Data security and network security monitoring system and method

Abstract

The present invention provides a data security and network security monitoring system and method, which relates to the field of network data security technology, wherein a local supervision module is used to monitor the real-time network security of different power equipment in the power system, and implement early warning supervision reliability analysis on the power equipment with network anomalies, obtain early warning reliable identification and processing reliable identification, and then obtain the behavior monitoring processing sequence corresponding to the power equipment, traverse and analyze the behavior monitoring processing sequence, obtain monitoring data and save it; the overall supervision module is used to perform abnormal impact processing analysis of different dimensions on the monitoring data of all power equipment with network anomalies, so as to adaptively optimize the early warning schemes and processing schemes of different power equipment. The present invention can realize the diversity of network security monitoring processing and the diversity of data security processing and storage, and improve the data security utilization management effect and network security prevention and control optimization management effect.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security, and in particular to a data security and network security monitoring system and method. Background Art

[0002] Data security focuses on protecting data from unauthorized access, use, disclosure, corruption or loss, and focuses on ensuring the integrity, confidentiality and availability of data; network security is more broadly concerned with protecting network systems from threats, including malware, hacker attacks and other cybercriminal activities, with the goal of maintaining the integrity and availability of the network.

[0003] The existing data security and network security monitoring solutions have certain defects in implementation. They cannot conduct multi-dimensional supervision and reliability data analysis on different threat warnings that occur each time for different power equipment in the power system, and thus cannot adaptively implement targeted data security utilization management and network security prevention and control optimization management for individual power equipment and all power equipment based on the analysis results. Summary of the invention

[0004] The purpose of the present invention is to provide a data security and network security monitoring system and method, which is used to solve the problems that the existing technology cannot perform multi-dimensional supervision and reliability data analysis on different threat warnings that occur each time for different power equipment in the power system, and to achieve diversity in network security monitoring processing and data security processing and storage for a single power equipment with network anomalies, thereby improving the data security utilization management effect and network security prevention and control optimization management effect of different power equipment.

[0005] In order to achieve the above-mentioned purpose, in a first aspect, the present invention provides a data security and network security monitoring system, comprising a local supervision module and an overall supervision module, wherein the local supervision module is used to monitor the real-time network security of different power equipment in the power system, and to perform early warning supervision reliability analysis on the power equipment with network anomalies, to obtain an early warning reliable identifier and a processing reliable identifier, to sort and combine the early warning reliable identifier and the processing reliable identifier, to obtain a behavior monitoring processing sequence corresponding to the power equipment to which they belong, to traverse and analyze the behavior monitoring processing sequence, to obtain monitoring data and to save it; wherein the early warning reliable identifier is used to characterize the reliability of a preset early warning scheme corresponding to the power equipment with network anomalies, and the processing reliable identifier is used to characterize the reliability of a preset processing scheme corresponding to the power equipment with network anomalies;

[0006] The overall supervision module is used to analyze the abnormal impact of different dimensions on the monitoring data of all power equipment with network abnormalities, so as to adaptively optimize the early warning and processing solutions for different power equipment.

[0007] According to a data security and network security monitoring system provided by the present invention, an early warning supervision reliability analysis is performed on power equipment with network anomalies to obtain an early warning reliability mark and a processing reliability mark, including:

[0008] Obtain the abnormality occurrence timestamp of the power equipment where the network abnormality occurs, monitor and count the early warning behavior and processing behavior in the monitoring period before and after the abnormality occurrence timestamp respectively, obtain the early warning behavior data and the processing behavior data, and input the early warning behavior data and the processing behavior data into the preset early warning supervision reliable identification function, and output the early warning reliable identification and the processing reliable identification respectively.

[0009] According to a data security and network security monitoring system provided by the present invention, the expression of the early warning supervision reliable identification function is:

[0010]

[0011] In the formula, k = 1 or 2; XC1 is the warning reliability mark, XC2 is the treatment reliability mark; X1 is the warning behavior, X2 is the treatment behavior; Xk standardized implementation behavior and effective means that the warning behavior occurs in the previous monitoring period, the treatment behavior occurs in the previous monitoring period or in the later monitoring period, and the problem that occurred is solved; Xk non-standard implementation behavior means that the warning behavior occurs in the later monitoring period, the treatment behavior occurs in the previous monitoring period or in the later monitoring period, but the problem that occurred is not solved; Xk unimplemented behavior means that the warning behavior does not occur and the treatment behavior does not occur.

[0012] According to a data security and network security monitoring system provided by the present invention, the monitoring data includes conventional monitoring data and special monitoring data.

[0013] According to a data security and network security monitoring system provided by the present invention, a behavior monitoring processing sequence is traversed and analyzed to obtain and save monitoring data, including:

[0014] If all elements in the behavior monitoring processing sequence are 0, the corresponding power equipment will be marked as conventional problem power equipment, and the warning behavior data, processing behavior data, and behavior monitoring processing sequence corresponding to the conventional problem power equipment will be sorted and combined to obtain conventional monitoring data and save it through the conventional preservation scheme.

[0015] According to a data security and network security monitoring system provided by the present invention, a behavior monitoring processing sequence is traversed and analyzed to obtain and save monitoring data, including:

[0016] If there are non-zero elements in the behavior monitoring processing sequence, the problem impact index corresponding to the corresponding power equipment is calculated for the non-zero elements in the behavior monitoring processing sequence by a first preset formula; the first preset formula is:

[0017]

[0018] In the formula, Zwy is the problem impact index; YB and CB are the warning reliability identification values ​​and processing reliability identification values ​​respectively; α and β are different weight coefficients and are both greater than 0;

[0019] The power equipment is marked according to the problem impact index, and the corresponding marks, warning behavior data, processing behavior data, behavior monitoring processing sequence, and problem impact index of the power equipment are sorted and combined to obtain special monitoring data and save them through a special saving plan.

[0020] According to a data security and network security monitoring system provided by the present invention, the power equipment is marked according to the problem impact index, including:

[0021] if , then the corresponding power equipment is marked as power equipment with mild special problems;

[0022] if , the corresponding power equipment will be marked as power equipment with severe special problems.

[0023] According to a data security and network security monitoring system provided by the present invention, the overall supervision module is specifically used for:

[0024] All power equipment with network anomalies are sorted according to the time when the network anomaly first occurred, and the monitoring data of all power equipment are obtained in sequence;

[0025] If the monitoring data corresponding to the power equipment is conventional monitoring data, the corresponding power equipment will be eliminated;

[0026] If the monitoring data corresponding to the electric power equipment is special monitoring data, the electric power equipment is marked as a target equipment, and the active warning index and active processing index of the target equipment are calculated by the second preset formula, and the overall processing impact index of the target equipment is calculated by the third preset formula;

[0027] The second preset formula is:

[0028]

[0029] Where, k=1 or 2; JC1 and JC2 are the active warning index and active processing index of the target device respectively; N11 and N12 are the total number of warning reliable identifications with a value of 1 and the total number of processing reliable identifications with a value of 1 respectively; N21 and N22 are the total number of warning reliable identifications with a value of 2 and the total number of processing reliable identifications with a value of 2 respectively; N1 and N2 are the total number of all warning reliable identifications and the total number of all processing reliable identifications respectively; η is the weight coefficient, and η>1; [ ] is the rounding function;

[0030] The third preset formula is:

[0031]

[0032]

[0033] Where ZC is the overall processing impact index; Zwyj is the problem impact index of target device j; m is the number of target devices; A is the preset standard value; is the intermediate parameter;

[0034] If ZC>1, the early warning plan and processing plan of the target equipment are optimized;

[0035] If ZC≤1 and JC1>1, the early warning plan of the target equipment is optimized;

[0036] If ZC≤1 and JC2>1, the processing scheme of the corresponding target device is optimized and managed.

[0037] In a second aspect, the present invention further provides a data security and network security monitoring method, which is applied to the data security and network security monitoring system of the first aspect, and the method comprises:

[0038] The local supervision module monitors the real-time network security of different power equipment in the power system, and performs early warning supervision reliability analysis on the power equipment with network anomalies to obtain early warning behavior data and processing behavior data, and then obtains early warning reliable identification and processing reliable identification according to the early warning behavior data and processing behavior data, respectively, sorts and combines the early warning reliable identification and processing reliable identification, obtains the behavior monitoring processing sequence corresponding to the power equipment to which it belongs, traverses and analyzes the behavior monitoring processing sequence, obtains monitoring data and saves it; wherein, the early warning reliable identification is used to characterize the reliability of the preset early warning scheme corresponding to the power equipment with network anomalies, and the processing reliable identification is used to characterize the reliability of the preset processing scheme corresponding to the power equipment with network anomalies;

[0039] The overall supervision module performs abnormal impact processing and analysis in different dimensions on the monitoring data of all power equipment with network abnormalities, thereby adaptively optimizing the early warning and processing plans for different power equipment.

[0040] The technical solution of the present invention has at least the following technical effects:

[0041] The present invention provides a data security and network security monitoring system and method, which implements early warning supervision reliability analysis on power equipment with network anomalies, and adaptively and dynamically and securely stores the monitoring data corresponding to a single power equipment with network anomalies based on the analysis results, thereby realizing diversity in network security monitoring processing and diversity in data security processing and storage for a single power equipment with network anomalies. In addition, by performing abnormal impact processing analysis of different dimensions on all network security monitoring data of different power equipment, adaptively and targetedly optimizing management of early warning schemes and processing schemes corresponding to different power equipment based on the analysis results of different dimensions, targeted processing analysis and expanded utilization of different network security supervision corresponding to different power equipment are realized, thereby improving the data security utilization management effect and network security prevention and control optimization management effect of different power equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] In the attached picture:

[0044] Figure 1 It is a structural block diagram of the data security and network security monitoring system of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Some embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0047] See also Figure 1 The embodiment of the present invention provides a data security and network security monitoring system, including a local supervision module and an overall supervision module. The local supervision module is used to monitor the real-time network security of different power equipment in the power system, and to perform early warning supervision reliability analysis on the power equipment with network anomalies, to obtain an early warning reliable identifier and a processing reliable identifier, to sort and combine the early warning reliable identifier and the processing reliable identifier, to obtain a behavior monitoring processing sequence corresponding to the power equipment to which it belongs, to perform traversal analysis on the behavior monitoring processing sequence, to obtain monitoring data and to save it; wherein, the early warning reliable identifier is used to characterize the reliability of a preset early warning scheme corresponding to the power equipment with network anomalies, and the processing reliable identifier is used to characterize the reliability of a preset processing scheme corresponding to the power equipment with network anomalies;

[0048] The overall supervision module is used to analyze the abnormal impact of different dimensions on the monitoring data of all power equipment with network abnormalities, so as to adaptively optimize the early warning and processing solutions for different power equipment.

[0049] Specifically, an early warning supervision reliability analysis is performed on the power equipment with network anomalies to obtain early warning behavior data and processing behavior data, and then an early warning reliability mark and a processing reliability mark are obtained according to the early warning behavior data and the processing behavior data, respectively, including:

[0050] Obtain the abnormality occurrence timestamp of the power equipment with network abnormality, the unit of the abnormality occurrence timestamp is seconds, monitor and count the early warning behavior and processing behavior in the monitoring period before and after the abnormality occurrence timestamp respectively, obtain the early warning behavior data and processing behavior data, and input them into the preset early warning supervision reliable identification function, and output the early warning reliable identification and processing reliable identification respectively;

[0051] It should be noted that the specific values ​​of the monitoring periods before and after the abnormality occurrence timestamp can be determined according to the existing early warning requirement design data and processing requirement design data. For example, the 30s before and after the abnormality occurrence timestamp are the monitoring periods;

[0052] Among them, the expression of the reliable identification function of early warning supervision is:

[0053]

[0054] In the formula, k = 1 or 2; XC1 is the warning reliability mark, XC2 is the treatment reliability mark; X1 is the warning behavior, X2 is the treatment behavior; Xk standardized implementation behavior and effective means that the warning behavior occurs in the previous monitoring period, the treatment behavior occurs in the previous monitoring period or in the later monitoring period, and the problem that occurred is solved; Xk non-standard implementation behavior means that the warning behavior occurs in the later monitoring period, the treatment behavior occurs in the previous monitoring period or in the later monitoring period, but the problem that occurred is not solved; Xk unimplemented behavior means that the warning behavior does not occur and the treatment behavior does not occur.

[0055] In an embodiment of the present invention, an early warning reliability flag and a processing reliability flag are respectively used to digitally represent the processing reliability status of preset early warning schemes and processing schemes corresponding to the power equipment where network abnormalities occur; different power equipment are pre-set with early warning schemes and processing schemes corresponding to different sample network abnormalities, and different sample network abnormalities pre-set for different power equipment can be determined based on all network abnormalities that have occurred in the history of the corresponding power equipment, as well as according to the operation and maintenance experience of professional and technical personnel in this field.

[0056] It is understandable that if the network anomaly that occurs is not completely identical to all the sample network anomalies pre-set for the corresponding power equipment, or is partially identical, the corresponding early warning plan and processing plan for the power equipment will be invalid.

[0057] Specifically, the warning reliability flag contains a value of 0, 1 or 2, indicating that the warning behavior is reliable, limitedly reliable or unreliable, respectively; the processing reliability flag contains a value of 0, 1 or 2, indicating that the processing behavior is reliable, limitedly reliable or unreliable, respectively; that is, the warning reliability flag is used to characterize the reliability of the preset warning scheme corresponding to the power equipment with network abnormalities, and the processing reliability flag is used to characterize the reliability of the preset processing scheme corresponding to the power equipment with network abnormalities.

[0058] In an embodiment of the present invention, by digitally processing and combining the processing results of different dimensions corresponding to the power equipment with network anomalies, a corresponding behavior monitoring processing sequence is obtained, which can not only realize the digital representation of the processing reliability status of different dimensions of the power equipment with network anomalies, but also provide reliable local processing analysis data support for the subsequent overall processing reliability status analysis and management corresponding to different power equipment.

[0059] Specifically, monitoring data includes regular monitoring data and special monitoring data. The behavior monitoring processing sequence is traversed and analyzed to obtain and save monitoring data, including:

[0060] If all the elements in the behavior monitoring processing sequence are 0, a normal problem processing instruction is generated and the corresponding power equipment is marked as a conventional problem power equipment, and the warning behavior data, processing behavior data, and behavior monitoring processing sequence corresponding to the conventional problem power equipment are sorted and combined to obtain conventional monitoring data and save it through a conventional storage plan; among which, the conventional storage plan can specifically be a storage plan without encryption.

[0061] If there are non-zero elements in the behavior monitoring processing sequence, a problem handling exception instruction is generated, and the problem impact index corresponding to the power equipment to which the non-zero elements in the behavior monitoring processing sequence belong is calculated by a first preset formula; the first preset formula is:

[0062]

[0063] Where Zwy is the problem impact index; YB and CB are the warning reliability identification values ​​and processing reliability identification values ​​respectively; α and β are different weight coefficients and are both greater than 0. The specific values ​​of α and β are not limited and can be customized according to the application requirements of the actual application scenario;

[0064] The power equipment is marked according to the problem impact index, and the corresponding marks, warning behavior data, processing behavior data, behavior monitoring processing sequence, and problem impact index of the power equipment are sorted and combined to obtain special monitoring data and save them through a special saving plan.

[0065] It should be noted that the problem impact index is used to process the abnormality handling data of different aspects of the power equipment with network abnormalities to digitally represent the impact of the problems caused by them.

[0066] Furthermore, the power equipment is marked according to the problem impact index, including:

[0067] if , then a mild unreliable instruction is generated and prompted, and the corresponding power equipment is marked as a mild special problem power equipment;

[0068] if , a severe unreliable instruction is generated and prompted, and the corresponding power equipment is marked as severe special problem power equipment.

[0069] According to the mildly unreliable instructions or the severely unreliable instructions, the warning behavior data, processing behavior data, behavior monitoring processing sequence, problem impact index and the corresponding marks of the power equipment are sorted and combined to obtain special monitoring data and securely save them through a special storage scheme; wherein the characteristic storage scheme may specifically be an encrypted storage scheme, for example, the special monitoring data is encrypted and then uploaded to the blockchain for storage, thereby realizing dynamic and secure storage of network data of different power equipment, and improving the flexibility and reliability of secure storage of network data of different power equipment.

[0070] It should be noted that by performing data analysis on the problem impact index and dynamically marking the power equipment, as well as dynamically storing routine monitoring data and special monitoring data, it is possible to implement targeted data processing and reliable status analysis and management for individual power equipment with network anomalies.

[0071] In an embodiment of the present invention, by implementing early warning supervision reliability analysis on the power equipment with network anomalies, and adaptively and dynamically and securely storing the monitoring data corresponding to the single power equipment with network anomalies based on the analysis results, the diversity of network security monitoring processing and data security processing and storage of the single power equipment with network anomalies is achieved.

[0072] Specifically, the overall supervision module is used to:

[0073] All power equipment with network anomalies are sorted according to the time when the network anomaly first occurred, the monitoring data of all power equipment are obtained in sequence, and the screening necessity analysis is carried out on the monitoring data corresponding to all sorted power equipment in turn, and the type analysis of the monitoring data corresponding to different power equipment is carried out, including:

[0074] If the monitoring data corresponding to the electric power equipment is conventional monitoring data, an unnecessary instruction is generated and the corresponding electric power equipment is removed from the sorted electric power equipment data;

[0075] It can be understood that unnecessary instructions indicate that all network anomalies occurring in the corresponding power equipment have been properly warned and processed, and no new network anomaly types have occurred;

[0076] If the monitoring data corresponding to the power equipment is special monitoring data, necessary instructions are generated and the power equipment to which it belongs is marked as a target device, and abnormal impact processing analysis of different dimensions is performed on the target device, and the behavior monitoring processing sequence corresponding to the target device is traversed to obtain, and the active warning index and active processing index of the target device are calculated by the second preset formula; the second preset formula is:

[0077]

[0078] Where, k=1 or 2; JC1 and JC2 are the active warning index (i.e., the local processing influence index in the active warning dimension) and active processing index (i.e., the local processing influence index in the active processing dimension) of the target device respectively; N11 and N12 are the total number of warning reliable identifications with a value of 1 and the total number of processing reliable identifications with a value of 1 respectively; N21 and N22 are the total number of warning reliable identifications with a value of 2 and the total number of processing reliable identifications with a value of 2 respectively; N1 and N2 are the total number of all warning reliable identifications and the total number of all processing reliable identifications respectively; η is the weight coefficient, and η>1; [ ] is the rounding function;

[0079] It should be noted that the local processing impact index is used to digitally represent the local processing impact of different power equipment corresponding to the active warning dimension and active processing dimension; the larger the local processing impact index, the worse the local processing impact of the corresponding dimension.

[0080] The overall processing impact index of the target device is calculated by a third preset formula; the third preset formula is:

[0081]

[0082]

[0083] Where ZC is the overall processing impact index; Zwyj is the problem impact index of target device j; m is the number of target devices; A is the preset standard value; is an intermediate parameter; it can be understood that j = 1, 2, 3, ..., m; m is a positive integer; A is a preset standard value of the overall processing impact, which is determined according to the application design requirement data of the actual application scenario, and can also be determined according to the median value of all overall processing impact indices that have appeared in the history of the same power equipment in the industry.

[0084] It should be noted that the overall processing impact index is used to integrate and calculate the network anomaly processing data of all dimensions of different power equipment to digitally represent its overall processing impact; the larger the overall processing impact index, the worse the overall processing impact of the corresponding power equipment.

[0085] Furthermore, when targeted optimization management is performed on the early warning scheme and the processing scheme of the target device according to the local processing impact index and the overall processing impact index, the overall processing impact index corresponding to different target devices is analyzed in turn.

[0086] If ZC>1, the early warning plan and processing plan of the target equipment are optimized;

[0087] If ZC≤1, data analysis is performed based on the active warning index and active processing index corresponding to the warning scheme and processing scheme of the target device;

[0088] It can be understood that in the embodiment of the present invention, data analysis and dynamic optimization management are first performed on the overall reliability status corresponding to the early warning scheme and the treatment scheme from the overall dimension of the power equipment, and reliable analysis data support can also be provided for the subsequent local reliability status data analysis and dynamic optimization management in different local dimensions.

[0089] If JC1>1 and / or JC2>1, the early warning scheme and / or processing scheme of the corresponding target device is optimized; if JC1≤1 and / or JC2≤1, the early warning scheme and / or processing scheme of the corresponding target device is not optimized.

[0090] It should be noted that, for optimized management, a number of new early warning identification indicators and a number of processing identification indicators and their corresponding solutions can be added on the basis of the existing early warning schemes and processing schemes. The new different indicators can be determined by professional operation and maintenance personnel in this field based on experience and existing network anomaly big data.

[0091] In the prior art, a periodic fixed operation and maintenance plan is implemented for the network operation and maintenance plan corresponding to different power equipment in the power system, or an irregular random operation and maintenance plan is implemented based on the work experience of professional and technical personnel in this field. This has the problems of poor operation and maintenance targeting and poor operation and maintenance effect.

[0092] In the embodiment of the present invention, by performing abnormal impact processing and analysis in different dimensions on all network security monitoring data occurring in different power equipment, and adaptively performing targeted optimization management on the early warning schemes and processing schemes corresponding to different power equipment based on the analysis results in different dimensions, targeted processing and analysis as well as expanded utilization of different network security supervisions occurring in different power equipment are achieved, thereby improving the data security utilization management effect and network security prevention and control optimization management of different power equipment.

[0093] In addition, the formulas involved in the above are all dimensionless and numerically calculated, and the formulas closest to the actual situation are obtained by simulating a large amount of collected data through simulation software.

[0094] Based on the same inventive concept, another embodiment of the present invention further provides a data security and network security monitoring method, which is applied to the data security and network security monitoring system of the aforementioned embodiment, and the method includes:

[0095] The local supervision module monitors the real-time network security of different power equipment in the power system, and performs early warning supervision reliability analysis on the power equipment with network anomalies to obtain early warning behavior data and processing behavior data, and then obtains early warning reliable identification and processing reliable identification according to the early warning behavior data and processing behavior data, respectively, sorts and combines the early warning reliable identification and processing reliable identification, obtains the behavior monitoring processing sequence corresponding to the power equipment to which it belongs, traverses and analyzes the behavior monitoring processing sequence, obtains monitoring data and saves it; wherein, the early warning reliable identification is used to characterize the reliability of the preset early warning scheme corresponding to the power equipment with network anomalies, and the processing reliable identification is used to characterize the reliability of the preset processing scheme corresponding to the power equipment with network anomalies;

[0096] The overall supervision module performs abnormal impact processing and analysis in different dimensions on the monitoring data of all power equipment with network abnormalities, thereby adaptively optimizing the early warning and processing plans for different power equipment.

[0097] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the embodiments disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A data security and network security monitoring system, characterized in that: It includes a local supervision module and an overall supervision module. The local supervision module is used to monitor the real-time network security of different power equipment in the power system, and perform early warning supervision reliability analysis on the power equipment with network anomalies to obtain early warning reliable identification and processing reliable identification, sort and combine the early warning reliable identification and processing reliable identification to obtain the behavior monitoring processing sequence corresponding to the power equipment, traverse and analyze the behavior monitoring processing sequence, obtain monitoring data and save it; wherein, the early warning reliable identification is used to characterize the reliability of the preset early warning scheme corresponding to the power equipment with network anomalies, and the processing reliable identification is used to characterize the reliability of the preset processing scheme corresponding to the power equipment with network anomalies; The overall supervision module is used to perform abnormal impact processing and analysis of different dimensions on the monitoring data of all power equipment with network abnormalities, so as to adaptively optimize the early warning schemes and processing schemes of different power equipment; The reliability analysis of early warning supervision is performed on the power equipment with network anomalies to obtain the early warning reliability mark and the processing reliability mark, including: Obtain the abnormality occurrence timestamp of the power equipment where the network abnormality occurs, monitor and count the early warning behavior and the processing behavior in the monitoring period before and after the abnormality occurrence timestamp, respectively, obtain the early warning behavior data and the processing behavior data, and input the early warning behavior data and the processing behavior data into the preset early warning supervision reliable identification function, and output the early warning reliable identification and the processing reliable identification respectively; The expression of the early warning supervision reliable identification function is: In the formula, k = 1 or 2; XC1 is the warning reliability mark, XC2 is the treatment reliability mark; X1 is the warning behavior, X2 is the treatment behavior; Xk standardized implementation behavior and effective means that the warning behavior occurs in the previous monitoring period, the treatment behavior occurs in the previous monitoring period or in the later monitoring period, and the problem that occurred is solved; Xk non-standard implementation behavior means that the warning behavior occurs in the later monitoring period, the treatment behavior occurs in the previous monitoring period or in the later monitoring period, but the problem that occurred is not solved; Xk unimplemented behavior means that the warning behavior does not occur and the treatment behavior does not occur.

2. The data security and network security monitoring system according to claim 1, characterized in that: The monitoring data includes regular monitoring data and special monitoring data.

3. The data security and network security monitoring system according to claim 2 is characterized in that: The traversal analysis of the behavior monitoring processing sequence to obtain and save monitoring data includes: If all the elements in the behavior monitoring processing sequence are 0, the corresponding power equipment will be marked as conventional problem power equipment, and the warning behavior data, processing behavior data, and behavior monitoring processing sequence corresponding to the conventional problem power equipment will be sorted and combined to obtain conventional monitoring data and save it through a conventional storage scheme.

4. The data security and network security monitoring system according to claim 2 is characterized in that: The traversal analysis of the behavior monitoring processing sequence to obtain and save monitoring data includes: If there are non-zero elements in the behavior monitoring processing sequence, the problem impact index corresponding to the corresponding power equipment is calculated for the non-zero elements in the behavior monitoring processing sequence by a first preset formula; the first preset formula is: In the formula, Zwy is the problem impact index; YB and CB are the warning reliability identification values ​​and processing reliability identification values ​​respectively; α and β are different weight coefficients and are both greater than 0; The power equipment is marked according to the problem impact index, and the marks, warning behavior data, processing behavior data, behavior monitoring processing sequence, and problem impact index corresponding to the power equipment are sorted and combined to obtain special monitoring data and save them through a special saving scheme.

5. The data security and network security monitoring system according to claim 4, characterized in that: The step of marking the corresponding electric power equipment according to the problem impact index includes: if , then the corresponding power equipment is marked as power equipment with mild special problems; if , the corresponding power equipment will be marked as power equipment with severe special problems.

6. The data security and network security monitoring system according to claim 5, characterized in that: The overall supervision module is specifically used for: All power equipment with network anomalies are sorted according to the time when the network anomaly first occurred, and the monitoring data of all power equipment are obtained in sequence; If the monitoring data corresponding to the power equipment is conventional monitoring data, the corresponding power equipment will be eliminated; If the monitoring data corresponding to the electric power equipment is special monitoring data, the electric power equipment is marked as a target equipment, and the active warning index and active processing index of the target equipment are calculated by the second preset formula, and the overall processing impact index of the target equipment is calculated by the third preset formula; The second preset formula is: Where, k=1 or 2; JC1 and JC2 are the active warning index and active processing index of the target device respectively; N11 and N12 are the total number of warning reliable identifications with a value of 1 and the total number of processing reliable identifications with a value of 1 respectively; N21 and N22 are the total number of warning reliable identifications with a value of 2 and the total number of processing reliable identifications with a value of 2 respectively; N1 and N2 are the total number of all warning reliable identifications and the total number of all processing reliable identifications respectively; η is the weight coefficient, and η>1; [ ] is the rounding function; The third preset formula is: Where ZC is the overall processing impact index; Zwyj is the problem impact index of target device j; m is the number of target devices; A is the preset standard value; is the intermediate parameter; If ZC>1, the early warning plan and processing plan of the target equipment are optimized; If ZC≤1 and JC1>1, the early warning plan of the target equipment is optimized; If ZC≤1 and JC2>1, the processing scheme of the corresponding target device is optimized and managed.

7. A data security and network security monitoring method, characterized in that: Applied to the data security and network security monitoring system according to any one of claims 1 to 6, the method comprises: The local supervision module monitors the real-time network security of different power equipment in the power system, and performs early warning supervision reliability analysis on the power equipment with network anomalies to obtain early warning behavior data and processing behavior data, and then obtains early warning reliable identification and processing reliable identification according to the early warning behavior data and processing behavior data, respectively, sorts and combines the early warning reliable identification and processing reliable identification to obtain the behavior monitoring processing sequence corresponding to the power equipment to which it belongs, traverses and analyzes the behavior monitoring processing sequence, obtains monitoring data and saves it; wherein, the early warning reliable identification is used to characterize the reliability of the preset early warning scheme corresponding to the power equipment with network anomalies, and the processing reliable identification is used to characterize the reliability of the preset processing scheme corresponding to the power equipment with network anomalies; The overall supervision module performs abnormal impact processing and analysis in different dimensions on the monitoring data of all power equipment with network abnormalities, thereby adaptively optimizing the early warning and processing plans for different power equipment.

Images