Behavioral anomaly detection, isolation method, device and system of power grid regulation cloud platform

Abstract

The application discloses a kind of behavior anomaly detection, isolation method, device and system of power grid regulation and control cloud platform, including the real-time connection relationship data of collection and external service node and real-time operating information of itself;The real-time connection relationship data of collection and external service node is input to the connection relationship evaluation model that is trained in advance, and the abnormal connection evaluation score of connection relationship is obtained, and compared with abnormal connection baseline score, whether the connection relationship of service node is abnormal connection is judged;The real-time operating information of collection and itself is input to the node behavior evaluation model that is trained in advance, and the abnormal behavior evaluation score is obtained, and compared with abnormal behavior baseline score, whether the behavior of service node is abnormal behavior is judged.The application can meet the network protection requirement of regulation and control cloud platform, realizes the effective isolation of the internal flow of regulation and control cloud platform.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a behavior anomaly detection and isolation method, device and system for a power grid regulation and control cloud platform. BACKGROUND

[0002] The regulation and control cloud platform is a cloud service platform for power grid dispatching business, and carries business functions such as regulation and control operation analysis, security control and auxiliary decision-making. Once attacked, it will cause problems such as business system collapse, data loss, leakage and destruction, and cause serious damage to business operation.

[0003] With the application of cloud computing technology in the regulation and control cloud platform, the traditional IT resource-carrying business system is changed into a virtualized resource and middleware-carrying business system. With the continuous application of new technologies such as cloud native, continuous delivery, container and microservice architecture, new challenges have been brought to network security. The rapid iteration of applications, cross-cloud resource scheduling will lead to dynamic adjustment of network structure, unreasonable security policy configuration and incomplete monitoring measures, which will increase the security risk of the regulation and control cloud platform.

[0004] The traditional network security defense scheme has obvious shortcomings under the impact of new technology application. Specifically, the research method of analyzing security problems and setting fixed rules becomes inefficient, even powerless; the abnormal access connection of the network is very complex, which needs to be manually set and defined rules, and takes a long time; it is easy to misreport, too many signal data sources and fragmented alarm rules need tedious analysis, and the misreporting or missing reporting rate is high; when the attack comes from the internal network, the protection provided by the traditional network boundary defense is extremely limited; the defense is mainly realized by manual mode, lacks the monitoring and identification of the behavior of nodes and the network behavior between nodes, and has not yet possessed the ability to efficiently manage a large number of host nodes and internal network behaviors of the regulation and control cloud. SUMMARY

[0005] In view of the above problems, the application provides a behavior anomaly detection and isolation method, device and system for a power grid regulation and control cloud platform.

[0006] In order to realize the above technical purpose and achieve the above technical effect, the application realizes the following technical scheme:

[0007] In a first aspect, the application provides a behavior anomaly detection method for a power grid regulation and control cloud platform, applied to a business node, comprising:

[0008] Collecting real-time connection relationship data with external business nodes and real-time running information of itself;

[0009] The collected real-time connection relationship data with the external business node is input into the pre-trained connection relationship evaluation model to obtain an abnormal connection evaluation score of the connection relationship, and compared with an abnormal connection baseline score to determine whether the connection relationship of the business node is an abnormal connection.

[0010] The collected real-time running information of itself is input into the pre-trained node behavior evaluation model to obtain an abnormal behavior evaluation score, and compared with an abnormal behavior baseline score to determine whether the behavior of the business node is an abnormal behavior.

[0011] Optionally, before the step of inputting the collected real-time connection relationship data with the external business node into the pre-trained connection relationship evaluation model, the method further comprises:

[0012] Receiving a connection relationship whitelist and a node behavior whitelist issued by the server;

[0013] Matching the collected real-time connection relationship data with the external business node with the connection relationship whitelist, and if the connection relationship whitelist can be successfully matched, determining that the connection relationship of the business node is a normal connection;

[0014] Matching the collected real-time running information of itself with the node behavior whitelist, and if the node behavior whitelist can be successfully matched, determining that the behavior of the business node is a normal behavior.

[0015] Optionally, the connection relationship evaluation model is obtained by the following steps:

[0016] Using historical connection relationship data with the external business node as a training set;

[0017] Using an isolated forest algorithm and the training set to train a machine learning model to obtain the connection relationship evaluation model and obtain an abnormal connection baseline score of the connection relationship evaluation model.

[0018] Optionally, the node behavior evaluation model is obtained by the following steps:

[0019] Using historical running information of itself as a training set;

[0020] Using an isolated forest algorithm and the training set to train a machine learning model to obtain the node behavior evaluation model and obtain an abnormal behavior baseline score of the node behavior evaluation model.

[0021] Optionally, the real-time connection relationship data with the external business node and the real-time running information of itself are collected by the following steps:

[0022] Intercepting traffic messages sent by an external service node to the service node and sent by the service node to the external service node using netfilter technology;

[0023] Analyzing the traffic messages to obtain real-time connection relationship data of the external service node and real-time running information of the service node.

[0024] Optionally, the connection relationship data comprises: <local IP, local port, remote IP, remote port, network protocol, process ID, process name, connection time>.

[0025] The local IP refers to the IP address of the service node itself.

[0026] The local port refers to the port opened by the service node itself for connection with the external service node.

[0027] The remote IP refers to the IP address of the external service node connected to the service node.

[0028] The remote port refers to the port opened by the external service node connected to the service node.

[0029] The network protocol refers to the collection of agreements and communication rules commonly followed by both parties.

[0030] The process ID refers to the ID of the connection relationship between the service node and the external service node in the process of the service node.

[0031] The process name refers to the name of the connection relationship between the service node and the external service node in the process of the service node.

[0032] The connection time refers to the time of the collected connection relationship.

[0033] The running information comprises: <local IP, all open ports, all running process information, service group to which the node belongs, node memory usage, node CPU usage>.

[0034] The local IP refers to the IP address of the service node itself.

[0035] The all open ports refer to all open ports of the service node.

[0036] The running process information refers to the attributes contained in the running process, including the user to which the process belongs, the process ID, the process startup time, the actual instructions of the process, the physical memory ratio occupied by the process, and the CPU resource ratio occupied by the process.

[0037] The service to which the node belongs refers to different service groups distinguished by the server for classified management of assets.

[0038] The node memory usage refers to the proportion of the used memory of the service node to the total memory size.

[0039] The node CPU usage refers to the proportion of the CPU resource occupied by the running program of the service node.

[0040] In a second aspect, the application provides a behavior anomaly isolation method of a power grid regulation cloud platform, comprising:

[0041] When an abnormal connection is detected based on the behavior anomaly detection method, a micro-isolation strategy corresponding to the abnormal connection is established, and the service node is prohibited from accessing the external service node or the external service node is prohibited from accessing the service node.

[0042] When an abnormal node behavior is detected based on the behavior anomaly detection method, a micro-isolation strategy of external disconnection is established, and the service node is prohibited from connecting to the outside.

[0043] The behavior anomaly isolation method further comprises:

[0044] receiving the micro-isolation strategy issued by the service end;

[0045] When an abnormal connection is detected based on the behavior anomaly detection method, if the abnormal connection meets the requirements of the received micro-isolation strategy, the service node is prohibited from accessing the external service node or the external service node is prohibited from accessing the service node based on the received micro-isolation strategy;

[0046] When an abnormal node behavior is detected based on the behavior anomaly detection method, if the abnormal node behavior meets the requirements of the received micro-isolation strategy, the service node is prohibited from connecting to the outside based on the received micro-isolation strategy.

[0047] Optionally, the behavior anomaly isolation method further comprises:

[0048] sending the established micro-isolation strategy to the service end to update the micro-isolation strategy saved in the service end.

[0049] Optionally, the micro-isolation strategy comprises a strategy name, a type, an access, an access port, a service, a service object and a strategy description.

[0050] The strategy name refers to the name of the micro-isolation strategy.

[0051] The type refers to the type to which the micro-isolation strategy belongs, including a blacklist and a whitelist.

[0052] The access refers to the IP source address limited by the micro-isolation strategy.

[0053] The access port refers to the source port limited by the micro-isolation strategy.

[0054] The service object refers to the protocol and destination port restricted by the micro-isolation strategy.

[0055] The service object refers to the protocol and destination port restricted by the micro-isolation strategy.

[0056] In a third aspect, the application provides a behavior anomaly detection device of a power grid regulation and control cloud platform, comprising:

[0057] The collection module is configured to collect real-time connection relationship data of external service nodes and real-time operation information of the device;

[0058] The abnormal connection judgment module is configured to input the collected real-time connection relationship data of external service nodes into a pre-trained connection relationship evaluation model to obtain an abnormal connection evaluation score of the connection relationship, and compare the abnormal connection evaluation score with an abnormal connection baseline score to determine whether the connection relationship of the service node is abnormal.

[0059] The abnormal behavior judgment module is configured to input the collected real-time operation information of the device into a pre-trained node behavior evaluation model to obtain an abnormal behavior evaluation score, and compare the abnormal behavior evaluation score with an abnormal behavior baseline score to determine whether the behavior of the service node is abnormal.

[0060] In a fourth aspect, the application provides a behavior anomaly detection system of a power grid regulation and control cloud platform, comprising a storage medium and a processor.

[0061] The storage medium is configured to store instructions.

[0062] The processor is configured to operate according to the instructions to perform the method according to any one of the embodiments 1.

[0063] In a fifth aspect, the application provides a behavior anomaly isolation device of a power grid regulation and control cloud platform, comprising:

[0064] The first isolation module is configured to establish a micro-isolation strategy to disconnect the abnormal connection when the abnormal connection is detected based on the behavior anomaly detection method, and prohibit the service node from accessing external service nodes or external service nodes from accessing the service node.

[0065] The second isolation module is configured to establish a micro-isolation strategy to disconnect the external connection when the abnormal node behavior is detected based on the behavior anomaly detection method, and prohibit the service node from connecting to the external connection.

[0066] In a sixth aspect, the application provides a behavior anomaly isolation system of a power grid regulation and control cloud platform, comprising a storage medium and a processor.

[0067] The storage medium is configured to store instructions.

[0068] The processor is configured to operate according to the instructions to perform the method according to any one of the second aspect.

[0069] Compared with the prior art, the application has the following beneficial effects:

[0070] The application can effectively solve the problems that abnormal connection between the inside and outside of the cloud platform cannot be timely blocked and abnormal behavior in the cloud platform cannot be timely prevented, prevent all unnecessary access, prohibit internal attacks on the cloud platform, improve the intelligent management capability of the cloud platform, and guarantee the confidentiality, integrity and stability of the cloud platform, greatly improve the security management, network communication, data security and computing environment security, and thus improve the comprehensive defense capability of the cloud platform. BRIEF DESCRIPTION OF DRAWINGS

[0071] In order to make the content of the application more easily understood, the application will be further described in detail below according to specific embodiments and in conjunction with the drawings, in which:

[0072] Figure 1 The figure is a structural schematic diagram of the power grid regulation cloud platform of an embodiment of the application. DETAILED DESCRIPTION

[0073] In order to make the content of the application more easily understood, the application will be further described in detail below according to specific embodiments and in conjunction with the drawings, in which:

[0074] The application principle of the application will be described in detail below in conjunction with the drawings.

[0075] Embodiment 1

[0076] The application embodiment provides a behavior anomaly detection method of a power grid regulation cloud platform, applied to a business node, including:

[0077] (1) collecting real-time connection relationship data of an external business node and real-time running information of itself;

[0078] (2) inputting the collected real-time connection relationship data of the external business node into a pre-trained connection relationship evaluation model to obtain an abnormal connection evaluation score of the connection relationship, and comparing the abnormal connection evaluation score with an abnormal connection baseline score to determine whether the connection relationship of the business node is abnormal connection;

[0079] (3) inputting the collected real-time running information of itself into a pre-trained node behavior evaluation model to obtain an abnormal behavior evaluation score, and comparing the abnormal behavior evaluation score with an abnormal behavior baseline score to determine whether the behavior of the business node is abnormal behavior.

[0080] In an embodiment of the present application, the connection relationship data includes: <local IP, local port, remote IP, remote port, network protocol, process ID, process name, connection time>, wherein the local IP refers to the IP address of the service node itself; the local port refers to the port opened by the node itself connected with the external service node; the remote IP refers to the IP address of the external service node connected with the service node collected by the service node; the remote port refers to the port opened by the external service node connected with the service node collected by the service node; the network protocol refers to the collection of agreements and communication rules commonly followed by both parties; the process ID refers to the ID of the connection relationship between the service node and the external service node in the process itself; the process name refers to the name of the connection relationship between the service node and the external service node in the process itself; the connection time refers to the time of the collected connection relationship; the running information includes: <local IP, all open ports, all running process information, node business group, node memory usage, node CPU usage>; wherein the local IP refers to the IP address of the service node itself; the all open ports refers to all open ports of the service node; the running process information refers to the attributes contained by the running process, including the user to which the process belongs, the process ID, the process startup time, the actual instructions of the process, the physical memory ratio occupied by the process and the CPU resource ratio occupied by the process; the node business refers to the different business groups distinguished by the server in the classification management of assets; the node memory usage refers to the proportion of the used memory of the service node to the total memory size; the node CPU usage refers to the proportion of the CPU resource occupied by the running program of the service node.

[0081] In an embodiment of the present application, before the step of inputting the collected real-time connection relationship data of the external service node into the pre-trained connection relationship evaluation model, the following steps are further included:

[0082] receiving the connection relationship white list and the node behavior white list issued by the server;

[0083] matching the collected real-time connection relationship data of the external service node with the connection relationship white list, if the connection relationship white list can be successfully matched, determining that the connection relationship of the service node is normal connection;

[0084] matching the collected real-time running information of the service node with the node behavior white list, if the node behavior white list can be successfully matched, determining that the behavior of the service node is normal behavior.

[0085] In an embodiment of the present application, the connection relationship evaluation model is obtained by the following steps:

[0086] using connection relationship data with external service node history as a training set;

[0087] using an isolation forest algorithm and the training set to train a machine learning model, obtaining a connection relationship evaluation model and an abnormal connection baseline score of the connection relationship evaluation model.

[0088] In one specific embodiment of the embodiment of the application, the node behavior evaluation model is trained by the following steps:

[0089] using the running information of the self history as a training set;

[0090] using an isolation forest algorithm and the training set to train a machine learning model, obtaining a node behavior evaluation model and an abnormal behavior baseline score of the node behavior evaluation model.

[0091] In one specific embodiment of the embodiment of the application, the connection relationship data with the external service node in real time and the running information of the self in real time are obtained by the following steps:

[0092] using the netfilter technology to intercept traffic messages sent by the external service node to the service node and sent by the service node to the external service node;

[0093] obtaining the connection relationship data with the external service node in real time and the running information of the self in real time based on the traffic messages.

[0094] Referring to Figure 1 The behavior anomaly detection method of the power grid regulation and control cloud platform specifically includes the following steps:

[0095] S1, respectively in the service end and each business node (i.e. host node, also known as client node) in the power grid regulation and control cloud management platform Deploy software, so that each business node can be connected with the service end, and respectively registered to the service end, each business node respectively receives the instructions and micro-isolation strategies sent by the service end. Each business node and the service end management platform together constitute an internal regulation and control cloud.

[0096] The software in the service end needs to open the specified TCP port of the service end when starting. The port is the communication port of the service end and each business node. The service end issues instructions and accepts information through the port. The application requires that the port must be opened to ensure normal communication between the service end and each business node.

[0097] S2, the service end will group the business nodes, and distribute the connection relationship white list and node behavior white list related to each business node to the corresponding business node, and will also distribute the specified machine learning model training algorithm and related micro-isolation strategy information to each business node, so that each business node can perform machine learning model training.

[0098] S3, each business node continuously collects the real-time connection relationship of each business node with external business nodes and the real-time running information of itself within a certain time range, and records and saves it locally, and the business node supports periodic collection of real-time connection relationship of each business node with external business nodes and real-time running information of itself.

[0099] The content of the connection relationship is as follows:

[0100] <Local IP, local port, remote IP, remote port, network protocol, process ID, process name, connection time>

[0101] Among them:

[0102] The local IP refers to the IP address of the business node itself;

[0103] The local port refers to the port opened by the node itself connected with the external business node;

[0104] The remote IP refers to the IP address of the external business node connected with the business node;

[0105] The remote port refers to the port opened by the external business node connected with the business node;

[0106] The network protocol refers to the collection of agreements and communication rules that both parties must jointly comply with for communication;

[0107] The process ID refers to the ID of the connection relationship between the business node and the external business node in the process itself;

[0108] The process name refers to the name of the connection relationship between the business node and the external business node in the process itself;

[0109] The connection time refers to the time of the collected connection relationship;

[0110] The content of the running information is as follows:

[0111] <Local IP, all open ports, all running process information, node belongs to business group, node memory usage, node CPU usage>

[0112] Among them:

[0113] The local IP refers to the IP address of the service node itself;

[0114] The open all ports refer to all open ports of the service node;

[0115] The running process information refers to the attributes contained by the running process, including the user to which the process belongs, the process ID, the process startup time, the actual instructions of the process, the physical memory ratio occupied by the process, and the CPU resource ratio occupied by the process;

[0116] The node belongs to the service refers to different business groups distinguished by the server in the classification management of assets;

[0117] The node memory usage refers to the proportion of the used memory of the service node to the total memory size;

[0118] The node CPU usage refers to the proportion of the CPU resources occupied by the running program of the service node.

[0119] S4, the service node uses the connection relationship data with the external service node history and the historical running information of itself as the machine learning model training set, and uses the isolated forest algorithm to start training the model, including the following processes:

[0120] (1) According to the specific content of the training set, the number of isolated trees of the isolated forest algorithm, the number of features of each sub-tree, and the number of sub-tree samples are constructed;

[0121] (2) Start training the isolated tree, sample from the training set, construct the isolated tree, test each isolated tree in the forest, and record the path length;

[0122] (3) After the training of a single isolated tree is completed, the generated isolated tree can be used to evaluate the test data, that is, to calculate the anomaly score:

[0123]

[0124] Wherein:

[0125] x: refers to the extracted sample;

[0126] refers to the number of samples;

[0127] h(x): refers to the height of sample x in each tree;

[0128] refers to the average value of the path length when the given number of samples ;

[0129] E(h(x)): refers to the average height of the isolated tree.

[0130] (4) The connection relationship evaluation model and the node behavior evaluation model are respectively trained using the training data of the connection relationship and the running information of the service node itself after training, and the abnormal connection baseline score and the abnormal behavior baseline score are calculated through the above formula.

[0131] The abnormal connection baseline score refers to the baseline of the abnormal connection evaluation score, the value of which is between 0 and 1, which is used as a standard for judging whether the connection relationship is abnormal. If the evaluation score of the connection relationship is greater than the baseline value, the connection relationship is judged to be abnormal.

[0132] The abnormal behavior baseline score refers to the baseline of the abnormal behavior evaluation score, the value of which is between 0 and 1, which is used as a standard for judging whether the behavior is abnormal. If the evaluation score of the behavior is greater than the baseline value, the behavior is judged to be abnormal.

[0133] S5, the service node starts real-time research and judgment of abnormal connection and abnormal behavior.

[0134] The service node collects real-time connection relationship data with external service nodes and real-time running information of itself;

[0135] First, the collected data is matched with the whitelist issued by the server. If the whitelist can be hit, the connection relationship of the service node is normal, and no abnormal detection is needed by using the connection relationship evaluation model and the node behavior evaluation model. Otherwise, the connection relationship evaluation model and the node behavior evaluation model are used for abnormal detection. Specifically:

[0136] The real-time connection relationship data with external service nodes and the real-time running information of itself are respectively input into the connection relationship evaluation model and the node behavior evaluation model trained, and the abnormal connection evaluation score and the abnormal behavior evaluation score are calculated.

[0137] The abnormal connection evaluation score and the abnormal connection baseline score are compared, and the abnormal behavior evaluation score and the abnormal behavior baseline score are compared. If it is greater than the corresponding baseline score, the corresponding behavior is judged to be abnormal.

[0138] S6, each service node periodically collects the latest real-time connection relationship data with external service nodes and real-time running information of itself, and when the machine learning model is trained, the last training result can be reused to update the training model, so as to improve the training efficiency of the machine learning model.

[0139] It can be seen that the behavior abnormality detection method in the embodiment of the application can enable the service nodes in the power grid regulation and control cloud platform to intelligently and efficiently detect behavior abnormalities / abnormal connections, so as to achieve rapid abnormal response of the cloud platform.

[0140] Embodiment 2

[0141] The embodiment of the application provides a behavior anomaly isolation method of a power grid regulation cloud platform, and comprises the following steps:

[0142] When an abnormal connection is detected based on the behavior anomaly detection method in the embodiment 1, a micro-isolation strategy of disconnecting the abnormal connection is established, and the business node is prohibited from accessing the external business node or the external business node is prohibited from accessing the business node;

[0143] When an abnormal node behavior is detected based on the behavior anomaly detection method in the embodiment 1, a micro-isolation strategy of disconnecting the external connection is established, and the business node is prohibited from connecting with the external connection.

[0144] In one specific embodiment of the embodiment of the application, the behavior anomaly isolation method further comprises:

[0145] receiving the micro-isolation strategy sent by the server;

[0146] When an abnormal connection is detected based on the behavior anomaly detection method, if the abnormal connection meets the requirement of the received micro-isolation strategy, the business node is prohibited from accessing the external business node or the external business node is prohibited from accessing the business node based on the received micro-isolation strategy;

[0147] When an abnormal node behavior is detected based on the behavior anomaly detection method, if the abnormal node behavior meets the requirement of the received micro-isolation strategy, the business node is prohibited from connecting with the external connection based on the received micro-isolation strategy.

[0148] In one specific embodiment of the embodiment of the application, the behavior anomaly isolation method further comprises:

[0149] sending the established micro-isolation strategy to the server to update the micro-isolation strategy stored in the server.

[0150] In one specific embodiment of the embodiment of the application, the micro-isolation strategy comprises a strategy name, a type, an access, an access port, a service, a service object and a strategy description; the strategy description refers to the information such as a creation reason and a creator;

[0151] The strategy name refers to the name of the micro-isolation strategy;

[0152] The type refers to the type to which the micro-isolation strategy belongs, and the type comprises a blacklist and a whitelist;

[0153] The access refers to the IP source address limited by the micro-isolation strategy;

[0154] The access port refers to the source port limited by the micro-isolation strategy;

[0155] The service refers to the destination address to which the micro-isolation strategy is applied;

[0156] The service object refers to a protocol and a destination port limited by the micro-isolation policy.

[0157] The abnormal behavior isolation method in the embodiment of the application will be described in detail below in combination with a specific implementation.

[0158] S1, software is respectively deployed in a service end in a power grid regulation and control cloud management platform and each business node (i.e. a host node, i.e. a client node), so that each business node can be connected with the service end, and is respectively registered to the service end, each business node respectively receives an instruction and a micro-isolation policy sent by the service end, and can acquire a micro-isolation policy execution condition of each business node. Each business node and the service end management platform jointly constitute an internal regulation and control cloud.

[0159] The software in the service end needs to open a TCP port specified by the service end when starting, the port is a communication port of the service end and each business node, the service end sends an instruction and accepts information through the port, and the application requires that the port must be opened to ensure normal communication between the service end and each business node.

[0160] S2, a micro-isolation policy is manually generated by the service end, is applied to a corresponding business node, and forms a corresponding boundary protection, including the following processes:

[0161] (1) An administrator manually inputs the content of micro-isolation in the service end to form a micro-isolation policy;

[0162] The main content of the micro-isolation policy is as follows:

[0163] <Policy name, type, visitor, visitor port, service provider, service object and description>

[0164] Among them:

[0165] Type: refers to the type of the created policy, including a blacklist and a whitelist;

[0166] Visitor: refers to an initiator of access or an access source, i.e. a source IP address limited by the micro-isolation policy, which can be a specified business group or node, or a specified IP address, an IP address range or no limit to any address;

[0167] Visitor port: refers to a source port limited by the micro-isolation policy;

[0168] Service provider: refers to a host providing a service, i.e. a destination address acted on by the micro-isolation policy, which can be a specified business group or node;

[0169] Service object: refers to a protocol and a destination port limited by the micro-isolation policy;

[0170] Description: refers to the description of the created micro-isolation policy.

[0171] (2) The service end issues the created micro-isolation policy to a specified business node or a specified business group;

[0172] (3) The business node uses the netfilter framework technology hook mounting point: NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT, and registers the corresponding processing function at the mounting point. When a data packet passes through the mounting point, the business node can intercept the network traffic message sent by the external business node to the local business node and the network traffic message sent by the local business node to the external business node, and parse the intercepted network traffic message to obtain the source IP address, source port, destination IP address, destination port and network protocol of the network traffic message;

[0173] (4) If the intercepted network traffic message data meets the isolation requirements of the existing micro-isolation policy, NF_DROP is returned directly, the transmission of the network traffic message data is interrupted and discarded, and if the isolation requirements are not met, NF_ACCEPT is returned directly, and the connection relationship is not interrupted;

[0174] S3, the business node automatically generates a micro-isolation policy to block the connection relationship or the external connection relationship, and reports to the service end. If an abnormal connection relationship is detected, the existing connection relationship is blocked. If an abnormal behavior of the node is detected, all connection relationships between the business node and the external are blocked. The process includes the following:

[0175] (1) The business node uses the netfilter framework technology hook mounting point: NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT, and registers the corresponding processing function at the mounting point. The business node intercepts the network traffic message sent by the external business node to the local business node and the network traffic message sent by the local business node to the external business node, parses to obtain the source IP address, source port, destination IP address, destination port and network protocol, and saves locally. At the same time, real-time connection relationship data with the external business node and real-time running information of itself within a certain time range are collected;

[0176] (2) Based on the trained connection relationship evaluation model, the real-time connection relationship data collected and analyzed with the external business node is used to calculate the abnormal connection evaluation score, and compared with the abnormal connection baseline score to determine whether the connection relationship of the node is an abnormal connection;

[0177] (3) If the connection relationship is judged as an abnormal connection, the mounting point processing function of the business node directly returns NF_DROP to interrupt the data connection, and builds a corresponding micro-isolation policy;

[0178] (4) based on the trained node behavior evaluation model, using the real-time collected and analyzed real-time running information of itself, calculating the abnormal behavior evaluation score of the running information, and comparing with the abnormal behavior baseline score, to determine whether the node behavior is abnormal behavior;

[0179] (5) if the running information of the service node is abnormal behavior, the service node immediately terminates the network connection with the external service node, and builds a corresponding micro-isolation strategy to prohibit the service node from accessing the external or external access node;

[0180] (6) after the service node detects the abnormal behavior and creates the micro-isolation strategy, the self-built micro-isolation strategy is directly reported to the server to form a visual micro-isolation strategy of the server, facilitating unified management;

[0181] (7) if the service node has no abnormal node behavior for a long time, the micro-isolation strategy created before can be automatically cancelled according to the actual situation, and the information is reported to the server.

[0182] The method has strong adaptability, outputs more accurate behavior abnormal risk, and enables the regulation and control cloud platform to more intelligently realize the safety isolation between nodes, prevents attacks initiated by the outside of the regulation and control cloud to the inside and attacks initiated by the inside of the platform, simultaneously solves the problem that network attacks between business nodes in the regulation and control cloud platform cannot be quickly and timely blocked, realizes automatic arrangement response of behavior abnormality, meets the needs of east-west traffic isolation in the regulation and control cloud platform, and guarantees the safety and stability of the entire environment. The network traffic is divided into two types, one is the traffic between external users and internal servers, such traffic is called north-south traffic or vertical traffic, and the other is the traffic between servers in the data center, also called east-west traffic or horizontal traffic.

[0183] Embodiment 3

[0184] The application embodiment provides a behavior abnormality detection device of a power grid regulation and control cloud platform, which comprises:

[0185] The acquisition module is configured to acquire real-time connection relationship data of the external service node and real-time running information of itself.

[0186] The abnormal connection judgment module is configured to input the acquired real-time connection relationship data of the external service node into a pre-trained connection relationship evaluation model to obtain an abnormal connection evaluation score of the connection relationship, and compare the abnormal connection evaluation score with an abnormal connection baseline score to determine whether the connection relationship of the service node is abnormal connection.

[0187] An abnormal behavior judging module is configured to input the collected real-time running information of the self into a pre-trained node behavior evaluation model to obtain an abnormal behavior evaluation score, and compare the abnormal behavior evaluation score with an abnormal behavior baseline score to determine whether the behavior of the business node is abnormal.

[0188] The remaining parts are the same as those of Example 1.

[0189] Example 4

[0190] In the embodiments of the present application, a behavior anomaly detection system of a power grid regulation cloud platform is provided, which comprises a storage medium and a processor.

[0191] The storage medium is configured to store instructions.

[0192] The processor is configured to operate according to the instructions to perform the method according to any one of the embodiments 1.

[0193] Example 5

[0194] In the embodiments of the present application, a behavior anomaly isolation device of a power grid regulation cloud platform is provided, which comprises:

[0195] A first isolation module is configured to, when an abnormal connection is detected based on the behavior anomaly detection method, establish a micro-isolation strategy of disconnecting the abnormal connection, and prohibit the business node from accessing the external business node or the external business node from accessing the business node.

[0196] A second isolation module is configured to, when an abnormal node behavior is detected based on the behavior anomaly detection method, establish a micro-isolation strategy of disconnecting with the outside, and prohibit the connection between the business node and the outside.

[0197] The remaining parts are the same as those of Example 2.

[0198] Example 6

[0199] In the embodiments of the present application, a behavior anomaly isolation system of a power grid regulation cloud platform is provided, which comprises a storage medium and a processor.

[0200] The storage medium is configured to store instructions.

[0201] The processor is configured to operate according to the instructions to perform the method according to any one of the embodiments 2.

[0202] The above shows and describes the basic principles and main features of the present application and the advantages of the present application. Those skilled in the art should understand that the present application is not limited to the above embodiments, and the above embodiments and descriptions in the specification are only to illustrate the principles of the present application. Without departing from the spirit and scope of the present application, various changes and improvements can be made to the present application, and these changes and improvements all fall within the scope of the claimed present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A method for detecting abnormal behaviors of a power grid regulation cloud platform, characterized in that, The application is applied to a service node, comprising: collecting real-time connection relationship data with external service nodes and real-time running information of itself; inputting the collected real-time connection relationship data with external service nodes into a pre-trained connection relationship evaluation model to obtain an abnormal connection evaluation score of the connection relationship, and comparing the abnormal connection evaluation score with an abnormal connection baseline score to determine whether the connection relationship of the service node is abnormal connection; inputting the collected real-time running information of itself into a pre-trained node behavior evaluation model to obtain an abnormal behavior evaluation score, and comparing the abnormal behavior evaluation score with an abnormal behavior baseline score to determine whether the behavior of the service node is abnormal behavior; when abnormal connection is detected, a micro-isolation strategy corresponding to the abnormal connection is established to prohibit the service node from accessing the external service node or the external service node from accessing the service node; when abnormal node behavior is detected, a micro-isolation strategy is established to disconnect with the outside, and the service node is prohibited from connecting with the outside; The method further comprises: receiving a micro-isolation strategy issued by a server; when abnormal connection is detected, if the abnormal connection meets the requirements of the received micro-isolation strategy, the service node is prohibited from accessing the external service node or the external service node from accessing the service node based on the received micro-isolation strategy; when abnormal node behavior is detected, if the abnormal node behavior meets the requirements of the received micro-isolation strategy, the service node is prohibited from connecting with the outside based on the received micro-isolation strategy; The method further comprises: sending the established micro-isolation strategy to the server to update the micro-isolation strategy saved in the server. 2.The method of claim 1, wherein the method further comprises: The method further comprises, before the step of inputting the collected real-time connection relationship data with external service nodes into a pre-trained connection relationship evaluation model: receiving a connection relationship whitelist and a node behavior whitelist issued by a server; matching the collected real-time connection relationship data with external service nodes with the connection relationship whitelist, if the connection relationship whitelist can be successfully matched, it is determined that the connection relationship of the service node is normal connection; matching the collected real-time running information of itself with the node behavior whitelist, if the node behavior whitelist can be successfully matched, it is determined that the behavior of the service node is normal behavior. 3.The method of claim 1, wherein the method further comprises: The connection relationship evaluation model is trained by the following steps: using historical connection relationship data with external service nodes as a training set; using an isolated forest algorithm and the training set to train a machine learning model to obtain a connection relationship evaluation model and obtain an abnormal connection baseline score of the connection relationship evaluation model. 4.The method of claim 1, wherein the method further comprises: The node behavior evaluation model is trained by the following steps: using historical running information of itself as a training set; using an isolated forest algorithm and the training set to train a machine learning model to obtain a node behavior evaluation model and obtain an abnormal behavior baseline score of the node behavior evaluation model. 5.The method of claim 1, wherein the method further comprises: The real-time connection relationship data with external service nodes and the real-time running information of itself are collected by the following steps: using netfilter technology to intercept traffic messages sent by external service nodes to the service node and traffic messages sent by the service node to external service nodes; The connection relationship data in real time with the external service node and the running information in real time of the service node are obtained based on the traffic message analysis. 6.The method of claim 1, wherein the method further comprises: The connection relationship data comprises: <local IP, local port, remote IP, remote port, network protocol, process ID, process name, and connection time>. The local IP refers to the IP address of the service node itself. The local port refers to the port opened by the service node for connection with the external service node. The remote IP refers to the IP address of the external service node connected with the service node. The remote port refers to the port opened by the external service node connected with the service node. The network protocol refers to the collection of agreements and communication rules observed by both parties. The process ID refers to the ID of the connection relationship between the service node and the external service node in the process of the service node itself. The process name refers to the name of the connection relationship between the service node and the external service node in the process of the service node itself. The connection time refers to the time of the collected connection relationship. The running information comprises: <local IP, all opened ports, all running process information, service group to which the node belongs, memory usage rate of the node, and CPU usage rate of the node>. The local IP refers to the IP address of the service node itself. The all opened ports refer to all the opened ports of the service node. The running process information refers to the attributes contained in the running process, including the user to which the process belongs, the process ID, the process startup time, the actual instructions of the process, the physical memory ratio occupied by the process, and the CPU resource ratio occupied by the process. The service group to which the node belongs refers to the different service groups distinguished by the server in the classification management of assets. The memory usage rate of the node refers to the proportion of the used memory of the service node to the total memory size. The CPU usage rate of the node refers to the proportion of the CPU resource occupied by the running program of the service node. 7.The method of claim 1, wherein, The micro-isolation strategy comprises: a strategy name, a type, an access, an access port, a service, a service object, and a strategy description. The strategy name refers to the name of the micro-isolation strategy. The type refers to the type to which the micro-isolation strategy belongs, including a blacklist and a whitelist. The access refers to the IP source address restricted by the micro-isolation strategy. The access port refers to the source port restricted by the micro-isolation strategy. The service refers to the destination address acted on by the micro-isolation strategy. The service object refers to the protocol and the destination port restricted by the micro-isolation strategy.

8. A device for detecting abnormal behavior of a power grid regulation cloud platform, characterized in that, The collection module is configured to collect the connection relationship data in real time with the external service node and the running information in real time of the service node. The abnormal connection judgment module is configured to input the collected connection relationship data in real time with the external service node into a pre-trained connection relationship evaluation model to obtain an abnormal connection evaluation score of the connection relationship, and compare the abnormal connection evaluation score with an abnormal connection baseline score to determine whether the connection relationship of the service node is an abnormal connection. ​ The abnormal behavior judging module is configured to input the collected real-time running information of the self into a pre-trained node behavior evaluation model to obtain an abnormal behavior evaluation score, compare the abnormal behavior evaluation score with an abnormal behavior baseline score, and judge whether the behavior of the service node is abnormal behavior. The first isolation module is configured to, when detecting an abnormal connection, establish a micro-isolation strategy corresponding to the abnormal connection, and prohibit the service node from accessing an external service node or the external service node from accessing the service node. The second isolation module is configured to, when detecting abnormal node behavior, establish a micro-isolation strategy corresponding to the abnormal node behavior, and prohibit the service node from connecting with the external service node. The behavior abnormality detection apparatus is further configured to: receive a micro-isolation strategy issued by a service end; when detecting an abnormal connection, if the abnormal connection meets the requirement of the received micro-isolation strategy, prohibit the service node from accessing an external service node or the external service node from accessing the service node based on the received micro-isolation strategy; when detecting abnormal node behavior, if the abnormal node behavior meets the requirement of the received micro-isolation strategy, prohibit the service node from connecting with the external service node based on the received micro-isolation strategy; The behavior abnormality detection apparatus is further configured to: send the established micro-isolation strategy to the service end to update the micro-isolation strategy stored in the service end. 9.A behavior anomaly detection system of a power grid regulation cloud platform, characterized in that: comprise a storage medium and a processor; The storage medium is configured to store instructions; The processor is configured to operate according to the instructions to execute the method according to any one of claims 1-7.

Images