A method for controlling the spread of malicious programs in power system networks

Abstract

The present invention discloses a method for controlling the spread of malicious programs in a power system network, which includes the following steps: constructing a node state transition diagram of a power CPS network, and according to the transition diagram, listing the differential equations corresponding to each node; constructing a cost objective function according to the isolation rate and virus detection rate of the node; constructing a Hamiltonian function according to the obtained cost objective function and the differential equations of each node; according to the Hamiltonian function, obtaining a group of differential equations of co-state variables by the maximum principle, solving the transversal condition and the optimization condition, and finally obtaining the optimal control pair according to the optimization condition. Starting from the power CPS network model, the present invention considers the impact of isolation operation and immune operation on the system, and proposes an optimization control strategy, which has a certain impact and significance on preventing the spread of malicious viruses in the power CPS network.

Description

Technical Field

[0001] This invention relates to the field of power system network technology, and specifically to a method for controlling the propagation of malicious programs in power system networks. Background Art

[0002] With the rapid development of the internet, society has entered the era of the Internet of Everything, and the power system also needs to be upgraded accordingly. To ensure the safe, stable, and economical operation of the power system, it is necessary to introduce advanced information communication and computing technologies to realize the acquisition, transmission, and processing of data. The modern power system has developed into a cyber-physical system (CPS) that deeply integrates the power grid and the information network, and it possesses the typical characteristics of various cyber-physical systems.

[0003] A malicious virus refers to a worm virus that spreads infection along a specific path. Worms originating from computers can spread between computers; they can also spread between computers and programmable logic controllers (PLCs); and PLC worms can achieve the same propagation. The purpose of a worm attack is to compromise the availability, integrity, or confidentiality of its target.

[0004] Infectious disease models study the spread speed and spatial extent of infectious diseases, and are used for prevention and control of infectious diseases. Common infectious disease models include SI, SIS, and SIR. In the field of power system networks, infectious disease models can be combined to provide guidance for the isolation and immunization of malicious programs. Traditional malicious program propagation models mainly consider the relationship between susceptible nodes, infected nodes, and immune nodes, without considering the isolation between nodes or the impact of multi-layered topologies. In reality, malicious programs can spread through infected nodes at both the top and bottom layers, rendering the model inoperable; simultaneously, isolating and immunizing nodes will effectively reduce the proportion of susceptible nodes that become infected. Summary of the Invention

[0005] The purpose of this invention is to provide a method for controlling the propagation of malicious programs in power system networks, which solves the problem that traditional malicious program propagation models are no longer applicable to current power system networks. Current technology does not consider the isolation between nodes and the impact of multi-layer topology networks.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A method for controlling the spread of malicious programs in a power system network comprises the following steps:

[0008] S1. Construct a real-world simulation diagram of the power system network based on its actual operation.

[0009] S2. Based on the actual simulation diagram of the power CPS, simplify the computer and programmable controller into nodes, and construct a two-layer coupled network diagram of the power CPS;

[0010] S3. Based on the power CPS two-layer coupled network diagram, using the infectious disease model modeling method, construct the node state transition diagram and establish the corresponding node differential equations;

[0011] S4. Construct a cost objective function based on the virus detection rate and isolation rate of infected nodes;

[0012] S5. Using the maximum principle, solve for the corresponding Hamiltonian function and costate variables, and finally find the optimal control pair of the system model.

[0013] Furthermore, the nodes are classified into infected nodes, susceptible nodes, immune nodes, and isolated nodes according to the infection degree of the worm virus;

[0014] The infected nodes include PC infected nodes and PLC infected nodes;

[0015] The susceptible nodes include PC susceptible nodes and PLC susceptible nodes;

[0016] The immune nodes include PC immune nodes and PLC immune nodes;

[0017] The isolation nodes include PC isolation nodes and PLC isolation nodes;

[0018] The immune node, the PC susceptible node, the PC susceptible node, and the PC isolation node are PC nodes; the PLC infection node, the PLC susceptible node, the PLC immune node, and the PLC isolation node are PLC nodes.

[0019] Furthermore, the system model is a continuous model and a pulse model, and the differential equations of the pulse model are represented using time transformation coefficients.

[0020] Furthermore, in the actual simulation diagram of the power CPS, the computer is connected to the Internet, the programmable controller is connected to the local area network, and the computer exchanges information with the programmable controller through a switch; the output terminal of the programmable controller is connected to the power system switching devices, relays, and control devices.

[0021] Furthermore, the infected node is a node that is attacked by a worm virus and randomly sends out information containing the worm virus; the susceptible node is a node that is easily threatened and infected by worm viruses because it has not installed the latest immune patch; the immune node is a node that has installed the latest immune patch and has performed virus scanning. The immune node is immune to worm viruses for a period of time. After a period of time, the immune patch becomes invalid, and the immune node will become a susceptible node.

[0022] Furthermore, the specific steps for constructing the node state transition graph are as follows:

[0023] When a known node is converted into other nodes, it is converted at a set ratio. During the conversion, the direction is from one node as the starting point to another node as the end point; the worm virus infects along a certain direction; the worm virus from the computer spreads between the computer and the programmable controller; the worm virus from the programmable controller spreads between the computer and the programmable controller.

[0024] Furthermore, the corresponding node differential equation is specifically:

[0025] The total number of PC nodes is N A Expressed as follows; where N A =S A (t)+I A (t)+Q A (t)+R A (t);

[0026] The total number of PLC nodes is N B Expressed as follows; where N B =S B (t)+I B (t)+R B (t);

[0027] Among them, PC susceptible nodes use S A (t) is used to represent; PC infected nodes are represented by I A (t) is used to represent; PC isolation nodes are represented by Q A (t) is used to represent; PC immune nodes are represented by R A (t) is used to represent; PLC susceptible nodes are represented by S B (t) is used to represent; PLC infected nodes are represented by I B (t) is used for representation; PLC immune nodes use R B (t) to make an expression;

[0028] The system of nodal differential equations can then be expressed as the following equation:

[0029]

[0030]

[0031]

[0032]

[0033]

[0034]

[0035]

[0036] The infection rate caused by PC infected nodes is represented by β. AA and β BA This is represented; infections caused by PLC infection nodes are represented using β. AB and β BB The following are represented: the birth rate of PC susceptible nodes is represented by b; the birth rate and death rate of PC nodes are represented by μ1; the birth rate and death rate of PLC nodes are represented by μ2; the invulnerability rate of PC immune nodes is represented by η1; the invulnerability rate of PLC immune nodes is represented by η2; the virus detection rate of PC infected nodes is represented by γ1; the virus detection rate of PLC infected nodes is represented by γ2; the isolation rate of PC infected nodes is represented by δ1; and the recovery rate of PC isolated nodes is represented by ω1.

[0037] Furthermore, the cost objective function J(γ1,γ2,δ1) is:

[0038]

[0039] Where c1 represents the cost parameter for detecting and eliminating infected PC nodes; c2 represents the cost parameter for detecting and eliminating infected PLC nodes; c3 represents the cost parameter for isolating infected PC nodes; t f Indicates the terminal moment of this optimal control; I A (t and the I) A (t) are the same; I B (t) and the I B (t) are the same; I A (t f ) represents the number of infected nodes in the PC network at the current optimal control terminal moment; I B (t f ) represents the number of infected nodes in the PLC network at the optimal control terminal moment; dt represents the differential operator; the integral term γ1(t), γ2(t), and δ1(t) represent the costs of detecting and isolating the virus; γ1(t), γ2(t), and δ1(t) represent the objective cost function through the control of the corresponding control variables.

[0040] Furthermore, the pulse model specifically refers to the prevention and control of PC infection nodes and PLC infection nodes. Specific measures include virus scanning and removal for PC infection nodes, virus scanning and removal for PLC infection nodes, and isolation of PC infection nodes. All the above operations are assumed to occur at time t relative to global time. p The operation is completed in an instant, indicating that these operations do not consume excessive network resources.

[0041] Furthermore, the optimal control solution process for the impulse model is the same as that for the continuous model, and the control variables, cost objective function, and cost parameters of the impulse model are the same as those of the continuous model.

[0042] The beneficial technical effects of the present invention are at least as follows:

[0043] This invention starts from the power CPS network model, considers the impact of isolation and immunity operations on the system, and proposes an optimized control strategy, which has a certain impact and significance on preventing the spread of malicious viruses in the power CPS network. Attached Figure Description

[0044] The present invention is further described with reference to the accompanying drawings. However, the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the process for controlling the propagation of malicious programs in a power system network according to an embodiment of the present invention.

[0046] Figure 2 This is an actual simulation diagram of the power CPS method according to the embodiments of the present invention;

[0047] Figure 3 This is a diagram of a two-layer coupled power CPS network of the method in this embodiment of the invention;

[0048] Figure 4 This is a continuous model node transformation diagram of the method in the embodiments of the present invention;

[0049] Figure 5 This is a pulse model node transformation diagram of the method in an embodiment of the present invention. Detailed Implementation

[0050] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0051] Example

[0052] See also Figure 1 The method for controlling the propagation of malicious programs in power system networks provided by this invention includes the following steps:

[0053] S1. Construct a real-world simulation diagram of the power system network based on its actual operation.

[0054] S2, such as Figure 2 As shown, based on the actual simulation diagram of the power CPS, the computer and programmable controller are simplified into nodes, and a two-layer coupled network diagram of the power CPS is constructed. This can abstract and simplify the actual simulation diagram of the power CPS, and divide the network composed of the computer and the network composed of the programmable controller into network A and network B.

[0055] At the same time, each device of computer and programmable controller is regarded as a node, and according to the degree of infection of the node by the worm virus, it is classified into infected node, susceptible node and immune node;

[0056] S3, such as Figure 3 As shown, based on the two-layer coupled network diagram of the power CPS, the infectious disease model modeling method is used to construct the node state transition diagram and establish the corresponding node differential equations;

[0057] The system model is classified into continuous model and pulse model. The differential equations of the pulse model are expressed using time transformation coefficients.

[0058] S4. Construct a cost objective function based on the virus detection rate and isolation rate of infected nodes;

[0059] S5. Using the maximum principle, solve for the corresponding Hamiltonian function and costate variables, and finally find the optimal control pair of the system model.

[0060] In practical applications, the actual simulation diagram of power CPS can be divided into a computer layer and a programmable controller layer. The computer is connected to the Internet, and the programmable controller is connected to the local area network. The computer exchanges information with the programmable controller through a switch. The output of the programmable controller is generally connected to the power system's switching devices, relays, and control devices.

[0061] The network composed of computers and the network composed of programmable controllers are divided into network A and network B. At the same time, each device of the computer and programmable controller is regarded as a node, and according to the degree of infection of the node by the worm virus, it is classified into infected node, susceptible node, and immune node.

[0062] The nodes are classified into infected nodes, susceptible nodes, immune nodes, and isolated nodes according to the degree of worm virus infection.

[0063] The infected nodes include PC infected nodes and PLC infected nodes;

[0064] The susceptible nodes include PC susceptible nodes and PLC susceptible nodes;

[0065] The immune nodes include PC immune nodes and PLC immune nodes;

[0066] The isolation nodes include PC isolation nodes and PLC isolation nodes;

[0067] The immune node, the PC susceptible node, the PC susceptible node, and the PC isolation node are PC nodes; the PLC infection node, the PLC susceptible node, the PLC immune node, and the PLC isolation node are PLC nodes.

[0068] An infected node is a node that is attacked by a worm virus and will randomly send out messages containing the worm virus.

[0069] A susceptible node is one that has not installed the latest immune patch and is therefore vulnerable to worm virus threats and infections.

[0070] An immune node is a node that has installed the latest immune patch and has been scanned for viruses. Such a node is immune to worm viruses for a period of time, but after a period of time, the immune patch becomes invalid and the immune node will become a susceptible node.

[0071] In infectious disease models, common prevention methods include isolation and eradication. Therefore, when an isolation operation is added to a computer network, the infected nodes that are isolated are called isolated nodes. These nodes will not send out information containing worm viruses.

[0072] The system model consists of a continuous model and a pulse model. The differential equations of the pulse model are represented using time transformation coefficients.

[0073] In the actual simulation diagram of the power CPS, the computer is connected to the Internet, the programmable controller is connected to the local area network, and the computer exchanges information with the programmable controller through a switch; the output terminal of the programmable controller is connected to the power system switching devices, relays and control devices.

[0074] The infected node is a node that is attacked by a worm virus and randomly sends out information containing the worm virus; the susceptible node is a node that is easily threatened and infected by worm viruses because it has not installed the latest immune patch; the immune node is a node that has installed the latest immune patch and has performed virus scanning. The immune node is immune to worm viruses for a period of time. After a period of time, the immune patch becomes invalid, and the immune node will become a susceptible node.

[0075] like Figure 4-5 As shown, the node state transition diagram is constructed as follows:

[0076] It is known that when a node is transformed into another node, the transformation will be carried out at a set ratio, and the direction of the transformation is from one node to another node; at the same time, each node has two types of connections; worm viruses will also infect along a certain direction; worm viruses from computers can spread between computers; they can also spread between computers and programmable controllers; worm viruses from programmable controllers can also achieve the above-mentioned propagation process.

[0077] For PC nodes, if a susceptible PC node is connected to an infected PC node, then that node will be β-affected. AA The proportion is converted to PC infected nodes; if a PC susceptible node is connected to a PLC infected node, then that node will be converted to PC infected nodes at a rate of β. AB The proportion is converted into PC infection nodes; assuming that PC infection nodes can detect and kill viruses by installing antivirus programs, and then install immune patches to obtain immunity, the probability of successfully obtaining immunity in this process is γ1.

[0078] In the node state transition diagram, it is assumed that the total number of nodes remains stable. Therefore, the proportion of nodes joining and leaving the network is extremely small, and both of these proportions are μ1 in the PC node network.

[0079] Assume that PC immune nodes lose immunity at a rate of η1, and PC infected nodes are isolated at a rate of δ1; meanwhile, after the PC isolated nodes are scanned for and infected and then patched with immune patches, they will recover to be immune nodes at a rate of ω1; in the PC node network, the birth rate of susceptible nodes is b, and the birth rate of immune nodes is 1-b.

[0080] For PLC nodes, if a PLC susceptible node is connected to a PLC infected node, the node will be BB If a PLC susceptible node is connected to a PC infected node, then the node will be converted into a PLC infected node at a rate of β BA The proportion is converted into PLC infected nodes; assuming that the PLC infected nodes can detect and kill viruses by installing antivirus programs, and then install immune patches to obtain immunity, the probability of successfully obtaining immunity in this process is γ2.

[0081] In the node state transition diagram, it is assumed that the total number of nodes remains stable, so the ratio of nodes joining and leaving the network is extremely small, and the ratio of both is μ2 in the PLC node network;

[0082] Assume that PLC immune nodes lose immunity at a rate of η²; meanwhile, PLC isolated nodes, after virus detection and immunization patch installation, will recover to be immune nodes at a rate of ω²; in the PLC node network, all newly created nodes are susceptible nodes.

[0083] When a known node is converted into other nodes, it is converted at a set ratio. During the conversion, the direction is from one node as the starting point to another node as the end point; the worm virus infects along a certain direction; the worm virus from the computer spreads between the computer and the programmable controller; the worm virus from the programmable controller spreads between the computer and the programmable controller.

[0084] The corresponding node differential equation is specifically:

[0085] The total number of PC nodes is N A Expressed as follows; where N A =S A (t)+I A (t)+Q A (t)+R A (t);

[0086] The total number of PLC nodes is N B Expressed as follows; where N B =S B (t)+I B (t)+R B (t);

[0087] Among them, PC susceptible nodes use S A (t) is used to represent; PC infected nodes are represented by I A (t) is used to represent; PC isolation nodes are represented by Q A (t) is used to represent; PC immune nodes are represented by R A(t) is used to represent; PLC susceptible nodes are represented by S B (t) is used to represent; PLC infected nodes are represented by I B (t) is used for representation; PLC immune nodes use R B (t) to make an expression;

[0088] The system of nodal differential equations can then be expressed as the following equation:

[0089]

[0090]

[0091]

[0092]

[0093]

[0094]

[0095] The infection rate caused by PC infected nodes is represented by β. AA and β BA This is represented; infections caused by PLC infection nodes are represented using β. AB and β BB The following are represented: the birth rate of PC susceptible nodes is represented by b; the birth rate and mortality rate of PC nodes are represented by μ1; the birth rate and mortality rate of PLC nodes are represented by μ2; the invulnerability rate of PC immune nodes is represented by η1; the invulnerability rate of PLC immune nodes is represented by η2; the virus detection rate of PC infected nodes is represented by γ1; the virus detection rate of PLC infected nodes is represented by γ2; the isolation rate of PC infected nodes is represented by δ1; and the recovery rate of PC isolated nodes is represented by ω1.

[0096] In power CPSs, worm prevention and control measures include: immunizing susceptible nodes, virus detection and disinfection of infected nodes, and isolating infected nodes. The goal of this paper is to minimize the cost of virus detection and disinfection and isolation operations; therefore, the virus detection and disinfection ratios γ1 and γ2 of infected nodes and the isolation ratio δ1 of infected nodes are selected as control variables.

[0097] The cost objective function J(γ1,γ2,δ1) is:

[0098]

[0099] Where c1 represents the cost parameter for detecting and eliminating infected PC nodes; c2 represents the cost parameter for detecting and eliminating infected PLC nodes; c3 represents the cost parameter for isolating infected PC nodes; t f Indicates the terminal time of this optimal control; I A (t) and the I A (t) are the same; I B (t) and the I B (t) are the same; I A (t f ) represents the number of infected nodes in the PC network at the current optimal control terminal moment; I B (t f ) represents the number of infected nodes in the PLC network at the optimal control terminal moment; dt represents the differential operator; the integral term γ1(t), γ2(t), and δ1(t) represent the cost of detecting and isolating the virus; γ1(t), γ2(t), and δ1(t) represent the target cost function obtained by controlling the corresponding control variables; min represents taking the minimum value of the obtained result.

[0100] This paper takes the objective cost function as a quadratic function to represent the nonlinear situation in reality.

[0101] Therefore, the integral term The objective cost function describes the costs of virus detection and isolation. It represents the optimal control achieved at time t by controlling the corresponding control variables γ1(t), γ2(t), and δ1(t). f At that time, the number of infected PC nodes and infected PLC nodes is at its minimum, and it is within the continuous interval (t=[0,t)). f The cost of [the control pair] is minimized. Therefore, the control objective can be transformed into finding the optimal control pair. and

[0102] Based on the principle of maxima, the corresponding Hamiltonian function H is constructed as follows:

[0103]

[0104] For the integral term The cost of detecting and killing viruses on PC networks and PLC networks is expressed as the cost of isolating infected nodes on PC networks. For Λ1(t) and Λ2(t), they are represented as a set of costate variables of the Hamiltonian function, denoted as Λ1 and Λ2 in the following text.

[0105] The system of differential equations for the costate variables is derived using the maximum principle, as shown below:

[0106]

[0107]

[0108] For Λ1(t) and Λ2(t), they are represented as a set of covariates of the Hamiltonian function, and are represented by Λ1 and Λ2 to simplify the calculation.

[0109] For t∈[0,t f ], according to the target cost function, the optimization control target I A (t f ) and I B (t f All of these exist, therefore the cross-section conditions are as follows:

[0110]

[0111] According to the maximum principle, the optimization condition is obtained as follows:

[0112]

[0113]

[0114]

[0115] For the optimization condition, it means solving the system of partial differential equations for γ1(t), γ2(t) and δ1(t) for the Hamiltonian function H;

[0116] Simplifying the above optimization conditions, we get:

[0117]

[0118]

[0119]

[0120] The three equations of γ1(t), γ2(t) and δ1(t) are the optimization results obtained by solving the control variables using the maximum principle.

[0121] Therefore, the optimal control pair of the continuous model is finally obtained as follows:

[0122]

[0123]

[0124]

[0125] min means taking the minimum value of the result; max means taking the maximum value of the result; the optimal control pair This is the result obtained by solving the control variables under optimal control.

[0126] In existing research, most malware prevention measures for infectious disease models adopt continuous models for control. Although this control strategy may be very efficient for network control, it consumes a lot of network resources, such as bandwidth and the energy of the nodes themselves. Most continuous control is not suitable for actual situations. Therefore, it is necessary to build a pulse model for malware prevention strategies for power CPS.

[0127] The pulse strategy refers to prevention and control measures targeting both PC and PLC infected nodes. Specific measures include virus scanning and removal for PC and PLC infected nodes, and isolation of PC infected nodes. All the above operations are assumed to occur at time t relative to global time. p The operation is completed in an instant, indicating that these operations do not consume excessive network resources.

[0128] The pulse model specifically refers to the prevention and control measures for PC infection nodes and PLC infection nodes. These measures include virus scanning and removal for PC infection nodes, virus scanning and removal for PLC infection nodes, and isolation of PC infection nodes. All the above operations are assumed to occur at time t relative to global time. p The operation is completed in an instant, indicating that these operations do not consume excessive network resources.

[0129] For vulnerable nodes in the PC network, use S A (t) to make an expression;

[0130] For infected nodes in a PC network, use I A (t) to make an expression;

[0131] For isolated nodes in a PC network, use Q. A (t) to make an expression;

[0132] For immune nodes in a PC network, use R A (t) to make an expression;

[0133] For vulnerable nodes in a PLC network, use S B (t) to make an expression;

[0134] For infected nodes in a PLC network, use I B (t) to make an expression;

[0135] For immune nodes in a PLC network, use R B (t) to make an expression;

[0136] The total number of PC network nodes is used as N.A To represent;

[0137] Among them, N A =S A (t)+I A (t)+Q A (t)+R A (t);

[0138] The total number of PLC network nodes is N. B To express;

[0139] Among them, N B =S B (t)+I B (t)+R B (t);

[0140] For the infection rate caused by the infected nodes of the PC network, use β AA and β BA To express;

[0141] For the infection rate caused by the infected nodes of the PLC network, use β AB and β BB To express;

[0142] The birth rate of susceptible nodes in the PC network is represented by b;

[0143] The birth rate and death rate of all nodes in the PC network are represented by μ1;

[0144] The birth rate and death rate of all nodes in the PLC network are expressed as μ2;

[0145] The failure rate of immune nodes in PC networks is represented by η1;

[0146] The failure rate of immune nodes in the PLC network is represented by η2;

[0147] The virus detection and killing rate of infected nodes in the PC network is represented by γ1;

[0148] The virus detection and killing rate of infected nodes in the PLC network is represented by γ2;

[0149] The isolation rate of infected nodes in the PC network is represented by δ1;

[0150] The recovery rate of isolated nodes in PC network is expressed as ω1;

[0151] Assumptions This represents the time transformation coefficient, if t ≠ t p, that is, the current time is not a pulse moment, and it contains The term of the time transformation coefficient will be eliminated, that is,

[0152] At the same time, when t=t p At that time, containing The time transformation coefficients are retained as impulse terms, i.e.

[0153] The system of nodal differential equations can then be expressed as the following equation:

[0154]

[0155]

[0156]

[0157]

[0158]

[0159]

[0160] The Hamiltonian function and the system of differential equations for costate variables are specifically as follows:

[0161]

[0162] c1 represents the cost parameter for the PC infected node detection and killing operation;

[0163] c2 represents the cost parameter for performing the PLC infected node detection and killing operation;

[0164] c3 represents the cost parameter for isolating infected PC nodes;

[0165] For the integral term Expressed as the cost of virus detection and removal on PC and PLC networks, and the cost of isolating infected nodes on PC networks;

[0166] For Λ1(t) and Λ2(t), a set of covariates represented as Hamiltonian functions are denoted by Λ1 and Λ2 in the following text;

[0167] For time transformation coefficients It is represented as a simplified operational operator for a pulse model;

[0168] t f This indicates the endpoint of the current optimal control.

[0169] I A (t) and I in claim 5 A(t) The expressions are the same;

[0170] I B (t) and I in claim 5 B (t) The expressions are the same.

[0171] The system of differential equations for the costate variables is derived using the maximum principle, as shown below:

[0172]

[0173]

[0174] The optimal control pair of the pulse model is specifically as follows:

[0175] The optimization conditions are as follows:

[0176]

[0177]

[0178]

[0179] For the optimization condition, it means solving the system of partial differential equations for γ1(t), γ2(t) and δ1(t) for the Hamiltonian function H;

[0180] Simplifying, we get:

[0181]

[0182]

[0183] The three equations for γ1(t), γ2(t), and δ1(t) above are the optimization results obtained by solving the control variables using the maximum principle.

[0184]

[0185] `max` represents taking the maximum value of the obtained result;

[0186] Optimal control pair This is the result obtained by solving the control variables under optimal control.

[0187] The optimal control solution process of the pulse model is the same as the optimal control solution process of the continuous model, and the control variables, cost objective function, and cost parameters of the pulse model are the same as the control variables, cost objective function, and cost parameters of the continuous model.

[0188] In summary, this invention, starting from power industry control, establishes a common power control simulation diagram and constructs a corresponding two-layer coupled network structure based on graph theory and the fundamental theory of infectious disease models. For this coupled structure, various nodes in the upper and lower layers are classified and defined, and the transition ratios between nodes are explained in detail, ultimately constructing the corresponding node state transition diagram. Furthermore, based on the power CPS node state transition diagram, differential equations for continuous and impulse models are written. Using the maximum principle and considering the actual propagation of worm viruses in the network, appropriate cost parameters and control variables are selected, and the corresponding objective cost function is written. Based on the cost objective function, the corresponding Hamiltonian function is written, and costate variables and their differential equations are constructed. Finally, the optimal control pair of control variables is obtained by solving the equations. Considering the impact of isolation and immunization operations on the system, an optimized control strategy is proposed, which has a certain impact and significance in preventing the spread of malicious viruses in power CPS networks.

[0189] The key point of the above embodiments of the present invention is that, starting from the power CPS network model, considering the impact of isolation and immunity operations on the system, an optimized control strategy is proposed, which has a certain impact and significance on preventing the spread of malicious viruses in the power CPS network.

[0190] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for controlling the spread of malicious programs in a power system network, characterized in that: include: S1. Construct the actual simulation diagram of power CPS based on the actual operation of power system network; S2. According to the actual simulation diagram of the power CPS, the computer and programmable controller are simplified into nodes, and a double-layer coupling network diagram of the power CPS is constructed; Classifying the nodes into infected nodes, susceptible nodes, immune nodes, and isolated nodes according to the infection degree of the worm virus; the infected nodes include PC infected nodes and PLC infected nodes; the susceptible nodes include PC susceptible nodes and PLC susceptible nodes; The immune nodes include PC immune nodes and PLC immune nodes; The isolation nodes include PC isolation nodes and PLC isolation nodes; The immune node, the PC susceptible node, the PC susceptible node and the PC isolated node are PC nodes; the PLC infected node, the PLC susceptible node, the PLC immune node and the PLC isolated node are PLC nodes; S3. Based on the double-layer coupled network diagram of the power CPS, the infectious disease model modeling method is used to construct the node state transition diagram and establish the corresponding node differential equations; The corresponding node differential equation is specifically: The total number of PC nodes is N A It is represented by A =S A (t)+I A (t)+Q A (t)+R A (t); The total number of PLC nodes is N B It is represented by B =S B (t)+I B (t)+R B (t); Among them, PC susceptible nodes use S A (t) is used to represent; PC infected nodes are represented by I A (t) is used to represent; PC isolation nodes are represented by Q A (t) is used to represent; PC immune nodes are represented by R A (t) is used to represent; PLC susceptible nodes are represented by S B (t) is used to represent; PLC infected nodes use I B (t) is used to represent; PLC immune nodes use R B (t) to make an indication; Then the node differential equations can be expressed as follows: Among them, the infection rate caused by PC infection nodes is β AA and β BA The infection caused by the PLC infected node is represented by β AB and β BB The birth rate of PC susceptible nodes is represented by b; the birth rate and death rate of PC nodes are represented by μ1; the birth rate and death rate of PLC nodes are represented by μ2; the failure rate of PC immune nodes is represented by η1; the failure rate of PLC immune nodes is represented by η2; the virus detection rate of PC infected nodes is represented by γ1; the virus detection rate of PLC infected nodes is represented by γ2; the isolation rate of PC infected nodes is represented by δ1; the recovery rate of PC isolated nodes is represented by ω1; S4. Construct a cost objective function based on the virus detection and killing rate of infected nodes and the isolation rate of infected nodes; The cost objective function J(γ1,γ2,δ1) is: Where c1 represents the cost parameter for PC infected node detection and killing operation; c2 represents the cost parameter for PLC infected node detection and killing operation; c3 represents the cost parameter for PC infected node isolation operation; t f represents the terminal time of this optimal control; I A (t) with the I A (t) same; I B (t) with the I B (t) same; I A (t f ) represents the number of infected nodes in the PC network at the optimal control terminal time; I B (t f ) represents the number of infected nodes in the PLC network at the optimal control terminal time; dt represents the differential operator; the integral term represents the cost of virus detection and isolation; γ1(t), γ2(t) and δ1(t) represent the target cost function by controlling the corresponding control variables; S5. Use the maximum principle to solve the corresponding Hamiltonian function and co-state variables, and finally solve the optimal control pair of the system model.

2. A method for controlling the spread of malicious programs in a power system network according to claim 1, characterized in that: The system model is a continuous model and a pulse model, and the differential equation group of the pulse model is represented by time transformation coefficients.

3. A method for controlling the spread of malicious programs in a power system network according to claim 1, characterized in that: In the actual simulation diagram of the power CPS, the computer is connected to the Internet, the programmable controller is connected to the local area network, and the computer exchanges information with the programmable controller through a switch; the output end of the programmable controller is connected to the power system switch electrical appliances, relays and master electrical appliances.

4. A method for controlling the spread of malicious programs in a power system network according to claim 1, characterized in that: The infected node is a node that, when attacked by a worm virus, will randomly send out information containing the worm virus; the susceptible node is a node that is easily threatened and infected by a worm virus without installing the latest immune patch; the immune node is a node that has installed the latest immune patch and performed virus detection and killing. The immune node has immunity to the worm virus for a period of time. After a period of time, the immune patch becomes invalid and the immune node will be converted into a susceptible node.

5. A method for controlling the spread of malicious programs in a power system network according to claim 1, characterized in that: The specific steps of constructing the node state transition diagram are: It is known that when nodes are converted into other nodes, they are converted in a certain ratio. During the conversion, the direction is from one node as the starting point to another node as the end point. The worm virus infects along a certain direction. The worm virus from the computer spreads between the computer and the programmable controller. The worm virus from the programmable controller spreads between the computer and the programmable controller.

6. A method for controlling the spread of malicious programs in a power system network according to claim 2, characterized in that: The pulse model is specifically: it refers to the prevention and control of PC infected nodes and PLC infected nodes. The specific measures include virus detection and killing of PC infected nodes, virus detection and killing of PLC infected nodes, and isolation of PC infected nodes. The above operation process is relative to the global time, and it is assumed that at time t p Completed, the operation process is completed in an instant to indicate that these operations do not occupy too many network resources.

7. A method for controlling the spread of malicious programs in a power system network according to claim 6, characterized in that: The optimal control solution process of the pulse model is the same as the optimal control solution process of the continuous model, and the control variables, cost objective function, and cost parameters of the pulse model are the same as the control variables, cost objective function, and cost parameters of the continuous model.

Images