Visual report generation method and system based on power system network security data

Abstract

The present invention discloses a method and system for generating a visual report based on power system network security data. The method comprises obtaining power system network security data from a data source; preprocessing the raw power system network security data; importing the preprocessed power system network security data into a trained deep learning model; mining data features to determine data types; determining chart types corresponding to the data features, and displaying the data using the selected chart types; establishing a visual report template, and importing charts associated with the network security data into the visual report template to form a complete visual report on the power system network security data. The present invention effectively mines the features of power system network security data and improves the accuracy of identifying data types.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a method and system for generating a visual report based on network security data of an electric power system. Background Art

[0002] The vigorous advancement of informatization within the power system has not only improved the management efficiency of power companies but also provided benefits for residential electricity users and businesses. Due to the interconnectedness of networks, attacks targeting various software vulnerabilities have also increased year by year. Malware attacks such as Trojans and viruses that exploit these vulnerabilities have caused significant losses to both businesses and individuals. In recent years, attacks against power systems by criminals have also increased. Power production is crucial to people's livelihoods and requires extremely high standards for continuous and safe operation. Only by ensuring its reliability and security can we prevent impacts on residential electricity use. To more comprehensively understand the development of power system network security over time and to conduct statistical analysis of this network security data, reports are often used to present data in the form of graphs and charts. However, existing technologies for network security reporting systems rely on a single data source and template, and are often based on a client-server architecture. This not only complicates user operations but also results in poorly visualized reports. Summary of the Invention

[0003] To overcome the above technical problems, the present invention provides a method and system for generating visual reports based on power system network security data, which effectively mines the characteristics of power system network security data and improves the accuracy of identifying data types.

[0004] In order to achieve the above object, the present invention adopts the following technical solutions:

[0005] The method for generating a visual report based on power system network security data includes the following steps:

[0006] Obtaining raw power system cybersecurity data from data sources;

[0007] preprocessing the raw power system network security data;

[0008] Import the pre-processed power system cybersecurity data into the trained deep learning model;

[0009] Use deep learning models to mine data features and determine the type of data by mining various data features;

[0010] Determining a chart type corresponding to the data characteristics, and displaying the network security data using the selected chart type;

[0011] Create a visual report template and import charts associated with network security data into the visual report template to form a complete visual report on power system network security data.

[0012] Furthermore, the data sources include: Excel data sources, CSV data sources, relational databases, non-relational databases, and custom data sets.

[0013] Furthermore, the original power system network security data includes: network alarm data, network threat data, network anomaly data, and network security asset data.

[0014] Furthermore, the original power system network security data is pre-processed, specifically:

[0015] Write SQL: Add query SQL or request body based on the selected data source to complete the query of original power system network security data;

[0016] Data cleaning: Use custom JS scripts to improve the field information of SQL query results. In addition, use dictionary translation to translate a key value of the SQL query results into detailed information. Then, use data regularization to clean the improved field information and translated data into accurate network security data.

[0017] Data fusion: Merge accurate network security data based on known characteristics to form data families with the same characteristics or attributes, reducing the amount of data analysis;

[0018] Data preview: Preview the data after data fusion.

[0019] Furthermore, the deep learning model adopts an improved knowledge distillation model, which uses two neural networks for simultaneous training. During the training process, each neural network not only receives supervision from true value labels, but also refers to the learning experience of peer networks to further improve generalization capabilities.

[0020] Furthermore, in the improved knowledge distillation model, each network has two loss functions during the learning process. One is the supervision loss function, which uses cross entropy loss to measure the difference between the target category predicted by the network and the true label, expressed as follows:

[0021]

[0022]

[0023] Among them, L1 represents the supervised loss function of the first neural network, L2 represents the supervised loss function of the second neural network, and x irepresents the i-th power system network security data, M represents the total number of categories of data samples, m represents the m-th category of data samples, N represents the total number of data samples, p1 m (x i ) represents the first network prediction data x in the improved knowledge distillation model i The probability of belonging to class m, p2 m (x i ) represents the data x predicted by the second network in the improved knowledge distillation model i The probability of belonging to class m, y i represents the predicted label value of the ith power system network security data, I(y i ,m) is the indicator function, when y i =m, then I(y i ,m)=1, and y i ≠m, then I(y i ,m)=0;

[0024] The other is the interaction loss function between networks, which uses KL divergence to measure the difference between the predicted probability distributions of the two networks, expressed as follows:

[0025]

[0026]

[0027] Among them, p1 represents the probability of the first network predicting the data category in the improved distillation model, p2 represents the probability of the second network predicting the data category in the improved knowledge distillation model, and D KL (p2||p1) and D KL (p1||p2) represents the KL divergence between the two network prediction probability distributions;

[0028] The total loss function is

[0029] Among them, α and β are two adjustment factors in the total loss function, which control the weights of the two supervised loss functions.

[0030] Furthermore, the deep learning model is used to mine data features and determine the data type by mining various data features. Specifically, the improved knowledge distillation model is used to mine various features of power system network security data; the data types of network alarms, threats, anomalies, and security assets are determined;

[0031] The various features include basic features of TCP connections, content features of TCP connections, time-based network traffic statistics features, and host-based network traffic statistics features.

[0032] Furthermore, the chart types include: line chart, bar chart, column chart, map, funnel chart, Nightingale rose chart, relationship chart, pie chart, dashboard, scatter chart, table, K-line chart, radar chart, tree chart and sunburst chart;

[0033] When displaying power system network security data through the selected chart type, the update interval of the chart data can be customized, and the update interval includes no update, real-time update and specific time interval.

[0034] Furthermore, the creation of the visual report template adopts a B / S architecture, the backend adopts Spring Boot technology, and the front end adopts Vue technology.

[0035] A visual report generation system based on power system network security data includes:

[0036] Data acquisition module: used to obtain original power system network security data from the data source;

[0037] Preprocessing module: used for preprocessing the original power system network security data;

[0038] Data import module: used to import pre-processed power system network security data into the trained deep learning model;

[0039] The data processing module is used to mine data features using a deep learning model and determine the type of data by mining various features of the data;

[0040] Data display module: used to determine the chart type corresponding to the data characteristics, and display the network security data through the selected chart type;

[0041] Visualization module: used to establish a visualization report template, import charts with associated network security data into the visualization report template, and form a complete visualization report of power system network security data.

[0042] Compared to existing technologies, the present invention has the following advantages: It utilizes a B / S architecture, simplifying user operations. It obtains raw power system network security data from a variety of data sources, ensuring data integrity and comprehensiveness. This raw power system network security data is then preprocessed through SQL writing, data cleaning, data fusion, and data preview. An improved knowledge distillation model is then used to mine the features of this data. This model employs two neural networks for simultaneous training. During training, each network receives supervision not only from ground truth labels but also draws on the learning experience of its peer network to further enhance generalization capabilities. This reduces the size of the deep learning model while improving the accuracy of data type recognition. Furthermore, chart types corresponding to the data features are determined. A wide range of chart types, including line charts, bar charts, broken column charts, maps, funnel charts, Nightingale rose charts, relationship diagrams, pie charts, gauge charts, scatter plots, tables, candlestick charts, radar charts, treemaps, and sunburst charts, expand the presentation of power system network security data. A customizable update interval allows for flexible control of the model's refresh rate. Finally, a visualization report template is established, and the charts with associated network security data are imported into the template to form a complete visualization report of power system network security data. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is an overall flow chart of the method for generating visual reports based on power system network security data provided by the present invention.

[0044] Figure 2 This is a framework diagram of the deep learning model used in the present invention.

[0045] Figure 3 This is a framework diagram of the visual report generation system based on power system network security data provided by the present invention. DETAILED DESCRIPTION

[0046] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments:

[0047] like Figure 1 As shown, the present invention provides a method for generating a visual report based on power system network security data, which includes obtaining original power system network security data from a data source; preprocessing the original power system network security data; importing the preprocessed power system network security data into a trained deep learning model; mining data features to determine the data type; determining the chart type corresponding to the data feature, and displaying the data through the selected chart type; establishing a visual report template, importing the chart associated with the network security data into the template, and forming a complete visual report of power system network security data. Specifically, the method includes the following steps:

[0048] Step 1: Acquire raw power system network security data from data sources such as Excel, CSV, relational, and non-relational databases. This method includes built-in drivers for MySQL, Elasticsearch, and Kudu, and also supports custom datasets. The acquired power system network security data includes network alarm data, network threat data, network anomaly data, and network security asset data.

[0049] Step 2: Preprocess the original power system network security data. The specific steps are as follows:

[0050] In step 1, write SQL. You can add query SQL or request body based on the selected data source to complete the data query. The query parameters in the query process are mainly for dynamic parameters in the SQL. The corresponding parameter values ​​such as time interval will be displayed in the subsequent charts.

[0051] Step 2: Clean the data. This not only improves the field information of the SQL query results through custom JS scripts, but also translates a key value in the SQL query results into detailed information through dictionary translation. Further, through data regularization, the improved field information and translated data are cleaned into accurate network security data.

[0052] Step 3: Data fusion: Based on known features, basic power system network security data is merged to form data families with the same features or attributes, reducing the amount of data analysis.

[0053] Step 4, data preview, can preview the data after data fusion.

[0054] Step 3: Import the pre-processed power system network security data into the trained deep learning model. The deep learning model used is an improved knowledge distillation model, such as Figure 2 As shown in Figure 1, the model uses two neural networks to train simultaneously. During the training process, each neural network not only receives supervision from the true value labels, but also refers to the learning experience of the companion network to further improve its generalization ability. Throughout the process, the two neural networks continuously share learning experience, achieving mutual learning and common progress. In the improved knowledge distillation model used, each network has two loss functions during the learning process, one of which is the traditional supervised loss function. Cross entropy loss is used to measure the difference between the target category predicted by the network and the true label, and the other is the interaction loss function between the networks KL divergence is used to measure the difference between the two network prediction probability distributions. The total loss function is α and β are two adjustment factors in the total loss function, which control the weights of the two supervised loss functions.

[0055] Among them, L1 represents the supervised loss function of the first neural network, L2 represents the supervised loss function of the second neural network, and x i represents the i-th power system network security data, M represents the total number of categories of data samples, m represents the m-th category of data samples, N represents the total number of data samples, p1 m (x i ) represents the first network prediction data x in the improved knowledge distillation model i The probability of belonging to class m, p2 m (x i ) represents the data x predicted by the second network in the improved knowledge distillation model i The probability of belonging to class m, y i represents the predicted label value of the ith power system network security data, I(y i ,m) is the indicator function, when y i =m, then I(y i ,m)=1, and y i ≠m, then I(y i ,m)=0.

[0056] Step 4: Mining data features and determining data types. This primarily involves mining various features of power system network security data through an improved knowledge distillation model to determine the types of data, such as network alarms, threats, anomalies, and security assets.

[0057] Step 5: Determine a chart type corresponding to the data characteristics and display the data using the selected chart type. Available chart types include: line chart, bar chart, column chart, map, funnel chart, Nightingale rose chart, relationship diagram, pie chart, dashboard, scatter plot, table, candlestick chart, radar chart, treemap, and sunburst chart. When displaying power system network security data using the selected chart type, you can customize the chart data update interval, including no update, real-time update, and a specific time interval.

[0058] Step 6: Create a visualization report template and import the charts associated with network security data into the template to form a complete visualization report of power system network security data. The visualization report template used can simultaneously display multiple types of charts, comprehensively displaying the network security status of the power system. This invention adopts a B / S architecture, Spring Boot technology on the back end, and Vue technology on the front end, which stably supports the generation of visualization reports.

[0059] like Figure 3 As shown, the present invention also provides a visual report generation system based on power system network security data, comprising:

[0060] Data acquisition module: used to obtain original power system network security data from the data source;

[0061] Preprocessing module: used for preprocessing the original power system network security data;

[0062] Data import module: used to import pre-processed power system network security data into the trained deep learning model;

[0063] The data processing module is used to mine data features using a deep learning model and determine the type of data by mining various features of the data;

[0064] Data display module: used to determine the chart type corresponding to the data characteristics, and display the network security data through the selected chart type;

[0065] Visualization module: used to establish a visualization report template, import charts with associated network security data into the visualization report template, and form a complete visualization report of power system network security data.

[0066] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0068] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit its scope of protection. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that after reading the present invention, those skilled in the art may still make various changes, modifications or equivalent substitutions to the specific implementation methods of the invention, but these changes, modifications or equivalent substitutions are all within the scope of protection of the pending claims of the invention.

Claims

1. A method for generating a visual report based on power system network security data, characterized in that: The following steps are involved: Obtaining raw power system cybersecurity data from data sources; preprocessing the raw power system network security data; Importing the pre-processed power system network security data into a trained deep learning model using an improved knowledge distillation model. The improved knowledge distillation model uses two neural networks for simultaneous training. During training, each neural network not only receives supervision from the ground truth labels but also refers to the learning experience of the peer network to further improve generalization capabilities. In the improved knowledge distillation model, each network has two loss functions during the learning process. One is the supervision loss function, which uses cross entropy loss to measure the difference between the target category predicted by the network and the true label, expressed as follows: Among them, L1 represents the supervised loss function of the first neural network, L2 represents the supervised loss function of the second neural network, and x i represents the i-th power system network security data, M represents the total number of categories of data samples, m represents the m-th category of data samples, N represents the total number of data samples, p1 m (x i ) represents the first network prediction data x in the improved knowledge distillation model i The probability of belonging to class m, p2 m (x i ) represents the data x predicted by the second network in the improved knowledge distillation model i The probability of belonging to class m, y i represents the predicted label value of the ith power system network security data, I(y i ,m) is the indicator function, when y i =m, then I(y i ,m)=1, and y i ≠m, then I(y i ,m)=0; The other is the interaction loss function between networks, which uses KL divergence to measure the difference between the predicted probability distributions of the two networks, expressed as follows: Among them, p1 represents the probability of the first network predicting the data category in the improved distillation model, p2 represents the probability of the second network predicting the data category in the improved knowledge distillation model, and D KL (p2||p1) and D KL (p1||p2) represents the KL divergence between the two network prediction probability distributions; The total loss function is Among them, α and β are two adjustment factors in the total loss function, which control the weights of the two supervised loss functions; Using deep learning models to mine data features, the data type is determined by mining various data features. Specifically, an improved knowledge distillation model is used to mine various features of power system network security data; the data types of network alarms, threats, anomalies, and security assets are determined; these various features include basic TCP connection features, TCP connection content features, time-based network traffic statistics, and host-based network traffic statistics. Determining a chart type corresponding to the data characteristics, and displaying the network security data using the selected chart type; Create a visual report template and import charts associated with network security data into the visual report template to form a complete visual report on power system network security data.

2. The method for generating a visual report based on power system network security data according to claim 1, characterized in that: The data sources include: Excel data source, CSV data source, relational database, non-relational database and custom data set.

3. The method for generating a visual report based on power system network security data according to claim 1, characterized in that: The original power system network security data includes: network alarm data, network threat data, network anomaly data, and network security asset data.

4. The method for generating a visual report based on power system network security data according to claim 1, characterized in that: Preprocessing the raw power system network security data is as follows: Write SQL: Add query SQL or request body based on the selected data source to complete the query of original power system network security data; Data cleaning: Use custom JS scripts to improve the field information of SQL query results, and use dictionary translation to translate a key value of the SQL query results into detailed information; Then, through data regularization, the completed field information and translated data are cleaned into accurate network security data; Data fusion: Merge accurate network security data based on known characteristics to form data families with the same characteristics or attributes, reducing the amount of data analysis; Data preview: Preview the data after data fusion.

5. The method for generating a visual report based on power system network security data according to claim 1, characterized in that: The chart types include: line chart, bar chart, column chart, map, funnel chart, Nightingale rose chart, relationship chart, pie chart, dashboard, scatter chart, table, candlestick chart, radar chart, tree map and sunburst chart; When displaying power system network security data through the selected chart type, the update interval of the chart data can be customized, and the update interval includes no update, real-time update and specific time interval.

6. The method for generating a visual report based on power system network security data according to claim 1, characterized in that: The visual report template is established using a B / S architecture, with Spring Boot technology used in the back end and Vue technology used in the front end.

7. A visual report generation system based on power system network security data, characterized by: include: Data acquisition module: used to obtain original power system network security data from the data source; Preprocessing module: used for preprocessing the original power system network security data; Data import module: used to import pre-processed power system network security data into the trained deep learning model; The deep learning model uses an improved knowledge distillation model that trains two neural networks simultaneously. During training, each neural network not only receives supervision from true value labels but also refers to the learning experience of its peer network to further improve its generalization ability. In the improved knowledge distillation model, each network has two loss functions during the learning process. One is the supervision loss function, which uses cross entropy loss to measure the difference between the target category predicted by the network and the true label, expressed as follows: Among them, L1 represents the supervised loss function of the first neural network, L2 represents the supervised loss function of the second neural network, and x i represents the i-th power system network security data, M represents the total number of categories of data samples, m represents the m-th category of data samples, N represents the total number of data samples, p1 m (x i ) represents the first network prediction data x in the improved knowledge distillation model i The probability of belonging to class m, p2 m (x i ) represents the data x predicted by the second network in the improved knowledge distillation model i The probability of belonging to class m, y i represents the predicted label value of the ith power system network security data, I(y i ,m) is the indicator function, when y i =m, then I(y i ,m)=1, and y i ≠m, then I(y i ,m)=0; The other is the interaction loss function between networks, which uses KL divergence to measure the difference between the predicted probability distributions of the two networks, expressed as follows: Among them, p1 represents the probability of the first network predicting the data category in the improved distillation model, p2 represents the probability of the second network predicting the data category in the improved knowledge distillation model, and D KL (p2||p1) and D KL (p1||p2) represents the KL divergence between the two network prediction probability distributions; The total loss function is Among them, α and β are two adjustment factors in the total loss function, which control the weights of the two supervised loss functions; A data processing module is used to mine data features using a deep learning model and determine the data type by mining various data features. Specifically, it mines various features of power system network security data using an improved knowledge distillation model; determines the data types of network alarms, threats, anomalies, and security assets; the various features include basic TCP connection features, TCP connection content features, time-based network traffic statistics features, and host-based network traffic statistics features; Data display module: used to determine the chart type corresponding to the data characteristics, and display the network security data through the selected chart type; Visualization module: used to establish a visualization report template, import charts with associated network security data into the visualization report template, and form a complete visualization report of power system network security data.

Images