A method and system for modeling dangers of power data external services

Abstract

The present invention relates to the field of network information security technology, and discloses a method and system for modeling the danger of power data external services, including: obtaining power data, and classifying data according to power data business characteristic attributes; defining typical scenarios for power data external services, and classifying data classified at the business characteristic layer at the typical scenario layer; monitoring the power data classified at the typical scenario layer, constructing a threat identification matrix, and determining threat factors; based on the threat factors recorded in the constructed threat identification matrix, using the Monte Carlo algorithm to simulate the probability distribution of threat events and determine the frequency of threat events; based on the frequency of threat events combined with the weights of threat events and business scenarios, constructing a threat assessment matrix model, obtaining the risk value of the threat to the entire business, completing the threat level sorting, and realizing the risk factor assessment of power data external services. The present invention improves the extensiveness and accuracy of power system threat assessment.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and in particular to a method and system for modeling dangers of external services of electric power data. Background Art

[0002] At present, power companies need to meet the needs of customers, partners and regulators through external data services. However, external data services also bring a series of security risks and privacy leakage risks. The typical scenarios of external data services for power business are different, and these typical scenarios involve data types with multiple business characteristics. In the process of external data services, data may be subject to various security threats, which may affect the economy, efficiency and stability of power business.

[0003] With the continuous improvement of the information level of power enterprises, data external services have become an important means for power enterprises to provide data resources to the outside world, and can provide data services in energy production, power supply management and other aspects to other enterprises, institutions and individuals. However, with the continuous expansion and deepening of data external services, power companies are facing more and more information security threats. These information security threats not only cause direct losses to the data assets of power companies, but may also have a significant impact on power business, and thus affect the stability and security of the entire society. In order to cope with the increasingly complex power network security threats and protect the interests of the power system, the use of a single security protection technology can no longer meet the security requirements of the power system with diverse data types, multiple application scenarios and large-scale network environments; therefore, it is necessary to conduct in-depth research and exploration on the information security issues of power data external services. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a method and system for modeling the dangers of external services of electric power data to solve the problems of high security risks and privacy leakage risks of existing electric power safety protection technologies.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for modeling a risk of external power data services, comprising:

[0008] Obtain power data and classify the data according to the power data service characteristic attributes;

[0009] Based on the power data classified by business characteristic attributes, define the typical scenarios of power data external services, and classify the data classified at the business characteristic layer into the typical scenario layer;

[0010] Monitor the power data classified by typical scenario layers, build a threat identification matrix, and identify threat factors;

[0011] Based on the threat factors recorded in the constructed threat identification matrix, the Monte Carlo algorithm is used to simulate the probability distribution of threat events to determine the frequency of threat events;

[0012] Based on the frequency of threat events combined with the weights of threat events and business scenarios, a threat assessment matrix model is constructed to obtain the risk value of the threat to the entire business, complete the threat level ranking, and realize the risk factor assessment of power data external services.

[0013] As a preferred solution of the method for modeling the danger of external service of power data described in the present invention, wherein:

[0014] The data classification according to the power data service characteristic attributes includes the following steps:

[0015] Obtain power data, and clean, remove duplicates, and standardize the acquired power data;

[0016] The characteristic attributes of different power data are labeled with a label set p={t 1 ,t 2 ,t 3 ,...,t i ,...,t n}, where t i represents the i-th characteristic attribute, and n represents the number of non-overlapping characteristic attributes;

[0017] The power business data is divided into power production data, power transmission data, power distribution data, power sales data and power quality data, which are marked with serial numbers 1, 2, 3, 4 and 5 respectively and saved in the data business type set: m j ={m 1 ,m 2 ,m 3 ,m 4 ,m 5}, and indicate the included characteristic attributes in advance according to the characteristics of the category;

[0018] For each feature attribute t i , traverse the data service type set and check whether m exists j , so that , if there exists an m that meets the requirements j , it proves that the power data with attribute i belongs to business feature j.

[0019] As a preferred solution of the method for modeling the danger of external service of power data described in the present invention, wherein:

[0020] Define typical scenarios for external services of power data and classify the data classified at the business feature layer into typical scenario layers, including the following steps:

[0021] Obtain the user's demand for querying power data based on specific conditions and define the power data query service scenario;

[0022] Obtain the demand for transmitting specific power data to the outside world and define the power data transmission service scenario;

[0023] Obtain the demand for statistical analysis of power data and define the power data analysis service scenario;

[0024] Define non-overlapping feature attributes for three typical scenes and save them in the typical scene feature set k j ={k 1 ,k 2 ,k 3};

[0025] Analyze the flow, usage, subjects and object factors of power data classified at the business feature layer;

[0026] According to the service attributes and business requirements of the data, the scene attributes of the power data are labeled with a label set q = {q 1 ,q 2 ,q 3 ,...,q i ,...,q n};

[0027] Traverse the scene attribute label set q of the power data and the feature set k of the typical scene, and check whether q exists i , so that ;

[0028] Record q i ∩k j The maximum value of the number is marked as w, and the power data corresponding to w is defined as the jth typical scenario.

[0029] As a preferred solution of the method for modeling the danger of external service of power data described in the present invention, wherein:

[0030] The monitoring of the power data classified by the typical scenario layer, building a threat identification matrix, and determining threat factors include the following steps:

[0031] Deploy an intrusion detection system based on the network architecture and security requirements of the power system, and use FPGA-specific hardware to capture the original data packets of network traffic;

[0032] Define the threshold based on the reconstruction error of the VAE model and the distance in the latent space, and set the threshold ;

[0033] When the network flow data of the power system is detected by the VAE model, if the comprehensive anomaly score CAS of the network flow data of the VAE model exceeds the predefined threshold TH, it is considered abnormal;

[0034] If the RNN encoder captures a pattern that does not conform to the normal network traffic time series relationship, it is considered an anomaly;

[0035] When the SIEM system detects anomalies, it generates alerts and data reports;

[0036] Through data reporting, the economic and efficiency loss data caused by each threat are recorded, and summarized and classified into a threat identification matrix based on different types of information security threats, combined with different typical scenarios and different business characteristics.

[0037] As a preferred solution of the method for modeling the danger of external service of power data described in the present invention, wherein:

[0038] The threat identification matrix R is expressed as:

[0039] (1);

[0040] It includes three dimensions: business characteristics, typical scenarios and security threat types. In the matrix, the first column S 1 , S 2 , S 3 , S 4 , S 5 Identify five types of business features. The first line is P 1 , P 2 , P 3 Identify three typical scenarios; K at the intersection of row P and column S ij is a set of threat types, where i∈[1,5], j∈[1,3]; the threat type set contains q threat types, i.e., K ij ={k 1 ,…,k q}.

[0041] As a preferred solution of the method for modeling the danger of external service of power data described in the present invention, wherein:

[0042] The method of using the Monte Carlo algorithm to simulate the probability distribution of threat events and determine the frequency of threats includes the following steps:

[0043] To K ij For each threat K i , find the mean probability of occurrence and standard deviation , using Monte Carlo simulation to generate a set of probability normal distributions ;

[0044] In each simulation, a random sample is drawn from the chosen normal distribution, representing the threat K i Probability of occurrence. Assuming the probability of threat occurrence is normally distributed, the following formula is used to generate the probability of threat occurrence in Monte Carlo simulation:

[0045] ;

[0046] in, is the probability of the threat occurring in the ith simulation, is the mean parameter of the normal distribution, is the standard deviation parameter of the normal distribution, is a random number drawn from a standard normal distribution;

[0047] Repeat the simulation process of different threats under three scenarios for a sufficient number of times to obtain the distribution of the probability of threat occurrence.

[0048] As a preferred solution of the method for modeling the danger of external service of power data described in the present invention, wherein:

[0049] The threat assessment matrix model is constructed based on the frequency of threat events combined with the weights of threat events and business scenarios to obtain the risk value of the threat to the entire business and complete the threat level sorting, including constructing a threat weight assessment model represented as:

[0050] ;

[0051] Among them, n rows represent n different threat types, three columns represent three different scenario types, and the cell represents the weight of the threat in the scenario. The scenario weight representing the threat, is the frequency of threat occurrence in scenario c, c∈[1,3]; represents the impact score of threat i, i∈[1,n];

[0052] It also includes building a business feature data scenario weight model:

[0053] ;

[0054] in, The scenario weight representing the business feature data, Where a represents a type (a∈[1,5]) of different business feature data. Where b represents b (b∈[1,3]) different typical scenarios, and the weights of five different business feature data in scenario 1, scenario 2, and scenario 3 are calculated in sequence;

[0055] It also includes multiplying the weight of each threat by the scenario weight of each business feature to obtain n threat assessment matrices. The threat assessment matrix model is expressed as:

[0056] ;

[0057] in, Represents the type of threat. The three rows of each threat matrix represent three different scenario weights. The 1st, 2nd, 3rd, 4th, and 5th columns represent different business feature data types. Each cell represents a single threat.

[0058] The threat value of different business characteristic data in different scenarios of the entire power business;

[0059] It also includes adding the weights of each threat in each business feature to obtain the risk value of the threat to the entire business, and ranking the threats from high to low according to the business risk value to the entire business.

[0060] In a second aspect, the present invention provides a power data external service risk modeling system, comprising:

[0061] A data classification module is used to obtain power data and classify the data according to the business characteristic attributes of the power data;

[0062] The scenario classification module is used to define typical scenarios for external services of power data based on power data classified by business feature attributes, and classify the data classified by the business feature layer into typical scenario layers;

[0063] The monitoring module is used to monitor the power data classified at the typical scenario level, build a threat identification matrix, and determine threat factors;

[0064] The simulation module is used to simulate the probability distribution of threat events using the Monte Carlo algorithm based on the threat factors recorded in the constructed threat identification matrix to determine the frequency of threat events;

[0065] The sorting module is used to build a threat assessment matrix model based on the frequency of threat events combined with the weights of threat events and business scenarios, obtain the risk value of threats to the entire business, complete threat level sorting, and realize the risk factor assessment of power data external services.

[0066] In a third aspect, the present invention provides a computing device, comprising:

[0067] Memory, used to store programs;

[0068] A processor is used to execute the computer executable instructions, which, when executed by the processor, implement the steps of the method for modeling the danger of external power data services.

[0069] In a fourth aspect, the present invention provides a computer-readable storage medium, comprising: when the program is executed by a processor, the steps of implementing the method for modeling the risk of external power data services are implemented.

[0070] The beneficial effects of the present invention are as follows: the business characteristics of power data are linked with typical scenarios to form a matrix model with clearer logical relationships. These logical relationships are conducive to improving the accuracy of threat assessment of power data with different business characteristics in typical scenarios, and combining business characteristics with the relationship between typical application scenarios to assess power threats, thereby improving the breadth and accuracy of power system threat assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0072] Figure 1 A basic flow chart of a method for modeling dangers of external services of electric power data provided by an embodiment of the present invention;

[0073] Figure 2 A probability normal distribution diagram of a Monte Carlo method of a method for modeling dangers of external power data services provided by an embodiment of the present invention after 1000 simulations of the probabilities of five threats;

[0074] Figure 3 A comparison chart of the threat assessment accuracy of a method for modeling the external service risk of electric power data provided by an embodiment of the present invention and a common method;

[0075] Figure 4 A comparison chart of the impact assessment accuracy of the power business economy, efficiency and stability of a power data external service risk modeling method provided by an embodiment of the present invention and a common method. DETAILED DESCRIPTION

[0076] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0077] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0078] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0079] Example 1

[0080] Reference Figure 1 , is an embodiment of the present invention, and provides a method for modeling the risk of external services of electric power data, comprising:

[0081] S1: Obtain power data and classify the data according to the power data service attribute;

[0082] Furthermore, power data is collected and acquired, and divided into power production data, power transmission data, power distribution data, power sales data, and power quality data according to different business characteristic attributes of the power data, so as to realize data classification at the business characteristic layer;

[0083] Furthermore, S1 includes the following steps:

[0084] S11: Collect power data from the power system and related data sources, clean, remove duplicates and standardize the collected power data to ensure the accuracy and consistency of the data;

[0085] S12: Label the characteristic attributes of different power data with a label set p={t 1 ,t 2 ,t 3 ,...,t i ,...,t n}, where t i represents the i-th characteristic attribute, and n represents the number of non-overlapping characteristic attributes;

[0086] S13: Divide the power business data into power production data, power transmission data, power distribution data, power sales data, and power quality data, and mark them with serial numbers 1, 2, 3, 4, and 5 respectively and save them in the data business type set: m j ={m 1 ,m 2 ,m 3 ,m 4 ,m 5}, and indicate the included characteristic attributes in advance according to the characteristics of the category;

[0087] S14: For each feature attribute t i , traverse the data service type set K={m 1 ,m 2 ,m 3 ,m 4 ,m 5}, check if m exists j , so that If there exists such an m j , it is proved that the power data with attribute i belongs to business feature j, and records each t i Business characteristics m j , for subsequent data classification.

[0088] S15: Collect and classify electricity business characteristic data.

[0089] S2: Based on the power data classified by business feature attributes, define the typical scenarios of power data external services, and classify the data classified at the business feature layer into typical scenario layers;

[0090] Furthermore, typical scenarios for external services of power data are defined, and data classified at the business feature layer are classified into typical scenarios according to the data flow, usage, subjects and objects involved, etc.;

[0091] Furthermore, S2 includes the following steps:

[0092] S21: define the power data query service scenario, which involves the user's need to query power production, transmission, distribution, sales or quality data according to specific conditions. Specific features may include the selection of query parameters, the display of query results and the way of data interaction, etc.;

[0093] S22: Define the power data transmission service scenario, which involves transmitting specific power data to external users or systems, taking into account the security and stability of data transmission, and may include features such as the selection of data transmission protocols, encryption and verification mechanisms for data transmission, etc.

[0094] S23: Define the power data analysis service scenario, which involves the need for statistical analysis, prediction or modeling of power data, considering the methods and tools of data analysis, and may include features such as the selection of data analysis algorithms, data processing and result presentation methods.

[0095] S24: Define non-overlapping feature attributes for each typical scene and save them in the typical scene feature set k j ={k 1 ,k 2 ,k 3}, analyze the flow direction, usage, subjects and objects involved in the power data classified by the business feature layer, and annotate the scene attributes of the power data with a label set q={q 1 ,q 2 ,q 3 ,...,q i ,...,q n}, traverse the scene attribute label set q of the power data and the feature set k of the typical scene, and check whether q exists i , so that ; Because power data may contain attributes of multiple scenarios, record q i ∩k j The maximum value of the number is marked as w, and the power data corresponding to w is defined as the jth typical scenario.

[0096] S3: Monitor the power data classified by typical scenario layers, build a threat identification matrix, and determine threat factors;

[0097] Furthermore, an intrusion detection system is used to monitor the power data after S2 classification for attacks or abnormal behaviors, build a threat identification matrix, and determine threat factors;

[0098] Furthermore, S3 includes the following steps:

[0099] S31: According to the network architecture and security requirements of the power system, an intrusion detection system (IDS) is deployed, and FPGA dedicated hardware is used to directly capture the original data packets of network traffic to ensure efficient data acquisition; the power system network traffic data collected by the IDS is preprocessed to construct a variational autoencoder (VAE) for data anomaly detection. VAE is suitable for processing complex high-dimensional data, such as power system network traffic; the constructed VAE model includes an encoder and a decoder. The encoder part uses a recurrent neural network (RNN) to capture the temporal relationship between traffic data, and the decoder is used to map the potential representation back to the original data. Using self-supervised learning, the VAE model is trained to learn the normal data distribution of power system network traffic and capture abnormal behaviors of potential threats;

[0100] S32: Define the threshold based on the reconstruction error (RE) and latent space distance (LSD) of the VAE model. Use normal power system network traffic data to train the VAE model. For each input data point, use the model for encoding and decoding. The reconstruction error is to calculate the difference between the original data and the reconstructed data. The mean square error (MSE) is used for distance measurement. The latent space is to calculate the distance between the potential representations. The Euclidean distance and cosine similarity are used for distance measurement. The reconstruction error and latent space distance distribution of the training data set, select a set of samples containing only normal data from the training data set, and for the selected normal data samples, calculate the comprehensive anomaly score as ,in and is an adjustable proportional weight used to balance the impact of reconstruction error and latent space distance in the calculation of the comprehensive anomaly score, and collects the average of the comprehensive anomaly scores of all normal data samples after calculation , and continuously iterate the experiment to optimize the mean;

[0101] S33: In order to make the comprehensive anomaly score of most normal samples lower than the threshold, set the threshold When the network flow data of the power system is detected by the VAE model, the corresponding operations are performed according to the following judgment rules and solutions:

[0102] (1) Anomaly score judgment: If the comprehensive anomaly score CAS of the network traffic data of the VAE model exceeds the predefined threshold TH, it is considered anomaly;

[0103] (2) Time series relationship judgment: If the RNN encoder captures a pattern that does not conform to the normal network traffic time series relationship, it is considered an anomaly;

[0104] Once the IDS detects suspicious data that exceeds the threshold, the actions involved need to be recorded and classified for subsequent analysis and response. The following is how to record suspicious actions and their types:

[0105] When an IDS detects suspicious activity, it should generate detailed event logs, including the following information:

[0106] Timestamp: The time when the event occurred.

[0107] Description of the detected action: Describes the specific details of the incident, including characteristics of the attack pattern or abnormal behavior.

[0108] Possible impact: The possible impact on the system if the suspicious action is successful.

[0109] Source and destination IP addresses: Information about the network nodes involved in the event.

[0110] Source and destination ports: Network port information involved in the event.

[0111] Device: The affected device involved in the incident.

[0112] The actions are classified based on the business characteristics of the power data involved and the typical scenarios of external services, and alarms are generated and notified to relevant personnel. The alarms contain event logs and classification information.

[0113] S34: Configure logging and auditing. Enable detailed logging capabilities for network devices, servers, and applications in the power system, and configure appropriate logging levels and log retention policies.

[0114] S35: Implement a security information and event management system (SIEM) to centrally collect and store log data generated by network devices, including network traffic data, device logs, system logs, and application logs, to ensure the integrity and reliability of log data; SIEM will monitor the collected log data in real time and use analytical technology to identify potential threat activities. It can detect abnormal behaviors and threat signs by comparing known attack patterns, using behavioral analysis and threat intelligence, etc.; when the security information and event management system detects abnormal activities or potential threats, it will generate an alert and notify relevant personnel. The alert can provide key information, such as event type, time, affected systems, etc., and generate detailed data reports for security analysis and auditing;

[0115] S36: Through data reporting, record the economic and efficiency loss data caused by each threat, and summarize and classify them into a threat identification matrix R according to different types of information security threats, combined with their appearance in different typical scenarios and different business characteristics:

[0116] (1);

[0117] It includes three dimensions: business characteristics, typical scenarios and security threat types. In the matrix, the first column S1, S2, S3, S4, S5 indicates five types of business characteristics, and the first row P1, P2, P3 indicates three typical scenarios. The intersection of row P and column S is K. ab is a set of threat types, where a∈[1,5], b∈[1,3]; the set may contain q threat types, i.e., K ab ={k 1 ,…,k q}; Each cell of the three-dimensional matrix represents a specific combination of information security threats, typical scenarios, and business characteristics.

[0118] S4: Based on the threat factors recorded in the constructed threat identification matrix, the probability distribution of threat events is simulated using the Monte Carlo algorithm to determine the frequency of threat events;

[0119] Furthermore, S4 includes the following steps:

[0120] S41: K in S3 ab For each threat K i , find the mean probability of occurrence and standard deviation , using Monte Carlo simulation to generate a set of probability normal distributions .

[0121] (2);

[0122] Where s is the number of simulations, Threat K in the data i probability.

[0123] S42: In each simulation, a random sample is drawn from the selected normal distribution, representing the threat K i Probability of occurrence. Assuming the probability of threat occurrence is normally distributed, the following formula is used to generate the probability of threat occurrence in Monte Carlo simulation:

[0124] (3);

[0125] in, is the probability of the threat occurring in the tth simulation, is the mean parameter of the normal distribution, is the standard deviation parameter of the normal distribution, are random numbers drawn from a standard normal distribution.

[0126] S43: Repeat the simulation process of different threats in the three scenarios for a sufficient number of times to obtain the distribution of the probability of threat occurrence.

[0127] S5: Based on the frequency of threat events and the weights of threat events and business scenarios, a threat assessment matrix model is constructed to obtain the risk value of the threat to the entire business, complete the threat level ranking, and realize the risk factor assessment of power data external services.

[0128] Furthermore, based on the threat frequency, comprehensive loss, weight and business feature scenario weight, a threat weight assessment model and a threat assessment matrix model are constructed to simulate the probability distribution of economic and efficiency losses, obtain the threat risk value Q for the entire business, and complete the threat level ranking;

[0129] Furthermore, S5 includes the following steps:

[0130] S51: For each threat K i , according to the frequency of occurrence in the three scenarios and the degree of impact on the business, weights are assigned based on expert opinions;

[0131] S52: Based on the past records of each threat K in the data report i The economic loss and efficiency loss of the system are simulated using the Monte Carlo method to generate the normal distribution of economic loss and efficiency loss. and , and for each threat K i Calculate its comprehensive loss and assign it an impact score based on the comprehensive loss.

[0132] (4);

[0133] in, is the comprehensive loss impact score of threat i, and are the weights of economic losses and efficiency losses given according to expert opinions.

[0134] S53: Construct threat weight assessment model:

[0135] (5);

[0136] Among them, n rows represent n different threat types, three columns represent three different scenario types, and the cell represents the weight of the threat in the scenario. The scenario weight representing the threat, is the frequency of threat occurrence in scenario c, c∈[1,3]; represents the impact score of threat i (each i represents a threat type, i.e., acts in one row), i∈[1,n];

[0137] S54: The frequency of occurrence of each business feature in each scenario and its importance to the business are also different. For each business feature, a weight is calculated according to its frequency of occurrence in each scenario and its importance to the business:

[0138] S55: Based on the repeated simulations of the Monte Carlo method in three scenarios, the frequency of occurrence of each business characteristic data in three typical scenarios T1, T2, T3 is obtained according to the probability distribution;

[0139] S56: The importance of each business feature data to the entire power business is different. Based on expert opinions, historical data, industry standards and other factors, importance scores U1, U2, U3, U4, and U5 are obtained;

[0140] S57: For each business feature, a weight is calculated based on its frequency of occurrence in each scenario and its importance score to the business:

[0141] (6);

[0142] in, The scenario weight representing the business feature data, Score the importance of the a-th business data. is the frequency of occurrence of the business data in the bth typical scenario;

[0143] S58: According to (S57), construct a business feature data scenario weight model:

[0144] (7);

[0145] in, Scenario weight representing business feature data; Where a represents a type (a∈[1,5]) of different business feature data. Where b represents b different typical scenarios (b∈[1,3]), and the calculations are as follows:

[0146] The weights of five different business feature data in scenario 1, scenario 2, and scenario 3 can be obtained respectively;

[0147] S59: multiply the weight of each threat by the scenario weight of each business feature to obtain n threat assessment matrices, each matrix representing the threat assessment of a single threat;

[0148] S510: Construct threat assessment matrix model:

[0149] (8);

[0150] in, where i represents the type of the i-th threat, i∈[1,n]. The three rows of each threat matrix represent the weights of three different scenarios, and the first, second, third, fourth, and fifth columns represent different business feature data types. Represents the threat value of threat i to different business characteristic data in different scenarios of the entire power business;

[0151] S511: Add up the weights of each threat in each business feature to obtain the risk value of threat i to the entire business :

[0152] (9);

[0153] S512: Threats are ranked from high to low based on the business risk value for the entire business, and threat scores are given based on expert opinions so that security protection measures for high-risk threats are prioritized.

[0154] Furthermore, an assessment of the risk factors of external power data services is conducted to determine their impact on the economy, efficiency and stability of power business.

[0155] Furthermore, monitoring data of external services of power business data is collected, including service volume, visit volume, transaction volume, number of failures, and service response time;

[0156] Furthermore, we select the factors that affect the economy, efficiency and stability of the power business from the collected data, formulate service efficiency indicators, economic cost indicators and stability indicators, and use the formulated indicators to evaluate the economy, efficiency and stability of the data's external services;

[0157] Furthermore, the economic evaluation includes the amount of economic loss that may be caused by the threat incident, the additional costs, and the cost of security control measures. The calculation formula is as follows:

[0158] (10);

[0159] in, is the total economic impact of the threat on the entire power business, n is the number of threats, is the threat value of threat i to the entire business, For the past direct economic losses caused by the threat, It is an indicator factor, which is used to adjust the impact of economic related indicators. The cost of power business data threatened by i, It is an indicator directly related to the economic loss of the power business threatened by i, representing various indicator data related to the economic loss. is the cost factor, used to adjust the impact of costs, is the cost of implementing security measures against threat i, is the cost of restoring business after a threat occurs. It is the customer compensation after the threat occurs. is the potential income loss factor, is the potential income before the threat occurs;

[0160] Furthermore, the efficiency evaluation includes the impact of security control measures on business processes and the possible service interruption time, calculated as follows:

[0161] (11);

[0162] in, The total efficiency impact of the threat on the entire power business, represents the impact of threat i on service interruption time; represents the impact of threat i on the response time delay; The weight of the risk factor for each threat is given by experts based on the actual situation; represents the efficiency cost factor, which is used to measure the economic cost of efficiency; represents the impact of threat i on resource utilization;

[0163] Furthermore, the stability assessment includes the impact of possible system crashes, data corruption, and the impact of security control measures on system availability and stability. The calculation formula is as follows:

[0164] (12);

[0165] in, is the total stability impact of the threat on the entire power business, represents the impact of threat i on system availability; represents the impact of threat i on resilience and recovery capabilities; represents the impact of threat i on risk management capabilities; The weight of the risk factor for each threat is given by experts based on the actual situation; represents the cost factor, which is used to measure the economic cost of stability;

[0166] Furthermore, based on the evaluation results, a quantitative evaluation is conducted to measure the impact of different threats on the service through indicators.

[0167] This embodiment also provides a power data external service risk modeling system, including:

[0168] The data classification module obtains power data and classifies the data according to the business characteristic attributes of the power data;

[0169] The scenario classification module defines typical scenarios for external services of power data and classifies the data classified at the business feature layer into typical scenario layers;

[0170] The monitoring module monitors the power data classified at the typical scenario level, builds a threat identification matrix, and determines threat factors;

[0171] The simulation module uses the Monte Carlo algorithm to simulate the probability distribution of threat events and determine the frequency of threats;

[0172] The sorting module builds a threat assessment matrix model based on the frequency of threat events combined with the weights of threat events and business scenarios, obtains the risk value of threats to the entire business, completes threat level sorting, and realizes the risk factor assessment of power data external services.

[0173] Furthermore, it also includes:

[0174] Memory, used to store programs;

[0175] A processor is used to load the program to execute the power data external service risk modeling method.

[0176] This embodiment also provides a computer-readable storage medium storing a program, which, when executed by a processor, implements the method for modeling the risk of external power data services.

[0177] The storage medium proposed in this embodiment and the power data external service risk modeling method proposed in the above embodiment belong to the same inventive concept. The technical details not described in detail in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0178] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of the present invention.

[0179] Example 2

[0180] Refer to Table 1-Table 8 and Figure 2-Figure 4 , which is an embodiment of the present invention, provides a method for modeling the danger of external services of power data. In order to verify its beneficial effects, scientific demonstration is carried out through specific implementation methods and implementation effects.

[0181] The present embodiment is as follows:

[0182] The test target is a power grid company. The total power data of a certain year is collected. After detection by the intrusion detection system, the risk threats involve five categories: unauthorized access to data, APT attack data, data leakage data, data tampering, and denial of service data. Monte Carlo simulation is performed on the above threats to obtain the mean μ and standard deviation σ of the probability. Repeated simulations are performed based on Monte Carlo, such as Figure 2 As shown, the threat assessment model is constructed and the impact assessment is performed through the above method. The experimental table is as follows:

[0183] Table 1 Scenario weight score table for threat assessment

[0184]

[0185] Table 2 Scenario weight score table of business feature data

[0186]

[0187] Table 3 Threat score, risk value and risk value ranking of unauthorized threats to the entire business

[0188]

[0189] Table 4 Threat score, risk value and risk value ranking of APT attacks on the entire business

[0190]

[0191] Table 5 Threat score, risk value and risk value ranking of data leakage to the entire business

[0192]

[0193] Table 6 Threat score, risk value and risk value ranking of data tampering to the entire business

[0194]

[0195] Table 7 Denial of service threat score, risk value and risk value ranking table for the entire business

[0196]

[0197] Table 8 Evaluation of the impact of various threats on economy, efficiency and stability

[0198]

[0199] According to Tables 1 to 8, different threats have different degrees of harm to the overall system. In this system, the harm of data tampering is far greater than other threats, and the harm of data tampering in the query scenario is extremely high. The result is very reasonable because in the query scenario, if the data is tampered, the query results may mislead business decision makers and make decisions based on wrong information. The queried data may contain sensitive information, and users may doubt the accuracy of the query results, thereby affecting the normal operation of the business. If the data integrated with other systems is tampered in the query scenario, it may cause the entire business process to be interrupted or errors to occur. In this system, the harm of denial of service is very small, and the harm of denial of service in the query scenario is the smallest, because the query scenario is usually an operation to read the database or other data storage system, rather than a write or modify operation. Denial of service attacks usually achieve their purpose by occupying resources or making the system unable to respond. In the query scenario, the read operation is relatively light, and the failure of one query does not affect the execution of other queries. Therefore, even if a query is attacked by a denial of service, other queries may still be executed normally. This method takes into full account the reality and considers multiple factors at the same time. The evaluation results obtained have a strong basis support point, which helps the power grid company to conduct a comprehensive analysis of the degree of harm of each threat in different scenarios in a system with a lot of data and complex threats. In this way, the power grid company can more accurately assess potential risks and threats, which helps the company to formulate more targeted risk management strategies and decisions, give priority to the threats that have the greatest impact on system security and stability, and on the basis of understanding the degree of harm of each threat, the power grid company can allocate resources more effectively and focus on strengthening the defense and monitoring of high-risk threats. It helps to optimize security investment, ensure that resources are used to the maximum extent, and improve overall security. A comprehensive understanding of the degree of threat harm helps the power grid company to formulate more effective emergency response plans. The company can formulate corresponding response measures according to the urgency and impact of different threats, and respond more quickly and more targetedly when security incidents occur. Communicating the assessment results of the degree of threat harm to relevant teams and personnel helps to improve the entire organization's awareness of the importance of information security. Through comprehensive threat analysis, employees can better understand the complexity of potential threats, enhance security awareness, and take positive actions to protect systems and data.

[0200] This method integrates multiple dimensions, considers practical application factors, and closely combines specific data types and scenarios. Figure 3 This is a comparison chart of the threat assessment accuracy of this method and the common method. According to the graphical results, because the model of this method is more in line with the actual situation, it has a higher accuracy in threat assessment accuracy.

[0201] Figure 4This is a comparison chart of the accuracy of the impact assessment on the economy, efficiency and stability of the power business of this method and the common method. After conducting threat assessment, this method can quantify the potential impact of these threats on the entire system based on key values, evaluate key factors, and provide specific data support for feasibility decisions on the economy, efficiency and stability of the system.

[0202] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for modeling the risk of external services of power data, characterized in that: include: Obtain power data and classify the data according to the power data service characteristic attributes; Based on the power data classified by business characteristic attributes, define the typical scenarios of power data external services, and classify the data classified at the business characteristic layer into the typical scenario layer; Monitor the power data classified by typical scenario layers, build a threat identification matrix, and identify threat factors; Based on the threat factors recorded in the constructed threat identification matrix, the Monte Carlo algorithm is used to simulate the probability distribution of threat events to determine the frequency of threat events; Based on the frequency of threat events combined with the weights of threat events and business scenarios, a threat assessment matrix model is constructed to obtain the risk value of the threat to the entire business, complete the threat level ranking, and realize the risk factor assessment of power data external services; The monitoring of the power data classified by the typical scenario layer, building a threat identification matrix, and determining threat factors include the following steps: Deploy an intrusion detection system based on the network architecture and security requirements of the power system, and use FPGA-specific hardware to capture the original data packets of network traffic; The threshold is defined based on the reconstruction error of the VAE model and the distance in the latent space, and the threshold TH is set to 0.95AvgCAS; When the network flow data of the power system is detected by the VAE model, if the comprehensive anomaly score CAS of the network flow data of the VAE model exceeds the predefined threshold TH, it is considered abnormal; If the RNN encoder captures a pattern that does not conform to the normal network traffic time series relationship, it is considered an anomaly; When the SIEM system detects anomalies, it generates alerts and data reports; Through data reports, record the economic and efficiency loss data caused by each threat, and summarize and classify them into a threat identification matrix based on different types of information security threats, combined with different typical scenarios and different business characteristics; The threat identification matrix R is expressed as: It includes three dimensions: business characteristics, typical scenarios and security threat types. In the matrix, the first column S1, S2, S3, S4, S5 indicates five types of business characteristics, and the first row P1, P2, P3 indicates three typical scenarios. The intersection of row P and column S is K. ij is a set of threat types, where i∈[1,5], j∈[1,3]; the threat type set contains q threat types, i.e., K ij ={k1,…,k q }; The threat assessment matrix model is constructed based on the frequency of threat events combined with the weights of threat events and business scenarios to obtain the risk value of the threat to the entire business and complete the threat level sorting, including constructing a threat weight assessment model represented as: Among them, n rows represent n different threat types, three columns represent three different scenario types, and the cell represents the weight of the threat in the scenario. p Represents the scenario weight of the threat, k c is the frequency of threat occurrence in scenario c, c∈[1,3]; I i represents the impact score of threat i, i∈[1,n]; It also includes building a business feature data scenario weight model: Among them, N p Represents the scenario weight of business feature data, U a where a represents a different kind of service feature data, a∈[1,5]; T b Where b represents b different typical scenarios, b∈[1,3], and the weights of five different business feature data in scenario 1, scenario 2, and scenario 3 are calculated in sequence; It also includes multiplying the weight of each threat by the scenario weight of each business feature to obtain n threat assessment matrices. The threat assessment matrix model is expressed as: Among them, the three rows of each threat matrix represent the weights of three different scenarios, the 1st, 2nd, 3rd, 4th, and 5th columns represent different types of business feature data, and each cell represents the threat value of a single threat to different business feature data in different scenarios of the entire power business; It also includes adding the weights of each threat in each business feature to obtain the risk value of the threat to the entire business, and ranking the threats from high to low according to the business risk value to the entire business.

2. The method for modeling the risk of external power data services according to claim 1, characterized in that: The data classification according to the power data service characteristic attributes includes the following steps: Obtain power data, and clean, remove duplicates, and standardize the acquired power data; The characteristic attributes of different power data are labeled with a label set p = {t1, t2, t3, ..., t i ,...,t n }, where t i represents the i-th characteristic attribute, and n represents the number of non-overlapping characteristic attributes; The power business data is divided into power production data, power transmission data, power distribution data, power sales data and power quality data, which are marked with serial numbers 1, 2, 3, 4 and 5 respectively and saved in the data business type set: m j ={m1,m2,m3,m4,m5}, and indicate the included characteristic attributes in advance according to the characteristics of the category; For each feature attribute t i , traverse the data service type set and check whether m exists j , so that If there is an m that meets the requirements j , it proves that the power data with attribute i belongs to business feature j.

3. The method for modeling the risk of external power data services according to claim 1 or 2, characterized in that: Defining typical scenarios for external services of power data and classifying the data classified at the business feature layer at the typical scenario layer includes the following steps: Obtain the user's needs for querying power data based on time range, geographic location and equipment number, and define the power data query service scenario; Obtain the need to transmit real-time readings, historical loads, and fault records to external parties, and define power data transmission service scenarios; Obtain the demand for statistical analysis of power data and define the power data analysis service scenario; Define non-overlapping feature attributes for three typical scenes and save them in the typical scene feature set k j ={k1,k2,k3}; Analyze the flow, usage, subjects and object factors of power data classified at the business feature layer; According to the service attributes and business requirements of the data, the scene attributes of the power data are labeled with a label set q = {q1, q2, q3, ..., q i ,...,q n }; Traverse the scene attribute label set q of the power data and the feature set k of the typical scene, and check whether q exists i , so that Record q i ∩k j The maximum value of the number is marked as w, and the power data corresponding to w is defined as the jth typical scenario.

4. The method for modeling the risk of external power data services according to claim 3, characterized in that: The method of using the Monte Carlo algorithm to simulate the probability distribution of threat events and determine the frequency of threats includes the following steps: K ij For each threat K i , find the mean μ and standard deviation σ of the probability occurrence, and use Monte Carlo simulation to generate a set of probability normal distribution P i ; In each simulation, a random sample is drawn from the chosen normal distribution, representing the threat K i Probability of occurrence. Assuming the probability of threat occurrence is normally distributed, the following formula is used to generate the probability of threat occurrence in Monte Carlo simulation: X i =μ+σ·Z i Among them, X i is the probability of the threat occurring in the ith simulation, μ is the mean parameter of the normal distribution, σ is the standard deviation parameter of the normal distribution, and Z i is a random number drawn from a standard normal distribution; Repeat the simulation process of different threats in three scenarios until the distribution of threat occurrence probability is obtained.

5. A modeling system based on the power data external service risk modeling method according to claim 1, characterized in that: A data classification module is used to obtain power data and classify the data according to the business characteristic attributes of the power data; The scenario classification module is used to define typical scenarios for external services of power data based on power data classified by business feature attributes, and classify the data classified by the business feature layer into typical scenario layers; The monitoring module is used to monitor the power data classified by the typical scenario layer, build a threat identification matrix, and determine the threat factors; The simulation module is used to simulate the probability distribution of threat events using the Monte Carlo algorithm based on the threat factors recorded in the constructed threat identification matrix to determine the frequency of threat events; The sorting module is used to build a threat assessment matrix model based on the frequency of threat events combined with the weights of threat events and business scenarios, obtain the risk value of threats to the entire business, complete threat level sorting, and realize the risk factor assessment of power data external services.

6. An electronic device, characterized in that: include: Memory, used to store programs; A processor is used to load the program to execute the steps of the method for modeling the risk of external services of electric power data as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a program, characterized in that: When the program is executed by a processor, the steps of the method for modeling the risk of external services of electric power data as described in any one of claims 1 to 4 are implemented.

Images