Power station monitoring system network security protection method

Abstract

The power station monitoring system network security protection method comprises the steps of generating a signal sending threshold value of each device based on current power station operation data; monitoring the signal sending number of each device in a preset monitoring duration; judging whether each device is in a safe state or not based on the signal sending threshold value and the signal sending quantity; performing network security detection on the equipment in the non-security state; and carrying out temporary management and control on the equipment with the threat in the network security detection and generating early warning information. According to the method, the problem that the whole monitoring network is attacked by cracking a certain device is solved, safe operation of the network is protected, meanwhile, the early warning signal is generated and controlled for the device with threats in network safety detection, and stable operation of the power station monitoring system network is further guaranteed.

Description

Technical Field

[0001] The invention belongs to the technical field of monitoring technology and relates to a network security protection method for a power station monitoring system. Background Art

[0002] A power station is a facility responsible for producing electrical energy, including thermal power plants, hydroelectric power plants, wind power plants, solar power plants and other renewable energy power plants.

[0003] The power station monitoring system network is a complex network composed of multiple devices, sensors and control systems, designed to ensure the safe, reliable and economical and efficient operation of the power station. The power station monitoring system network mainly includes the following parts: data acquisition equipment, data transmission equipment, data processing and analysis equipment, control equipment, display equipment, human-computer interaction equipment, etc.

[0004] The security of the power station monitoring system network is very important. The existing technology generally adopts the following methods to ensure security: 1) Network equipment, security equipment, operating systems, database systems, etc. will use two or more identification technologies to authenticate users, ensuring that at least one identification technology is implemented using cryptographic technology, such as: establishing an authentication server and distributing device administrator tokens to implement a two-factor authentication mechanism based on dynamic passwords.

[0005] 2) The network communication channel will build an encrypted transmission channel through a power-specific encryption device, use a digital certificate that meets the required cryptographic algorithm to authenticate the identity of the communication entity, and verify the validity of the device digital certificate.

[0006] 3) Use cryptographic technology to perform secure access authentication on devices connected from the outside to the internal network to ensure the authenticity of the access devices.

[0007] 4) Servers, database management systems, etc. will use cryptographic technology to ensure the integrity of system resource access control information and the integrity and source authenticity of important executable programs.

[0008] 5) Application system operation and maintenance users and business users use two or more identification technologies to authenticate their identities, and ensure that at least one identification technology uses cryptographic technology to ensure the authenticity of the user's identity.

[0009] 6) The application system will use cryptographic technology to protect the integrity of access control information, and use cryptographic technology or cryptographic products to ensure the confidentiality of data transmission. The application system business data will use cryptographic technology or cryptographic products to ensure the confidentiality during the storage process, and use cryptographic technology or cryptographic products to ensure the integrity of important data transmission, and use cryptographic technology or cryptographic products to ensure the integrity of the important data storage process.

[0010] In summary, the existing technology focuses more on how to ensure data security in the monitoring system, but ignores the problem of stable operation of the monitoring system network. Therefore, how to ensure the safe operation of the monitoring system network is a problem to be solved. Summary of the invention

[0011] The technical problem to be solved by the present invention is to provide a network security protection method for a power station monitoring system to achieve network security operation of the monitoring system.

[0012] In order to solve the above technical problems, the technical solution adopted by the present invention is: a network security protection method for a power station monitoring system, comprising the following steps: S1, based on the current unit operation data and the power generation power of the power station, use the signal sending threshold prediction model corresponding to each device to generate the signal sending threshold of each device; monitor the number of signals sent by each device within the preset monitoring time; S1-1, pre-processing of meteorological data and power generation; S1-2, inputting the preprocessed meteorological data and power generation power into the signal transmission threshold prediction model corresponding to each device, respectively, and obtaining the threshold to be verified generated by each signal transmission threshold prediction model; S1-3, verify whether each threshold to be verified is within a preset range; if so, use each threshold to be verified as a signal sending threshold of the corresponding device; S2, judging whether each device is in a safe state based on the signal sending threshold and the signal sending number; judging that the device is in an unsafe state when the signal sending number is greater than the signal sending threshold; S3, performing network security detection on devices in an unsafe state; S4, temporarily controlling the devices that pose a threat to network security detection and generating early warning information; temporarily controlling the devices that pose a threat to network security detection and generating early warning information includes: determining the control and early warning level for the devices that pose a threat to network security detection based on the signal sending threshold and the number of signal sending; temporarily controlling the devices that pose a threat to network security detection based on the control and early warning level and generating early warning information.

[0013] The control and warning levels for devices that pose a threat to network security detection based on the signal sending threshold and the number of signals sent include: when the number of signals sent is 101%-130% of the signal sending threshold, the control and warning level is level three; when the number of signals sent is 131%-150% of the signal sending threshold, the control and warning level is level two; when the number of signals sent is greater than 150% of the signal sending threshold, the control and warning level is level one.

[0014] Based on the control and warning level, temporary control is performed on devices that pose threats to network security detection and warning information is generated, including: when the control and warning level is level three, the device is not controlled, and level three warning information is generated; when the control and warning level is level two, the number of signals sent by the device is controlled according to the threshold, and level two warning information is generated; when the control and warning level is level one, the device is prohibited from sending signals, and level one warning information is generated.

[0015] In S1, monitoring the number of signals sent by each device within a preset monitoring time includes: obtaining preset monitoring frequency and monitoring time information; generating monitoring time based on the preset monitoring frequency and monitoring time information; and collecting the number of signals sent by each device within the monitoring time.

[0016] In S1, using the signal sending threshold prediction model corresponding to the device includes the following steps: SA1, collect historical data of all devices, use correlation analysis tools to calculate the correlation coefficients between devices based on historical data, and generate a correlation matrix; collect historical data of each device, including operating status and sensor data; use correlation analysis tools to analyze correlation coefficients or covariances, and evaluate the correlation between devices based on historical data; SA2, the correlation coefficient between the i-th device and the j-th device in the correlation matrix is ​​calculated by the following formula: ; Where Xi is the data of the i-th device, Xj is the data of the j-th device, corr(Xi, Xj) is the correlation coefficient between Xi and Xj; cov(Xi, Xj) is the covariance of Xi and Xj, var(Xi) and var(Xj) are the variances of Xi and Xj respectively; SA3, using machine learning algorithm to build an initial signal sending threshold prediction model, which introduces the weight of each device for the signal sending threshold of the i-th device; Based on the correlation matrix and historical data between devices, the initial signal sending threshold prediction model is constructed using a machine learning algorithm so that the generated signal sending threshold can fully reflect the correlation between devices; the machine learning algorithm includes regression analysis and neural network; the initial signal sending threshold prediction model of the i-th device is as follows: ; Wherein, Thresholdi is the signal sending threshold of the i-th device, and Wij is the weight of the j-th device to the signal sending threshold of the i-th device.

[0017] According to the correlation between each device and the i-th device, the influence of each related device on the signal sending threshold is determined, and the above weights are adjusted; through the above weight adjustment mechanism, the device with a higher correlation with the i-th device has a greater influence; The weight Wij of the signal sending threshold of the j-th device and the i-th device is adjusted by the following formula; ; Where Wij is the weight of the signal sending threshold of the j-th device to the i-th device, corr weight is the conversion function of correlation strength to weight, and f(Temperature, Vibration, …) is a complex function of temperature and vibration factors; Continuously collect data from each device and adjust the corresponding weights in a timely manner according to data changes; establish a real-time monitoring system to continuously monitor the status of each device and data changes; when the data changes exceed a certain range, instantly adjust the corresponding weights according to the new data; monitor the application effect of the signal sending threshold, and optimize and adjust the signal sending threshold prediction model according to the application effect; the application effect is characterized by various pre-established evaluation indicators, including the misjudgment rate, and the accuracy, stability and reliability of the method are further improved through optimization and adjustment.

[0018] The process of optimizing and adjusting the signal sending threshold prediction model according to the false positive rate specifically includes: The first step is to define the objective function. The false positive rate is calculated by calculating the ratio of the number of falsely positive and negative examples to the total number of samples. The objective function is defined as the false positive rate, expressed as Error_Rate, and its calculation formula is: ; Among them, FalsePositive is the number of samples that are mistakenly judged as positive but are actually negative, FalseNegative is the number of samples that are mistakenly judged as negative but are actually positive, and TotalSamples is the total number of samples; The second step is to determine the optimization algorithm, and choose gradient descent, genetic algorithm, or particle swarm optimization to minimize the misjudgment rate; The third step is to establish an optimization model, associate the objective function ErrorRate with the parameters or variables in the signal sending threshold prediction model, and establish an optimization model, that is, to use the parameters or variables of the signal sending threshold prediction model as the independent variables of the optimization problem, and use the error rate as the objective function; The fourth step is to set the initial parameters, which provide the initial parameters or variable values ​​for the optimization model based on historical data or experience, and to start the iterative process of the optimization model; The fifth step is to execute the optimization algorithm and use the optimization model to optimize the objective function to reduce the misjudgment rate; The sixth step is convergence judgment. Set a convergence condition, that is, stop the optimization when the change of the objective function value is less than a certain threshold or the number of iterations reaches a certain value, monitor the convergence of the optimization model, and judge whether the condition for stopping optimization is met; The seventh step is to apply the optimization result, apply the optimized parameters and / or variables to the signal sending threshold prediction model, and update the signal sending threshold prediction model.

[0019] The security protection system of the network security protection method of the power station monitoring system as described above includes a data monitoring unit, a judgment unit, a security monitoring unit, and a temporary control and early warning information generation unit which are sequentially connected to a threshold generation unit; the threshold generation unit generates a signal sending threshold for each device based on the current unit operation data and the power generation power of the power station using a signal sending threshold prediction model corresponding to each device; the data monitoring unit is used to monitor the number of signals sent by each device in a preset time period; the judgment unit determines whether each device is in a safe state based on the signal sending threshold and the number of signals sent; the security monitoring unit performs network security detection on devices in an unsafe state; the temporary control and early warning information generation unit performs temporary control on devices where network security detection poses a threat and generates early warning information.

[0020] The electronic device of the power plant monitoring system network security protection method as described above includes at least one processor; and a memory communicatively connected to at least one processor; wherein the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor so that at least one processor can execute the power plant monitoring system network security protection method.

[0021] The computer-readable storage medium of the power plant monitoring system network security protection method as described above stores computer instructions, and the computer instructions are used to enable a computer to execute the power plant monitoring system network security protection method.

[0022] The main beneficial effects of the present invention are: By monitoring the number of signals sent by each device and the signal sending threshold generated according to the operating data, it is determined whether the device is suspected of being hacked (i.e., in an unsafe state), and then further network security detection is performed on the suspected hacked device, and finally temporary control and early warning information are generated for the device that is threatened according to the network security detection. The above scheme not only conducts preliminary screening based on whether the device is in a safe state, and then conducts network security detection, avoiding large-scale inefficient network security detection, but also solves the problem of attacking the entire monitoring network by hacking a certain device, protecting the network's secure operation, and at the same time generates early warning signals and controls the devices that are threatened by network security detection, further ensuring the stable operation of the power station monitoring system network.

[0023] By using the signal sending threshold prediction model in combination with the unit operation data and power generation power, the signal sending threshold can be dynamically determined, so as to facilitate the intelligent management and control of each device in combination with different operating conditions.

[0024] Devices that pose a threat to network security detection are rated based on the signal sending threshold and the number of signals sent, and different levels are handled in different ways, thereby avoiding the overall impact of directly shutting down a device on the power station.

[0025] The control and warning levels are further determined by the ratio of the number of signals sent to the signal sending threshold, and different control measures and warning information are implemented according to different warning levels, so as to set different warning levels for different situations. This is conducive to rapid response when a security incident actually occurs and improves the efficiency of emergency rescue. At the same time, the investment of security resources can be flexibly adjusted according to actual conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0027] Figure 1 The present invention is a flow chart of the method.

[0028] Figure 2 This is a diagram of the network security protection system of the present invention.

[0029] Figure 3 It is a schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0030] like Figure 1~Figure 3 A network security protection method for a power station monitoring system is provided. Embodiment 1, In a first aspect, the embodiments of the present disclosure provide a network security protection method for a power station monitoring system, which is applied to a power station network security protection device and adopts the following technical solutions: Based on the current unit operation data and the power generation power of the power station, the signal sending threshold prediction model corresponding to each device is used to generate the signal sending threshold of each device; the number of signal sending of each device within the preset monitoring time is monitored; Determining whether each device is in a safe state based on the signal sending threshold and the signal sending quantity; Conduct network security testing on devices in an unsafe state; Temporarily control devices that pose threats to network security and generate early warning information.

[0031] As an optional implementation, the generating of the signal transmission threshold of each device using the signal transmission threshold prediction model corresponding to each device based on the current meteorological data and the power generation power of the power station includes: Preprocessing the meteorological data and the generated power; Inputting the preprocessed meteorological data and the generated power into the signal transmission threshold prediction model corresponding to each device, respectively, to obtain the threshold to be verified generated by each signal transmission threshold prediction model; Verify respectively whether each threshold to be verified is within a preset range; If so, each threshold to be verified is used as the signal sending threshold of the corresponding device.

[0032] As an optional implementation manner, judging whether each device is in a safe state based on the signal sending threshold and the signal sending quantity includes: When the signal sending number is greater than the signal sending threshold, it is determined that the device is in an unsafe state.

[0033] As an optional implementation method, temporarily controlling devices with threats in network security detection and generating early warning information includes: Determine the control and early warning level for the device posing a threat to network security detection based on the signal sending threshold and the signal sending quantity; Based on the control and warning levels, temporary control is performed on devices that are detected to be threatening in network security and warning information is generated.

[0034] As an optional implementation manner, determining the control and warning level of the device posing a threat to network security detection based on the signal sending threshold and the signal sending quantity includes: When the number of signal transmissions is 101%-130% of the signal transmission threshold, the control and early warning level is level three; When the number of signal transmissions is 131%-150% of the signal transmission threshold, the control and warning level is level 2; When the number of signals sent is greater than 150% of the signal sending threshold, the control and warning level is level one.

[0035] As an optional implementation, temporarily controlling the device with a threat in network security detection based on the control and warning level and generating warning information includes: When the control and warning level is level three, the device is not controlled, and a level three warning message is generated; When the control and warning level is level 2, the number of signal transmissions of the control device is controlled according to the threshold, and level 2 warning information is generated at the same time; When the control and warning level is level one, the device is prohibited from sending signals and a level one warning message is generated.

[0036] As an optional implementation, monitoring the number of signals sent by each device within a preset monitoring time period includes: Get the preset monitoring frequency and monitoring duration information; Generate monitoring time based on the preset monitoring frequency and monitoring duration information; Collect the number of signals sent by each device during the monitoring time.

[0037] In a second aspect, an embodiment of the present disclosure further provides a power station monitoring system network security protection system, including: The threshold generation and data monitoring unit generates the signal transmission threshold of each device using the signal transmission threshold prediction model corresponding to each device based on the current unit operation data and the power generation power of the power station; monitors the number of signals sent by each device in a preset time period; A judging unit, for judging whether each device is in a safe state based on the signal sending threshold and the signal sending quantity; Security monitoring unit, which performs network security detection on devices in an unsafe state; The temporary control and warning information generation unit temporarily controls the devices that have threats in network security detection and generates warning information.

[0038] In a third aspect, the present disclosure also provides an electronic device, which adopts the following technical solution: The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the power plant monitoring system network security protection method described above.

[0039] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the power plant monitoring system network security protection method described above.

[0040] Embodiment 2, A power station is a facility responsible for producing electrical energy, including thermal power plants, hydroelectric power plants, wind power plants, solar power plants and other renewable energy power plants.

[0041] The power station monitoring system network is a complex network composed of multiple devices, sensors and control systems, designed to ensure the safe, reliable and economical and efficient operation of the power station. The power station monitoring system network mainly includes the following parts: data acquisition equipment, data transmission equipment, data processing and analysis equipment, control equipment, display equipment, human-computer interaction equipment, etc. Reference Figure 1 The first aspect of the present invention provides a network security protection method for a power station monitoring system, which is applied to power station network security protection equipment, such as firewalls, switches, routers, intrusion prevention systems, bastion hosts, etc., including: Step S1, based on the current unit operation data and the power generation power of the power station, use the signal sending threshold prediction model corresponding to each device to generate the signal sending threshold of each device; monitor the number of signals sent by each device within a preset monitoring time; For example, the unit operation data of a hydroelectric power station includes unit speed, power generation voltage, power generation current, power generation frequency, water level, and flow rate; Specifically, the method of generating the signal transmission threshold of each device using the signal transmission threshold prediction model corresponding to each device based on the current unit operation data and the power generation power of the power station includes: The unit operation data and the power generation are preprocessed; the preprocessing includes: cleaning the data, removing outliers and missing data; standardizing or normalizing the data so that the model can better process data of different scales.

[0042] Inputting the preprocessed unit operation data and the generated power into the signal sending threshold prediction model corresponding to each device, respectively, to obtain the threshold to be verified generated by each signal sending threshold prediction model; Verify respectively whether each threshold to be verified is within a preset range; If so, each threshold to be verified is used as the signal sending threshold of the corresponding device.

[0043] Specifically, each device has a corresponding signal sending threshold prediction model, which is obtained by training with historical data. The historical data used for training includes unit operation data, power generation and the amount of data of sent signals. The model trained based on historical data can generate a signal sending threshold according to the current unit operation data and power generation.

[0044] Since each device in the power station monitoring system is not isolated from each other, and each device has a certain influence on the other, in the embodiment of the present disclosure, the influence between each device can be taken into account in the process of building the model. For example, building a signal transmission threshold prediction model corresponding to the i-th device includes: 1. Collect historical data of all devices, use correlation analysis tools to calculate the correlation coefficients between devices based on historical data, and generate a correlation matrix.

[0045] Specifically, historical data of each device is collected, including operating status, sensor data, etc. Correlation analysis tools, such as correlation coefficient or covariance, are used to evaluate the correlation between each device based on historical data.

[0046] Exemplarily, the correlation coefficient between the i-th device and the j-th device in the correlation matrix is ​​calculated by the following formula: ; Where Xi is the data of the i-th device, Xj is the data of the j-th device, corr(Xi, Xj) is the correlation coefficient between Xi and Xj; cov(Xi, Xj) is the covariance of Xi and Xj, and var(Xi) and var(Xj) are the variances of Xi and Xj, respectively.

[0047] 2. Use machine learning algorithms to build an initial signal sending threshold prediction model, in which the weight of each device for the signal sending threshold of the i-th device is introduced.

[0048] Based on the correlation matrix and historical data between devices, an initial signal sending threshold prediction model is constructed using machine learning algorithms, such as regression analysis and neural networks, so that the generated signal sending threshold can fully reflect the correlation between devices.

[0049] Exemplarily, the initial signal transmission threshold prediction model of the i-th device is as follows:

[0050] Wherein, Thresholdi is the signal sending threshold of the i-th device, and Wij is the weight of the j-th device to the signal sending threshold of the i-th device.

[0051] 3. According to the correlation between each device and the i-th device, determine the influence of each related device on the signal sending threshold and adjust the above weights.

[0052] Through the above weight adjustment mechanism, the device with higher relevance to the i-th device has greater influence.

[0053] Exemplarily, the weight Wij of the signal sending threshold of the j-th device to the i-th device is adjusted by the following formula.

[0054]

[0055] Among them, Wij is the weight of the signal sending threshold of the j-th device to the i-th device, corr weight is the conversion function of correlation strength to weight, and f(Temperature, Vibration, …) is a complex function of multiple factors such as temperature and vibration.

[0056] 4. Continuously collect data from each device and adjust the corresponding weight in time according to data changes.

[0057] In the disclosed embodiment, a real-time monitoring system can be established to continuously monitor and collect the status and data changes of each device. When the data changes exceed a certain range, the corresponding weight is adjusted immediately according to the new data.

[0058] 5. Monitor the application effect of the signal sending threshold, and optimize and adjust the signal sending threshold prediction model according to the application effect.

[0059] The application effect can be characterized by various pre-established evaluation indicators, such as false positive rate, etc. The accuracy, stability and reliability of the method can be further improved through optimization and adjustment.

[0060] Exemplarily, the process of optimizing and adjusting the signal sending threshold prediction model according to the false positive rate specifically includes: a. Define the objective function: The false positive rate is calculated by calculating the ratio of the number of falsely positive and negative examples to the total number of samples. Define the objective function as the false positive rate, expressed as Error_Rate, and its calculation formula is:

[0061] Among them, FalsePositive is the number of samples that are mistakenly judged as positive but are actually negative, FalseNegative is the number of samples that are mistakenly judged as negative but are actually positive, and TotalSamples is the total number of samples.

[0062] b. Determine the optimization algorithm: Select a suitable optimization algorithm such as gradient descent, genetic algorithm, particle swarm optimization, etc. to minimize the misjudgment rate.

[0063] c. Establish an optimization model: Associate the objective function ErrorRate with the parameters or variables in the signal sending threshold prediction model to establish an optimization model, that is, use the parameters or variables of the signal sending threshold prediction model as the independent variables of the optimization problem, and use the misjudgment rate as the objective function.

[0064] d. Set initial parameters: Provide initial parameters or variable values ​​for the optimization model based on historical data or experience to start the iterative process of the optimization model.

[0065] e. Execute optimization algorithm: Use the optimization model to optimize the objective function to reduce the misjudgment rate.

[0066] f. Convergence judgment: Set a convergence condition, such as stopping the optimization when the change in the objective function value is less than a certain threshold or the number of iterations reaches a certain value, monitor the convergence of the optimization model, and judge whether the conditions for stopping the optimization are met.

[0067] g. Apply optimization results: apply the optimized parameters and / or variables to the signal sending threshold prediction model to update the signal sending threshold prediction model.

[0068] This step uses the signal sending threshold prediction model combined with the unit operation data and power generation power to dynamically determine the signal sending threshold, so as to facilitate intelligent management and control of various equipment in combination with different operating conditions.

[0069] Specifically, the monitoring of the number of signals sent by each device within a preset monitoring time period includes: Get the preset monitoring frequency and monitoring duration information; monitoring frequency specifically refers to how often monitoring is performed, for example, once every hour, once every 2 hours, once every 6 hours, or once a day, etc. Monitoring duration refers to the duration of each monitoring, for example, 5 minutes each time, 10 minutes each time, 30 minutes each time, 1 hour each time, etc.

[0070] Specifically, obtaining the preset monitoring frequency and monitoring duration information includes: Generate monitoring frequency and duration by combining historical cyber attack occurrence time and power generation cycle data; For example, the monitoring frequency at night is more frequent than that during the day, and the monitoring duration is longer. The monitoring frequency in the peak season of power generation is more frequent than that in the off-season, and the monitoring duration is longer.

[0071] The monitoring time is generated based on the preset monitoring frequency and monitoring duration information; the monitoring time here refers to the specific monitoring time period, for example, monitoring from 8:00 to 8:30 on a certain day refers to the time period from 8:00 to 8:30 here.

[0072] The number of signals sent by each device during the monitoring time is collected. For example, the number of signals sent from 8:00 to 8:30 is collected, for example, 324.

[0073] This step generates the monitoring frequency and duration by combining the time of occurrence of historical network attacks and the power generation demand at that time, thereby realizing intelligent adjustment of the monitoring time, collecting the signal transmission amount of each device during the monitoring time, and intelligently optimizing the computing power of the computer while ensuring safety.

[0074] Step S2, judging whether each device is in a safe state based on the signal sending threshold and the signal sending quantity; Specifically, judging whether each device is in a safe state based on the signal sending threshold and the signal sending quantity includes: When the signal sending number is greater than the signal sending threshold, it is determined that the device is in an unsafe state.

[0075] It can be known that the signal sending threshold in this step is obtained according to the previous step, and the signal sending threshold is dynamic.

[0076] Step S3, performing network security detection on the device in the unsafe state; The network security detection here is aimed at: virus, attack, illegal access and other network security detection.

[0077] Step S4: temporarily control the devices that are detected as threatening by network security and generate early warning information.

[0078] Specifically, temporary control of devices with threats in network security detection and generation of early warning information include: Determine the control and early warning level for the device posing a threat to network security detection based on the signal sending threshold and the signal sending quantity; Based on the control and warning levels, temporary control is performed on devices that are detected to be threatening in network security and warning information is generated.

[0079] In this step, the equipment in the unsafe state is rated based on the signal sending threshold and the signal sending quantity, and different levels are handled in different ways, thereby avoiding the impact of directly shutting down a certain equipment on the overall power station.

[0080] In summary, the disclosed embodiments provide a network security protection method for a power station monitoring system, which determines whether a device is suspected of being hacked, i.e., in an unsafe state, by monitoring the number of signals sent by each device and the signal sending threshold generated according to the operating data, and then further performs network security detection on the suspected hacked device, and finally performs temporary management and control on the device that is threatened according to the network security detection and generates early warning information. The above scheme not only performs a preliminary screening based on whether the device is in a safe state, and then performs network security detection, thus avoiding large-scale inefficient network security detection, but also solves the problem of attacking the entire monitoring network by hacking a certain device, thus protecting the network's secure operation, and at the same time generates early warning signals and manages the device that is threatened according to the network security detection, further ensuring the stable operation of the power station monitoring system network.

[0081] As an optional implementation manner, determining the control and warning level of the device posing a threat to network security detection based on the signal sending threshold and the signal sending quantity includes: When the number of signal transmissions is 101%-130% of the signal transmission threshold, the control and early warning level is level three; When the number of signal transmissions is 131%-150% of the signal transmission threshold, the control and warning level is level 2; When the number of signal transmissions is greater than 150% of the signal transmission threshold, the control and warning level is level 1. It can be known that among the warning levels, level 1 is greater than level 2 and greater than level 3.

[0082] As an optional implementation, temporarily controlling the device with a threat in network security detection based on the control and warning level and generating warning information includes: When the control and warning level is level three, the device is not controlled, and a level three warning message is generated; When the control and warning level is level 2, the number of signal transmissions of the control device is controlled according to the threshold, and level 2 warning information is generated at the same time; When the control and warning level is level one, the device is prohibited from sending signals and a level one warning message is generated.

[0083] In this embodiment, the control and warning levels are further determined by the ratio of the number of signals sent to the signal sending threshold, and different control measures and warning information are implemented according to different warning levels, so as to set different warning levels for different situations. This is conducive to rapid response when a security incident actually occurs, improves emergency rescue efficiency, and flexibly adjusts the investment of security resources according to actual conditions.

[0084] On the other hand, refer to Figure 2The present invention provides a network security protection system for a power station monitoring system, comprising: The threshold generation and data monitoring unit generates the signal transmission threshold of each device based on the unit operation data and the power generation power of the power station using the signal transmission threshold prediction model corresponding to each device; monitors the number of signals sent by each device in a preset time period; A judging unit, for judging whether each device is in a safe state based on the signal sending threshold and the signal sending quantity; Safety monitoring unit for equipment in unsafe state; The temporary control and warning information generation unit temporarily controls the devices that have threats in network security detection and generates warning information.

[0085] The disclosed embodiment provides a network security protection system for a power station monitoring system, which determines whether a device is suspected of being hacked, i.e., in an unsafe state, by monitoring the number of signals sent by each device and the signal sending threshold generated according to the operating data, and then further performs network security detection on the suspected hacked device, and finally performs temporary management and control on the device that is threatened according to the network security detection and generates early warning information. The above scheme not only performs a preliminary screening based on whether the device is in a safe state, and then performs network security detection, thus avoiding large-scale inefficient network security detection, but also solves the problem of attacking the entire monitoring network by hacking a certain device, thus protecting the network's secure operation, and at the same time generates early warning signals and manages the device that is threatened according to the network security detection, further ensuring the stable operation of the power station monitoring system network.

[0086] The electronic device according to the embodiment of the present disclosure includes a memory and a processor. The memory is used to store non-temporary computer-readable instructions. Specifically, the memory may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media, such as volatile memory or non-volatile memory. The volatile memory may include, for example, a random access memory RAM or a cache memory cache. The non-volatile memory may include, for example, a read-only memory ROM, a hard disk, a flash memory, etc.

[0087] The processor may be a central processing unit CPU or other forms of processing units with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device to perform desired functions. In one embodiment of the present disclosure, the processor is used to run the computer-readable instructions stored in the memory, so that the electronic device performs all or part of the steps of the power station monitoring system network security protection method of each embodiment of the present disclosure.

[0088] like Figure 3The present invention provides a schematic diagram of the structure of an electronic device according to an embodiment of the present invention, which is suitable for implementing the electronic device in the embodiment of the present invention. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0089] like Figure 3 As shown, the electronic device may include a processor, such as a central processing unit, a graphics processing unit, etc., which can perform various appropriate actions and processes according to a program stored in a read-only memory ROM or a program loaded from a storage device into a random access memory RAM. In the RAM, various programs and data required for the operation of the electronic device are also stored. The processor, ROM and RAM are connected to each other through a bus. The input I / output O interface is also connected to the bus.

[0090] Typically, the following devices can be connected to the I / O interface: input devices such as sensors or visual information acquisition devices; output devices such as display screens; storage devices such as tapes, hard disks, etc.; and communication devices. The communication device can allow the electronic device to communicate with other devices, such as edge computing devices, wirelessly or by wire to exchange data. Figure 3 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0091] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the power station monitoring system network security protection method of the embodiment of the present disclosure are executed.

[0092] For detailed description of this embodiment, reference may be made to the corresponding descriptions in the aforementioned embodiments, which will not be repeated here.

[0093] The computer-readable storage medium according to the embodiment of the present disclosure stores non-transitory computer-readable instructions. When the non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the power station monitoring system network security protection method of each embodiment of the present disclosure are executed.

[0094] The above-mentioned computer-readable storage media include, but are not limited to: optical storage media, such as CD-ROM and DVD, magneto-optical storage media, such as MO, magnetic storage media, such as magnetic tapes or mobile hard disks, media with built-in rewritable non-volatile memory, such as memory cards, and media with built-in ROM, such as ROM boxes.

[0095] The above-mentioned embodiments are only preferred technical solutions of the present invention and should not be regarded as limitations of the present invention. The embodiments and features in the embodiments of the present application can be arbitrarily combined with each other without conflict. The protection scope of the present invention shall be the technical solutions recorded in the claims, including the equivalent replacement solutions of the technical features in the technical solutions recorded in the claims. That is, equivalent replacement improvements within this scope are also within the protection scope of the present invention.

Claims

1. A network security protection method for a power station monitoring system, characterized in that: The steps include: S1, based on the current unit operation data and the power generation power of the power station, use the signal sending threshold prediction model corresponding to each device to generate the signal sending threshold of each device; monitor the number of signals sent by each device within the preset monitoring time; S1-1, pre-processing of meteorological data and power generation; S1-2, inputting the preprocessed meteorological data and power generation power into the signal transmission threshold prediction model corresponding to each device, respectively, and obtaining the threshold to be verified generated by each signal transmission threshold prediction model; S1-3, verify whether each threshold to be verified is within a preset range; if so, use each threshold to be verified as a signal sending threshold of the corresponding device; S2, judging whether each device is in a safe state based on the signal sending threshold and the signal sending number; judging that the device is in an unsafe state when the signal sending number is greater than the signal sending threshold; S3, performing network security detection on devices in an unsafe state; S4, temporarily control the devices that are detected as threats to network security and generate early warning information; Temporarily controlling the devices that pose a threat to network security detection and generating warning information includes: determining the control and warning level of the devices that pose a threat to network security detection based on the signal sending threshold and the signal sending quantity; Based on the control and warning levels, temporary control is performed on devices that are detected to be threatening in network security and warning information is generated.

2. The power station monitoring system network security protection method according to claim 1 is characterized by: The control and warning levels for devices that pose a threat to network security detection based on the signal sending threshold and the number of signals sent include: when the number of signals sent is 101%-130% of the signal sending threshold, the control and warning level is level three; when the number of signals sent is 131%-150% of the signal sending threshold, the control and warning level is level two; when the number of signals sent is greater than 150% of the signal sending threshold, the control and warning level is level one.

3. The power station monitoring system network security protection method according to claim 1 is characterized by: Based on the control and warning level, temporary control is performed on devices that pose threats to network security detection and warning information is generated, including: when the control and warning level is level three, the device is not controlled, and level three warning information is generated; when the control and warning level is level two, the number of signals sent by the device is controlled according to the threshold, and level two warning information is generated; when the control and warning level is level one, the device is prohibited from sending signals, and level one warning information is generated.

4. The power station monitoring system network security protection method according to claim 1 is characterized in that: In S1, monitoring the number of signals sent by each device within a preset monitoring time includes: obtaining preset monitoring frequency and monitoring time information; generating monitoring time based on the preset monitoring frequency and monitoring time information; and collecting the number of signals sent by each device within the monitoring time.

5. The power station monitoring system network security protection method according to claim 1 is characterized in that: In S1, using the signal sending threshold prediction model corresponding to the device includes the following steps: SA1, collect historical data of all devices, use correlation analysis tools to calculate the correlation coefficients between devices based on historical data, and generate a correlation matrix; collect historical data of each device, including operating status and sensor data; use correlation analysis tools to analyze correlation coefficients or covariances, and evaluate the correlation between devices based on historical data; SA2, the correlation coefficient between the i-th device and the j-th device in the correlation matrix is ​​calculated by the following formula: ； Where Xi is the data of the i-th device, Xj is the data of the j-th device, corr(Xi, Xj) is the correlation coefficient between Xi and Xj; cov(Xi, Xj) is the covariance of Xi and Xj, var(Xi) and var(Xj) are the variances of Xi and Xj respectively; SA3, using machine learning algorithm to build an initial signal sending threshold prediction model, which introduces the weight of each device for the signal sending threshold of the i-th device; Based on the correlation matrix and historical data between devices, the initial signal sending threshold prediction model is constructed using a machine learning algorithm so that the generated signal sending threshold can fully reflect the correlation between devices; the machine learning algorithm includes regression analysis and neural network; the initial signal sending threshold prediction model of the i-th device is as follows: ； Wherein, Thresholdi is the signal sending threshold of the i-th device, and Wij is the weight of the j-th device to the signal sending threshold of the i-th device.

6. The power station monitoring system network security protection method according to claim 5 is characterized by: According to the correlation between each device and the i-th device, the influence of each related device on the signal sending threshold is determined, and the above weights are adjusted; through the above weight adjustment mechanism, the device with a higher correlation with the i-th device has a greater influence; The weight Wij of the signal sending threshold of the j-th device and the i-th device is adjusted by the following formula; ； Where Wij is the weight of the signal sending threshold of the j-th device to the i-th device, corr weight is the conversion function of correlation strength to weight, and f(Temperature, Vibration, …) is a complex function of temperature and vibration factors; Continuously collect data from each device and adjust the corresponding weights in a timely manner according to data changes; establish a real-time monitoring system to continuously monitor the status of each device and data changes; when the data changes exceed a certain range, instantly adjust the corresponding weights according to the new data; monitor the application effect of the signal sending threshold, and optimize and adjust the signal sending threshold prediction model according to the application effect; the application effect is characterized by various pre-established evaluation indicators, including the misjudgment rate, and the accuracy, stability and reliability of the method are further improved through optimization and adjustment.

7. The power station monitoring system network security protection method according to claim 6 is characterized by: The process of optimizing and adjusting the signal sending threshold prediction model according to the false positive rate specifically includes: The first step is to define the objective function. The error rate is calculated by calculating the ratio of the number of falsely positive and negative examples to the total number of samples. The objective function is defined as the error rate, expressed as (Error_Rate), and its calculation formula is: ； Among them, FalsePositive is the number of samples that are mistakenly judged as positive but are actually negative, FalseNegative is the number of samples that are mistakenly judged as negative but are actually positive, and TotalSamples is the total number of samples; The second step is to determine the optimization algorithm, and choose gradient descent, genetic algorithm, or particle swarm optimization to minimize the misjudgment rate; The third step is to establish an optimization model, associate the objective function ErrorRate with the parameters or variables in the signal sending threshold prediction model, and establish an optimization model, that is, to use the parameters or variables of the signal sending threshold prediction model as the independent variables of the optimization problem, and use the error rate as the objective function; The fourth step is to set the initial parameters, which provide the initial parameters or variable values ​​for the optimization model based on historical data or experience, and to start the iterative process of the optimization model; The fifth step is to execute the optimization algorithm and use the optimization model to optimize the objective function to reduce the misjudgment rate; The sixth step is convergence judgment. Set a convergence condition, that is, stop the optimization when the change of the objective function value is less than a certain threshold or the number of iterations reaches a certain value, monitor the convergence of the optimization model, and judge whether the condition for stopping optimization is met; The seventh step is to apply the optimization result, apply the optimized parameters and / or variables to the signal sending threshold prediction model, and update the signal sending threshold prediction model.

8. The security protection system of the power station monitoring system network security protection method according to any one of claims 1 to 7, characterized in that: It includes a data monitoring unit, a judgment unit, a safety monitoring unit, and a temporary control and early warning information generation unit connected in sequence to the threshold generation unit; the threshold generation unit generates the signal transmission threshold of each device based on the current unit operation data and the power generation power of the power station using the signal transmission threshold prediction model corresponding to each device; the data monitoring unit is used to monitor the number of signals sent by each device in a preset time period; The judging unit judges whether each device is in a safe state based on the signal sending threshold and the signal sending quantity; The security monitoring unit performs network security detection on devices in an unsafe state; The temporary control and warning information generation unit temporarily controls the devices that are threatened by network security detection and generates warning information.

9. The electronic device of the power station monitoring system network security protection method according to any one of claims 1 to 7, characterized in that: The method comprises at least one processor; and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network security protection method of the power station monitoring system.

10. The computer-readable storage medium of the power station monitoring system network security protection method according to any one of claims 1 to 7, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute a power station monitoring system network security protection method.

Images