Power grid-based equipment safety protection method, equipment and storage medium

Abstract

The invention discloses an equipment safety protection method and equipment based on a power grid, and a storage medium. The method comprises the following steps: collecting network flow data of power equipment in the power grid; inputting the flow data into the local outlier factor model, and calculating a risk value of the power equipment; setting a security level for the power equipment according to the risk value; under the visual sense of the global risk of the power grid, making a security policy for the power equipment according to the security level; and executing safety operation on the power equipment according to the safety strategy. According to the embodiment, the risk value and the security level corresponding to the power equipment are identified through the trained local outlier factor model, multi-dimensional analysis is carried out on the identified risk data, the security level is adjusted, the corresponding security policy is formulated, and a dynamic adjustment mechanism is adopted to ensure that the system can quickly respond to various security threats, so that the safety of the power equipment is improved. Therefore, the overall safety and the response speed of the system are improved, and the stability and the safety of the system are guaranteed.

Description

Technical Field

[0001] Embodiments of the present invention relate to the technical field of power grid equipment, and in particular to a power grid-based equipment security protection method, equipment, and storage medium. Background Art

[0002] Power equipment in the power industry (such as smart meters, sensors, controllers, etc.) is one of the important components of the power system. With the popularization of Internet of Things technology, more and more power equipment is connected to the Internet, forming a complex, distributed network system. The security of these devices is related to the stability and reliability of the power system.

[0003] Power equipment is widely distributed and numerous, making it an easy target for attacks. Currently, most systems rely on static security policies to protect networks and equipment. These static policies usually set corresponding security policies based on known risks, and have low dynamic adaptability and flexibility, especially in the face of sudden security incidents, their response capabilities are limited. Summary of the invention

[0004] The present invention provides a power grid-based equipment safety protection method, equipment and storage medium, which are used to improve the operation safety of power equipment in a power system.

[0005] In a first aspect, an embodiment of the present invention provides a method for protecting equipment safety based on a power grid, comprising:

[0006] Collect network flow data from power equipment in the power grid;

[0007] Inputting the flow data into a local outlier factor model and calculating a risk value for the power equipment;

[0008] Setting a safety level for the electric power equipment according to the risk value;

[0009] Formulate a security strategy for the power equipment according to the security level under the vision of the global risk of the power grid;

[0010] Perform security operations on the electrical equipment according to the security policy.

[0011] In a second aspect, an embodiment of the present invention further provides a power grid-based equipment safety protection device, including:

[0012] The flow data collection module is used to collect network flow data from power equipment in the power grid;

[0013] A risk value calculation module, used for inputting the flow data into a local outlier factor model and calculating a risk value for the power equipment;

[0014] A safety level setting module, used to set the safety level of the electric power equipment according to the risk value;

[0015] A security policy formulation module, used to formulate a security policy for the power equipment according to the security level under the vision of the global risk of the power grid;

[0016] A safety operation execution module is used to execute safety operations on the power equipment according to the safety policy.

[0017] In a third aspect, an embodiment of the present invention further provides a computer device, including:

[0018] one or more processors;

[0019] A storage device for storing one or more programs;

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the power grid-based equipment safety protection method provided in the first aspect of the present invention.

[0021] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the power grid-based equipment safety protection method provided in the first aspect of the present invention.

[0022] In a fifth aspect, an embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the power grid-based equipment safety protection method provided in the first aspect of the present invention.

[0023] In this embodiment, network flow data is collected for power equipment in the power grid; the flow data is input into the local outlier factor model and the risk value of the power equipment is calculated; the safety level of the power equipment is set according to the risk value; under the vision of the global risk of the power grid, a safety strategy is formulated for the power equipment according to the safety level; and safety operations are performed on the power equipment according to the safety strategy. This embodiment identifies the risk value and safety level corresponding to the power equipment through the trained local outlier factor model, performs multi-dimensional analysis on the identified risk data, adjusts the safety level and formulates the corresponding safety strategy, and adopts a dynamic adjustment mechanism to ensure that the system can respond quickly to various security threats and can respond to emergencies in a timely manner, thereby improving the overall safety and response speed of the system and ensuring the stability and safety of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A flowchart of a power grid-based equipment safety protection method provided in Embodiment 1 of the present invention;

[0025] Figure 2 A structural block diagram of a power grid-based equipment safety protection device provided in Embodiment 2 of the present invention;

[0026] Figure 3 A schematic diagram of the structure of a computer device provided in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can cover sequential implementations other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] See also Figure 1 , shows a flow chart of a power grid-based equipment safety protection method provided by the first embodiment of the present invention, the method can be executed by a power grid-based equipment safety protection device, the power grid-based equipment safety protection device can be implemented in the form of hardware and / or software, and the power grid-based equipment safety protection device can be configured in a computer device. Figure 1 As shown, the method includes:

[0031] Step 101: Collect network flow data from power equipment in the power grid.

[0032] The power system includes power equipment, equipment safety level module, distributed business module and cloud platform.

[0033] The power equipment mainly includes smart meters, sensors, controllers, etc., which are used to collect network traffic data (i.e. environmental data and user data), perform preliminary data processing based on the power equipment's own capabilities, and upload the processed data to the distributed business module.

[0034] The equipment safety level module is used to define, store and manage the safety levels of all power equipment, and provide an interface for distributed business modules to query the safety levels of electrical equipment; it also senses the status of power equipment and changes in the network environment based on the network environment of the power equipment, identifies risks, and adjusts the equipment safety level in a targeted manner based on the identified risks.

[0035] The distributed business module is used to receive the flow data of the power equipment collection network and perform corresponding security processing on the flow data of the received network according to the security level provided by the equipment security level module, and upload the data after security processing to the cloud platform.

[0036] The cloud platform is used to receive and store data uploaded by distributed business modules, and formulate security policies from a global perspective based on the risks identified by the device security level module.

[0037] In this embodiment, the power system receives network traffic data collected by power equipment arranged in the power grid to monitor whether there are risks in the power equipment operating environment and the network environment, and takes corresponding measures to deal with the risks.

[0038] Step 102: Input the flow data into the local outlier factor model and calculate the risk value of the power equipment.

[0039] In this embodiment, the power system inputs the network flow data collected by the received power equipment into a trained local outlier factor (LOF) model to calculate the risk value of the current power equipment, and different safety measures can be taken according to the risk value.

[0040] In one embodiment of the present invention, step 102 may include the following steps:

[0041] Step 1021: extract multiple traffic features from the traffic data to form data points, and write the data points into a data set.

[0042] In this embodiment, a plurality of traffic features are extracted from the traffic data to form data points that conform to a trained local outlier factor (LOF) model, and the data points are written into a data set.

[0043] In this embodiment, multiple time windows are added to the traffic data, and the total traffic volume, number of connections, and average packet size are counted in each time window. The total traffic volume, number of connections, and average packet size after counting are standardized so that the data has a unified scale, which helps to improve the performance and stability of the local outlier factor (LOF) model. If the standardization is completed, the total traffic volume, number of connections, and average packet size are represented by a vector to form a data point for each time window, and the data point is written into the data set.

[0044] Exemplarily, the dataset is divided into a training set and a validation set.

[0045] When the data set is a training set, the vectors of each dimension of the data point are used to train the local outlier factor (LOF) model. The purpose of this stage is to let the local outlier factor (LOF) model learn to identify normal and abnormal patterns from the training data.

[0046] When the data set is a validation set, the vectors of each dimension of the data point are used to verify the local outlier factor (LOF) model to check the performance of the local outlier factor (LOF) model on unseen data and ensure its generalization ability.

[0047] The vector with the best dimension is selected based on the verified metric as the target vector. If there are multiple target vectors, the target vector with the lowest dimension is used. This helps to simplify the local outlier factor (LOF) model and reduce computational complexity while maintaining good detection performance.

[0048] Step 1022: Select a k value in the local outlier factor model.

[0049] In this embodiment, a k-fold cross-validation method is used to select a k value, multiple k values ​​are selected in the local outlier factor model, and a k value that meets the training conditions is screened out from the multiple k values, wherein the training condition is that the risk value is greater than 1. The training condition that the risk value is greater than 1 is to ensure that the outliers identified by the model have sufficient significance. A risk value greater than 1 usually means that the degree of outliers of these data points is high, thereby improving the effectiveness of the model in anomaly detection. This helps to filter out those outliers that are not significant enough and improve the accuracy and reliability of the model. If there are multiple k values ​​that meet the training conditions, the k value with the smallest value is selected.

[0050] Using k-fold cross validation to select k values ​​can ensure that the selected k values ​​perform consistently on different data subsets, thereby improving the generalization and stability of the model. This method reduces the overfitting of the model to a specific data set through multiple training and validation, ensuring that the selected k values ​​can effectively detect anomalies under different data distributions.

[0051] Step 1023: In the data set, calculate the distance between the data point and k nearest neighbor points.

[0052] In this embodiment, for each data point in the data set, the distance between the data point and its k nearest neighboring data points is calculated. The nearest neighbor points refer to the k points with the smallest distance to the current data point in the feature space. This process helps to understand the position of the data point in the feature space and its relationship with the surrounding data points, providing basic data for subsequent density calculations.

[0053] For example, assume that p and q are any two points in set D, and the Euclidean distance between them is denoted as d(p,q); the distance from the kth nearest neighbor of point p to point p is called the k-th distance of point p, denoted as d k (p), where k is a natural number; define the set of points in set D except point p as D\{p}; if there are at least k different points q∈D\{p} satisfying d(p,q)≤d k (p), and there are at most k-1 points q∈D\{p} that satisfy d(p,q) <d k (p) then d(p,q) is equivalent to d k (p) For a given d k (p), define all the distances from point p in set D to be less than d k The neighborhood formed by the points of (p) is called the k-distance neighborhood of point p, that is, the distance between the data point and its k nearest neighboring points is calculated:

[0054] |N k (p)|={q∈D\{p}∣d(p,q)≤d k (p)};

[0055] Where: |N k (p)| represents the number of all points contained in the k-distance neighborhood of point p.

[0056] Step 1024: In the data set, calculate the reachable distance between the data point and k nearest neighbor points based on the distance.

[0057] In this embodiment, in the data set, the reachable distance between each data point and its k nearest neighbor points is calculated based on the actual distance of each data point to its k nearest neighbor points. This reachable distance usually takes into account the path through the nearest neighbor points to calculate a more accurate relative distance, thereby better reflecting the actual location and distribution of the data point. The reachable distance calculation formula between a data point and its k nearest neighbor points is as follows:

[0058] d rk (p,q)=max{d k (p), d(p,q)};

[0059] The maximum value of the k distance of point p and the Euclidean distance between points p and q is defined as the reachable distance from point p to point q.

[0060] Step 1025: In the data set, take the inverse of the average value of all reachable distances to obtain the local density.

[0061] In this embodiment, in the data set, the average of the reachable distances of all k neighboring points is calculated and the inverse is taken to obtain the local density. The local density indicates the compactness of the data points in their local area. The local density can effectively measure the density of the data points. Data points with higher density are considered normal, while data points with lower density may be abnormal. The local density formula is as follows:

[0062]

[0063] Where: d lrk (p) represents the local reachability density of point p.

[0064] Step 1026: Calculate the average value of the ratio between the local density of the data point corresponding to the power equipment and the local density of the k neighboring points to obtain the risk value of the power equipment.

[0065] In this embodiment, for the power equipment data point, the ratio between the local density of the point and the local density of its k neighboring points is calculated, and the average of these ratios is calculated to obtain the risk value. This risk value can be used to determine whether the power equipment data point is abnormal. If the local density of the power equipment data point is significantly lower than the density of its neighboring points, it means that the data point may be in a sparse area and there is an abnormal risk. This helps to identify potential abnormal situations and improve the accuracy of anomaly detection. If the risk value is greater than 1, the point is considered to be an abnormal point, and if the risk value is less than 1, the point is considered to be a normal point. The risk value calculation formula is as follows:

[0066]

[0067] Where: LOF k (p) represents the risk value.

[0068] Step 103: Set a safety level for the power equipment according to the risk value.

[0069] In this embodiment, a trained local outlier factor (LOF) model is deployed in the equipment safety level module. The local outlier factor (LOF) model identifies the power equipment to obtain the corresponding risk value, sets the safety level of the power equipment according to the risk value, and executes the security policy corresponding to the safety level.

[0070] Step 104: Under the vision of the global risk of the power grid, formulate a security strategy for the power equipment according to the security level.

[0071] In this embodiment, the cloud platform formulates security policies corresponding to the security levels of the power equipment based on the security level identified by the equipment security level module under the vision of global risk.

[0072] In one embodiment of the present invention, step 104 includes the following steps:

[0073] Step 1041: Under the vision of the global risk of the power grid, set a safety mapping table for the power equipment.

[0074] In this embodiment, the cloud platform sets a security mapping table for the power equipment based on the security level of the power equipment identified by the equipment security level module under the vision of global risk, and the security mapping table records the mapping relationship between multiple security levels and multiple security policies.

[0075] In one embodiment of the present invention, step 1041 includes the following steps:

[0076] S101. Collect risk data when the risk value meets the preset risk conditions.

[0077] In this embodiment, the device security level module collects risk data when the risk value meets the preset risk condition, converts the risk data into a unified data format, and aggregates it to the cloud platform to form a unified risk database. The risk data includes at least one of the device identification, timestamp, risk type of the risk item, and risk level of the risk item.

[0078] When the risk value exceeds different preset risk conditions, the risk level can be divided into high risk, medium risk and low risk.

[0079] Specific risk classification criteria include but are not limited to:

[0080] High risk: The risk value is extremely high and the impact range is wide, such as a large-scale DDoS attack (Distributed Denial of Service Attack).

[0081] Medium risk: The risk value is high and the impact range is medium, such as unauthorized access to a single device.

[0082] Low risk: The risk value is low and the impact range is small, such as occasional abnormal operations.

[0083] S102. Mining correlated risk data based on frequent sets to form risk clusters.

[0084] In this embodiment, the risk data is converted into a transaction database, each row in the transaction database represents a transaction, and the transaction includes all risk items in the risk data.

[0085] Set the support threshold and confidence threshold. The support threshold is 0.01 and the confidence threshold is 0.5.

[0086] Calculate the support of each transaction, and retain transactions whose support is greater than the support threshold to form the first frequent itemset. The support calculation formula is as follows:

[0087]

[0088] Where: |T(X)| represents the number of transactions containing item set X; |T| represents the total number of transactions; support(X) represents the support of item set X.

[0089] Generate the kth candidate item set from the k-1th frequent item set, calculate the support of each kth candidate item set, and retain the kth candidate item set whose support is greater than the support threshold to form the kth frequent item set, and repeat the frequent item set generation steps until no new frequent item set can be generated.

[0090] Generate association rules from frequent item sets, calculate the confidence of each association rule, and retain association rules whose confidence is greater than the confidence threshold. The confidence calculation formula is as follows:

[0091]

[0092] Where support(X∪Y) represents the number of transactions containing item sets X and Y; confidence(X→Y) represents the confidence associated with transactions X and Y.

[0093] Based on the retained association rules, relevant transactions are obtained to obtain relevant risk data.

[0094] S103. For the same risk item, calculate the product of the weight corresponding to the risk type and the coefficient corresponding to the risk level to obtain a single risk score.

[0095] In this embodiment, a weight is defined for each risk type. For example, the weight of a high-risk vulnerability attack is 1.0, the weight of an abnormal login is 0.7, and the weight of an abnormal traffic is 0.5.

[0096] Define a coefficient for each risk level, for example, a high risk coefficient is 1.0, a medium risk coefficient is 0.7, and a low risk coefficient is 0.4.

[0097] Calculate the weight of each risk item: Single risk score = risk type weight * risk level coefficient.

[0098] S104. In the risk cluster, calculate the sum of all individual risk scores to obtain an overall risk score.

[0099] In this embodiment, the weights of all risk items in the risk cluster group are weighted and summed to obtain the overall risk score. The interval of the overall risk score is defined, for example, an overall risk score>1.5 is high risk, an overall risk score between 1.0 and 1.5 is medium risk, and an overall risk score<1.0 is low risk.

[0100] S105. Configure individual impact scores for risk clusters in the dimensions of equipment, system, and business.

[0101] In this embodiment, a single impact score of each dimension is calculated for the risk cluster in the three dimensions of equipment, system and business.

[0102] Exemplary device impact analysis: determine the list of affected devices and their business importance, and calculate the business importance weight of each device, for example, the weight of key devices is 1.0 and the weight of common devices is 0.5.

[0103] System impact analysis: Analyze the dependencies between devices and determine the possibility of risk propagation. Evaluate the overall impact of risk events on the system, for example, determine the risk of equipment on the critical path through graph analysis.

[0104] Business impact analysis: Identify the affected business processes and their importance. Calculate the business impact weights, for example, the key business process weight is 1.0 and the supporting business process weight is 0.5.

[0105] S106. In the risk cluster, calculate the sum of all individual impact scores to obtain an overall impact score.

[0106] In this embodiment, in the risk cluster, the sum of the scores of the device impact analysis, the system impact analysis and the business impact analysis is comprehensively calculated to obtain the overall impact score. The interval of the overall impact score is defined, for example, an overall impact score > 1.5 indicates a wide impact, an overall impact score between 1.0 and 1.5 indicates a medium impact, and an overall impact score < 1.0 indicates a local impact.

[0107] S107. Configure security policies for the risk cluster based on the overall risk score and the overall impact score.

[0108] In this embodiment, a two-dimensional matrix of overall risk scores and overall impact scores is constructed. Each risk cluster is mapped to a corresponding position in the matrix. According to the matrix position, the risk clusters are divided into high-risk groups, medium-risk groups, and low-risk groups. The evaluation results are displayed using color coding or other visualization methods. The corresponding security policy is configured for each risk cluster.

[0109] S108. Write the security policy into the security mapping table set for the power equipment.

[0110] In this embodiment, the corresponding security policy configured for each risk cluster is written into the security mapping table set for the power equipment, so as to query different security measures corresponding to different security levels.

[0111] Step 1042: Match the security level of the power equipment with the security level in the security mapping table.

[0112] In this embodiment, the security level of the electrical equipment identified in the local outlier factor model is matched with the security level in the security mapping table, and a security policy corresponding to the successfully matched security level is found to provide security protection for the electrical equipment.

[0113] Step 1043: When the match is successful, extract the security policy mapped by the security level in the security mapping table as the security policy of the power equipment.

[0114] In this embodiment, the security level of the power equipment is matched with the security level in the security mapping table. When the match is successful, the security policy mapped by the security level in the security mapping table is extracted as the security policy of the power equipment. The power equipment can perform security protection according to the extracted security policy.

[0115] Step 105: Perform security operations on the power equipment according to the security policy.

[0116] In this embodiment, security protection operations are performed on the power equipment according to the protection measures corresponding to the security policy.

[0117] Exemplarily, the power equipment identifies its current security level in the equipment security level module, and queries the security policy of the security level mapping according to its current security level.

[0118] Among them, the security level can be divided into low security level, medium security level and high security level.

[0119] Low security level: Perform basic data encryption and integrity verification.

[0120] Medium security level: Enhanced data encryption, data integrity verification, and access control.

[0121] High security level: advanced data encryption, multiple authentication, sensitive information desensitization and strict access control.

[0122] Data encryption refers to the encryption of data using appropriate encryption algorithms (such as AES (Advanced Encryption Standard, symmetric encryption), RSA (Rivest-Shamir-Adleman, asymmetric encryption), etc.) to ensure the confidentiality of data during transmission and storage.

[0123] For low security level: Symmetric encryption (such as AES) may be used for data encryption.

[0124] For medium security level: Use a combination of symmetric encryption and asymmetric encryption (such as RSA) for data encryption.

[0125] For high security levels: hybrid encryption technology is used to perform multiple encryption processes simultaneously.

[0126] Data integrity verification refers to the use of a hash algorithm to generate a checksum for the data to ensure that the data has not been tampered with during transmission.

[0127] For low security level: perform basic hash verification.

[0128] For medium security level: Combine hash checksum and message authentication code (MAC).

[0129] For high security level: Use digital signature technology for data verification.

[0130] Sensitive information processing refers to information desensitization: desensitizing sensitive information in data to prevent sensitive information leakage.

[0131] For low security levels: perform basic information hiding.

[0132] For medium security level: partial desensitization is performed.

[0133] For high security levels: perform comprehensive desensitization, including data blurring and anonymization.

[0134] In the embodiment of the present invention, after executing different security measures according to different security levels of the power equipment, the cloud platform also needs to perform further security protection on the power equipment from a global perspective.

[0135] Security protection includes: preventive measures, detection measures, response measures and recovery measures.

[0136] Preventive measures: Conduct comprehensive security inspections and reinforcements on power equipment and patch known vulnerabilities. Strengthen access control and restrict abnormal login behaviors. Provide safety training to operators to improve their safety awareness.

[0137] Detection measures: Deploy an intrusion detection system to monitor the network traffic of power equipment in real time. Enable power equipment logging and regularly analyze logs to detect abnormal behavior.

[0138] Response measures: If a high-risk vulnerability attack occurs in power equipment, the power equipment will be immediately isolated and the vulnerability will be repaired. If an abnormal login occurs in the power equipment, the source will be traced and, if necessary, the access control policy of the power equipment will be changed. If abnormal traffic occurs in the power equipment, the traffic source will be analyzed and blocking measures will be taken.

[0139] Recovery measures: Perform system recovery on power equipment to ensure normal operation. Check the system integrity of power equipment and restore the normal login mechanism. Perform business recovery tests to ensure that all important businesses are not affected.

[0140] In this embodiment, network flow data is collected for power equipment in the power grid; the flow data is input into the local outlier factor model and the risk value of the power equipment is calculated; the safety level of the power equipment is set according to the risk value; under the vision of the global risk of the power grid, a safety strategy is formulated for the power equipment according to the safety level; and safety operations are performed on the power equipment according to the safety strategy. This embodiment identifies the risk value and safety level corresponding to the power equipment through the trained local outlier factor model, performs multi-dimensional analysis on the identified risk data, adjusts the safety level and formulates the corresponding safety strategy, and adopts a dynamic adjustment mechanism to ensure that the system can respond quickly to various security threats and can respond to emergencies in a timely manner, thereby improving the overall safety and response speed of the system and ensuring the stability and safety of the system.

[0141] Embodiment 2

[0142] Figure 2 A schematic diagram of a power grid-based equipment safety protection device provided in the second embodiment of the present invention is shown in FIG. Figure 2 As shown, the device comprises:

[0143] The flow data collection module 201 is used to collect network flow data of the power equipment in the power grid;

[0144] A risk value calculation module 202, used for inputting the flow data into a local outlier factor model and calculating a risk value for the power equipment;

[0145] A safety level setting module 203, used to set a safety level for the power equipment according to the risk value;

[0146] A security policy formulation module 204, configured to formulate a security policy for the power equipment according to the security level under the vision of the global risk of the power grid;

[0147] The safety operation execution module 205 is used to execute safety operations on the power equipment according to the safety policy.

[0148] In one embodiment of the present invention, the risk value calculation module 202 includes:

[0149] A data point composition module, used for extracting a plurality of flow features from the flow data to compose data points, and writing the data points into a data set;

[0150] k value selection module, used to select k value in the local outlier factor model;

[0151] A distance calculation module, used to calculate the distance between the data point and k neighboring points in the data set; the neighboring points are other data points adjacent to the current data point;

[0152] A reachable distance calculation module, used for calculating the reachable distance between the data point and k neighboring points based on the distance in the data set;

[0153] A local density acquisition module, used for taking the inverse of the average value of all the reachable distances in the data set to obtain the local density;

[0154] The risk value acquisition module of the power equipment is used to calculate the average value of the ratio between the local density of the data point corresponding to the power equipment and the local density of k neighboring points to obtain the risk value of the power equipment.

[0155] In one embodiment of the present invention, the data point composition module includes:

[0156] A time window adding module, used for adding multiple time windows to the traffic data;

[0157] A data statistics module, used to count the total flow, number of connections and average data packet size in each time window;

[0158] A data standardization processing module, used for standardizing the total flow, the number of connections and the average data packet size;

[0159] The data point forming module of the time window is used to form a vector representation of the total flow, the number of connections and the average data packet size to form a data point for each time window if the standardization processing is completed.

[0160] In one embodiment of the present invention, the data point composition module further includes:

[0161] A data set partitioning module, used to partition the data set into a training set and a validation set;

[0162] A local outlier factor model training module, used for training the local outlier factor model by applying the vectors of each dimension of the data point when the data set is the training set;

[0163] A local outlier factor model verification module, used for verifying the local outlier factor model by applying the vectors of each dimension of the data point when the data set is the verification set;

[0164] A target vector acquisition module is used to select a vector with the best dimension as the target vector based on the verified index;

[0165] The target vector application module with the lowest dimension is used to apply the target vector with the lowest dimension if there are multiple target vectors.

[0166] In one embodiment of the present invention, the k value selection module includes:

[0167] A candidate value selection module for selecting multiple k values ​​in a local outlier factor model;

[0168] A candidate value screening module, used to screen out a k value that meets a training condition from a plurality of k values; the training condition is that the risk values ​​are all greater than 1;

[0169] The minimum k value selection module is used to select the k value with the smallest value if there are multiple k values ​​that meet the training conditions.

[0170] In one embodiment of the present invention, the security policy formulation module 204 includes:

[0171] A security mapping table setting module is used to set a security mapping table for the power equipment under the vision of the global risk of the power grid; the mapping relationship between multiple security levels and multiple security policies is recorded in the security mapping table;

[0172] A security level matching module, used to match the security level of the electric equipment with the security level in the security mapping table;

[0173] The successful matching module is used to extract the security policy of the security level mapping in the security mapping table as the security policy of the power equipment when the matching is successful.

[0174] In one embodiment of the present invention, the security mapping table setting module includes:

[0175] A risk data collection module, used to collect risk data when the risk value meets a preset risk condition; the risk data includes at least one of a device identifier, a timestamp, a risk type of a risk item, and a risk level of a risk item;

[0176] A risk cluster forming module, used for mining the risk data with correlation based on frequent sets to form risk clusters;

[0177] A single risk score acquisition module is used to calculate the product of the weight corresponding to the risk type and the coefficient corresponding to the risk level for the same risk item to obtain a single risk score;

[0178] An overall risk score acquisition module, used to calculate the sum of all the individual risk scores in the risk cluster to obtain an overall risk score;

[0179] A single impact score configuration module, used to configure the single impact score for the risk cluster in the dimensions of equipment, system and business;

[0180] An overall impact score calculation module, used to calculate the sum of all the individual impact scores in the risk cluster to obtain an overall impact score;

[0181] A security policy configuration module, configured to configure a security policy for the risk cluster based on the overall risk score and the overall impact score;

[0182] The security policy writing module is used to write the security policy into the security mapping table set for the power equipment.

[0183] In one embodiment of the present invention, the risk cluster composition module includes:

[0184] A transaction database acquisition module, used to convert the risk data into a transaction database; each row in the transaction database represents a transaction, and the transaction contains all the risk items in the risk data;

[0185] A threshold setting module is used to set a support threshold and a confidence threshold;

[0186] A first frequent item set forming module, used for calculating the support of each of the transactions, and retaining the transactions whose support is greater than the support threshold to form a first frequent item set;

[0187] A k-th frequent item set forming module, used to generate a k-th candidate item set from the k-1-th frequent item set, calculate the support of each k-th candidate item set, and retain the k-th candidate item set whose support is greater than the support threshold to form a k-th frequent item set;

[0188] An association rule generating module, used to generate association rules from the frequent item set, calculate the confidence of each association rule, and retain the association rules whose confidence is greater than the confidence threshold;

[0189] The correlation risk data acquisition module is used to obtain the transaction with correlation based on the retained association rule to obtain the risk data with correlation.

[0190] The power grid-based equipment safety protection device provided in the embodiment of the present invention can execute the power grid-based equipment safety protection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing the power grid-based equipment safety protection method.

[0191] Embodiment 3

[0192] See also Figure 3 , showing a schematic diagram of the structure of a computer device provided by an embodiment of the present invention. The computer device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, blade servers, mainframe computers, and other suitable computers. The computer device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0193] like Figure 3 As shown, the computer device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the computer device 10 can also be stored. The processor 11, ROM 12 and RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0194] A number of components in the computer device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the computer device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0195] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a power grid-based device safety protection method.

[0196] In some embodiments, the power grid-based device safety protection method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the computer device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the power grid-based device safety protection method described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to execute the power grid-based device safety protection method in any other appropriate manner (for example, by means of firmware).

[0197] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0198] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0199] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0200] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0201] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0202] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0203] Embodiment 4

[0204] An embodiment of the present invention further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the power grid-based equipment safety protection method provided by any embodiment of the present invention is implemented.

[0205] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0206] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0207] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for protecting equipment safety based on a power grid, characterized in that: The method comprises: Collect network flow data from power equipment in the power grid; Inputting the flow data into a local outlier factor model and calculating a risk value for the power equipment; Setting a safety level for the electric power equipment according to the risk value; Formulate a security strategy for the power equipment according to the security level under the vision of the global risk of the power grid; Perform security operations on the electrical equipment according to the security policy.

2. The method according to claim 1, characterized in that The step of inputting the flow data into a local outlier factor model and calculating a risk value for the power equipment comprises: Extracting a plurality of traffic features from the traffic data to form data points, and writing the data points into a data set; Select the value of k in the local outlier factor model; In the data set, the distance between the data point and k neighboring points is calculated; the neighboring points are other data points adjacent to the current data point; In the data set, calculating the reachable distance between the data point and k neighboring points based on the distance; In the data set, taking the inverse of the average value of all the reachable distances, to obtain a local density; The average value of the ratio between the local density of the data point corresponding to the electric power equipment and the local density of the k neighboring points is calculated to obtain the risk value of the electric power equipment.

3. The method according to claim 1, characterized in that The extracting a plurality of flow features from the flow data to form data points comprises: Adding multiple time windows to the traffic data; Counting the total traffic volume, number of connections and average data packet size in each of the time windows; Standardizing the total traffic volume, the number of connections, and the average data packet size; If the standardization process is completed, the total traffic volume, the number of connections and the average data packet size are represented by a vector to form a data point for each time window.

4. The method according to claim 3, characterized in that The extracting a plurality of flow features from the flow data to form data points also includes: Dividing the data set into a training set and a validation set; When the data set is the training set, the vectors of each dimension of the data point are used to train the local outlier factor model; When the data set is the validation set, applying vectors of each dimension of the data point to validate the local outlier factor model; Select the vector with the best dimension based on the verified indicator as the target vector; If there are multiple target vectors, the target vector with the lowest dimension is used.

5. The method according to claim 2, characterized in that: The step of selecting a k value in the local outlier factor model comprises: Select multiple k values ​​in the local outlier factor model; Screening out a k value that meets a training condition from a plurality of k values; the training condition is that the risk values ​​are all greater than 1; If there are multiple k values ​​that meet the training conditions, the k value with the smallest value is selected.

6. The method according to any one of claims 1 to 5, characterized in that The formulating of a security strategy for the power equipment according to the security level under the vision of the global risk of the power grid includes: Under the vision of the global risk of the power grid, a security mapping table is set for the power equipment; the mapping relationship between multiple security levels and multiple security policies is recorded in the security mapping table; Matching the security level of the electrical equipment with the security level in the security mapping table; When the match is successful, the security policy of the security level mapping in the security mapping table is extracted as the security policy of the power equipment.

7. The method according to claim 6, characterized in that The step of setting a safety mapping table for the power equipment under the vision of the global risk of the power grid includes: Collecting risk data when the risk value meets a preset risk condition; the risk data includes at least one of a device identifier, a timestamp, a risk type of the risk item, and a risk level of the risk item; Mining the risk data with correlation based on frequent sets to form risk clusters; For the same risk item, the product of the weight corresponding to the risk type and the coefficient corresponding to the risk level is calculated to obtain a single risk score; In the risk cluster, calculating the sum of all the individual risk scores to obtain an overall risk score; Configure individual impact scores for the risk clusters in the dimensions of equipment, system, and business; In the risk cluster, the sum of all the individual impact scores is calculated to obtain an overall impact score; configuring a security policy for the risk cluster based on the overall risk score and the overall impact score; The security policy is written into a security mapping table set for the power device.

8. The method according to claim 7, characterized in that The mining of the risk data with correlation based on frequent sets to form risk clusters includes: Converting the risk data into a transaction database; each row in the transaction database represents a transaction, and the transaction contains all the risk items in the risk data; Set support threshold and confidence threshold; Calculating the support of each of the transactions, and retaining the transactions whose support is greater than the support threshold, to form a first frequent item set; Generate a kth candidate item set from the k-1th frequent item set, calculate the support of each kth candidate item set, and retain the kth candidate item set whose support is greater than the support threshold to form a kth frequent item set; Generate association rules from the frequent item set, calculate the confidence of each of the association rules, and retain the association rules whose confidence is greater than the confidence threshold; The transactions with correlation are obtained based on the retained association rules to obtain the risk data with correlation.

9. A computer device, characterized in that: include: one or more processors; A storage device for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the power grid-based equipment safety protection method as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a power grid-based equipment safety protection method as described in any one of claims 1 to 8 is implemented.

Images