A method and system for assessing power network security risks

Abstract

The present invention relates to the field of network security technology, and specifically discloses a method and system for assessing the risk of power network security, wherein the method comprises the following steps: S1: determining a time node, obtaining network traffic at the time node and generating a network traffic set; S2: determining an abnormal difference; calculating a judgment ratio, and determining a maximum standard traffic according to the judgment ratio; generating data points, and fitting the data points to obtain a curve of the maximum standard traffic changing over time; S3: obtaining network traffic in real time within a judgment period, and using it as pending traffic, and drawing a curve of the pending traffic changing over time; determining a target curve; determining an evaluation function, and judging whether there is a network security risk according to the evaluation function. The present invention can identify potential network security risks according to network traffic, and avoid affecting the security of the power network.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for assessing electric power network security risks. Background Art

[0002] Cyber ​​Security refers to the protection of the hardware, software and data in the network system from damage, change or leakage due to accidental or malicious reasons, and the continuous, reliable and normal operation of the system and uninterrupted network services.

[0003] The power system is not just a simple electricity production and supply, it also involves a wide range of network technology applications, including smart grids, distributed power generation, demand response, etc. The implementation of these technologies relies on information technology and network communications, making the power system a highly digital and networked complex system. In this case, the impact of network security on the power system is becoming increasingly prominent.

[0004] Traffic monitoring is an important part of network security. By monitoring network traffic, abnormal behaviors and potential threats can be identified and detected. Conventional methods mostly rely on real-time monitoring of traffic. When the network traffic exceeds a certain limit, it is determined that there is a network security risk. However, in this case, the traffic has exceeded the preset range, and the network security may have been affected. At this time, there may be a lag in the corresponding processing. Based on this, a power network security risk assessment method is proposed to identify potential network security risks and avoid the security of the power network being affected. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for assessing power network security risks to solve the above technical problems.

[0006] The purpose of the present invention can be achieved through the following technical solutions:

[0007] A method for assessing power network security risks comprises the following steps:

[0008] S1: m collection cycles are set, where m is a preset value. In the collection cycle, a number of time nodes are set at preset time intervals, and network traffic is obtained at the time nodes, and a network traffic set QJHi=(Q1i, Q2i, ..., Qmi) is generated, where Qmi represents the network traffic at the i-th time node in the m-th collection cycle;

[0009] S2: Determine the maximum network flow Qimax=max(QJHi) at the i-th time node, and calculate the flow difference Qidif=Qimax-Qmi. When the flow difference Qidif≥Qdif', mark it as an abnormal difference, Qidif' represents a preset flow difference threshold;

[0010] Calculate the judgment ratio C=Syc / Stot, where Syc represents the total number of abnormal differences, and Stot represents the total number of abnormal differences. When the judgment ratio C≥C', remove the maximum network flow and execute the above steps again, where C' represents a preset ratio threshold, until a judgment ratio C corresponding to a certain maximum network flow is <C', and the maximum network flow at this time is recorded as the maximum standard flow Qstai;

[0011] Generate data points (ti, Qstai), where ti represents the time interval between the ith time node and the starting point of the acquisition cycle, and fit the data points to obtain a curve f(t) of the maximum standard flow rate changing with time;

[0012] S3: Setting a judgment period, obtaining network traffic in real time during the judgment period, taking it as pending traffic, and drawing a curve g(t) showing the pending traffic changing with time;

[0013] Intercepting the portion of the curve of the maximum standard flow rate changing with time corresponding to the judgment period, and using it as the target curve f'(t);

[0014] An evaluation function h(t)=f'(t)-g(t) is determined, and whether there is a network security risk is determined based on the evaluation function.

[0015] As a further solution of the present invention: in step S3, the process of judging whether there is a network security risk according to the evaluation function specifically includes:

[0016] The intersection of the evaluation function and the x-axis is taken as a reference point. When the evaluation function between two adjacent reference points is below the x-axis, it is marked as an abnormal curve, and the total number N of the abnormal curves is counted;

[0017] The evaluation score K is calculated by the formula:

[0018]

[0019] Wherein, Q' represents a preset network security flow threshold, ε represents a preset correction coefficient and ε<0, Tn represents the duration corresponding to the nth abnormal curve, Tend represents the end time of the judgment cycle, and Tsta represents the start time of the judgment cycle;

[0020] When the evaluation score K>K', it is determined that there is a network security risk, and an early warning message is sent to remind the staff, where K' represents a preset evaluation score threshold.

[0021] As a further solution of the present invention: in the process of judging whether there is a network security risk according to the evaluation function, when It is determined that there is a network security risk.

[0022] As a further solution of the present invention: in step S2, the process of determining the flow difference threshold value specifically includes:

[0023] Sort the network traffic at time node i by size. The larger the network traffic, the lower the ranking, and the traffic ranking is obtained.

[0024] Calculate the difference between the network traffic at two adjacent sorting positions in the traffic sorting, and use it as the initial difference;

[0025] Calculate the standard deviation S of the initial difference, and when the standard deviation S≥S', remove the fluctuation difference, S' represents a preset standard deviation threshold, and the fluctuation difference is the maximum and minimum values ​​of the initial difference, and calculate the standard deviation again, and repeat the above steps until the standard deviation S after removing the fluctuation difference is less than S';

[0026] The mean of the initial differences that have not been removed at this time is calculated and used as the flow difference threshold at time node i.

[0027] As a further solution of the present invention: the process of calculating the mean of the initial difference values ​​that have not been removed at this time also includes the following steps:

[0028] When the difference between the initial difference b and the flow difference threshold is greater than the preset first difference threshold, the initial difference b is removed and the average is calculated again, and is used as the flow difference threshold at time node i.

[0029] As a further solution of the present invention: in the step S3, when the pending traffic is greater than the network traffic security threshold, the subsequent steps are not executed and it is determined that there is a network security risk.

[0030] As a further solution of the present invention: in the step S1, when the network traffic in the collection period a is greater than the network traffic security threshold, the following steps are performed:

[0031] Sorting the acquisition cycles in the order of the time axis, and determining the start time tsta1 of the first acquisition cycle in the order;

[0032] The acquisition period a is removed, and a new acquisition period [tsta1-A, tsta1] is set, where A represents the length of the acquisition period.

[0033] A power network security risk assessment system, comprising:

[0034] Initial module: set m collection cycles, m is a preset value, set a number of time nodes at preset time intervals within the collection cycle, obtain network traffic at the time nodes, and generate a network traffic set QJHi = (Q1i, Q2i, ..., Qmi), Qmi represents the network traffic at the i-th time node within the m-th collection cycle;

[0035] Processing module: determine the maximum network flow Qimax=max(QJHi) at the i-th time node, and calculate the flow difference Qidif=Qimax-Qmi. When the flow difference Qidif≥Qdif', mark it as an abnormal difference, Qidif' represents a preset flow difference threshold;

[0036] Calculate the judgment ratio C=Syc / Stot, where Syc represents the total number of abnormal differences, and Stot represents the total number of abnormal differences. When the judgment ratio C≥C', remove the maximum network flow and execute the above steps again, where C' represents a preset ratio threshold, until a judgment ratio C corresponding to a certain maximum network flow is <C', and the maximum network flow at this time is recorded as the maximum standard flow Qstai;

[0037] Generate data points (ti, Qstai), where ti represents the time interval between the ith time node and the starting point of the acquisition cycle, and fit the data points to obtain a curve f(t) of the maximum standard flow rate changing with time;

[0038] Judgment module: set a judgment period, obtain network traffic in real time within the judgment period, use it as pending traffic, and draw a curve g(t) of the pending traffic changing with time;

[0039] Intercepting the portion of the curve of the maximum standard flow rate changing with time corresponding to the judgment period, and using it as the target curve f'(t);

[0040] An evaluation function h(t)=g(t)-f'(t) is determined, and whether there is a network security risk is determined based on the evaluation function.

[0041] Beneficial effects of the present invention: In the present invention, first, a collection cycle is set, and the number of collection cycles can be set by experience. The length of the collection cycle is one day, and the time interval between two adjacent time nodes can also be set according to experience; then, a network flow set is generated, which is the basis for subsequent processing. A network flow set corresponds to a time node, and the processing method of the network flow flow set is the same, which will not be repeated here; then, the abnormal difference is determined, the judgment ratio is calculated, and the maximum standard flow is determined according to the judgment ratio; it is worth noting that the reason for not directly using the maximum value in the network flow set is: the larger the judgment ratio, the more elements in the network flow set deviate from the maximum value of the network flow, which indicates that this network flow maximum value does not conform to the "general situation", so directly using the network flow maximum value as the basis for subsequent processing may lead to inaccurate subsequent processing, such as, the network flow of a certain day suddenly soars to an extremely high value at the i-th time node, but this situation only occurs once, and at the same time point on other dates, the network flow is relatively stable, then directly using this extremely high value The value is taken as the maximum value, which will obviously have an adverse effect on data analysis. Therefore, the maximum value of network traffic is identified by calculating the judgment ratio to see whether it conforms to the "general situation", ensuring that the maximum value of network traffic used for subsequent processing is a more reasonable and stable value; then generate data points, and determine the curve of the maximum standard traffic changing with time, which is to determine the "safe range" of network traffic in different time periods; then obtain the curve of the pending traffic changing with time within the judgment period, and determine the target curve, which is the part of the curve of the maximum standard traffic changing with time corresponding to the judgment period, and determine the evaluation function, and judge whether there is a network security risk according to the evaluation function; it is worth noting that by identifying potential abnormal behaviors in advance in this way, measures can be taken before the problem expands to prevent sudden increases in network traffic or other emergencies from occurring, affecting network security; some attacks may not immediately manifest as obvious traffic anomalies, but gradually accumulate their effects through subtle and scattered abnormal behaviors. Identifying these anomalies in advance can prevent attackers from gradually infiltrating the network and avoid the lag in processing when there is a network security risk. The present invention can identify potential network security risks based on network traffic and avoid the security of the power network being affected. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The present invention will be further described below in conjunction with the accompanying drawings.

[0043] Figure 1 It is a flow chart of a power network security risk assessment method of the present invention. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] See also Figure 1 As shown, the present invention is a method for assessing power network security risks, comprising the following steps:

[0046] S1: m collection cycles are set, where m is a preset value. In the collection cycle, a number of time nodes are set at preset time intervals, and network traffic is obtained at the time nodes, and a network traffic set QJHi=(Q1i, Q2i, ..., Qmi) is generated, where Qmi represents the network traffic at the i-th time node in the m-th collection cycle;

[0047] S2: Determine the maximum network flow Qimax=max(QJHi) at the i-th time node, and calculate the flow difference Qidif=Qimax-Qmi. When the flow difference Qidif≥Qdif', mark it as an abnormal difference, Qidif' represents a preset flow difference threshold;

[0048] Calculate the judgment ratio C=Syc / Stot, where Syc represents the total number of abnormal differences, and Stot represents the total number of abnormal differences. When the judgment ratio C≥C', remove the maximum network flow and execute the above steps again, where C' represents a preset ratio threshold, until a judgment ratio C corresponding to a certain maximum network flow is <C', and the maximum network flow at this time is recorded as the maximum standard flow Qstai;

[0049] Generate data points (ti, Qstai), where ti represents the time interval between the ith time node and the starting point of the acquisition cycle, and fit the data points to obtain a curve f(t) of the maximum standard flow rate changing with time;

[0050] S3: Setting a judgment period, obtaining network traffic in real time during the judgment period, taking it as pending traffic, and drawing a curve g(t) showing the pending traffic changing with time;

[0051] Intercepting the portion of the curve of the maximum standard flow rate changing with time corresponding to the judgment period, and using it as the target curve f'(t);

[0052] An evaluation function h(t)=f'(t)-g(t) is determined, and whether there is a network security risk is determined based on the evaluation function.

[0053] It should be noted that, first, the collection cycle is set. The number of collection cycles can be set by experience. The length of the collection cycle is one day, and the time interval between two adjacent time nodes can also be set according to experience. After that, a network flow set is generated, which is the basis for subsequent processing. A network flow set corresponds to a time node. The processing method of the network flow set is the same, which will not be described in detail here. After that, the abnormal difference is determined, the judgment ratio is calculated, and the maximum standard flow is determined according to the judgment ratio. It is worth noting that the reason for not directly using the maximum value in the network flow set is: the larger the judgment ratio, the more elements in the network flow set deviate from the maximum value of the network flow, which indicates that this maximum value of the network flow does not conform to the "general situation". Therefore, directly using the maximum value of the network flow as the basis for subsequent processing may lead to inaccurate subsequent processing. For example, the network flow on a certain day suddenly soars to an extremely high value at the i-th time node, but this situation only occurs once, and at the same time point on other dates, the network flow is relatively stable, then directly using this extremely high value as the maximum value Large values ​​will obviously have an adverse effect on data analysis. Therefore, the maximum value of network traffic is identified by calculating the judgment ratio to see if it conforms to the "general situation" to ensure that the maximum value of network traffic used for subsequent processing is a more reasonable and stable value; then data points are generated and the curve of the maximum standard traffic changing over time is determined, in order to determine the "safe range" of network traffic in different time periods; then the curve of the pending traffic changing over time within the judgment period is obtained, and the target curve is determined. The target curve is the part of the curve of the maximum standard traffic changing over time corresponding to the judgment period, and the evaluation function is determined, and the evaluation function is used to determine whether there is a network security risk; it is worth noting that by identifying potential abnormal behaviors in advance in this way, measures can be taken before the problem expands to prevent a sudden increase in network traffic or other emergencies from occurring, affecting network security; some attacks may not immediately manifest as obvious traffic anomalies, but gradually accumulate their impact through subtle and scattered abnormal behaviors. Identifying these anomalies in advance can prevent attackers from gradually infiltrating the network and avoid delays in processing when there are network security risks.

[0054] In another preferred implementation of the present invention, in step S3, the process of determining whether there is a network security risk according to the evaluation function specifically includes:

[0055] The intersection of the evaluation function and the x-axis is taken as a reference point. When the evaluation function between two adjacent reference points is below the x-axis, it is marked as an abnormal curve, and the total number N of the abnormal curves is counted;

[0056] The evaluation score K is calculated by the formula:

[0057]

[0058] Wherein, Q' represents a preset network security flow threshold, ε represents a preset correction coefficient and ε<0, Tn represents the duration corresponding to the nth abnormal curve, Tend represents the end time of the judgment cycle, and Tsta represents the start time of the judgment cycle;

[0059] When the evaluation score K>K', it is determined that there is a network security risk, and an early warning message is sent to remind the staff, where K' represents a preset evaluation score threshold.

[0060] It is worth noting that when the evaluation function is below the x-axis, it means that the pending flow exceeds the safe range of the flow during that period, which can reflect the existence of an abnormal situation. The longer the duration of the abnormal situation (i.e., the abnormal curve), the greater the possibility of the existence of the abnormal situation. Therefore, it is positively correlated with the evaluation score. The remaining parameters are determined to be positively or negatively correlated with the evaluation score based on this idea, and will not be elaborated on here. The specific value of ε can be set based on experience.

[0061] In another preferred implementation of the present invention, in the process of judging whether there is a network security risk according to the evaluation function, when It is determined that there is a network security risk.

[0062] It is understandable that when , it means that the longer time in the judgment cycle exceeds the corresponding time safety range, so it can be directly determined that there is a network security risk.

[0063] In another preferred implementation of the present invention, in step S2, the process of determining the flow difference threshold specifically includes:

[0064] Sort the network traffic at time node i by size. The larger the network traffic, the lower the ranking, and the traffic ranking is obtained.

[0065] Calculate the difference between the network traffic at two adjacent sorting positions in the traffic sorting, and use it as the initial difference;

[0066] Calculate the standard deviation S of the initial difference, and when the standard deviation S≥S', remove the fluctuation difference, S' represents a preset standard deviation threshold, and the fluctuation difference is the maximum and minimum values ​​of the initial difference, and calculate the standard deviation again, and repeat the above steps until the standard deviation S after removing the fluctuation difference is less than S';

[0067] The mean of the initial differences that have not been removed at this time is calculated and used as the flow difference threshold at time node i.

[0068] It should be noted that there are often outliers or bursts in network traffic data, which may seriously affect the analysis results. If the impact of these anomalies is not removed directly, the calculated traffic difference threshold may be inaccurate, affecting subsequent anomaly detection and data analysis. Iteratively removing extreme values ​​(fluctuation differences) helps to eliminate abnormal fluctuations and ensure that the traffic difference threshold is more reasonable.

[0069] In another preferred implementation of the present invention, the process of calculating the mean of the initial differences that have not been removed at this time further includes the following steps:

[0070] When the difference between the initial difference b and the flow difference threshold is greater than the preset first difference threshold, the initial difference b is removed and the average is calculated again, and is used as the flow difference threshold at time node i.

[0071] It should be noted that after the initial removal of extreme values, there may still be some initial differences whose fluctuation range is greater than the preset tolerance. These differences may affect the final calculated mean and lead to inaccurate flow difference thresholds. By further removing these differences, the quality of the remaining data can be continuously optimized, making the calculated mean more stable and reliable.

[0072] In another preferred implementation of the present invention, in the step S3, when the pending traffic is greater than the network traffic security threshold, the subsequent steps are not executed and it is determined that there is a network security risk.

[0073] It is understandable that when the pending traffic exceeds the security threshold, it means that the network traffic has reached a dangerous level. At this time, it is more important to quickly identify this situation than to continue with complex subsequent calculations. Once the network traffic exceeds the security threshold, continuing with subsequent steps may delay the necessary protective measures, thereby increasing the risk of further damage to the network. In network security management, rapid response and handling of abnormal situations are crucial. Immediately judging the risk when the security threshold is exceeded can ensure that managers can take timely countermeasures.

[0074] In another preferred implementation of the present invention, in the step S1, when the network traffic in the collection period a is greater than the network traffic security threshold, the following steps are performed:

[0075] Sorting the acquisition cycles in the order of the time axis, and determining the start time tsta1 of the first acquisition cycle in the order;

[0076] The acquisition period a is removed, and a new acquisition period [tsta1-A, tsta1] is set, where A represents the length of the acquisition period.

[0077] It is worth noting that when the network traffic in a certain collection cycle exceeds the preset safety threshold, it indicates that the data in this cycle may be affected by abnormal traffic. If the collection cycle is not adjusted, subsequent analysis may be based on inaccurate data, leading to wrong conclusions. By setting a new collection cycle to replace collection cycle a, the influence of abnormal traffic can be eliminated, ensuring that the collected data is more reliable and can truly reflect the changes in network traffic.

[0078] A power network security risk assessment system, comprising:

[0079] Initial module: set m collection cycles, m is a preset value, set a number of time nodes at preset time intervals within the collection cycle, obtain network traffic at the time nodes, and generate a network traffic set QJHi = (Q1i, Q2i, ..., Qmi), Qmi represents the network traffic at the i-th time node within the m-th collection cycle;

[0080] Processing module: determine the maximum network flow Qimax=max(QJHi) at the i-th time node, and calculate the flow difference Qidif=Qimax-Qmi. When the flow difference Qidif≥Qdif', mark it as an abnormal difference, Qidif' represents a preset flow difference threshold;

[0081] Calculate the judgment ratio C=Syc / Stot, where Syc represents the total number of abnormal differences, and Stot represents the total number of abnormal differences. When the judgment ratio C≥C', remove the maximum network flow and execute the above steps again, where C' represents a preset ratio threshold, until a judgment ratio C corresponding to a certain maximum network flow is <C', and the maximum network flow at this time is recorded as the maximum standard flow Qstai;

[0082] Generate data points (ti, Qstai), where ti represents the time interval between the ith time node and the starting point of the acquisition cycle, and fit the data points to obtain a curve f(t) of the maximum standard flow rate changing with time;

[0083] Judgment module: set a judgment period, obtain network traffic in real time within the judgment period, use it as pending traffic, and draw a curve g(t) of the pending traffic changing with time;

[0084] Intercepting the portion of the curve of the maximum standard flow rate changing with time corresponding to the judgment period, and using it as the target curve f'(t);

[0085] An evaluation function h(t)=g(t)-f'(t) is determined, and whether there is a network security risk is determined based on the evaluation function.

[0086] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A method for assessing power network security risks, characterized in that: The following steps are involved: S1: Set m collection cycles, where m is a preset value. Within the collection cycle, set several time nodes at preset time intervals, obtain network traffic at the time nodes, and generate a network traffic set QJH i =(Q1 i , Q2 i ,…,Qm i ), Qm i represents the network traffic at the i-th time node in the m-th collection cycle; S2: Determine the maximum network flow Qi at the i-th time node max =max(QJH i ), and calculate the flow difference Qi dif =Qi max -Qmi, when the flow difference Qi dif ≥Q dif ', mark it as an abnormal difference, Qi dif ' represents the preset flow difference threshold; Calculate the judgment ratio C=S yc / S tot , S yc represents the total number of abnormal differences, S tot represents the total number of abnormal differences. When the judgment ratio C≥C', remove the maximum network flow and execute the above steps again. C' represents a preset ratio threshold until a judgment ratio C<C' corresponding to a certain maximum network flow is reached, and the maximum network flow at this time is recorded as the maximum standard flow Qstai; Generate data points (ti, Qstai), ti represents the time interval between the ith time node and the starting point of the acquisition cycle, and fit the data points to obtain a curve f(t) of the maximum standard flow rate changing with time; S3: setting a judgment period, obtaining network traffic in real time within the judgment period, taking it as pending traffic, and drawing a curve g(t) of the pending traffic changing with time; intercepting a portion of the curve of the maximum standard flow rate changing with time corresponding to the judgment period and taking it as the target curve f'(t); Determine an evaluation function h(t)=f'(t)-g(t), and determine whether there is a network security risk based on the evaluation function.

2. A method for assessing power network security risks according to claim 1, characterized in that: In step S3, the process of determining whether there is a network security risk according to the evaluation function specifically includes: The intersection of the evaluation function and the x-axis is taken as a reference point. When the evaluation function between two adjacent reference points is below the x-axis, it is marked as an abnormal curve, and the total number N of the abnormal curves is counted; The evaluation score K is calculated by the formula: ； Wherein, Q' represents a preset network security flow threshold, ε represents a preset correction coefficient and ε<0, Tn represents the duration corresponding to the nth abnormal curve, Tend represents the end time of the judgment cycle, and Tsta represents the start time of the judgment cycle; When the evaluation score K>K', it is determined that there is a network security risk, and an early warning message is sent to remind the staff, where K' represents a preset evaluation score threshold.

3. A method for assessing power network security risks according to claim 2, characterized in that: In the process of judging whether there is a network security risk according to the evaluation function, when When it is greater than 0.8, it is determined that there is a network security risk.

4. A method for assessing power network security risks according to claim 1, characterized in that: In step S2, the process of determining the flow difference threshold value specifically includes: Sort the network traffic at time node i by size. The larger the network traffic, the lower the ranking, and the traffic ranking is obtained. Calculate the difference between the network traffic at two adjacent sorting positions in the traffic sorting, and use it as the initial difference; Calculate the standard deviation S of the initial difference, and when the standard deviation S≥S', remove the fluctuation difference, S' represents a preset standard deviation threshold, and the fluctuation difference is the maximum and minimum values ​​of the initial difference, and calculate the standard deviation again, and repeat the above steps until the standard deviation S after removing the fluctuation difference is less than S'; The mean of the initial differences that have not been removed at this time is calculated and used as the flow difference threshold at time node i.

5. A method for assessing power network security risks according to claim 4, characterized in that: The process of calculating the mean of the initial differences that have not been removed at this time also includes the following steps: When the difference between the initial difference b and the flow difference threshold is greater than the preset first difference threshold, the initial difference b is removed and the average is calculated again, and is used as the flow difference threshold at time node i.

6. A method for assessing power network security risks according to claim 2, characterized in that: In the step S3, when the pending traffic is greater than the network traffic security threshold, the subsequent steps are not executed and it is determined that there is a network security risk.

7. A method for assessing power network security risks according to claim 6, characterized in that: In the step S1, when the network traffic in the collection period a is greater than the network traffic security threshold, the following steps are performed: Sorting the acquisition cycles in the order of the time axis, and determining the start time tsta1 of the first acquisition cycle in the order; The acquisition period a is removed, and a new acquisition period [tsta1-A, tsta1] is set, where A represents the length of the acquisition period.

8. A power network security risk assessment system, characterized in that: include: Initial module: Set m collection cycles, where m is a preset value. Within the collection cycle, set several time nodes at preset time intervals, obtain network traffic at the time nodes, and generate a network traffic set QJH i =(Q1 i , Q2 i ,…,Qm i ), Qm i represents the network traffic at the i-th time node in the m-th collection cycle; Processing module: Determine the maximum network flow Qi at the i-th time node max =max(QJH i ), and calculate the flow difference Qi dif =Qi max -Qmi, when the flow difference Qi dif ≥Q dif ', mark it as an abnormal difference, Qi dif ' represents the preset flow difference threshold; Calculate the judgment ratio C=S yc / S tot , S yc represents the total number of abnormal differences, S tot represents the total number of abnormal differences. When the judgment ratio C≥C', remove the maximum network flow and execute the above steps again. C' represents a preset ratio threshold until a judgment ratio C<C' corresponding to a certain maximum network flow is reached, and the maximum network flow at this time is recorded as the maximum standard flow Qstai; Generate data points (ti, Qstai), ti represents the time interval between the ith time node and the starting point of the acquisition cycle, and fit the data points to obtain a curve f(t) of the maximum standard flow rate changing with time; Judgment module: setting a judgment period, obtaining network traffic in real time within the judgment period, taking it as pending traffic, and drawing a curve g(t) of the pending traffic changing with time; intercepting a portion of the curve of the maximum standard flow rate changing with time corresponding to the judgment period and taking it as the target curve f'(t); Determine an evaluation function h(t)=g(t)-f'(t), and determine whether there is a network security risk based on the evaluation function.

Images