A security assessment method, system and storage medium for power communication network

Abstract

The present invention discloses a security assessment method, system and storage medium for an electric power communication network, comprising: step S1: dividing electric power equipment into first equipment and second equipment; step S2: generating multiple intrusion routes, calculating the intrusion benefit of each intrusion route by a safety factor and a first impact degree, calculating a first probability of the first equipment by comprehensively considering the intrusion benefit, and collecting historical intrusion data to generate a second probability of the second equipment; step S3: correcting the second probability of the second equipment based on a first formula to obtain a third probability; step S4: obtaining the fault type and occurrence probability of each electric power equipment, and establishing a first table in combination with the first impact degree, the first probability and the third probability, collecting a solution strategy for each fault type and generating a second table, and calculating the robustness value of the communication network based on the first table and the second table for evaluation. Through the above technical scheme, the electric power communication network can be evaluated from both macro and micro perspectives.

Description

Technical Field

[0001] The present invention belongs to the technical field of data transmission, and in particular relates to a security assessment method, system and storage medium for a power communication network. Background Art

[0002] The power communication network came into being to ensure the safe and stable operation of the power system. It is an important means to ensure the safe, stable and economical operation of the power grid. Therefore, by evaluating the power communication network, we can try to avoid risk events and potential risks and ensure the stable operation of the power communication network.

[0003] The following methods are proposed in the prior art to evaluate the power communication network. For example, the Chinese patent application "CN114500294A" discloses a communication network security assessment method and system. The method first obtains the original data of the communication network security, classifies the original data, establishes the initial indicator data of the communication network security, determines the triangular fuzzy membership function of the initial indicator data, obtains the fuzzy judgment matrix data, determines the initial weight data according to the fuzzy judgment matrix data, and finally processes the initial weight data to obtain the final standardized weight data. According to the standardized weight data and the initial indicator data, a safety factor is generated to achieve a quantitative evaluation of the communication network.

[0004] However, the above-mentioned prior art only conducts security risk assessment on the power communication network as a whole, which is not only greatly affected by subjective factors, but also lacks interpretability in the assessment results, and it is impossible to determine which problems lead to the low safety factor of the power communication network. Summary of the invention

[0005] To solve the above problems, the present invention provides a security assessment method, system and storage medium for a power communication network to solve the problem that the assessment results in the prior art are relatively vague.

[0006] In order to achieve the above-mentioned object of the invention, the present invention proposes a security assessment method for a power communication network, comprising:

[0007] Step S1: acquiring power devices included in a communication network and corresponding IP addresses, dividing the communication network into multiple sub-networks based on the IP addresses, wherein the sub-networks include a first type and a second type, defining the power devices located in the sub-network of the first type as first devices, and defining the power devices located in the sub-network of the second type as second devices;

[0008] Step S2: Based on the subnetwork and the included power equipment, a first topology map of the communication network is generated, multiple intrusion routes are generated based on the first topology map, the safety factor and the first impact degree of each power equipment are collected, the intrusion benefit of each intrusion route is calculated by the safety factor and the first impact degree, the first probability of the first device is calculated by combining the intrusion benefits of each intrusion route, and the historical intrusion data of the communication network is collected to generate the second probability of the second device;

[0009] Step S3: modify the second probability of the second device numbered m based on the first formula to obtain a third probability of the second device numbered m , the first formula is: ,in, and are respectively the first probability and weight of the nth first device among the first devices that are allowed to access the second device, the second probability of the second device numbered m;

[0010] Step S4: Collect first historical data, extract the fault type and occurrence probability of each type of the power equipment based on the first historical data, and establish a first table in combination with the first impact level, the first probability and the third probability, collect solution strategies for each type of fault and generate a second table, calculate the risk value of each type of the power equipment based on the first table and the second table, calculate the robustness value of the communication network based on the risk value, and evaluate the communication network based on the robustness value.

[0011] Further, in step S4, calculating the risk value of the electric power equipment based on the first table and the second table includes the following steps:

[0012] The second table includes the solution measures for each fault type and the solution probability of each solution to the fault type, and the risk value of the power equipment numbered m is calculated based on the second formula , the second formula is: , wherein, if the power device is the first device, is the first probability, if the power device is the second device, is the third probability, is the probability of occurrence of the hth type of fault of the power equipment, is the probability of solving the hth fault type after adopting the solution.

[0013] Further, in step S4, the robustness value is calculated and the communication network is evaluated based on the following steps:

[0014] Establish a risk assessment model, input the risk value of the power equipment and the first impact degree into the risk assessment model, the risk assessment model generates a second topology map, the second topology map includes a first network layer, a second network layer and a third network layer, the first network layer includes a plurality of first nodes, each of the first nodes corresponds to one of the power equipment, and the first node includes the risk value of the power equipment, the second network layer includes a plurality of second nodes, set a matching rule, connect the second node with at least one of the first nodes based on the matching rule, and calculate a fourth probability within the second node based on the first node connected to the second node;

[0015] A third node is arranged in the third network layer, and the third node collects the fourth probability of each second node and calculates and generates the robust value, wherein the robust value includes the average value and variance of the fourth probability, and sets a first threshold and a second threshold. If the average value and the variance are respectively smaller than the first threshold and the second threshold, the communication network is classified into a first rating; if only the average value is smaller than the first threshold, the communication network is classified into a second rating; if only the variance is smaller than the second threshold, the communication network is classified into a third rating.

[0016] Further, the second node is connected to the first node based on the following steps:

[0017] Acquire the accident handling guide text of the communication network, extract the accident name in the accident handling guide and the power equipment associated with the accident name based on a natural language model, generate the matching rule based on the accident name and the associated power equipment, generate the second node based on the accident name, and connect the second node with the corresponding first node based on the matching rule.

[0018] Furthermore, after generating the second topology map, the first influence degree of each first node is accumulated to the second nodes connected thereto to obtain a second influence degree. If the communication network is divided into the first rating, the second nodes whose second influence degree is greater than a third threshold are extracted, and a warning message is generated to the second nodes.

[0019] Further, in step S2, calculating the first probability of the first device includes the following steps:

[0020] The first devices located in the same sub-network are divided into the same calculation group, and the intrusion benefit of the j-th intrusion route starting from the i-th first device in the calculation group is calculated based on a third formula. , the third formula is: ,in, and are respectively the first impact degree and the safety factor of the kth power device in the jth intrusion route starting from the i-th first device;

[0021] Calculate the first probability of the i-th first device based on the fourth formula , the fourth formula is: .

[0022] The present invention also provides a safety assessment system for a power communication network, which is used to implement the above-mentioned safety assessment method for a power communication network, and the system comprises:

[0023] an identification module, obtaining power devices included in a communication network and corresponding IP addresses, dividing the communication network into a plurality of sub-networks based on the IP addresses, wherein the sub-networks include a first type and a second type, defining the power devices located in the sub-network of the first type as first devices, and defining the power devices located in the sub-network of the second type as second devices;

[0024] A calculation module, based on the subnetwork and the included power equipment, generates a first topology map of the communication network, generates multiple intrusion routes based on the first topology map, collects the safety factor and the first impact degree of each of the power equipment, calculates the intrusion benefit of each of the intrusion routes by using the safety factor and the first impact degree, calculates the first probability of the first equipment by combining the intrusion benefits of each intrusion route, and collects historical intrusion data of the communication network to generate a second probability of the second equipment;

[0025] A correction module is configured to correct the second probability of the second device numbered m based on the first formula to obtain a third probability of the second device numbered m. , the first formula is: ,in, and are respectively the first probability and weight of the nth first device among the first devices that are allowed to access the second device, the second probability of the second device numbered m;

[0026] An evaluation module collects first historical data, extracts the fault type and occurrence probability of each type of the power equipment based on the first historical data, establishes a first table in combination with the first impact level, the first probability and the third probability, collects solution strategies for each type of fault and generates a second table, calculates the risk value of each type of the power equipment based on the first table and the second table, calculates the robustness value of the communication network based on the risk value, and evaluates the communication network based on the robustness value.

[0027] The present invention also provides a computer storage medium, wherein the computer storage medium stores program instructions, wherein when the program instructions are executed, the device where the computer storage medium is located is controlled to execute the above-mentioned method for safety assessment of a power communication network.

[0028] Compared with the prior art, the beneficial effects of the present invention are at least as follows:

[0029] The present invention first collects the IP addresses of each power device in the communication network, thereby dividing the communication network and the power equipment into different types, and then generates a topological map of the entire network according to the types of the divided communication network and power equipment, and generates and calculates the intrusion route based on this; in the calculation process, by introducing the influence degree and safety factor of each power device, the expected benefit of each intrusion route is obtained, so as to further obtain the first probability of the head device of each route being invaded, and then the second probability of each power device located in the local area network being invaded is calculated in combination with historical data, and finally the second probability is corrected in combination with the first probability, so as to obtain the third probability of each power device being invaded; in this way, the probability of each power device in the power communication network being invaded is shown from a microscopic perspective, which is convenient for relevant personnel to evaluate.

[0030] The present invention also combines the first probability and the third probability to calculate the robustness value of the entire power communication network. The overall stability and reliability of the communication network can be evaluated through the robustness value, thereby demonstrating the risk resistance of the power communication network from a macro perspective. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flow chart of the steps of a method for safety assessment of a power communication network according to the present invention;

[0032] Figure 2 is a first topological diagram of the present invention;

[0033] Figure 3 is a second topological diagram of the present invention;

[0034] Figure 4 It is a structural schematic diagram of a safety assessment system for a power communication network of the present invention. DETAILED DESCRIPTION

[0035] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0036] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe various elements, but unless otherwise specified, these elements are not limited by these terms. These terms are only used to distinguish a first element from another element. For example, without departing from the scope of this application, a first xx script may be referred to as a second xx script, and similarly, a second xx script may be referred to as a first xx script.

[0037] like Figure 1 As shown, a security assessment method for a power communication network includes:

[0038] Step S1: Obtain the power devices included in the communication network and the corresponding IP addresses, divide the communication network into multiple sub-networks based on the IP addresses, the sub-networks include a first type and a second type, define the power devices located in the first type of sub-network as first devices, and define the power devices located in the second type of sub-network as second devices.

[0039] Specifically, in this embodiment, the communication network is divided into a plurality of different sub-networks, and the sub-networks are respectively of a first type and a second type. The first type is a wide area network, and the second type is a local area network. The power equipment located in the wide area network can communicate data with the outside world, and the power equipment located in the local area network can only communicate data with other power equipment that is also located in the local area network. It is a prior art to divide sub-networks according to the IP addresses of the power equipment, and to determine which power equipment is in the same sub-network according to the network segment of the IP address, which will not be described in detail here. In addition, the power equipment located in the wide area network is positioned as the first device, and the equipment located in the local area network is defined as the second device. In this embodiment, the power equipment is also numbered as device 1, device 2, etc.; it should also be noted that external data can access the power equipment in the local area network with the help of the power equipment in the wide area network, such as Figure 2 In the figure, NW1 is a wide area network, NW2 and NW3 are local area networks, devices 1 and 2 in NW1 can access device 4 in NW2, and device 3 in NW1 can access device 8 in NW3, but devices in the external network cannot directly access devices in NW2 and NW3; in addition, multiple wide area networks can be divided from the communication network, and devices in the same wide area network can be physically close, or devices in the same wide area network can have directed access to the same local area network.

[0040] Step S2: Based on the sub-network and the included power equipment, generate a first topology map of the communication network, generate multiple intrusion routes based on the first topology map, collect the safety factor and the first impact degree of each power equipment, calculate the intrusion benefit of each intrusion route through the safety factor and the first impact degree, calculate the first probability of the first device based on the intrusion benefits of each intrusion route, and collect the historical intrusion data of the communication network to generate the second probability of the second device.

[0041] The first topology graph generated is as follows Figure 2 As shown, the safety factor and the first impact degree of each power equipment in the first topology diagram are set by collecting existing information. In this embodiment, the safety factor is set to 1-5. The higher the safety factor, the more difficult it is to invade the equipment. The first impact degree is also set to 1-5. The larger the first impact degree is, the greater the impact range or the severity of the consequences caused by the equipment failure. For example, a firewall is set in device 1, and vulnerability patches are frequently maintained. Its safety factor is 4. Device 9 is responsible for the exchange of core power dispatching data. If it fails, the central dispatching information cannot be sent down, which will affect the power grid load in multiple regions. Therefore, its first impact degree is 5. The value here can be set manually, or the maintenance rules and jurisdiction text of each device can be extracted through the natural language NLP model. The extracted text is then combined with the pre-set rules to automatically set the safety factor and the first impact degree of each device.

[0042] After generating the first topology map, multiple intrusion routes are generated. The intrusion route is the route that an external device attacks a target power device, causing it to lose certain functions. For example, device 9 is a key power device. During the intrusion, the external device can invade according to the route of device 1-device 4-device 9, or according to the route of device 3-device 8-device 9. Then, the first probability of the first device and the second device is calculated based on the intrusion benefits of each intrusion route. The method for calculating the intrusion benefit and the first probability of the first device is described later. The method for calculating the second probability can be obtained based on the statistics of collected historical data. For example, 100 intrusion records in the past are collected, and the intrusion targets of 80 intrusion records are all device 9. Then, the second probability of device 9 is 80 / 100*100%=80%.

[0043] Step S3: Based on the first formula, the second probability of the second device numbered m is modified to obtain the third probability of the second device numbered m , the first formula is: ,in, and are respectively a first probability and a weight of the nth first device in the first devices that are allowed to access the second device, is the second probability of the second device numbered m.

[0044] The first formula is explained below. For example, to calculate the third probability of device 4, the other first devices that can access device 4 are device 1 and device 2, and the first probability of device 1 and device 2 is obtained. The first probability is the probability that device 1 and device 2 are invaded. Here, the first probability of device 1 is 80%, and the first probability of device 2 is 60%. In addition, the weight between device 1 and device 4 is related to the physical distance between the two. In this embodiment, it is concretized as the number of data forwardings between the two, and then the weight between the two devices is calculated by setting a fixed weight formula; if the data of device 1 needs to be forwarded through 3 routes before reaching device 4, the weight formula is set to 0.6 / u, where u is the number of forwardings between devices. Here, by calculation, the weight between device 1 and device 4 is 0.6 / 3=0.2, and the number of forwardings between device 2 and device 4 is 1, then the weight between the two is 0.6 / 1=0.6.

[0045] Assuming that the second probability of device 4 is 70%, substituting the above data into the first formula, the third probability of device 4 is calculated as , which is 33.6%. The principle of the first formula is that by adding and multiplying the currently calculated probability of invading device 1 and the probability of invading device 4 obtained through historical data, we can obtain the probability of continuing to invade device 4 based on the current probability of invading device 1. In theory, the greater the physical distance between the two devices, the lower the probability of invading device 4 through device 1. Therefore, by increasing the weight based on the number of forwardings of the two, a more reasonable probability can be obtained. In particular, the first formula introduces the value 1 and performs multiple inversion operations, and the result is the comprehensive probability of invading device 4 through device 1 alone, device 2 alone, and device 1 and device 2 at the same time.

[0046] Step S4: Collect the first historical data, extract the fault type and occurrence probability of each power equipment based on the first historical data, and establish a first table in combination with the first impact degree, the first probability and the third probability, collect the solution strategy for each fault type and generate a second table, calculate the risk value of each power equipment based on the first table and the second table, calculate the robustness value of the communication network based on the risk value, and evaluate the communication network based on the robustness value.

[0047] The fault types of power equipment are collected through existing technical data. The fault types include slow data transmission speed, system operation lag or system failure to start, etc. The probability of occurrence of each fault can also be calculated based on the above-mentioned method of calculating the second probability, that is, calculated through the number of occurrences in historical data; then, a first table is established for the fault types of power equipment, the probability of occurrence of each fault type, the first impact degree and the third probability, and the fault resolution strategy for each power equipment is collected and a second table is generated. The specific content of the second table will be introduced later; by establishing the first table and the second table, on the one hand, scattered data can be organized into structured data for easy viewing by technical personnel, and on the other hand, structured data can also be easily input into subsequent risk assessment models; finally, the robustness value calculated by the first table and the second table is used to evaluate the overall stability of the communication network, and the specific evaluation method will be introduced later.

[0048] The present invention first collects the IP addresses of each power device in the communication network, thereby dividing the communication network and the power equipment into different types, and then generates a topological map of the entire network according to the types of the divided communication network and power equipment, and generates and calculates the intrusion route based on this; in the calculation process, by introducing the influence degree and safety factor of each power device, the expected benefit of each intrusion route is obtained, so as to further obtain the first probability of the head device of each route being invaded, and then the second probability of each power device located in the local area network being invaded is calculated in combination with historical data, and finally the second probability is corrected in combination with the first probability, so as to obtain the third probability of each power device being invaded; in this way, the probability of each power device in the power communication network being invaded is shown from a microscopic perspective, which is convenient for relevant personnel to evaluate.

[0049] It is particularly noteworthy that, through the above technical solution, the power communication network can be evaluated from both macro and micro perspectives.

[0050] In step S4 of this embodiment, calculating the risk value of the power equipment based on the first table and the second table includes the following steps:

[0051] The second table includes the solution measures for each fault type and the solution probability of each solution to the fault type, and the risk value of the power equipment numbered m is calculated based on the second formula , the second formula is: , wherein, if the power device is the first device, is the first probability, if the power equipment is the second equipment, is the third probability, is the probability of occurrence of the hth type of fault in power equipment, is the probability of solving the hth fault type after adopting the solution.

[0052] As mentioned above, the fault type, solution and solution probability recorded in the second table can be obtained through historical data. For example, the fault type is that the system runs slowly, the solution is to disconnect the network connection and clean up the system memory, the solution probability is 60%, and the probability of the fault occurring is 40%. Through the above data, it can be calculated that the probability that device 1 has this type of fault and cannot be solved is 0.338*0.4*(1-0.6)=0.05. Similarly, the probability that device 1 has other types of faults and cannot be solved is calculated. Finally, the probabilities that all types of faults of device 1 cannot be solved are accumulated to obtain the third probability of device 1. In fact, the third probability is the probability that device 1 has a fault and cannot be solved after being invaded.

[0053] Traditionally, when evaluating the power communication network, a quantitative evaluation result is generally obtained. For example, when the evaluation result of the power communication network is 8 out of 10, it indicates that the power communication network is relatively reliable and is not prone to accidents. However, this evaluation method is relatively broad. There is a situation where even if the power communication network is relatively reliable and is not prone to accidents, it has fatal loopholes. Once a failure is caused by the loophole, a major accident will occur. This cannot be solved by the traditional evaluation method. Therefore, in order to avoid this situation, in this embodiment, the communication network is evaluated based on the following steps:

[0054] A risk assessment model is established, and the risk value of the power equipment and the first impact degree are input into the risk assessment model. The risk assessment model generates a second topology map. The second topology map includes a first network layer, a second network layer and a third network layer. The first network layer includes multiple first nodes, each first node corresponds to a power equipment, and the first node includes the risk value of the power equipment. The second network layer includes multiple second nodes. A matching rule is set, and the second node is connected to at least one first node based on the matching rule. Based on the first node connected to the second node, the fourth probability within the second node is calculated.

[0055] like Figure 3As shown, for example, after inputting devices 1 to 4 into the risk assessment model, the risk assessment model generates first nodes 11, 12, 13 and 14, and the four nodes respectively store the risk values ​​calculated by the above steps and the first impact degree of each power device; then the second nodes 21, 22 and 23 are generated, the first nodes are connected to the corresponding second nodes, and the fourth probability in the second nodes is calculated at the same time. In particular, the second node stores the probability of a certain accident. The occurrence of the accident may be caused by one or more power devices through failure. For example, a failure of the first node 11 will cause an accident at the second node 21. For example, a failure of the first node 12 may also cause an accident at the second node 21. Or, for example, a failure of the first nodes 11 and 12 at the same time will cause an accident at the second node 21. Then the fourth probability in the second node is calculated. The rate can be calculated using the following algorithm. For example, to calculate the fourth probability of the second node 21, before the calculation, first obtain the probability of an accident occurring at the second node 21 based on historical data, which is defined here as the historical probability. The calculation method is the same as the method for calculating the second probability. Then the fourth probability = (risk value of the first node 11 * risk value of the first node 12) * historical probability + (risk value of the first node 11 * (1-risk value of the first node 12)) * historical probability + ((1-risk value of the first node 11) * risk value of the first node 12) * historical probability. Similarly, the risk value of each second node is calculated in sequence. The risk value is actually the probability that an accident may occur. In addition, the risk value is calculated based on the failure probability. The meaning is that no matter what type of failure occurs, it may cause the power equipment to fail to operate. Therefore, the sum of the failure probabilities is made equivalent to the failure of the power equipment.

[0056] A third node is arranged in the third network layer. The third node collects the fourth probability of each second node and calculates and generates a robust value. The robust value includes the average value and the variance of the fourth probability. A first threshold and a second threshold are set. If the average value and the variance are respectively smaller than the first threshold and the second threshold, the communication network is divided into a first rating. If only the average value is smaller than the first threshold, the communication network is divided into a second rating. If only the variance is smaller than the second threshold, the communication network is divided into a third rating.

[0057] The fourth probability of each second node is collected through the third node, all the collected fourth probabilities are arranged into a numerical sequence, the mean and variance of the numerical sequence are calculated, and the mean and variance are used as the robustness value of the power communication network. If only the mean value is less than the first threshold, it means that the probability of each accident is very small, but the existence of accidents causes the variance to increase, so it is necessary to focus on the occurrence of such events; if only the variance is less than the second threshold, it means that the probabilities of each event are close, but if the mean value is larger, it means that the entire power access network is unreliable; if both are less than the first threshold and the second threshold, it means that the power access network is relatively reliable, so the entire power communication network is evaluated from both macro and micro perspectives.

[0058] In this embodiment, the second node is connected to the first node based on the following steps:

[0059] Obtain the accident handling guide text of the communication network, extract the accident name in the accident handling guide and the power equipment associated with the accident name based on the natural language model, generate a matching rule based on the accident name and the associated power equipment, generate a second node based on the accident name, and connect the second node to the corresponding first node based on the matching rule.

[0060] Specifically, the method for obtaining matching rules is to obtain the fault handling guide of the power communication network, extract the accidents therein and the power equipment that may cause the accidents through manual or natural language processing. It should be noted that for the same accident, each time may be caused by different power equipment, or may be caused by multiple power equipment at the same time.

[0061] In this embodiment, after generating the second topological map, the first influence degree of each first node is accumulated to the second nodes connected thereto to obtain the second influence degree. If the communication network is divided into the first rating, the second node whose second influence degree is greater than the third threshold is extracted, and a warning message is generated pointing to the second node.

[0062] After the second node is generated, the first impact degree corresponding to the first node is added to the second node to obtain the second impact degree. If the second impact degree is greater than the third threshold and the final evaluation result of the power grid is the second rating, the event information is extracted and a key attention warning is generated, that is, after such event occurs, the impact degree is relatively large.

[0063] In step S2, calculating the first probability of the first device includes the following steps:

[0064] The first devices located in the same sub-network are divided into the same calculation group, and the intrusion benefit of the j-th intrusion route starting from the i-th first device in the calculation group is calculated based on the third formula. , the third formula is: ,in, and They are respectively the first impact degree and safety factor of the kth power equipment in the jth intrusion route starting from the ith first equipment.

[0065] The first device located in the same subnetwork is divided into the same computing group. For example, device 1, device 2 and device 3 in NW1 are divided into one computing group. There are three intrusion routes starting from device 1, namely route 1: device 1-device 4-device 9, route 2: device 1-device 5-device 9, and route 3: device 1-device 4-device 5-device 9. The first impact levels of device 1, device 4, device 5 and device 9 are 1, 1, 1, 5, and the safety factors are 1, 2, 2, 5. The calculated benefit of route 1 is (1+1+5) / (1+2+5)=0.875. The meaning of the third formula is that the larger the safety factor, the higher the cost of intrusion, and the larger the first impact level, the greater the benefit after intrusion. Therefore, the larger the calculated benefit, the greater the benefit that can be obtained through less cost.

[0066] Calculate the first probability of the i-th first device based on the fourth formula , the fourth formula is: .

[0067] Here, the profit of route 2 is calculated to be 0.875, and the profit of route 3 is 0.8, so the calculated total profit of device 1 is 2.55. Similarly, assuming that the total profit of device 2 is 4 and the total profit of device 3 is 1 based on the above method, then the first probability of device 1 is 2.55 / (2.55+4+1)*100%=33.8%. Similarly, the first probabilities of other first devices can be calculated.

[0068] like Figure 4 As shown, the present invention also provides a safety assessment system for a power communication network, which is used to implement the above-mentioned safety assessment method for a power communication network, and the system includes:

[0069] An identification module is provided to obtain power devices included in the communication network and corresponding IP addresses, and divide the communication network into a plurality of sub-networks based on the IP addresses, wherein the sub-networks include a first type and a second type, and define the power devices located in the first type of sub-network as first devices and the power devices located in the second type of sub-network as second devices;

[0070] A calculation module generates a first topology map of the communication network based on the subnetwork and the included power equipment, generates multiple intrusion routes based on the first topology map, collects the safety factor and the first impact degree of each power equipment, calculates the intrusion benefit of each intrusion route by the safety factor and the first impact degree, calculates the first probability of the first device by combining the intrusion benefits of each intrusion route, and collects historical intrusion data of the communication network to generate a second probability of the second device;

[0071] A correction module is configured to correct the second probability of the second device numbered m based on the first formula to obtain a third probability of the second device numbered m. , the first formula is: ,in, and are respectively a first probability and a weight of the nth first device in the first devices that are allowed to access the second device, The second probability of the second device numbered m;

[0072] An evaluation module collects first historical data, extracts the fault type and occurrence probability of each power equipment based on the first historical data, and establishes a first table in combination with the first impact degree, the first probability and the third probability, collects the solution strategy for each fault type and generates a second table, calculates the risk value of each power equipment based on the first table and the second table, calculates the robustness value of the communication network based on the risk value, and evaluates the communication network based on the robustness value.

[0073] The present invention also provides a computer storage medium, which stores program instructions, wherein when the program instructions are executed, the device where the computer storage medium is located is controlled to execute the above-mentioned safety assessment method for a power communication network.

[0074] It should be understood that, although each step in the flow chart of each embodiment of the present invention is shown in sequence according to the indication of the arrow, these steps are not necessarily performed in sequence according to the order indicated by the arrow. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be performed in other orders. Moreover, at least a portion of the steps in each embodiment may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in sequence, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0075] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the above-mentioned program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0076] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0077] The above embodiments only express several implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the present invention. It should be pointed out that, for those of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the attached claims.

[0078] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for security assessment of a power communication network, characterized in that: include: Step S1: acquiring power devices included in a communication network and corresponding IP addresses, dividing the communication network into multiple sub-networks based on the IP addresses, wherein the sub-networks include a first type and a second type, the first type being a wide area network, and the second type being a local area network, defining the power devices located in the sub-network of the first type as first devices, and defining the power devices located in the sub-network of the second type as second devices; Step S2: Based on the subnetwork and the included power equipment, a first topology map of the communication network is generated, multiple intrusion routes are generated based on the first topology map, the safety factor and the first impact degree of each power equipment are collected, the intrusion benefit of each intrusion route is calculated by the safety factor and the first impact degree, the first probability of the first device being invaded is calculated by combining the intrusion benefits of each intrusion route, and the historical intrusion data of the communication network is collected to generate a second probability of the second device being invaded; Step S3: modify the second probability of the second device numbered m based on the first formula to obtain a third probability of the second device numbered m , the first formula is: ,in, and are respectively the first probability and weight of the nth first device among the first devices that are allowed to access the second device, the second probability of the second device numbered m; Step S4: Collect first historical data, extract the fault type and occurrence probability of each type of the power equipment based on the first historical data, and establish a first table in combination with the first impact level, the first probability and the third probability, collect solution strategies for each type of fault and generate a second table, calculate the risk value of each type of the power equipment based on the first table and the second table, calculate the robustness value of the communication network based on the risk value, and evaluate the communication network based on the robustness value.

2. A method for security assessment of a power communication network according to claim 1, characterized in that: In the step S4, calculating the risk value of the electric power equipment based on the first table and the second table includes the following steps: The second table includes the solution measures for each fault type and the solution probability of each solution to the fault type, and the risk value of the power equipment numbered m is calculated based on the second formula , the second formula is: , wherein, if the power device is the first device, is the first probability, if the power device is the second device, is the third probability, is the probability of occurrence of the hth type of fault of the power equipment, is the probability of solving the hth fault type after adopting the solution.

3. A method for safety assessment of a power communication network according to claim 2, characterized in that: In step S4, the robustness value is calculated and the communication network is evaluated based on the following steps: Establish a risk assessment model, input the risk value of the power equipment and the first impact degree into the risk assessment model, the risk assessment model generates a second topology map, the second topology map includes a first network layer, a second network layer and a third network layer, the first network layer includes a plurality of first nodes, each of the first nodes corresponds to one of the power equipment, and the first node includes the risk value of the power equipment, the second network layer includes a plurality of second nodes, set a matching rule, connect the second node with at least one of the first nodes based on the matching rule, and calculate a fourth probability within the second node based on the first node connected to the second node; A third node is arranged in the third network layer, and the third node collects the fourth probability of each second node and calculates and generates the robust value, wherein the robust value includes the average value and variance of the fourth probability, and sets a first threshold and a second threshold. If the average value and the variance are respectively smaller than the first threshold and the second threshold, the communication network is classified into a first rating; if only the average value is smaller than the first threshold, the communication network is classified into a second rating; if only the variance is smaller than the second threshold, the communication network is classified into a third rating.

4. A method for safety assessment of a power communication network according to claim 3, characterized in that: Connecting the second node to the first node is based on the following steps: Acquire the accident handling guide text of the communication network, extract the accident name in the accident handling guide and the power equipment associated with the accident name based on a natural language model, generate the matching rule based on the accident name and the associated power equipment, generate the second node based on the accident name, and connect the second node with the corresponding first node based on the matching rule.

5. A method for safety assessment of a power communication network according to claim 3, characterized in that: After generating the second topology map, the first influence degree of each first node is accumulated to the second nodes connected thereto to obtain a second influence degree. If the communication network is classified as the first rating, the second nodes whose second influence degree is greater than a third threshold are extracted, and a warning message is generated to the second nodes.

6. A method for safety assessment of a power communication network according to claim 1, characterized in that: In step S2, calculating the first probability of the first device includes the following steps: The first devices located in the same sub-network are divided into the same calculation group, and the intrusion benefit of the j-th intrusion route starting from the i-th first device in the calculation group is calculated based on a third formula. , the third formula is: ,in, and are respectively the first impact degree and the safety factor of the kth power device in the jth intrusion route starting from the i-th first device; Calculate the first probability of the i-th first device based on the fourth formula , the fourth formula is: .

7. A security assessment system for a power communication network, used to implement a security assessment method for a power communication network as claimed in any one of claims 1 to 6, characterized in that: include: an identification module, obtaining power devices included in a communication network and corresponding IP addresses, dividing the communication network into a plurality of sub-networks based on the IP addresses, wherein the sub-networks include a first type and a second type, the first type being a wide area network, and the second type being a local area network, defining the power devices located in the sub-network of the first type as first devices, and defining the power devices located in the sub-network of the second type as second devices; a calculation module, which generates a first topology map of the communication network based on the subnetwork and the included power equipment, generates multiple intrusion routes based on the first topology map, collects the safety factor and the first impact degree of each power equipment, calculates the intrusion benefit of each intrusion route by using the safety factor and the first impact degree, calculates the first probability of the first equipment being invaded by combining the intrusion benefits of each intrusion route, and collects historical intrusion data of the communication network to generate a second probability of the second equipment being invaded; A correction module is configured to correct the second probability of the second device numbered m based on the first formula to obtain a third probability of the second device numbered m. , the first formula is: ,in, and are respectively the first probability and weight of the nth first device among the first devices that are allowed to access the second device, the second probability of the second device numbered m; An evaluation module collects first historical data, extracts the fault type and occurrence probability of each type of the power equipment based on the first historical data, establishes a first table in combination with the first impact level, the first probability and the third probability, collects solution strategies for each type of fault and generates a second table, calculates the risk value of each type of the power equipment based on the first table and the second table, calculates the robustness value of the communication network based on the risk value, and evaluates the communication network based on the robustness value.

8. A computer storage medium, characterized in that: The computer storage medium stores program instructions, wherein when the program instructions are executed, the device where the computer storage medium is located is controlled to execute the security assessment method for a power communication network according to any one of claims 1 to 6.

Images