A power network security method and system based on scale-free network

Abstract

The present invention relates to a power network security method and system based on a scale-free network, the method comprising: obtaining network node information of a local network in real time, and constructing a BA scale-free network model of the local network based on the network node information; the network node information includes the total number of nodes, the number of connections of each node, and the connection distance between nodes; according to the BA scale-free network model, adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node; based on the frequency and duration of the detected deliberate attacks, determining to start the active deception security defense system of the intrusion detection system of the local network. The present invention determines the probability of a power network being subjected to a deliberate attack through a BA scale-free network model, and then improves the security of the power network through the network security strategy of the intrusion detection system.

Description

Technical Field

[0001] The present invention belongs to the technical field of power network security, and in particular relates to a power network security method and system based on a scale-free network. Background Art

[0002] With the rapid development of computer technology and communication technology, various forms of networks have gradually entered thousands of households. This is especially true for enterprises. Computer network technology has brought great convenience to the operation of enterprises. However, the rapid development of the network has also brought some security issues. Some illegal hackers often use some system loopholes to enter corporate units, and some even wantonly attack corporate networks, causing huge losses to enterprises. This is especially true for the power system. Once the power network is attacked, it will threaten the continuous and stable operation of the entire power grid and bring immeasurable disasters to the normal operation of the city.

[0003] The power-law degree distribution characteristics of scale-free networks have important research significance in statistics. Generally speaking, complex networks may suffer from two forms of attacks, namely random attacks and malicious attacks. Random attacks are to randomly select nodes in the network to attack, while malicious attacks are premeditated and targeted attacks on nodes that have an important position (high degree) in the network. Unlike the Poisson distribution, the power-law distribution reflects the heterogeneity of the network degree distribution. This heterogeneity is a double-edged sword and has an important impact on the robustness and fragility of scale-free networks. Scale-free networks have good robustness to random attacks, and the loss of some low-degree nodes will not have a great impact on the performance of the network; however, scale-free networks show inherent fragility to deliberate attacks, and the attack of a small number of high-degree nodes can destroy the connectivity of the network.

[0004] IDS is a computer monitoring system that uses real-time monitoring to send out warnings once an abnormality is detected. It is divided into several categories based on the different information sources and detection methods: based on the information source, it can be divided into host-based IDS and network-based IDS, and based on the detection method, it can be divided into abnormal intrusion detection and misuse intrusion detection. Unlike a firewall, an IDS intrusion detection system is a monitoring device that is not connected to any link and can work without network traffic flowing through it. Therefore, the only requirement for the deployment of IDS is that the IDS should be attached to the link through which all traffic of concern must flow. Here, "traffic of concern" refers to access traffic from high-risk network areas and network messages that need to be counted and monitored. Summary of the invention

[0005] In order to improve the security of power networks, a first aspect of the present invention provides a power network security method based on a scale-free network, including: acquiring network node information of a local network in real time, and constructing a BA scale-free network model of the local network based on the information; the network node information includes the total number of nodes, the number of connections of each node, and the connection distance between nodes; according to the BA scale-free network model, adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node; based on the frequency and duration of the detected deliberate attacks, determining to start the active deception security defense system of the intrusion detection system of the local network.

[0006] In some embodiments of the present invention, the BA scale-free network model for constructing a local network includes: determining the initial number of nodes m0, the number of connections e0, and the current number of valid connections m of the local network; randomly selecting a node i from the existing nodes in the local network, and determining a subnetwork N consisting of node i and its adjacent and validly connected nodes; each time a new node is added, the new node is added to the valid nodes in the subnetwork N.

[0007] Furthermore, each time a new node is added, adding the new node to the valid nodes in the sub-network N includes: each time a new node is added, adding the new node to m valid nodes; and calculating the probability of the new node being added to the valid nodes in the sub-network N according to the duration and depth number of adjacent and valid nodes of the node i in the sub-network N.

[0008] In some embodiments of the present invention, adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node according to the BA scale-free network model includes: real-time detection of the number of effective connections, effective connection distance and effective duration of each node; based on the BA scale-free network model, as well as the number of effective connections and effective connection distance of each node, calculating whether the probability of each node being subjected to a deliberate attack exceeds a preset value; and adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node according to the probability of each node being subjected to a deliberate attack.

[0009] Furthermore, according to the probability of each node being subjected to a deliberate attack, the priority of random attacks and deliberate attacks in the attack detection type of each node is adjusted: if the probability of each node being subjected to a deliberate attack exceeds a preset threshold, the detection priority of the deliberate attack is adjusted to be higher than the detection priority of the random attack; otherwise, the detection priority of the random attack is adjusted to be higher than the detection priority of the deliberate attack.

[0010] In the above-mentioned embodiment, the method of determining to activate the active deception security defense system of the intrusion detection system of the local network based on the detected frequency and duration of the intentional attacks includes: judging the scale and hazard level of the intentional attacks based on the detected frequency and duration of the intentional attacks, and determining to activate the active deception security defense system of the intrusion detection system of the local network based on the scale and hazard level of the intentional attacks.

[0011] The second aspect of the present invention provides an electric power network security system based on a scale-free network, comprising: an acquisition module for acquiring network node information of a local network in real time, and constructing a BA scale-free network model of the local network based on the information; the network node information includes the total number of nodes, the number of connections of each node, and the connection distance between nodes; an adjustment module for adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node according to the BA scale-free network model; a determination module for determining to start the active deception security defense system of the intrusion detection system of the local network based on the frequency and duration of the detected deliberate attacks.

[0012] Furthermore, the adjustment module includes: a detection unit for detecting the number of effective connections, effective connection distance and effective duration of each node in real time; a calculation unit for calculating the number of effective connections and effective connection distance of each node based on the BA scale-free network model.

[0013] Calculate whether the probability of each node being attacked intentionally exceeds a preset value; and adjust the priority of random attack and intentional attack in the attack detection type of each node according to the probability of each node being attacked intentionally.

[0014] The third aspect of the present invention provides an electronic device, comprising: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the power network security method based on a scale-free network provided in the first aspect of the present invention.

[0015] A fourth aspect of the present invention provides a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the power network security method based on a scale-free network provided in the first aspect of the present invention is implemented.

[0016] The beneficial effects of the present invention are:

[0017] The present invention determines the probability of the power network being subjected to intentional attacks through the BA scale-free network model, and determines the detection and protection priority of the power network according to the probability of being subjected to intentional attacks. Since the absence of low-degree nodes will not have a significant impact on the performance of the network, conventional security strategies can be adopted; while for high-degree nodes, since the impact is very large, it is necessary to improve the protection and detection level, and then the security of the power network is improved through the network security strategy of the intrusion detection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic diagram of a basic flow chart of a power network security method based on a scale-free network in some embodiments of the present invention;

[0019] Figure 2 A schematic diagram of a scale-free network node construction process in some embodiments of the present invention;

[0020] Figure 3 A schematic diagram of the structure of a power network security system based on a scale-free network in some embodiments of the present invention;

[0021] Figure 4 It is a schematic diagram of the structure of an electronic device in some embodiments of the present invention. DETAILED DESCRIPTION

[0022] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0023] refer to Figure 1 In a first aspect of the present invention, a power network security method based on a scale-free network is provided, comprising: S100. acquiring network node information of a local network in real time, and constructing a BA scale-free network model of the local network based on the information; the network node information includes the total number of nodes, the number of connections of each node, and the connection distance between nodes; S200. adjusting the priority of random attacks and intentional attacks in the attack detection type of each node according to the BA scale-free network model; S300. determining to start the active deception security defense system of the intrusion detection system of the local network based on the frequency and duration of the detected intentional attacks.

[0024] It can be understood that the BA scale-free network model takes into account the network growth characteristics and the preferential connection characteristics (also known as the preferential connection characteristics) which are two important factors in the evolution of scale-free networks. The growth characteristic refers to the fact that as time goes by, new nodes are constantly added to the network and connected to existing nodes in the network, thus forming a dynamic growth process of network evolution.

[0025] In step S100 of some embodiments of the present invention, the construction of the BA scale-free network model of the local network includes: S101. Determining the initial number of nodes m0, the number of connections e0, and the current number of valid connections m of the local network; S102. Randomly selecting a node i from the existing nodes in the local network, and determining the sub-network N consisting of node i and its adjacent and validly connected nodes; S103. Each time a new node is added, the new node is added to the valid nodes in the sub-network N.

[0026] Further, in step S103, each time a new node is added, adding the new node to the valid nodes in the sub-network N includes: each time a new node is added, adding the new node to m valid nodes; according to the duration and depth number of adjacent and valid nodes of node i in the sub-network N, calculating the probability of the new node being added to the valid nodes in the sub-network N.

[0027] refer to Figure 2 Specifically, based on the above definition, the construction algorithm of the new neighborhood evolution network model can be expressed as:

[0028] 1) Growing: Start with a smaller number of nodes (m0) and a smaller number of edges (e0).

[0029] 2) Randomly select a node i from the existing nodes in the network and determine the neighborhood N of node i with a depth of P P (i) (Subnetwork).

[0030] 3) Add a new node and connect the new node to node f and the neighborhood N of node i P For the (m-1) nodes in (i), the connection with the nodes in the neighborhood is made in a preferential way, and the connection probability

[0031]

[0032] Where P(i∈Np)=size(N P ) / (m0+t). After determining the probability, the connection point is selected by the roulette wheel method. In this way, in each time interval, the newly added node is connected to m existing nodes, which include a randomly selected node and (m-1) nodes selected according to the priority connection method in the neighborhood of the node with a depth of p, instead of selecting m nodes from the entire network according to the priority connection rule as in the BA scale-free network.

[0033] In step S200 of some embodiments of the present invention, adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node according to the BA scale-free network model includes: S201. Real-time detection of the number of effective connections, effective connection distance and effective duration of each node; S202. Based on the BA scale-free network model, the number of effective connections and the effective connection distance of each node, calculating whether the probability of each node being subjected to a deliberate attack exceeds a preset value; S203. According to the probability of each node being subjected to a deliberate attack, adjusting the priority of random attacks and deliberate attacks in the attack detection type of each node.

[0034] Furthermore, according to the probability of each node being subjected to a deliberate attack, the priority of random attacks and deliberate attacks in the attack detection type of each node is adjusted: if the probability of each node being subjected to a deliberate attack exceeds a preset threshold, the detection priority of the deliberate attack is adjusted to be higher than the detection priority of the random attack; otherwise, the detection priority of the random attack is adjusted to be higher than the detection priority of the deliberate attack.

[0035] Based on S300 of the above-mentioned embodiment, the method of determining to activate the active deception security defense system of the intrusion detection system of the local network based on the detected frequency and duration of the intentional attacks includes: judging the scale and hazard level of the intentional attacks based on the detected frequency and duration of the intentional attacks, and determining to activate the active deception security defense system of the intrusion detection system of the local network based on the scale and hazard level of the intentional attacks.

[0036] Specifically, the deception system mainly includes the deception environment, the system isolation layer and the host operating system, among which the host operating system occupies a dominant position. Through its unified control, the division of labor and cooperation of various systems are realized, and the coordinated and orderly operation is fully guaranteed to ensure the network security of the power system. Some nodes or virtual nodes in the deception environment can evade the detection of the system by disguising as other servers. However, when entering the system, the intrusion attack is introduced into the deception environment by disguising the directory, data and files, or through other deception strategies, such as simulating various vulnerabilities of the operating system, generating simulated network traffic, configuring attractive names, connecting to attractive services, etc. The deception system creates a system isolation layer (sandbox) through the deception mechanism as an interface between the deception environment and the system kernel, so that the system behavior in the deception environment cannot directly access the system kernel, which plays a good isolation role.

[0037] Example 2

[0038] refer to Figure 3According to a second aspect of the present invention, a power network security system 1 based on a scale-free network is provided, comprising: an acquisition module 11, for acquiring network node information of a local network in real time, and constructing a BA scale-free network model of the local network based thereon; the network node information comprises the total number of nodes, the number of connections of each node, and the connection distance between nodes; an adjustment module 12, for adjusting the priority of random attacks and intentional attacks in the attack detection type of each node according to the BA scale-free network model; a determination module 13, for determining to start an active deception security defense system of an intrusion detection system of a local network based on the frequency and duration of the detected intentional attacks.

[0039] Furthermore, the adjustment module 12 includes: a detection unit for detecting the number of effective connections, effective connection distance and effective duration of each node in real time; a calculation unit for calculating the number of effective connections and effective connection distance of each node based on the BA scale-free network model.

[0040] Calculate whether the probability of each node being attacked intentionally exceeds a preset value; and adjust the priority of random attack and intentional attack in the attack detection type of each node according to the probability of each node being attacked intentionally.

[0041] Example 3

[0042] refer to Figure 4 According to a third aspect of the present invention, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method of the first aspect of the present invention.

[0043] The electronic device 500 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage device 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the electronic device 500 are also stored. The processing device 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0044] Typically, the following devices may be connected to the I / O interface 505: an input device 506 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 507 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 508 including, for example, a hard disk, etc.; and a communication device 509. The communication device 509 may allow the electronic device 500 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 500 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 4 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0045] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through a communication device 509, or installed from a storage device 508, or installed from a ROM 502. When the computer program is executed by the processing device 501, the above functions defined in the method of the embodiment of the present disclosure are executed. It should be noted that the computer-readable medium described in the embodiment of the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In an embodiment of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In an embodiment of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wire, optical cable, RF (radio frequency), etc., or any suitable combination of the foregoing.

[0046] The computer-readable medium may be included in the electronic device, or may exist independently without being installed in the electronic device. The computer-readable medium carries one or more computer programs. When the one or more programs are executed by the electronic device, the electronic device:

[0047] Computer program code for performing the operations of embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, Python, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on a user's computer, partially on a user's computer, as a separate software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0048] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0049] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A power network security method based on scale-free network, characterized in that: include: Obtain network node information of the local network in real time, and build a BA scale-free network model of the local network based on it; The network node information includes the total number of nodes, the number of connections of each node, and the connection distance between nodes; According to the BA scale-free network model, the priority of random attack and intentional attack in the attack detection type of each node is adjusted: the number of valid connections, effective connection distance and effective duration of each node are detected in real time; Based on the BA scale-free network model, as well as the number of effective connections and effective connection distance of each node, calculate whether the probability of each node being deliberately attacked exceeds the preset value; According to the probability of each node being attacked intentionally, adjust the priority of random attack and intentional attack in the attack detection type of each node; Based on the frequency and duration of detected deliberate attacks, determine the active deception security defense system that activates the local network's intrusion detection system.

2. The power network security method based on scale-free network according to claim 1 is characterized in that: The BA scale-free network model for constructing the local network includes: Determine the initial number of nodes in the local network m 0. Number of connections e 0. Current number of valid connections m ; Randomly select a node from the existing nodes in the local network i , and determine the node i The sub-network N consisting of its adjacent and effectively connected nodes; Each time a new node is added, the new node is added to the valid nodes in the subnetwork N.

3. The power network security method based on scale-free network according to claim 2 is characterized in that: Each time a new node is added, adding the new node to the valid nodes in the subnetwork N includes: Each time you add a new node, add the new node to m Of the valid nodes; According to the nodes in the sub-network N i The duration and depth of adjacent and validly connected nodes are used to calculate the probability of a new node being added to a valid node in the subnetwork N.

4. The power network security method based on scale-free network according to claim 1 is characterized in that: According to the probability of each node being subjected to a deliberate attack, the priority of random attack and deliberate attack in the attack detection type of each node is adjusted: If the probability of each node being subjected to a deliberate attack exceeds a preset threshold, the detection priority of the deliberate attack is adjusted to be higher than the detection priority of the random attack; otherwise, the detection priority of the random attack is adjusted to be higher than the detection priority of the deliberate attack.

5. The power network security method based on a scale-free network according to any one of claims 1 to 4, characterized in that: The active deception security defense system for determining to start the intrusion detection system of the local network based on the frequency and duration of the detected deliberate attack includes: Based on the frequency and duration of the detected intentional attacks, the scale and harm level of the intentional attacks are judged, and based on this, the active deception security defense system of the intrusion detection system of the local network is determined to be activated.

6. A power network security system based on a scale-free network, characterized in that: include: An acquisition module is used to acquire network node information of the local network in real time and construct a BA scale-free network model of the local network based on the information; The network node information includes the total number of nodes, the number of connections of each node, and the connection distance between nodes; An adjustment module is used to adjust the priority of random attack and intentional attack in the attack detection type of each node according to the BA scale-free network model: real-time detection of the number of effective connections, effective connection distance and effective duration of each node; Based on the BA scale-free network model, as well as the number of effective connections and effective connection distance of each node, calculate whether the probability of each node being deliberately attacked exceeds the preset value; According to the probability of each node being attacked intentionally, adjust the priority of random attack and intentional attack in the attack detection type of each node; The determination module is used to determine to start the active deception security defense system of the intrusion detection system of the local network based on the frequency and duration of the detected deliberate attack.

7. An electronic device comprising: one or more processors; A storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the power network security method based on a scale-free network as described in any one of claims 1 to 5.

8. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the scale-free network-based power network security method according to any one of claims 1 to 5 is implemented.

Images