Power operation and maintenance network security protection system
By designing data transmission, processing and permission application modules in the power operation and maintenance network, combining primary and secondary storage units, authentication and in-depth analysis units, the problem of slow response of existing systems is solved, and rapid identification and defense against network security is achieved Risk significantly improves the security performance of the power operation and maintenance network.
Patent Information
- Application Number
- CN202411372861.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-29
- Publication Date
- 2024-12-10
AI Technical Summary
The existing power operation and maintenance network security monitoring and early warning system uses ordinary commercial servers and is slow to respond to network intrusions quickly, resulting in low security.
A power operation and maintenance network security protection system was designed, including data transmission module, data processing module and permission application module, using first- and second-level storage units, authentication module, log unit and deep analysis unit, and through in-depth analysis and intelligent construction The unit identifies potential network security risks and forms a protective wall for real-time dynamic defense.
It effectively improves the security performance of the power operation and maintenance network, can quickly identify and deal with abnormal data flows, form an intelligent protection wall, and enhance network protection capabilities.
Smart Images
Figure CN119109694A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of power network protection, and in particular to a power operation and maintenance network protection system. Background Art
[0002] The power operation and maintenance network refers to the use of modern information technology means such as computer network technology and communication technology to connect various links of the power system to form a comprehensive network that integrates monitoring, management, dispatching, operation and maintenance and other functions.
[0003] With the rapid development of information technology, the level of informatization, digitalization and intelligence of the power system has been continuously improved, but at the same time it is also facing more network security risks.
[0004] At present, the existing power operation and maintenance network security monitoring and early warning system servers still use ordinary commercial servers, and have not been improved accordingly for the power system, which makes the server system run slowly, resulting in a slow response of the power operation and maintenance network security monitoring and early warning system, and unable to make basic responses to network intrusions, and its security is low. Summary of the invention
[0005] The purpose of the present invention is to solve the shortcomings of the prior art and to propose a power operation and maintenance network security protection system.
[0006] In order to achieve the above object, the present invention adopts the following technical solutions: A power operation and maintenance network security protection system, the system comprising: A data transmission module, a data processing module, and a permission application module, wherein an output end of the data transmission module is connected to an input end of the data processing module, and another input end of the data processing module is connected to the permission application module, wherein the data processing module includes a data storage unit and a data comparison unit, the data storage unit is provided with a primary storage unit and a secondary storage unit, the primary storage unit is provided with an authentication module, one output end of the authentication module is connected to the data storage unit through a log unit, and another output end is connected to the depth analysis unit; The authentication module is provided with a log unit and a deep analysis unit, wherein the log unit and the deep analysis unit are connected to each other, wherein the deep analysis unit is provided with an analysis and learning unit and an intelligent construction unit, the intelligent construction unit is connected to the input end of the data comparison unit, and the analysis and learning unit is directly connected to the intelligent construction unit, and the intelligent construction unit constructs a data model through the files in the log unit, and stores it in a primary storage unit provided in the data storage unit.
[0007] Preferably, the data transmission module is provided with a wired interface and a wireless interface to connect and transmit the corresponding data source, and is responsible for aggregating the data of the input file and transmitting it to the data processing module.
[0008] Preferably, the permission application module includes a physical input module and a cloud input module, wherein the physical input module and the cloud input module serve as access layers to allow personnel to access the data storage unit, wherein the physical input module includes a numeric keyboard and the cloud input module includes a mobile device.
[0009] Preferably, the data storage unit is provided with an identity comparison unit, the input end of the identity comparison unit is directly connected to the output end of the physical input module and the cloud input module, and compares the input data information thereof, wherein the identity comparison unit and the data comparison unit share a primary storage unit in the data storage unit, and share its storage framework, which includes user information and data information, and a multi-layer identity system is provided in the identity comparison unit, which performs fine-grained access permission control based on user identity and role, to ensure that only authorized users can access corresponding resources.
[0010] Preferably, the data information input by the data transmission module is preferentially accepted by the data processing module, and the accepted data information is directly compared through the data comparison unit, and the network traffic and user behavior are deeply analyzed. At the same time, the input data information is directly stored in the primary storage unit in the data storage unit for temporary storage, and will be stored in the secondary storage unit after full trust. The primary storage unit is directly monitored and read by the server.
[0011] Preferably, the authentication module includes a log unit and a deep analysis unit, wherein the log unit records the data stream in the data storage unit in real time, wherein the deep analysis unit is provided with an analysis and learning unit, which directly reads the data stream in the log unit, and performs adaptive analysis, judgment, and learning, and the corresponding data is used by the intelligent construction unit to produce a threat prediction model, so as to identify potential network security risks in advance and take corresponding protective measures.
[0012] Preferably, the primary storage unit is used for temporary storage, downloading and storing each real-time data stream, which includes safe traffic and suspicious traffic.
[0013] Preferably, the log file will record in detail the specific IP address and log record of each data flow.
[0014] Preferably, the intelligent construction unit includes a direct protection unit, which performs a deep inspection when suspicious traffic is detected, reads the normal data flow predetermined in the log unit and the identity comparison unit, compares it with the predefined attack signature library, and automatically blocks the confirmed malicious traffic to prevent the attack from further spreading.
[0015] The beneficial effects of the present invention are: In the present invention, a primary storage unit and a secondary storage unit are provided in the data storage unit, and the primary storage unit is used as a temporary storage framework, and cooperates with the authentication module and the identity comparison module to analyze its internal data source, and stores the trusted file in the secondary storage unit, and when an abnormal data flow is identified, the data flow is analyzed and learned by the analysis and learning unit and cooperates with the intelligent construction unit to form a corresponding protective wall, and the corresponding data flow information is recorded in the log unit for real-time dynamic defense, which can be updated as the data flow is updated, and can learn to protect each abnormal data flow, thereby strengthening its network protective wall and effectively improving the security performance of the circuit operation and maintenance network. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 This is a schematic diagram of the overall framework of a power operation and maintenance network security protection system proposed by the present invention. DETAILED DESCRIPTION
[0017] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.
[0018] Reference Figure 1 , a power operation and maintenance network security protection system, the system comprising: A data transmission module, a data processing module, and a permission application module, wherein an output end of the data transmission module is connected to an input end of the data processing module, and another input end of the data processing module is connected to the permission application module, wherein the data processing module includes a data storage unit and a data comparison unit, the data storage unit is provided with a primary storage unit and a secondary storage unit, the primary storage unit is provided with an authentication module, one output end of the authentication module is connected to the data storage unit through a log unit, and another output end is connected to the depth analysis unit; Furthermore, the authentication module is provided with a log unit and a deep analysis unit, wherein the log unit and the deep analysis unit are interconnected, wherein the deep analysis unit is provided with an analysis and learning unit and an intelligent construction unit, the intelligent construction unit is connected to the input end of the data comparison unit, and the analysis and learning unit is directly connected to the intelligent construction unit, and the intelligent construction unit constructs a data model through the files in the log unit, and stores it in a primary storage unit provided in the data storage unit.
[0019] Furthermore, the data transmission module is provided with a wired interface and a wireless interface to connect and transmit the corresponding data source, and is responsible for aggregating the data of the input file and transmitting it to the data processing module.
[0020] Furthermore, the permission application module includes a physical input module and a cloud input module, wherein the physical input module and the cloud input module serve as access layers to allow personnel to access the data storage unit, wherein the physical input module includes a numeric keyboard and the cloud input module includes a mobile device.
[0021] Furthermore, the data storage unit is provided with an identity comparison unit, the input end of the identity comparison unit is directly connected to the output end of the physical input module and the cloud input module, and compares the input data information thereof, wherein the identity comparison unit and the data comparison unit share a primary storage unit in the data storage unit, and share its storage framework, which includes user information and data information, and a multi-layer identity system is provided in the identity comparison unit, which performs fine-grained access permission control based on user identity and role, to ensure that only authorized users can access corresponding resources.
[0022] Furthermore, the data information input by the data transmission module is preferentially accepted by the data processing module, and the accepted data information is directly compared through the data comparison unit, and the network traffic and user behavior are deeply analyzed. At the same time, the input data information is directly stored in the primary storage unit in the data storage unit for temporary storage, and will be stored in the secondary storage unit after full trust. The primary storage unit is directly monitored and read by the server.
[0023] Furthermore, the authentication module includes a log unit and a deep analysis unit. The log unit records the data flow in the data storage unit in real time. The deep analysis unit is provided with an analysis and learning unit. The analysis and learning unit directly reads the data flow in the log unit, and performs adaptive analysis, judgment, and learning. The corresponding data is used by the intelligent construction unit to produce a threat prediction model, so as to identify potential network security risks in advance and take corresponding protective measures.
[0024] Furthermore, the primary storage unit performs temporary storage and downloads and stores each real-time data stream, which includes safe traffic and suspicious traffic.
[0025] Furthermore, the log file will record in detail the specific IP address and log records of each data flow.
[0026] Furthermore, the intelligent construction unit includes a direct protection unit, which performs a deep inspection when suspicious traffic is detected, reads the normal data flow predetermined in the log unit and the identity comparison unit, compares it with the predefined attack signature library, and automatically blocks the confirmed malicious traffic to prevent the attack from spreading further.
[0027] In this embodiment, the user directly accesses the data storage unit of the network system through the permission application module, wherein the permission application module includes a physical input module and a cloud input module to satisfy the user's identity information input. At the same time, the identity information is input into the power network system data processing module. The data storage unit provided in the data processing module records the access rights and identifies the identity information through the identity comparison unit. After trust, the user is authorized to access the data storage unit to modify and read the internal data.
[0028] Among them, the data transmission module transmits the corresponding data to the data processing module, and the data comparison unit in the data storage unit reads and identifies it, wherein the data storage unit includes user information and data information, and the data comparison unit will authenticate the data flow of this operation with the authentication module in the primary storage unit. After authorization, the overlapping data flow will be recorded, recorded in the log file, and the data flow will be authorized.
[0029] When an abnormal data stream is input, the primary storage unit will download, record, and temporarily store it by default, and perform authentication processing through the authentication module, and record it in a log file. When the corresponding overlapping and matching data stream cannot be identified, the deep analysis unit will analyze and identify the data stream, monitor network traffic and user behavior in real time, and then the data stream will be recorded in the log unit, and the analysis and learning unit will make the final judgment. When it is determined that there is no trusted data stream, the secondary storage unit refuses to accept the data stream, and records and reads the access information, purpose, and address of the data stream through the intelligent construction unit, and forms a corresponding protective wall, builds an intelligent security threat prediction model, identifies potential network security risks in advance, and takes corresponding protective measures.
[0030] Among them, in the actual application process, the data storage unit includes a primary storage unit and a secondary storage unit. The temporary identity information entered by the user will be directly recorded and downloaded to the primary storage unit. The primary storage unit directly reads the secondary storage unit and compares it. When overlapping data streams occur, the user operation is authorized. If there is no overlapping data stream, the operation will be recorded in the log file. After an abnormal operation occurs, the operation will be stopped directly through the intelligent construction unit.
[0031] In the present invention, a primary storage unit and a secondary storage unit are provided in the data storage unit, and the primary storage unit is used as a temporary storage framework, and cooperates with the authentication module and the identity comparison module to analyze its internal data source, and stores the trusted file in the secondary storage unit, and when an abnormal data flow is identified, the data flow is analyzed and learned by the analysis and learning unit and cooperates with the intelligent construction unit to form a corresponding protective wall, and the corresponding data flow information is recorded in the log unit for real-time dynamic defense, which can be updated as the data flow is updated, and can learn to protect each abnormal data flow, thereby strengthening its network protective wall and effectively improving the security performance of the circuit operation and maintenance network.
[0032] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.
Claims
1. A power operation and maintenance network security protection system, characterized in that: The system comprises: A data transmission module, a data processing module, and a permission application module, wherein an output end of the data transmission module is connected to an input end of the data processing module, and another input end of the data processing module is connected to the permission application module, wherein the data processing module includes a data storage unit and a data comparison unit, the data storage unit is provided with a primary storage unit and a secondary storage unit, the primary storage unit is provided with an authentication module, one output end of the authentication module is connected to the data storage unit through a log unit, and another output end is connected to the depth analysis unit; The authentication module is provided with a log unit and a deep analysis unit, wherein the log unit and the deep analysis unit are connected to each other, wherein the deep analysis unit is provided with an analysis and learning unit and an intelligent construction unit, the intelligent construction unit is connected to the input end of the data comparison unit, and the analysis and learning unit is directly connected to the intelligent construction unit, and the intelligent construction unit constructs a data model through the files in the log unit, and stores it in a primary storage unit provided in the data storage unit.
2. According to claim 1, a power operation and maintenance network security protection system is characterized in that: The data transmission module is provided with a wired interface and a wireless interface to connect and transmit the corresponding data source, and is responsible for aggregating the data of the input file and transmitting it to the data processing module.
3. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The permission application module includes a physical input module and a cloud input module, wherein the physical input module and the cloud input module serve as access layers to allow personnel to access the data storage unit, wherein the physical input module includes a numeric keyboard and the cloud input module includes a mobile device.
4. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The data storage unit is provided with an identity comparison unit, the input end of the identity comparison unit is directly connected to the output end of the physical input module and the cloud input module, and compares the input data information thereof, wherein the identity comparison unit and the data comparison unit share a primary storage unit in the data storage unit, and share its storage framework, which includes user information and data information, and a multi-layer identity system is provided in the identity comparison unit, which performs fine-grained access permission control based on user identity and role, to ensure that only authorized users can access corresponding resources.
5. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The data information input by the data transmission module is preferentially accepted by the data processing module, and the accepted data information is directly compared through the data comparison unit, and the network traffic and user behavior are deeply analyzed. At the same time, the input data information is directly stored in the primary storage unit in the data storage unit for temporary storage, and will be stored in the secondary storage unit after full trust. The primary storage unit is directly monitored and read by the server.
6. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The authentication module includes a log unit and a deep analysis unit. The log unit records the data flow in the data storage unit in real time. The deep analysis unit is provided with an analysis and learning unit. The analysis and learning unit directly reads the data flow in the log unit and performs adaptive analysis, judgment, and learning. The corresponding data is used by the intelligent construction unit to produce a threat prediction model to identify potential network security risks in advance and take corresponding protective measures.
7. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The primary storage unit is used for temporary storage, downloading and storing each real-time data stream, which includes safe traffic and suspicious traffic.
8. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The log file will record in detail the specific IP address and log records of each data flow.
9. The power operation and maintenance network security protection system according to claim 1 is characterized in that: The intelligent construction unit includes a direct protection unit, which performs a deep inspection when suspicious traffic is detected, reads the normal data flow predetermined in the log unit and the identity comparison unit, compares it with the predefined attack signature library, and automatically blocks the confirmed malicious traffic to prevent the attack from spreading further.