A cyberspace asset mapping method for power monitoring system

Abstract

The present invention discloses a method for mapping cyberspace assets of an electric power monitoring system, which belongs to the technical field of equipment mapping, and includes: constructing a cyberspace asset model of the electric power monitoring system based on cyberspace modeling demand information of various assets in the electric power monitoring system and asset operation parameter information; constructing a cyberspace asset mapping framework of the electric power monitoring system based on the cyberspace asset model and cyberspace mapping parameter information; mapping the actual network access behaviors between various assets based on the cyberspace asset mapping framework and cyberspace mapping demand information, and obtaining an optimal network access relationship diagram between various assets. The present invention can more comprehensively map the actual network access behaviors between various assets, reduce the data error of network asset mapping in the electric power monitoring system, and significantly improve the network asset mapping effect in the electric power monitoring system.

Description

Technical Field

[0001] The present invention relates to the technical field of equipment mapping, and in particular to a method for mapping cyberspace assets of an electric power monitoring system. Background Art

[0002] With the rapid development of information technology and the digital transformation of the power industry, the scale of cyberspace assets in power monitoring systems continues to expand, and the interactive relationships between assets are becoming increasingly complex. Accurate and efficient mapping of network assets has become an important part of ensuring the safe and stable operation of power systems. However, existing cyberspace asset mapping methods often focus on the monitoring and analysis of a single network asset or a local network environment, and lack the construction of an overall modeling and mapping architecture for network assets. As a result, in power monitoring systems, the mapping effect of network assets is difficult to more comprehensively and accurately grasp the status, configuration, and interactive relationship of network assets, making it difficult to provide strong support for the safety management of power systems.

[0003] In a Chinese patent publication number CN117729005A, publication date March 19, 2024, and titled "A Network Asset Mapping Method", a network asset mapping method is disclosed, including: obtaining at least two traffic information to be parsed passively monitored by the traffic port mirror; the traffic information is generated based on the interaction of the network assets to be mapped in the business network environment; by parsing and processing each traffic information, the target interaction relationship between the target network assets in the business network environment is obtained; based on the target interaction relationship, a network asset topology map is drawn to determine the target network asset topology map. Although this method can realize fast and accurate network asset mapping without interfering with the business network environment, the disadvantage is that there is a lack of overall modeling of network assets and construction of a mapping architecture, resulting in poor network asset mapping effect in the power monitoring system. Summary of the invention

[0004] The purpose of the present invention is to address the problem that the existing cyberspace asset mapping methods lack the overall modeling of network assets and the construction of a mapping architecture, resulting in poor network asset mapping effects in a power monitoring system. A cyberspace asset mapping method for a power monitoring system is provided, which constructs a cyberspace asset model of the power monitoring system through cyberspace modeling requirement information and asset operation parameter information, and constructs a cyberspace asset mapping architecture for the power monitoring system through cyberspace mapping parameter information. The actual network access behavior between various assets is mapped by fully considering the cyberspace mapping requirement information, and the optimal network access relationship diagram between various assets is obtained, so that the actual network access behavior between various assets can be mapped more comprehensively, reducing the data error of network asset mapping in the power monitoring system and significantly improving the network asset mapping effect in the power monitoring system.

[0005] The purpose of the present invention is achieved through the following technical solutions:

[0006] A method for mapping cyberspace assets of an electric power monitoring system comprises the following steps:

[0007] S1. Construct a cyberspace asset model of the power monitoring system based on the cyberspace modeling demand information of various assets in the power monitoring system and the asset operation parameter information;

[0008] S2. Constructing the cyberspace asset mapping architecture of the power monitoring system based on the cyberspace asset model and cyberspace mapping parameter information;

[0009] S3. Based on the cyberspace asset mapping architecture and cyberspace mapping demand information, the actual network access behavior between various assets is mapped to obtain the optimal network access relationship diagram between various assets.

[0010] In this scheme, the cyberspace asset model of the power monitoring system is constructed through the cyberspace modeling demand information and asset operation parameter information, and the cyberspace asset mapping architecture of the power monitoring system is constructed through the cyberspace mapping parameter information. Then, the actual network access behavior between various assets is mapped by fully considering the cyberspace mapping demand information, and the optimal network access relationship diagram between various assets is obtained. This enables a more comprehensive mapping of the actual network access behavior between various assets, reduces the data error of network asset mapping in the power monitoring system, and significantly improves the network asset mapping effect in the power monitoring system.

[0011] Further, the S1 includes:

[0012] S11. Obtain cyberspace modeling demand information of various assets in the power monitoring system and perform multi-dimensional analysis to obtain key target information;

[0013] S12, extracting features from the operating status information of various assets to obtain asset operating parameter information;

[0014] S13. Construct a multi-dimensional network asset mapping framework based on key target information and asset operation parameter information, and construct an initial network space asset model based on the multi-dimensional network asset mapping framework;

[0015] S14. Establish a cyberspace asset model optimization mechanism based on multi-dimensional operating status information of various assets obtained in real time;

[0016] S15. Optimize the initial cyberspace asset model according to the cyberspace asset model optimization mechanism to obtain the cyberspace asset model of the power monitoring system.

[0017] In this scheme, by obtaining the cyberspace modeling demand information of various assets in the power monitoring system and performing multi-dimensional analysis, it is helpful to accurately extract key target information; by performing feature extraction on the operating status information of various assets, the asset operating parameter information can be obtained, and the network asset mapping framework constructed based on these asset operating parameter information can more accurately reflect the association and operation rules between assets; the multi-dimensional network asset mapping framework constructed by combining key target information and asset operating parameter information can more comprehensively display the complex relationship between various assets, making asset management and monitoring more intuitive and efficient; the cyberspace asset model optimization mechanism established based on the multi-dimensional operating status information of various assets obtained in real time can dynamically adjust and optimize the model, which helps to improve the accuracy and adaptability of the model, making the cyberspace asset management of the power monitoring system more accurate and efficient; through the cyberspace asset model of the power monitoring system, the network access relationship and operating status between assets can be more accurately reflected, which helps to reduce the data error of network asset mapping and improve the mapping effect.

[0018] Further, the S13 includes:

[0019] S131. Based on a data fusion method, key target information and asset operation parameter information are fused to obtain network asset fusion information;

[0020] S132. Construct a multi-dimensional network asset mapping framework based on a multi-dimensional mapping algorithm and network asset fusion information;

[0021] S133. Construct an initial cyberspace asset model based on a multi-dimensional network asset mapping framework.

[0022] In this scheme, the key target information and asset operation parameter information can be organically combined through the data fusion method to form a more comprehensive network asset fusion information, which helps to improve the accuracy and reliability of the information; the multi-dimensional mapping algorithm can make full use of the network asset fusion information to reveal the relationship between assets from multiple angles and dimensions; based on the multi-dimensional network asset mapping framework, the initial cyberspace asset model can be further constructed, which can more accurately reflect the actual status and operation characteristics of various assets in the power monitoring system.

[0023] Further, the S15 includes:

[0024] S151. Determine the key assets and key risk factor information in the initial cyberspace asset model according to the cyberspace asset model optimization mechanism;

[0025] S152, obtaining an optimization strategy for an initial cyberspace asset model based on the key assets and their key risk factor information;

[0026] S153. Optimize the initial cyberspace asset model according to the optimization strategy to obtain a cyberspace asset model of the power monitoring system.

[0027] In this scheme, through the analysis of the cyberspace asset model optimization mechanism, the key assets in the initial model can be accurately identified and the key risk factor information of the key assets can be determined; the optimization strategy formulation based on the key assets and key risk factor information can directly improve the weak links and risk points in the model, thereby improving the accuracy and practicality of the model; optimizing the initial model according to the optimization strategy can significantly improve the performance and quality of the model, and more accurately reflect the actual operation status of the power monitoring system.

[0028] Further, the S2 includes:

[0029] S21. Obtain and process the historical operation data of various assets in the cyberspace asset model to obtain the corresponding key asset operation data;

[0030] S22, performing value assessment based on the real-time operating status information of various assets in the power monitoring system and the operating data of key assets, and obtaining the influence of various assets on the operation of the power monitoring system;

[0031] S23, obtaining and processing network space mapping parameter information to obtain network space mapping characteristic parameter information, wherein the network space mapping parameter information includes network topology parameters, equipment performance parameters, and flow parameters;

[0032] S24. Construct a cyberspace asset mapping architecture for the power monitoring system based on the degree of influence of various assets on the operation of the power monitoring system and the characteristic parameter information of cyberspace mapping.

[0033] In this scheme, by acquiring and processing historical operation data, we can gain in-depth understanding of the performance of various types of assets during long-term operation, which helps to identify key assets; combining real-time operation status information and historical operation data, we can conduct value assessments on various types of assets, which can accurately reflect the importance and impact of assets in the power monitoring system; through cyberspace mapping parameter information, we can extract key features that reflect the characteristics and status of cyberspace assets; combined with asset impact and cyberspace mapping characteristic parameter information, the constructed power monitoring system cyberspace asset mapping architecture can more comprehensively reflect the actual status and relationships of various types of assets in the system, which helps to improve the accuracy and efficiency of network asset mapping.

[0034] Further, the S22 includes:

[0035] S221, obtaining real-time operating status information of various assets in the power monitoring system and analyzing the information to obtain key factors affecting the operation of the power monitoring system by various assets;

[0036] S222. Determine the value assessment mechanism of various types of assets affecting the operation of the power monitoring system based on the specific business scenario demand information of the power monitoring system;

[0037] S223. Perform value assessment based on the key factors and value assessment mechanism to obtain the influence of various types of assets on the operation of the power monitoring system.

[0038] In this solution, by analyzing the real-time operating status information of various assets in the power monitoring system, the key factors affecting the operation of the power monitoring system can be accurately identified, which helps to more accurately evaluate the impact of various assets on the system operation; by combining the specific business scenario demand information, a value assessment mechanism that is more in line with the actual situation can be formulated to ensure the accuracy and effectiveness of the assessment results; the value assessment based on key factors and value assessment mechanism can comprehensively and objectively reflect the impact of various assets on the operation of the power monitoring system.

[0039] Further, the S24 includes:

[0040] S241. Conduct correlation analysis on the influence of various assets on the operation of the power monitoring system and the characteristic parameter information of cyberspace mapping, and build a cyberspace correlation model for various assets;

[0041] S242. Construct a cyberspace asset mapping architecture for the power monitoring system based on the cyberspace association model.

[0042] In this scheme, the correlation analysis of the influence of various assets on the operation of the power monitoring system and the characteristic parameter information of cyberspace mapping is carried out, which helps to have a more comprehensive understanding of the relationship between assets and cyberspace mapping parameters. Through the cyberspace asset mapping architecture, real-time monitoring and dynamic management of various assets in the power monitoring system can be achieved, thereby improving the safety and reliability of the system.

[0043] Further, the S3 includes:

[0044] S31. Analyze the network space mapping parameter information to obtain the key requirement information of network access behavior between various assets; S32. Obtain the network access behavior data between various assets in real time, and construct a mapping strategy of the network access relationship diagram between various assets based on the network access behavior data and the key requirement information;

[0045] S33. Based on the mapping strategy of the network access relationship diagram between various types of assets, the actual network access behavior between various types of assets is mapped to obtain the optimal network access relationship diagram between various types of assets.

[0046] In this scheme, by analyzing the network space mapping parameter information, the key requirement information of various assets in terms of network access behavior can be extracted more accurately, which helps to avoid wrong decisions caused by insufficient information or misunderstanding in subsequent steps, and improves the accuracy and efficiency of mapping work; real-time acquisition of network access behavior data between various assets ensures the timeliness and accuracy of mapping work, and builds mapping strategies based on key requirement information, so that mapping work is more in line with actual business needs and system characteristics; mapping the actual network access behavior based on the mapping strategy of the network access relationship diagram can accurately reflect the network access relationship and interaction mode between assets, which helps to optimize the network structure and resource allocation, and improve network performance and security.

[0047] Further, the S32 includes:

[0048] S321, real-time acquisition of network access behavior data between various types of assets and processing thereof to obtain key network access behavior data;

[0049] S322. Construct a mapping strategy for network access relationship diagrams between various types of assets based on key network access behavior data and key requirement information.

[0050] In this solution, network access behavior data between various types of assets are obtained in real time to ensure the timeliness and accuracy of the data. The obtained network access behavior data is processed to filter out redundant and invalid information and extract key network access behavior data. Surveying and mapping strategies are constructed based on key network access behavior data and key requirement information, making surveying and mapping work more targeted and helping to improve the overall operating efficiency of the system.

[0051] Further, the S33 includes:

[0052] S331. Determine the network mapping technology based on the mapping strategy of the network access relationship diagram between various types of assets;

[0053] S332, updating the actual network access behavior data between various assets in real time according to the network mapping technology, and obtaining the initial network access relationship diagram between various assets;

[0054] S333. Based on the initial network access relationship graph and the network access relationship graph optimization mechanism, the actual network access behavior between the various assets is optimized to obtain the optimal network access relationship graph between the various assets.

[0055] In this scheme, according to the surveying strategy of the network access relationship diagram between various assets, the network surveying technology suitable for the current network environment and business needs can be selected in a targeted manner, ensuring the effectiveness and applicability of the surveying technology and improving the efficiency and accuracy of the surveying work; the actual network access behavior data between various assets is updated in real time according to the network surveying technology, which helps to capture the changes in network access behavior in a timely manner. By updating the data in real time, the initial network access relationship diagram between various assets can be obtained; based on the initial network access relationship diagram and the network access relationship diagram optimization mechanism, the actual network access behavior between various assets can be optimized, which significantly improves the network asset mapping effect in the power monitoring system.

[0056] The beneficial effects of the present invention are: constructing a cyberspace asset model of a power monitoring system through cyberspace modeling demand information and asset operation parameter information, and constructing a cyberspace asset mapping architecture of a power monitoring system through cyberspace mapping parameter information, and then mapping the actual network access behavior between various types of assets by fully considering the cyberspace mapping demand information, and obtaining the optimal network access relationship diagram between various types of assets, so that the actual network access behavior between various types of assets can be mapped more comprehensively, reducing the data error of network asset mapping in the power monitoring system, and significantly improving the network asset mapping effect in the power monitoring system. By analyzing the network space mapping parameter information, the key requirement information of various assets in terms of network access behavior can be accurately extracted, which helps to avoid wrong decisions caused by insufficient information or misunderstanding in subsequent steps, and improves the accuracy and efficiency of mapping work; real-time acquisition of network access behavior data between various assets ensures the timeliness and accuracy of mapping work, and builds mapping strategies based on key requirement information, making mapping work more in line with actual business needs and system characteristics; mapping actual network access behavior based on the mapping strategy of the network access relationship diagram can accurately reflect the network access relationship and interaction mode between assets, which helps to optimize the network structure and resource allocation, and improve network performance and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a flowchart of a method for cyberspace asset mapping of a power monitoring system according to an embodiment of the present invention;

[0058] Figure 2 is a structural diagram of a cyberspace asset model according to an embodiment of the present invention;

[0059] Figure 3 This is a technical architecture diagram of cyberspace mapping of a power monitoring system according to an embodiment of the present invention;

[0060] Figure 4 is a diagram of an automatic network space mapping algorithm according to an embodiment of the present invention;

[0061] Figure 5 is a physical connection relationship diagram between assets of the power monitoring system according to an embodiment of the present invention;

[0062] Figure 6 is a network connectivity relationship diagram between various types of assets in an embodiment of the present invention;

[0063] Figure 7 It is an asset access relationship diagram of the power monitoring system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0065] Embodiment: A method for mapping cyberspace assets of an electric power monitoring system, such as Figure 1 As shown, the following steps are included: S1, constructing a cyberspace asset model of the power monitoring system based on the cyberspace modeling demand information of various assets in the power monitoring system and the asset operation parameter information;

[0066] S2. Constructing the cyberspace asset mapping architecture of the power monitoring system based on the cyberspace asset model and cyberspace mapping parameter information;

[0067] S3. Based on the cyberspace asset mapping architecture and cyberspace mapping demand information, the actual network access behavior between various assets is mapped to obtain the optimal network access relationship diagram between various assets.

[0068] Furthermore, detailed information of various assets (such as servers, network devices, sensors, etc.) is obtained from the power monitoring system, including their hardware configuration, software version, operating status, etc. The network-related information such as the location, IP address, port number, etc. of these assets in the cyberspace is collected. The collected asset information is organized into a structured data format and stored in a database for subsequent query and analysis. Based on the information in the asset database, a cyberspace asset model of the power monitoring system is constructed using modeling tools or programming methods.

[0069] According to the actual needs and characteristics of the power monitoring system, determine the parameters required for cyberspace mapping, such as network bandwidth, latency, packet loss rate, etc. According to the determined mapping parameters, design appropriate mapping methods, such as active detection (such as ping, traceroute, etc.) or passive monitoring (such as traffic analysis). Select or develop cyberspace mapping tools suitable for the power monitoring system and integrate them into the mapping architecture. Combine the cyberspace asset model and mapping parameter information to build a cyberspace asset mapping architecture for the power monitoring system.

[0070] Using the established cyberspace asset mapping architecture, the actual network access behavior of various assets in the power monitoring system is mapped. By sending mapping data packets and collecting response data, information such as network connectivity, access latency, and bandwidth utilization between assets can be obtained. The collected network mapping data is analyzed to calculate network performance indicators between assets. Methods such as graph theory or optimization algorithms can be used to analyze the network access relationship between assets, find the optimal network access path, and generate the optimal network access relationship diagram: Based on the data analysis results, visualization tools can be used to generate the optimal network access relationship diagram between various assets in the power monitoring system. This diagram can intuitively display the network connectivity between assets, the optimal access path, and potential network bottlenecks.

[0071] Specifically, S1 includes:

[0072] S11. Obtain cyberspace modeling demand information of various assets in the power monitoring system and perform multi-dimensional analysis to obtain key target information;

[0073] S12, extracting features from the operating status information of various assets to obtain asset operating parameter information;

[0074] S13. Construct a multi-dimensional network asset mapping framework based on key target information and asset operation parameter information, and construct an initial network space asset model based on the multi-dimensional network asset mapping framework;

[0075] S14. Establish a cyberspace asset model optimization mechanism based on multi-dimensional operating status information of various assets obtained in real time;

[0076] S15. Optimize the initial cyberspace asset model according to the cyberspace asset model optimization mechanism to obtain the cyberspace asset model of the power monitoring system.

[0077] Specifically, S13 includes:

[0078] S131. Based on a data fusion method, key target information and asset operation parameter information are fused to obtain network asset fusion information;

[0079] S132. Construct a multi-dimensional network asset mapping framework based on a multi-dimensional mapping algorithm and network asset fusion information;

[0080] S133. Construct an initial cyberspace asset model based on a multi-dimensional network asset mapping framework.

[0081] Specifically, S15 includes:

[0082] S151. Determine the key assets and key risk factor information in the initial cyberspace asset model according to the cyberspace asset model optimization mechanism;

[0083] S152, obtaining an optimization strategy for the initial cyberspace asset model based on key assets and their key risk factor information;

[0084] S153. Optimize the initial cyberspace asset model according to the optimization strategy to obtain the cyberspace asset model of the power monitoring system.

[0085] Furthermore, the cyberspace modeling demand information of various assets (such as servers, network equipment, security equipment, etc.) is collected from the power monitoring system through web crawlers, API interfaces, etc., including: ensuring that the cyberspace can efficiently and accurately transmit and share data, information and knowledge; ensuring the integrity, confidentiality and availability of data in the cyberspace, and preventing data leakage, tampering or destruction; having the ability to defend and respond to network attacks, viruses, and malware; providing sufficient network bandwidth and low latency to meet the needs of large-scale data transmission and real-time communication; the cyberspace should be easy to expand to meet the needs of future business growth and technological development.

[0086] The cyberspace asset model optimization mechanism refers to the continuous adjustment and optimization of the cyberspace asset model by real-time acquisition and analysis of multi-dimensional operating status information of various assets in the power monitoring system, and by continuously collecting and processing asset operation data, updating the key parameters and features in the model to reflect the current latest status and security status of the system.

[0087] The following is the specific implementation process of the cyberspace asset model optimization mechanism:

[0088] Set the trigger conditions for model optimization, such as timing trigger, state change trigger, etc. When the trigger conditions are met, start the model optimization process. Collect new operating status information in real time, and preprocess and extract features. Input the new operating status information into the initial cyberspace asset model to evaluate the performance of the model. According to the evaluation results, select the appropriate optimization algorithm to optimize the model. The optimization content may include adjusting model parameters, adding new features, improving model structure, etc. Finally, the cyberspace asset model optimization mechanism is obtained.

[0089] The initial cyberspace asset model is comprehensively evaluated using the cyberspace asset model optimization mechanism. The evaluation content can be based on multiple dimensions such as the accuracy, completeness, and real-time performance of the model. Based on the evaluation results, the key assets in the initial cyberspace asset model are determined. The identification of key assets can take into account factors such as the importance, value, and dependencies of the assets, and risk factor analysis can be performed on key assets to identify key factors that may cause asset failure or security vulnerabilities. Risk factors can include technical defects, human errors, external threats, etc. Risk factors are prioritized according to the degree of impact and probability of occurrence of key risk factors. For each key asset and its key risk factors, a corresponding optimization strategy is formulated. The optimization strategy may include strengthening security measures, improving performance, optimizing resource allocation, etc. When formulating a strategy, it is necessary to consider practical feasibility, cost-effectiveness, and synergy with other assets.

[0090] According to the optimization strategy, the initial cyberspace asset model is specifically adjusted and optimized. The adjustment content may include updating asset attributes, modifying relationship connections, adding new security mechanisms, etc. The optimized cyberspace asset model is verified to ensure its accuracy and effectiveness. The verification content can be carried out by comparing with the actual network system, simulating attack tests, etc. The optimized cyberspace asset model is published to the power monitoring system and used as a new cyberspace asset model. As the power monitoring system changes and develops, the cyberspace asset model is regularly updated.

[0091] Natural language processing (NLP) or rule engines can be used to perform multi-dimensional analysis on the cleaned data to extract key target information, such as asset type, location, function, performance requirements, etc. The operating status information of various assets can be collected in real time through protocols such as SNMP, Syslog, NetFlow, etc. Key features can be extracted from the operating status information using machine learning or statistical analysis methods, such as CPU usage, memory occupancy, network bandwidth, latency, etc. The extracted features are integrated into asset operating parameter information to provide data support for subsequent analysis. Based on the key target information and asset operating parameter information, a multi-dimensional network asset mapping framework is designed, which can clearly display the relationship and dependency between assets. Based on the mapping framework, the initial cyberspace asset model is constructed using graph theory, data mining and other technologies. The model can include the attributes, status of assets and the connection relationship between them. Multi-dimensional operating status information of various assets can be collected in real time through monitoring tools and API interfaces. The initial cyberspace asset model can be evaluated in real time using machine learning or statistical learning methods to identify errors and deficiencies in the model. According to the evaluation results, design corresponding optimization mechanisms, such as parameter adjustment, model update, etc. According to the optimization mechanism, adjust and optimize the initial cyberspace asset model to improve the accuracy and practicality of the model. By comparing the actual data and model data, verify the accuracy and effectiveness of the optimized model. Publish the verified model to the power monitoring system to provide decision support for the operation and management of the system.

[0092] Specifically, first, ensure that the key target information and asset operation parameter information have been processed in accordance with a unified format and standard to facilitate subsequent fusion operations. Since the key target information and asset operation parameter information may come from different data sources and acquisition systems, data alignment is required to ensure the consistency of information such as timestamps and asset identification. According to the needs of cyberspace asset modeling, relevant features are selected from the key target information and asset operation parameter information. Using data fusion algorithms such as weighted fusion, Kalman filtering, Bayesian networks, etc., the key target information and asset operation parameter information are fused. During the fusion process, weighted processing can be performed according to the weights or importance of different features. The fused information is output in a structured or tabular form to form network asset fusion information. According to the actual situation and needs of the power monitoring system, multiple dimensions are defined, such as asset type, geographic location, functional role, operating status, etc. According to the network asset fusion information, the mapping relationship between different dimensions is designed. For example, a server asset can be mapped in both the geographic location dimension and the functional role dimension. Using graph theory, cluster analysis, association rule mining and other algorithms, a multi-dimensional network asset mapping framework is constructed based on the mapping relationship. This framework can clearly show the distribution and association of assets in different dimensions. Verify its accuracy and completeness by comparing the actual network structure with the mapping framework. According to the multi-dimensional network asset mapping framework, design the structure of the initial cyberspace asset model, which can contain information such as the attributes, status, and relationships of the assets. Fill the network asset fusion information into the model structure to form a specific cyberspace asset model. Verify the constructed initial cyberspace asset model to ensure that it meets the actual situation and requirements of the power monitoring system. Output the verified initial cyberspace asset model in a visual or file form to facilitate subsequent analysis and optimization.

[0093] Specifically, the goal of the cyberspace asset model is to build a basic model that can fully describe cyberspace. From the perspective of network security, we adopt an object-oriented modeling approach and a unified modeling language representation method to model the points, lines, and behaviors of cyberspace. The structure of the cyberspace asset model is shown in the figure below: Figure 2 As shown in the figure, the cyberspace asset model is used to uniformly model assets, relationships between assets, and asset behaviors, and comprehensively depict cyberspace. The cyberspace asset model includes spatial structure and spatial behavior, where the spatial structure includes spatial assets and spatial connection information. In terms of spatial asset attributes, 33 model information tables such as hardware, system, management, user, network, session, peripheral, process, service, software, driver, and file are established to achieve a comprehensive description of asset attributes; spatial connection information includes physical connection, connection relationship, and access relationship; in terms of spatial behavior, in accordance with the ATT&CK knowledge framework, a unified structured expression is made for the subject and object of various behavioral events, behavioral actions, and impacts.

[0094] Specifically, S2 includes:

[0095] S21. Obtain and process the historical operation data of various assets in the cyberspace asset model to obtain the corresponding key asset operation data;

[0096] S22, performing value assessment based on the real-time operating status information of various assets in the power monitoring system and the operating data of key assets, and obtaining the influence of various assets on the operation of the power monitoring system;

[0097] S23, obtaining and processing network space mapping parameter information to obtain network space mapping characteristic parameter information, where the network space mapping parameter information includes network topology parameters, equipment performance parameters, and traffic parameters;

[0098] S24. Construct a cyberspace asset mapping architecture for the power monitoring system based on the degree of influence of various assets on the operation of the power monitoring system and the characteristic parameter information of cyberspace mapping.

[0099] Specifically, S22 includes:

[0100] S221, obtaining real-time operating status information of various assets in the power monitoring system and analyzing the information to obtain key factors affecting the operation of the power monitoring system by various assets;

[0101] S222. Determine the value assessment mechanism of various types of assets affecting the operation of the power monitoring system based on the specific business scenario demand information of the power monitoring system;

[0102] S223. Perform value assessment based on key factors and value assessment mechanism to obtain the impact of various types of assets on the operation of the power monitoring system.

[0103] Specifically, S24 includes:

[0104] S241. Conduct correlation analysis on the influence of various assets on the operation of the power monitoring system and the characteristic parameter information of cyberspace mapping, and build a cyberspace correlation model for various assets;

[0105] S242. Construct a cyberspace asset mapping architecture for the power monitoring system based on the cyberspace association model.

[0106] Furthermore, extract historical operating data of various assets from the cyberspace asset model, which can include the CPU usage rate of the server, memory occupancy rate, traffic data of network devices, logs of security devices, etc. Clean the collected data to remove duplicate, abnormal or invalid data. Aggregate, transform or standardize the data as needed for subsequent analysis. Extract the operating data of key assets from the processed data based on business needs and system importance. Obtain real-time operating status information through monitoring tools or API interfaces. Use statistical analysis, machine learning and other methods to identify key factors affecting system operation, such as failure rate, response time, etc. Understand the business objectives, key business processes and performance requirements of the power monitoring system. Based on business needs, design appropriate value assessment indicators and weights, such as business continuity and data security.

[0107] The value assessment mechanism of various types of assets affecting the operation of the power monitoring system refers to a method or system for quantitative analysis and value judgment of the impact of different types of assets (such as power generation equipment, transmission equipment, distribution equipment, control system, etc.) in the operation of the power monitoring system. Combining the real-time operating status information of the assets, the specific business scenario requirements of the power monitoring system, and the key factors of various types of assets on the operation of the system, through a series of analysis and calculation processes, the impact of various types of assets on the operation of the power monitoring system is finally obtained.

[0108] Next, taking power generation equipment as an example, the implementation steps of the value assessment mechanism are explained in detail:

[0109] (1) Determine the evaluation indicators: including power generation efficiency, failure rate and maintenance cost. Power generation efficiency is a measure of the energy conversion efficiency of power generation equipment. Failure rate reflects the stability of equipment. Maintenance cost includes the cost of daily maintenance and fault repair. (2) Collect data: Collect real-time operation data of power generation equipment, such as power generation and fuel consumption. Collect historical fault records and maintenance cost data. (3) Weight allocation: According to the business scenario requirements, weights are allocated to power generation efficiency, failure rate and maintenance cost. For example, if the business scenario has high requirements for power supply stability, the weight of failure rate may be larger. (4) Calculate score: According to the scoring criteria, score each evaluation indicator. Multiply the score by the corresponding weight and then sum it to obtain the comprehensive score of the power generation equipment. (5) Comprehensive evaluation and feedback: Summarize the comprehensive scores of various assets to obtain the overall value evaluation results of each asset in the power monitoring system. According to the evaluation results, optimize the configuration, repair or replace the assets to improve the operating efficiency and stability of the power monitoring system.

[0110] Combine key factors and value assessment mechanisms to assess the value of various types of assets and obtain their impact on system operation. Collect network topology parameters, equipment performance parameters, and traffic parameters from network devices and security systems. Standardize, normalize, or convert the collected parameters for subsequent analysis. Extract characteristic parameter information related to surveying and mapping from the processed parameters. Use statistical analysis or graph theory to analyze the correlation between the impact and characteristic parameters, and build a cyberspace association model that reflects the characteristics of assets and cyberspace based on the results of the association analysis. Design the hierarchical structure, functional modules, and data flows of the surveying and mapping architecture based on the cyberspace association model. Use programming languages ​​and development tools to implement the functions of the surveying and mapping architecture, including data collection, processing, analysis, and visualization.

[0111] Specifically, the technical architecture diagram of the power monitoring system cyberspace mapping is as follows: Figure 3 As shown in the figure, based on the existing network security management platform and monitoring system, a network space mapping technology architecture diagram is constructed. Detection layer: Adopting on-demand active scanning, when host monitoring and collection, and traffic monitoring passive listening cannot cover, adopting protocol detection, device fingerprint detection, device port detection and IP or MAC scanning technology to detect network space device nodes and realize information collection of hidden or inactive assets.

[0112] Data layer: Aggregate all detected device nodes, and combine with the IP geographic library, the previously collected device fingerprint library and the vulnerability library to provide data sources for upper-layer alarm analysis, topology drawing and asset profiling.

[0113] Analysis layer: Based on full perception of anomalies, on the one hand, by enriching the expert experience of the existing network security management platform, including expert experience in three aspects: association rules, threat intelligence and asset baselines, it is used to improve the abnormal alarms of causal relationships; on the other hand, machine learning is introduced to discover abnormal alarms with associated relationships through the use of anomaly detection models, neural networks, etc., and perceive whether the operating status of the equipment is abnormal.

[0114] Application layer: Provides services such as equipment security monitoring, network security alarm, equipment retrieval, equipment operation statistics report, network topology drawing, and network space map.

[0115] Visualization layer: Provides alarm basic rules or asset baseline configuration, various types of equipment asset search, physical space and network space topology drawing, various types of asset portraits, various types of asset security situation analysis and various equipment asset management and control in emergency situations. Basic rules start from the dimensions of equipment anomalies, peripheral access, abnormal login, illegal operation, abnormal access, malicious code, etc. to achieve network security management and security operation and maintenance; asset baselines automatically perform statistical analysis on asset processes, networks, files, systems, etc. that are easily attacked and exploited by the network for a certain period of time to form asset security operation baselines. By comparing the baselines of real-time asset behaviors, abnormal asset behaviors can be accurately identified.

[0116] Specifically, S3 includes:

[0117] S31. Analyze the network space mapping parameter information to obtain the key requirement information of network access behavior between various assets; S32. Obtain the network access behavior data between various assets in real time, and construct a mapping strategy of the network access relationship diagram between various assets based on the network access behavior data and the key requirement information;

[0118] S33. Based on the mapping strategy of the network access relationship diagram between various types of assets, the actual network access behavior between various types of assets is mapped to obtain the optimal network access relationship diagram between various types of assets.

[0119] Specifically, S32 includes:

[0120] S321, real-time acquisition of network access behavior data between various types of assets and processing thereof to obtain key network access behavior data;

[0121] S322. Construct a mapping strategy for network access relationship diagrams between various types of assets based on key network access behavior data and key requirement information.

[0122] Specifically, S33 includes:

[0123] S331. Determine the network mapping technology based on the mapping strategy of the network access relationship diagram between various types of assets;

[0124] S332, updating the actual network access behavior data between various assets in real time according to the network mapping technology, and obtaining the initial network access relationship diagram between various assets;

[0125] S333. Based on the initial network access relationship graph and the network access relationship graph optimization mechanism, the actual network access behavior between the various assets is optimized to obtain the optimal network access relationship graph between the various assets.

[0126] Furthermore, network space mapping parameter information is collected, including network equipment configuration information, access control lists, traffic analysis data, etc. The collected parameter information is parsed to extract key information related to network access behavior between various assets, such as access rights, transmission protocols, port numbers, access frequencies, etc. Based on the parsing results, key requirements for network access behavior between various assets are extracted, such as the need for high-bandwidth, low-latency access between certain assets, or the need for encryption for access between certain assets.

[0127] Use network monitoring tools or API interfaces to obtain network access behavior data between various assets in real time. Clean, aggregate and standardize the acquired data to extract key network access behavior data, such as access time, access source and target, and data volume transmitted. Based on key network access behavior data, construct a preliminary network access relationship diagram between various assets. Combine key requirement information to develop a mapping strategy.

[0128] The strategy of mapping the network access relationship diagram between various assets refers to the real-time capture, analysis and visualization of the network access behavior between various assets (such as servers, workstations, network devices, etc.), and the construction of a network access relationship diagram between them. This relationship diagram not only reflects the connection status between assets, but also reveals key information such as the direction of network traffic, access frequency, access duration, etc., thereby helping network administrators or security analysts to quickly identify potential security risks.

[0129] Steps to build a network access graph mapping strategy:

[0130] According to business needs and security policies, clearly define the types of network access behaviors that need to be monitored (such as HTTP, FTP, SSH, etc.) and identify key assets. These assets can be the core of business operations or the focus of security risks. Define key indicators of network access behavior, such as access frequency, response time, data transmission volume, etc. Use network traffic analysis tools or security devices (such as firewalls, intrusion detection systems) to capture network traffic data in real time. Parse network data packets and extract information such as source address, destination address, port number, protocol type, etc. Store the parsed data in the database for subsequent analysis and query. Based on the collected network access behavior data, build a network access relationship graph between assets. The nodes in the graph represent assets, and the edges represent network access behaviors between assets. The weights of the edges can be set according to key indicators such as access frequency and data transmission volume, so as to intuitively reflect the strength of the access relationship in the graph. You can use visualization tools to present the network access relationship graph, which supports operations such as zooming, dragging, and filtering, so that users can view and analyze it easily. As the network environment changes and business needs adjust, network access behavior will also change. Therefore, it is necessary to update the network access relationship graph in real time to reflect the latest network status and optimize the relationship graph, such as removing noise data, merging similar nodes, etc., to improve the clarity and readability of the graph. Additional analysis functions or alarm mechanisms can be added according to actual needs so that timely response can be made when network access behavior is abnormal.

[0131] Assume that in an enterprise, there are two servers (ServerA and ServerB) and multiple client workstations. ServerA is responsible for processing customer orders, while ServerB is responsible for storing customer data. Client workstations are used for daily office work. According to the mapping strategy of the network access relationship diagram, the network access relationship diagram between these assets can be constructed by following the steps below:

[0132] First, determine the key required information that needs to be monitored, such as the frequency of data exchange between ServerA and ServerB, the number of visits to ServerA by client workstations, etc. Then, you can use network traffic analysis tools to capture the network access behavior data between these assets in real time. Next, parse this data, extract information such as source address, destination address, access protocol, etc. Based on this data, build a network access relationship graph, in which nodes represent ServerA, ServerB and client workstations, and edges represent network access behaviors between them. For example, you can see in the figure that there is frequent data exchange between ServerA and ServerB, and client workstations often access ServerA to process orders. Finally, this relationship graph can be optimized and updated in real time according to business needs and security policies, such as setting up an alarm mechanism to monitor abnormal access behavior, or adding data filtering functions to remove unnecessary noise data.

[0133] According to the requirements of the mapping strategy, select appropriate network mapping technologies, such as network topology discovery, traffic analysis, performance monitoring, etc. Use the selected network mapping technology to obtain and update the actual network access behavior data between various assets in real time, and generate the initial network access relationship diagram between various assets based on the updated data. The network access relationship diagram optimization mechanism refers to the in-depth analysis of the network access relationship diagram, identifying bottlenecks, security risks and unreasonable access paths in the network, and taking corresponding optimization measures based on these analysis results. According to the network access relationship diagram optimization mechanism, such as load balancing, path selection algorithm, etc., the initial network access relationship diagram is optimized. Through optimization processing, the optimal network access relationship diagram between various assets is obtained, which reflects the best path and method for network access between assets.

[0134] Specifically, cyberspace asset mapping includes asset perception and spatial mapping. Apply spatial mapping technology to discover all cyberspace assets and draw a cyberspace map. The main goal of cyberspace mapping is to fully grasp the relationship between assets and asset connections in cyberspace and build a multi-level, multi-dimensional cyberspace map, including physical connection relationships, network connectivity relationships, and network access relationships. The physical connection relationship is based on the address resolution protocol (ARP), forwarding database (FDB), open standard protocol (LLDP) and other information of network control assets to calculate the second-layer physical connection relationship between each asset and generate a physical connection map. Based on the physical connection relationship, the network connectivity relationship integrates the routing, access control policy and other information of the asset to generate the network connectivity relationship between each asset, providing support for the analysis of the network exposure of the asset and the impact analysis after being compromised. The network access relationship is based on the actual network access behavior to generate the network access relationship between each asset, providing data support for grasping the cyberspace situation.

[0135] The network space mapping parameter information includes the basic information such as the routing, strategy, and port of network equipment and general security protection equipment that must be collected for network space mapping. Figure 4 As shown, in terms of automatic mapping of physical connection relationships in spatial surveying, with network control devices as the core, relying on the breadth traversal algorithm, the list of devices connected to each interface of the network control device is continuously traversed. For the connected host devices, the asset attachment is completed based on the host asset IP address information; for the cascaded network control devices, a secondary interface traversal is carried out to complete the drawing of the physical connection relationship diagram step by step.

[0136] To draw the access relationship between assets, it is necessary to collect basic data to provide a data source and basis for the behavior analysis between devices. The collection scope includes host devices, network control devices and traffic data. In terms of host devices, by deploying agents on the host, the host's process, files, users, networks and sessions and other information are collected, and the subject of the event or the object affected by the event is added to the collected information. The event and process, file, user and other information attributes are associated and collected on the host side, which strengthens the information association and enhances the host asset's monitoring of the internal behavior of the Agent log collection and response processing capabilities. In terms of network control equipment, it is mainly aimed at spatial mapping needs, and collects information related to routers, switches and firewall devices, including equipment operation status, software and hardware attributes, access control policies, routing forwarding rules and other information.

[0137] In terms of traffic data collection, by collecting the traffic of mirrored network devices, traffic analysis, protocol identification and behavior perception are achieved to make up for the problem that weakly controlled assets cannot be collected through agents, and to achieve comprehensive collection of external behaviors of cyberspace assets. Based on the traffic characteristics and behavior events collected by traffic, the network security management platform realizes functions such as traffic-based behavior monitoring and network access relationship diagram display.

[0138] Table 1 Correspondence between behavior models and network security management platform alarm events

[0139] property Remark Time of occurrence When the behavior occurred User ID The system user who initiated the behavior event, can be empty Way The access method of the system user can be empty, such as ssh login, local login, etc. Subject Object The asset that initiated the behavioral event Subject Sub-Object The object that initiates the behavior event, such as the process session, can be empty Object The asset or structure object affected by the behavioral event Object sub-object Objects affected by the behavior event, such as files, processes, configurations, etc., can be empty action Behavior event action type, such as add, delete, start, configuration change, cross-line, etc. Extended attributes According to the different extended attributes of behavioral events, behavioral models are established respectively

[0140] As shown in Table 1, behavior modeling in cyberspace, in accordance with the ATT&CK knowledge framework, provides a unified and structured expression of the subject and object, behavior actions, and impact of various behavior events.

[0141] According to the above description, the specific implementation process is carried out next.

[0142] The physical connection relationship between various assets in the power monitoring system is shown in the figure below: Figure 5 As shown in Figure 1, according to the cyberspace asset mapping method of the power monitoring system, the cyberspace physical map is first drawn to generate the physical connection map between assets. Based on the physical connection relationship, the routing, access control strategy and other information of each asset are integrated to generate the network connectivity relationship between each asset. The network connectivity relationship diagram between various assets is shown in Figure 1. Figure 6 As shown, Figure 6 The bold black solid line in the figure is the network connection path from server 192.168.10.1 to server 192.168.10.2 drawn based on information such as asset routing and access control policies.

[0143] The asset access relationship diagram of the power monitoring system is as follows: Figure 7As shown, according to the behavior model and the actual network access behavior between assets, a network access relationship diagram between each asset is generated. According to the log information collected by the network security management platform, and after the logs are merged and analyzed, the information "2023-10-1717:37:25 192.168.10.1 server (asset name: sx2-d5000-2) root user logged in to the 192.168.10.2 server (asset name: sx2-d5000-1) via ssh" is extracted. Based on this information, the access relationship between asset sx2-d5000-2 and asset sx2-d5000-1 is drawn.

[0144] According to the behavioral model, the asset access relationship of the power monitoring system Figure 7 It means "On 2023-10-17 23:37:25, the root user in the asset sx2-d5000-1 logged in to the asset sx2-d5000-2 via ssh. It is suspected that the login is abnormal, which may lead to illegal access to system data, allowing the login user to start malicious processes, and eventually cause the server to be infected with malicious viruses. Serious consequences will lead to the system being stopped or paralyzed."

[0145] Through a cyberspace asset mapping method for power monitoring systems, the access behavior path of cyberspace assets can be outlined, helping relevant personnel to grasp the attributes, operating status and development trends of various assets from a global perspective, and at the same time reducing the uncertainty of network security decision-making and management activities of power monitoring systems. By building a unified cyberspace asset model, the cyberspace is characterized from two dimensions: the structural model (static model) and the behavioral model (dynamic model). Statically, with the IP address as the core, the assets in the physical space are mapped to the cyberspace, the IP relationship is associated, and an overall cyberspace structure is established; dynamically, from the perspective of network security, the behavior of the assets themselves and between assets in the cyberspace is depicted. The combination of static and dynamic makes the cyberspace describable and visualized.

[0146] The above embodiment is only a preferred solution of the present invention and does not limit the present invention in any form. There are other variations and modifications without exceeding the technical solution described in the claims.

Claims

1. A method for mapping cyberspace assets of an electric power monitoring system, characterized in that: The following steps are involved: S1. Construct a cyberspace asset model of the power monitoring system based on the cyberspace modeling demand information of various assets in the power monitoring system and the asset operation parameter information; S2. Constructing the cyberspace asset mapping architecture of the power monitoring system based on the cyberspace asset model and cyberspace mapping parameter information; S3. Map the actual network access behaviors between various assets based on the network space asset mapping architecture and network space mapping demand information to obtain the optimal network access relationship diagram between various assets; The S1 includes: S11. Obtain cyberspace modeling demand information of various assets in the power monitoring system and perform multi-dimensional analysis to obtain key target information; S12, extracting features from the operating status information of various assets to obtain asset operating parameter information; S13, constructing a multi-dimensional network asset mapping framework based on key target information and asset operation parameter information, and constructing an initial network space asset model based on the multi-dimensional network asset mapping framework; S14. Establish a cyberspace asset model optimization mechanism based on multi-dimensional operating status information of various assets obtained in real time; S15. Optimizing the initial cyberspace asset model according to the cyberspace asset model optimization mechanism to obtain a cyberspace asset model of the power monitoring system; The S2 includes: S21. Obtain and process the historical operation data of various assets in the cyberspace asset model to obtain the corresponding key asset operation data; S22, performing value assessment based on the real-time operating status information of various assets in the power monitoring system and the operating data of key assets, and obtaining the influence of various assets on the operation of the power monitoring system; S23, acquiring and processing network space mapping parameter information to obtain network space mapping characteristic parameter information, wherein the network space mapping parameter information includes network topology parameters, equipment performance parameters, and flow parameters; S24. Constructing a cyberspace asset mapping architecture for the power monitoring system based on the degree of influence of various assets on the operation of the power monitoring system and cyberspace mapping characteristic parameter information; The S3 includes: S31. Analyze the network space mapping parameter information to obtain key requirement information of network access behavior between various assets; S32. Acquire network access behavior data between various types of assets in real time, and construct a mapping strategy for network access relationship diagrams between various types of assets based on the network access behavior data and key requirement information; S33. Based on the mapping strategy of the network access relationship diagram between various types of assets, the actual network access behavior between various types of assets is mapped to obtain the optimal network access relationship diagram between various types of assets.

2. The method for mapping cyberspace assets of a power monitoring system according to claim 1, characterized in that: The S13 includes: S131. Based on a data fusion method, key target information and asset operation parameter information are fused to obtain network asset fusion information; S132. Construct a multi-dimensional network asset mapping framework based on a multi-dimensional mapping algorithm and network asset fusion information; S133. Construct an initial cyberspace asset model based on a multi-dimensional network asset mapping framework.

3. The method for mapping cyberspace assets of a power monitoring system according to claim 1, characterized in that: The S15 includes: S151. Determine the key assets and key risk factor information in the initial cyberspace asset model according to the cyberspace asset model optimization mechanism; S152, obtaining an optimization strategy for an initial cyberspace asset model based on the key assets and their key risk factor information; S153. Optimize the initial cyberspace asset model according to the optimization strategy to obtain a cyberspace asset model of the power monitoring system.

4. The method for mapping cyberspace assets of a power monitoring system according to claim 1, characterized in that: The S22 includes: S221, obtaining real-time operating status information of various assets in the power monitoring system and analyzing the information to obtain key factors affecting the operation of the power monitoring system by various assets; S222. Determine the value assessment mechanism of various types of assets affecting the operation of the power monitoring system based on the specific business scenario demand information of the power monitoring system; S223. Perform value assessment based on the key factors and value assessment mechanism to obtain the influence of various types of assets on the operation of the power monitoring system.

5. The method for mapping cyberspace assets of a power monitoring system according to claim 1, characterized in that: The S24 includes: S241. Conduct correlation analysis on the influence of various assets on the operation of the power monitoring system and the characteristic parameter information of cyberspace mapping, and build a cyberspace correlation model for various assets; S242. Construct a cyberspace asset mapping architecture for the power monitoring system based on the cyberspace association model.

6. The method for mapping cyberspace assets of a power monitoring system according to claim 1, characterized in that: The S32 includes: S321, real-time acquisition of network access behavior data between various types of assets and processing thereof to obtain key network access behavior data; S322. Construct a mapping strategy for network access relationship diagrams between various types of assets based on key network access behavior data and key requirement information.

7. The method for mapping cyberspace assets of a power monitoring system according to claim 1, characterized in that: The S33 includes: S331. Determine the network mapping technology based on the mapping strategy of the network access relationship diagram between various types of assets; S332, updating the actual network access behavior data between various assets in real time according to the network mapping technology, and obtaining the initial network access relationship diagram between various assets; S333. Based on the initial network access relationship graph and the network access relationship graph optimization mechanism, the actual network access behavior between the various assets is optimized to obtain the optimal network access relationship graph between the various assets.

Images