A network data analysis shielding method for electric power general contracting technology

Abstract

The present invention discloses a network data analysis and shielding method for electric power general contracting technology, which relates to the field of data analysis and shielding technology, and includes the following steps: S1, obtaining network status; S2, formulating data shielding strategies; S3, determining the arrangement of security resources; S4, scheduling security resources; S5, establishing physical and virtual resource pools; S6, implementing network security mechanisms. The present invention obtains network status, identifies the attack path of suspicious data, determines whether it is attacked by malicious data based on the K nearest neighbor algorithm, and learns the impact of data on electricity from data behavior characteristics, and formulates data shielding strategies by analyzing the effectiveness of data attacks, laying a reliable foundation for the subsequent arrangement, scheduling and classification of security resources, and setting a state estimation module by combining the hierarchical structure of the electric power information network and the attack blocking impact range analysis, thereby realizing automatic blocking of abnormal behavior.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis and shielding, and in particular to a network data analysis and shielding method for electric power general contracting technology. Background Art

[0002] In recent years, attacks on power information networks have occurred frequently, which have had a serious impact on the safe and stable operation of the power system. At this stage, my country's power information network security protection has improved the power information network security protection capabilities through the deployment of various security equipment and the application of security technologies on the basis of building a deep protection architecture for the power information network. However, there is a lack of unified coordination between security devices independently deployed based on different security needs, and no overall defense capability has been formed, nor can it shield offensive network data.

[0003] The general package network data of power information has a large network carrying capacity. There is a lack of effective and reasonable resource arrangement and scheduling during data analysis and processing, which affects the processing efficiency of network data. When encountering malicious data attacks, it is difficult to achieve the target shielding effect. The network data is relatively scattered, so it is necessary to conduct layered analysis according to the path. Due to the complexity of the network data, the selection of paths and the formulation of strategies are both costly. Network data resources are divided into physical equipment and virtual technology. Therefore, targeted classification and establishment of resource pools are very important for resource scheduling. Summary of the invention

[0004] The purpose of the present invention is to provide a network data analysis and shielding method for electric power general contracting technology to solve the problems raised in the above-mentioned background technology.

[0005] To achieve the above object, the present invention provides the following technical solution: a network data analysis and shielding method for electric power general contracting technology, comprising the following steps:

[0006] S1. Obtaining network status: The network is layered according to the type of power information network data, and the dependency analysis within each layer and the tracking of the relationship between different layers are realized. Based on the network layering model, the dependency relationship at the operating system level and the dependency relationship at the network level are constructed to identify suspicious attack paths, thereby providing a reliable foundation for network security shielding strategies;

[0007] S2. Formulate data shielding strategies: Determine the source of network data from the attack path, and determine the state of malicious data attack based on the K nearest neighbor algorithm, and learn the impact of data on electricity from the data behavior characteristics, and formulate data shielding strategies by analyzing the effectiveness of data attacks. According to the security resources in the power information network, clarify the optional security defense actions, study the impact of signals on the strategy decisions at each stage of the network, and achieve the coordination of the optimal defense decisions of the network;

[0008] S3. Determine the orchestration of security resources: According to the data shielding strategy and the security requirements of the power information business system, the security resources in the power information network are orchestrated, and the orchestration of security resources is set as the orchestration layer. The orchestration layer includes a security requirement analysis module, a security resource orchestration module, and a security policy formulation module. The path with the least overhead is selected through the resource orchestration overhead model to formulate a security service function chain;

[0009] S4. Dispatching security resources: The control layer receives the security service function chain from the orchestration layer. The control layer includes the SDN network controller and the security resource controller. Based on the security service function chain and combined with SDN and cloud platform technologies, different security resources are effectively and flexibly dispatched to achieve optimal combination and efficient utilization of security resources.

[0010] S5. Establish two types of resource pools: physical and virtual: Set up a resource layer, which includes network resources and security resources. The physical resource pool is composed of proprietary hardware devices, and various security tools are deployed in the form of virtual machines on virtual devices on general servers through virtualization technology to form a virtual resource pool;

[0011] S6. Implement network security mechanism: Set up a state estimation module in combination with the data analysis of the hierarchical structure of the power information network and security resources, and use the state estimation module to achieve automatic blocking of abnormal behavior through network status, attack path analysis, blocking strategy decision-making and blocking strategy execution.

[0012] Preferably, the step S1 specifically includes the following steps:

[0013] S101, generating a directed graph at each level to represent the dependency relationship between objects in the layer, and the directed graph covers the entire power information network to be analyzed;

[0014] S102, each level of the directed graph describes the state of the entire power information network from different perspectives;

[0015] S103, the directed graphs between the upper and lower layers are connected according to the dependency relationship to achieve cross-level dependency coordination analysis;

[0016] S104. The directed graph of the next layer is integrated into a higher layer through cross-layer analysis to support higher-level network security status analysis.

[0017] Preferably, the step S2 specifically includes the following steps:

[0018] S201, calculating the cluster center o of all historical measurement sample feature data sets in the dynamic security domain;

[0019] S202, taking the obtained cluster center o as the symmetry center, obtaining the coordinates of the symmetry point z";

[0020] S203, taking the symmetrical point z" as the category attribute, and obtaining the measurement samples corresponding to the K feature sample points closest to the symmetrical point z" through the K nearest neighbor algorithm.

[0021] The K nearest neighbor algorithm is as follows:

[0022]

[0023] In the formula, (x o_1 ,x o_2 ,…,x o_r ) is the coordinate of the cluster center o, (x' o ' _1 ,x' o ' _2 ,…,x' o ' _r ) are the coordinates of the symmetric point z”, r is the dimension;

[0024] Preferably, the step S3 specifically includes the following steps:

[0025] S301, the security demand analysis module is responsible for parsing the security demand of the power information business into the demand for security defense capabilities;

[0026] S302, the security resource orchestration module is responsible for combining and arranging the security defense capabilities in the resource pool and formulating a security service function chain. The security service function chain defines a set of orderly security service functions and meets the security service requirements with the help of the resource pool;

[0027] S303, the security policy formulation module formulates the security policy that the security device needs to execute according to the security service function chain. The security policy is a specific parameter configuration for the security device to control the defense action of the security device;

[0028] The resource orchestration overhead model is as follows:

[0029]

[0030] In the formula, Represents a security service function node Deployed physical nodes, express The unit computing cost of the deployed physical nodes, Indicates the physical link of the virtual link in the object mapping. It represents the cost per unit link resource and SSFC represents the security service function chain.

[0031] Preferably, the step S4 specifically includes the following steps:

[0032] S401, the security resource controller receives the security service function chain and security policy issued by the orchestration layer, extracts the required security resource combination from it, instantiates the required security resources in the resource pool, and then calls the interface of the security resource to configure the security policy for each instantiated security resource;

[0033] S402, the SDN network controller generates classification rules and forwarding rules based on the flow table according to the security service function chain, and sends the network traffic classification forwarding table to the network device, scheduling the network traffic to flow through the security service function chain in sequence.

[0034] Preferably, the step S5 specifically includes the following steps:

[0035] S501. The security resource provides security service capabilities to the upper layer through the interface, performs corresponding processing on the network traffic flowing through according to the security policy issued by the control layer, and implements the execution of the security defense strategy;

[0036] S502. Network resources include network traffic classifiers and forwarders.

[0037] Preferably, the step S5 specifically further comprises the following steps:

[0038] S503, the classifier classifies the network traffic based on the flow table of the control layer so that it can flow into the respective security service function chains according to the instructions of the network controller;

[0039] S504, the forwarder forwards the network traffic to each security resource instance node of the security service function chain to realize the scheduling of network traffic.

[0040] Preferably, in step S6, for the measurement data uploaded in real time, the state estimation module can identify bad measurement data introduced by random errors according to the carried bad data detection mechanism, thereby playing a role in eliminating bad data and even resisting bad data maliciously tampered by attackers.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. The present invention obtains the network status, identifies the attack path of suspicious data, determines whether it is attacked by malicious data based on the K nearest neighbor algorithm, learns the impact of data on electricity from the data behavior characteristics, and formulates a data shielding strategy by analyzing the effectiveness of data attacks, laying a reliable foundation for the subsequent arrangement, scheduling and classification of security resources. By combining the hierarchical structure of the power information network and the attack blocking impact range analysis to set up a state estimation module, the automatic blocking of abnormal behavior is achieved, and the path with the lowest cost is selected through the resource arrangement cost model to formulate a security service function chain to reduce the cost;

[0043] 2. The present invention reasonably arranges security resources through the orchestration layer, control layer and resource layer. The orchestration layer includes a security demand analysis module, a security resource orchestration module and a security policy formulation module. The path with the lowest overhead is selected through the resource orchestration overhead model to formulate a security service function chain. The control layer includes an SDN network controller and a security resource controller. The control layer accepts the security service function chain and effectively and flexibly schedules different security resources. The resource layer includes network resources and security resources. Then, physical and virtual resource pools are established through the resource layer to form a complete closed-loop data processing flow, thereby improving data analysis and processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 Provide an overall method flow chart for an embodiment of the present invention;

[0045] Figure 2 A flow chart of a method for obtaining network status provided by an embodiment of the present invention;

[0046] Figure 3 A flow chart of a method for formulating a data shielding strategy provided by an embodiment of the present invention;

[0047] Figure 4 A flow chart of a method for determining the arrangement of security resources provided by an embodiment of the present invention;

[0048] Figure 5 A flow chart of a method for scheduling security resources provided by an embodiment of the present invention;

[0049] Figure 6 A flow chart of a method for establishing physical and virtual resource pools provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] See also Figure 1-6 The present invention provides a technical solution: a network data analysis and shielding method for electric power general contracting technology, comprising the following steps:

[0052] S1. Obtaining network status: The network is layered according to the type of power information network data, and the dependency analysis within each layer and the tracking of the relationship between different layers are realized. Based on the network layering model, the dependency relationship at the operating system level and the dependency relationship at the network level are constructed to identify suspicious attack paths, thereby providing a reliable foundation for network security shielding strategies;

[0053] S2. Formulate data shielding strategies: Determine the source of network data from the attack path, and determine the state of malicious data attack based on the K nearest neighbor algorithm, and learn the impact of data on electricity from the data behavior characteristics, and formulate data shielding strategies by analyzing the effectiveness of data attacks. According to the security resources in the power information network, clarify the optional security defense actions, study the impact of signals on the strategy decisions at each stage of the network, and achieve the coordination of the optimal defense decisions of the network;

[0054] S3. Determine the orchestration of security resources: According to the data shielding strategy and the security requirements of the power information business system, the security resources in the power information network are orchestrated, and the orchestration of security resources is set as the orchestration layer. The orchestration layer includes a security requirement analysis module, a security resource orchestration module, and a security policy formulation module. The path with the least overhead is selected through the resource orchestration overhead model to formulate a security service function chain;

[0055] S4. Dispatching security resources: The control layer receives the security service function chain from the orchestration layer. The control layer includes the SDN network controller and the security resource controller. Based on the security service function chain and combined with SDN and cloud platform technologies, different security resources are effectively and flexibly dispatched to achieve optimal combination and efficient utilization of security resources.

[0056] S5. Establish two types of resource pools: physical and virtual: Set up a resource layer, which includes network resources and security resources. The physical resource pool is composed of proprietary hardware devices, and various security tools are deployed in the form of virtual machines on virtual devices on general servers through virtualization technology to form a virtual resource pool;

[0057] S6. Implement network security mechanism: Set up a state estimation module in combination with the data analysis of the hierarchical structure of the power information network and security resources, and use the state estimation module to achieve automatic blocking of abnormal behavior through network status, attack path analysis, blocking strategy decision-making and blocking strategy execution.

[0058] Step S1 specifically includes the following steps:

[0059] S101, generating a directed graph at each level to represent the dependency relationship between objects in the layer, and the directed graph covers the entire power information network to be analyzed;

[0060] S102, each level of the directed graph describes the state of the entire power information network from different perspectives;

[0061] S103, the directed graphs between the upper and lower layers are connected according to the dependency relationship to achieve cross-level dependency coordination analysis;

[0062] S104, the directed graph of the next level is integrated into a higher level through cross-layer analysis to support higher-level network security status analysis;

[0063] Step S2 specifically includes the following steps:

[0064] S201, calculating the cluster center o of all historical measurement sample feature data sets in the dynamic security domain;

[0065] S202, taking the obtained cluster center o as the symmetry center, obtaining the coordinates of the symmetry point z";

[0066] S203, taking the symmetric point z" as the category attribute, obtaining the measurement samples corresponding to the K feature sample points closest to the symmetric point z" by using the K nearest neighbor algorithm;

[0067] The K nearest neighbor algorithm is as follows:

[0068]

[0069] In the formula, (x o_1 ,x o_2 ,…,x o_r ) is the coordinate of the cluster center o, (x' o ' _1 ,x' o ' _2 ,…,x' o ' _r ) are the coordinates of the symmetric point z”, r is the dimension;

[0070] Step S3 specifically includes the following steps:

[0071] S301, the security demand analysis module is responsible for parsing the security demand of the power information business into the demand for security defense capabilities;

[0072] S302, the security resource orchestration module is responsible for combining and arranging the security defense capabilities in the resource pool and formulating a security service function chain. The security service function chain defines a set of orderly security service functions and meets the security service requirements with the help of the resource pool;

[0073] S303, the security policy formulation module formulates the security policy that the security device needs to execute according to the security service function chain. The security policy is a specific parameter configuration for the security device to control the defense action of the security device;

[0074] The resource orchestration overhead model is as follows:

[0075]

[0076] In the formula, Represents a security service function node Deployed physical nodes, express The unit computing cost of the deployed physical nodes, Indicates the physical link of the virtual link in the object mapping. represents the cost per unit link resource, SSFC represents the security service function chain;

[0077] Step S4 specifically includes the following steps:

[0078] S401, the security resource controller receives the security service function chain and security policy issued by the orchestration layer, extracts the required security resource combination from it, instantiates the required security resources in the resource pool, and then calls the interface of the security resource to configure the security policy for each instantiated security resource;

[0079] S402, the SDN network controller generates classification rules and forwarding rules based on the flow table according to the security service function chain, and sends the network traffic classification forwarding table to the network device, scheduling the network traffic to flow through the security service function chain in sequence;

[0080] Step S5 specifically includes the following steps:

[0081] S501. The security resource provides security service capabilities to the upper layer through the interface, performs corresponding processing on the network traffic flowing through it according to the security policy issued by the control layer, and implements the execution of the security defense strategy;

[0082] S502, network resources include network traffic classifiers and forwarders;

[0083] Step S5 specifically also includes the following steps:

[0084] S503, the classifier classifies the network traffic based on the flow table of the control layer so that it can flow into the respective security service function chains according to the instructions of the network controller;

[0085] S504, the forwarder forwards the network traffic to each security resource instance node of the security service function chain to implement the scheduling of the network traffic;

[0086] In step S6, for the measurement data uploaded in real time, the state estimation module can identify the bad measurement data introduced by random errors according to the bad data detection mechanism carried by it, thereby playing the role of eliminating bad data and even resisting the bad data maliciously tampered by attackers.

[0087] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0088] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network data analysis and shielding method for electric power general contracting technology, characterized in that: The method comprises the following steps: S1. Obtaining network status: The network is layered according to the type of power information network data, and the dependency analysis within each layer and the tracking of the relationship between different layers are realized. Based on the network layering model, the dependency relationship at the operating system level and the dependency relationship at the network level are constructed to identify suspicious attack paths, thereby providing a reliable foundation for network security shielding strategies; The step S1 specifically includes the following steps: S101, generating a directed graph at each level to represent the dependency relationship between objects in the layer, and the directed graph covers the entire power information network to be analyzed; S102, each level of the directed graph describes the state of the entire power information network from different perspectives; S103, the directed graphs between the upper and lower layers are connected according to the dependency relationship to achieve cross-level dependency coordination analysis; S104, the directed graph of the next level is integrated into a higher level through cross-layer analysis to support higher-level network security status analysis; S2. Formulate data shielding strategies: Determine the source of network data from the attack path, and determine the state of malicious data attack based on the K nearest neighbor algorithm, and learn the impact of data on electricity from the data behavior characteristics, and formulate data shielding strategies by analyzing the effectiveness of data attacks. According to the security resources in the power information network, clarify the optional security defense actions, study the impact of signals on the strategy decisions at each stage of the network, and achieve the coordination of the optimal defense decisions of the network; S3. Determine the orchestration of security resources: According to the data shielding strategy and the security requirements of the power information business system, the security resources in the power information network are orchestrated, and the orchestration of security resources is set as the orchestration layer. The orchestration layer includes a security requirement analysis module, a security resource orchestration module, and a security policy formulation module. The path with the least overhead is selected through the resource orchestration overhead model to formulate a security service function chain; S4. Dispatching security resources: The control layer receives the security service function chain from the orchestration layer. The control layer includes the SDN network controller and the security resource controller. Based on the security service function chain and combined with SDN and cloud platform technologies, different security resources are effectively and flexibly dispatched to achieve optimal combination and efficient utilization of security resources. S5. Establish two types of resource pools: physical and virtual: Set up a resource layer, which includes network resources and security resources. The physical resource pool is composed of proprietary hardware devices, and various security tools are deployed in the form of virtual machines on virtual devices on general servers through virtualization technology to form a virtual resource pool; S6. Implement network security mechanism: Set up a state estimation module in combination with the data analysis of the hierarchical structure of the power information network and security resources, and use the state estimation module to achieve automatic blocking of abnormal behavior through network status, attack path analysis, blocking strategy decision-making and blocking strategy execution.

2. A network data analysis and shielding method for electric power general contracting technology according to claim 1, characterized in that: The step S2 specifically includes the following steps: S201. Calculate the cluster center of all historical measurement sample feature data sets in the dynamic security domain ; S202, using the obtained cluster center As the symmetry center, find the symmetry point The coordinates of S203, symmetrical point As a category attribute, the symmetric point is obtained through the K nearest neighbor algorithm The measurement samples corresponding to the K nearest feature sample points.

3. A network data analysis and shielding method for electric power general contracting technology according to claim 1, characterized in that: The step S3 specifically comprises the following steps: S301, the security demand analysis module is responsible for parsing the security demand of the power information business into the demand for security defense capabilities; S302, the security resource orchestration module is responsible for combining and arranging the security defense capabilities in the resource pool and formulating a security service function chain. The security service function chain defines a set of orderly security service functions and meets the security service requirements with the help of the resource pool; S303. The security policy formulation module formulates the security policy that the security device needs to execute according to the security service function chain. The security policy is a specific parameter configuration for the security device to control the defense action of the security device.

4. The network data analysis and shielding method for electric power general contracting technology according to claim 1 is characterized in that: The step S4 specifically comprises the following steps: S401, the security resource controller receives the security service function chain and security policy issued by the orchestration layer, extracts the required security resource combination from it, instantiates the required security resources in the resource pool, and then calls the interface of the security resource to configure the security policy for each instantiated security resource; S402, the SDN network controller generates classification rules and forwarding rules based on the flow table according to the security service function chain, and sends the network traffic classification forwarding table to the network device, scheduling the network traffic to flow through the security service function chain in sequence.

5. The network data analysis and shielding method for electric power general contracting technology according to claim 1 is characterized in that: The step S5 specifically comprises the following steps: S501. The security resource provides security service capabilities to the upper layer through the interface, performs corresponding processing on the network traffic flowing through according to the security policy issued by the control layer, and implements the execution of the security defense strategy; S502. Network resources include network traffic classifiers and forwarders.

6. A network data analysis and shielding method for electric power general contracting technology according to claim 5, characterized in that: The step S5 specifically further comprises the following steps: S503, the classifier classifies the network traffic based on the flow table of the control layer, so that it flows into the respective security service function chains according to the instructions of the network controller; S504, the forwarder forwards the network traffic to each security resource instance node of the security service function chain to realize the scheduling of network traffic.

7. The network data analysis and shielding method for electric power general contracting technology according to claim 1 is characterized in that: In step S6, for the measurement data uploaded in real time, the state estimation module identifies bad measurement data introduced by random errors according to the bad data detection mechanism carried by it, thereby playing a role in eliminating bad data and even resisting bad data maliciously tampered by attackers.

Images