A knowledge correlation analysis method and device for a power distribution secondary system

Abstract

The application provides a knowledge correlation analysis method and device for a power distribution secondary system, and the method comprises the following steps: obtaining target information in the power distribution secondary system, wherein the target information comprises asset maintenance information, threat dimension information and vulnerability dimension information; removing the target information according to an improved J-Hash method to obtain short text information after removing the target information; generating knowledge triples for the power distribution secondary system by using an optimized knowledge extraction model according to the short text information; and generating a knowledge graph for the power distribution secondary system according to the knowledge triples and an external expert knowledge base. Through the application, the problem of low efficiency of knowledge correlation analysis for the power distribution secondary system in the related art is solved.

Description

Technical Field

[0001] This invention relates to the fields of text information processing and information extraction, and in particular to a knowledge association analysis method and apparatus for power distribution secondary systems. Background Technology

[0002] The power distribution secondary system is a system composed of relay protection, automatic safety control, system communication, DCS automatic control system, and dispatch automation. It is an indispensable and important component of the power system, and the safety of the secondary system is crucial to the safety of the entire power distribution system. With the development of big data, textual data resources related to the power distribution secondary system are rapidly increasing. Analyzing this data can help identify potential hazards in the system.

[0003] Traditional security event correlation analysis techniques based on multi-source information store information from multiple dimensions in relational databases. However, due to poor collaboration between these dimensions, the real-time performance and accuracy of the correlation analysis are affected. Storage is also inflexible; updates to data in one dimension cannot be promptly correlated with other dimensions, impacting subsequent searches. Rule-based correlation analysis relies on expert knowledge to construct attack scenarios, and it typically cannot automatically analyze and reason about novel attacks not found in the attack template knowledge base. When using existing technologies for knowledge correlation analysis in the field of power distribution secondary systems, the diverse sources of unstructured data lead to significant duplication of knowledge, and knowledge extraction efficiency is low. Therefore, existing technologies suffer from low efficiency in knowledge correlation analysis for power distribution secondary systems. Summary of the Invention

[0004] This invention provides a method and apparatus for knowledge association analysis of power distribution secondary systems, which at least solves the problem of low efficiency in knowledge association analysis of power distribution secondary systems in related technologies.

[0005] According to a first aspect of the present invention, a knowledge association analysis method for a power distribution secondary system is provided. The method includes: acquiring target information in the power distribution secondary system, wherein the target information includes asset-dimensional information, threat-dimensional information, and vulnerability-dimensional information; deduplicating the target information using an improved J-Hash method to obtain deduplicated short text information; generating knowledge triples for the power distribution secondary system based on the short text information using an optimized knowledge extraction model; and generating a knowledge graph for the power distribution secondary system based on the knowledge triples and an external expert knowledge base.

[0006] Optionally, before performing deduplication on the target information according to the improved J-Hash method to obtain deduplicated short text information, the method further includes: deleting useless symbols in the target information; segmenting the target information after deleting useless symbols into sentences to obtain multiple sentences; deleting sentences that do not contain entities and sentences with a text length less than a preset value to obtain a dataset composed of multiple sentences.

[0007] Optionally, the step of deduplicating the target information using the improved J-Hash method to obtain deduplicated short text information includes: segmenting sentences in the dataset using Jieba segmentation and a preset dictionary to generate feature vectors corresponding to words in the sentences; determining the weights corresponding to each feature vector based on the product of three factors: the ratio of the number of times the target word appears in the dataset to the number of words contained in the dataset, the logarithm of the ratio of the total number of datasets to the number of datasets containing the target word, and the logarithm of the ratio of the number of secondary distribution system subsystems to the number of secondary distribution system subsystems containing the target word; calculating the hash value corresponding to the feature vector after determining the weights to obtain the n-bit signature corresponding to the hash value; merging and dimensionality reduction of the n-bit signatures to obtain the n-bit signature of the dataset; calculating the similarity between the n-bit signatures of any two datasets based on the Hamming distance and the number of bits in the n-bit signature of the dataset; and when the similarity is less than a preset threshold, selecting one of the two datasets as the deduplicated short text information and deleting the other dataset.

[0008] Optionally, the step of generating knowledge triples for the power distribution secondary system based on the short text information using the optimized knowledge extraction model includes: generating corresponding word vectors based on the short text information using a word embedding model; inputting the word vectors into a BiLSTM+CRF model for entity recognition to obtain entities in the short text information; segmenting the short text information into sentences based on the entities to obtain target clauses, wherein the target clause is a minimal clause containing two entities; extracting relations from the minimal clause using an improved BERT+MTB model to obtain the relations between the two entities in the minimal clause; generating knowledge triples for the minimal clause based on the two entities in the minimal clause and the relations between the two entities; and generating knowledge triples for the power distribution secondary system based on the knowledge triples of all minimal clauses in the short text.

[0009] Optionally, the step of using an improved BERT+MTB model to extract relations from the minimal clause to obtain the relations between the two entities in the minimal clause includes: generating an original text representation vector from the minimal clause using BERT; generating a new text representation vector from the original text representation vector using a self-attention mechanism; obtaining a concatenated text representation vector from the original text representation vector and the new text representation vector using a vector concatenation method; and inputting the concatenated text representation vector into the BERT+MTB model for relation extraction to obtain the relations between the two entities in the minimal clause.

[0010] Optionally, generating a knowledge graph for the power distribution secondary system based on the knowledge triples and the external expert knowledge base includes: calculating the similarity between entities in the knowledge triples and entities in the external expert knowledge base; and performing knowledge fusion on entities whose similarity reaches a similarity threshold to obtain a knowledge graph for the power distribution secondary system.

[0011] Optionally, the method further includes: obtaining the vulnerabilities and attack methods corresponding to any asset entity based on the knowledge graph of the power distribution secondary system using a breadth-first search algorithm; calculating the hazard score of any asset entity based on the vulnerabilities and attack methods; sorting all the hazard scores in descending order to obtain the sorting result; and visually displaying the sorting result.

[0012] According to a second aspect of the present invention, a knowledge association analysis apparatus for a power distribution secondary system is also provided. The apparatus includes: a first acquisition module for acquiring target information in the power distribution secondary system, wherein the target information includes asset-dimensional information, threat-dimensional information, or vulnerability-dimensional information; a first obtaining module for deduplicating the target information using an improved J-Hash method to obtain deduplicated short text information; a first generation module for generating knowledge triples for the power distribution secondary system based on the short text information using an optimized knowledge extraction model; and a second generation module for generating a knowledge graph for the power distribution secondary system based on the knowledge triples and an external expert knowledge base.

[0013] Optionally, the device further includes: a deletion module for deleting useless symbols from the target information; a sentence segmentation module for segmenting the target information after deleting useless symbols into sentences to obtain multiple sentences; and a second obtaining module for deleting sentences that do not contain entities and sentences whose text length is less than a preset value to obtain a dataset composed of multiple sentences.

[0014] Optionally, the first obtaining module includes: a first generation unit, used to segment sentences in the dataset according to Jieba segmentation and a preset dictionary, and generate feature vectors corresponding to words in the sentences; a determining unit, used to determine the weights corresponding to each feature vector based on the product of the ratio of the number of times the target word appears in the dataset to the number of words contained in the dataset, the logarithm of the ratio of the total number of datasets to the number of datasets containing the target word, and the logarithm of the ratio of the number of power distribution secondary system subsystems to the number of power distribution secondary system subsystems containing the target word; a first obtaining unit, used to calculate the Hash value corresponding to the feature vector after determining the weights, and obtain the n-bit signature corresponding to the Hash value; a second obtaining unit, used to merge and reduce the dimensionality of the n-bit signatures to obtain the n-bit signature of the dataset; a first calculation unit, used to calculate the similarity of the n-bit signatures of any two datasets according to the Hamming distance and the number of bits of the n-bit signature of the dataset; and a selection unit, used to select any one of the two datasets as the deduplicated short text information and delete the other dataset when the similarity is less than a preset threshold.

[0015] Optionally, the first generation module includes: a second generation unit, used to generate corresponding word vectors based on the short text information using a word embedding model; a third obtaining unit, used to input the word vectors into a BiLSTM+CRF model for entity recognition to obtain entities in the short text information; a fourth obtaining unit, used to segment the short text information into sentences based on the entities to obtain target clauses, wherein the target clause is a minimal clause containing two entities; a fifth obtaining unit, used to extract relations from the minimal clause using an improved BERT+MTB model to obtain the relations between the two entities in the minimal clause; a third generation unit, used to generate knowledge triples for the minimal clause based on the two entities in the minimal clause and the relations between the two entities; and a fourth generation unit, used to generate knowledge triples for the power distribution secondary system based on the knowledge triples of all minimal clauses in the short text.

[0016] Optionally, the fifth obtaining unit includes: a first generation submodule, used to generate an original text representation vector using BERT based on the minimum clause; a second generation submodule, used to generate a new text representation vector using a self-attention mechanism based on the original text representation vector; a first obtaining submodule, used to obtain a concatenated text representation vector based on the original text representation vector and the new text representation vector using a vector concatenation method; and a second obtaining submodule, used to input the concatenated text representation vector into the BERT+MTB model for relation extraction to obtain the relation between the two entities in the minimum clause.

[0017] Optionally, the second generation module includes: a second calculation unit, used to calculate the similarity between entities in the knowledge triplet and entities in an external expert knowledge base; and a sixth obtaining unit, used to perform knowledge fusion on entities whose similarity reaches a similarity threshold to obtain a knowledge graph for the power distribution secondary system.

[0018] Optionally, the device further includes: a second acquisition module, configured to acquire vulnerabilities and attack methods corresponding to any asset entity based on the knowledge graph of the power distribution secondary system using a breadth-first search algorithm; a calculation module, configured to calculate the hazard score of any asset entity based on the vulnerabilities and attack methods; a sorting module, configured to sort all hazard scores in descending order to obtain a sorting result; and a visualization module, configured to visualize the sorting result.

[0019] According to a third aspect of the present invention, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; wherein the memory is used to store a computer program; and the processor is used to execute the method steps of any of the above embodiments by running the computer program stored in the memory.

[0020] According to a fourth aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to execute the method steps of any of the above embodiments when running.

[0021] In this embodiment of the invention, target information in the secondary distribution system is acquired; the target information is deduplicated using an improved J-Hash method to obtain deduplicated short text information; an optimized knowledge extraction model is used to generate knowledge triples for the secondary distribution system based on the short text information; and a knowledge graph for the secondary distribution system is generated based on the knowledge triples and an external expert knowledge base. Because the acquired target information is deduplicated using the improved J-Hash method, a large amount of duplicate target information is avoided, improving knowledge extraction efficiency. Then, based on the extracted knowledge triples and the external expert knowledge base, a knowledge graph for the secondary distribution system is generated. By using the generated knowledge graph to analyze the multidimensional information of the secondary distribution system, the efficiency of association analysis is improved, thereby solving the problem of low efficiency in knowledge association analysis for the secondary distribution system in related technologies.

[0022] In this embodiment of the invention, the target information is deduplicated using an improved J-Hash method. By using a preset dictionary, more accurate word segmentation is achieved. Weights are set for the feature vectors of words in the short text information according to the actual situation of the power distribution secondary system, which improves the accuracy of deduplication and further improves the efficiency of knowledge extraction. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the hardware environment for an optional knowledge association analysis method for power distribution secondary systems according to an embodiment of the present invention;

[0026] Figure 2 This is a flowchart illustrating an optional knowledge association analysis method for power distribution secondary systems according to an embodiment of the present invention.

[0027] Figure 3 This is a schematic diagram of the overall process of an optional knowledge association analysis method for power distribution secondary systems according to an embodiment of the present invention;

[0028] Figure 4 This is a schematic diagram of the overall process of an optional data cleaning method according to an embodiment of the present invention;

[0029] Figure 5 This is a structural block diagram of an optional knowledge association analysis device for power distribution secondary systems according to an embodiment of the present invention;

[0030] Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of the present invention. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0032] It should be noted that in the description of this invention, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices. The terms "installed," "connected," and "linked" should be interpreted broadly; for example, they can refer to a fixed connection, a detachable connection, or an integral connection; a mechanical connection or an electrical connection; a direct connection or an indirect connection through an intermediate medium; a connection within two elements; a wireless connection or a wired connection. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0033] According to one aspect of the present invention, a knowledge association analysis method for distribution secondary systems is provided. Optionally, in this embodiment, the above-described knowledge association analysis method for distribution secondary systems can be applied to, for example... Figure 1 In the hardware environment shown. For example... Figure 1 As shown, terminal 102 may include memory 104, processor 106, and display 108 (optional component). Terminal 102 can communicate with server 112 via network 110. Server 112 can provide services (such as application services) to the terminal or clients installed on the terminal. Database 114 can be set up on or independently of server 112 to provide data storage services to server 112. In addition, server 112 may run a processing engine 116, which can be used to execute the steps performed by server 112.

[0034] Optionally, terminal 102 may be, but is not limited to, a terminal capable of computing data, such as a mobile terminal (e.g., mobile phone, tablet computer), laptop computer, PC (Personal Computer), etc. The aforementioned network may include, but is not limited to, a wireless network or a wired network. The wireless network includes Bluetooth, Wi-Fi (Wireless Fidelity), and other networks that enable wireless communication. The aforementioned wired network may include, but is not limited to, a wide area network (WAN), a metropolitan area network (MAN), and a local area network (LAN). The aforementioned server 112 may include, but is not limited to, any hardware device capable of computing.

[0035] Furthermore, in this embodiment, the knowledge association analysis method for secondary power distribution systems described above can also be applied to, but is not limited to, independent processing devices with powerful processing capabilities, without the need for data interaction. For example, the processing device can be, but is not limited to, a terminal device with powerful processing capabilities; that is, the various operations in the knowledge association analysis method for secondary power distribution systems described above can be integrated into an independent processing device. The above is merely an example, and no limitation is made in this embodiment.

[0036] Optionally, in this embodiment, the knowledge association analysis method for secondary power distribution systems described above can be executed by server 112, by terminal 102, or by both server 112 and terminal 102. Alternatively, the knowledge association analysis method for secondary power distribution systems implemented in this embodiment can be executed by a client installed on terminal 102.

[0037] Taking the application of knowledge association analysis methods for power distribution secondary systems to the central processing unit as an example, Figure 2 This is a flowchart illustrating an optional knowledge association analysis method for power distribution secondary systems according to an embodiment of the present invention, such as... Figure 2 As shown, the process of this method may include the following steps:

[0038] Step S201: Obtain target information in the power distribution secondary system, wherein the target information includes asset-dimensional information, threat-dimensional information, and vulnerability-dimensional information. Optionally, first obtain the target information in the power distribution secondary system to be correlated and analyzed. In this embodiment of the invention, the target information in the power distribution secondary system includes asset-dimensional information, threat-dimensional information, and vulnerability-dimensional information. Asset-dimensional information includes information on the power distribution master station cloud platform, routers, switches, and sensor facilities such as DTUs and FTUs; threat-dimensional information includes attack intelligence information; vulnerability-dimensional information includes network security vulnerabilities and risk information faced by physical equipment.

[0039] Step S202: The target information is deduplicated using the improved J-Hash method to obtain deduplicated short text information. Optionally, the improved J-Hash method is used to deduplicatize the target information obtained in step S201. The improved J-Hash method obtains a more reasonable feature vector based on the actual situation of the power distribution secondary system, and the similarity of the feature vectors is calculated to obtain the deduplicated short text information.

[0040] Step S203: The optimized knowledge extraction model is used to generate knowledge triples for the power distribution secondary system based on the short text information. Optionally, the optimized knowledge extraction model is used to perform entity recognition and relation extraction on the deduplicated short text information obtained in step S202, and knowledge triples are generated based on the recognized entities and extracted relations, further generating all knowledge triples in the power distribution secondary system.

[0041] Step S204: Generate a knowledge graph for the power distribution secondary system based on the knowledge triples and the external expert knowledge base. Optionally, perform knowledge fusion on entities based on all the knowledge triples obtained in step S203 and the external expert knowledge base, and generate a knowledge graph for the power distribution secondary system based on all the knowledge triples in the fused power distribution secondary system.

[0042] In this embodiment of the invention, target information in the secondary distribution system is acquired; the target information is deduplicated using an improved J-Hash method to obtain deduplicated short text information; an optimized knowledge extraction model is used to generate knowledge triples for the secondary distribution system based on the short text information; and a knowledge graph for the secondary distribution system is generated based on the knowledge triples and an external expert knowledge base. Because the acquired target information is deduplicated using the improved J-Hash method, a large amount of duplicate target information is avoided, improving knowledge extraction efficiency. Then, based on the extracted knowledge triples and the external expert knowledge base, a knowledge graph for the secondary distribution system is generated. By using the generated knowledge graph to analyze the multidimensional information of the secondary distribution system, the efficiency of association analysis is improved, thereby solving the problem of low efficiency in knowledge association analysis for the secondary distribution system in related technologies.

[0043] As an optional embodiment, before deduplicating the target information using the improved J-Hash method to obtain deduplicated short text information, the method further includes: deleting useless symbols from the target information; segmenting the target information after deleting useless symbols into sentences to obtain multiple sentences; deleting sentences that do not contain entities and sentences with a text length less than a preset value to obtain a dataset composed of multiple sentences. Optionally, the acquired target information is subjected to noise reduction processing to delete useless symbols such as “~” and “·”. Then, sentences are segmented using “.” or “;” as the segmentation criterion to obtain multiple sentences. To improve the efficiency of knowledge association analysis, text information that does not contain entities and shorter text information are deleted to construct the dataset. Among them, entity deletion can be achieved by judging the part of speech of words. For example, entities are generally nouns, so sentences that do not contain nouns can be deleted. In addition, sentences with a text length less than a preset value, from which no useful information can be extracted, can also be deleted. For example, sentences with a text length less than 5 can be deleted based on the shortest edit distance formula: Where E(i,j) is the minimum edit distance, l i With l j The lengths of the two text messages are defined as L and L. If L is less than a threshold, the sentence is deleted, and the remaining sentences form the dataset. In this embodiment of the invention, the acquired target information is preprocessed to improve extraction efficiency.

[0044] As an optional implementation, the target information is deduplicated using an improved J-Hash method to obtain deduplicated short text information. This includes: segmenting sentences in the dataset using Jieba segmentation and a preset dictionary to generate feature vectors corresponding to words in the sentences; determining the weights of each feature vector based on the product of three factors: the ratio of the number of times the target word appears in the dataset to the number of words contained in the dataset, the logarithm of the ratio of the total number of datasets to the number of datasets containing the target word, and the logarithm of the ratio of the number of power distribution secondary system subsystems to the number of power distribution secondary system subsystems containing the target word; calculating the hash value corresponding to the feature vector after determining the weights to obtain the n-bit signature corresponding to the hash value; merging and dimensionality reduction of the n-bit signatures to obtain the n-bit signature of the dataset; calculating the similarity between the n-bit signatures of any two datasets based on the Hamming distance and the number of bits in the n-bit signature of the dataset; and when the similarity is less than a preset threshold, selecting any one of the two datasets as the deduplicated short text information and deleting the other dataset.

[0045] Optionally, the dataset obtained after preprocessing the target information is first segmented using Jieba segmentation and a preset dictionary. The preset dictionary includes commonly used words from the asset dimension, weakness dimension, and threat dimension information of the power distribution secondary system. Using the preset dictionary can improve the accuracy of word segmentation. Then, feature vectors corresponding to each word after segmentation are generated. The method of generating feature vectors can use commonly used methods in the prior art, and this embodiment does not make specific limitations. Then, the weights corresponding to each feature vector are determined according to formula (1):

[0046]

[0047] In the formula, n ij ∑n represents the number of times the target word appears in the dataset. k,j The number of words contained in the dataset. The ratio of the total number of datasets to the number of datasets containing the target words is given. Furthermore, to prevent the denominator from being 0, formula (1) is improved to obtain formula (2) as shown below:

[0048]

[0049] According to formula (2), set weights for the feature vectors corresponding to the target words; calculate the hash value corresponding to the feature vectors after weighting, that is, calculate the hash value of each feature vector after weighting by using a hash function, and convert the hash value into the corresponding n-bit signature composed of 0 and 1. Then merge and reduce the dimension of all words' n-bit signatures to obtain the n-bit signature of the dataset. Among them, merging means adding the corresponding n-bit signatures of each feature vector after weighting. Dimension reduction can be set to 1 if it is greater than the preset value, and 0 otherwise, so as to obtain the n-bit signature of the dataset containing multiple words. Calculate the similarity of the n-bit signatures of any two datasets according to the Hamming distance and the number of bits of the n-bit signature of the dataset, as shown in formula (3):

[0050]

[0051] In the formula, Ham(A,B) represents the Hamming distance between any two datasets, and f represents the number of bits in the n-bit signature of the dataset. It should be noted that a lower similarity indicates greater similarity; for example, a similarity of less than 3 indicates that the two datasets are relatively similar. Therefore, when the calculated similarity is less than a preset threshold, either dataset is selected as the deduplicated short text information, and the other dataset is deleted.

[0052] In this embodiment of the invention, the target information is deduplicated using an improved J-Hash method. By using a preset dictionary, more accurate word segmentation is achieved. Weights are set for the feature vectors of words in the short text information according to the actual situation of the power distribution secondary system, which improves the accuracy of deduplication and further improves the efficiency of knowledge extraction.

[0053] As an optional implementation, an optimized knowledge extraction model is used to generate knowledge triples for power distribution secondary systems based on short text information. This includes: generating corresponding word vectors based on short text information using a word embedding model; inputting the word vectors into a BiLSTM+CRF model for entity recognition to obtain entities in the short text information; segmenting the short text information into sentences based on entities to obtain target clauses, where the target clause is a minimal clause containing two entities; extracting relations from the minimal clause using an improved BERT+MTB model to obtain the relations between the two entities in the minimal clause; generating knowledge triples for the minimal clause based on the two entities in the minimal clause and the relations between the two entities; and generating knowledge triples for power distribution secondary systems based on the knowledge triples of all minimal clauses in the short text.

[0054] Optionally, a word embedding model is used to generate corresponding word vectors based on the short text information. Specifically, word2vec can be used for English and MacBert model can be used for Chinese. After generating the word vectors corresponding to the short text information, the word vectors are input into a BiLSTM+CRF model for encoding and decoding to obtain the entities in the short text information. Based on this, the short text information is further segmented into sentences according to the entities of the power distribution secondary system. During sentence segmentation, the smallest clause containing two entities is selected to obtain the target clause. Then, an improved BERT+MTB model is used to extract relations from the smallest clause to obtain the entity relations in the smallest clause. This generates knowledge triples contained in the smallest clause, and finally, knowledge triples in all smallest clauses of the power distribution secondary system are extracted. Through this embodiment, the purpose of extracting all knowledge triples from the asset dimension information, threat dimension information, and vulnerability dimension information of the power distribution secondary system is achieved.

[0055] As an optional implementation, an improved BERT+MTB model is used to extract relations from the minimum clause to obtain the relations between the two entities in the minimum clause. This includes: generating an original text representation vector from the minimum clause using BERT; generating a new text representation vector from the original text representation vector using a self-attention mechanism; obtaining a concatenated text representation vector from the original and new text representation vectors using vector concatenation; and inputting the concatenated text representation vector into the BERT+MTB model for relation extraction to obtain the relations between the two entities in the minimum clause. Optionally, the function of the BERT model is to represent the sentence as a feature vector, generate an original text representation vector from the minimum clause using BERT, and then generate a new text representation vector from the original text representation vector using a self-attention mechanism. It should be noted that the self-attention mechanism can establish the correlation between different parts of the entire input, thereby improving the model training effect. In the new text representation vector, the value of each dimension is obtained by weighted summation of the values ​​of the original text representation vector in that dimension. Then, a vector concatenation method, such as the `concat` method in TensorFlow, is used to obtain a concatenated text representation vector based on the original text representation vector and the new text representation vector. This concatenated text representation vector is then input into the BERT+MTB model for relation extraction, thereby obtaining the relationship between the two entities in the smallest clause. In this embodiment, the fused vector representation obtained through self-attention and vector concatenation improves the accuracy of relation extraction.

[0056] As an optional embodiment, a knowledge graph for the secondary distribution system is generated based on knowledge triples and an external expert knowledge base. This includes: calculating the similarity between entities in the knowledge triples and entities in the external expert knowledge base; and performing knowledge fusion on entities whose similarity reaches a similarity threshold to obtain the knowledge graph for the secondary distribution system. Optionally, when generating the knowledge graph for the secondary distribution system, the similarity between entities in the structured data of the knowledge triples and entities in the external expert knowledge base is calculated, and knowledge fusion is performed on entities whose similarity reaches a similarity threshold to obtain the knowledge graph for the secondary distribution system. Knowledge fusion, through the alignment, association, and merging of entities in multiple related knowledge bases, makes the entity knowledge more comprehensive, achieves knowledge complementarity, expands the scale of the knowledge base, and finally generates the knowledge graph for the secondary distribution system based on the knowledge-fused triples. In this embodiment, generating a knowledge graph improves the efficiency of correlation analysis of the secondary distribution system.

[0057] As an optional embodiment, the method further includes: based on the knowledge graph of the power distribution secondary system, using a breadth-first search algorithm to obtain the vulnerabilities and attack methods corresponding to any asset entity; calculating the vulnerability score of any asset entity based on the vulnerabilities and attack methods; sorting all vulnerability scores in descending order to obtain the sorting result; and visualizing the sorting result. Optionally, in the knowledge graph of the power distribution secondary system, an asset entity such as a power distribution master station cloud platform may contain multiple weaknesses, i.e., vulnerabilities, and a vulnerability may be hidden in multiple asset entities. Threats exploit vulnerabilities to attack asset entities. When using the knowledge graph to analyze vulnerabilities in the power distribution secondary system, a breadth-first search algorithm is used to obtain the vulnerabilities and attack methods corresponding to any asset entity, and then the vulnerability score of any asset entity is calculated based on the vulnerabilities and attack methods. For example, starting with an asset entity, if the asset entity corresponds to n vulnerabilities, and each of the n vulnerabilities corresponds to m attack methods, then the vulnerability score of the entity is m×n. The vulnerability scores of all asset entities are sorted in descending order to obtain the sorting result, and the sorting result is visualized.

[0058] The knowledge association analysis method for power distribution secondary systems provided in this invention integrates internal and external intelligence of the power distribution secondary system, enabling risk assessment of assets within the system. It achieves the effect of associating assets with weaknesses and presenting them intuitively to users, shortening the time for hazard identification and mitigation, improving the accuracy of risk detection, and protecting the power distribution secondary system. Specifically, higher hazard scores indicate more serious hazards, and users can prioritize addressing more serious hazards based on the hazard score ranking results.

[0059] As an optional embodiment, Figure 3This is a schematic diagram of the overall process of an optional knowledge association analysis method for power distribution secondary systems according to an embodiment of the present invention. The method specifically includes the following steps: Information to be analyzed in the power distribution secondary system is obtained through methods such as self-sensing, traffic detection, and security event acquisition by internal security software. This information includes asset-dimensional information, threat-dimensional information, and vulnerability-dimensional information. Asset-dimensional information can include the power distribution master station cloud platform, routers, switches, and sensor facilities such as DTUs and FTUs; threat-dimensional information can include attack intelligence; and vulnerability-dimensional information can include network security vulnerabilities and risks faced by physical equipment. Unstructured data from the power distribution secondary system is obtained and cleaned by removing useless symbols, segmenting long texts related to the power distribution secondary system using keyword extraction algorithms, deleting irregular text, and then using an improved J-Hash method for deduplication to obtain deduplicated short text information, i.e., short text related to the power distribution secondary system.

[0060] like Figure 3 As shown, the short text is input into the model, where word vectors are obtained through a hybrid word vector extraction method and input into the BiLSTM+CRF model to identify entities in the power distribution secondary system. After re-segmenting the sentence based on the power distribution secondary system entities, the text is input into the BERT+MTB model to extract entity relations. Based on the identified power distribution secondary system entities and the extracted entity relations, knowledge triple structured data is generated and stored in a graph database. Combined with an external expert knowledge base, a knowledge graph of the power distribution secondary system is generated. Specifically, entities in the expert knowledge base are crawled and matched, and then the attributes of the matched entities, such as the date of the vulnerability and the type of asset, are crawled. If the attributes of two entities match successfully, they are considered to be the same entity, and the information corresponding to the matched entities is used as supplementary information for knowledge fusion.

[0061] Figure 4 This is a schematic diagram of the overall process of an optional data cleaning method, such as... Figure 4 As shown, after importing text information and deleting useless symbols, long texts are segmented into sentences. Symbols can be used as keywords, i.e., the segmentation criteria, to divide long sentences. Then, it is determined whether the length of the segmented sentences is less than 5. Sentences shorter than 5 do not yield much useful information, so they are deleted. The remaining sentences are grouped into a dataset, and the Jieba tool is used for word segmentation. The text information is then converted into hash numeric strings, representing the segmented words. Deduplication is then performed using a recursive method, specifically an improved J-Hash method, to obtain the deduplicated short text information, which is the short text for the power distribution secondary system.

[0062] In this embodiment, the execution flow of the two subtasks, entity naming recognition and entity relation extraction, adopts a parallel processing approach, reducing redundant steps in word vector extraction. By using a graph database such as Neo4j to store entities and relations, the storage performance of triple data is improved, allowing for a more intuitive view of the relationships between knowledge points. Furthermore, using a graph database enables complex relational queries through the Cypher graph query language, significantly reducing code volume and improving query performance compared to using relational database SQL query language.

[0063] According to another aspect of the present invention, a knowledge association analysis device for power distribution secondary systems is also provided. Figure 5 This is an optional knowledge association analysis device for power distribution secondary systems according to an embodiment of the present invention, such as... Figure 5 As shown, the device may include: a first acquisition module 501, used to acquire target information in the secondary distribution system, wherein the target information includes asset-dimensional information, threat-dimensional information, or vulnerability-dimensional information; a first obtaining module 502, used to deduplicate the target information according to the improved J-Hash method to obtain deduplicated short text information; a first generation module 503, used to generate knowledge triples for the secondary distribution system based on the short text information using an optimized knowledge extraction model; and a second generation module 504, used to generate a knowledge graph for the secondary distribution system based on the knowledge triples and an external expert knowledge base.

[0064] It should be noted that the first acquisition module 501 in this embodiment can be used to execute the above step S201, the first obtaining module 502 in this embodiment can be used to execute the above step S202, the first generation module 503 in this embodiment can be used to execute the above step S203, and the second generation module 504 in this embodiment can be used to execute the above step S204.

[0065] Through the above modules, the acquired target information is deduplicated using an improved J-Hash method, which avoids a large amount of duplicate target information and improves the efficiency of knowledge extraction. Then, based on the extracted knowledge triples and combined with an external expert knowledge base, a knowledge graph for the power distribution secondary system is generated. By using the generated knowledge graph to analyze the multidimensional information of the power distribution secondary system, the efficiency of correlation analysis is improved, thereby solving the problem of low efficiency in knowledge correlation analysis for the power distribution secondary system in related technologies.

[0066] As an optional embodiment, the device further includes: a deletion module for deleting useless symbols from the target information; a sentence segmentation module for segmenting the target information after deleting useless symbols into sentences to obtain multiple sentences; and a second obtaining module for deleting sentences that do not contain entities and sentences whose text length is less than a preset value to obtain a dataset composed of multiple sentences.

[0067] As an optional embodiment, the first obtaining module includes: a first generating unit, used to segment sentences in the dataset according to Jieba segmentation and a preset dictionary, and generate feature vectors corresponding to words in the sentences; a determining unit, used to determine the weights corresponding to each feature vector based on the product of the ratio of the number of times the target word appears in the dataset to the number of words contained in the dataset, the logarithm of the ratio of the total number of datasets to the number of datasets containing the target word, and the logarithm of the ratio of the number of power distribution secondary system subsystems to the number of power distribution secondary system subsystems containing the target word; a first obtaining unit, used to calculate the Hash value corresponding to the feature vector after determining the weights, and obtain the n-bit signature corresponding to the Hash value; a second obtaining unit, used to merge and reduce the dimensionality of the n-bit signatures to obtain the n-bit signature of the dataset; a first calculation unit, used to calculate the similarity of the n-bit signatures of any two datasets according to the Hamming distance and the number of bits of the n-bit signature of the dataset; and a selection unit, used to select any one of the two datasets as the deduplicated short text information and delete the other dataset when the similarity is less than a preset threshold.

[0068] As an optional embodiment, the first generation module includes: a second generation unit, used to generate corresponding word vectors based on short text information using a word embedding model; a third obtaining unit, used to input the word vectors into a BiLSTM+CRF model for entity recognition to obtain entities in the short text information; a fourth obtaining unit, used to segment the short text information into sentences based on entities to obtain target clauses, wherein the target clause is a minimal clause containing two entities; a fifth obtaining unit, used to extract relations from the minimal clause using an improved BERT+MTB model to obtain the relations between the two entities in the minimal clause; a third generation unit, used to generate knowledge triples of the minimal clause based on the two entities in the minimal clause and the relations between the two entities; and a fourth generation unit, used to generate knowledge triples for the power distribution secondary system based on the knowledge triples of all minimal clauses in the short text.

[0069] As an optional embodiment, the fifth obtaining unit includes: a first generation submodule, used to generate the original text representation vector using BERT based on the minimum clause; a second generation submodule, used to generate a new text representation vector based on the original text representation vector using a self-attention mechanism; a first obtaining submodule, used to obtain the concatenated text representation vector based on the original text representation vector and the new text representation vector using a vector concatenation method; and a second obtaining submodule, used to input the concatenated text representation vector into the BERT+MTB model for relation extraction to obtain the relation between the two entities in the minimum clause.

[0070] As an optional embodiment, the second generation module includes: a second calculation unit for calculating the similarity between entities in the knowledge triplet and entities in the external expert knowledge base; and a sixth obtaining unit for performing knowledge fusion on entities whose similarity reaches a similarity threshold to obtain a knowledge graph for the power distribution secondary system.

[0071] As an optional embodiment, the device further includes: a second acquisition module, used to acquire the vulnerabilities and attack methods corresponding to any asset entity based on the knowledge graph of the power distribution secondary system and through a breadth-first search algorithm; a calculation module, used to calculate the hazard score of any asset entity based on the vulnerabilities and attack methods; a sorting module, used to sort all the hazard scores in descending order to obtain the sorting result; and a visualization display module, used to visualize the sorting result.

[0072] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented through software or hardware, and the hardware environment includes the network environment.

[0073] According to another aspect of the present invention, an electronic device for implementing the above-described knowledge association analysis method for power distribution secondary systems is also provided. The electronic device may be a server, a terminal, or a combination thereof.

[0074] Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of the present invention, such as... Figure 6 As shown, the system includes a processor 601, a communication interface 602, a memory 603, and a communication bus 604. The processor 601, communication interface 602, and memory 603 communicate with each other via the communication bus 604. The memory 603 stores computer programs. When the processor 601 executes the computer program stored in the memory 603, it performs the following steps:

[0075] The system acquires target information from the secondary distribution system, including asset-dimensional information, threat-dimensional information, and vulnerability-dimensional information. It then deduplicates the target information using an improved J-Hash method to obtain deduplicated short text information. An optimized knowledge extraction model is used to generate knowledge triples for the secondary distribution system based on the short text information. Finally, a knowledge graph for the secondary distribution system is generated based on the knowledge triples and an external expert knowledge base.

[0076] Optionally, in this embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0077] The communication interface is used for communication between the aforementioned electronic devices and other devices.

[0078] The memory may include RAM, or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0079] As an example, such as Figure 6 As shown, the memory 603 may include, but is not limited to, the first acquisition module 501, the first obtaining module 502, the first generation module 503, and the second generation module 504 in the knowledge association analysis device for power distribution secondary systems. Furthermore, it may include, but is not limited to, other module units in the knowledge association analysis device for power distribution secondary systems, which will not be elaborated upon in this example.

[0080] The processors mentioned above can be general-purpose processors, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; they can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0081] In addition, the aforementioned electronic equipment also includes a display for showing the results of knowledge correlation analysis for power distribution secondary systems.

[0082] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here.

[0083] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. The device that implements the above-mentioned knowledge association analysis method for power distribution secondary systems can be a terminal device, such as a smartphone (e.g., Android phone, iOS phone), tablet computer, handheld computer, mobile internet device (MID), PAD, etc. Figure 6 This does not limit the structure of the aforementioned electronic devices. For example, the terminal device may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0084] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, ROM, RAM, disk or optical disk, etc.

[0085] According to another aspect of the present invention, a storage medium is also provided. Optionally, in this embodiment, the storage medium can be used to execute program code for a knowledge association analysis method for power distribution secondary systems.

[0086] Optionally, in this embodiment, the storage medium may be located on at least one of the network devices in the network shown in the above embodiment.

[0087] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps:

[0088] The system acquires target information from the secondary distribution system, including asset-dimensional information, threat-dimensional information, and vulnerability-dimensional information. It then deduplicates the target information using an improved J-Hash method to obtain deduplicated short text information. An optimized knowledge extraction model is used to generate knowledge triples for the secondary distribution system based on the short text information. Finally, a knowledge graph for the secondary distribution system is generated based on the knowledge triples and an external expert knowledge base.

[0089] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated in this embodiment.

[0090] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0091] According to another aspect of the present invention, a computer program product or computer program is also provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the steps of the knowledge association analysis method for power distribution secondary systems in any of the above embodiments.

[0092] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0093] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0094] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0095] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A knowledge association analysis method for power distribution secondary systems, characterized in that, The method includes: Acquire target information in the secondary power distribution system, wherein the target information includes asset dimension information, threat dimension information, and vulnerability dimension information; The target information is deduplicated using the improved J-Hash method to obtain deduplicated short text information; An optimized knowledge extraction model is used to generate knowledge triples for the power distribution secondary system based on the short text information. Based on the aforementioned knowledge triplet and external expert knowledge base, a knowledge graph for power distribution secondary systems is generated. The step of deduplicating the target information using the improved J-Hash method to obtain deduplicated short text information includes: The sentences in the dataset are segmented using Jieba word segmentation and a pre-set dictionary, and feature vectors corresponding to the words in the sentences are generated. The weights of each feature vector are determined by multiplying the ratio of the number of times the target word appears in the dataset to the number of words contained in the dataset, the logarithm of the ratio of the total number of datasets to the number of datasets containing the target word, and the logarithm of the ratio of the number of secondary distribution system subsystems to the number of secondary distribution system subsystems containing the target word. Calculate the hash value corresponding to the feature vector after determining the weight, and obtain the n-bit signature corresponding to the hash value; The n-bit signatures are merged and their dimensionality reduced to obtain the n-bit signatures of the dataset; Calculate the similarity of n-bit signatures between any two datasets based on the Hamming distance and the number of bits in the n-bit signature of the dataset; When the similarity is less than a preset threshold, select one of the two datasets as the deduplicated short text information and delete the other dataset.

2. The knowledge association analysis method for power distribution secondary systems according to claim 1, characterized in that, Before performing deduplication on the target information using the improved J-Hash method to obtain the deduplicated short text information, the method further includes: Remove useless symbols from the target information; The target information after removing useless symbols is segmented into sentences to obtain multiple sentences; Sentences that do not contain entities and sentences whose text length is less than a preset value are deleted to obtain a dataset consisting of multiple sentences.

3. The knowledge association analysis method for power distribution secondary systems according to claim 1, characterized in that, The optimized knowledge extraction model generates knowledge triples for the power distribution secondary system based on the short text information, including: A word embedding model is used to generate corresponding word vectors based on the short text information; The word vectors are input into the BiLSTM+CRF model for entity recognition to obtain the entities in the short text information. The short text information is segmented into sentences based on the entities to obtain the target clause, wherein the target clause is the smallest clause containing two entities; An improved BERT+MTB model is used to extract relations from the minimum clause to obtain the relations between the two entities in the minimum clause; Generate a knowledge triplet for the minimum clause based on the two entities in the minimum clause and the relationship between the two entities; Generate knowledge triples for power distribution secondary systems based on the knowledge triples of all the smallest clauses in the short text.

4. The knowledge association analysis method for power distribution secondary systems according to claim 3, characterized in that, The improved BERT+MTB model is used to extract relations from the minimal clause to obtain the relations between the two entities in the minimal clause, including: BERT is used to generate the original text representation vector based on the smallest clause; A new text representation vector is generated based on the original text representation vector using a self-attention mechanism; The concatenated text representation vector is obtained by using a vector concatenation method based on the original text representation vector and the new text representation vector. The concatenated text representation vector is input into the BERT+MTB model for relation extraction to obtain the relation between the two entities in the smallest clause.

5. The knowledge association analysis method for power distribution secondary systems according to claim 1, characterized in that, The step of generating a knowledge graph for the power distribution secondary system based on the knowledge triples and the external expert knowledge base includes: Calculate the similarity between entities in the knowledge triple and entities in the external expert knowledge base; Knowledge fusion is performed on entities whose similarity reaches the similarity threshold to obtain a knowledge graph for power distribution secondary systems.

6. The knowledge association analysis method for power distribution secondary systems according to claim 3, characterized in that, The method further includes: Based on the knowledge graph of the power distribution secondary system, the vulnerabilities and attack methods corresponding to any asset entity are obtained through a breadth-first search algorithm. Calculate the vulnerability score for any asset entity based on the aforementioned vulnerabilities and attack methods; Sort all the hazard scores in descending order to get the sorting result; The sorting results are then visualized.

7. A knowledge association analysis device for power distribution secondary systems, characterized in that, The device includes: The first acquisition module is used to acquire target information in the secondary power distribution system, wherein the target information includes asset dimension information, threat dimension information, or vulnerability dimension information; The first obtaining module is used to deduplicate the target information according to the improved J-Hash method to obtain deduplicated short text information, specifically including: The sentences in the dataset are segmented using Jieba word segmentation and a preset dictionary, generating feature vectors corresponding to the words in the sentences. The weights of each feature vector are determined by multiplying the ratio of the frequency of the target word in the dataset to the number of words in the dataset, the logarithm of the ratio of the total number of datasets to the number of datasets containing the target word, and the logarithm of the ratio of the number of secondary distribution system subsystems to the number of secondary distribution system subsystems containing the target word. The hash values ​​corresponding to the weighted feature vectors are calculated to obtain the n-bit signatures corresponding to the hash values. The n-bit signatures are merged and their dimensionality reduced to obtain the n-bit signatures of the dataset. The similarity between the n-bit signatures of any two datasets is calculated based on the Hamming distance and the number of bits in the n-bit signatures of the datasets. When the similarity is less than a preset threshold, one of the two datasets is selected as the deduplicated short text information, and the other dataset is deleted. The first generation module is used to generate knowledge triples for the power distribution secondary system based on the short text information using an optimized knowledge extraction model. The second generation module is used to generate a knowledge graph for the power distribution secondary system based on the knowledge triples and the external expert knowledge base.

8. An electronic device comprising a processor, a communication interface, a memory, and a communication bus, wherein, The processor, the communication interface, and the memory communicate with each other via the communication bus, characterized in that... The memory is used to store computer programs; The processor is configured to perform the method steps of any one of claims 1 to 6 by running the computer program stored in the memory.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the method described in any one of claims 1 to 6.

Images