Security detection method and device for configuration file of power dispatching system

Abstract

The invention discloses a security detection method and device for a configuration file of a power dispatching system. The method comprises the following steps: acquiring configuration data of a configuration file in a power dispatching system in sequence in each time period in a preset continuous time, and extracting a corresponding first feature from the configuration data corresponding to each time period; based on all the first features, evaluating the configuration file through a preset security evaluation model; the security evaluation model is obtained by training a deep learning model through second configuration data of a historical configuration file; the deep learning model is obtained based on architecture construction of combination of a convolutional neural network and a recurrent neural network; and when the assessment result is that the risk exists, generating and outputting risk early warning information. According to the method, the generalization and the detection efficiency of the configuration file security detection method can be improved.

Description

Technical Field

[0001] The present application relates to the field of system configuration security detection, and in particular to a method and device for security detection of configuration files of an electric power dispatching system. Background Art

[0002] With the increasing complexity and expansion of the power dispatching system, the number of system configuration files has also increased dramatically. How to ensure the security and correctness of the configuration files and avoid problems such as missing and mismatching has become an urgent problem to be solved in the management of the power dispatching system. Most traditional configuration file detection methods rely on manual inspection one by one, which is prone to detection errors. In order to solve the above problems, the existing technology first solves the problem of how to determine whether the configuration file data has been changed by encrypting the configuration file and performing hash verification. After locking the changed configuration file type, the configuration file detection is performed through additional preset rules or manual inspection.

[0003] However, the above detection method has the disadvantages of low generalization and low detection efficiency when the number of data items in the configuration file increases and the types of configuration files are multiplied. Therefore, how to improve the generalization and detection efficiency of the power dispatching system configuration file detection method is an urgent problem to be solved. Summary of the invention

[0004] The present application provides a method and device for security detection of configuration files of an electric power dispatching system, so as to solve the technical problems of low generalization and low detection efficiency of the configuration file security detection method caused by the large number of configuration files of the electric power dispatching system.

[0005] In order to solve the above technical problems, in a first aspect, an embodiment of the present application provides a method for security detection of a configuration file of a power dispatching system, comprising:

[0006] Collecting configuration data of a plurality of configuration files within a preset continuous time in the power dispatching system, and extracting a corresponding first feature from each of the configuration data;

[0007] Based on all the first features, the collected configuration file is evaluated by a preset security assessment model; the security assessment model is obtained by training a deep learning model through the second configuration data of the historical configuration file; the deep learning model is obtained based on an architecture combining a convolutional neural network and a recurrent neural network;

[0008] When the configuration file has risks, corresponding risk information is generated and output.

[0009] Compared with the prior art, the embodiments of the present application have the following beneficial effects: In order to avoid the low detection efficiency and low generalization of the detection method caused by the traditional detection method, the present application considers that the power grid dispatching system is a real-time operation system with sufficient data volume to meet the training of the deep learning model, and therefore constructs a deep learning network model based on the architecture combining convolutional neural network and recurrent neural network, extracts spatiotemporal features from the configuration file, and learns the correlation between the change characteristics of the configuration file within a certain time interval and the security of the configuration file, thereby achieving an accurate assessment of the security of the configuration file. The above-mentioned whole process is based on the change characteristics of the configuration file in time and space, and performs a security assessment on the configuration file, which has good generalization and can further improve the efficiency of subsequent security detection.

[0010] In some embodiments of the first aspect of the present application, the step of evaluating the collected configuration file based on all the first features by using a preset security evaluation model includes:

[0011] The deep learning model includes: a number of convolutional neural network layers, recurrent neural network layers, a fusion layer and an output layer;

[0012] Inputting each of the first features into each convolutional neural network layer in sequence to obtain corresponding spatial features;

[0013] Input the spatial features into the recurrent neural network layer in sequence according to the collection time of the corresponding configuration data to obtain spatiotemporal dynamic features;

[0014] Inputting all the spatial features and the spatiotemporal dynamic features into a fusion layer to obtain fusion features;

[0015] The fused features are input into the output layer to obtain the evaluation results.

[0016] Compared with the prior art, the above embodiment has the following beneficial effects: the spatial feature of the first feature in the configuration file is extracted through the convolutional neural network layer, and the spatiotemporal dynamic characteristics of the first feature in the configuration file that change with time are learned through the recurrent neural network layer, so that the evaluation model can more accurately capture the characteristic changes of the configuration file of the power dispatching system, and effectively deal with the configuration data fluctuations in different time periods, thereby improving the accuracy of the final risk assessment results.

[0017] In some embodiments of the first aspect of the present application, extracting the corresponding first feature from the configuration data corresponding to each time period includes:

[0018] Cleaning and standardizing the configuration data to obtain first preprocessed data;

[0019] Through a supervised learning algorithm, feature selection and dimensionality reduction are performed on the first preprocessed data in sequence to obtain the first feature.

[0020] Compared with the prior art, the above embodiment has the following beneficial effects: through data cleaning and standardization processing, the quality of input data is improved, and the impact of noise and abnormal data on model evaluation results is reduced, thereby improving the robustness of the overall detection system. At the same time, feature selection and dimensionality reduction processing are used to reduce the computational complexity of the model, while retaining important feature information, thereby improving the computational efficiency and prediction performance of the model.

[0021] In some embodiments of the first aspect of the present application, the step of sequentially performing feature selection and dimensionality reduction processing on the first preprocessed data by a supervised learning algorithm to obtain the first feature includes:

[0022] Obtaining a second feature according to the correlation between each feature in the first preprocessed data and a preset target variable;

[0023] By using the dimensionality reduction technology, the dimension of the second feature is reduced to obtain the third feature;

[0024] The relationship between the third feature and the preset target variable is learned through a supervised learning algorithm, and the first feature is extracted from the third feature through a cross-validation evaluation method.

[0025] Compared with the prior art, the above embodiment has the following beneficial effects: by introducing a supervised learning algorithm, important features can be effectively selected according to the correlation of preset target variables, thereby enhancing the generalization ability of the model and further improving the accuracy of the security assessment model. In addition, through dimensionality reduction technology, the multicollinearity problem between features is reduced and the stability of the model is improved.

[0026] In some embodiments of the first aspect of the present application, extracting the first feature from the third feature by cross-validation evaluation includes:

[0027] Cross-combining the third features to obtain several feature sets;

[0028] Retraining the security assessment model according to the feature set, and evaluating the performance of the retrained security assessment model through a preset test set;

[0029] A second feature set corresponding to the best performance is selected from each of the feature sets, and features in the second feature set are used as the first features.

[0030] Compared with the prior art, the above embodiment has the following beneficial effects: by evaluating and selecting features in a cross-validation manner, it can ensure that the extracted first feature contributes to the model evaluation result to the maximum extent, reduce the risk of overfitting, and enable the model to perform well in different environments. In addition, the above feature selection method reduces manual intervention and improves the objectivity and efficiency of feature selection.

[0031] In some embodiments of the first aspect of the present application, when the assessment result is that there is a risk, generating and outputting risk warning information includes:

[0032] When the evaluation result is that there is a risk, the modification history of the configuration file within the preset continuous time and the evaluation result are output.

[0033] Compared with the prior art, the above embodiment has the following beneficial effects: when a risk is detected, the historical change records can be output in time, and by automatically outputting all change histories within the period, it helps operation and maintenance personnel to quickly locate and troubleshoot problems, thereby improving the safety and response speed of the power dispatching system.

[0034] In a second aspect, an embodiment of the present application further provides a safety detection device for a configuration file of a power dispatching system, comprising: a feature extraction module, a safety assessment module, and a risk warning module;

[0035] The feature extraction module is used to sequentially collect configuration data of the configuration file in the power dispatching system in each period within a preset continuous time, and extract the corresponding first feature from the configuration data corresponding to each period;

[0036] The security assessment module is used to assess the configuration file based on all the first features through a preset security assessment model; the security assessment model is obtained by training a deep learning model through the second configuration data of the historical configuration file; the deep learning model is obtained based on an architecture combining a convolutional neural network and a recurrent neural network;

[0037] The risk warning module is used to generate and output risk warning information when the assessment result shows that there is a risk.

[0038] In some embodiments of the second aspect of the present application, the feature extraction module is used to extract the corresponding first feature from the configuration data corresponding to each time period, including:

[0039] Cleaning and standardizing the configuration data to obtain first preprocessed data;

[0040] Through a supervised learning algorithm, feature selection and dimensionality reduction are performed on the first preprocessed data in sequence to obtain the first feature.

[0041] In some embodiments of the second aspect of the present application, the step of sequentially performing feature selection and dimensionality reduction processing on the first preprocessed data by a supervised learning algorithm to obtain the first feature includes:

[0042] Obtaining a second feature according to the correlation between each feature in the first preprocessed data and a preset target variable;

[0043] By using the dimensionality reduction technology, the dimension of the second feature is reduced to obtain the third feature;

[0044] The relationship between the third feature and the preset target variable is learned through a supervised learning algorithm, and the first feature is extracted from the third feature through a cross-validation evaluation method.

[0045] In some embodiments of the second aspect of the present application, the step of sequentially performing feature selection and dimensionality reduction processing on the first preprocessed data by a supervised learning algorithm to obtain the first feature includes:

[0046] Obtaining a second feature according to the correlation between each feature in the first preprocessed data and a preset target variable;

[0047] By using the dimensionality reduction technology, the dimension of the second feature is reduced to obtain the third feature;

[0048] The relationship between the third feature and the preset target variable is learned through a supervised learning algorithm, and the first feature is extracted from the third feature through a cross-validation evaluation method.

[0049] In some embodiments of the second aspect of the present application, extracting the first feature from the third feature by cross-validation evaluation includes:

[0050] Cross-combining the third features to obtain several feature sets;

[0051] Retraining the security assessment model according to the feature set, and evaluating the performance of the retrained security assessment model through a preset test set;

[0052] A second feature set corresponding to the best performance is selected from each of the feature sets, and features in the second feature set are used as the first features. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A schematic flow chart of a method for security detection of a configuration file of a power dispatching system provided in some embodiments of the present application;

[0054] Figure 2 A schematic diagram of the structure of a deep learning model provided in some embodiments of the present application;

[0055] Figure 3 A schematic diagram of the structure of a safety detection device for a configuration file of an electric power dispatching system provided in some embodiments of the present application. DETAILED DESCRIPTION

[0056] Traditional configuration file detection methods mostly rely on manual inspection one by one, which is prone to detection errors. In order to solve the above problems, the existing technology first solves the problem of how to determine whether the configuration file data has been changed by encrypting the configuration file and performing hash verification. After locking the changed configuration file type, the configuration file detection is performed through additional preset rules or manual inspection. However, when the above detection method faces the increase of data items in the configuration file and the number of configuration file types, it has the disadvantages of low generalization and low detection efficiency.

[0057] In order to solve the above technical problems, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] Embodiment 1

[0059] Please refer to Figure 1 , a method for security detection of a configuration file of a power dispatching system provided in an embodiment of the present application, comprising S10 to S30:

[0060] S10: In each time period within a preset continuous time, the configuration data of the configuration file in the power dispatching system is collected in sequence, and the corresponding first feature is extracted from the configuration data corresponding to each time period.

[0061] Further, in some embodiments of the present application, extracting the corresponding first feature from the configuration data corresponding to each time period includes:

[0062] S11: Clean and standardize the configuration data to obtain first preprocessed data;

[0063] S12: Using a supervised learning algorithm, perform feature selection and dimensionality reduction processing on the first preprocessed data in sequence to obtain the first feature.

[0064] Through data cleaning and standardization, the quality of input data is improved, and the impact of noise and abnormal data on model evaluation results is reduced, thereby improving the robustness of the overall detection system. At the same time, feature selection and dimensionality reduction processing are used to reduce the computational complexity of the model, while retaining important feature information, thereby improving the computational efficiency and prediction performance of the model.

[0065] Preferably, in some embodiments of the present application, the above data cleaning and standardization process can be implemented through the following preferred embodiments:

[0066] Among them, configuration data may include: historical configuration file change data, system operation status information and security threat cases;

[0067] Specifically, the process of cleaning and standardizing the configuration data can be:

[0068] S111: First, standardize the historical configuration file change data to ensure that the data format is consistent. For example, standardize the date and time format and convert the text description into structured data.

[0069] S112 then performs standardization processing on the system operation status information, including data cleaning and formatting. For example, system logs from different sources are converted into a unified format, key performance indicators are extracted, and normalized.

[0070] S113 finally standardizes the security threat cases, including data cleaning and feature extraction. For example, the case description is converted into an analyzable feature vector to ensure that the case data can be used for subsequent deep learning model training.

[0071] Furthermore, in some embodiments of the present application, the step of performing feature selection and dimensionality reduction processing on the first preprocessed data in sequence through a supervised learning algorithm to obtain the first feature includes:

[0072] Obtaining a second feature according to the correlation between each feature in the first preprocessed data and a preset target variable;

[0073] By using the dimensionality reduction technology, the dimension of the second feature is reduced to obtain the third feature;

[0074] The relationship between the third feature and the preset target variable is learned through a supervised learning algorithm, and the first feature is extracted from the third feature through a cross-validation evaluation method.

[0075] By introducing a supervised learning algorithm, important features can be effectively selected based on the correlation of preset target variables, thereby enhancing the generalization ability of the model and further improving the accuracy of the security assessment model. In addition, through dimensionality reduction technology, the multicollinearity problem between features can be reduced and the stability of the model can be improved.

[0076] Preferably, in some embodiments of the present application, the process of sequentially performing feature selection and dimensionality reduction processing on the first preprocessed data may be:

[0077] S121: According to the requirements of the supervised learning algorithm, select features with high correlation with the target variable, and use filtering, packaging or embedding methods to select features to obtain the second feature. The target variable includes features including the modification history of the configuration file (modification time and modification content), the access and modification permissions of different users to the configuration file, and the output results of the security assessment model when the configuration file has risks; preferably, new features can also be constructed based on the original data so that the subsequent deep learning model can learn more effective information;

[0078] S122: Apply dimensionality reduction techniques in supervised learning algorithms, such as linear discriminant analysis (LDA) and principal component analysis (PCA), to reduce the dimension of the second feature, while retaining as much information as possible that contributes to the prediction of the target variable, and obtaining the third feature;

[0079] S123: training the features using a selected supervised learning algorithm, such as a support vector machine (SVM), a random forest, or a neural network, to obtain a relationship between the third feature and the target variable;

[0080] S124: Evaluate the effect of feature extraction through methods such as cross-validation, obtain the first feature, and ensure that the extracted first feature can effectively improve the prediction performance of the model.

[0081] By introducing a supervised learning algorithm, important features can be effectively selected based on the correlation of preset target variables, thereby enhancing the generalization ability of the model and further improving the accuracy of the security assessment model. In addition, through dimensionality reduction technology, the multicollinearity problem between features can be reduced and the stability of the model can be improved.

[0082] Further, in some embodiments of the present application, extracting the first feature from the third feature by cross-validation evaluation includes:

[0083] Cross-combining the third features to obtain several feature sets;

[0084] Retraining the security assessment model according to the feature set, and evaluating the performance of the retrained security assessment model through a preset test set;

[0085] A second feature set corresponding to the best performance is selected from each of the feature sets, and features in the second feature set are used as the first features.

[0086] Preferably, in some embodiments of the present application, the first feature can be obtained by the following cross-validation method:

[0087] S1241: Collect a data set including a target variable (prediction object) and a third feature; reorganize the data corresponding to the third feature according to different cross combinations to obtain different feature sets, which are composed of training data corresponding to the third features in different combinations;

[0088] S1242: retraining the security assessment model using different feature sets, and evaluating the performance of the security assessment model after each training by cross-validation; that is, the test set of the security assessment model trained with the feature set formed by the first third feature combination is composed of feature sets formed by other third feature combinations;

[0089] S1243: Select the feature set with the best performance from step S1242, and use the third feature corresponding to the feature set as the first feature.

[0090] By evaluating and selecting features through cross-validation, it can be ensured that the contribution of the extracted first feature to the model evaluation results is maximized, reducing the risk of overfitting, so that the model has good performance in different environments. In addition, the above feature selection method reduces manual intervention and improves the objectivity and efficiency of feature selection.

[0091] S20: Based on all the first features, the configuration file is evaluated through a preset security assessment model; the security assessment model is obtained by training a deep learning model through the second configuration data of the historical configuration file; the deep learning model is obtained based on an architecture combining a convolutional neural network and a recurrent neural network.

[0092] Furthermore, in some embodiments of the present application, the collected configuration files are evaluated based on all the first features through a preset security evaluation model, including:

[0093] The deep learning model includes: a number of convolutional neural network layers, recurrent neural network layers, a fusion layer and an output layer;

[0094] Inputting each of the first features into each convolutional neural network layer in sequence to obtain corresponding spatial features;

[0095] Input the spatial features into the recurrent neural network layer in sequence according to the collection time of the corresponding configuration data to obtain spatiotemporal dynamic features;

[0096] Inputting all the spatial features and the spatiotemporal dynamic features into a fusion layer to obtain fusion features;

[0097] The fused features are input into the output layer to obtain the evaluation results.

[0098] Preferably, reference Figure 2, which is a schematic diagram of a deep learning model provided in some embodiments of the present application, and then combined with Figure 2 Detailed description of the process of obtaining the evaluation results:

[0099] S21: input the first feature into the first convolutional neural network layer, preliminarily extract the local features in the first feature data, then input the local features into the pooling layer for dimensionality reduction processing, and finally input the feature data after dimensionality reduction processing into the second convolutional neural network layer to extract deeper spatial features, thereby realizing the spatial feature extraction of the configuration data of the configuration file corresponding to a single time node;

[0100] S22: After the spatial features of the first features of the configuration data at each time node are obtained through step S21, the spatial features are sequentially input into the recurrent neural network layer according to the collection time sequence of the configuration data to obtain spatiotemporal dynamic features;

[0101] S23: The spatial features and spatiotemporal dynamic features are fused through the fusion layer, and the fused features are input into the output layer to obtain the evaluation results through the classification algorithm.

[0102] Preferably, in some embodiments of the present application, the following feature fusion method may be specifically referred to, to fuse spatial features and spatiotemporal dynamic features:

[0103] (1) Directly stitching spatial features and spatiotemporal dynamic features;

[0104] (2) After projecting the spatial features and spatiotemporal dynamic features to the same dimension, the spatial features and spatiotemporal dynamic features are fused by weighted summation;

[0105] (3) By defining a bilinear model, such as a simple matrix multiplication (it is necessary to project the spatial features and spatiotemporal features into a matching dimensional space), the spatial features and spatiotemporal dynamic features are fused;

[0106] (4) Through the attention mechanism, the weight that should be given to each feature in the fusion process is dynamically determined.

[0107] The spatial features of the first feature in the configuration file are extracted through the convolutional neural network layer, and the spatiotemporal dynamic features of the first feature in the configuration file that change over time are learned through the recurrent neural network layer. This enables the assessment model to more accurately capture the feature changes of the configuration file of the power dispatching system, and effectively respond to configuration data fluctuations in different time periods, thereby improving the accuracy of the final risk assessment results.

[0108] S30: When the assessment result shows that there is a risk, risk warning information is generated and output.

[0109] Furthermore, in some embodiments of the present application, when the assessment result indicates that there is a risk, generating and outputting risk warning information includes:

[0110] When the evaluation result is that there is a risk, the modification history of the configuration file within the preset continuous time and the evaluation result are output.

[0111] When a risk is detected, historical change records can be output in a timely manner. By automatically outputting all change histories within that period, it helps operation and maintenance personnel quickly locate and troubleshoot problems, thereby improving the safety and response speed of the power dispatching system.

[0112] Preferably, in some embodiments of the present application, when the evaluation result is that there is a risk, it is also possible to automatically diagnose and evaluate whether there is a risk in the change data corresponding to each change history within a preset continuous time, specifically: based on the hash value of each change history and the configuration file after the change, compare the difference between the current period configuration file and the previous stable version (or baseline configuration), evaluate the possible impact of the configuration change, including risks such as performance degradation and service interruption, and after binding the change history to the risk, output it to prompt the administrator to handle the change operation.

[0113] Preferably, in some embodiments of the present application, when the assessment result is that there is a risk, and after the risky change data is determined, the most suitable configuration template is automatically selected or generated as a reference based on the current system environment and requirements, and the recovery configuration is intelligently recommended using an AI algorithm in combination with the system operating status, user behavior patterns and historical repair cases.

[0114] Preferably, in some embodiments of the present application, before any automatic repair is performed, the current configuration file is backed up first, that is, according to the automatically determined correct configuration information, the error items in the configuration file are automatically modified to restore the correct configuration. After the repair, automated testing or simulation verification is performed to ensure that the system can operate normally and the performance meets expectations.

[0115] In summary, the security detection method for the configuration file of the power dispatching system provided by the embodiment of the present application has the following beneficial effects: In order to avoid the low detection efficiency brought by the traditional detection method and the low generalization of the detection method, the present application considers that since the power grid dispatching system is a real-time operation system, it has sufficient data volume to meet the training of the deep learning model, and therefore constructs a deep learning network model based on the architecture combining convolutional neural network and recurrent neural network, extracts spatiotemporal features from the configuration file, and learns the correlation between the change characteristics of the configuration file within a certain time interval and the security of the configuration file, thereby achieving an accurate assessment of the security of the configuration file. The above-mentioned whole process is based on the change characteristics of the configuration file in time and space, and performs a security assessment on the configuration file, which has good generalization and can further improve the efficiency of subsequent security detection.

[0116] Embodiment 2

[0117] refer to Figure 3 , which is a safety detection device for a power dispatching system configuration file provided in an embodiment of the present application, comprising: a feature extraction module 11, a safety assessment module 12 and a risk warning module 13.

[0118] Furthermore, in some embodiments of the present application, the feature extraction module 11 is used to collect the first configuration data of the configuration file in the power dispatching system in sequence in each time period within a preset continuous time, and extract the corresponding first feature from the first configuration data corresponding to each time period; the safety assessment module 12 is used to evaluate the configuration file based on all the first features through a preset safety assessment model; the safety assessment model is obtained by training a deep learning model through the second configuration data of the historical configuration file; the deep learning model is obtained based on the architecture of the combination of convolutional neural network and recurrent neural network; the risk warning module 13 is used to generate and output risk warning information when the assessment result is that there is a risk.

[0119] Furthermore, in some embodiments of the present application, the security assessment module 12 is used to evaluate the collected configuration files based on all the first features through a preset security assessment model, including: the deep learning model, including: a number of convolutional neural network layers, a recurrent neural network layer, a fusion layer and an output layer; inputting each of the first features into each convolutional neural network layer in turn to obtain the corresponding spatial features; inputting the spatial features into the recurrent neural network layer in turn according to the collection time of the corresponding first configuration data to obtain spatiotemporal dynamic features; inputting all the spatial features and the spatiotemporal dynamic features into the fusion layer to obtain fusion features; inputting the fusion features into the output layer to obtain evaluation results.

[0120] Furthermore, in some embodiments of the present application, the feature extraction module 11 is used to extract the corresponding first feature from the first configuration data corresponding to each time period, including: cleaning and standardizing the first configuration data to obtain first preprocessed data; and performing feature selection and dimensionality reduction on the first preprocessed data in sequence through a supervised learning algorithm to obtain the first feature.

[0121] Furthermore, in some embodiments of the present application, the first preprocessed data is subjected to feature selection and dimensionality reduction processing in sequence through a supervised learning algorithm to obtain the first feature, including: obtaining the second feature based on the correlation between each feature in the first preprocessed data and a preset target variable; reducing the dimension of the second feature through dimensionality reduction technology to obtain a third feature; learning the relationship between the third feature and the preset target variable through a supervised learning algorithm, and extracting the first feature from the third feature through a cross-validation evaluation method.

[0122] Furthermore, in some embodiments of the present application, the first feature is extracted from the third feature by cross-validation evaluation, including: cross-combining the third features to obtain several feature sets; retraining the security assessment model based on the feature sets, and evaluating the performance of the retrained security assessment model through a preset test set; from each of the feature sets, selecting the second feature set corresponding to the best performance, and using the features in the second feature set as the first feature.

[0123] Furthermore, in some embodiments of the present application, the risk warning module 13 is used to generate and output risk warning information when the assessment result is that there is a risk, including: when the assessment result is that there is a risk, outputting the change history of the configuration file within the preset continuous time and the assessment result.

[0124] It can be understood that the above-mentioned device item embodiments correspond to the method item embodiments of the present invention. The security detection device for a power dispatching system configuration file provided by the embodiment of the present invention can implement any method item embodiment of the present invention, that is, the security detection method for a power dispatching system configuration file provided in Embodiment 1.

[0125] In summary, the security detection device for the configuration file of the power dispatching system provided by the embodiment of the present application has the following beneficial effects: In order to avoid the low detection efficiency brought by the traditional detection method and the low generalization of the detection method, the present application considers that since the power grid dispatching system is a real-time operation system, it has sufficient data volume to meet the training of the deep learning model, and therefore constructs a deep learning network model based on the architecture combining convolutional neural network and recurrent neural network, extracts spatiotemporal features from the configuration file, and learns the correlation between the change characteristics of the configuration file in a certain time interval and the security of the configuration file, so as to achieve an accurate assessment of the security of the configuration file. The above-mentioned whole process is to conduct a security assessment of the configuration file based on the change characteristics of the configuration file in time and space, has good generalization, and can further improve the efficiency of subsequent security detection.

[0126] Embodiment 3

[0127] Based on the above-mentioned embodiment of the security detection method for the electric power dispatching system configuration file, another embodiment of the present application provides a security detection terminal device for the electric power dispatching system configuration file. The security detection terminal device for the electric power dispatching system configuration file includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the security detection method for the electric power dispatching system configuration file of any embodiment of the present application is implemented.

[0128] Exemplarily, in this embodiment, the computer program may be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the safety detection device of the power dispatching system configuration file.

[0129] The safety detection device of the electric power dispatching system configuration file can be a computing device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The safety detection terminal device of the electric power dispatching system configuration file can include, but is not limited to, a processor and a memory.

[0130] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the safety detection device of the electric power dispatching system configuration file, and uses various interfaces and lines to connect the various parts of the safety detection device of the entire electric power dispatching system configuration file. The memory may be used to store the computer program and / or module, and the processor realizes various functions of the safety detection device of the electric power dispatching system configuration file by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function, etc.; the data storage area may store data created according to the use of the mobile phone, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SmartMed i aCard, SMC), a secure digital (SecureDi gita l, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0131] Embodiment 4

[0132] Based on the above-mentioned embodiment of the security detection method for the electric power dispatching system configuration file, another embodiment of the present application provides a storage medium, wherein the storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the security detection method for the electric power dispatching system configuration file of any embodiment of the present application.

[0133] In this embodiment, the storage medium is a computer-readable storage medium, and the computer program includes computer program code, which may be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0134] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A method for security detection of configuration files of a power dispatching system, characterized in that: include: In each time period within a preset continuous time, sequentially collect configuration data of a configuration file in the power dispatching system, and extract a corresponding first feature from the configuration data corresponding to each time period; Based on all the first features, the configuration file is evaluated by a preset security assessment model; the security assessment model is obtained by training a deep learning model through the second configuration data of the historical configuration file; the deep learning model is obtained based on an architecture combining a convolutional neural network and a recurrent neural network; When the assessment result shows that there is a risk, risk warning information is generated and output.

2. A method for safety detection of a configuration file of a power dispatching system according to claim 1, characterized in that: The step of evaluating the collected configuration file based on all the first features by using a preset security evaluation model includes: The deep learning model includes: a number of convolutional neural network layers, recurrent neural network layers, a fusion layer and an output layer; Inputting each of the first features into each convolutional neural network layer in sequence to obtain corresponding spatial features; Input the spatial features into the recurrent neural network layer in sequence according to the collection time of the corresponding configuration data to obtain spatiotemporal dynamic features; Inputting all the spatial features and the spatiotemporal dynamic features into a fusion layer to obtain fusion features; The fused features are input into the output layer to obtain the evaluation results.

3. A method for safety detection of a configuration file of a power dispatching system according to claim 1, characterized in that: The extracting the corresponding first feature from the configuration data corresponding to each time period includes: Cleaning and standardizing the configuration data to obtain first preprocessed data; Through a supervised learning algorithm, feature selection and dimensionality reduction are performed on the first preprocessed data in sequence to obtain the first feature.

4. A method for safety detection of a configuration file of a power dispatching system according to claim 3, wherein the first pre-processed data is sequentially subjected to feature selection and dimensionality reduction processing by a supervised learning algorithm to obtain the first feature, comprising: Obtaining a second feature according to the correlation between each feature in the first preprocessed data and a preset target variable; By using the dimensionality reduction technology, the dimension of the second feature is reduced to obtain the third feature; The relationship between the third feature and the preset target variable is learned through a supervised learning algorithm, and the first feature is extracted from the third feature through a cross-validation evaluation method.

5. The method for security detection of a configuration file of a power dispatching system according to claim 4, wherein the step of extracting the first feature from the third feature by cross-validation evaluation comprises: Cross-combining the third features to obtain several feature sets; Retraining the security assessment model according to the feature set, and evaluating the performance of the retrained security assessment model through a preset test set; A second feature set corresponding to the best performance is selected from each of the feature sets, and features in the second feature set are used as the first features.

6. A method for safety detection of a configuration file of a power dispatching system according to claim 1, wherein when the assessment result indicates that there is a risk, generating and outputting risk warning information comprises: When the evaluation result is that there is a risk, the modification history of the configuration file within the preset continuous time and the evaluation result are output.

7. A safety detection device for a configuration file of an electric power dispatching system, characterized in that: include: Feature extraction module, safety assessment module and risk warning module; The feature extraction module is used to sequentially collect configuration data of the configuration file in the power dispatching system in each period within a preset continuous time, and extract the corresponding first feature from the configuration data corresponding to each period; The security assessment module is used to assess the configuration file based on all the first features through a preset security assessment model; the security assessment model is obtained by training a deep learning model through the second configuration data of the historical configuration file; the deep learning model is obtained based on an architecture combining a convolutional neural network and a recurrent neural network; The risk warning module is used to generate and output risk warning information when the assessment result shows that there is a risk.

8. A safety detection device for a configuration file of a power dispatching system according to claim 7, characterized in that: The feature extraction module is used to extract the corresponding first feature from the configuration data corresponding to each time period, including: Cleaning and standardizing the configuration data to obtain first preprocessed data; Through a supervised learning algorithm, feature selection and dimensionality reduction are performed on the first preprocessed data in sequence to obtain the first feature.

9. A safety detection device for a configuration file of a power dispatching system according to claim 8, characterized in that: The step of sequentially performing feature selection and dimensionality reduction processing on the first preprocessed data by a supervised learning algorithm to obtain the first feature includes: Obtaining a second feature according to the correlation between each feature in the first preprocessed data and a preset target variable; By using the dimensionality reduction technology, the dimension of the second feature is reduced to obtain the third feature; The relationship between the third feature and the preset target variable is learned through a supervised learning algorithm, and the first feature is extracted from the third feature through a cross-validation evaluation method.

10. A safety detection device for a configuration file of a power dispatching system according to claim 9, characterized in that: The step of extracting the first feature from the third feature by means of a cross-validation evaluation method includes: Cross-combining the third features to obtain several feature sets; Retraining the security assessment model according to the feature set, and evaluating the performance of the retrained security assessment model through a preset test set; A second feature set corresponding to the best performance is selected from each of the feature sets, and features in the second feature set are used as the first features.

Images