Power monitoring system network security event alarm method, device, equipment, storage medium and program product

Abstract

The application discloses a power monitoring system network security event alarm method and device, equipment, storage medium and program product, the method comprises the following steps: acquiring network security event alarm information log data set of the power monitoring system in the current time period, and extracting the corresponding network security event from each alarm information log; according to the preset coding rule, the network security event set is coded into a symbol sequence arranged in time sequence; a plurality of sub-symbol sequences are intercepted from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence; the sub-symbol sequence corresponding to each network security event is input into the trained neural network model to obtain the corresponding correlation vector; the correlation vectors corresponding to all network security events are clustered to obtain the alarm type to which each network security event belongs; whether the alarm information log corresponding to the network security event is executed according to the alarm type to which the network security event belongs. The application has higher processing efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system network security, and particularly relates to a power monitoring system network security event alarm method, device, equipment, storage medium and program product. BACKGROUND

[0002] The power monitoring system is a key link for ensuring power supply safety as a central control system of the power grid, and power monitoring system security is an important basis for building key information infrastructure security. The more the current network security management platform collects and monitors, the more alarms there are, and the more artificial analysis and judgment workload there is, which is inefficient, and real security threats can easily be lost in the vast number of alarms, which is not conducive to discovering real security threats. Therefore, the current network security management platform has deficiencies in processing efficiency and discovery ability in security threat early warning. SUMMARY

[0003] In view of the problems in the prior art, the present application aims to provide a power monitoring system network security event alarm method, device, equipment, storage medium and program product with higher processing efficiency and stronger security event discovery ability.

[0004] In order to achieve the above-mentioned application purpose, the present application provides the following technical solutions:

[0005] In a first aspect, the present application provides a power monitoring system network security event alarm method, comprising:

[0006] Obtaining network security event alarm information log data sets of the power monitoring system in a current time period, and extracting the corresponding network security events from each alarm information log to form a network security event set;

[0007] Encoding the network security event set into a symbol sequence arranged in time sequence according to a preset encoding rule, wherein the preset encoding rule encodes one network security event into one unique symbol;

[0008] Extracting a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes the symbol of the corresponding network security event and the symbols of a plurality of network security events occurring before;

[0009] Inputting the sub-symbol sequence corresponding to each network security event into a trained neural network model to obtain a corresponding correlation degree vector, wherein the neural network model is used to calculate the correlation degree between the network security event corresponding to the sub-symbol sequence and each network security event occurring before, and form a correlation degree vector output;

[0010] Clustering the relevance vectors corresponding to all network security events to obtain an alarm type to which each network security event belongs;

[0011] According to the alarm type to which the network security event belongs, it is judged whether to execute the alarm on the alarm information log corresponding to the network security event.

[0012] Further, the network security event alarm information log data set of the power monitoring system is obtained, and then the steps further include:

[0013] The network security event alarm information log data set is preprocessed, and the preprocessing includes code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

[0014] Further, the network security event set is encoded into a symbol sequence arranged in time sequence according to the preset encoding rule, and specifically includes:

[0015] The network security event set is rearranged in time sequence to obtain a sequential time network security event set;

[0016] Each network security event in the sequential time network security event set is encoded into a symbol according to the preset encoding rule;

[0017] All network security events are arranged in symbol order to form a symbol sequence arranged in time sequence.

[0018] Further, the sub-symbol sequence is intercepted from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, and specifically includes:

[0019] A sliding window with a window size of k is obtained, and k is a positive integer greater than 1;

[0020] The symbol sequence E' m ={e' m ,...,e' i} is obtained, wherein e' m represents the encoded symbol of the i-th security network event, and m is the number of symbols in the symbol sequence;

[0021] The first k-1 encoded symbols of the security network event are supplemented at the front end of the symbol sequence E' m ={e' m ,...,e' 1-k} to generate a supplement symbol sequence E* 2-k ={e' m ,e' 1-k ,...,e' 2-kdenotes the encoded symbols of the k-1, k-2 security network events before the first security network event;

[0022] The sliding window is used in steps of 1 to slide and intercept the supplementary symbol sequence E m 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ] are obtained, wherein [e' i-k ,...,e' i ] denotes the corresponding sub-symbol sequence of e' i .

[0023] Further, the training method of the neural network model comprises:

[0024] obtaining a network security event alarm information log data set of a historical power monitoring system, and extracting a corresponding historical network security event from each alarm information log to form a historical network security event set;

[0025] encoding the historical network security event set into a historical symbol sequence arranged in time sequence according to a preset encoding rule;

[0026] cutting a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence comprises symbols of the corresponding historical network security event and symbols of a plurality of historical network security events occurring before;

[0027] calculating a correlation degree between the historical network security event corresponding to the sub-symbol sequence and each historical network security event occurring before, and forming a correlation degree vector;

[0028] inputting the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding correlation degree vector as a label into a neural network model for training.

[0029] Further, the inputting of the sub-symbol sequence corresponding to each network security event into the trained neural network model to obtain the corresponding correlation degree vector further comprises:

[0030] normalizing the correlation degree vector according to the following formula:

[0031] V' i =(V i -mean(V i )) / std(V​i )

[0032] wherein, V i represents the relevance vector corresponding to the i th network security event, V' i represents V i the standardized relevance vector, mean(V i ) represents the mean of all relevance vectors, and std(V i ) represents the standard deviation of all relevance vectors.

[0033] Further, the clustering of the relevance vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs comprises:

[0034] extracting an unprocessed relevance vector from the relevance vectors corresponding to all network security events as a current to-be-processed relevance vector p;

[0035] For the current to-be-processed relevance vector p, it is judged whether the number N ε (V) of the relevance vectors included in the ε neighborhood N ε (p) of the current to-be-processed relevance vector p satisfies N ε (V)≥MinPts; wherein, N ε (p) = {q ∈ D | dist(p, q) ≤ ε}, q represents a relevance vector other than p, D represents a set formed by the relevance vectors corresponding to all network security events, dist(p, q) represents the distance between p and q, ε represents a distance threshold, and MinPts represents the minimum number of points in a cluster;

[0036] If N ε (V)≥MinPts is satisfied, the current to-be-processed relevance vector p is taken as a core point, and all the relevance vectors in N ε (p) are clustered into an alarm cluster;

[0037] If N ε (V)≥MinPts is not satisfied, the next unprocessed relevance vector is extracted until all the relevance vectors are processed;

[0038] The alarm type corresponding to the alarm cluster in which each relevance vector is located is taken as the alarm type to which the corresponding network security event belongs.

[0039] Further, the judging whether to perform an alarm on the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs comprises:

[0040] obtaining the alarm level of each alarm type;

[0041] The alarm information log corresponding to the network security event is marked with an alarm type and an alarm level according to the alarm type to which the network security event belongs;

[0042] It is judged whether the alarm level of the alarm information log reaches a preset alarm threshold, and if yes, the alarm information log is alarmed, and if not, no alarm is performed.

[0043] In a second aspect, the present application further provides a network security event alarm device of a power monitoring system, comprising:

[0044] A log data set acquisition module is configured to acquire a network security event alarm information log data set of the power monitoring system in a current time period;

[0045] A network security event extraction module is configured to extract a corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set;

[0046] An encoding module is configured to encode the network security event set into a symbol sequence arranged in time sequence according to a preset encoding rule, wherein the preset encoding rule encodes one network security event into one unique symbol;

[0047] A symbol interception module is configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol of the corresponding network security event and symbols of a plurality of network security events occurring before;

[0048] A correlation degree calculation module is configured to input the sub-symbol sequence corresponding to each network security event into a trained neural network model to obtain a corresponding correlation degree vector, wherein the neural network model is configured to calculate the correlation degree between the network security event corresponding to the sub-symbol sequence and each network security event occurring before, and form a correlation degree vector output;

[0049] A clustering module is configured to cluster the correlation degree vectors corresponding to all network security events to obtain an alarm type to which each network security event belongs;

[0050] An alarm judgment module is configured to judge whether to perform an alarm on the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs.

[0051] Further, the device further comprises:

[0052] A preprocessing module is configured to perform data preprocessing on the network security event alarm information log data set, wherein the preprocessing includes code filtering, false alarm filtering, invalid alarm data filtering, and data cleaning.

[0053] Further, the encoding module specifically comprises:

[0054] a sorting unit, configured to rearrange the network security events in the network security event set in time sequence to obtain a time-ordered network security event set;

[0055] an encoding unit, configured to encode each network security event in the time-ordered network security event set into a symbol according to a preset encoding rule;

[0056] a symbol sequence generating unit, configured to arrange the symbols of all network security events in time sequence to form a time-ordered symbol sequence.

[0057] Further, the symbol intercepting module specifically comprises:

[0058] a sliding window obtaining unit, configured to obtain a sliding window with a window size of k, k being a positive integer greater than 1;

[0059] a symbol sequence obtaining unit, configured to obtain the symbol sequence E' m ={e'1,...,e' m}, wherein e' i represents the encoded symbol of the i-th network security event, and m represents the number of symbols in the symbol sequence;

[0060] a symbol supplementing unit, configured to supplement the encoded symbols of the first k-1 network security events at the front end of the symbol sequence E' m ={e'1,...,e' m} to generate a supplemented symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, wherein e' 1-k ,e' 2-k represent the encoded symbols of the first k-1 and k-2 network security events of the first network security event;

[0061] a sliding intercepting unit, configured to slide and intercept the supplemented symbol sequence E* m using the sliding window with a step size of 1 to obtain a plurality of sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], wherein [e' i-k ,...,e'i ] represents e' i corresponding sub-symbol sequence.

[0062] Further, the apparatus further comprises a neural network model training module, the neural network model training module comprising:

[0063] a historical data acquisition unit configured to acquire a network security event alarm information log data set of a power monitoring system in history, and extract a corresponding historical network security event from each alarm information log to form a historical network security event set;

[0064] an encoding unit configured to encode the historical network security event set into a historical symbol sequence arranged in time sequence according to a preset encoding rule;

[0065] a truncation unit configured to truncate a plurality of sub-symbol sequences from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence comprises a symbol of the corresponding historical network security event and symbols of a plurality of historical network security events occurring before;

[0066] a correlation calculation unit configured to calculate a correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event occurring before, and form a correlation vector;

[0067] a training unit configured to input the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding correlation vector as a label into a neural network model for training.

[0068] Further, the apparatus further comprises:

[0069] a standardization module configured to standardize the correlation vector according to the following formula:

[0070] V' i = (V i -mean(V i )) / std(V i )

[0071] wherein V i represents the correlation vector corresponding to the i-th network security event, V' i represents the correlation vector after standardization of V i , mean(V i ) represents the mean of all correlation vectors, and std(V i ) represents the standard deviation of all correlation vectors.

[0072] Further, the clustering module specifically comprises:

[0073] A correlation degree vector extraction unit is configured to extract an unprocessed correlation degree vector from all correlation degree vectors corresponding to network security events as a current to-be-processed correlation degree vector p.

[0074] A neighborhood judgment unit is configured to judge the number of correlation degree vectors included in the ε-neighborhood N ε (p) of the current to-be-processed correlation degree vector p ε (V) whether N ε (V) is greater than or equal to MinPts; wherein N ε (p) = {q ∈ D | dist(p, q) ≤ ε}, q represents a correlation degree vector other than p, D represents a set formed by all correlation degree vectors corresponding to network security events, dist(p, q) represents a distance between p and q, ε represents a distance threshold, and MinPts represents a minimum number of points in a cluster;

[0075] A clustering unit is configured to, if N ε (V) is greater than or equal to MinPts, cluster all correlation degree vectors in the ε-neighborhood N ε (p) of the current to-be-processed correlation degree vector p as an alarm cluster.

[0076] A repetition judgment and execution unit is configured to, if N ε (V) is less than MinPts, execute the correlation degree vector extraction unit until all correlation degree vectors are processed.

[0077] An alarm type acquisition unit is configured to acquire an alarm type corresponding to an alarm cluster in which each correlation degree vector is located as an alarm type to which a network security event belongs.

[0078] Further, the alarm judgment module specifically includes:

[0079] An alarm level acquisition unit is configured to acquire an alarm level of each alarm type.

[0080] An alarm marker is configured to mark alarm type and alarm level of an alarm information log corresponding to a network security event according to an alarm type to which the network security event belongs.

[0081] An alarm judgment unit is configured to judge whether an alarm level of the alarm information log reaches a preset alarm threshold, and if yes, alarms the alarm information log, and if not, does not alarm the alarm information log.

[0082] In a third aspect, the present application further provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method in the first aspect.

[0083] In a fourth aspect, the present application also provides a computer readable storage medium, which stores computer programs / instructions, and the computer programs / instructions, when executed by a processor, implement the method of the first aspect.

[0084] In a fifth aspect, the present application also provides a computer program product, which comprises computer programs / instructions, and the computer programs / instructions, when executed by a processor, implement the method of the first aspect.

[0085] Compared with the prior art, the present application has the beneficial effects that: the present application learns the features of the alarm information of the network security event in the power system through the deep learning technology, improves the features that can better reflect the characteristics of the network security event, and enhances the security event discovery capability; the present application performs batch processing and analysis on the alarm information logs, clusters the alarms with the same features, improves the processing efficiency of the alarm data, and realizes automatic alarm of the high-risk type. BRIEF DESCRIPTION OF DRAWINGS

[0086] Figure 1 is a flowchart of the power monitoring system network security event alarm method provided by the embodiment of the present application;

[0087] Figure 2 is a structural diagram of the power monitoring system network security event alarm device provided by the embodiment of the present application;

[0088] Figure 3 is a structural diagram of the computer device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0089] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.

[0090] Embodiment one

[0091] The embodiment of the present application provides a power monitoring system network security event alarm method, as shown in Figure 1 The method comprises the following steps:

[0092] S101, acquiring network security event alarm information log data sets of a power monitoring system in a current time period, and extracting corresponding network security events from each alarm information log to form a network security event set.

[0093] Among them, the network security event alarm information log data set of the power monitoring system can be obtained according to the preset cycle. If the cycle is set short, the logs obtained in the current cycle will be processed and the alarm results obtained will be more timely. However, if the cycle time period is set too short, it may also cause frequent data processing, affect the network speed and occupy equipment space. Therefore, a reasonable cycle should be set to ensure timely feedback of alarms and reasonable equipment use.

[0094] In addition, the network security event alarm information log data set Log of the power monitoring system in the current time period is obtained. n ={log1,...,log n After that, the network security event alarm information log data set can also be preprocessed, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning, and finally the preprocessed data set Log' n ={log'1,...,log' n}, where log n 、log' n Indicates the nth network security event alarm information log before and after preprocessing, where n is the number of alarm information logs.

[0095] Each alarm information log will describe a network security event. Multiple alarm information logs may describe the same network security event or different network security events. By extracting information from the alarm information log, we can obtain the network security event described by each alarm information log. Then, we combine all network security events to form the network security event set F. m ={f1,...,f m}, f m Indicates the mth network security event, where m is the number of network security events and m<=n.

[0096] S102: Encode the network security event set into a symbol sequence arranged in chronological order according to a preset encoding rule.

[0097] The preset encoding rule is an enumerated encoding mapping, that is, each network security event is encoded as a unique symbol. For example, each network security event can be encoded as a unique number, or each network security event can be encoded as a unique letter, or any combination of numbers and letters.

[0098] In specific implementation, this step specifically includes:

[0099] S1021, the network security event set F m ={f1,...,f m} Rearrange in chronological order to obtain the sequential time network security event set F m '={f1',...,f m '};

[0100] S1022, the sequential time network security event set F m '={f1',...,f m Each network security event f in '} i ', according to the preset encoding rules, encoded as a symbol e' i ;

[0101] S1023. Arrange the symbols of all network security events in order to form a symbol sequence E' arranged in chronological order. m ={e'1,...,e' m}.

[0102] S103: Extract several sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence.

[0103] The sub-symbol sequence includes the symbol corresponding to the network security event and the symbols of several network security events that occurred previously, so that the sub-symbol sequence has the above meaning.

[0104] In specific implementation, step S103 includes:

[0105] S1031. Obtain a sliding window with a window size of k, where k is a positive integer greater than 1;

[0106] S1032. Obtain the symbol sequence E' m ={e'1,...,e' m}, where m is the number of symbols in the symbol sequence, i.e., the number of cybersecurity incidents;

[0107] S1033, in the symbol sequence E' m ={e'1,...,e' m}, complement the symbols after the first k-1 security network events are encoded, and generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event;

[0108] S1034, using the sliding window with a step size of 1 to represent the complement symbol sequence E* mSliding interception is performed on the e' to obtain a plurality of sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] represents the corresponding sub-symbol sequence of e' i .

[0109] S104, input the corresponding sub-symbol sequence of each network security event into the trained neural network model to obtain the corresponding relevance vector.

[0110] The neural network model is any one of a deep learning model, a neural network model, etc., such as a Transformer. The neural network model is used to calculate the relevance between the network security event corresponding to the sub-symbol sequence and each network security event that has occurred before, and form a relevance vector output. For example, for the sub-symbol sequence [e' i-k ,...,e' i-1 ,e' i ], after inputting the neural network model, the output is the relevance vector V i =[v i,1 ,...,v i,k-1 ], where v i,k-1 represents the relevance between the network security event f' i corresponding to e' i and the first network security event f' i-1 that has occurred before.

[0111] The training method of the neural network model includes:

[0112] Obtain the network security event alarm information log data set of the power monitoring system in history, and extract the corresponding historical network security event from each alarm information log to form a historical network security event set;

[0113] According to a preset encoding rule, the historical network security event set is encoded into a historical symbol sequence arranged in time sequence;

[0114] A plurality of sub-symbol sequences are intercepted from the symbol sequence, so that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes the symbol of the corresponding historical network security event and the symbols of a plurality of historical network security events that have occurred before;

[0115] correlation degrees between the sub-symbol sequence corresponding to the current network security event and each of the historical network security events, and form a correlation degree vector;

[0116] The sub-symbol sequence corresponding to each of the historical network security events is taken as a sample, and the corresponding correlation degree vector is taken as a label, and then the neural network model is trained.

[0117] In addition, after the sub-symbol sequence corresponding to each of the network security events is input into the trained neural network model to obtain the corresponding correlation degree vector, the correlation degree vector can also be standardized according to the following formula:

[0118] V' i =(V i -mean(V i )) / std(V i )

[0119] In the formula, V i represents the correlation degree vector corresponding to the i-th network security event, V' i represents the correlation degree vector after the standardization of V i , mean(V i ) represents the mean of all correlation degree vectors, and std(V i ) represents the standard deviation of all correlation degree vectors.

[0120] S105, clustering the correlation degree vectors corresponding to all network security events to obtain an alarm type to which each network security event belongs.

[0121] In specific implementation, the step specifically includes:

[0122] S1051, extracting an unprocessed correlation degree vector from the correlation degree vectors corresponding to all network security events as a current to-be-processed correlation degree vector p;

[0123] S1052, for the current to-be-processed correlation degree vector p, judging whether the number N ε (V) of correlation degree vectors included in the ε neighborhood N ε (p) of the current to-be-processed correlation degree vector p satisfies N ε (V)≥MinPts; wherein N ε (p)={q∈D|dist(p,q)≤ε}, q represents other correlation degree vectors except p, D represents a set formed by the correlation degree vectors corresponding to all network security events, dist(p,q) represents the distance between p and q, ε represents a distance threshold, and MinPts represents a minimum number of clusters;

[0124] S1053, if N ε(V)≥MinPts, the current to-be-processed correlation vector p is taken as a core point, and all N ε (p) are clustered into an alarm cluster;

[0125] S1054, if N ε (V)≥MinPts, the next unprocessed correlation vector is extracted until all correlation vectors are processed;

[0126] S1055, the alarm type corresponding to the alarm cluster in which each correlation vector is located is taken as the alarm type to which the network security event belongs. Each alarm cluster is an alarm type.

[0127] S106, according to the alarm type to which the network security event belongs, it is judged whether to perform alarm on the alarm information log corresponding to the network security event.

[0128] In specific implementation, the step specifically includes:

[0129] S1061, the alarm level of each alarm type is obtained. The alarm level of each alarm type can be obtained according to experience, or can be obtained and distinguished through alarm characteristics;

[0130] S1062, according to the alarm type to which the network security event belongs, the alarm information log corresponding to the network security event is marked with the alarm type and the alarm level;

[0131] S1063, it is judged whether the alarm level of the alarm information log reaches a preset alarm threshold. If yes, the alarm information log is alarmed, otherwise, no alarm is performed. The alarm level that is high is fed back to the operation and maintenance personnel for timely processing.

[0132] Embodiment two

[0133] The embodiment provides an alarm device for network security events of a power monitoring system, as shown in the figure, which comprises: Figure 2

[0134] A log data set acquisition module 201 is configured to acquire a network security event alarm information log data set of a power monitoring system in a current time period;

[0135] A network security event extraction module 202 is configured to extract a network security event corresponding to each alarm information log from the network security event alarm information log data set to form a network security event set;

[0136] An encoding module 203 is configured to encode the network security event set into a symbol sequence arranged in time sequence according to a preset encoding rule, wherein the preset encoding rule is that one network security event is encoded into one unique symbol; ​

[0137] a symbol interception module 204, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, so that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes the symbol of the corresponding network security event and the symbols of a plurality of network security events occurring before;

[0138] a correlation calculation module 205, configured to input the sub-symbol sequence corresponding to each network security event into a trained neural network model to obtain a corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the network security event corresponding to the sub-symbol sequence and each network security event occurring before, and form a correlation vector output;

[0139] a clustering module 206, configured to cluster the correlation vectors corresponding to all network security events to obtain an alarm type to which each network security event belongs;

[0140] an alarm judgment module 207, configured to judge whether to perform alarm on the alarm information log corresponding to the network security event according to the alarm type to which the network security event belongs.

[0141] In other embodiments, the apparatus can further include:

[0142] a preprocessing module, configured to perform data preprocessing on the network security event alarm information log dataset, wherein the preprocessing includes junk code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

[0143] In specific implementation, the encoding module 203 specifically includes:

[0144] a sorting unit, configured to rearrange the network security events in the network security event set in time sequence to obtain a time-ordered network security event set;

[0145] an encoding unit, configured to encode each network security event in the time-ordered network security event set into a symbol according to a preset encoding rule;

[0146] a symbol sequence generation unit, configured to arrange the symbols of all network security events in time sequence to form a symbol sequence arranged in time sequence.

[0147] In specific implementation, the symbol interception module 204 specifically includes:

[0148] a sliding window acquisition unit, configured to acquire a sliding window with a window size k, wherein k is a positive integer greater than 1;

[0149] a symbol sequence acquisition unit, configured to acquire the symbol sequence E' m ={e'1,...,e' m}, where e' i represents the symbol after encoding the i-th security network event, and m is the number of symbols in the symbol sequence;

[0150] A symbol supplement unit is used to add a m ={e'1,...,e' m}, complement the symbols after the first k-1 security network events are encoded, and generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m}, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event;

[0151] A sliding interception unit is used to adopt the sliding window in the complementary symbol sequence E* with a step size of 1. m Slide interception is performed within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

[0152] In other embodiments, the apparatus may further include a neural network model training module, wherein the neural network model training module includes:

[0153] A historical data acquisition unit is used to obtain a historical data set of network security event alarm information logs of the power monitoring system, and extract the corresponding historical network security events from each alarm information log to form a historical network security event set;

[0154] An encoding unit, configured to encode the set of historical network security events into a sequence of historical symbols arranged in chronological order according to a preset encoding rule;

[0155] an interception unit, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, such that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously;

[0156] The correlation calculation unit is configured to calculate a correlation between the historical network security event corresponding to the sub-symbol sequence and each historical network security event occurred before, and form a correlation vector.

[0157] The training unit is configured to input the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding correlation vector as a label into the neural network model for training.

[0158] In other embodiments, the apparatus can further include:

[0159] The normalization module is configured to normalize the correlation vector according to the following formula:

[0160] V' i =(V i -mean(V i )) / std(V i )

[0161] In the formula, V i denotes the correlation vector corresponding to the i-th network security event, V' i denotes the correlation vector after normalization of V i , mean(V i ) denotes the mean of all correlation vectors, and std(V i ) denotes the standard deviation of all correlation vectors.

[0162] In a specific implementation, the clustering module 206 specifically includes:

[0163] The correlation vector extraction unit is configured to extract an unprocessed correlation vector from all correlation vectors corresponding to network security events as a current to-be-processed correlation vector p.

[0164] The neighborhood judgment unit is configured to judge, for the current to-be-processed correlation vector p, whether the number N ε (V) of correlation vectors included in the ε neighborhood N ε (p) of the current to-be-processed correlation vector p satisfies N ε (V)≥MinPts; where N ε (p)={q∈D|dist(p,q)≤ε}, q denotes a correlation vector other than p, D denotes a set formed by all correlation vectors corresponding to network security events, dist(p,q) denotes a distance between p and q, ε denotes a distance threshold, and MinPts denotes a minimum number of clusters.

[0165] The clustering unit is configured to, if N ε (V)≥MinPts is satisfied, take the current to-be-processed correlation vector p as a core point and all N εThe relevance vectors in (p) are clustered into an alarm cluster;

[0166] The repeated judgment execution unit is used for executing the relevance vector extraction unit if N ε (V)≥MinPts, and the relevance vector extraction unit is executed until all the relevance vectors are processed.

[0167] The alarm type acquisition unit is used for taking the alarm type corresponding to the alarm cluster where each relevance vector is located as the alarm type to which the network security event belongs.

[0168] In the specific implementation, the alarm judgment module 207 specifically comprises:

[0169] The alarm level acquisition unit is used for acquiring the alarm level of each alarm type.

[0170] The alarm marking is used for marking the alarm information log corresponding to the network security event according to the alarm type and the alarm level to which the network security event belongs.

[0171] The alarm judgment unit is used for judging whether the alarm level of the alarm information log reaches a preset alarm threshold, and if yes, the alarm information log is alarmed, otherwise, the alarm information log is not alarmed.

[0172] The device provided by the embodiment of the application can be used for executing the method provided by the embodiment one of the application, and has the corresponding functions and beneficial effects of the execution method.

[0173] It is worth noting that in the embodiments of the above device, each unit and module included is only divided according to the function logic, but is not limited to the above division, as long as the corresponding function can be realized; in addition, the specific name of each functional unit is only for convenient mutual distinction, and does not limit the protection scope of the application.

[0174] The above-described embodiments are only illustrative, wherein the modules described as separate components can or can not be physically separated, and the components shown as modules can or can not be physical modules, i.e., can be located in one place or distributed on multiple network modules. According to actual needs, part or all of the modules can be selected to achieve the purpose of the embodiment scheme. Those skilled in the art can clearly understand that each embodiment can be realized by means of software and necessary general hardware platform, and of course, can also be realized by hardware only, as long as the function or action can be realized.

[0175] Embodiment three

[0176] Figure 3is a structural schematic diagram of a computer device provided by an embodiment of the present application, and the embodiment provides services for the implementation of the method of the above-mentioned embodiment one of the present application. As shown in the figure, the device can include a memory 301 in which a computer executable program is stored; a processor 302 coupled with the memory 301; and the processor 302 invokes the computer executable program stored in the memory 301 to execute the steps in the method described in embodiment one. Figure 3

[0177] The memory 301 can include a computer system readable medium in the form of volatile memory, such as a random access memory (RAM) and / or cache memory. The device can further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the memory 301 can be used for reading and writing non-removable, non-volatile magnetic media, usually referred to as a "hard disk drive". The program / utility, having a set of (at least one) program modules, can be stored in, for example, the memory 301, which includes an operating system, one or more application programs, other program modules, and program data, each or a combination thereof, can include an implementation of a network environment. The computer executable program of the program modules generally performs the functions and / or methods in the embodiments described in the present application.

[0178] The processor 302 performs various functional applications and data processing by running the program stored in the memory 301, such as implementing the method provided by the embodiment one of the present application.

[0179] The code of the computer executable program can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" language or similar programming languages.

[0180] Embodiment four

[0181] The embodiment of the present application provides a storage medium containing a computer executable program, which is used to execute the method of embodiment one when executed by a computer processor.

[0182] ​The storage medium of the embodiments of the present application can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer-readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device.

[0183] Of course, the storage medium provided by the embodiments of the present application includes computer executable programs, and the computer executable programs are not limited to the method operations described above, but can also perform related operations in the method provided by any embodiment of the present application.

[0184] Embodiment five

[0185] The embodiments of the present application also provide a computer product, such as an app on a mobile phone, a tablet, an installation program on a computer, etc. The product includes computer programs / instructions, which, when executed by a processor, implement the method described in embodiment one. The code of the computer executable program for performing the operations of the present application can be written in one or more programming languages or combinations thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" language or similar programming languages. The program code can be executed entirely on a user computer, partially on a user computer, as an independent software package, partially on a user computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, through the Internet using an Internet service provider).

[0186] It should be noted that, in this document, relational terms such as first and second and the like can only be used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations.

[0187] It should be noted that the above-mentioned embodiments and description of the application are only intended to illustrate the principles of the application and its main features and advantages, and various modifications and improvements can be made to the application without departing from the spirit and scope of the application, and these modifications and improvements shall fall within the scope of the application.

Claims

1. A method for warning network security events in a power monitoring system, characterized in that: include: Obtain a network security event alarm information log data set of the power monitoring system in the current time period, and extract the corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set; According to a preset coding rule, the set of network security events is encoded into a sequence of symbols arranged in chronological order, wherein the preset coding rule is that one network security event is encoded as one unique symbol; Extracting a plurality of sub-symbol sequences from the symbol sequence, such that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously; Inputting the sub-symbol sequence corresponding to each cybersecurity event into a trained neural network model to obtain a corresponding correlation vector, wherein the neural network model is used to calculate the correlation between the cybersecurity event corresponding to the sub-symbol sequence and each previous cybersecurity event, and outputting the correlation vector; Cluster the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs; Determine whether to issue an alert based on the type of alert the network security event corresponds to.

2. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The step of obtaining a network security event alarm information log data set of the power monitoring system further includes the following steps: Data preprocessing is performed on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

3. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The step of encoding the network security event set into a symbol sequence arranged in chronological order according to a preset encoding rule specifically includes: Rearranging each security event in the network security event set in chronological order to obtain a sequential time network security event set; Encoding each network security event in the sequential time network security event set into a symbol according to a preset encoding rule; Arrange the symbols of all network security events in chronological order to form a symbol sequence arranged in chronological order.

4. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The extracting of a plurality of sub-symbol sequences from the symbol sequence such that each network security event corresponds to a sub-symbol sequence specifically includes: Get a sliding window with a window size of k, where k is a positive integer greater than 1; Get the symbol sequence E' m ={e'1,...,e' m }, where e' i represents the symbol after encoding the i-th security network event, and m is the number of symbols in the symbol sequence; In the symbol sequence E' m ={e'1,...,e' m }, complement the symbols after the first k-1 security network events are encoded, and generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m }, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event; The sliding window is used in the complementary symbol sequence E* with a step size of 1. m Slide interception is performed within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

5. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The training method of the neural network model includes: Obtain a historical data set of cybersecurity event alarm information logs from the power monitoring system, and extract the corresponding historical cybersecurity events from each alarm information log to form a historical cybersecurity event set; According to a preset coding rule, the set of historical network security events is encoded into a historical symbol sequence arranged in chronological order; Extracting a plurality of sub-symbol sequences from the symbol sequence, such that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously; Calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each previous historical network security event, and form a correlation vector; The sub-symbol sequence corresponding to each historical cybersecurity event is used as a sample, and the corresponding relevance vector is used as a label, which is input into the neural network model for training.

6. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The sub-symbol sequence corresponding to each network security event is input into the trained neural network model to obtain the corresponding correlation vector, and then further includes: The correlation vector is normalized according to the following formula: V' i =(V i -mean(V i )) / std(V i ) Where V i Represents the correlation vector corresponding to the i-th network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

7. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The clustering of the correlation vectors corresponding to all network security events to obtain the alarm type to which each network security event belongs specifically includes: Extract an unprocessed correlation vector from the correlation vectors corresponding to all network security events as the current correlation vector p to be processed; For the current correlation vector p to be processed, determine its ε neighborhood N ε The number of correlation vectors N included in (p) ε (V) Whether N is satisfied ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, where q represents the correlation vectors other than p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters; If N is satisfied ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster; If N is not satisfied ε (V)≥MinPts, then extract the next unprocessed correlation vector until all correlation vectors are processed; The alarm type corresponding to the alarm cluster where each correlation vector is located is used as the alarm type to which the corresponding network security event belongs.

8. The method for warning network security events in a power monitoring system according to claim 1, characterized in that: The step of determining whether to issue an alarm for the alarm information log corresponding to the network security event based on the alarm type of the network security event specifically includes: Get the alarm level of each alarm type; According to the alarm type of the network security incident, the alarm information log corresponding to the network security incident is marked with the alarm type and alarm level; Determine whether the alarm level of the alarm information log reaches the preset alarm threshold. If so, issue an alarm for the alarm information log; otherwise, do not issue an alarm.

9. A network security event alarm device for an electric power monitoring system, characterized in that: include: The log data set acquisition module is used to obtain the network security event alarm information log data set of the power monitoring system in the current time period; A network security event extraction module is used to extract the corresponding network security event from each alarm information log in the network security event alarm information log data set to form a network security event set; An encoding module, configured to encode the set of network security events into a sequence of symbols arranged in chronological order according to a preset encoding rule, wherein the preset encoding rule is that one network security event is encoded as one unique symbol; a symbol interception module, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, such that each network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the network security event and symbols of a plurality of network security events that occurred previously; a correlation calculation module, configured to input the sub-symbol sequence corresponding to each cybersecurity event into a trained neural network model to obtain a corresponding correlation vector, wherein the neural network model is configured to calculate the correlation between the cybersecurity event corresponding to the sub-symbol sequence and each previously occurring cybersecurity event, and output the correlation vector; The clustering module is used to cluster the correlation vectors corresponding to all network security events and obtain the alarm type to which each network security event belongs; The alarm judgment module is used to determine whether to issue an alarm for the alarm information log corresponding to the network security event based on the alarm type of the network security event.

10. The network security event alarm device for the power monitoring system according to claim 9, characterized in that: The device further comprises: The preprocessing module is used to perform data preprocessing on the network security event alarm information log data set, and the preprocessing includes garbled code filtering, false alarm filtering, invalid alarm data filtering and data cleaning.

11. The network security event alarm device for a power monitoring system according to claim 9, characterized in that: The encoding module specifically includes: a sorting unit, configured to rearrange each security event in the network security event set in chronological order to obtain a sequential time network security event set; an encoding unit, configured to encode each network security event in the sequential time network security event set into a symbol according to a preset encoding rule; The symbol sequence generating unit is used to arrange the symbols of all network security events in chronological order to form a symbol sequence arranged in chronological order.

12. The network security event alarm device for the power monitoring system according to claim 9, characterized in that: The symbol interception module specifically includes: A sliding window acquisition unit, configured to acquire a sliding window of a window size k, where k is a positive integer greater than 1; A symbol sequence acquisition unit, configured to acquire the symbol sequence E' m ={e'1,...,e' m }, where e' i represents the symbol after encoding the i-th security network event, and m is the number of symbols in the symbol sequence; A symbol supplement unit is used to add a m ={e'1,...,e' m }, complement the symbols after the first k-1 security network events are encoded, and generate the complementary symbol sequence E* m ={e' 1-k ,e' 2-k ,...,e'1,...,e' m }, where e' 1-k ,e' 2-k The symbol representing the encoded k-1 and k-2 safety network events before the first safety network event; A sliding interception unit is used to adopt the sliding window in the complementary symbol sequence E* with a step size of 1. m Slide interception is performed within to obtain several sub-symbol sequences [e' 1-k ,...,e'1],[e' 2-k ,...,e'2],...,[e' i-k ,...,e' i ],...,[e' m-k ,...,e' m ], where [e' i-k ,...,e' i ] means e' i The corresponding sub-symbol sequence.

13. The network security event alarm device for a power monitoring system according to claim 9, characterized in that: The device also includes a neural network model training module, and the neural network model training module includes: A historical data acquisition unit is used to obtain a historical data set of network security event alarm information logs of the power monitoring system, and extract the corresponding historical network security events from each alarm information log to form a historical network security event set; An encoding unit, configured to encode the set of historical network security events into a sequence of historical symbols arranged in chronological order according to a preset encoding rule; an interception unit, configured to intercept a plurality of sub-symbol sequences from the symbol sequence, such that each historical network security event corresponds to a sub-symbol sequence, wherein the sub-symbol sequence includes a symbol corresponding to the historical network security event and symbols of a plurality of historical network security events that occurred previously; a correlation calculation unit, configured to calculate the correlation between the historical network security event corresponding to the sub-symbol sequence and each previously occurring historical network security event, and form a correlation vector; The training unit is used to input the sub-symbol sequence corresponding to each historical network security event as a sample and the corresponding relevance vector as a label into the neural network model for training.

14. The network security event alarm device for a power monitoring system according to claim 9, characterized in that: The device further comprises: The normalization module is used to normalize the correlation vector according to the following formula: V' i =(V i -mean(V i )) / std(V i ) Where V i Represents the correlation vector corresponding to the i-th network security event, V' i Indicates V i The normalized correlation vector, mean(V i ) represents the mean of all correlation vectors, std(V i ) represents the standard deviation of all correlation vectors.

15. The network security event alarm device for a power monitoring system according to claim 9, characterized in that: The clustering module specifically includes: A relevance vector extraction unit is used to extract an unprocessed relevance vector from the relevance vectors corresponding to all network security events as a current relevance vector p to be processed; Neighborhood judgment unit, used to judge the ε neighborhood N of the current correlation vector p to be processed ε The number of correlation vectors N included in (p) ε (V) Whether N is satisfied ε (V)≥MinPts; where N ε (p) = {q∈D|dist(p,q)≤ε}, where q represents the correlation vectors other than p, D represents the set of correlation vectors corresponding to all network security events, dist(p,q) is the distance between p and q, ε represents the distance threshold, and MinPts is the minimum number of clusters; Clustering unit is used to satisfy N ε (V)≥MinPts, then the current correlation vector p to be processed is taken as the core point, and all N ε The correlation vectors in (p) are clustered into an alarm cluster; Repeat the judgment execution unit, if N is not satisfied ε (V)≥MinPts, then execute the correlation vector extraction unit until all correlation vectors are processed; The alarm type acquisition unit is configured to use the alarm type corresponding to the alarm cluster where each correlation vector is located as the alarm type to which the corresponding network security event belongs.

16. The network security event alarm device for the power monitoring system according to claim 9, characterized in that: The alarm judgment module specifically includes: An alarm level acquisition unit, used to obtain the alarm level of each alarm type; Alarm marking, which is used to mark the alarm type and alarm level of the alarm information log corresponding to the network security event according to the alarm type of the network security event; The alarm judgment unit is used to judge whether the alarm level of the alarm information log reaches a preset alarm threshold. If so, an alarm is issued for the alarm information log; otherwise, no alarm is issued.

17. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the computer program to implement the method according to any one of claims 1 to 8.

18. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: The computer program / instructions, when executed by a processor, implement the method of any one of claims 1-8.

19. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images