A Visualization Method for Multi-Granularity Spatio-Temporal Objects with Ground Grid Coupling

Abstract

The present invention relates to a visualization method for multi-granularity spatio-temporal objects with ground network coupling, belonging to the technical field of spatio-temporal data modeling and visualization. The present invention establishes a ground network coupling entity model, uses the attribute feature description module in the ground network coupling entity model to describe the distribution and attribute features of entities in network events; uses the ground network association logic description module in the ground network coupling entity model to describe network space entities from three aspects of the physical layer, logical layer and social layer of the network space; then takes the description result of the ground network coupling entity model as the visualization content and displays the visualization content according to the selected visualization method. The present invention fully considers the multi-level nature of network space entities, highlights the ability to carry out cross-domain activities with cognitive and behavioral capabilities, and can directly simulate the dynamic evolution process of entities in network events according to the ground network logical association, expressing the characteristics of ground network coupling and improving the visualization effect.

Description

Technical Field

[0001] The invention relates to a ground grid coupled multi-granularity spatiotemporal object visualization method, belonging to the technical field of spatiotemporal data modeling and visualization. Background Art

[0002] Cyberspace security is related to national security. The distribution of equipment, information flow and topological structure in cyberspace all exist in dependence on the real geographic space and can be regarded as a parallel extension of the real geographic space. It has the characteristics of multi-level, virtual-real combination and cross-domain association. In the field of cyberspace mapping, cyberspace is usually divided into three layers: physical layer, logical layer and social layer, in order to establish a multi-level and multi-dimensional cyberspace theoretical system. How to build a cross-level and cross-domain cyberspace entity model, explore the relationship between cyberspace and geographic space, and describe the characteristics of ground-network coupling is an important cornerstone for drawing cyberspace maps, maintaining network security, and perceiving network situations.

[0003] The research on spatiotemporal data modeling by scholars at home and abroad can be traced back to the 1970s. Early studies introduced time issues into the changes of space and attribute information, and proposed basic concepts and theories about spatiotemporal data models, such as the space-time cube model first proposed by Hagerstrand. In the 1980s, scholars mainly conducted research on the fusion and integration of temporal technology and database technology, focusing on the discussion and research of temporal databases and their query languages. Spatiotemporal data models mainly include sequence snapshot models, base state correction models, and spatiotemporal composite models. In the 1990s, the research focus gradually shifted to the complex structure, logical characteristics, and correction of existing models of space and time, such as object-oriented spatiotemporal data models, event-based spatiotemporal data models, feature-based spatiotemporal data models, process-based spatiotemporal data models, and improvements to related spatiotemporal models. In recent years, research on spatiotemporal data modeling has further developed in many aspects such as method technology and field application. In terms of modeling theory and technology, researchers have conducted in-depth discussions from many aspects such as spatiotemporal structure, spatiotemporal scale, spatiotemporal information significance, and storage and indexing mechanisms of spatiotemporal models. In terms of application, spatiotemporal data modeling has been used to solve specific problems in the fields of land, transportation, etc., and has been further applied to related data modeling and analysis in the commercial field.

[0004] Experts at home and abroad have conducted a lot of research work on spatiotemporal expression and modeling theory from different cognitive perspectives, including: based on the extension of traditional static data models, object-oriented spatiotemporal data models, object-based spatiotemporal data models, spatiotemporal data models based on spatiotemporal integration, process-based spatiotemporal data models, and multidimensional unified data models based on geometric algebra. In the research on the construction of cyberspace spatiotemporal data models: the current general network spatiotemporal data model is considered to need to express the following levels of spatiotemporal semantics: spatial semantic expression, i.e., the geometric characteristics, attribute characteristics, and network topological relationships of network elements; temporal semantic expression, i.e., the temporal changes of spatial attributes of network elements and network topology. However, at present, entities in cyberspace are usually defined at home and abroad as the various levels of equipment that make up the network and the digital things that play a role in cyberspace. Almost everything in the physical world and the social world can be networked and have network entity mapping. Therefore, network entities not only include physical facilities with network attributes, but also various virtual cyberspace resources such as social accounts and software. They exist across the physical and virtual worlds, and their dynamic changes can affect and change the behavior of other network entities and real entities. They are cross-domain associated or coupled with natural geographical elements, socio-economic elements, and social and cultural elements, and have the characteristics of ground-network coupling. The current existing spatiotemporal data models are difficult to describe cyberspace entities with the characteristics of ground-network coupling well.

[0005] To this end, some people have conducted research on the classification and identification of network entities and the description of the time, space and other attributes of cyberspace entities. In order to solve the problems of network entities being difficult to associate and integrate across layers, coverage and incomplete feature description, a multi-level cyberspace entity model has been established. However, the above research and modeling are all carried out in a single-level context, presenting a situation where non-geographic space is cyberspace, and cannot solve the problem of cross-level and cross-domain activity association of cyberspace entities, affecting the comprehensive and unified expression of cyberspace and geographic space, and the visualization effect is poor. Summary of the invention

[0006] The purpose of the present invention is to provide a ground grid coupled multi-granularity spatiotemporal object visualization method to solve the current problem of poor visualization effect.

[0007] In order to solve the above technical problems, the present invention provides a method for visualizing multi-granularity spatiotemporal objects coupled with a ground grid, and the method comprises the following steps:

[0008] 1) Obtain the network events to be visualized;

[0009] 2) Establish a ground network coupling entity model, which includes an attribute feature description module and a ground network association logic description module. Use the attribute feature description module to describe the distribution and attribute features of entities in network events; use the ground network association logic description module to describe network space entities from three aspects: the physical layer, the logical layer, and the social layer of the network space, and describe the changes in the attribute states of network space entities and the changes in various elements in the real geographical space after network events occur; the description of the ground network association logic module for the physical layer refers to the network space level where network space entities directly affected by network events are located, including the infrastructure of various network information systems, the sensing devices in the access network system, and the physical entities mapped by virtual accounts; the description of the ground network association logic module for the social layer refers to the description of the behavior and cognitive attributes of network space entities in the social layer of the network space.

[0010] 3) Use the description result of the ground network coupling entity model as the visualization content and display the visualization content according to the selected visualization method.

[0011] Based on the modeling method of the multi-granularity spatio-temporal object model, the present invention reconstructs a ground network coupling entity model. Using this model, it is possible to describe the attribute characteristics of network space entities in a multi-granularity manner, fully considering the multi-level nature of network space entities, highlighting the ability to have cognitive and behavioral capabilities for cross-domain activities, and directly simulating the dynamic evolution process of entities in network events according to the ground network logical association, expressing the characteristics of ground network coupling, and improving the visualization effect.

[0012] Furthermore, the attribute feature description module is used to describe the distribution and attribute features of entities in network events from three aspects: inherent attribute features, hierarchical composition, and cognitive behavior.

[0013] The present invention describes the distribution and attribute features of entities in network events from three aspects: inherent attribute features, hierarchical composition, and cognitive behavior, and can achieve a comprehensive description of network space entities.

[0014] The present invention can describe network space entities from three aspects: the physical layer, the logical layer, and the social layer, and realizes the description of cross-domain coupling and logical response of network events from different angles.

[0015] Further, when the network event is a network attack event, the ground network association logic description module describes the network attack event in a formal expression, including three parts: event start and end time, event structure, and event impact. Among them, the start and end time refers to the period from the start of the network attack to the return to normal operation. The event structure refers to the attack type, attack method, and attack object. The event impact includes the impact on natural geographical elements, socio-economic elements, and social and cultural elements in the real geographical space, as well as the change in the entity attributes in the cyber space.

[0016] The present invention uses a formal expression of event start and end time, event structure, and event impact for network attack events, which can accurately describe network attack events.

[0017] Further, in step 3) during the visual display, the cyber space entities of the visualization object are determined, and according to different hierarchical composition relationships and spatial distributions, the cyber space entities are mapped to the real geographical space, and a visual expression method combining geographical location map layout, hierarchical map layout, and time series map layout is used for display.

[0018] Further, the geographical location map layout is displayed in the form of GIS visualization, and the expression forms of points, lines, and surfaces are used to display network entities, and corresponding level switching is performed according to the change of the viewport.

[0019] The present invention can adaptively adjust the display method according to the display content, further improving the visual display effect.

[0020] Further, when the network event is a network attack event, the visual content is determined as four aspects: network attack target, attack means, attack effect, and network public opinion, and statistical charts and word cloud diagrams are used to simulate the impact of network attacks on production and life in the real geographical space. Brief Description of the Drawings

[0021] Figure 1 is the basic process flow chart of cyber space entity modeling adopted by the present invention;

[0022] Figure 2 is the framework diagram of the ground network coupling entity model in the present invention;

[0023] Figure 3 is the cognitive behavior model diagram of the ground network association logic adopted by the present invention;

[0024] Figure 4 is the ground network association logic diagram adopted by the present invention;

[0025] Figure 5 is the visual flow chart of power system network attack simulation;

[0026] Figure 6aIt is a sunburst chart for visualizing network attack simulation;

[0027] Figure 6b It is a bar chart for visualizing network attack simulation;

[0028] Figure 6c It is a heat map for visualizing network attack simulation. Specific implementation manners

[0029] The following further explains the specific implementation manners of the present invention with reference to the accompanying drawings.

[0030] The present invention describes the distribution and attribute characteristics of entities in network events by establishing a ground network coupling entity model and using the attribute feature description module in the ground network coupling entity model; describes network space entities from three aspects of the physical layer, logical layer and social layer of the network space by using the ground network association logic description module in the ground network coupling entity model, and describes the change of the attribute state of network space entities and the changes of various elements in the real geographical space after network events occur; then takes the description result of the ground network coupling entity model as the visualization content and displays the visualization content according to the selected visualization method. The implementation process of this method is as Figure 5 shown. The following details the implementation process of the present invention according to specific examples.

[0031] 1. Construct a ground network coupling entity model and use the ground network coupling entity model to describe network events.

[0032] To establish a ground network coupling entity model, the network space entities need to be objectified first. Compared with other models, the multi-granularity spatio-temporal object model breaks the inherent modeling mode of traditional GIS and has good spatial expansibility and interactivity. Each spatio-temporal object has 8 inherent attributes of "attribute characteristics, spatio-temporal reference, spatial position, spatial form, composition structure, association relationship, cognitive characteristics, and behavioral ability". The present invention inherits the multi-granularity spatio-temporal object model to model network space entities, and the steps are divided into four parts, as Figure 1 shown.

[0033] (1) Complex network space entityification, abstracting and simplifying the main things objectively existing in the network space and entityifying them;

[0034] (2) Cognition and abstraction of network space targets, using the 8 inherent attributes of the multi-granularity spatio-temporal data model to cognize and abstract each network space target, and generating multi-granularity spatio-temporal entities;

[0035] (3) Logical objectification of multi-granularity spatio-temporal entities, organizing the abstraction results into a multi-granularity spatio-temporal object data model according to specifications;

[0036] (4) Dataization of multi-granularity spatio-temporal objects.

[0037] The ground network coupling entity model constructed by the present invention expands the multi-granularity spatio-temporal object model, and constructs a ground network coupling entity model to better describe the network space target attributes and the cross-domain association between the network space and the geographical space, such as Figure 2 shown. The ground network coupling entity model consists of an attribute description module and a ground network association logic description module. This model can be described as a quadruple: Solid model = <Conceptscyber, Conceptsgeo, Associations, Rules>. Among them, Conceptscyber = {Cyberspace entities, Level, {A1}} represents the set of various entity concepts in the network space. Cyberspace entities represent various entities in the network space, Level represents the three levels to which the network space entities belong, and {A1} is the set of various attributes that the network space entities have according to the modeling method of the multi-granularity spatio-temporal model; Conceptsgeo = {Geography entities, {A2}} represents the set of various entity concepts in the geographical space. Geography entities represent the geographical space entities mapped by various entities in the network space, and {A2} represents the various attributes of the geographical space entities, including natural geographical attributes, economic attributes, social attributes, etc.; Associations = {a(c1, c2)|c1 ∈ Conceptscyber, c2 ∈ Conceptsgeo} is the set of association mapping relationships between network space entities and geographical space entities, specifically referring to the semantic relationship and spatial position relationship between network space entities and corresponding geographical space entities; Rules = {rules} is the set of response rules for various network events. Among them, it includes the basic logical relationship rules for the association response between the network space and the geographical space entities through the logical layer and the basic rules for making response decisions, as well as the social value loss calculation rules, etc.

[0038] The attribute description module inherits the multi-granularity spatio-temporal object model, integrates the attribute features, spatio-temporal reference, spatial location, and spatial form of cyber space entities into inherent attribute features, and integrates the composition structure and association relationship into the hierarchical composition module; integrates the behavioral ability and cognitive ability into the cognitive behavior module. Among them, cyber space entities continuously interact with cyber space and geographical space through cognitive and behavioral abilities, thus generating associations. Therefore, the cognitive behavior module is the link connecting the ground-network association module; in the ground-network association logic description module, "multi-level" refers to the three layers of the physical layer, logical layer, and social layer of cyber space. Cyber space events (such as cyber attacks) act on cyber space entities, bringing about attribute changes. The changes of cyber space entities represented by various network devices are directly mapped to the physical layer of cyber space, manifested as damage or service interruption, etc.; cyber space entities in the "social layer" of cyber space represented by equipment management personnel, social users, etc. have behavioral and cognitive attributes, and such entities can use cognitive attributes to make corresponding decisions through knowledge reserves and network public opinion. At the same time, state variables are introduced to describe the changes in the attribute states of cyber space entities after cyber attacks and the changes in various elements in the real geographical space.

[0039] Different from the traditional multi-granularity spatio-temporal object attribute description, the modeling of cyber space entities needs to reflect the attribute features of entities at all levels in cyber space. Therefore, the attribute description module in the ground-network coupling entity model of the present invention is used to describe from three aspects: inherent attribute features, hierarchical composition, and cognitive behavior. There are four types of inherent attributes, and the following will introduce these 4 types of features respectively.

[0040] (1) Attribute features

[0041] All kinds of cyber space entities distributed at different levels always have physical entities in the real geographical space that are mapped one by one. Therefore, when making basic attribute descriptions of them, not only their attributes in cyber space need to be considered, but also the corresponding physical entities need to be considered. The formal description of the attribute features is as follows:

[0042] Value = {Name, Type, Physical entity, Cognitive ability, Behavioral capacity} Value is the collection of entity attributes, which includes the name (Name) of the cyber space entity, the entity type (Type), the mapped physical entity (Physical entity), and whether it has cognitive ability (Cognitive ability) and behavioral ability (Behavioral capacity).

[0043] (2) Spatio-temporal reference

[0044] Spatio-temporal reference includes time reference and space reference. In cyberspace, the time reference system usually requires a primary reference system, a secondary reference system, and a self-reference system. The primary reference system usually adopts the international standard time reference. The secondary reference system is used to describe the development process of network events that are constantly occurring in cyberspace. The self-reference system refers to the time characteristics of the entity itself, such as taking the factory or birth as the reference. The description of time reference is as follows, where Time main 、Time he 、Time self represent the primary reference system, the secondary reference system, and the self-reference system respectively.

[0045] Time main ={T internationality …}

[0046] Time he ={T begin ,T conduct ,T finish}

[0047] Time self ={T born ,T grow ,T perish}

[0048] Times={Time main ,Time he ,Time self}

[0049] Spatial reference consists of two parts: the geographical space reference system and the cyberspace reference system. In the geographical space reference system, the specific location of the geographical entity mapped by the network space entity is usually described based on a certain general coordinate reference system; in the cyberspace reference system, it is usually described based on the different network levels where the network entity is located.

[0050] (3) Spatial position

[0051] Since network space entities are divided into device entities and virtual entities, and virtual entities exist attached to devices, therefore, only the cyberspace reference system and the geographical space reference system where the device entities are located need to be described. Among them, the geographical location of the device entity can be described based on the primary reference system, the parent reference system, and the self-reference system, and usually the specific xyz coordinates are given based on a certain general coordinate reference system. The formal description is as follows: Position geo ={Geo x ,Geo y ,Geo z}

[0052] The spatial position relationship between devices is the distance between two coordinates under a unified projection coordinate system, and the calculation formula is:

[0053]

[0054] where (x i , y i , z i ) and (x j , y j , z j ) represent the geospatial coordinates of the corresponding entities.

[0055] The description of the cyberspace location of device entities is divided into two categories: absolute reference system and relative reference system. In the cyberspace, according to the topological relationship of the global Internet, it can be divided into between countries, within a country, between AS domains, within an AS domain, at the POP level, at the router level, and at the IP level. The absolute reference system refers to the positioning of a cyberspace entity in the entire cyberspace topological structure according to the topological level where its IP is located. Its formal description can adopt the form of a quadruple: <Entity, Country, Region, Level>. For example, a personal computer located in Henan Province can be described as <Personal computer, China, Henan Province, IP level>.

[0056] The relative reference system is used to describe that when conducting network topology detection, starting from any host, probes are sent to the destination host to obtain topological structure information and the returned information is collected to analyze the topological structure status of the network, so as to determine the relative position between the host and the destination host. Its formal description can adopt the form of a triple: <Entitys, Entityt, Distance>. Among them, Entitys represents the device that emits the signal, Entityt represents the target device to be detected, and Distance represents the distance of the topology. Regarding the distance between the signal-emitting device and the closest information-transmitting device as the unit distance D, one unit distance is added for each device passed through. The relative distance between two devices is:

[0057]

[0058] (4) Spatial form

[0059] The spatial form is to express the state characteristics of different cyberspace entities at different times, different levels, and different scenarios in different network events. Taking the entity of the ground-network fusion information system in the network attack scenario as an example, the formal description of the spatial form is as follows:

[0060] Time = {T begin , T conduct , T finish}

[0061] Tier = {Cyber physical , Cyber logical , Cyber social}

[0062] Scene = {Scene1, Scene2, … Scene n}

[0063] State = {State attack , State working , State control}

[0064] Time represents the time series when different network events occur. Tbegin, Tconduct, and Tfinish represent the start, development, and end of the event respectively; Tier represents the different network space levels where network space entities exist. Cyberphysical, Cyberlogical, and Cybersocial represent the physical layer, logical layer, and social layer of the network space respectively; Scene represents different network event scenarios; State represents the states of network space entities, namely being attacked, operating normally, and under control.

[0065] The hierarchical composition is described using two types of features, including the composition structure and the association relationship, which are introduced separately below.

[0066] (1) Composition Structure

[0067] The hierarchical composition module is mainly used to describe the architecture of device entities in the network space. For entities in a network information system with the characteristics of ground network coupling, the physical composition structure often has the characteristics of multiple levels and multiple granularities. Taking the power information system as an example, multiple levels mean that the system entities rely on hierarchical levels at the provincial, municipal, and county levels, and the composition relationship at each level is roughly the same; multiple granularities mean that different spatio-temporal objects can be combined into larger-scale spatio-temporal objects. For example, a substation system in a certain city can be composed of substations, power lines, power towers, etc.

[0068] (2) Association Relationship

[0069] When entities in a network information system with characteristics of ground grid coupling conduct information flow and exchange, they often exhibit the characteristics of multi-dimensional dynamics and multi-dimensional correlations. Taking the power information system as an example, multi-dimensional dynamics means that there are characteristics of execution and control, and upper-lower level correlations among the entities of the system. For example, the paralysis of the upper-level substation will cause the load center substation to not operate normally; multi-dimensional correlations are reflected in the hierarchical composition structure of the entities in the ground grid integrated information system and the connections with various stakeholders in society. For example, in the Smart Grid Interoperability Standards Framework and Roadmap proposed by the National Institute of Standards and Technology (NIST) of the United States in 2020, the correlation relationships and multi-dimensional information flows among the seven major components of the power production department, operation management department, power distribution department, power transmission department, service provider department, market, and consumers are described.

[0070] Cognitive behaviors mainly include behavioral ability and cognitive ability.

[0071] (1) Behavioral ability

[0072] According to the description method characterized by multi-granularity spatio-temporal objectivity, the triggering methods of spatio-temporal object behaviors are four types: "time triggering, rule triggering, event / message triggering, and state triggering", and most of the triggering methods are event / message triggering; the classification of spatio-temporal object behaviors is two types: "information transmission behavior" and "state change behavior", and a description framework for the behaviors of spatio-temporal objects is designed from six aspects: "behavior type, behavioral ability, environmental influencing factors, behavior triggering conditions, behavior acting objects, and behavior design models".

[0073] (2) Cognitive ability

[0074] Cognitive ability is the basis for describing the autonomous learning and cognition or group decision-making of multi-granularity spatio-temporal objects, mainly including spatio-temporal objects obtaining information, processing information, understanding information, forming decisions, operating and controlling, and publishing information, etc. The cognitive relationships among spatio-temporal objects can be expressed as "temporal cognitive relationships" and "logical cognitive relationships". Temporal cognitive relationships refer to the cognitive behaviors of spatio-temporal objects at a specific time node or during a specific time period, and logical cognitive relationships refer to the inference and cognition of the changes and evolutions of a specific object using the "event-state" mechanism.

[0075] For the description of the attributes of geographical space entities:

[0076] In the ground network coupling entity model, the description of the entity attributes in the geographical space does not focus on the description of the entity's own attributes, but rather on its additional natural geographical attributes, economic attributes, and social attributes. The natural geographical attribute is the geographical space location; the economic attribute is the value and additional value of the entity itself. For example, when the entity is a certain device, the additional value refers to the value attached to the information stored in the device. When the entity is a person with social attributes, the additional value refers to the value reflected by their labor to society; the social attribute refers to whether the entity has the ability to influence society, which is reflected in two aspects: cognitive decision-making and public opinion ability.

[0077] The ground network association logic description module describes the network space entities from three aspects: the physical layer, the logical layer, and the social layer of the network space, and describes the changes in the entity attributes in the network space and the changes in various elements in the real geographical space after a network event occurs, such as Figure 3 shown. The association between the network space and the geographical space is not only the link to express the linkage of spatial information but also the basis for carrying out spatio-temporal big data association analysis, predictive analysis, and decision support. The scope of influence of a network attack covers the three major levels of the network space. Therefore, the ground network association not only refers to the association of geographical location and level but also needs to consider the logical association with the real geographical space after a network attack event occurs. In this invention, taking a network attack as an example, the module is described by using a ground network association logic diagram and event formal expression. Among them, the ground network association logic diagram is as Figure 4 shown. The development of a network attack is in the network space, which directly changes the attributes of the physical layer entities. The change in the state of the device to which the entity is attached is mapped to the natural geographical elements in the geographical space, thereby affecting the social and economic elements and social public opinion, forming new social and cultural elements, and expanding and mapping to the social layer in the network space, fermenting into network public opinion, and ultimately affecting the cognition and behavior of network space entities.

[0078] 2. Determine the visualization content according to the description results of the ground network coupling entity model, and display the visualization content according to the selected visualization method.

[0079] Taking the network attack event of the power system in a certain area as an example, statistical and visual expression are carried out by using interactive means. The main technical implementation process of visualization is as follows:

[0080] (1) Collect relevant materials. Collect the distribution and attribute data of power plants, substations, power lines, and power towers in a certain area; collect data materials and calculation models related to loss calculation such as the gross national product of the area in 2020; use web crawler technology to crawl the relevant public opinion data on network attack power outages on Weibo from 2020 to 2021.

[0081] (2) Data cleaning and preprocessing. The original qmd format power point data and line data of the power system are converted into geojson format data and classified and databased according to entity categories. Invalid data information is eliminated, and the crawled network public opinion data is segmented and cleaned for statistical processing.

[0082] (3) Establish a visualization plan. Determine the visualization content based on the visualization model and select an appropriate expression method.

[0083] (4) Front-end visualization expression. Based on Cesium 3D digital earth, based on OSM map, using B / S framework, using OpenGL to render graphics, using VScode2019 development environment, the user interface of the power information system was built to realize 3D digital earth display and dynamic visualization interaction.

[0084] According to the visualization method system of "event-module decomposition-content determination-spatial mapping-expression", the attribute description module is used to describe the distribution and attribute characteristics of entities in the power information system. According to the 8 types of objects involved in the power information system determined earlier, the visualization objects are determined to be "power plant", "power station", "power line" and "power tower". According to the different hierarchical composition relationships and spatial distribution, these four types of network space entities are mapped to the real geographic space, and the visualization expression method combining geographic location map layout, hierarchical map layout and time sequence map layout is used for display.

[0085] The geographical location layout adopts the form of traditional GIS visualization, using point, line and surface expressions to display the overall distribution of Henan Province's power information system. Among them, the power tower entity is expressed by point data; lines of different colors represent the ultra-high voltage transmission lines, high voltage transmission lines and medium and low voltage distribution lines in the power line entity; power plants and substation entities are expressed by surface data of different colors. When the viewport changes, the entity level display changes accordingly. This module can be associated and coordinated with other different views.

[0086] according to Figure 5 Visualization process, the visualization content of this module is determined as four aspects: network attack targets, attack methods, attack effects, and network public opinion. Statistical charts and word cloud diagrams are used to simulate the impact of network attacks on production and life in real geographic space. Figure 6b It is a bar chart that can visually express the number of power plants, substations, and transmission lines in various cities, and is used to make preliminary judgments on attack targets; Figure 6c It is a Cartesian coordinate system heat map, which is used to represent the statistical data of common network attack types within a natural day. The horizontal axis represents a natural day, and the vertical axis represents various types of attack methods. The core of the heat map represents the number of times the attack method occurs during this period.

[0087] When a cyber - space entity in a certain area is under a cyber - attack, the entity interactions associated with this entity in the geographical map turn red and the status is set to out of service. This is an intuitive attack effect. The indirect attack effect is reflected in Figure 6a In the sunburst chart, this chart is used to statistically analyze the direct and indirect losses of socio - economic factors in the real geographical space. Since the power - outage durations of different user groups are different during a power outage, according to the estimation curve of the user power - outage loss function, when the power - outage duration exceeds 8 hours, the power - outage loss curve tends to be a straight line and the power - outage becomes stable. Therefore, in the experiment, the average power - outage duration of 8 hours is taken to calculate and display the direct and indirect losses brought by this power - outage simulation.

[0088] Starting from the perspective of modeling cross - domain associated cyber - space entities, this invention inherits the modeling method of the multi - granularity spatio - temporal object model and proposes a ground - network coupling entity model, which better describes the characteristics of cyber - space entities and the relationship between cyber - attack events and the ground - network association logic. Based on this model, a visualization system for simulating cyber - attacks on the power information system is developed to visually simulate cyber - attacks on the power system. The experimental results show that this model can fully consider the multi - level nature of cyber - space entities and the characteristics of cognitive behavior, directly simulate the dynamic evolution process of entities, and the visualization expression method achieves ground - network coupling display and analysis, clearly expressing the impacts on natural geographical elements, socio - economic elements, and social and human elements during the cyber - attack process on the power system, verifying the rationality and effectiveness of the model.

Claims

1. A visualization method for ground network-coupled multi-granularity spatio-temporal objects, characterized in that, The visualization method includes the following steps: 1) Obtain network events to be visualized; 2) Establish a ground network coupling entity model, which includes an attribute feature description module and a ground network association logic description module. Use the attribute feature description module to describe the distribution and attribute features of entities in the network event; use the ground network association logic description module to describe network space entities from three aspects: the physical layer, the logical layer, and the social layer of the network space, and describe the changes in the attribute states of network space entities and the changes in various elements in the real geographical space after the network event occurs; the description of the ground network association logic module for the physical layer refers to the network space level where network space entities are located, which are directly affected by network events and include infrastructure of various network information systems, sensing devices in the access network system, and physical entities mapped by virtual accounts; the description of the ground network association logic module for the social layer refers to the description of the behavior and cognitive attributes of network space entities in the social layer of the network space; 3) Take the description result of the ground network coupling entity model as the visualization content and display the visualization content according to the selected visualization method.

2. The visualization method of ground network-coupled multi-granularity spatio-temporal objects according to claim 1, wherein The attribute feature description module is used to describe the distribution and attribute features of entities in the network event from three aspects: inherent attribute features, hierarchical composition, and cognitive behavior.

3. The visualization method of the ground grid-coupled multi-granularity spatio-temporal object according to any one of claims 1-2, characterized in that When the network event is a network attack event, the ground network association logic module describes the network attack event in a formal expression way, including three parts: event start and end time, event structure, and event impact. Among them, the start and end time refers to the time from the start of the network attack to the return to normal operation, the event structure refers to the attack type, attack method, and attack object, and the event impact includes the impact on natural geographical elements, social and economic elements, and social and cultural elements in the real geographical space, as well as the change in the attributes of network space entities.

4. The visualization method of ground network-coupled multi-granularity spatio-temporal objects according to any one of claims 1-2, characterized in that When performing the visualization display in step 3), determine the network space entities of the visualization object, map the network space entities to the real geographical space according to different hierarchical composition relationships and spatial distributions, and use a visualization expression method that combines geographical location map layout, hierarchical map layout, and time series map layout for display.

5. The visualization method of the ground network-coupled multi-granularity spatio-temporal object according to claim 4, characterized in that, The geographical location map layout is displayed in the form of GIS visualization, and the point, line, and surface expression forms are used to display network entities, and corresponding hierarchical switching is performed according to the change of the viewport.

6. The visualization method of the ground network-coupled multi-granularity spatio-temporal object according to claim 4, characterized in that When the network event is a network attack event, the visualization content is determined to be four aspects: network attack target, attack means, attack effect, and network public opinion, and statistical charts and word cloud charts are used to simulate the impact of network attacks on production and life in the real geographical space.

Images