Power monitoring system network asset fingerprint construction and asset identification method

Abstract

The invention discloses a power monitoring system network asset fingerprint construction and asset identification method, and belongs to the technical field of power monitoring system network asset management. A more comprehensive and more stable power monitoring system network asset fingerprint construction and asset identification method is provided through a power monitoring system network asset fingerprint extraction index system construction method, a power monitoring system network asset fingerprint database construction method and a power monitoring system network asset identification method. The problems that a power monitoring system network asset fingerprint extraction index system does not have a unified specification, a network asset fingerprint database cannot be automatically updated, and a network asset identification technology based on active detection does not meet the system stability requirement are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network asset management of electric power monitoring systems, and in particular relates to a method for constructing a network asset fingerprint and identifying an asset of an electric power monitoring system. Background Art

[0002] As the "nerve center" of power industry production, the power monitoring system is the core component of the key information infrastructure of the power system. With the continuous development and application of information technology, the power monitoring system has gradually developed in the direction of networking and intelligence, and network asset management has become a key link to ensure the safe and stable operation of the system. At present, the number of cyberspace assets in the power monitoring system is large, the models are different, and the data is multi-source and heterogeneous. How to efficiently manage large-scale network assets faces the following problems:

[0003] (1) At present, there is no unified standard for the asset fingerprint extraction index system in the process of network asset identification in the power monitoring system. The lack of a unified and standardized index system makes it difficult to construct asset fingerprints, and it is impossible to effectively extract representative and unique fingerprint information, which reduces the accuracy and reliability of asset identification.

[0004] (2) The network asset fingerprint database of the power monitoring system cannot be automatically updated. Manual management requires a lot of manpower and material resources to collect, organize and update fingerprint information, which cannot keep up with the speed of dynamic changes in asset information, affecting the system's real-time monitoring and management of asset status.

[0005] (3) Network asset identification technology based on active detection has certain defects. Active detection can only obtain the asset status at the time of detection, but cannot achieve continuous detection and identification. It will also affect the stability of system operation and does not meet the stability requirements of the power monitoring system. Summary of the invention

[0006] The technical problem to be solved by the present invention is: to provide a method for constructing a network asset fingerprint and identifying an asset in a power monitoring system, so as to overcome the problems that the network asset fingerprint extraction index system of the power monitoring system has no unified specification, the network asset fingerprint library cannot be automatically updated, and the network asset identification technology based on active detection does not meet the system stability requirements.

[0007] A method for constructing a network asset fingerprint and identifying an asset in a power monitoring system comprises the following steps:

[0008] Step 1: Construct a network asset fingerprint extraction index system for the power monitoring system;

[0009] Step 2: Build a power monitoring network asset fingerprint library;

[0010] Step 3: Collect the communication traffic of unknown network assets, compare them with the network asset fingerprints in the power monitoring network asset fingerprint library, and calculate the unknown network asset fingerprint F′ and the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF. g The fingerprint similarity R g :Sort the fingerprint similarities of all network assets in descending order to obtain the maximum similarity R:

[0011] R=max(R 1 , R 2 , …, R n )

[0012] According to R, the identification result D of the unknown network asset is determined as follows:

[0013]

[0014] When R≥0.9, it is determined that the unknown network asset is identified successfully, and the unknown network asset is the same or similar network asset as the known network asset. When R<0.9, it is determined that the unknown network asset identification fails, and the unknown network asset fingerprint F′ is added to the network asset fingerprint library AF of the power monitoring system to realize automatic update of the network asset fingerprint library.

[0015] The criterion tuple of the power monitoring system network asset fingerprint extraction index system in step 1 includes stability b 1 、Security 2 , distinguishabilityb 3 And scalability 4 ; The power monitoring system network includes m asset fingerprint indicators, and the asset fingerprint extraction indicator scheme tuples are represented as a 1 , a 2 , …, a m ;

[0016] b in the criteria tuple 1 , b 2 , b 3 , b 4 Perform importance comparison, and the importance comparison result is obtained through c jk Indicates, where j = 1, 2, 3, 4; k = 1, 2, 3, 4;

[0017] Establish the importance criterion discriminant matrix A c :

[0018]

[0019] By using the importance criterion discriminant matrix A c Perform normalization processing to obtain the normalized importance criterion discriminant matrix A c ′:

[0020]

[0021] Calculate b 1 , b 2 , b 3 , b 4 The importance weight ω b1 ,ω b2 ,ω b3 ,ω b4 :

[0022]

[0023] For a in the asset fingerprint indicator scheme tuple 1 , a 2 , …, a m The stability, security, distinguishability, and scalability of the . hi , Safety comparison results Se hi , the distinguishability comparison result Di hi , scalability comparison resultsEx hi , where h = 1, 2, ..., m; i = 1, 2, ..., m;

[0024] Establish the stability criterion discriminant matrix A St :

[0025] Security criteria discriminant matrix A Se :

[0026] Distinguishability criterion discriminant matrix A Di :

[0027] Scalability criterion discriminant matrix A Ex :

[0028] For the stability criterion discriminant matrix A St , safety criteria discriminant matrix A Se , discriminability criterion discriminant matrix A Di , scalability criterion discriminant matrix A Ex Perform normalization processing,

[0029] Get the normalized stability criterion discriminant matrix A′ St :

[0030] Normalized security criterion discriminant matrix A′ Se :

[0031] Normalized distinguishability criterion discriminant matrix A′ Di :

[0032] Normalized scalability criterion discriminant matrix A′ Ex :

[0033] Calculate a 1 , a 2 , …, a m The stability weight ω St1 ,ω St2 ,…,ω Stm , safety weight ω Se1 ,ω Se2 ,…,ω Sem , distinguishability weight ω Di1 ,ω Di2 ,…,ω Dim , scalability weight ω Ex1 ,ω Ex2 ,…,ω Exm :

[0034]

[0035] For a 1 , a 2 , …, a m The comprehensive weight is calculated as:

[0036] ω ah =(ω b1 ×ω Sth +ω b2 ×ω Seh +ω b3 ×ω Dih +ω b4 ×ω Exh )×T(x),h=1,2,…,m

[0037] Where T(x) is the asset detection function,

[0038]

[0039] Yes a1 ,ω a2 ,…,ω am The network asset information corresponding to the first 10 items is set as the network asset fingerprint extraction index for constructing the power monitoring system, and is defined as I 1 , I 2 ,…,I 10 .

[0040] The method for establishing the power monitoring network asset fingerprint library in step 2 is as follows:

[0041] The network traffic collection tool Wireshark is used to collect and analyze the communication traffic in the power monitoring system network environment to form raw data traffic. Assuming that the power monitoring system network has n network assets, the corresponding indicator I in each network asset information is extracted from the raw data traffic. 1 , I 2 ,…,I 10 The value of f 1 , f 2 , …, f 10 Generate the network asset fingerprint of the power monitoring system. The g-th network asset fingerprint can be expressed as: F g =[f 1g , f 2g , …, f 10g ], g = 1, 2, ..., n, where f 1g , f 2g , …, f 10g is the corresponding index I of the g-th network asset 1 , I 2 ,…,I 10 The value of all n network assets builds the power monitoring system network asset fingerprint library AF = [F 1 , F 2 , …, F n ].

[0042] The unknown network asset fingerprint F′ in step 3 is compared with the g-th network asset fingerprint F in the network asset fingerprint library AF of the power monitoring system. g The fingerprint similarity R g The calculation method is:

[0043] Collect the communication traffic of unknown network assets and extract the corresponding indicators I from the asset information 1 , I 2 ,…,I 10 The value of f 1 ′,f 2 ′,…,f 1 ' 0 Generate unknown network asset fingerprint F′=[f 1 ′,f 2 ′,…,f 1 ' 0 ];

[0044] Compare the unknown network asset fingerprint F′ with the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF. g To compare, first replace f in F′ 1 ′,f 2 ′,…,f1 ' 0 Each character is converted into an 8-bit binary number corresponding to the ASCII code value to form a fingerprint vector of the unknown network asset. Then F g f 1g , f 2g , …, f 10g Each character is converted into an 8-bit binary number corresponding to the ASCII code value, forming the g-th network asset fingerprint vector of the power monitoring system

[0045] A u and B gu They are and , calculate the unknown network asset fingerprint F′ and the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF g The fingerprint similarity R g :

[0046]

[0047] Through the above-mentioned design scheme, the present invention can bring the following beneficial effects: a method for constructing a network asset fingerprint and identifying an asset of a power monitoring system, through a method for constructing a network asset fingerprint extraction indicator system of a power monitoring system, a method for constructing a network asset fingerprint library of a power monitoring system, and a method for identifying a network asset of a power monitoring system, a more comprehensive and stable method for constructing a network asset fingerprint and identifying an asset of a power monitoring system is provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] The present invention is further described below with reference to the accompanying drawings and specific embodiments:

[0049] Figure 1 The present invention is a flowchart of a method for constructing a network asset fingerprint and identifying an asset in a power monitoring system. DETAILED DESCRIPTION

[0050] The present invention provides a method for constructing a network asset fingerprint and identifying an asset in a power monitoring system. Figure 1 As shown, the optimization is achieved by the following technical solutions:

[0051] (1) Construction method of network asset fingerprint extraction index system for power monitoring system;

[0052] In order to construct the network asset fingerprint extraction index system of the power monitoring system, the stability b 1 、Security 2 , distinguishabilityb 3 , Scalability 4Assume that the power monitoring system network has a total of m asset fingerprint indicators, and the asset fingerprint extraction indicator scheme tuples are represented as a 1 , a 2 , …, a m , firstly, b in the criterion tuple 1 , b 2 , b 3 , b 4 Perform importance comparison, the importance comparison result c jk It can be expressed as:

[0053]

[0054] From this we can get the importance criterion discriminant matrix A c :

[0055]

[0056] According to formula (3), the importance criterion discriminant matrix A c After normalization, the normalized importance criterion discriminant matrix A shown in formula (4) is obtained: c ′:

[0057]

[0058] Among them, Sum k is the importance criterion discriminant matrix A c The sum of the elements in the kth column, and then calculate b respectively 1 , b 2 , b 3 , b 4 The importance weight ω b1 ,ω b2 ,ω b3 ,ω b4 :

[0059]

[0060] For a in the asset fingerprint indicator scheme tuple 1 , a 2 , …, a m The stability, security, distinguishability, and scalability of are compared respectively, and the comparison results can be expressed as:

[0061]

[0062] Among them, St hi is the stability comparison result, Se hi For the safety comparison results, Di hi is the distinguishability comparison result, Ex hiis the scalability comparison result, from which we can get the stability criterion discriminant matrix A St , safety criteria discriminant matrix A Se , discriminability criterion discriminant matrix A Di , Scalability criterion discriminant matrix A Ex :

[0063]

[0064]

[0065] According to formula (11), the stability criterion discriminant matrix A St , safety criteria discriminant matrix A Se , discriminability criterion discriminant matrix A Di , Scalability criterion discriminant matrix A Ex After normalization, the normalized stability criterion discriminant matrix A′ shown in formula (12) to formula (15) is obtained: St , Normalized security criterion discriminant matrix A′ Se , Normalized distinguishability criterion discriminant matrix A′ Di , Normalized scalability criterion discriminant matrix A′ Ex :

[0066]

[0067]

[0068] Where Sum i1 、Sum i2 、Sum i3 、Sum i4 A St , A Se , A Di , A Ex The sum of the elements in the i-th column, and then calculate a 1 , a 2 , …, a m The stability weight ω St1 ,ω St2 ,…,ω Stm , safety weight ω Se1 ,ω Se2 ,…,ω Sem , distinguishability weight ω Di1 ,ω Di2 ,…,ω Dim , scalability weight ω Ex1 ,ω Ex2 ,…,ω Exm :

[0069]

[0070] For a 1 , a 2 , …, a m The comprehensive weight is calculated as follows:

[0071] ω ah =(ω b1 ×ω Sth +ω b2 ×ω Seh +ω b3 ×ω Dih +ω b4 ×ω Exh )×T(x), h=1, 2,…, m(17)

[0072] The expression of the asset detection function T(x) is defined as:

[0073]

[0074] Yes a1 ,ω a2 ,…,ω am The network asset information corresponding to the first 10 items is used as the network asset fingerprint extraction index for constructing the power monitoring system, and is defined as I 1 , I 2 ,…,I 10 ;

[0075] (2) Method for constructing a network asset fingerprint database for power monitoring systems;

[0076] The network traffic collection tool Wireshark is used to collect and analyze the communication traffic in the power monitoring system network environment to form raw data traffic. Assuming that the power monitoring system network has n network assets, the corresponding indicator I in each network asset information is extracted from the raw data traffic. 1 , I 2 ,…,I 10 The value of f 1 , f 2 , …, f 10 Generate the network asset fingerprint of the power monitoring system. The g-th network asset fingerprint can be expressed as: F g =[f 1g , f 2g , …, f 10g ], g = 1, 2, ..., n, where f 1g , f 2g , …, f 10g is the corresponding index I of the g-th network asset 1 , I 2 ,…,I10 The value of all n network assets builds the power monitoring system network asset fingerprint library AF = [F 1 , F 2 , …, F n ];

[0077] (3) Network asset identification method for power monitoring system;

[0078] When an unknown network asset is discovered, the communication traffic of the unknown network asset is collected and the corresponding indicator I in the asset information is extracted from it. 1 , I 2 ,…,I 10 The value of f 1 ′,f 2 ′,…,f 1 ' 0 Generate unknown network asset fingerprint F′=[f 1 ′,f 2 ′,…,f 1 ' 0 ];

[0079] Compare the unknown network asset fingerprint F′ with the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF. g To compare, first replace f in F′ 1 ′,f 2 ′,…,f 1 ' 0 Each character is converted into an 8-bit binary number corresponding to the ASCII code value to form a fingerprint vector of the unknown network asset. Then F g f 1g , f 2g , …, f 10g Each character is converted into an 8-bit binary number corresponding to the ASCII code value, forming the g-th network asset fingerprint vector of the power monitoring system

[0080] Assumption A u and B gu They are and , calculate the unknown network asset fingerprint F′ and the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF g The fingerprint similarity R g :

[0081]

[0082] Calculate the similarity between the unknown network asset fingerprint F′ and the fingerprints of all network assets in the power monitoring system network asset fingerprint library AF and sort them in descending order to find the maximum similarity R:

[0083] R=max(R 1 , R 2 , …, R n ) (20)

[0084] According to R, the identification result D of the unknown network asset is determined as follows:

[0085]

[0086] When R≥0.9, it is determined that the unknown network asset is identified successfully, and the unknown network asset is the same or similar network asset as the known network asset. When R<0.9, it is determined that the unknown network asset identification fails, and the unknown network asset fingerprint F′ is added to the network asset fingerprint library AF of the power monitoring system to realize automatic update of the network asset fingerprint library.

[0087] The software program of the present invention is compiled based on automation, network security and computer processing technology, which is a technology familiar to those skilled in the art.

[0088] The specific implementation methods of the present invention are not exhaustive and do not constitute a limitation on the scope of protection of the claims. Based on the inspiration gained from the embodiments of the present invention, those skilled in the art can think of other substantially equivalent alternatives without creative work, all of which are within the scope of protection of the present invention.

Claims

1. A method for constructing network asset fingerprints and identifying assets in a power monitoring system, characterized by: The following steps are included: Step 1: Construct a network asset fingerprint extraction index system for the power monitoring system; Step 2: Build a power monitoring network asset fingerprint library; Step 3: Collect the communication traffic of unknown network assets, compare them with the network asset fingerprints in the power monitoring network asset fingerprint library, and calculate the unknown network asset fingerprint F′ and the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF. g The fingerprint similarity R g :Sort the fingerprint similarities of all network assets in descending order to obtain the maximum similarity R: R=max(R1,R2,···,R n ) According to R, the identification result D of the unknown network asset is determined as follows: When R≥0.9, it is determined that the unknown network asset is identified successfully, and the unknown network asset is the same or similar network asset as the known network asset. When R<0.9, it is determined that the unknown network asset identification fails, and the unknown network asset fingerprint F′ is added to the network asset fingerprint library AF of the power monitoring system to realize automatic update of the network asset fingerprint library.

2. According to claim 1, a method for constructing network asset fingerprints and identifying assets in a power monitoring system is characterized by: The quasi-group tuple of the power monitoring system network asset fingerprint extraction index system includes stability b1, security b2, distinguishability b3 and scalability b4; the power monitoring system network includes m asset fingerprint indicators, and the asset fingerprint extraction index scheme tuples are respectively represented by a1, a2, ···, a m ; The importance of b1, b2, b3, and b4 in the criterion tuple is compared, and the importance comparison result is obtained through c jk Indicates, where j = 1, 2, 3, 4; k = 1, 2, 3, 4; Establish the importance criterion discriminant matrix A c : By using the importance criterion discriminant matrix A c Perform normalization processing to obtain the normalized importance criterion discriminant matrix A c ′: Calculate the importance weights ω of b1, b2, b3, and b4 b1 ,ω b2 ,ω b3 ,ω b4 : For a1, a2, ···, a in the asset fingerprint indicator scheme tuple m The stability, security, distinguishability, and scalability of the . hi , Safety comparison results Se hi , the distinguishability comparison result Di hi , scalability comparison resultsEx hi , where h = 1, 2, ···, m; i = 1, 2, ···, m; Establish the stability criterion discriminant matrix A St : Security criteria discriminant matrix A Se : Distinguishability criterion discriminant matrix A Di : Scalability criterion discriminant matrix A Ex : For the stability criterion discriminant matrix A St , safety criteria discriminant matrix A Se , discriminability criterion discriminant matrix A Di , scalability criterion discriminant matrix A Ex Perform normalization processing, Get the normalized stability criterion discriminant matrix A′ St : Normalized security criterion discriminant matrix A′ Se : Normalized distinguishability criterion discriminant matrix A′ Di : Normalized scalability criterion discriminant matrix A′ Ex : Calculate a1, a2, ···, a m The stability weight ω St1 ,ω St2 ,···,ω Stm , safety weight ω Se1 ,ω Se2 ,···,ω Sem , distinguishability weight ω Di1 ,ω Di2 ,···,ω Dim , scalability weight ω Ex1 ,ω Ex2 ,···,ω Exm : For a1, a2, ···, a m The comprehensive weight is calculated as: oh ah =(ω b1 ×ω Sth +oh b2 ×ω Seh +oh b3 ×ω Dih +oh b4 ×ω Exh )×T(x), h=1, 2,…, m Where T(x) is the asset detection function, Yes a1 ,ω a2 ,···,ω am The network asset information corresponding to the first 10 items is set as the network asset fingerprint extraction index for constructing the power monitoring system, and is defined as I1, I2, ···, I 10 .

3. The method for constructing network asset fingerprints and identifying assets in a power monitoring system according to claim 1 is characterized by: The method for establishing the power monitoring network asset fingerprint library in step 2 is as follows: The network traffic collection tool Wireshark is used to collect and analyze the communication traffic in the power monitoring system network environment to form raw data traffic. Assuming that the power monitoring system network has n network assets, the corresponding indicators I1, I2, ···, I 10 The values ​​of f1, f2, ···, f 10 Generate the network asset fingerprint of the power monitoring system. The g-th network asset fingerprint can be expressed as: F g =[f 1g , f 2g ,···,f 10g ], g = 1, 2, ..., n, where f 1g , f 2g ,···,f 10g are the corresponding indicators I1, I2, ···, I 10 The value of all n network assets builds the power monitoring system network asset fingerprint library AF = [F1, F2, ···, F n ].

4. The method for constructing network asset fingerprints and identifying assets in a power monitoring system according to claim 1 is characterized in that: The unknown network asset fingerprint F′ in step 3 is compared with the g-th network asset fingerprint F in the network asset fingerprint library AF of the power monitoring system. g The fingerprint similarity R g The calculation method is: Collect the communication traffic of unknown network assets and extract the corresponding indicators I1, I2, ···, I 10 The values ​​f1′, f2′, ···, f1′0 generate the unknown network asset fingerprint F′=[f1′, f2′, ···, f1′0]; Compare the unknown network asset fingerprint F′ with the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF. g To compare, first convert each character f1′, f2′, ···, f1′0 in F′ into an 8-bit binary number corresponding to the ASCII code value to form the fingerprint vector of the unknown network asset Then F g f 1g , f 2g ,···,f 10g Each character is converted into an 8-bit binary number corresponding to the ASCII code value, forming the g-th network asset fingerprint vector of the power monitoring system A u and B gu They are and , calculate the unknown network asset fingerprint F′ and the g-th network asset fingerprint F in the power monitoring system network asset fingerprint library AF g The fingerprint similarity R g :

Images