Liquefied natural gas receiving station cyber-physical security early warning method, device and equipment

Abstract

The application provides a liquefied natural gas receiving station information physical safety early warning method, device and equipment. The method comprises the following steps: identifying nodes on each subsystem of each layer respectively, determining risk nodes and connection mechanisms of the risk nodes; acquiring a risk network structure according to the risk nodes and the connection mechanisms of the risk nodes; acquiring risk entropy, a risk state and an energy influence value borne by each risk node respectively by using a SIRS model; and acquiring a propagation process under two preset propagation mechanisms respectively according to the risk entropy, the risk state and the energy influence value borne by each risk node, so as to realize prediction of a risk path. Compared with qualitative analysis of nodes in a station by workers according to personal business level and work experience in the prior art, the application realizes quantitative analysis of risk propagation and prediction of the risk path objectively according to the risk entropy, the risk state and the energy influence value borne.

Description

Technical Field

[0001] This application relates to the field of risk prediction technology, and in particular to a method, apparatus and equipment for early warning of cyber-physical security at liquefied natural gas receiving stations. Background Technology

[0002] Liquefied Natural Gas (LNG) receiving terminals are important transit points for the storage, processing, and export of LNG. To ensure safe production within the terminals, prevent accidents such as fires and explosions caused by LNG leaks, and ensure regional energy supply and security, risk prediction and management are carried out within the terminals.

[0003] In existing technologies, qualitative analysis of nodes within a station is conducted by individuals skilled in the art based on their professional expertise and work experience, which involves a degree of subjectivity.

[0004] However, existing technologies can only perform qualitative analysis of the safety of liquefied natural gas receiving terminals. Risk paths are not timely, and it is difficult to quantify the interaction between various systems within the terminal and the propagation path of risk nodes. In addition, the determination of the safety of liquefied natural gas receiving terminals depends on the professional skills and work experience of the staff, and lacks objectivity. Summary of the Invention

[0005] This application provides a cyber-physical security early warning method, device, and equipment for liquefied natural gas receiving stations, which solves the problem in the prior art that the qualitative analysis of the safety of liquefied natural gas receiving stations by staff based on their own professional level and work experience is not timely and it is difficult to quantify the interaction between various systems in the station and the propagation path of risk nodes.

[0006] Firstly, this application provides a cyber-physical security early warning method for liquefied natural gas (LNG) receiving terminals, applied to the unloading and storage cyber-physical system of an LNG receiving terminal. The unloading and storage cyber-physical system includes a natural environment layer, an information layer, a physical equipment layer, and a personnel management and operation layer. Each layer includes multiple subsystems, including:

[0007] Each node in each subsystem of each layer is identified, and the risk nodes and their connection mechanisms are determined.

[0008] The risk network structure is obtained based on the risk nodes and their connection mechanisms.

[0009] Using a pre-configured SIRS model, the risk entropy, risk state, and energy impact value of each risk node are obtained.

[0010] Based on the risk entropy, risk state, and energy impact value of each risk node, the propagation process under two preset propagation mechanisms is obtained to predict the risk path.

[0011] In one specific implementation, the connection mechanism includes relationship categories, functional relationships, and connection methods:

[0012] The relationship categories include physical connections, multi-layer bridging, or no-interaction relationships.

[0013] The interaction relationships corresponding to the physical connection relationships include one or more of the following combinations: equipment accessories, pipeline connections, circuit transmission, communication signal and information flow transmission; the connection method corresponding to the physical connection relationships is undirected and unweighted.

[0014] The functional relationships corresponding to the multi-layer bridging include one or more combinations of the following: coupled connection nodes of the information layer, physical device layer and personnel management operation layer, as well as cross-layer connections; the connection method corresponding to the multi-layer bridging is undirected and unweighted.

[0015] The interaction relationship corresponding to the no-interaction relationship is the no-physical-connection and multi-layer bridging relationship; the connection method corresponding to the no-interaction relationship is independent node.

[0016] In one specific implementation, it further includes:

[0017] The SIRS model is established based on the set model running time, energy diffusion time threshold, energy conduction time, risk suppression state maintenance time, primary infection rate, recovery rate, and probability of risk suppression turning into risk state.

[0018] The model runtime is set to 2000 time slices; the energy diffusion time threshold is 1200 time slices; the energy conduction time is 600 time slices; the risk suppression state maintenance time is 200 time slices; the first infection rate represents the probability of a node moving from a susceptible risk state to a risk-triggered state; and the recovery rate represents the probability of a node moving from a risk-triggered state to a susceptible risk state.

[0019] In one specific implementation, the risk propagation mechanism includes: a capability diffusion propagation mechanism and an energy conduction propagation mechanism.

[0020] In one specific implementation, a pre-configured SIRS model is used to obtain the risk status of each risk node, including:

[0021] For each risk node, a pre-configured SIRS model is used to obtain the state value of the risk node, and the risk status of the risk node is determined based on the state value of the risk node and a preset node risk threshold.

[0022] Secondly, this application provides a cyber-physical security early warning device for liquefied natural gas (LNG) receiving terminals, applied to the unloading and storage cyber-physical system of an LNG receiving terminal. The unloading and storage cyber-physical system includes a natural environment layer, an information layer, a physical equipment layer, and a personnel management and operation layer, wherein each layer includes multiple subsystems; therefore, the device includes:

[0023] The acquisition module is used to identify nodes on each subsystem of each layer and determine risk nodes and their connection mechanisms.

[0024] The acquisition module is also used to acquire the risk network structure based on the risk node and the connection mechanism of the risk node.

[0025] The processing module is used to obtain the risk entropy, risk state, and energy impact value of each risk node using a pre-configured SIRS model.

[0026] The processing module is also used to obtain the propagation process under two preset propagation mechanisms based on the risk entropy, risk state, and energy impact value of each risk node, so as to predict the risk path.

[0027] In one specific implementation, the connection mechanism includes relationship categories, functional relationships, and connection methods:

[0028] The relationship categories include physical connections, multi-layer bridging, or no-interaction relationships.

[0029] The interaction relationships corresponding to the physical connection relationships include one or more of the following combinations: equipment accessories, pipeline connections, circuit transmission, communication signal and information flow transmission; the connection method corresponding to the physical connection relationships is undirected and unweighted.

[0030] The functional relationships corresponding to the multi-layer bridging include one or more combinations of the following: coupled connection nodes of the information layer, physical device layer and personnel management operation layer, as well as cross-layer connections; the connection method corresponding to the multi-layer bridging is undirected and unweighted.

[0031] The interaction relationship corresponding to the no-interaction relationship is the no-physical-connection and multi-layer bridging relationship; the connection method corresponding to the no-interaction relationship is independent node.

[0032] In one specific embodiment, the processing module is further configured to:

[0033] The SIRS model is established based on the set model running time, energy diffusion time threshold, energy conduction time, risk suppression state maintenance time, primary infection rate, recovery rate, and probability of risk suppression turning into risk state.

[0034] The model runtime is set to 2000 time slices; the energy diffusion time threshold is 1200 time slices; the energy conduction time is 600 time slices; the risk suppression state maintenance time is 200 time slices; the first infection rate represents the probability of a node moving from a susceptible risk state to a risk-triggered state; and the recovery rate represents the probability of a node moving from a risk-triggered state to a susceptible risk state.

[0035] In one specific implementation, the risk propagation mechanism includes: a capability diffusion propagation mechanism and an energy conduction propagation mechanism.

[0036] In one specific embodiment, the processing module is specifically used for:

[0037] For each risk node, a pre-configured SIRS model is used to obtain the state value of the risk node, and the risk status of the risk node is determined based on the state value of the risk node and a preset node risk threshold.

[0038] Thirdly, this application provides an electronic device, comprising:

[0039] Processor, memory, communication interface.

[0040] The memory is used to store executable instructions that the processor can execute.

[0041] The processor is configured to execute the cyber-physical security early warning method for liquefied natural gas receiving stations as described in the first aspect by executing the executable instructions.

[0042] Fourthly, this application provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cyber-physical security early warning method for liquefied natural gas receiving stations as described in the first aspect.

[0043] This application provides a cyber-physical security early warning method, device, and equipment for liquefied natural gas (LNG) receiving terminals. It identifies nodes in each subsystem of each layer, determines risk nodes and their connection mechanisms, obtains the risk network structure based on these risk nodes and their connection mechanisms, and uses a pre-configured SIRS model to obtain the risk entropy, risk state, and energy impact value of each risk node. Based on the risk entropy, risk state, and energy impact value of each risk node, it obtains the propagation process under two preset propagation mechanisms to predict risk paths. Compared to existing methods where personnel qualitatively analyze LNG receiving terminal safety based on their professional skills and experience, this application identifies risk nodes in subsystems, constructs a risk network structure based on the connection methods of these nodes, and predicts risk paths based on the risk network structure, the risk entropy, risk state, and energy impact value of each risk node. This achieves a qualitative description of patterns from the perspective of statistical indicators of complex networks, and objectively achieves quantitative analysis of risk propagation based on risk entropy, risk state, and energy impact value, thus completing the prediction of risk paths. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a diagram of the unloading and storage cyber-physical system structure provided in this application;

[0046] Figure 2 A flowchart illustrating an embodiment of a cyber-physical security early warning method for a liquefied natural gas receiving station provided in this application;

[0047] Figure 3 This is a risk network structure diagram;

[0048] Figure 4 This is a graph showing the degree distribution of nodes in the risk network.

[0049] Figure 5 A map showing the distribution of risk network communities;

[0050] Figure 6 This is a diagram illustrating the clustering of risk network communities.

[0051] Figure 7 A flowchart illustrating a second embodiment of a cyber-physical security early warning method for a liquefied natural gas receiving station provided in this application;

[0052] Figure 8 This is a risk status distribution diagram of the nodes in the unloading system, starting from its own risk level.

[0053] Figure 9 This is a risk status distribution diagram of the nodes in the unloading system, starting from the risk propagation caused by the coupling of multiple factors.

[0054] Figure 10 A flowchart for risk path prediction;

[0055] Figure 11 Flowchart of risk propagation and path prediction methods;

[0056] Figure 12 This is a schematic diagram of the structure of an embodiment of a cyber-physical security early warning device for a liquefied natural gas receiving station provided in this application;

[0057] Figure 13 This is a schematic diagram of the structure of an electronic device provided in this application.

[0058] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments made by those skilled in the art under the guidance of these embodiments are within the scope of protection of this application.

[0060] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0061] In existing technologies, qualitative analysis of liquefied natural gas receiving terminals is conducted by staff based on their individual professional skills and work experience. However, risk paths lack timeliness and it is difficult to quantify the interrelationships between various systems within the terminal and the propagation paths of risk nodes. To address these technical problems, the technical concept of this application lies in how to achieve quantitative analysis of risk propagation and complete the prediction of risk paths.

[0062] The technical solution of this application will now be described in detail through specific embodiments. It should be noted that the following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0063] Figure 1 The cyber-physical system structure diagram for unloading and storage provided in this application is as follows: Figure 1 As shown, the unloading and storage cyber-physical system 50 includes a natural environment layer 51, an information layer 52, a physical equipment layer 53, and a personnel management and operation layer 54, forming a physical-personnel-information-environmental facility layer system structure for the LNG receiving station. Each layer includes multiple subsystems, and each subsystem includes multiple nodes.

[0064] For example, the LNG receiving terminal subsystems and nodes are shown in Table 1, which illustrates the system structure of the LNG receiving terminal's physical-personnel-information-environmental facilities layer. Specifically, Table 1 is obtained by identifying the logical relationships between the actual LNG equipment and nodes.

[0065] Table 1. System Structure of LNG Receiving Terminal Physical-Personnel-Information-Environmental Facilities Layer

[0066]

[0067]

[0068]

[0069]

[0070] The connection methods between key facilities and nodes in the unloading and storage cyber-physical system are shown in Table 2.

[0071] Table 2 Connection Methods

[0072]

[0073] There are multiple interrelationships among key facilities. The composition of the equipment itself can be considered as a form of physical connection, such as the unloading arm support riser and outer arm, pipe welding, fastening threads, and also includes information layer transmission, communication signal transmission, etc. For cross-layer connections between multi-layer networks, it represents the bridging relationship of the coupling effect of multi-layer networks, that is, multi-layer bridging. In addition, there are some nodes that do not interact with other nodes, that is, independent nodes. Since there is only interaction between equipment, information, and personnel, without directional influence, the coupling connection nodes of equipment accessories, pipeline connections, circuit transmission, communication signals, information flow transmission, physical layer, information layer, and personnel layer, and the connection mode of cross-layer connections are undirected and unweighted.

[0074] Figure 2 This is a flowchart illustrating an embodiment of a cyber-physical security early warning method for liquefied natural gas (LNG) receiving terminals provided in this application. The method is applied to the cyber-physical system for unloading and storage at LNG receiving terminals. The cyber-physical system includes a natural environment layer, an information layer, a physical equipment layer, and a personnel management and operation layer, where each layer includes multiple subsystems; see also... Figure 2 The cyber-physical security early warning method for liquefied natural gas receiving stations specifically includes the following steps:

[0075] Step S101: Identify the nodes on each subsystem of each layer and determine the risk nodes and their connection mechanisms.

[0076] In this embodiment, the LNG receiving terminal, from unloading at the ship terminal to gasification and export, involves typical processes such as LNG unloading, storage, BOG condensation, and gasification. Taking a land-based LNG receiving terminal as an example, it involves the coordinated action of physical equipment, information commands, and personnel operations, and can be divided into 12 subsystems based on functional attributes.

[0077] Changes in node attributes, such as cracks, detachment, fatigue corrosion, interruption of information commands, instrument malfunction, unqualified personnel operation skills, or substandard physical condition, which affect system safety, can all lead to node failures. Risk node identification is shown in Table 3, and the connection mechanism of risk nodes is shown in Table 2 above.

[0078] Table 3 Risk Node Identification

[0079]

[0080]

[0081]

[0082] In a receiving station system, components, units, or factors with risk attributes that pose a risk of propagation during operation are called risk nodes. The topology of risk nodes in multiple subsystems influencing each other constitutes a risk network. Different risk network connection mechanisms generate different risk paths, thus leading to accident consequences of varying scales.

[0083] Step S102: Obtain the risk network structure based on the risk nodes and their connection mechanisms.

[0084] Risk network structure such as Figure 3 As shown in the risk network structure diagram, combined with on-site risk assessment reports, maintenance records, and the experience of Health-Safety-Environment (HSE) management personnel, risk nodes and risk attributes are extracted. This identifies risk nodes in the natural environment layer, information layer, physical equipment layer, and personnel management and operation layer, thus obtaining... Figure 3 The left side illustrates the logical relationship between the topology and the risk network. Based on the connection methods between nodes, a topological risk network structure is formed, comprised of four aspects: physical, informational, personnel, and environmental. This establishes the logical relationship between the actual equipment and facility network and the risk node network. Figure 3 The diagram on the right shows the risk network model of the LNG receiving terminal operation. The risk network model is the same as the risk network structure mentioned above.

[0085] Based on the risk network structure, obtain the node degree and the number of occurrences of each node to form... Figure 4 The risk network node degree distribution diagram shows that the horizontal axis represents the risk node degree of the LNG receiving terminal, and the vertical axis represents the frequency of different nodes in the risk network. The higher the node degree, the stronger the importance of the node. The diagram shows that the personnel management and operation layer and the information layer have higher node degrees, while the physical equipment layer has lower node degrees. Specifically, geographical location and unloading weather are nodes in the natural environment layer, and the nodes surrounding the geographical location node are nodes in the physical equipment layer.

[0086] The betweenness centrality, proximity centrality, harmonic proximity centrality, and eccentricity of risky nodes are calculated, and thresholds are set to allow risky nodes to form seven types of communities. Specifically, the graph distance analysis for betweenness centrality, proximity centrality, harmonic proximity centrality, and eccentricity is shown in Table 4.

[0087] Table 4. Distance Analysis

[0088]

[0089]

[0090] Figure 5 A risk network community distribution map, such as Figure 5As shown, the horizontal axis represents the number of different community clusters, i.e., the community number, and the vertical axis represents the number of nodes that appear, i.e., the number of nodes contained in different communities. Figure 6 This is a diagram illustrating risk network community clustering, such as... Figure 6 As shown, Communities 1 are the unloading and loading systems, Communities 2 are the storage systems, Communities 3 are the tank truck systems, Communities 4 are the fire protection systems, Communities 5 are the ORV systems, Communities 6 are the SCV systems, Communities 7 are the BOG handling systems, Communities 8 are the personnel management and operation systems, Communities 9 are the instrumentation and factory ventilation systems, and Communities 10 are the central control and engineer access control systems. Among them, Communities 8, 9, and 10 are widely distributed in Communities 1 to 7, so they are not separately classified.

[0091] In this embodiment, based on the composition and connection method of the risk network nodes, graph theory visualization is used to display the risk network, and complex network statistical index analysis is performed on node degree, graph distance, network community structure, and network clustering coefficient.

[0092] Step S103: Using a pre-configured SIRS model, obtain the risk entropy, risk state, and energy impact value of each risk node.

[0093] In the SIRS model, S represents a node in a vulnerable risk state, I represents a node in a risk-activated state, and R represents a node in a risk-suppressed state. Unlike the basic SIR model, nodes in the risk network that have reached the R state have a certain probability of returning to the S state. This is because the threshold of each node in the four-layer risk network, composed of physical, informational, personnel, and environmental aspects, changes over time as the receiving station's service life increases. For example, the unloading arm may not fail for a certain period after a major overhaul and may be in the R state. However, if the equipment fails again after several cycles, it indicates that during operation, the node changes from R to S, eventually reaching the risk-activated I state.

[0094] The operational risk of an LNG terminal is defined as the probability of energy release from its equipment and facilities, and the combination of the severity of various resulting damages. The propagation of operational risk is based on the inherent attributes and risk state value of the risk point. The two states of a risk point depend on a comparison between its own risk capacity and risk threshold. When the risk state value of a node exceeds the threshold, the node is in a state of risk activation; conversely, the node is in a state of risk suppression.

[0095] Specifically, based on the current state, the node state value S i and node risk threshold O i The first formula is used:

[0096]

[0097] Obtain the node risk status R i .

[0098] When a node is in a risk-triggered state, according to the principle of energy conservation, the released energy will do work on surrounding nodes along the connecting edges, transferring energy information to these nodes. Entropy measures the instability of a matter's energy state. Based on the second law of thermodynamics, risk entropy is defined as follows: during system operation, the more unstable the energy state of a node, the higher the risk entropy value; conversely, the lower the risk entropy value. According to the spontaneous direction of energy transfer, risk follows the principle of entropy increase, propagating from low entropy values ​​to high entropy values. The magnitude of risk entropy is related to the node's topology, functional level, and risk state value.

[0099] Specifically, based on the risk network topology G i,j Node functional level F i,j Node state value S i The second formula is used:

[0100] f i,j (t)=H(G i,j ,F i,j ,S i )

[0101] Obtain the risk entropy f of the node i,j (t).

[0102] Wherein, at time t, the energy of node i is transferred to node j, and the rate of change of the risk entropy between the two is df i,j (t) is related to the risk entropy of the two nodes and the topological distance between the two nodes.

[0103] Specifically, based on the risk entropy f of node i at time t i (t), the risk entropy f of node j at time t j (t) and the topological distance D between nodes i,j The third formula is adopted:

[0104]

[0105] Obtain the rate of change of risk entropy (df) between node i and node j. i,j (t).

[0106] According to the principle of energy conservation, the set of adjacent nodes L of node i (i) The structural network coefficients p of node j j Let k be the node between node i and node j, and use the fourth formula:

[0107]

[0108] Obtain the energy influence value E of the node at time t. i (t).

[0109] Among them, the structural network coefficients are parameters describing the complexity of nodes in the network, calculated based on the topology. Risk nodes and risk attributes include the device's own structural attributes, risk entropy value, and risk status.

[0110] Step S104: Based on the risk entropy, risk state, and energy impact value of each risk node, obtain the propagation process under two preset propagation mechanisms to predict the risk path.

[0111] In this embodiment, based on the on-site risk assessment report and maintenance records, nodes with high risk levels are selected as the starting point for risk assessment, and the attack mode, frequency, and location of each node in each time slice are determined. The states of nodes and edges within the time slice of risk propagation are updated, and the risk entropy of each node is calculated. All nodes are searched, the energy impact value of each node is calculated, compared with the node threshold, and the risk state parameters of the current node are stored. The propagation process under different risk propagation mechanisms is calculated and output. According to the stopping conditions of the propagation mechanism, the risk stopping point is searched, and the risk starting point, process point, and stopping point are connected to achieve risk path prediction.

[0112] The risk transmission mechanisms are shown in Table 5 as two different risk transmission mechanisms.

[0113] Table 5 Two risk transmission mechanisms

[0114]

[0115] Among them, energy diffusion means that a node propagates risk to other nodes in the domain until the risk stops propagating when there are no more nodes to propagate to; energy conduction means that a node propagates risk to the weakest node, and the risk stops propagating when the propagation energy is exhausted as the propagation link is extended.

[0116] The coexistence and coupling of multiple risks are the root cause of equipment and accidents within the station. Energy diffusion and energy conduction are common in LNG receiving terminals, and different propagation mechanisms will have different risk paths.

[0117] During risk propagation, it is necessary to clearly define the risk's starting point, path, and final state. There are two possible endpoints for risk propagation: equipment failure and work stoppages, production halts, or personal injury accidents such as fires and explosions. Based on the principle of energy release, the essence of risk propagation is the energy change at nodes, and the quantitative indicator of risk propagation is risk entropy. Depending on the endpoint, the risk propagation process involves two mechanisms: energy diffusion and energy conduction at nodes.

[0118] In this embodiment, nodes on each subsystem of each layer are identified to determine risk nodes and their connection mechanisms. Based on the risk nodes and their connection mechanisms, the risk network structure is obtained. Using a pre-configured SIRS model, the risk entropy, risk state, and energy impact value of each risk node are obtained. Based on the risk entropy, risk state, and energy impact value of each risk node, the propagation process under two preset propagation mechanisms is obtained to predict risk paths. Compared to existing methods where technical personnel conduct qualitative analysis of nodes within a station based on their individual skills and experience, this application analyzes and identifies risk points and attributes based on the natural environment layer, information layer, physical equipment layer, and personnel management and operation layer. It establishes an adjacency matrix of a four-layer network, forming a topological risk network. The application analyzes node connection methods and studies the static risk attributes of nodes within the system, bridging nodes between systems, and the risk network based on complex network statistical indicators. It qualitatively describes the importance of risk nodes within the station, explains the community structure that increases risk propagation, and analyzes risk entropy, risk state, and the energy impact value based on the SIRS model. It predicts risk paths, achieving a qualitative description of patterns from the perspective of complex network statistical indicators. It objectively achieves quantitative analysis of risk propagation based on risk entropy, risk state, and the energy impact value, and completes the prediction of risk paths.

[0119] Figure 7 This is a flowchart illustrating a second embodiment of a cyber-physical security early warning method for liquefied natural gas (LNG) receiving terminals provided in this application. This method is applied to the cyber-physical system for unloading and storage at LNG receiving terminals. The cyber-physical system includes a natural environment layer, an information layer, a physical equipment layer, and a personnel management and operation layer, where each layer includes multiple subsystems; see also... Figure 7 The cyber-physical security early warning method for liquefied natural gas receiving stations specifically includes the following steps:

[0120] Step S201: Identify the nodes on each subsystem of each layer and determine the risk nodes and their connection mechanisms.

[0121] The connection mechanism includes relation type, function relation, and connection method:

[0122] The relationship categories include physical connections, multi-layered bridging, or no-interaction relationships.

[0123] The interaction relationships corresponding to physical connection relationships include one or more of the following combinations: equipment accessories, pipeline connections, circuit transmission, communication signal and information flow transmission; the connection method corresponding to physical connection relationships is undirected and unweighted.

[0124] The functional relationships corresponding to multi-layer bridging include one or more of the following combinations: coupled connection nodes of the information layer, physical device layer and personnel management operation layer, as well as cross-layer connections; the connection method corresponding to multi-layer bridging is undirected and unweighted.

[0125] The interaction relationship corresponding to no interaction relationship is no physical connection and multi-layer bridging relationship; the connection method corresponding to no interaction relationship is independent node.

[0126] In this embodiment, the subsystems and nodes are shown in Table 1, which shows the system structure of the LNG receiving station's physical-personnel-information-environmental facilities layer. The identification of risk nodes is shown in Table 3, which shows the identification of risk nodes. The connection mechanism of risk nodes is shown in Table 2 above.

[0127] A detailed description of this step can be found in the previous embodiment, and will not be repeated here.

[0128] Step S202: Obtain the risk network structure based on the risk nodes and their connection mechanisms.

[0129] A detailed description of this step can be found in the previous embodiment, and will not be repeated here.

[0130] Step S203: Establish the SIRS model based on the set model running time, energy diffusion time threshold, energy conduction time, risk suppression state maintenance time, first infection rate, recovery rate, and probability of risk suppression turning into risk state.

[0131] The model runtime is set to 2000 time slices; the energy diffusion time threshold is 1200 time slices; the energy conduction time is 600 time slices; the risk suppression state maintenance time is 200 time slices; the first infection rate represents the probability of a node moving from a susceptible risk state to a risk-triggered state; and the recovery rate represents the probability of a node moving from a risk-triggered state to a susceptible risk state.

[0132] Specifically, the SIRS model runtime T and the energy diffusion time threshold t are set. d Energy conduction time t c The duration of state R is t r The parameters are: primary infection rate λ, recovery rate β, and risk suppression to risk state μ. See Table 6 for SIRS model parameter settings.

[0133] Table 6 SIRS Model Parameter Settings

[0134]

[0135] Step S204: Using a pre-configured SIRS model, obtain the risk entropy, risk state, and energy impact value of each risk node.

[0136] In this embodiment, for each risk node, a pre-configured SIRS model is used to obtain the state value of the risk node, and the risk status of the risk node is determined based on the state value of the risk node and the preset node risk threshold.

[0137] A detailed description of this step can be found in the previous embodiment, and will not be repeated here.

[0138] Step S205: Based on the risk entropy, risk state, and energy impact value of each risk node, obtain the propagation process under two preset propagation mechanisms to predict the risk path.

[0139] A detailed description of this step can be found in the previous embodiment, and will not be repeated here.

[0140] Among them, risk propagation mechanisms include: capability diffusion propagation mechanism and energy transmission propagation mechanism.

[0141] Taking the aforementioned unloading system as an example, two risk starting points are set. The first is a random attack on physical equipment nodes in the entire risk network, with the risk propagation method being the self-propagation of risks during the equipment's service life; the second is a random setting of physical equipment and personnel operation nodes in the entire risk network, with the risk propagation method being the risk propagation of multiple factors coupled together.

[0142] Taking the above unloading system as an example, Figure 8 This is a risk status distribution diagram of the unloading system, starting from its own risk level, such as... Figure 8 As shown, the horizontal axis represents time T, and the vertical axis represents the distribution of node risk states. Risk peaks indicate that the number of nodes in state I exceeds a preset value. Dashed lines represent cases where the number of nodes in state I is 30 in any time slice, highlighting the extent to which the number of nodes in state I within a community exceeds the preset value. The risk propagation method is based on the variance of the device's own risk propagation during its service life, which is 28.3. The number of nodes in states S, I, and R in each community is obtained for 2000 time slices. Taking a specific community as an example, nodes in state I within that community when the number of nodes in state I exceeds 20 (i.e., the risk peak exceeds 20) are identified. These nodes in state I are set as the starting point of the risk. Risk paths are obtained based on the risk network structure, and the risk propagation mechanism of each node is determined based on the node energy value within the risk path.

[0143] according to Figure 8 Taking the risk node in the unloading system when T=1500 as an example, the risk path corresponding to T=1500 is shown in Table 7.

[0144] Table 7 shows the risk paths corresponding to T=1500.

[0145]

[0146]

[0147]

[0148] Taking the above unloading system as an example, Figure 9 The risk state distribution diagram of the unloading system, starting from the risk propagation caused by the coupling of multiple factors, is shown below. Figure 9 As shown, the horizontal axis represents time T, and the vertical axis represents the distribution of node risk states. Risk peaks indicate that the number of nodes in state I exceeds a preset value. Dashed lines represent cases where the number of nodes in state I is 30 in any given time slice, highlighting the extent to which the number of nodes in state I exceeds the preset value within a community. The risk propagation method is based on the variance of the device's own risk propagation during its service life, which is 30.6. The number of nodes in states S, I, and R in each community is obtained for 2000 time slices. Taking a specific community as an example, nodes in state I within that community when the number of nodes in state I exceeds 20 (i.e., the risk peak exceeds 20) are identified. These nodes in state I are set as the starting point of the risk. Risk paths are obtained based on the risk network structure, and the risk propagation mechanism of each node is determined based on the node energy value within the risk path.

[0149] by Figure 9 For example, the node risk path of this community, which starts with the risk propagation of multiple factors coupled together, is shown in Table 8. The node risk path and propagation characteristics starting with the risk propagation of multiple factors coupled together are shown in Table 8.

[0150] Table 8. Node-based risk propagation paths and characteristics starting from the coupling of multiple factors.

[0151]

[0152]

[0153]

[0154]

[0155]

[0156] Specifically, after determining the risk starting point, the risk nodes connected to the risk starting point are obtained according to the risk network structure. Based on the energy impact value of the risk node connected to the risk starting point and the energy threshold of the risk node, it is determined whether there is energy propagation at the risk node connected to the risk starting point.

[0157] Specifically, Figure 10 A flowchart for risk path prediction, such as Figure 10As shown, a risk starting point is set. Based on the risk network search nodes and connecting edges, in the next time slice, the node energy influence value is calculated and compared with the node threshold. If the energy influence value is greater than the node threshold, energy propagation is performed. If the energy influence value is less than the threshold, the search for nodes and connecting edges based on the risk network continues. For the case of energy propagation, the influence coefficients of the two propagation mechanisms are calculated, i.e., the node energy influence value under different propagation mechanisms. Here, the influence coefficient is equivalent to the energy influence value. It is then determined whether the propagation is in equilibrium. If it is in equilibrium, propagation proceeds to the stopping condition, and the propagation path, i.e., the risk path, is output. If the propagation is not in equilibrium, the search for nodes and connecting edges based on the risk network continues. The risk propagation equilibrium state is defined as when the node energy influence value is 0.

[0158] Figure 11 A flowchart of risk propagation and path prediction methods, such as Figure 11 As shown, the LNG receiving terminal system model is fundamentally constructed using an LNG receiving terminal system risk model. This system risk model is the risk network described above, which is a network topology structure. It includes the basic system components and connection methods. The basic system is obtained based on node categories, and the connection methods include node connections and community bridging. Based on this network topology, static risk indicators can be obtained: node attributes, risk thresholds, and complex network statistical indicators. Risk propagation path prediction includes three dynamic indicators: node risk status, energy type change, and risk path. The changed energy type is obtained using the SIRS model, which is an improvement on the SIR model. In addition, model evaluation indicators include: the number and height of risk peaks, and the proportion of the three types of nodes. The risk peaks are the risk wave peaks described above. These model evaluation indicators affect the three dynamic indicators; the risk entropy and the energy impact value of risk points obtained from the network topology structure influence the model evaluation indicators.

[0159] In this embodiment, by dividing the LNG receiving terminal system, analyzing the risk points and attributes of each subsystem, determining the types of system risk nodes, identifying basic node connection relationships, updating and summarizing node risk content and influencing factors, analyzing network node degree indicators, network graph distance indicators, network community indicators, and network clustering coefficient indicators, clarifying the risk starting point, path, and final state, calculating the risk entropy and node influence value of nodes, and clarifying the risk propagation direction and stopping conditions, specifically including: determining the risk propagation starting point, updating the risk state search nodes and calculating the node influence value and comparing it with the risk threshold, calculating and outputting the propagation process under two risk propagation mechanisms, searching for risk stopping points according to the stopping conditions of the propagation mechanism, connecting the risk starting point, process points, and stopping points, and realizing risk path prediction and risk warning.

[0160] In this embodiment, a method for representing the dependency effect between networks is formed for the interaction between the system's physics, personnel, information, and environment. For the dynamic propagation of risks between systems, a qualitative description of the laws is given from the perspective of statistical indicators of complex networks. A risk propagation model based on risk entropy and energy release principles is proposed to predict risk paths. Specifically, based on the second law of thermodynamics, the concept of entropy is introduced into the field of risk propagation to construct risk entropy, and a specific calculation method is proposed. Under set parameters, the laws and path results of risk propagation between physics, personnel, information, and environment are formed from the perspective of system energy. Based on the SIR model, the risk state changes of LNG receiving terminal nodes are represented, describing and visualizing the transformation characteristics of specific equipment's susceptible risk state, risk activation state, and risk suppression state. The moment of concentrated risk propagation is obtained, enabling the prediction of risk propagation paths coupled with single and multiple factors, thereby achieving risk early warning.

[0161] In this embodiment, compared to existing technical personnel who perform qualitative analysis of nodes within a station based on their individual professional skills and work experience, this application analyzes and identifies risk points and attributes based on the natural environment layer, information layer, physical equipment layer, and personnel management operation layer. It establishes an adjacency matrix of a four-layer network, forming a topological risk network. It analyzes node connection methods and studies the static risk attributes of nodes within the system, bridging nodes between systems, and the risk network based on complex network statistical indicators. It qualitatively describes the importance of risk nodes within the station, explains the community structure that increases risk propagation, analyzes risk entropy, risk state, and the energy impact value based on the SIRS model, predicts risk paths, and achieves a qualitative description of patterns from the perspective of complex network statistical indicators. Based on a dynamic model, it conducts risk propagation analysis, proposes energy diffusion and energy conduction propagation mechanisms, and studies the changes in node risk state under these two mechanisms to distinguish whether the risk endpoint is equipment failure or a safety accident. This provides support for decision-makers and technical personnel in risk management and control. It objectively achieves quantitative analysis of risk propagation based on risk entropy, risk state, and the energy impact value, and completes the prediction of risk paths.

[0162] Figure 12 This is a schematic diagram of the structure of an embodiment of a cyber-physical security early warning device for a liquefied natural gas receiving station provided in this application, as shown below. Figure 12As shown, the cyber-physical security early warning device 30 for liquefied natural gas receiving stations includes an acquisition module 31 and a processing module 32. The acquisition module 31 is used to identify nodes on each subsystem of each layer and determine risk nodes and their connection mechanisms. The acquisition module 31 is also used to acquire the risk network structure based on the risk nodes and their connection mechanisms. The processing module 32 is used to acquire the risk entropy, risk state, and energy impact value of each risk node using a pre-configured SIRS model. The processing module 32 is also used to acquire the propagation process under two preset propagation mechanisms based on the risk entropy, risk state, and energy impact value of each risk node, thereby enabling the prediction of risk paths.

[0163] The oil well flow prediction and processing system provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be repeated here.

[0164] In one possible implementation, the connection mechanism includes relationship type, action relationship, and connection method:

[0165] The relationship categories include physical connections, multi-layered bridging, or no-interaction relationships.

[0166] The interaction relationships corresponding to physical connection relationships include one or more of the following combinations: equipment accessories, pipeline connections, circuit transmission, communication signal and information flow transmission; the connection method corresponding to physical connection relationships is undirected and unweighted.

[0167] The functional relationships corresponding to multi-layer bridging include one or more of the following combinations: coupled connection nodes of the information layer, physical device layer and personnel management operation layer, as well as cross-layer connections; the connection method corresponding to multi-layer bridging is undirected and unweighted.

[0168] The interaction relationship corresponding to no interaction relationship is no physical connection and multi-layer bridging relationship; the connection method corresponding to no interaction relationship is independent node.

[0169] In one possible implementation, the processing module is also used for:

[0170] A SIRS model is established based on the set model running time, energy diffusion time threshold, energy conduction time, risk suppression state maintenance time, first infection rate, recovery rate, and probability of risk suppression turning into risk state.

[0171] The model runtime is set to 2000 time slices; the energy diffusion time threshold is 1200 time slices; the energy conduction time is 600 time slices; the risk suppression state maintenance time is 200 time slices; the first infection rate represents the probability of a node moving from a susceptible risk state to a risk-triggered state; and the recovery rate represents the probability of a node moving from a risk-triggered state to a susceptible risk state.

[0172] In one possible implementation, the risk propagation mechanism includes: a capability diffusion propagation mechanism and an energy conduction propagation mechanism.

[0173] In one possible implementation, the processing module is specifically used for:

[0174] For each risk node, a pre-configured SIRS model is used to obtain the state value of the risk node, and the risk status of the risk node is determined based on the state value of the risk node and the preset node risk threshold.

[0175] Figure 13 This is a schematic diagram of the structure of an electronic device provided in this application. Figure 13 As shown, the electronic device 40 includes: a processor 41, a memory 42, and a communication interface 43; wherein, the memory 42 is used to store executable instructions that can be executed by the processor 41; the processor 41 is configured to execute the technical solutions in any of the foregoing method embodiments by executing the executable instructions.

[0176] Optionally, the memory 42 can be either standalone or integrated with the processor 41.

[0177] Optionally, when the memory 42 is a device independent of the processor 41, the electronic device 40 may further include a bus for connecting the aforementioned devices.

[0178] The electronic device is used to execute the technical solutions in any of the foregoing method embodiments. Its implementation principle and technical effect are similar, and will not be described again here.

[0179] This application also provides a readable storage medium storing a computer program thereon, which, when executed by a processor, implements the technical solutions provided in any of the foregoing embodiments.

[0180] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0181] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0182] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A cyber-physical security early warning method for liquefied natural gas receiving stations, characterized in that, A cyber-physical system for unloading and storage of liquefied natural gas (LNG) at a receiving terminal is provided. The cyber-physical system includes a natural environment layer, an information layer, a physical equipment layer, and a personnel management and operation layer, with each layer comprising multiple subsystems. The method includes: For each node in each subsystem of each layer, identify the risk nodes and their connection mechanisms; The risk network structure is obtained based on the risk nodes and their connection mechanisms. Using a pre-configured SIRS model, the risk entropy, risk state, and energy impact value of each risk node are obtained. In the SIRS model, S represents a node in a risk-sensitive state, I represents a node in a risk-activated state, and R represents a node in a risk-inhibited state. A node in the risk-inhibited state R can be converted back to the risk-sensitive state S with a preset probability. Based on the risk entropy, risk state, and energy impact value of each risk node, the propagation process under two preset propagation mechanisms is obtained to predict the risk path. The method further includes: establishing the SIRS model based on the set model running time, energy diffusion time threshold, energy conduction time, risk suppression state maintenance time, first infection rate, recovery rate, and probability of risk suppression to risk state; The model runtime is set to 2000 time slices; the energy diffusion time threshold is 1200 time slices; the energy conduction time is 600 time slices; the risk suppression state maintenance time is 200 time slices; the first infection rate represents the probability of a node moving from a susceptible risk state to a risk-triggered state; the recovery rate represents the probability of a node moving from a risk-triggered state to a susceptible risk state. The two preset propagation mechanisms include: a capability diffusion propagation mechanism and an energy conduction propagation mechanism; The energy diffusion propagation mechanism involves the risk node propagating the risk to neighboring nodes until the risk stops propagating when there are no more risk nodes to propagate to. The energy conduction propagation mechanism involves the risk node propagating the risk to the weakest risk node, and the risk stops propagating when the propagation energy is exhausted as the propagation link lengthens.

2. The method according to claim 1, characterized in that, The connection mechanism includes relationship type, functional relationship, and connection method: The relationship categories include physical connections, multi-layer bridging, or no-interaction relationships; The interaction relationships corresponding to the physical connection relationships include one or more of the following combinations: equipment accessories, pipeline connections, circuit transmission, communication signal and information flow transmission; the connection method corresponding to the physical connection relationships is undirected and unweighted. The functional relationships corresponding to the multi-layer bridging include one or more combinations of the following: coupled connection nodes of the information layer, physical device layer, and personnel management operation layer, as well as cross-layer connections; the connection method corresponding to the multi-layer bridging is undirected and unweighted. The interaction relationship corresponding to the no-interaction relationship is the no-physical-connection and multi-layer bridging relationship; the connection method corresponding to the no-interaction relationship is independent node.

3. The method according to claim 1, characterized in that, Using a pre-configured SIRS model, the risk status of each risk node is obtained, including: For each risk node, a pre-configured SIRS model is used to obtain the state value of the risk node, and the risk status of the risk node is determined based on the state value of the risk node and a preset node risk threshold.

4. A cyber-physical security early warning device for a liquefied natural gas receiving station, characterized in that, A cyber-physical system for unloading and storage of liquefied natural gas (LNG) at a receiving terminal is provided. The cyber-physical system includes a natural environment layer, an information layer, a physical equipment layer, and a personnel management and operation layer, with each layer comprising multiple subsystems. The device includes: The acquisition module is used to identify nodes on each subsystem of each layer and determine risk nodes and their connection mechanisms. The acquisition module is further configured to acquire the risk network structure based on the risk node and the connection mechanism of the risk node; The processing module is used to obtain the risk entropy, risk state, and energy impact value of each risk node using a pre-configured SIRS model. In the SIRS model, S represents a node in a risk-sensitive state, I represents a node in a risk-activated state, and R represents a node in a risk-inhibited state. A node in the risk-inhibited state R can be converted back to the risk-sensitive state S with a preset probability. The processing module is also used to obtain the propagation process under two preset propagation mechanisms based on the risk entropy, risk state, and energy impact value of each risk node, so as to predict the risk path. The processing module is also used to: establish the SIRS model based on the set model running time, energy diffusion time threshold, energy conduction time, risk suppression state maintenance time, first infection rate, recovery rate, and probability of risk suppression to risk state; The model runtime is set to 2000 time slices; the energy diffusion time threshold is 1200 time slices; the energy conduction time is 600 time slices; the risk suppression state maintenance time is 200 time slices; the first infection rate represents the probability of a node moving from a susceptible risk state to a risk-triggered state; the recovery rate represents the probability of a node moving from a risk-triggered state to a susceptible risk state. The risk propagation mechanisms include: capability diffusion propagation mechanism and energy conduction propagation mechanism; The energy diffusion propagation mechanism involves the risk node propagating the risk to neighboring nodes until the risk stops propagating when there are no more risk nodes to propagate to. The energy conduction propagation mechanism involves the risk node propagating the risk to the weakest risk node, and the risk stops propagating when the propagation energy is exhausted as the propagation link lengthens.

5. The apparatus according to claim 4, characterized in that, The connection mechanism includes relationship type, functional relationship, and connection method: The relationship categories include physical connections, multi-layer bridging, or no-interaction relationships; The interaction relationships corresponding to the physical connection relationships include one or more of the following combinations: equipment accessories, pipeline connections, circuit transmission, communication signal and information flow transmission; the connection method corresponding to the physical connection relationships is undirected and unweighted. The functional relationships corresponding to the multi-layer bridging include one or more combinations of the following: coupled connection nodes of the information layer, physical device layer, and personnel management operation layer, as well as cross-layer connections; the connection method corresponding to the multi-layer bridging is undirected and unweighted. The interaction relationship corresponding to the no-interaction relationship is the no-physical-connection and multi-layer bridging relationship; the connection method corresponding to the no-interaction relationship is independent node.

6. An electronic device, characterized in that, include: Processor, memory, communication interface; The memory is used to store executable instructions that can be executed by the processor; The processor is configured to execute the cyber-physical security early warning method for liquefied natural gas receiving stations according to any one of claims 1 to 3 by executing the executable instructions.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, is used to implement the cyber-physical security early warning method for liquefied natural gas receiving stations as described in any one of claims 1 to 3.

Images