a corresponding weighted value of the security information of each element under each penalty factor is obtained; The final score of the safety information of each element is calculated according to the corresponding weighted value of the safety information of each element under each penalty factor, the initial safety score, and the number of penalty factors of the safety information of each element.

3. The method for evaluating cyberspace security of a power monitoring system according to claim 2, characterized in that: The penalty factors of the device security information include: risk factor penalty factor, network availability penalty factor, network breach rate penalty factor, impact device penalty factor, device impact time penalty factor, attack tool quantity penalty factor, and attack time penalty factor.

4. The method for evaluating cyberspace security of a power monitoring system according to claim 2, characterized in that: The penalty factors of the protocol security information include: a protocol vulnerability quantity penalty factor, a protocol authentication penalty factor, a protocol authority distinction penalty factor, a protocol broadcast suppression penalty factor, a protocol encryption penalty factor, and a protocol programmability penalty factor.

5. The method for evaluating cyberspace security of a power monitoring system according to claim 2, characterized in that: The penalty factors of the policy security information include: system password penalty factor, system firewall penalty factor, system access control penalty factor, system backup and recovery penalty factor, system audit penalty factor, and system vulnerability check penalty factor.

6. A device for evaluating cyberspace security of a power monitoring system, characterized in that: include: An information acquisition module, used to acquire security information of each factor affecting the security of the cyberspace, and store the security information of each factor in an established security rating database; An initial scoring module, used to calculate an initial safety score of the safety information of each element according to the safety information of each element and the influencing factor and penalty factor of each element in the safety rating database; A final scoring module, used to calculate a final score of the safety information of each element according to the safety information of each element in the safety rating database, using a plurality of penalty factors of the safety information of each element and an initial safety score of the safety information of each element; A rating module, for calculating a security score of the network space based on a final score of the security information of each element, and determining a security level of the network space according to the security score of the network space; The security information of the elements that affect the security of the cyberspace includes: equipment security information, protocol security information and policy security information; The process of calculating the initial security score of the security information of each element according to the security information of each element in the security rating database and the influencing factor and penalty factor of each element includes: grading the equipment in the power monitoring system according to the equipment security information; obtaining the preset grade weight corresponding to each grade, and calculating the initial security score of the equipment at each grade according to the number of equipment at each grade, the influencing factor of the security information, and the preset grade weight corresponding to each grade; taking the ratio of the influencing factor of the protocol security information to the number of protocols used in the cyberspace as the initial security score of the protocol security information; taking the ratio of the influencing factor of the policy security information to the number of penalty factors of the policy security information as the initial security score of the policy security information.

7. A computer device, characterized in that: include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the method for assessing the cyberspace security of a power monitoring system as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method for evaluating the cyberspace security of a power monitoring system as described in any one of claims 1-5.

Images