Power monitoring system network multi-dimensional security risk assessment method

Abstract

The invention discloses a power monitoring system network multi-dimensional security risk assessment method, and belongs to the technical field of power monitoring system network security. According to the multi-dimensional security risk assessment method for the power monitoring system network, security risks of multiple dimensions are comprehensively considered; comprising a power monitoring system network security protection scoring method, a power monitoring system network security threat scoring method, a power monitoring system network security potential threat scoring method, a power monitoring system network security maintainability scoring method and a power monitoring system network multi-dimensional security risk scoring method. According to the multi-dimensional security risk assessment method for the power monitoring system network, the multi-dimensional security factors of the power monitoring system network are fully considered, the security risk of the power monitoring system network can be assessed more comprehensively and accurately, and a reliable basis is provided for protecting the security of the power monitoring system network.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security of electric power monitoring systems, and in particular relates to a multi-dimensional security risk assessment method for electric power monitoring system networks. Background Art

[0002] With the continuous development of computer technology, information technology, big data, artificial intelligence and industrial automation technology, traditional industrial control systems and infrastructure are becoming increasingly intelligent. From the perspective of the power industry, information technology has had a serious impact on the security of power information networks. The types of network attacks have increased sharply, and network equipment vulnerabilities have been continuously discovered. Network security assessment and network security maintenance are becoming increasingly important. The power monitoring system refers to a business system and intelligent equipment based on computer and network technology used to monitor and control the power production and supply process, as well as communication and data networks as basic support. Once the power monitoring system is damaged, it may affect national and social security. Therefore, in-depth analysis and research on the network security risks of the power monitoring system is of great significance to ensure the safe operation of the power monitoring system. The current network security risk assessment methods for power monitoring systems mainly have the following problems:

[0003] (1) Existing assessment methods often focus on the security of all types of networks, and lack effective assessment tools and methods for power monitoring system network security, which may affect the accuracy and reliability of the assessment;

[0004] (2) Existing assessment methods usually only consider a small number of security indicators, fail to comprehensively consider security risks in multiple dimensions, and fail to comprehensively assess the network security of the power monitoring system.

[0005] Therefore, a new technical solution is urgently needed in the prior art to solve this problem. Summary of the invention

[0006] The technical problem to be solved by the present invention is to provide a multi-dimensional security risk assessment method for an electric power monitoring system network, which is used to solve the problems in the prior art of lacking an assessment method for the network security of an electric power monitoring system, failing to comprehensively consider security risks in multiple dimensions, and having low assessment accuracy and reliability.

[0007] The technical solution adopted by the present invention is to provide a method for evaluating the multi-dimensional security risks of the power monitoring system network, including a method for scoring the network protection of the power monitoring system network, a method for scoring the network threat of the power monitoring system network, a method for scoring the potential threat of the power monitoring system network, a method for scoring the network maintainability of the power monitoring system network, and a method for scoring the multi-dimensional security risks of the power monitoring system network.

[0008] The network security protection score of the power monitoring system is P 1 The calculation method is:

[0009]

[0010] The calculation formula of the network intrusion rate success rate I of the power monitoring system can be expressed as:

[0011]

[0012] Among them, N v N is the number of successful attacks on the power monitoring system network during the test time, test It is the total number of attacks on the power monitoring system network during the test period.

[0013] The network security threat score of the power monitoring system is composed of the network attack path threat level score of the power monitoring system, the loss level score caused by the network attack of the power monitoring system, the automation level score of the network attack of the power monitoring system, and the attack type score of the power monitoring system. 2 The calculation method is:

[0014] P 2 =ω 1 ·P 21 +ω 2 ·P 22 +ω 3 ·P 23 +ω 4 ·P 24

[0015] Among them, ω 1 The weight for scoring the threat level of the network attack path of the power monitoring system, ω 2 The weight of the damage degree caused by the cyber attack on the power monitoring system, ω 3 The weight of the automation degree of cyber attacks on the power monitoring system, ω 4 The weight for scoring the attack type of the power monitoring system, ω 1 +ω 2 +ω 3 +ω 4 =1, each weight can be adjusted according to the specific situation, the default is

[0016] Threat level score of network attack path of power monitoring system 21 , different threat values ​​are assigned according to the different threat levels of network attack paths of the power monitoring system:

[0017]

[0018] Score of the degree of loss caused by cyber attacks on power monitoring systems 22, different values ​​are assigned according to the degree of loss caused by the network attack on the power monitoring system:

[0019]

[0020] Automation level score of cyber attacks on power monitoring systems 23 , different values ​​are assigned according to the different levels of automation of network attacks on the power monitoring system:

[0021]

[0022] Power monitoring system attack type score P 24 , different values ​​are assigned according to the different types of network attacks on the power monitoring system:

[0023]

[0024] The network security potential threat score of the power monitoring system is composed of the network vulnerability threat score of the power monitoring system and the open port threat score of the power monitoring system. 3 The calculation method is:

[0025] P 3 =ω 5 ·P 31 +ω 6 ·P 32

[0026] Among them, ω 5 is the weight of the threat score of the power monitoring system network vulnerability, ω 6 is the weight of the threat score of the open port of the power monitoring system, ω 5 +ω 6 =1, each weight can be adjusted according to the specific situation, the default is

[0027] Power monitoring system network vulnerability threat score P 31 The calculation method is:

[0028]

[0029] Power monitoring system network vulnerability threat V 1 ,Affected by the number and type of vulnerabilities in the power monitoring system network equipment, different levels of vulnerabilities will have different degrees of impact on the power monitoring system network security. The threat level of power monitoring system network vulnerabilities is V 1 The calculation method is:

[0030]

[0031] Where m is the number of vulnerability categories in the power monitoring system network equipment, N is the total number of vulnerabilities in the power monitoring system network equipment, and D ij Indicates the CVSS vulnerability rating score of the j-th vulnerability type existing on the ith device, with a value range of [0,10]. N ij Indicates the number of vulnerabilities of the jth type existing on the i-th device;

[0032] The higher the security level of information stored in the power monitoring system network equipment, the greater the threat to the power monitoring system network when there are high-risk vulnerabilities in the power monitoring system network equipment. Assume that there are n devices in the power monitoring system network, the importance of the i-th device, i = 1, 2, ···, n, is Q i It can be expressed as:

[0033]

[0034] Among them, I i It represents the security level score of the information stored in the ith device of the power monitoring system network. Different values ​​are assigned according to the different security levels of the information stored in the power monitoring system network devices:

[0035]

[0036] Threat score of open ports in power monitoring system 32 The calculation method is:

[0037]

[0038] The more dangerous ports the network equipment of the power monitoring system opens, the worse the network security of the power monitoring system will be. 2 The calculation method is:

[0039]

[0040] Among them, k is the open port type of the power monitoring system network, N k The number of open ports of type k for the power monitoring system network, N all represents the total number of open ports in the power monitoring system network, ρ k It indicates the risk score when the open port type of the power monitoring system network is k. Different values ​​are assigned according to the different threats of the open port of the power monitoring system network:

[0041]

[0042] The network security maintainability score of the power monitoring system is composed of the network security maintenance score of the power monitoring system and the network failure frequency score of the power monitoring system.4 The calculation method is:

[0043] P 4 =ω 7 ·P 41 +ω 8 ·P 42

[0044] Among them, ω 7 The weight of the network security maintenance score of the power monitoring system, ω 8 is the weight of the network failure frequency score of the power monitoring system, ω 7 +ω 8 =1, each weight can be adjusted according to the specific situation, the default is

[0045] If the power monitoring system network has not been maintained for a long time, it may cause power monitoring system network failure. Therefore, the power monitoring system network security maintenance score P is defined. 41 The calculation method is:

[0046]

[0047] Power monitoring system network failure frequency score P 42 :

[0048]

[0049] The network fault frequency F of the power monitoring system can be defined as:

[0050]

[0051] Among them, t all is the total duration of the power monitoring system network under test, t f It is the fault duration of the power monitoring system network during the test time.

[0052] The calculation method of the multi-dimensional security risk score S of the power monitoring system network is:

[0053] S=ω 9 ·P 1 +ω 10 ·P 2 +ω 11 ·P 3 +ω 12 ·P 4

[0054] Among them, ω 9 is the weight of the network security protection score of the power monitoring system, ω 10 The weight of the cybersecurity threat score of the power monitoring system, ω 11The weight of the potential threat score of the power monitoring system network security, ω 12 is the weight of the network security maintainability score of the power monitoring system, ω 9 +ω 10 +ω 11 +ω 12 =1, each weight can be adjusted according to the specific situation, the default is

[0055] According to the multi-dimensional security risk score of the power monitoring system network, the multi-dimensional security risk of the power monitoring system network can be graded to provide a reference for subsequent management and optimization. The specific classification method is as follows:

[0056]

[0057] Through the above-mentioned design scheme, the present invention can bring the following beneficial effects: it fully considers the multi-dimensional security factors of the power monitoring system network, can more comprehensively and accurately evaluate the network security risks of the power monitoring system, and provide a reliable basis for protecting the network security of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 The present invention is a flowchart of a method for multi-dimensional network security risk assessment of an electric power monitoring system. DETAILED DESCRIPTION

[0059] The present invention is further described below with reference to the accompanying drawings and specific embodiments:

[0060] Reference Figure 1 The present invention provides a multi-dimensional security risk assessment method for a power monitoring system network, including a power monitoring system network security protection scoring method, a power monitoring system network security threat scoring method, a power monitoring system network security potential threat scoring method, a power monitoring system network security maintainability scoring method and a power monitoring system network multi-dimensional security risk scoring method, the specific contents are as follows:

[0061] (1) Scoring method for network security protection of power monitoring system

[0062] When the success rate of network intrusion in the power monitoring system is too high, the network security of the power monitoring system is poor, which may easily lead to failure or even paralysis of the entire power monitoring system network. The calculation formula of the success rate of network intrusion in the power monitoring system I can be expressed as:

[0063]

[0064] Among them, N v N is the number of successful attacks on the power monitoring system network during the test time, testIt is the total number of attacks on the power monitoring system network during the test period.

[0065] Power monitoring system network security protection score P 1 The calculation method is:

[0066]

[0067] (2) Cybersecurity threat scoring method for power monitoring systems

[0068] The network security threat score of the power monitoring system is composed of the threat level score of the power monitoring system network attack path, the loss level score caused by the power monitoring system network attack, the automation level score of the power monitoring system network attack, and the attack type score of the power monitoring system.

[0069] Threat level score of network attack path of power monitoring system 21 , different threat values ​​are assigned according to the different threat levels of the network attack paths of the power monitoring system:

[0070]

[0071] Score of the degree of loss caused by cyber attacks on power monitoring systems 22 , different values ​​are assigned according to the degree of loss caused by the network attack on the power monitoring system:

[0072]

[0073] Automation level score of cyber attacks on power monitoring systems 23 , different values ​​are assigned according to the different levels of automation of network attacks on the power monitoring system:

[0074]

[0075] Power monitoring system attack type score P 24 , different values ​​are assigned according to the type of network attack on the power monitoring system:

[0076]

[0077] According to the threat level score of the network attack path of the power monitoring system, P 21 , Score of the degree of loss caused by cyber attacks on power monitoring systems 22 , Power monitoring system network attack automation degree score P 23 And the power monitoring system attack type score P 24 , calculate the cybersecurity threat score P of the power monitoring system 2 :

[0078] P 2 =ω1 ·P 21 +ω 2 ·P 22 +ω 3 ·P 23 +ω 4 ·P 24 (7)

[0079] Among them, ω 1 The weight for scoring the threat level of the network attack path of the power monitoring system, ω 2 The weight of the damage degree caused by the cyber attack on the power monitoring system, ω 3 The weight of the automation degree of cyber attacks on the power monitoring system, ω 4 The weight for scoring the attack type of the power monitoring system, ω 1 +ω 2 +ω 3 +ω 4 =1, each weight can be adjusted according to the specific situation, the default is

[0080] (3) Scoring method for potential cyber threats of power monitoring system

[0081] The potential threat score of the power monitoring system network security is composed of the power monitoring system network vulnerability threat score and the power monitoring system open port threat score.

[0082] The higher the security level of information stored in the power monitoring system network equipment, the greater the threat to the power monitoring system network when there are high-risk vulnerabilities in the power monitoring system network equipment. Assume that there are n devices in the power monitoring system network, the importance of the i-th device, i = 1, 2, ···, n, is Q i It can be expressed as:

[0083]

[0084] Among them, I i It represents the security level score of the information stored in the ith device of the power monitoring system network. Different values ​​are assigned according to the different security levels of the information stored in the power monitoring system network devices:

[0085]

[0086] Power monitoring system network vulnerability threat V 1 ,Affected by the number and type of vulnerabilities in the power monitoring system network equipment, different levels of vulnerabilities will have different degrees of impact on the power monitoring system network security. The threat level of power monitoring system network vulnerabilities is V 1 The calculation method is:

[0087]

[0088] Where m is the number of vulnerability categories in the power monitoring system network equipment, N is the total number of vulnerabilities in the power monitoring system network equipment, and D ij Indicates the CVSS vulnerability rating score of the j-th vulnerability type existing on the ith device, with a value range of [0,10]. N ij Indicates the number of vulnerabilities of the jth type existing on the i-th device.

[0089] Power monitoring system network vulnerability threat score P 31 The calculation method is:

[0090]

[0091] The more dangerous ports the network equipment of the power monitoring system opens, the worse the network security of the power monitoring system will be. 2 The calculation method is:

[0092]

[0093] Among them, k is the open port type of the power monitoring system network, N k The number of open ports of type k for the power monitoring system network, N all represents the total number of open ports in the power monitoring system network, ρ k It indicates the risk score when the open port type of the power monitoring system network is k. Different values ​​are assigned according to the different threats of the open port of the power monitoring system network:

[0094]

[0095] According to formula (12), the threat score of open ports in the power monitoring system can be obtained as P 32 for:

[0096]

[0097] According to the threat score of power monitoring system network vulnerability P 31 and the threat score of open ports in the power monitoring system 32 , we can get the potential threat score P of the power monitoring system network security 3 :

[0098] P 3 =ω 5 ·P 31 +ω 6 ·P 32 (15)

[0099] Among them, ω 5is the weight of the threat score of the power monitoring system network vulnerability, ω 6 is the weight of the threat score of the open port of the power monitoring system, ω 5 +ω 6 =1, each weight can be adjusted according to the specific situation, the default is

[0100] (4) Scoring method for network security maintainability of power monitoring system

[0101] The power monitoring system network security maintainability score is composed of the power monitoring system network security maintenance score and the power monitoring system network failure frequency score.

[0102] If the power monitoring system network has not been maintained for a long time, it may cause power monitoring system network failure. Therefore, the power monitoring system network security maintenance score P is defined. 41 The calculation method is:

[0103]

[0104] The network fault frequency F of the power monitoring system can be defined as:

[0105]

[0106] Among them, t all is the total duration of the power monitoring system network under test, t f It is the fault duration of the power monitoring system network during the test time.

[0107] According to the power monitoring system network failure frequency F, the power monitoring system network failure frequency score P can be obtained. 42 :

[0108]

[0109] According to the network security inspection and maintenance score of the power monitoring system P 41 and the network failure frequency score of the power monitoring system P 42 , we can get the network security maintainability score P of the power monitoring system 4 :

[0110] P 4 =ω 7 ·P 41 +ω 8 ·P 42 (19)

[0111] Among them, ω 7 The weight of the network security maintenance score of the power monitoring system, ω 8 is the weight of the network failure frequency score of the power monitoring system, ω 7+ω 8 =1, each weight can be adjusted according to the specific situation, the default is

[0112] (5) Multi-dimensional security risk scoring method for power monitoring system network

[0113] According to the network security protection score of the power monitoring system P 1 , Cybersecurity threat score of power monitoring system P 2 , Power monitoring system network security potential threat score P 3 , Power Monitoring System Network Security Maintainability Score P 4 , calculate the multi-dimensional security risk score S of the power monitoring system network:

[0114] S=ω 9 ·P 1 +ω 10 ·P 2 +ω 11 ·P 3 +ω 12 ·P 4 (20)

[0115] Among them, ω 9 is the weight of the network security protection score of the power monitoring system, ω 10 The weight of the cybersecurity threat score of the power monitoring system, ω 11 The weight of the potential threat score of the power monitoring system network security, ω 12 is the weight of the network security maintainability score of the power monitoring system, ω 9 +ω 10 +ω 11 +ω 12 =1, each weight can be adjusted according to the specific situation, the default is

[0116] According to the multi-dimensional security risk score of the power monitoring system network, the multi-dimensional security risk of the power monitoring system network can be graded to provide a reference for subsequent management and optimization. The specific classification method is as follows:

[0117]

[0118] The software program of the present invention is compiled based on automation, network security and computer processing technology, which is a technology familiar to those skilled in the art.

[0119] The implementation methods of the present invention are not limited to the above-mentioned embodiments, and any other changes, modifications, substitutions, combinations, and simplifications made without departing from the spirit and principle of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A multi-dimensional security risk assessment method for a power monitoring system network, characterized by: It includes a scoring method for the protection of power monitoring system network security, a scoring method for the threat of power monitoring system network security, a scoring method for the potential threat of power monitoring system network security, a scoring method for the maintainability of power monitoring system network security, and a scoring method for the multi-dimensional security risk of power monitoring system network.

2. A method for multi-dimensional security risk assessment of a power monitoring system network according to claim 1, characterized in that: The calculation method of the network security protection score P1 of the power monitoring system is: The calculation formula of the network intrusion rate success rate I of the power monitoring system can be expressed as: Among them, N v N is the number of successful attacks on the power monitoring system network during the test time, test It is the total number of attacks on the power monitoring system network during the test period.

3. The method for multi-dimensional security risk assessment of a power monitoring system network according to claim 1 is characterized in that: The network security threat score of the power monitoring system is composed of the threat degree score of the network attack path of the power monitoring system, the loss degree score caused by the network attack of the power monitoring system, the automation degree score of the network attack of the power monitoring system, and the attack type score of the power monitoring system. The network security threat score P2 of the power monitoring system is calculated as follows: P2=ω1·P 21 +ω2·P 22 +ω3·P 23 +ω4·P 24 Among them, ω1 is the weight of the threat level score of the network attack path of the power monitoring system, ω2 is the weight of the loss level score caused by the network attack of the power monitoring system, ω3 is the weight of the automation level score of the network attack of the power monitoring system, and ω4 is the weight of the attack type score of the power monitoring system. ω1+ω2+ω3+ω4=1. Each weight can be adjusted according to the specific situation. The default is Threat level score of network attack path of power monitoring system 21 , different threat values ​​are assigned according to the different threat levels of network attack paths of the power monitoring system: Score of the degree of loss caused by cyber attacks on power monitoring systems 22 , different values ​​are assigned according to the degree of loss caused by the network attack on the power monitoring system: Automation level score of cyber attacks on power monitoring systems 23 , different values ​​are assigned according to the different levels of automation of network attacks on the power monitoring system: Power monitoring system attack type score P 24 , different values ​​are assigned according to the different types of network attacks on the power monitoring system:

4. The method for multi-dimensional security risk assessment of a power monitoring system network according to claim 1 is characterized in that: The power monitoring system network security potential threat score is composed of the power monitoring system network vulnerability threat score and the power monitoring system open port threat score. The power monitoring system network security potential threat score P3 is calculated as follows: P3=ω5·P 31 +ω6·P 32 Among them, ω5 is the weight of the threat score of the network vulnerability of the power monitoring system, ω6 is the weight of the threat score of the open port of the power monitoring system, ω5+ω6=1, and each weight can be adjusted according to the specific situation. The default is Power monitoring system network vulnerability threat score P 31 The calculation method is: The power monitoring system network vulnerability threat level V1 is affected by the number and type of vulnerabilities in the power monitoring system network equipment. Different levels of vulnerabilities will have different degrees of impact on the power monitoring system network security. The power monitoring system network vulnerability threat level V1 is calculated as follows: Where m is the number of vulnerability categories in the power monitoring system network equipment, N is the total number of vulnerabilities in the power monitoring system network equipment, and D ij Indicates the CVSS vulnerability rating score of the j-th vulnerability type existing on the ith device, with a value range of [0,10]. N ij Indicates the number of vulnerabilities of the jth type existing on the i-th device; The higher the security level of information stored in the power monitoring system network equipment, the greater the threat to the power monitoring system network when there are high-risk vulnerabilities in the power monitoring system network equipment. Assume that there are n devices in the power monitoring system network, the importance of the i-th device, i = 1, 2, ···, n, is Q i It can be expressed as: Among them, I i It represents the security level score of the information stored in the ith device of the power monitoring system network. Different values ​​are assigned according to the different security levels of the information stored in the power monitoring system network devices: Threat score of open ports in power monitoring system 32 The calculation method is: The more dangerous ports the network equipment of the power monitoring system opens, the worse the security of the power monitoring system network. The calculation method of the threat level V2 of the open ports of the power monitoring system is: Among them, k is the open port type of the power monitoring system network, N k The number of open ports of type k for the power monitoring system network, N all represents the total number of open ports in the power monitoring system network, ρ k It indicates the risk score when the open port type of the power monitoring system network is k. Different values ​​are assigned according to the different threats of the open port of the power monitoring system network:

5. The method for multi-dimensional security risk assessment of a power monitoring system network according to claim 1 is characterized in that: The network security maintainability score of the power monitoring system is composed of the network security maintenance score of the power monitoring system and the network failure frequency score of the power monitoring system. The calculation method of the network security maintainability score P4 of the power monitoring system is: P4=ω7·P 41 +ω8·P 42 Among them, ω7 is the weight of the network security maintenance score of the power monitoring system, ω8 is the weight of the network failure frequency score of the power monitoring system, ω7+ω8=1, and each weight can be adjusted according to the specific situation. The default is If the power monitoring system network has not been maintained for a long time, it may cause power monitoring system network failure. Therefore, the power monitoring system network security maintenance score P is defined. 41 The calculation method is: Power monitoring system network failure frequency score P 42 : The network fault frequency F of the power monitoring system can be defined as: Among them, t all is the total duration of the power monitoring system network under test, t f It is the fault duration of the power monitoring system network during the test time.

6. A method for multi-dimensional security risk assessment of a power monitoring system network according to claim 1, characterized in that: The calculation method of the multi-dimensional security risk score S of the power monitoring system network is: S=ω9·P1+ω 10 ·P2+ω 11 ·P3+ω 12 ·P4 Among them, ω9 is the weight of the network security protection score of the power monitoring system, ω 10 The weight of the cybersecurity threat score of the power monitoring system, ω 11 The weight of the potential threat score of the power monitoring system network security, ω 12 is the weight of the network security maintainability score of the power monitoring system, ω9+ω 10 +ω 11 +ω 12 =1, each weight can be adjusted according to the specific situation, the default is According to the multi-dimensional security risk score of the power monitoring system network, the multi-dimensional security risk of the power monitoring system network can be graded to provide a reference for subsequent management and optimization. The specific classification method is as follows:

Images