Security detection method and system for power grid information network

Abstract

The invention provides a power grid information network security detection method and system, and relates to the field of power grid information network security detection. The security detection method provided by the invention comprises the steps of extracting risk information of a power grid information network to construct a data set, constructing a manual confirmation risk set, and constructing a risk pre-judgment sub-model; carrying out data coding based on a power grid information network by integrating graph coding and vector coding to obtain training data, training the initial model, and verifying by integrating traditional evaluation indexes and entity object importance to obtain a security detection model; and obtaining the to-be-identified power grid flow and performing pre-judgment based on the risk pre-judgment sub-model, outputting a pre-judgment detection result when the pre-judgment is risk information or safety information, performing detection analysis based on the safety detection model to obtain a safety detection result when the risk pre-judgment fails, and updating the manual confirmation risk set and the risk pre-judgment sub-model. According to the method, the problems of poor timeliness of an analysis model, low event identification accuracy, insufficient generalization ability and the like can be improved.

Description

Technical Field

[0001] The present invention relates to the field of power grid information network security detection, and in particular to a power grid information network security detection method and system. Background Art

[0002] The power grid information network is a complex system, which covers multiple links such as substations at all levels, distribution terminals, dispatching agencies, offices, etc., and forms a huge network through close or loose connections. It is an important part of the power system and plays an irreplaceable role in the operation, management and optimization of the power system.

[0003] At present, network security, including power grid information networks, is mainly based on interception during attacks and repair after attacks, while pre-emptive defense and active monitoring related technologies and solutions are rarely used as the most ideal security technology. Problems in existing technologies: First, facing a large amount of chaotic network attack traffic, the efficiency of security detection is low and the timeliness of analysis is poor; second, the accuracy of identifying events or attacks is low, and the model generalization ability is insufficient.

[0004] Therefore, it is urgent to develop a solution to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide a detection method and system for power grid information network security, so as to improve the problems of low efficiency of security detection, poor analysis timeliness, low accuracy of identifying events or attacks, and insufficient model generalization ability when facing large and chaotic network attack traffic.

[0006] The present invention provides a method and system for detecting the safety of a power grid information network, which specifically include: In a first aspect, the present invention provides a method for detecting security of a power grid information network, comprising: Extract risk information of the power grid information network to construct a data set, build an artificially confirmed risk set whose initial state is an empty set, and build a risk prediction sub-model based on the data set and the artificially confirmed risk set; Construct an initial model, encode data based on the power grid information network and integrate graph coding and vector coding to obtain training data, train the initial model based on the training data, and verify it by integrating traditional evaluation indicators and the importance of entity objects to obtain a safety detection model; The grid flow to be identified is obtained and predicted based on the risk prediction sub-model. When the prediction is risk information or safety information, the prediction detection result is output. When the risk prediction fails, the safety detection result is obtained by performing detection analysis based on the safety detection model, and the manually confirmed risk set and risk prediction sub-model are updated.

[0007] The security detection model provided by the present invention can effectively memorize the security time of power grid information by using a deep learning algorithm in combination with power grid information network data, and comprehensively consider abnormal data to improve the accuracy of prediction results. At the same time, from data collection and analysis to behavior supervision, all are executed in real time or near real time, and can respond quickly when an anomaly is detected, thereby improving data processing efficiency. In addition, automatic, real-time prediction and calculation of power grid network security time greatly reduces dependence on manual monitoring, thereby effectively reducing power grid network operating costs and saving human resources. At the same time, the present invention can fully consider the various influencing factors of the power grid information network's own characteristics and external environment characteristics by comprehensively considering dimensions such as security deployment architecture, business traffic, historical network attacks, and network security time, and the accuracy of risk assessment has been greatly improved.

[0008] Optionally, when obtaining the power grid flow to be identified and making a prediction based on the risk prediction sub-model, pattern matching, similarity matching and family risk matching are performed on the power grid flow to be identified in sequence.

[0009] Optionally, when pattern matching, similarity matching and family risk matching are performed in sequence, it includes: The grid flow to be identified is pattern matched with the data set and the manually confirmed risk set respectively. When the match is successful, the prediction is completed. Otherwise, the similarity between the grid flow to be identified and the data set is calculated. When the similarity is greater than the preset similarity threshold, the prediction is completed. Otherwise, the risk value of the entity object and the relationship in the grid flow to be identified are weighted to calculate the family risk value. When the family risk value is greater than the preset risk threshold, the prediction is completed, otherwise the prediction fails.

[0010] Optionally, when the risk value of the entity object in the identified power grid flow is weighted to calculate the risk value of the relationship to obtain the family risk value, it includes: Calculate the risk values ​​of the entity objects in the power grid flow to be identified respectively; Calculate the ratio of the number of known risk pairs contained in the to-be-identified power grid flow to the total number of risk pairs, and obtain the risk value of the pairs with similar relationships; Assign adjustable weights to the risk value of the entity object and the risk value of the close relationship pair, and obtain the family risk value through weighted calculation; The weighted calculation formula of the family risk value is as follows: ; in, is the adjustable weight of the entity object, is the adjustable weight of the proximity to the risk value, is the risk value of the entity object, is the risk value of the close relationship.

[0011] Optionally, when data encoding is performed based on the power grid information network and by integrating graph encoding and vector encoding to obtain training data, the method includes: After preprocessing the network flow data in the power grid information network and performing balancing and desensitization, feature extraction is performed to obtain the flow data set; After preprocessing the network environment data in the power grid information network and performing feature extraction, data encoding is performed based on timestamps to obtain an environment data set; The traffic dataset and the environmental dataset are fused and annotated, and the training data is obtained by encoding the data using a combination of graph encoding and vector encoding.

[0012] Optionally, the training data is obtained after data encoding by integrating graph encoding and vector encoding, and the data encoding process includes: The relationship information in the labeled data is assigned relationship importance based on graph coding, and the entity information in the labeled data is assigned individual importance based on vector coding. The relationship importance and individual importance are numerically calculated to obtain entity importance. The labeled data is encoded based on entity importance to obtain training data. The formula for calculating entity importance is as follows: ; Indicates the entity serial number, Indicates The importance number of each entity, For the importance of relationship, of individual importance.

[0013] Optionally, when training the initial model based on the training data, the steps specifically include: Randomly divide the training data into validation set and training set; Build the initial model framework, design the number of input layers, hidden layers, and output layers of the initial model, and determine and regularize the loss function; The initial model is iteratively trained based on the training set, and an evaluation index is obtained by comprehensively considering the accuracy, precision and recall rate of the initial model. The training is terminated when the evaluation index is within a preset range, and the trained model is evaluated and fine-tuned based on the validation set.

[0014] Optionally, traditional evaluation indicators and the importance of entity objects are combined for verification to obtain a security detection model, which specifically includes: Calculate the harmonic mean of the accuracy, precision, and recall of the initial model to obtain the unweighted evaluation index; The accuracy, precision and recall of the initial model are weighted respectively and the harmonic mean is calculated to obtain the weighted evaluation index; After weights are assigned to the unweighted evaluation indicators and the weighted evaluation indicators, the comprehensive evaluation indicators are calculated to verify the trained initial model to obtain the security detection model.

[0015] Optionally, when obtaining the unweighted evaluation index, it is as shown in the following formula: ; In the formula, is the accuracy of the initial model, is the accuracy of the initial model, is the recall rate of the initial model.

[0016] Optionally, when obtaining the weighted evaluation index, it is as shown in the following formula: ; In the formula, is the weighted accuracy of the initial model. The weighted accuracy calculation formula is: ; In the formula, is the weighted accuracy of the initial model. The weighted accuracy calculation formula is: ; In the formula, is the weighted recall rate of the initial model. The weighted recall rate calculation formula is: ; in, is the initial model accuracy, Indicates A cybersecurity incident or attack, The correct number of current cybersecurity incidents or attacks is identified, represents the number of model training sets, Indicates the current link The weight of an entity.

[0017] Optionally, when obtaining the comprehensive evaluation index, it is as shown in the following formula: ; In the formula, and They represent unweighted evaluation index and weighted evaluation index respectively. and They represent the adjustable weights of the unweighted evaluation index and the weighted evaluation index respectively.

[0018] In a second aspect, the present invention further provides a security detection system for a power grid information network, comprising: A data extraction module is used to extract risk information of the power grid information network to construct a data set, build an artificially confirmed risk set whose initial state is an empty set, and build a risk prediction sub-model based on the data set and the artificially confirmed risk set; The model training module is used to construct the initial model. Based on the power grid information network, the data is encoded by combining graph coding and vector coding to obtain training data. After the initial model is trained based on the training data, it is verified by combining traditional evaluation indicators and the importance of entity objects to obtain a safety detection model. The safety detection module is used to obtain the power grid flow to be identified and make a prediction based on the risk prediction sub-model. When the prediction is risk information or safety information, the prediction detection result is output. When the risk prediction fails, the safety detection result is obtained by performing detection analysis based on the safety detection model, and the manually confirmed risk set and risk prediction sub-model are updated.

[0019] The beneficial effects of the security detection system for power grid information network provided by the present invention are: identifying risks through security analysis models, updating and supplementing manually confirmed risk sets and risk prediction sub-models, making the system's later retrieval and identification of network security events more and more efficient, and the long-tail effect is obvious; for network connection scenarios with high repetitiveness and complex relationships, the retrieval efficiency and effect are improved, saving system resources and costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flow chart of the steps of a risk prediction sub-model of a safety detection method for a power grid information network provided by the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be understood by people with general skills in the field to which the present invention belongs. "Including" and similar words used in this article mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0022] An embodiment of the present invention provides a method for detecting the security of a power grid information network, which specifically includes: S1. Extract risk information of the power grid information network to construct a data set, build an artificially confirmed risk set whose initial state is an empty set, and build a risk prediction sub-model based on the data set and the artificially confirmed risk set; S2. Construct an initial model, obtain training data by encoding data based on the power grid information network and integrating graph coding and vector coding, train the initial model based on the training data, and verify it by integrating traditional evaluation indicators and the importance of entity objects to obtain a safety detection model; S3. Obtain the power grid flow to be identified and make a prediction based on the risk prediction sub-model. When the prediction is risk information or safety information, output the prediction detection result. When the risk prediction fails, perform detection analysis based on the safety detection model to obtain the safety detection result, and update the manually confirmed risk set and the risk prediction sub-model.

[0023] In some embodiments, when S1 is executed, it includes: S1-1. Extract risk information of the power grid information network to construct a data set, and build an artificially confirmed risk set whose initial state is an empty set; S1-2. Construct a risk prediction sub-model based on the data set and manually confirmed risk set.

[0024] Specifically, when S1-1 is executed, the risk information in the power grid information network includes: threat intelligence data set, IP and regional risk set, IP blacklist and whitelist set and power grid private network threat intelligence.

[0025] Furthermore, the risk information in the power grid information network is formatted and standardized, and then the data set is obtained after deduplication, dimension removal, deletion of invalid data, and disposal of ambiguous information.

[0026] Specifically, when executing S1-2, when the power grid flow to be identified is obtained and predicted based on the risk prediction sub-model, the power grid flow to be identified is subjected to pattern matching, similarity matching and family risk matching in sequence.

[0027] Furthermore, the manually confirmed risk set is derived from a data set that is analyzed as having risks in the security detection model and has risks after being manually confirmed, and the initial state is an empty set.

[0028] In fact, see Figure 1 , when pattern matching, similarity matching and family risk matching are performed in sequence, including: The grid flow to be identified is pattern matched with the data set and the manually confirmed risk set respectively. When the match is successful, the prediction is completed. Otherwise, the similarity between the grid flow to be identified and the data set is calculated. When the similarity is greater than the preset similarity threshold, the prediction is completed. Otherwise, the risk value of the entity object and the relationship in the grid flow to be identified are weighted to calculate the family risk value. When the family risk value is greater than the preset risk threshold, the prediction is completed, otherwise the prediction fails.

[0029] Furthermore, pattern matching is performed to match the to-be-identified power grid traffic with the standardized data set and the manual risk confirmation set. If the threat information is matched, it is marked as a threat and the result is returned to the risk prediction sub-model; if it is matched with the whitelist, it is marked as a security event. Furthermore, similarity matching uses the cosine similarity algorithm to calculate the similarity against the data set. When the similarity is higher than the preset threshold, it is marked as a threat, otherwise it is whitelisted. If the similarity is less than or equal to the preset threshold, it is considered a judgment failure; In fact, when the risk value of the entity object in the identified power grid flow is weighted to calculate the risk value of the relationship to obtain the family risk value, it includes: Calculate the risk values ​​of the entity objects in the power grid flow to be identified respectively; Calculate the ratio of the number of known risk pairs contained in the to-be-identified power grid flow to the total number of risk pairs, and obtain the risk value of the pairs with similar relationships; The risk value of the entity object and the risk value of the close relationship pair are given adjustable weights, and the family risk value is obtained by weighted calculation.

[0030] Furthermore, the family risk value weighted calculation formula is as follows: ; in, is the adjustable weight of the entity object, is the adjustable weight of the proximity to the risk value, is the risk value of the entity object, is the risk value of the close relationship.

[0031] It should be noted that family risk matching is based on pattern matching and similarity matching. If both fail, family matching will be further performed. The scenario significance of family matching is that the risks of entity objects involved in the traffic can be identified based on other objects with similar relationships.

[0032] Furthermore, most entity objects are IP addresses or links. For example, if a certain IP address is ip7, and its adjacent IP addresses ip4 / ip5 / ip8 / ip9 in the public network are all risky IPs, then it is highly likely that ip7 is also a risky IP.

[0033] It should be noted that the family matching process is: a. Calculate the risk value of all IP objects involved in the current process. The formula is as follows: ; Among them, the distance from the current IP is the ordinal distance from the current IP, such as the distance between 192.168.100.100 and 192.168.100.101 is 1; b. Calculate the ratio of the number of known risk pairs to the total risk pairs to obtain the risk value of the close relationship pairs. The formula is as follows: ; c. The family risk calculation formula is as follows: ; in, is the adjustable weight of the entity object, is the adjustable weight of the proximity to the risk value, is the risk value of the entity object, is the risk value of the close relationship.

[0034] d. Perform family risk identification, set the family risk threshold warn_curr0, determine the relationship between warn_curr and warn_curr0, and identify whether the current flow is risky flow. If it is not a risky flow, return a judgment failure.

[0035] In some embodiments, when executing step S2, it includes: S2-1. Construct an initial model, encode data based on the power grid information network and integrate graph coding and vector coding to obtain training data; S2-2, after training the initial model based on the training data, the traditional evaluation indicators and the importance of the entity objects are comprehensively verified to obtain the security detection model; Specifically, when executing step S2-1, data encoding is performed based on the power grid information network and the graph encoding and vector encoding are combined to obtain training data, including: After preprocessing the network flow data in the power grid information network and performing balancing and desensitization, feature extraction is performed to obtain the flow data set; After preprocessing the network environment data in the power grid information network and performing feature extraction, data encoding is performed based on timestamps to obtain an environment data set; The traffic dataset and the environmental dataset are fused and annotated, and the training data is obtained by encoding the data using a combination of graph encoding and vector encoding.

[0036] In fact, the training data is obtained by performing data encoding by integrating graph encoding and vector encoding, and the data encoding process includes: The relationship importance is set for the relationship information in the labeled data based on graph coding, and the individual importance is set for the entity information in the labeled data based on vector coding. The entity importance is obtained by numerically calculating the relationship importance and the individual importance. The labeled data is encoded based on the entity importance to obtain training data.

[0037] Furthermore, the entity importance calculation formula is as follows: ; Indicates the entity serial number, Indicates The importance number of each entity, For the importance of relationship, of individual importance.

[0038] Furthermore, relationship importance mainly describes the importance of the relationship between entities in the graph space, and different importances are set between different network entity attributes as w_e_g(j); where j represents the jth attribute entity relationship; for example, the importance of network device-network device, network device-IP, and IP-IP are w_e_g(1), w_e_g(2), w_e_g(3), etc., respectively.

[0039] Furthermore, the individual importance of an entity mainly describes the importance of each entity in the graph space. The individual importance of different entities is set as w_e_v(k), where k represents the serial number of the entity, such as network devices, IPs, etc., with different importances.

[0040] Furthermore, the formula for calculating entity weight is: ; The formula means taking the maximum value of all entity importances of entity k as the current entity weight value.

[0041] Specifically, when executing step S2-2, training the initial model based on the training data specifically includes: Randomly divide the training data into validation set and training set; Build the initial model framework, design the number of input layers, hidden layers, and output layers of the initial model, and determine and regularize the loss function; The initial model is iteratively trained based on the training set, and an evaluation index is obtained by comprehensively considering the accuracy, precision and recall rate of the initial model. The training is terminated when the evaluation index is within a preset range, and the trained model is evaluated and fine-tuned based on the validation set.

[0042] In fact, the security detection model is obtained by combining traditional evaluation indicators and the importance of entity objects for verification, including: Calculate the harmonic mean of the accuracy, precision, and recall of the initial model to obtain the unweighted evaluation index; The accuracy, precision and recall of the initial model are weighted respectively and the harmonic mean is calculated to obtain the weighted evaluation index; After weights are assigned to the unweighted evaluation indicators and the weighted evaluation indicators, the comprehensive evaluation indicators are calculated to verify the trained initial model to obtain the security detection model.

[0043] In fact, when obtaining the unweighted evaluation index, it is as shown in the following formula: ; In the formula, is the accuracy of the initial model, is the accuracy of the initial model, is the recall rate of the initial model; And / or, when obtaining the weighted evaluation index, it is as shown in the following formula: ; In the formula, is the weighted accuracy of the initial model. The weighted accuracy calculation formula is: ; In the formula, is the weighted accuracy of the initial model. The weighted accuracy calculation formula is: ; In the formula, is the weighted recall rate of the initial model. The weighted recall rate calculation formula is: ; in, is the initial model accuracy, Indicates A cybersecurity incident or attack, The correct number of current cybersecurity incidents or attacks is identified, represents the number of model training sets, Indicates the current link The weight of an entity.

[0044] And / or, when obtaining the comprehensive evaluation index, it is as shown in the following formula: ; In the formula, and They represent unweighted evaluation index and weighted evaluation index respectively. and They represent the adjustable weights of the unweighted evaluation index and the weighted evaluation index respectively.

[0045] It should be noted that the weight values ​​of unweighted evaluation indicators and weighted evaluation indicators are hyper-parameters. They are given by business experts before the model is created, and are appropriately adjusted according to different business scenarios in the later stage, such as according to different stages, time periods, periods and the frequency, proportion, external environmental factors, etc. of network security incidents.

[0046] Furthermore, the model is evaluated using the validation set, and its comprehensive evaluation indicators are used to judge the training effect of the model. Then, the tuning method is determined based on its training effect until all indicators meet the standards.

[0047] In some embodiments, when executing step S3, it includes: S3-1, used to obtain the power grid flow to be identified and make a prediction based on the risk prediction sub-model, and output the prediction detection result when the prediction is risk information or safety information; S3-2: When risk prediction fails, a safety detection result is obtained by performing detection analysis based on the safety detection model, and the manually confirmed risk set and risk prediction sub-model are updated.

[0048] Specifically, when executing step S3-1, risk prediction is performed in sequence using traditional pattern matching, similarity matching and family risk matching methods to obtain prediction results.

[0049] Specifically, when executing step S3-2, the safety detection results obtained according to the analysis are updated to the manually confirmed risk set after manual confirmation, and the updated manually confirmed risk set is used for pattern matching to update the pattern matching library of the risk prediction sub-model.

[0050] Furthermore, since it uses rule matching and similarity calculation, it has high computational efficiency and is used in some scenarios where blacklists and whitelists are extremely prominent. If the risk prediction sub-model has already identified whether a certain traffic is risky, the security analysis model is no longer used for identification.

[0051] Although the embodiments of the present invention are described in detail above, it is obvious to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as described in the claims. Moreover, the present invention described herein may have other embodiments and may be implemented or realized in a variety of ways.

Claims

1. A security detection method for a power grid information network, characterized in that: include: Extract risk information of the power grid information network to construct a data set, build an artificially confirmed risk set whose initial state is an empty set, and build a risk prediction sub-model based on the data set and the artificially confirmed risk set; Construct an initial model, encode data based on the power grid information network and integrate graph coding and vector coding to obtain training data, train the initial model based on the training data, and verify it by integrating traditional evaluation indicators and the importance of entity objects to obtain a safety detection model; The grid flow to be identified is obtained and predicted based on the risk prediction sub-model. When the prediction is risk information or safety information, the prediction detection result is output. When the risk prediction fails, the safety detection result is obtained by performing detection analysis based on the safety detection model, and the manually confirmed risk set and risk prediction sub-model are updated.

2. The safety detection method according to claim 1, characterized in that: When obtaining the power grid flow to be identified and making a prediction based on the risk prediction sub-model, the power grid flow to be identified is subjected to pattern matching, similarity matching and family risk matching in sequence.

3. The safety detection method according to claim 2, characterized in that: When pattern matching, similarity matching and family risk matching are performed in sequence, it includes: The grid flow to be identified is pattern matched with the data set and the manually confirmed risk set respectively. When the match is successful, the prediction is completed. Otherwise, the similarity between the grid flow to be identified and the data set is calculated. When the similarity is greater than the preset similarity threshold, the prediction is completed. Otherwise, the risk value of the entity object and the relationship in the grid flow to be identified are weighted to calculate the family risk value. When the family risk value is greater than the preset risk threshold, the prediction is completed, otherwise the prediction fails.

4. The safety detection method according to claim 3, characterized in that: When the risk value of the entity object in the identified power grid flow is weighted to calculate the risk value of the relationship to obtain the family risk value, it includes: Calculate the risk values ​​of the entity objects in the power grid flow to be identified respectively; Calculate the ratio of the number of known risk pairs contained in the to-be-identified power grid flow to the total number of risk pairs, and obtain the risk value of the pairs with similar relationships; Assign adjustable weights to the risk value of the entity object and the risk value of the close relationship pair, and obtain the family risk value through weighted calculation; The weighted calculation formula of the family risk value is as follows: ； in, is the adjustable weight of the entity object, is the adjustable weight of the proximity to the risk value, is the risk value of the entity object, is the risk value of the close relationship.

5. The safety detection method according to claim 1, characterized in that: When data encoding is performed based on the power grid information network and combined with graph encoding and vector encoding to obtain training data, it includes: After preprocessing the network flow data in the power grid information network and performing balancing and desensitization, feature extraction is performed to obtain the flow data set; After preprocessing the network environment data in the power grid information network and performing feature extraction, data encoding is performed based on timestamps to obtain an environment data set; The traffic dataset and the environmental dataset are fused and annotated, and the training data is obtained by encoding the data using a combination of graph encoding and vector encoding.

6. The safety detection method according to claim 5, characterized in that: After data encoding by comprehensive graph encoding and vector encoding, training data is obtained. The data encoding process includes: The relationship information in the labeled data is assigned relationship importance based on graph coding, and the entity information in the labeled data is assigned individual importance based on vector coding. The relationship importance and individual importance are numerically calculated to obtain entity importance. The labeled data is encoded based on entity importance to obtain training data. The formula for calculating entity importance is as follows: ； Indicates the entity serial number, Indicates The importance number of each entity, For the importance of relationship, of individual importance.

7. The safety detection method according to claim 1, characterized in that: When training the initial model based on the training data, it specifically includes: Randomly divide the training data into validation set and training set; Build the initial model framework, design the number of input layers, hidden layers, and output layers of the initial model, and determine and regularize the loss function; The initial model is iteratively trained based on the training set, and an evaluation index is obtained by comprehensively considering the accuracy, precision and recall rate of the initial model. The training is terminated when the evaluation index is within a preset range, and the trained model is evaluated and fine-tuned based on the validation set.

8. The safety detection method according to claim 7, characterized in that: The traditional evaluation indicators and the importance of entity objects are combined for verification to obtain a security detection model, which includes: Calculate the harmonic mean of the accuracy, precision, and recall of the initial model to obtain the unweighted evaluation index; The accuracy, precision and recall of the initial model are weighted respectively and the harmonic mean is calculated to obtain the weighted evaluation index; After weights are assigned to the unweighted evaluation indicators and the weighted evaluation indicators, the comprehensive evaluation indicators are calculated to verify the trained initial model to obtain the security detection model.

9. The safety detection method according to claim 8, characterized in that: When obtaining the unweighted evaluation index, it is as shown in the following formula: ； In the formula, is the accuracy of the initial model, is the accuracy of the initial model, is the recall rate of the initial model; And / or, when obtaining the weighted evaluation index, it is as shown in the following formula: ； In the formula, is the weighted accuracy of the initial model. The weighted accuracy calculation formula is: ； In the formula, is the weighted accuracy of the initial model. The weighted accuracy calculation formula is: ； In the formula, is the weighted recall rate of the initial model. The weighted recall rate calculation formula is: ； in, is the initial model accuracy, Indicates A cybersecurity incident or attack, The correct number of current cybersecurity incidents or attacks is identified, represents the number of model training sets, Indicates the first The weight of an entity; And / or, when obtaining the comprehensive evaluation index, it is as shown in the following formula: ； In the formula, and They represent unweighted evaluation index and weighted evaluation index respectively. and They represent the adjustable weights of the unweighted evaluation index and the weighted evaluation index respectively.

10. A security detection system for a power grid information network, characterized in that: include: A data extraction module is used to extract risk information of the power grid information network to construct a data set, build an artificially confirmed risk set whose initial state is an empty set, and build a risk prediction sub-model based on the data set and the artificially confirmed risk set; The model training module is used to construct the initial model. Based on the power grid information network, the data is encoded by combining graph coding and vector coding to obtain training data. After the initial model is trained based on the training data, it is verified by combining traditional evaluation indicators and the importance of entity objects to obtain a safety detection model. The safety detection module is used to obtain the power grid flow to be identified and make a prediction based on the risk prediction sub-model. When the prediction is risk information or safety information, the prediction detection result is output. When the risk prediction fails, the safety detection result is obtained by performing detection analysis based on the safety detection model, and the manually confirmed risk set and risk prediction sub-model are updated.

Images