Power monitoring system network security event alarm method, device, equipment, storage medium and program product

Abstract

The invention discloses a power monitoring system network security event alarm method, device and equipment, a storage medium and a program product, and the method comprises the steps: obtaining a network security event alarm information log data set of a power monitoring system in a current time period, and extracting a corresponding network security event from each alarm information log; according to a preset coding rule, coding the network security event set into a symbol sequence arranged in a time sequence; intercepting a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to one sub-symbol sequence; inputting the sub-symbol sequence corresponding to each network security event into the trained neural network model to obtain a corresponding relevancy vector; clustering the relevancy vectors corresponding to all the network security events to obtain an alarm type to which each network security event belongs; and according to the alarm type to which the network security event belongs, judging whether to execute an alarm on the alarm information log corresponding to the network security event. The method is higher in treatment efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of power system network security, and in particular to a network security event alarm method, device, equipment, storage medium and program product for a power monitoring system. Background Art

[0002] As the central control system of the power grid, the power monitoring system is a key link in ensuring power supply safety. The security of the power monitoring system is an important foundation for building the security of critical information infrastructure. The more the current network security management platform collects and monitors, the greater the number of alarms, the greater the workload of manual analysis and judgment, the lower the processing efficiency, and the real security threats are easily buried in the massive alarms, which is not conducive to discovering the real security threats. Therefore, the current network security management platform is insufficient in terms of processing efficiency and discovery capabilities of security threat warnings. Summary of the invention

[0003] In view of the problems existing in the prior art, the purpose of the present invention is to provide a network security event alarm method, device, equipment, storage medium and program product for an electric power monitoring system with higher processing efficiency and stronger security event detection capability.

[0004] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions:

[0005] In a first aspect, the present invention provides a method for warning network security events in a power monitoring system, comprising:

[0006] Obtain a data set of network security event alarm information logs of the power monitoring system in the current time period, and extract the corresponding network security event from each alarm information log to form a network security event set;

[0007] According to a preset coding rule, the network security event set is encoded into a symbol sequence arranged in chronological order, wherein the preset coding rule is that one network security event is encoded into one unique symbol;

[0008] Extracting a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously;

[0009] Inputting the sub-symbol sequence corresponding to each network security event into the trained neural network model to obtain the corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event that occurred previously, and form a correlation vector output;

[0010] Cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs;

[0011] According to the alarm type of the network security event, determine whether to execute an alarm for the alarm information log corresponding to the network security event.

[0012] Furthermore, the step of obtaining a network security event alarm information log data set of the power monitoring system further includes the following steps:

[0013] Data preprocessing is performed on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

[0014] Furthermore, encoding the network security event set into a symbol sequence arranged in chronological order according to a preset encoding rule specifically includes:

[0015] Rearranging the network security event set in chronological order to obtain a sequential time network security event set;

[0016] Encoding each network security event in the sequential time network security event set into a symbol according to a preset encoding rule;

[0017] Arrange the symbols of all cybersecurity events in order to form a chronological sequence of symbols.

[0018] Furthermore, the extracting of a plurality of sub-symbol sequences from the symbol sequence such that each network security event corresponds to a sub-symbol sequence specifically includes:

[0019] Get a sliding window with a window size of k, where k is a positive integer greater than 1;

[0020] Get the symbol sequence E' m ={e'1,...,e' m}, where e' i represents the symbol after encoding the i-th safety network event, and m is the number of symbols in the symbol sequence;

[0021] In the symbol sequence E' m ={e'1,...,e' m}, complement the first k-1 security network event encoded symbols to generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, where e' 1-k ,e' 2-kThe symbol representing the encoded k-1 and k-2 safety network events before the first safety network event;

[0022] The sliding window is used in the complementary symbol sequence E* with a step size of 1. m Slide and intercept within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

[0023] Furthermore, the training method of the neural network model includes:

[0024] Obtain a historical data set of cybersecurity event alarm information logs of the power monitoring system, and extract the corresponding historical cybersecurity events from each alarm information log to form a historical cybersecurity event set;

[0025] According to a preset coding rule, the set of historical network security events is encoded into a sequence of historical symbols arranged in chronological order;

[0026] Extracting a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously;

[0027] Calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event that occurred previously, and form a correlation vector;

[0028] The sub-symbol sequence corresponding to each historical network security event is taken as a sample, and the corresponding relevance vector is used as a label and input into the neural network model for training.

[0029] Furthermore, the sub-symbol sequence corresponding to each network security event is input into the trained neural network model to obtain the corresponding correlation vector, and then further includes:

[0030] The correlation vector is normalized according to the following formula:

[0031] V' i =(V i -mean(V i )) / std(Vi )

[0032] Where V i Represents the correlation vector corresponding to the ith network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

[0033] Furthermore, clustering the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs specifically includes:

[0034] Extract an unprocessed relevance vector from the relevance vectors corresponding to all network security events as the current relevance vector p to be processed;

[0035] For the current correlation vector p to be processed, determine its ε neighborhood N ε The number of correlation vectors N included in (p) ε (V) Whether it satisfies N ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, q represents other correlation vectors except p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters;

[0036] If N is satisfied ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster;

[0037] If N is not satisfied ε (V)≥MinPts, then extract the next unprocessed relevance vector until all relevance vectors are processed;

[0038] The alarm type corresponding to the alarm cluster where each correlation vector is located is used as the alarm type to which the corresponding network security event belongs.

[0039] Further, judging whether to issue an alarm for the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs specifically includes:

[0040] Get the alarm level of each alarm type;

[0041] According to the alarm type of the network security event, the alarm information log corresponding to the network security event is marked with the alarm type and alarm level;

[0042] Determine whether the alarm level of the alarm information log reaches the preset alarm threshold. If so, an alarm is issued for the alarm information log, otherwise no alarm is issued.

[0043] In a second aspect, the present invention further provides a network security event alarm device for a power monitoring system, comprising:

[0044] A log data set acquisition module is used to acquire a network security event alarm information log data set of the power monitoring system within the current time period;

[0045] A network security event extraction module is used to extract the corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set;

[0046] An encoding module, used to encode the set of network security events into a sequence of symbols arranged in chronological order according to a preset encoding rule, wherein the preset encoding rule is that one network security event is encoded as one unique symbol;

[0047] A symbol interception module, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously;

[0048] A correlation calculation module, used to input the sub-symbol sequence corresponding to each network security event into a trained neural network model to obtain a corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event that occurred previously, and form a correlation vector output;

[0049] A clustering module is used to cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs;

[0050] The alarm judgment module is used to judge whether to execute an alarm for the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs.

[0051] Furthermore, the device also includes:

[0052] The preprocessing module is used to perform data preprocessing on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

[0053] Furthermore, the encoding module specifically includes:

[0054] A sorting unit, used to rearrange each security event in the network security event set in chronological order to obtain a sequential time network security event set;

[0055] An encoding unit, used to encode each network security event in the sequential time network security event set into a symbol according to a preset encoding rule;

[0056] The symbol sequence generating unit is used to arrange the symbols of all network security events in chronological order to form a symbol sequence arranged in chronological order.

[0057] Furthermore, the symbol interception module specifically includes:

[0058] A sliding window acquisition unit, used to acquire a sliding window with a window size of k, where k is a positive integer greater than 1;

[0059] A symbol sequence acquisition unit, used to acquire the symbol sequence E' m ={e'1,...,e' m}, where e' i represents the symbol after encoding the i-th safety network event, and m is the number of symbols in the symbol sequence;

[0060] A symbol supplement unit is used to add a symbol to the symbol sequence E' m ={e'1,...,e' m}, complement the first k-1 security network event encoded symbols to generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event;

[0061] A sliding interception unit is used to adopt the sliding window in the complementary symbol sequence E* with a step size of 1. m Slide and intercept within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e'i ] means e' i The corresponding sub-symbol sequence.

[0062] Furthermore, the device also includes a neural network model training module, and the neural network model training module includes:

[0063] A historical data acquisition unit is used to acquire a historical data set of network security event alarm information logs of the power monitoring system, and extract the corresponding historical network security events from each alarm information log to form a historical network security event set;

[0064] An encoding unit, configured to encode the set of historical network security events into a sequence of historical symbols arranged in chronological order according to a preset encoding rule;

[0065] An interception unit, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously;

[0066] A correlation calculation unit, used to calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event that occurred previously, and form a correlation vector;

[0067] The training unit is used to take the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding relevance vector as a label, and input them into the neural network model for training.

[0068] Furthermore, the device also includes:

[0069] The normalization module is used to normalize the correlation vector according to the following formula:

[0070] V' i =(V i -mean(V i )) / std(V i )

[0071] Where V i Represents the correlation vector corresponding to the ith network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

[0072] Furthermore, the clustering module specifically includes:

[0073] A relevance vector extraction unit, used to extract an unprocessed relevance vector from the relevance vectors corresponding to all network security events as the current relevance vector p to be processed;

[0074] Neighborhood judgment unit, used to judge the ε neighborhood N of the current correlation vector p to be processed ε The number of correlation vectors N included in (p) ε (V) Whether it satisfies N ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, q represents other correlation vectors except p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters;

[0075] Clustering unit is used to satisfy N ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster;

[0076] Repeat the judgment execution unit, if N is not satisfied ε (V)≥MinPts, the relevance vector extraction unit is executed until all relevance vectors are processed;

[0077] The alarm type acquisition unit is used to use the alarm type corresponding to the alarm cluster where each correlation vector is located as the alarm type to which the corresponding network security event belongs.

[0078] Furthermore, the alarm judgment module specifically includes:

[0079] An alarm level acquisition unit, used to acquire the alarm level of each alarm type;

[0080] Alarm marking, which is used to mark the alarm type and alarm level of the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs;

[0081] The alarm judgment unit is used to judge whether the alarm level of the alarm information log reaches a preset alarm threshold. If so, an alarm is issued for the alarm information log, otherwise no alarm is issued.

[0082] In a third aspect, the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect.

[0083] In a fourth aspect, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, wherein the computer program / instruction implements the method described in the first aspect when executed by a processor.

[0084] In a fifth aspect, the present invention further provides a computer program product, comprising a computer program / instructions, which implement the method described in the first aspect when executed by a processor.

[0085] Compared with the prior art, the present invention has the following beneficial effects: the present invention learns the characteristics of alarm information of network security events in the power system through deep learning technology, and the improved characteristics can better reflect the characteristics of network security events and enhance the ability to discover security events; the present invention batch processes and analyzes alarm information logs, clusters alarms with the same characteristics, improves the processing efficiency of alarm data, and realizes automatic alarms of high-risk types. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 It is a flow chart of a method for warning network security events in a power monitoring system provided by an embodiment of the present invention;

[0087] Figure 2 It is a structural diagram of a network security event alarm device for a power monitoring system provided by an embodiment of the present invention;

[0088] Figure 3 It is a structural diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0089] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0090] Embodiment 1

[0091] The embodiment of the present invention provides a method for warning network security events in a power monitoring system. Figure 1 As shown, the following steps are included:

[0092] S101. Obtain a data set of network security event alarm information logs of a power monitoring system in a current time period, and extract the corresponding network security event from each alarm information log to form a network security event set.

[0093] Among them, the network security event alarm information log data set of the power monitoring system can be obtained according to the preset cycle. If the cycle is set short, the logs in the current cycle can be processed and the alarm results obtained in a timely manner. However, if the time period of the cycle is set too short, it may also cause frequent data processing, affect the network speed and occupy equipment space. Therefore, a reasonable cycle should be set to ensure timely feedback of alarms and reasonable equipment use.

[0094] In addition, the network security event alarm information log data set Log of the power monitoring system in the current time period is obtained. n ={log1,...,log n After that, the network security event alarm information log data set can also be preprocessed, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning, and finally the preprocessed data set Log' n ={log'1,...,log' n}, where log n 、log' n Represents the nth network security event alarm information log before and after preprocessing, where n is the number of alarm information logs.

[0095] Each alarm information log will describe a network security event. Multiple alarm information logs may describe the same network security event or different network security events. By extracting information from the alarm information log, we can obtain the network security event described by each alarm information log, and then combine all network security events to form a network security event set F. m ={f1,...,f m}, f m Represents the mth network security event, where m is the number of network security events, and m<=n.

[0096] S102: Encode the network security event set into a symbol sequence arranged in chronological order according to a preset encoding rule.

[0097] The preset coding rule is an enumeration coding mapping, that is, a network security event is coded as a unique symbol. For example, each network security event can be coded as a unique number, or each network security event can be coded as a unique letter, or any one of a number and a letter.

[0098] In specific implementation, the steps include:

[0099] S1021, the network security event set F m ={f1,...,f m} Rearrange in chronological order to obtain the sequential time network security event set F m '={f1',...,f m '};

[0100] S1022: The sequential time network security event set F m '={f1',...,f m Each network security event f in '} i ', according to the preset encoding rules, encoded as a symbol e' i ;

[0101] S1023. Arrange the symbols of all network security events in order to form a symbol sequence E' arranged in chronological order. m ={e'1,...,e' m}.

[0102] S103: extract several sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence.

[0103] Among them, the sub-symbol sequence includes the symbol corresponding to the network security event and the symbols of several network security events that occurred before, so that the sub-symbol sequence has the above meaning.

[0104] In specific implementation, step S103 includes:

[0105] S1031. Obtain a sliding window with a window size of k, where k is a positive integer greater than 1;

[0106] S1032, obtaining the symbol sequence E' m ={e'1,...,e' m}, where m is the number of symbols in the symbol sequence, i.e., the number of cybersecurity events;

[0107] S1033, in the symbol sequence E' m ={e'1,...,e' m}, complement the first k-1 security network event encoded symbols to generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event;

[0108] S1034, using the sliding window in a step size of 1 to represent the complement symbol sequence E* mSlide and intercept within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

[0109] S104: Input the sub-symbol sequence corresponding to each network security event into the trained neural network model to obtain the corresponding correlation vector.

[0110] The neural network model is any one of a deep learning model, a neural network model, etc., such as a Transformer. The neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event that occurred previously, and form a correlation vector output. For example, for the sub-symbol sequence [e' i-k ,...,e' i-1 ,e' i ], after inputting the neural network model, the output is the correlation vector V i =[v i,1 ,...,v i,k-1 ],v i,k-1 Indicates e' i Corresponding network security incident f' i The first cybersecurity incident that occurred before i-1 The correlation between .

[0111] The training method of the neural network model includes:

[0112] Obtain a historical data set of cybersecurity event alarm information logs of the power monitoring system, and extract the corresponding historical cybersecurity events from each alarm information log to form a historical cybersecurity event set;

[0113] According to a preset coding rule, the set of historical network security events is encoded into a sequence of historical symbols arranged in chronological order;

[0114] Extracting a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously;

[0115] Calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event that occurred previously, and form a correlation vector; wherein the correlation can be any correlation measure;

[0116] The sub-symbol sequence corresponding to each historical network security event is taken as a sample, and the corresponding relevance vector is used as a label and input into the neural network model for training.

[0117] In addition, after the sub-symbol sequence corresponding to each network security event is input into the trained neural network model to obtain the corresponding correlation vector, the correlation vector can also be standardized according to the following formula:

[0118] V' i =(V i -mean(V i )) / std(V i )

[0119] Where V i Represents the correlation vector corresponding to the ith network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

[0120] S105: Cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs.

[0121] In specific implementation, the steps include:

[0122] S1051. Extract an unprocessed correlation vector from the correlation vectors corresponding to all network security events as the current correlation vector p to be processed;

[0123] S1052: for the current correlation vector p to be processed, determine its ε neighborhood N ε The number of correlation vectors N included in (p) ε (V) Whether it satisfies N ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, q represents other correlation vectors except p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters;

[0124] S1053, if N is satisfied ε(V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster;

[0125] S1054, if N is not satisfied ε (V)≥MinPts, then extract the next unprocessed relevance vector until all relevance vectors are processed;

[0126] S1055: Use the alarm type corresponding to the alarm cluster where each correlation vector is located as the alarm type to which the corresponding network security event belongs, wherein each alarm cluster is an alarm type.

[0127] S106: Determine whether to issue an alarm for the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs.

[0128] In specific implementation, the steps include:

[0129] S1061. Obtain an alarm level for each alarm type; wherein the alarm level for each alarm type may be obtained based on experience, or may be obtained and identified based on alarm features;

[0130] S1062. Mark the alarm type and alarm level of the alarm information log corresponding to the network security event according to the alarm type of the network security event.

[0131] S1063: Determine whether the alarm level of the alarm information log reaches the preset alarm threshold. If yes, then an alarm is issued for the alarm information log, otherwise no alarm is issued. High alarm levels are fed back to the operation and maintenance personnel for timely processing.

[0132] Embodiment 2

[0133] This embodiment provides a network security event alarm device for a power monitoring system, such as Figure 2 As shown, including:

[0134] The log data set acquisition module 201 is used to acquire a network security event alarm information log data set of the power monitoring system in the current time period;

[0135] A network security event extraction module 202 is used to extract the corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set;

[0136] The encoding module 203 is used to encode the network security event set into a symbol sequence arranged in chronological order according to a preset encoding rule, wherein the preset encoding rule is that one network security event is encoded as one unique symbol;

[0137] A symbol interception module 204 is used to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously;

[0138] A correlation calculation module 205 is used to input the sub-symbol sequence corresponding to each network security event into the trained neural network model to obtain a corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event that occurred previously, and form a correlation vector output;

[0139] A clustering module 206 is used to cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs;

[0140] The alarm determination module 207 is used to determine whether to issue an alarm for the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs.

[0141] In other embodiments, the device may further include:

[0142] The preprocessing module is used to perform data preprocessing on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

[0143] In a specific implementation, the encoding module 203 specifically includes:

[0144] A sorting unit, used to rearrange each security event in the network security event set in chronological order to obtain a sequential time network security event set;

[0145] An encoding unit, used to encode each network security event in the sequential time network security event set into a symbol according to a preset encoding rule;

[0146] The symbol sequence generating unit is used to arrange the symbols of all network security events in chronological order to form a symbol sequence arranged in chronological order.

[0147] In a specific implementation, the symbol interception module 204 specifically includes:

[0148] A sliding window acquisition unit, used to acquire a sliding window with a window size of k, where k is a positive integer greater than 1;

[0149] A symbol sequence acquisition unit, used to acquire the symbol sequence E' m ={e'1,...,e' m}, where e' i represents the symbol after encoding the i-th safety network event, and m is the number of symbols in the symbol sequence;

[0150] A symbol supplement unit is used to add a symbol to the symbol sequence E' m ={e'1,...,e' m}, complement the first k-1 security network event encoded symbols to generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event;

[0151] A sliding interception unit is used to adopt the sliding window in the complementary symbol sequence E* with a step size of 1. m Slide and intercept within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

[0152] In other embodiments, the device may further include a neural network model training module, wherein the neural network model training module includes:

[0153] A historical data acquisition unit is used to acquire a historical data set of network security event alarm information logs of the power monitoring system, and extract the corresponding historical network security events from each alarm information log to form a historical network security event set;

[0154] An encoding unit, configured to encode the set of historical network security events into a sequence of historical symbols arranged in chronological order according to a preset encoding rule;

[0155] An interception unit, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously;

[0156] A correlation calculation unit, used to calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event that occurred previously, and form a correlation vector;

[0157] The training unit is used to take the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding relevance vector as a label, and input them into the neural network model for training.

[0158] In other embodiments, the device may further include:

[0159] The normalization module is used to normalize the correlation vector according to the following formula:

[0160] V' i =(V i -mean(V i )) / std(V i )

[0161] Where V i Represents the correlation vector corresponding to the ith network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

[0162] In specific implementation, the clustering module 206 specifically includes:

[0163] A relevance vector extraction unit, used to extract an unprocessed relevance vector from the relevance vectors corresponding to all network security events as the current relevance vector p to be processed;

[0164] Neighborhood judgment unit, used to judge the ε neighborhood N of the current correlation vector p to be processed ε The number of correlation vectors N included in (p) ε (V) Whether it satisfies N ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, q represents other correlation vectors except p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters;

[0165] Clustering unit is used to satisfy N ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N εThe correlation vectors in (p) are clustered into an alarm cluster;

[0166] Repeat the judgment execution unit, if N is not satisfied ε (V)≥MinPts, the relevance vector extraction unit is executed until all relevance vectors are processed;

[0167] The alarm type acquisition unit is used to use the alarm type corresponding to the alarm cluster where each correlation vector is located as the alarm type to which the corresponding network security event belongs.

[0168] In specific implementation, the alarm determination module 207 specifically includes:

[0169] An alarm level acquisition unit, used to acquire the alarm level of each alarm type;

[0170] Alarm marking, which is used to mark the alarm type and alarm level of the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs;

[0171] The alarm judgment unit is used to judge whether the alarm level of the alarm information log reaches a preset alarm threshold. If so, an alarm is issued for the alarm information log, otherwise no alarm is issued.

[0172] The device provided in the embodiment of the present invention can be used to execute the method provided in the first embodiment of the present invention, and has the corresponding functions and beneficial effects of executing the method.

[0173] It is worth noting that in the embodiment of the above-mentioned device, the various units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0174] The embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, or of course, it can be implemented only by hardware, as long as the function or effect can be achieved.

[0175] Embodiment 3

[0176] Figure 3Schematic diagram of the structure of a computer device provided by an embodiment of the present invention. The embodiment of the present invention provides services for implementing the method of the above-mentioned embodiment 1 of the present invention. Figure 3 As shown, the device may include: a memory 301 storing a computer executable program; a processor 302 coupled to the memory 301; the processor 302 calls the computer executable program stored in the memory 301 to execute the steps in the method described in the first embodiment.

[0177] The memory 301 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the memory 301 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as "hard drives"). A program / utility having a set (at least one) of program modules may be stored in, for example, the memory 301, such program modules including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include the implementation of a network environment. The computer executable program of the program module typically performs the functions and / or methods in the embodiments described in the present invention.

[0178] The processor 302 executes various functional applications and data processing by running the program stored in the memory 301, such as implementing the method provided in the first embodiment of the present invention.

[0179] The code of the computer executable program can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages.

[0180] Embodiment 4

[0181] An embodiment of the present invention provides a storage medium including a computer executable program. When the computer executable program is executed by a computer processor, it is used to execute the method of the first embodiment.

[0182] The storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. Computer-readable media can be computer-readable signal media or computer-readable storage media. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: electrical connections with one or more wires, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this document, computer-readable storage media can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0183] Of course, the storage medium containing a computer executable program provided by an embodiment of the present invention, the computer executable program of which is not limited to the above method operations, can also execute related operations in the method provided by any embodiment of the present invention.

[0184] Embodiment 5

[0185] The embodiment of the present invention also provides a computer product, such as an app on a mobile phone, a tablet, an installation program on a computer, etc., which includes a computer program / instruction, and the computer program / instruction is executed by a processor to implement the method described in Example 1. The code of the computer executable program for performing the operation of the present invention can be written in one or more programming languages ​​or a combination thereof, and the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as "C" language or similar programming language. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0186] It should be noted that, in this document, relational terms such as first and second, etc. are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations.

[0187] It should be understood that the above embodiments and descriptions only describe the principles, main features and advantages of the present invention. Without departing from the spirit and scope of the present invention, the present invention may be subject to various changes and improvements, and these changes and improvements all fall within the scope of protection of the present invention.

Claims

1. A method for warning network security events in a power monitoring system, characterized in that: include: Obtain a network security event alarm information log data set of the power monitoring system in the current time period, and extract the corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set; According to a preset coding rule, the network security event set is encoded into a symbol sequence arranged in chronological order, wherein the preset coding rule is that one network security event is encoded into one unique symbol; Extracting a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously; Inputting the sub-symbol sequence corresponding to each network security event into the trained neural network model to obtain the corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event that occurred previously, and form a correlation vector output; Cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs; According to the alarm type of the network security event, determine whether to execute an alarm for the alarm information log corresponding to the network security event.

2. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The step of obtaining a network security event alarm information log data set of the power monitoring system further includes the following steps: Data preprocessing is performed on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

3. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The step of encoding the network security event set into a symbol sequence arranged in chronological order according to a preset encoding rule specifically includes: Rearranging each security event in the network security event set in chronological order to obtain a sequential time network security event set; Encoding each network security event in the sequential time network security event set into a symbol according to a preset encoding rule; Arrange the symbols of all network security events in chronological order to form a symbol sequence arranged in chronological order.

4. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The extracting a plurality of sub-symbol sequences from the symbol sequence so that each network security event corresponds to a sub-symbol sequence specifically includes: Get a sliding window with a window size of k, where k is a positive integer greater than 1; Get the symbol sequence E' m ={e'1,...,e' m }, where e' i represents the symbol after encoding the i-th safety network event, and m is the number of symbols in the symbol sequence; In the symbol sequence E' m ={e'1,...,e' m }, complement the first k-1 security network event encoded symbols to generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m }, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event; The sliding window is used in the complementary symbol sequence E* with a step size of 1. m Slide and intercept within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

5. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The training method of the neural network model includes: Obtain a historical data set of cybersecurity event alarm information logs of the power monitoring system, and extract the corresponding historical cybersecurity events from each alarm information log to form a historical cybersecurity event set; According to a preset coding rule, the set of historical network security events is encoded into a sequence of historical symbols arranged in chronological order; Extracting a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously; Calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event that occurred previously, and form a correlation vector; The sub-symbol sequence corresponding to each historical network security event is taken as a sample, and the corresponding relevance vector is used as a label and input into the neural network model for training.

6. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The sub-symbol sequence corresponding to each network security event is input into the trained neural network model to obtain the corresponding correlation vector, and then the following is further included: The correlation vector is normalized according to the following formula: V' i =(V i -mean(V i )) / std(V i ) Where V i Represents the correlation vector corresponding to the ith network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

7. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The clustering of the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs specifically includes: Extract an unprocessed relevance vector from the relevance vectors corresponding to all network security events as the current relevance vector p to be processed; For the current correlation vector p to be processed, determine its ε neighborhood N ε The number of correlation vectors N included in (p) ε (V) Whether it satisfies N ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, q represents other correlation vectors except p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters; If N is satisfied ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster; If N is not satisfied ε (V)≥MinPts, then extract the next unprocessed relevance vector until all relevance vectors are processed; The alarm type corresponding to the alarm cluster where each correlation vector is located is used as the alarm type to which the corresponding network security event belongs.

8. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The step of determining whether to issue an alarm for an alarm information log corresponding to a network security event according to the alarm type to which the network security event belongs specifically includes: Get the alarm level of each alarm type; According to the alarm type of the network security event, the alarm information log corresponding to the network security event is marked with the alarm type and alarm level; Determine whether the alarm level of the alarm information log reaches the preset alarm threshold. If so, an alarm is issued for the alarm information log, otherwise no alarm is issued.

9. A network security event alarm device for a power monitoring system, characterized in that: include: A log data set acquisition module is used to acquire a network security event alarm information log data set of the power monitoring system within the current time period; A network security event extraction module is used to extract the corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set; An encoding module, used to encode the set of network security events into a sequence of symbols arranged in chronological order according to a preset encoding rule, wherein the preset encoding rule is that one network security event is encoded as one unique symbol; A symbol interception module, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously; A correlation calculation module, used to input the sub-symbol sequence corresponding to each network security event into a trained neural network model to obtain a corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event that occurred previously, and form a correlation vector output; A clustering module is used to cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs; The alarm judgment module is used to judge whether to execute an alarm for the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs.

10. The network security event alarm device of the power monitoring system according to claim 9, characterized in that: The device also includes: The preprocessing module is used to perform data preprocessing on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

11. The network security event alarm device of the power monitoring system according to claim 9, characterized in that: The encoding module specifically includes: A sorting unit, used to rearrange each security event in the network security event set in chronological order to obtain a sequential time network security event set; An encoding unit, used to encode each network security event in the sequential time network security event set into a symbol according to a preset encoding rule; The symbol sequence generating unit is used to arrange the symbols of all network security events in chronological order to form a symbol sequence arranged in chronological order.

12. The network security event alarm device for the power monitoring system according to claim 9, characterized in that: The symbol interception module specifically includes: A sliding window acquisition unit, used to acquire a sliding window with a window size of k, where k is a positive integer greater than 1; A symbol sequence acquisition unit, used to acquire the symbol sequence E' m ={e'1,...,e' m }, where e' i represents the symbol after encoding the i-th safety network event, and m is the number of symbols in the symbol sequence; A symbol supplement unit is used to add a symbol to the symbol sequence E' m ={e'1,...,e' m }, complement the first k-1 security network event encoded symbols to generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m }, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event; A sliding interception unit is used to adopt the sliding window in the complementary symbol sequence E* with a step size of 1. m Slide and intercept within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

13. The network security event alarm device of the power monitoring system according to claim 9, characterized in that: The device also includes a neural network model training module, and the neural network model training module includes: A historical data acquisition unit is used to acquire a historical data set of network security event alarm information logs of the power monitoring system, and extract the corresponding historical network security events from each alarm information log to form a historical network security event set; An encoding unit, configured to encode the set of historical network security events into a sequence of historical symbols arranged in chronological order according to a preset encoding rule; An interception unit, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously; A correlation calculation unit, used to calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event that occurred previously, and form a correlation vector; The training unit is used to take the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding relevance vector as a label, and input them into the neural network model for training.

14. The network security event alarm device of the power monitoring system according to claim 9, characterized in that: The device also includes: The normalization module is used to normalize the correlation vector according to the following formula: V' i =(V i -mean(V i )) / std(V i ) Where V i Represents the correlation vector corresponding to the ith network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

15. The network security event alarm device of the power monitoring system according to claim 9, characterized in that: The clustering module specifically includes: A relevance vector extraction unit, used to extract an unprocessed relevance vector from the relevance vectors corresponding to all network security events as the current relevance vector p to be processed; Neighborhood judgment unit, used to judge the ε neighborhood N of the current correlation vector p to be processed ε The number of correlation vectors N included in (p) ε (V) Whether it satisfies N ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, q represents other correlation vectors except p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters; Clustering unit is used to satisfy N ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster; Repeat the judgment execution unit, if N is not satisfied ε (V)≥MinPts, the relevance vector extraction unit is executed until all relevance vectors are processed; The alarm type acquisition unit is used to use the alarm type corresponding to the alarm cluster where each correlation vector is located as the alarm type to which the corresponding network security event belongs.

16. The network security event alarm device of the power monitoring system according to claim 9, characterized in that: The alarm judgment module specifically includes: An alarm level acquisition unit, used to acquire the alarm level of each alarm type; Alarm marking, which is used to mark the alarm type and alarm level of the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs; The alarm judgment unit is used to judge whether the alarm level of the alarm information log reaches a preset alarm threshold. If so, an alarm is issued for the alarm information log, otherwise no alarm is issued.

17. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the computer program to implement the method according to any one of claims 1 to 8.

18. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: The computer program / instructions, when executed by a processor, implement the method of any one of claims 1-8.

19. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images