Attack graph construction method, attack graph prevention method and attack graph prevention device for attack of power grid
The method enhances attack graph construction in power grids by dividing the system into sub-networks, calculating Bayesian probabilities, and fusing sub-attack graphs, resulting in a more accurate and detailed representation for preventive measures.
Patent Information
- Application Number
- CN202411460560.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-18
- Publication Date
- 2024-12-27
AI Technical Summary
Existing methods for constructing attack graphs in power grid systems suffer from inaccuracies due to high complexity or limited scalability, leading to insufficient accuracy in preventing cyberattacks.
A method involving feature extraction, community discovery, Bayesian attack probability calculation, and graph fusion to construct a network attack graph by dividing the power grid system into sub-networks, identifying attack paths, and merging Bayesian sub-attack graphs based on associated edges.
Improves the accuracy of attack graph construction by reducing complexity and maintaining detailed attack path correlations, enabling effective prevention strategies.
Smart Images
Figure CN119210882A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of power grid system security analysis, and in particular to an attack graph construction method, prevention method and device for power grid attacks. Background Art
[0002] With the continuous development of information technology in power grid systems, data security of power grid systems has become increasingly important. Cyber attacks on power grid systems will seriously affect the normal operation of power grid systems. Modeling attacks on power grid systems based on data such as past attack events, forming attack graphs, and taking targeted preventive measures based on the attack graphs can effectively improve the data security performance of power grid systems. Therefore, it is necessary to construct an attack graph for the power grid system in order to take preventive actions based on the attack graphs.
[0003] In the prior art, the construction of attack graphs for power grid systems generally includes the following methods: (1) an attack graph generation method based on model detection technology. This method requires modeling of the entire power grid system. The model is relatively complex, and the complexity of the resulting attack graph is also relatively high. Some details of the attack graph may not be taken into account, resulting in a decrease in the accuracy of the attack graph; (2) an attack graph generation method based on graph theory. This method generates a small-scale attack graph that is difficult to adapt to large-scale power grid systems, resulting in insufficient accuracy when analyzing based on the attack graph. Therefore, how to construct a more accurate attack graph for the power grid system to prevent attacks on the power grid system is an urgent problem to be solved in the prior art. Summary of the invention
[0004] The present application provides an attack graph construction method, a prevention method and a device for an electric power grid being attacked, so as to solve the technical problem that the attack graph of the electric power grid system in the prior art is not accurate enough.
[0005] According to a first aspect of an embodiment of the present application, a method for constructing an attack graph of an attack on a power grid is provided, comprising:
[0006] Extracting features from the operation log of the power grid system to obtain network feature data; wherein the network feature data includes a node topology map and an access path set;
[0007] According to the community discovery algorithm, the node topology graph is divided into a plurality of sub-network graphs, and according to the access path set, a plurality of attack paths in the plurality of sub-network graphs are identified to obtain a plurality of attack path sets;
[0008] Based on the historical attack event set and the multiple attack path sets, calculate the Bayesian attack probability between the nodes of the multiple sub-network graphs, and construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability;
[0009] According to a number of associated edges between the multiple sub-network graphs, the multiple Bayesian sub-attack graphs are fused to obtain a network attack graph of the power grid system.
[0010] The present application first extracts features from the operation log of the power grid system to obtain network feature data including a node topology map and an access path set, and then divides the node topology map into multiple sub-network maps according to a community discovery algorithm, which can divide the complex power grid system topology into multiple simple sub-network maps, and then obtains multiple attack path sets based on the access path set identification, which can limit the obtained attack path sets to the corresponding sub-network maps, thereby reducing the complexity increase caused by the paths crossing the sub-network maps; then, based on the historical attack event set and the multiple attack path sets, the Bayesian attack probability between the nodes of the multiple sub-network maps is calculated, and then multiple Bayesian sub-attack graphs are constructed, and the attack probability calculation through the Bayesian method is more accurate, thereby making the obtained Bayesian sub-attack graph more accurate; then, based on a number of associated edges between the multiple sub-network graphs, multiple Bayesian sub-attack graphs are fused to obtain a network attack graph, ensuring that the attack path within each sub-network graph can be connected to the attack path of other sub-network graphs according to the associated edges, and multiple sub-network graphs can be re-associated to improve the correlation of the attack paths of each sub-network graph, thereby improving the accuracy of the constructed network attack graph.
[0011] In certain embodiments of the present application, the node topology graph is divided into a plurality of sub-network graphs according to the community discovery algorithm, specifically including:
[0012] A single node in the node topology graph is regarded as a community to obtain multiple initial communities, and the multiple initial communities are iterated according to the node topology graph. During the iteration, the multiple initial communities are merged according to the community merging gain of each initial community with the adjacent initial communities to obtain multiple updated communities, until the community merging gain of each updated community does not exceed a preset threshold, and the multiple updated communities obtained by the final iteration are output;
[0013] According to the multiple updated communities obtained in the last iteration, the node topology graph is divided to obtain multiple sub-network graphs.
[0014] The present application first constructs multiple initial communities according to each node of the node topology map, and iterates the multiple initial communities. During the iteration, the multiple initial communities are merged according to the calculated community merging gain to obtain multiple updated communities, and the node topology map is divided according to the multiple updated communities obtained in the last iteration to obtain multiple sub-network graphs. Compared with the prior art, the complex power grid system topology is divided into multiple simple sub-network graphs through a community discovery algorithm, which can reduce the construction complexity of the system attack graph to the construction of the attack graph of each sub-network graph, and the construction of the attack graph in each simple sub-network graph is more accurate than the construction of the attack graph in the complex overall power grid system, and it is less likely to lose the details of the attack graph, thereby improving the accuracy of the network attack graph finally constructed.
[0015] In certain embodiments of the present application, identifying a plurality of attack paths in the plurality of subnetwork graphs according to the access path set to obtain a plurality of attack path sets specifically includes:
[0016] The data categories of the access path set include source node address, target node address and access type;
[0017] Selecting one sub-network graph in turn as the current sub-network graph, and determining the attack path set corresponding to the current sub-network graph according to the access path set based on a preset path matching identification method, until the corresponding attack path sets are obtained for all the sub-network graphs;
[0018] Among them, the path matching and identification method includes: matching the access path set according to each node of the current sub-network graph to obtain multiple access paths, and combining the multiple access paths into an attack path set corresponding to the current sub-network graph; the access path satisfies that the nodes corresponding to the source node address and the target node address are all in the current sub-network graph.
[0019] The present application determines the attack path set corresponding to each sub-network graph according to the access path set and based on the path matching identification method, determines the selectable attack path of the current sub-network graph through the historical access path, excludes some unselected or unselectable paths, and can make the attack path set more adaptable to real attack events, thereby improving the accuracy of the network attack graph finally constructed; at the same time, the obtained attack path set can be limited to the corresponding sub-network graph, reducing the increased complexity caused by the path crossing the sub-network graph.
[0020] In certain embodiments of the present application, the calculation of the Bayesian attack probability between the nodes of the multiple sub-network graphs based on the historical attack event set and the multiple attack path sets, and the construction of multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability specifically includes:
[0021] Determining weighted frequencies of a plurality of edges of each of the plurality of subnetwork graphs according to the historical attack event set and the plurality of attack path sets;
[0022] Calculating the Bayesian attack probability between nodes of the plurality of sub-network graphs according to the weighted frequencies of the respective plurality of edges in the plurality of sub-network graphs;
[0023] According to the Bayesian attack probability, a plurality of Bayesian sub-attack graphs corresponding to the plurality of sub-network graphs are constructed.
[0024] The present application first determines the weighted frequencies of several edges of multiple sub-network graphs according to the historical attack event set and multiple attack path sets, thereby calculating the Bayesian attack frequencies between the nodes of the multiple sub-network graphs, and then constructs multiple corresponding Bayesian sub-attack graphs. The weighted frequencies of the edges are determined by the historical attack event set and multiple attack path sets, which can amplify the probability of potential attacks caused by historical attack events and selectable attack paths, so that the constructed Bayesian sub-attack graph can better reflect the attack path corresponding to the actual potential attack, thereby improving the accuracy of the network attack graph finally constructed.
[0025] In certain embodiments of the present application, the step of fusing the multiple Bayesian sub-attack graphs to obtain the network attack graph of the power grid system according to the plurality of associated edges between the multiple sub-network graphs specifically includes:
[0026] According to the node topology graph, obtain a plurality of associated edges between the plurality of sub-network graphs;
[0027] For each sub-network graph, according to the several associated edges, the first associated edges between the current sub-network graph and the corresponding adjacent sub-network graphs are selected, and according to the first associated edges, the Bayesian sub-attack graph corresponding to the current sub-network graph and the Bayesian sub-attack graphs corresponding to the corresponding adjacent sub-network graphs are fused to obtain the network attack graph of the power grid system; wherein the first associated edge is the associated edge with the largest weight among all the associated edges between the current sub-network graph and the corresponding adjacent sub-network graphs.
[0028] The present application first obtains several associated edges between multiple sub-network graphs according to the node topology graph, and then fuses multiple Bayesian sub-attack graphs according to the several associated edges to obtain a network attack graph, which can ensure that the attack path within each sub-network graph can be connected with the attack path of other sub-network graphs according to the associated edges, and can re-associate multiple sub-network graphs to prevent the distortion of the network attack graph caused by the distortion of the association between the sub-network graphs, thereby improving the accuracy of the constructed network attack graph.
[0029] According to a second aspect of the embodiments of the present application, a method for preventing a power grid from being attacked is provided, comprising:
[0030] Obtaining a network attack graph of a power grid system; wherein the network attack graph is constructed by a method for constructing an attack graph of a power grid under attack described in the present application;
[0031] Based on a preset probability threshold, the network attack graph is screened to obtain multiple predicted attack paths;
[0032] According to the node information and attack means of each of the plurality of predicted attack paths, a corresponding plurality of prevention strategies are generated, and prevention is performed according to the plurality of prevention strategies.
[0033] This application first obtains a network attack graph and obtains multiple predicted attack paths based on the network attack graph, and then generates multiple corresponding prevention strategies based on the node information and attack methods of the multiple predicted attack paths and performs prevention, which can more accurately prevent attacks and prevent them in time when the attacks arrive.
[0034] According to a third aspect of the implementation of the present application, there is provided an attack graph construction device for a power grid under attack, comprising a feature extraction module, a partition identification module, a sub-attack graph construction module and an attack graph construction module;
[0035] The feature extraction module is used to extract features from the operation log of the power grid system to obtain network feature data; wherein the network feature data includes a node topology map and an access path set;
[0036] The partition identification module is used to divide the node topology graph into multiple sub-network graphs according to the community discovery algorithm, and identify a plurality of attack paths in the multiple sub-network graphs according to the access path set to obtain multiple attack path sets;
[0037] The sub-attack graph construction module is used to calculate the Bayesian attack probability between the nodes of the multiple sub-network graphs based on the historical attack event set and the multiple attack path sets, and construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability;
[0038] The attack graph construction module is used to fuse the multiple Bayesian sub-attack graphs according to a number of associated edges between the multiple sub-network graphs to obtain the network attack graph of the power grid system.
[0039] In certain embodiments of the present application, the partition identification module includes a topology partition submodule; the topology partition submodule includes a community iteration unit and a topology partition unit;
[0040] The community iteration unit is used to regard a single node in the node topology map as a community to obtain multiple initial communities, and iterate the multiple initial communities according to the node topology map, merge the multiple initial communities according to the community merging gain of each initial community with the adjacent initial communities to obtain multiple updated communities, until the community merging gain of each updated community does not exceed a preset threshold, and output the multiple updated communities obtained by the final iteration;
[0041] The topology division unit is used to divide the node topology graph according to the multiple updated communities obtained in the last iteration to obtain multiple sub-network graphs.
[0042] In certain embodiments of the present application, the partition identification module includes a path identification submodule; the data category of the access path set includes a source node address, a target node address, and an access type;
[0043] The path identification submodule is used to select one subnetwork graph as the current subnetwork graph in turn, and determine the attack path set corresponding to the current subnetwork graph according to the access path set based on a preset path matching identification method, until the corresponding attack path sets are obtained for all the subnetwork graphs;
[0044] Among them, the path matching and identification method includes: matching the access path set according to each node of the current sub-network graph to obtain multiple access paths, and combining the multiple access paths into an attack path set corresponding to the current sub-network graph; the access path satisfies that the nodes corresponding to the source node address and the target node address are all in the current sub-network graph.
[0045] In certain embodiments of the present application, the sub-attack graph construction module includes a weighted frequency determination sub-module, an attack probability calculation sub-module, and a sub-attack graph construction sub-module;
[0046] The weighted frequency determination submodule is used to determine the weighted frequencies of a plurality of edges of each of the plurality of subnetwork graphs according to the historical attack event set and the plurality of attack path sets;
[0047] The attack probability calculation submodule is used to calculate the Bayesian attack probability between the nodes of the multiple subnetwork graphs according to the weighted frequencies of the respective edges in the multiple subnetwork graphs;
[0048] The sub-attack graph construction submodule is used to construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability.
[0049] In certain embodiments of the present application, the attack graph construction module includes an associated edge acquisition submodule and an attack graph construction submodule;
[0050] The associated edge acquisition submodule is used to acquire a plurality of associated edges between the plurality of sub-network graphs according to the node topology graph;
[0051] The attack graph construction submodule is used to select, for each subnetwork graph, the first associated edges between the current subnetwork graph and the corresponding adjacent subnetwork graphs according to the several associated edges, and to fuse the Bayesian sub-attack graph corresponding to the current subnetwork graph and the Bayesian sub-attack graphs corresponding to the corresponding adjacent subnetwork graphs according to the first associated edges, so as to obtain the network attack graph of the power grid system; wherein the first associated edge is the associated edge with the largest weight among all associated edges between the current subnetwork graph and the corresponding adjacent subnetwork graphs.
[0052] The present application first extracts features from the operation log of the power grid system to obtain network feature data including a node topology map and an access path set, and then divides the node topology map into multiple sub-network maps according to a community discovery algorithm, which can divide the complex power grid system topology into multiple simple sub-network maps, and then obtains multiple attack path sets based on the access path set identification, which can limit the obtained attack path sets to the corresponding sub-network maps, thereby reducing the complexity increase caused by the paths crossing the sub-network maps; then, based on the historical attack event set and the multiple attack path sets, the Bayesian attack probability between the nodes of the multiple sub-network maps is calculated, and then multiple Bayesian sub-attack graphs are constructed, and the attack probability calculation through the Bayesian method is more accurate, thereby making the obtained Bayesian sub-attack graph more accurate; then, based on a number of associated edges between the multiple sub-network graphs, multiple Bayesian sub-attack graphs are fused to obtain a network attack graph, ensuring that the attack path within each sub-network graph can be connected to the attack path of other sub-network graphs according to the associated edges, and multiple sub-network graphs can be re-associated to improve the correlation of the attack paths of each sub-network graph, thereby improving the accuracy of the constructed network attack graph.
[0053] According to a fourth aspect of the implementation manner of the present application, there is provided a device for preventing a power grid from being attacked, comprising an attack graph acquisition module, an attack path screening module and an attack prevention module;
[0054] The attack graph acquisition module is used to acquire a network attack graph of the power grid system; wherein the network attack graph is constructed by an attack graph construction device for a power grid under attack as described in the present application;
[0055] The attack path screening module is used to screen the network attack graph based on a preset probability threshold to obtain multiple predicted attack paths;
[0056] The attack prevention module is used to generate corresponding multiple prevention strategies according to the node information and attack means of each of the multiple predicted attack paths, and perform prevention according to the multiple prevention strategies.
[0057] This application first obtains a network attack graph and obtains multiple predicted attack paths based on the network attack graph, and then generates multiple corresponding prevention strategies based on the node information and attack methods of the multiple predicted attack paths and performs prevention, which can more accurately prevent attacks and prevent them in time when the attacks arrive. BRIEF DESCRIPTION OF THE DRAWINGS
[0058] Figure 1 : A schematic diagram of a flow chart of a method for constructing an attack graph of an electric power grid under attack, shown in certain embodiments of the present application;
[0059] Figure 2 : A flowchart of a method for preventing a power grid from being attacked according to certain embodiments of the present application;
[0060] Figure 3 : A module structure diagram of an attack graph construction device for a power grid under attack shown in certain embodiments of the present application;
[0061] Figure 4 : A module structure diagram of a device for preventing power grid attacks shown in certain embodiments of the present application. DETAILED DESCRIPTION
[0062] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals represent the same or similar elements or elements having the same or similar functions from beginning to end. The embodiments described below in conjunction with the accompanying drawings are exemplary and are only used to explain some embodiments of the present application, and should not be construed as limitations on the embodiments of the present application. Based on the embodiments shown in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.
[0063] In the description of this application, it should be understood that the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, unless otherwise clearly and specifically defined, "multiple" and "several" mean two or more.
[0064] In the prior art, when constructing an attack graph for a power grid system, there are usually two methods for generating attack graphs based on model detection technology and graph theory. The former requires modeling of the entire power grid system. The complexity of the model leads to a high complexity of the attack graph, and some details of the attack graph are missing, resulting in insufficient accuracy of the attack graph. The latter generates an attack graph with a small scale and is difficult to adapt to large power grid systems, resulting in insufficient accuracy of analysis based on the attack graph when applied to large power grid systems. Therefore, how to construct a more accurate attack graph for a power grid system to prevent attacks on the power grid system is an urgent problem to be solved in the prior art.
[0065] Based on the above technical background, please refer to Figure 1 The embodiment of the present application provides a method for constructing an attack graph of an attack on a power grid, including steps S101 to S104, each of which is as follows:
[0066] Step S101: extracting features from the operation log of the power grid system to obtain network feature data; wherein the network feature data includes a node topology map and an access path set.
[0067] In certain embodiments of the present application, extracting features from the operation log of the power grid system to obtain network feature data includes:
[0068] Obtaining an initial operation log of the power grid system; the initial operation log includes network traffic data, system log, security device log, and user behavior data;
[0069] The initial operation log is deduplicated and denulled to obtain an operation log.
[0070] In certain embodiments of the present application, the null value is specifically:
[0071] If the data value of the current column of the current processing row of the initial operation log is a numeric type, the mean value is used to fill in the empty values;
[0072] If the data value of the current column of the current processing row of the initial operation log is a string type, deleting the current processing row;
[0073] If the data value of the current column of the current processing row of the initial operation log is of date type, the data value is formatted as a date.
[0074] Step S102: According to the community discovery algorithm, the node topology graph is divided into multiple sub-network graphs, and according to the access path set, a plurality of attack paths in the multiple sub-network graphs are identified to obtain multiple attack path sets.
[0075] In certain embodiments of the present application, the node topology graph is divided into a plurality of sub-network graphs according to the community discovery algorithm, specifically including:
[0076] A single node in the node topology graph is regarded as a community to obtain multiple initial communities, and the multiple initial communities are iterated according to the node topology graph. During the iteration, the multiple initial communities are merged according to the community merging gain of each initial community with the adjacent initial communities to obtain multiple updated communities, until the community merging gain of each updated community does not exceed a preset threshold, and the multiple updated communities obtained by the final iteration are output;
[0077] According to the multiple updated communities obtained in the last iteration, the node topology graph is divided to obtain multiple sub-network graphs.
[0078] In certain embodiments of the present application, implementation schemes of the community discovery algorithm include but are not limited to the Louvain algorithm, the KL algorithm, the label propagation algorithm and the greedy modularity algorithm, and the preferred implementation scheme is the Louvain algorithm.
[0079] Specifically, in the first iteration, the node topology graph {v1, v2, ..., v i , ..., v n} as the initial community, and calculate the current initial community v i The community merging gain with the adjacent initial communities {Q1, Q2, ..., Q i , ..., Q n}, and set the current initial community v i The adjacent initial communities corresponding to the maximum community merging gain are merged; after the initial iteration is completed, the multiple updated communities generated after the iteration are used as the initial communities of the next iteration and iterated until the community merging gain of each updated community does not exceed the preset threshold;
[0080] The community merger gain is specifically:
[0081]
[0082] Among them, ∑ in ,∑ tot is the sum of the weights of the internal edges of the current community and the weights of the edges connected to the nodes inside the current community, k i , k i，in is the sum of the weights of the edges connected to node i in the current community and the sum of the weights of the edges from node i to other nodes in the current community, and m is the sum of the weights of all edges in the node topology graph.
[0083] In certain embodiments of the present application, the preset threshold is preferably 0.
[0084] The present application first constructs multiple initial communities according to each node of the node topology map, and iterates the multiple initial communities. During the iteration, the multiple initial communities are merged according to the calculated community merging gain to obtain multiple updated communities, and the node topology map is divided according to the multiple updated communities obtained in the last iteration to obtain multiple sub-network graphs. Compared with the prior art, the complex power grid system topology is divided into multiple simple sub-network graphs through a community discovery algorithm, which can reduce the construction complexity of the system attack graph to the construction of the attack graph of each sub-network graph, and the construction of the attack graph in each simple sub-network graph is more accurate than the construction of the attack graph in the complex overall power grid system, and it is less likely to lose the details of the attack graph, thereby improving the accuracy of the network attack graph finally constructed.
[0085] In certain embodiments of the present application, identifying a plurality of attack paths in the plurality of subnetwork graphs according to the access path set to obtain a plurality of attack path sets specifically includes:
[0086] The data categories of the access path set include source node address, target node address and access type;
[0087] Selecting one sub-network graph in turn as the current sub-network graph, and determining the attack path set corresponding to the current sub-network graph according to the access path set based on a preset path matching identification method, until the corresponding attack path sets are obtained for all the sub-network graphs;
[0088] Among them, the path matching and identification method includes: matching the access path set according to each node of the current sub-network graph to obtain multiple access paths, and combining the multiple access paths into an attack path set corresponding to the current sub-network graph; the access path satisfies that the nodes corresponding to the source node address and the target node address are all in the current sub-network graph.
[0089] The present application determines the attack path set corresponding to each sub-network graph according to the access path set and based on the path matching identification method, determines the selectable attack path of the current sub-network graph through the historical access path, excludes some unselected or unselectable paths, and can make the attack path set more adaptable to real attack events, thereby improving the accuracy of the network attack graph finally constructed; at the same time, the obtained attack path set can be limited to the corresponding sub-network graph, reducing the increased complexity caused by the path crossing the sub-network graph.
[0090] Step S103: Based on the historical attack event set and the multiple attack path sets, calculate the Bayesian attack probability between the nodes of the multiple sub-network graphs, and construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability.
[0091] In certain embodiments of the present application, the calculation of the Bayesian attack probability between the nodes of the multiple sub-network graphs based on the historical attack event set and the multiple attack path sets, and the construction of multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability specifically includes:
[0092] Determining weighted frequencies of a plurality of edges of each of the plurality of subnetwork graphs according to the historical attack event set and the plurality of attack path sets;
[0093] Calculating the Bayesian attack probability between nodes of the plurality of sub-network graphs according to the weighted frequencies of the respective plurality of edges in the plurality of sub-network graphs;
[0094] According to the Bayesian attack probability, a plurality of Bayesian sub-attack graphs corresponding to the plurality of sub-network graphs are constructed.
[0095] In certain embodiments of the present application, the weighted frequencies of the edges of the plurality of subnetwork graphs are determined according to the historical attack event set and the plurality of attack path sets, specifically:
[0096] If the corresponding access type of the current edge is non-aggressive access, the corresponding weighted frequency is 1;
[0097] If the corresponding access type of the current edge is attack access, the corresponding weighted frequency is 10.
[0098] In certain embodiments of the present application, the calculating of the Bayesian attack probability between the nodes of the plurality of sub-network graphs according to the weighted frequencies of the plurality of edges in the plurality of sub-network graphs specifically includes:
[0099] The Bayesian attack probability between the nodes is specifically:
[0100]
[0101] Among them, P(A i |B) represents the Bayesian attack probability of the current node being attacked, represents the attack probability of the i-th adjacent node of the current node on the current node, n is the number of nodes in the current sub-network graph, w i is the weighted frequency of the i-th adjacent node of the current node to the current node.
[0102] The present application first determines the weighted frequencies of several edges of multiple sub-network graphs according to the historical attack event set and multiple attack path sets, thereby calculating the Bayesian attack frequencies between the nodes of the multiple sub-network graphs, and then constructs multiple corresponding Bayesian sub-attack graphs. The weighted frequencies of the edges are determined by the historical attack event set and multiple attack path sets, which can amplify the probability of potential attacks caused by historical attack events and selectable attack paths, so that the constructed Bayesian sub-attack graph can better reflect the attack path corresponding to the actual potential attack, thereby improving the accuracy of the network attack graph finally constructed.
[0103] Step S104: According to a number of associated edges between the multiple sub-network graphs, the multiple Bayesian sub-attack graphs are merged to obtain a network attack graph of the power grid system.
[0104] In certain embodiments of the present application, the step of fusing the multiple Bayesian sub-attack graphs to obtain the network attack graph of the power grid system according to the plurality of associated edges between the multiple sub-network graphs specifically includes:
[0105] According to the node topology graph, obtain a plurality of associated edges between the plurality of sub-network graphs;
[0106] For each sub-network graph, according to the several associated edges, the first associated edges between the current sub-network graph and the corresponding adjacent sub-network graphs are selected, and according to the first associated edges, the Bayesian sub-attack graph corresponding to the current sub-network graph and the Bayesian sub-attack graphs corresponding to the corresponding adjacent sub-network graphs are fused to obtain the network attack graph of the power grid system; wherein the first associated edge is the associated edge with the largest weight among all the associated edges between the current sub-network graph and the corresponding adjacent sub-network graphs.
[0107] The present application first obtains several associated edges between multiple sub-network graphs according to the node topology graph, and then fuses multiple Bayesian sub-attack graphs according to the several associated edges to obtain a network attack graph, which can ensure that the attack path within each sub-network graph can be connected with the attack path of other sub-network graphs according to the associated edges, and can re-associate multiple sub-network graphs to prevent the distortion of the network attack graph caused by the distortion of the association between the sub-network graphs, thereby improving the accuracy of the constructed network attack graph.
[0108] Compared with the prior art, the present application first extracts features from the operation log of the power grid system to obtain network feature data including a node topology map and an access path set, and then divides the node topology map into multiple sub-network maps according to the community discovery algorithm, which can divide the complex power grid system topology into multiple simple sub-network maps, and then obtains multiple attack path sets based on the access path set identification, which can limit the obtained attack path sets to the corresponding sub-network maps, reducing the complexity caused by the paths crossing the sub-network maps; then, based on the historical attack event set and the multiple attack path sets, the Bayesian attack probability between the nodes of the multiple sub-network maps is calculated, and then multiple Bayesian sub-attack graphs are constructed, and the attack probability calculation by the Bayesian method is more accurate, so that the obtained Bayesian sub-attack graph is more accurate; then, based on a number of associated edges between the multiple sub-network graphs, multiple Bayesian sub-attack graphs are fused to obtain a network attack graph, ensuring that the attack paths within each sub-network graph can be connected with the attack paths of other sub-network graphs according to the associated edges, and multiple sub-network graphs can be re-associated to improve the correlation of the attack paths of each sub-network graph, thereby improving the accuracy of the constructed network attack graph.
[0109] Based on the attack graph construction method for a power grid under attack provided in this application, this application also provides a method for preventing a power grid from being attacked, see Figure 2 , including steps S201 to S203, which are specifically as follows:
[0110] Step S201: Obtain a network attack graph of a power grid system; wherein the network attack graph is constructed by a method for constructing an attack graph of a power grid under attack as described in the present application.
[0111] Step S202: Based on a preset probability threshold, the network attack graph is screened to obtain multiple predicted attack paths.
[0112] Step S203: Generate a plurality of corresponding prevention strategies according to the node information and attack means of each of the plurality of predicted attack paths, and perform prevention according to the plurality of prevention strategies.
[0113] This application first obtains a network attack graph and obtains multiple predicted attack paths based on the network attack graph, and then generates multiple corresponding prevention strategies based on the node information and attack methods of the multiple predicted attack paths and performs prevention, which can more accurately prevent attacks and prevent them in time when the attacks arrive.
[0114] Corresponding to the previous method, see Figure 3 , the embodiment of the present application provides an attack graph construction device for a power grid under attack, including a feature extraction module 310, a partition identification module 320, a sub-attack graph construction module 330 and an attack graph construction module 340;
[0115] The feature extraction module 310 is used to extract features from the operation log of the power grid system to obtain network feature data; wherein the network feature data includes a node topology map and an access path set;
[0116] The partition identification module 320 is used to divide the node topology graph into multiple sub-network graphs according to the community discovery algorithm, and identify a plurality of attack paths in the multiple sub-network graphs according to the access path set to obtain multiple attack path sets;
[0117] The sub-attack graph construction module 330 is used to calculate the Bayesian attack probability between the nodes of the multiple sub-network graphs based on the historical attack event set and the multiple attack path sets, and construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability;
[0118] The attack graph construction module 340 is used to fuse the multiple Bayesian sub-attack graphs according to a number of associated edges between the multiple sub-network graphs to obtain a network attack graph for the power grid system.
[0119] In certain embodiments of the present application, the partition identification module includes a topology partition submodule; the topology partition submodule includes a community iteration unit and a topology partition unit;
[0120] The community iteration unit is used to regard a single node in the node topology map as a community to obtain multiple initial communities, and iterate the multiple initial communities according to the node topology map, merge the multiple initial communities according to the community merging gain of each initial community with the adjacent initial communities to obtain multiple updated communities, until the community merging gain of each updated community does not exceed a preset threshold, and output the multiple updated communities obtained by the final iteration;
[0121] The topology division unit is used to divide the node topology graph according to the multiple updated communities obtained in the last iteration to obtain multiple sub-network graphs.
[0122] In certain embodiments of the present application, the partition identification module includes a path identification submodule; the data category of the access path set includes a source node address, a target node address, and an access type;
[0123] The path identification submodule is used to select one subnetwork graph as the current subnetwork graph in turn, and determine the attack path set corresponding to the current subnetwork graph according to the access path set based on a preset path matching identification method, until the corresponding attack path sets are obtained for all the subnetwork graphs;
[0124] Among them, the path matching and identification method includes: matching the access path set according to each node of the current sub-network graph to obtain multiple access paths, and combining the multiple access paths into an attack path set corresponding to the current sub-network graph; the access path satisfies that the nodes corresponding to the source node address and the target node address are all in the current sub-network graph.
[0125] In certain embodiments of the present application, the sub-attack graph construction module includes a weighted frequency determination sub-module, an attack probability calculation sub-module, and a sub-attack graph construction sub-module;
[0126] The weighted frequency determination submodule is used to determine the weighted frequencies of a plurality of edges of each of the plurality of subnetwork graphs according to the historical attack event set and the plurality of attack path sets;
[0127] The attack probability calculation submodule is used to calculate the Bayesian attack probability between the nodes of the multiple subnetwork graphs according to the weighted frequencies of the respective edges in the multiple subnetwork graphs;
[0128] The sub-attack graph construction submodule is used to construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability.
[0129] In certain embodiments of the present application, the attack graph construction module includes an associated edge acquisition submodule and an attack graph construction submodule;
[0130] The associated edge acquisition submodule is used to acquire a plurality of associated edges between the plurality of sub-network graphs according to the node topology graph;
[0131] The attack graph construction submodule is used to select, for each subnetwork graph, the first associated edges between the current subnetwork graph and the corresponding adjacent subnetwork graphs according to the several associated edges, and to fuse the Bayesian sub-attack graph corresponding to the current subnetwork graph and the Bayesian sub-attack graphs corresponding to the corresponding adjacent subnetwork graphs according to the first associated edges, so as to obtain the network attack graph of the power grid system; wherein the first associated edge is the associated edge with the largest weight among all associated edges between the current subnetwork graph and the corresponding adjacent subnetwork graphs.
[0132] The present application first extracts features from the operation log of the power grid system to obtain network feature data including a node topology map and an access path set, and then divides the node topology map into multiple sub-network maps according to a community discovery algorithm, which can divide the complex power grid system topology into multiple simple sub-network maps, and then obtains multiple attack path sets based on the access path set identification, which can limit the obtained attack path sets to the corresponding sub-network maps, thereby reducing the complexity increase caused by the paths crossing the sub-network maps; then, based on the historical attack event set and the multiple attack path sets, the Bayesian attack probability between the nodes of the multiple sub-network maps is calculated, and then multiple Bayesian sub-attack graphs are constructed, and the attack probability calculation through the Bayesian method is more accurate, thereby making the obtained Bayesian sub-attack graph more accurate; then, based on a number of associated edges between the multiple sub-network graphs, multiple Bayesian sub-attack graphs are fused to obtain a network attack graph, ensuring that the attack path within each sub-network graph can be connected to the attack path of other sub-network graphs according to the associated edges, and multiple sub-network graphs can be re-associated to improve the correlation of the attack paths of each sub-network graph, thereby improving the accuracy of the constructed network attack graph.
[0133] Based on the attack graph construction device for a power grid under attack provided by the present application, the present application also provides a prevention device for a power grid under attack, see Figure 4 , including an attack graph acquisition module 410, an attack path screening module 420 and an attack prevention module 430;
[0134] The attack graph acquisition module 410 is used to acquire a network attack graph of the power grid system; wherein the network attack graph is constructed by an attack graph construction device for a power grid under attack as described in the present application;
[0135] The attack path screening module 420 is used to screen the network attack graph based on a preset probability threshold to obtain multiple predicted attack paths;
[0136] The attack prevention module 430 is used to generate corresponding multiple prevention strategies according to the node information and attack means of each of the multiple predicted attack paths, and perform prevention according to the multiple prevention strategies.
[0137] This application first obtains a network attack graph and obtains multiple predicted attack paths based on the network attack graph, and then generates multiple corresponding prevention strategies based on the node information and attack methods of the multiple predicted attack paths and performs prevention, which can more accurately prevent attacks and prevent them in time when the attacks arrive.
[0138] It should be understood that the device provided in the embodiment of the present application corresponds to the aforementioned method. The attack graph construction device for a power grid under attack provided in the embodiment of the present application can implement the attack graph construction method for a power grid under attack provided in any embodiment of the present application; the prevention device for a power grid under attack provided in the embodiment of the present application can implement the prevention method for a power grid under attack provided in any embodiment of the present application.
[0139] Adaptively, the embodiments of the present application also provide a computer device and a computer-readable storage medium.
[0140] The computer device comprises: a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor;
[0141] Wherein, when the processor executes the computer program, a method for constructing an attack graph of an electric power grid under attack or a method for preventing an electric power grid from under attack of the present application is implemented.
[0142] The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute an attack graph construction method for a power grid being attacked or a prevention method for a power grid being attacked of the present application.
[0143] The above are some implementation methods of the present application, and the purpose, technical scheme and beneficial effects of the present application are further described in detail. It should be clear that the above-mentioned partial implementation methods of the present application cannot be understood as limiting the present application. It is particularly pointed out that for those skilled in the art, any changes, modifications, equivalent substitutions and variations made within the spirit and principles of the present application should be included in the protection scope of the present application.
Claims
1. A method for constructing an attack graph of a power grid under attack, characterized in that: include: Extracting features from the operation log of the power grid system to obtain network feature data; wherein the network feature data includes a node topology map and an access path set; According to the community discovery algorithm, the node topology graph is divided into a plurality of sub-network graphs, and according to the access path set, a plurality of attack paths in the plurality of sub-network graphs are identified to obtain a plurality of attack path sets; Based on the historical attack event set and the multiple attack path sets, calculate the Bayesian attack probability between the nodes of the multiple sub-network graphs, and construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability; According to a number of associated edges between the multiple sub-network graphs, the multiple Bayesian sub-attack graphs are fused to obtain a network attack graph of the power grid system.
2. The method for constructing an attack graph of a power grid under attack according to claim 1, characterized in that: The node topology graph is divided into a plurality of sub-network graphs according to the community discovery algorithm, specifically including: A single node in the node topology graph is regarded as a community to obtain multiple initial communities, and the multiple initial communities are iterated according to the node topology graph. During the iteration, the multiple initial communities are merged according to the community merging gain of each initial community with the adjacent initial communities to obtain multiple updated communities, until the community merging gain of each updated community does not exceed a preset threshold, and the multiple updated communities obtained by the final iteration are output; According to the multiple updated communities obtained in the last iteration, the node topology graph is divided to obtain multiple sub-network graphs.
3. The method for constructing an attack graph of a power grid under attack according to claim 1, characterized in that: The step of identifying a plurality of attack paths in the plurality of subnetwork graphs according to the access path set to obtain a plurality of attack path sets specifically includes: The data categories of the access path set include source node address, target node address and access type; Selecting one sub-network graph in turn as the current sub-network graph, and determining the attack path set corresponding to the current sub-network graph according to the access path set based on a preset path matching identification method, until the corresponding attack path sets are obtained for all the sub-network graphs; Among them, the path matching and identification method includes: matching the access path set according to each node of the current sub-network graph to obtain multiple access paths, and combining the multiple access paths into an attack path set corresponding to the current sub-network graph; the access path satisfies that the nodes corresponding to the source node address and the target node address are all in the current sub-network graph.
4. The method for constructing an attack graph of a power grid under attack according to claim 1, characterized in that: The method of calculating the Bayesian attack probability between the nodes of the multiple sub-network graphs based on the historical attack event set and the multiple attack path sets, and constructing multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability, specifically includes: Determining weighted frequencies of a plurality of edges of each of the plurality of subnetwork graphs according to the historical attack event set and the plurality of attack path sets; Calculating the Bayesian attack probability between nodes of the plurality of sub-network graphs according to the weighted frequencies of the respective plurality of edges in the plurality of sub-network graphs; According to the Bayesian attack probability, a plurality of Bayesian sub-attack graphs corresponding to the plurality of sub-network graphs are constructed.
5. The method for constructing an attack graph of a power grid under attack according to claim 1, characterized in that: The step of fusing the plurality of Bayesian sub-attack graphs according to the plurality of associated edges between the plurality of sub-network graphs to obtain the network attack graph of the power grid system specifically includes: According to the node topology graph, obtain a plurality of associated edges between the plurality of sub-network graphs; For each sub-network graph, according to the several associated edges, the first associated edges between the current sub-network graph and the corresponding adjacent sub-network graphs are selected, and according to the first associated edges, the Bayesian sub-attack graph corresponding to the current sub-network graph and the Bayesian sub-attack graphs corresponding to the corresponding adjacent sub-network graphs are fused to obtain the network attack graph of the power grid system; wherein the first associated edge is the associated edge with the largest weight among all the associated edges between the current sub-network graph and the corresponding adjacent sub-network graphs.
6. A method for preventing a power grid from being attacked, characterized in that: include: Obtaining a network attack graph of a power grid system; wherein the network attack graph is constructed by the attack graph construction method for a power grid under attack according to any one of claims 1 to 5; Based on a preset probability threshold, the network attack graph is screened to obtain multiple predicted attack paths; According to the node information and attack means of each of the plurality of predicted attack paths, a corresponding plurality of prevention strategies are generated, and prevention is performed according to the plurality of prevention strategies.
7. A device for constructing an attack graph when a power grid is attacked, characterized in that: It includes a feature extraction module, a partition recognition module, a sub-attack graph construction module and an attack graph construction module; The feature extraction module is used to extract features from the operation log of the power grid system to obtain network feature data; wherein the network feature data includes a node topology map and an access path set; The partition identification module is used to divide the node topology graph into multiple sub-network graphs according to the community discovery algorithm, and identify a plurality of attack paths in the multiple sub-network graphs according to the access path set to obtain multiple attack path sets; The sub-attack graph construction module is used to calculate the Bayesian attack probability between the nodes of the multiple sub-network graphs based on the historical attack event set and the multiple attack path sets, and construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability; The attack graph construction module is used to fuse the multiple Bayesian sub-attack graphs according to a number of associated edges between the multiple sub-network graphs to obtain the network attack graph of the power grid system.
8. The device for constructing an attack graph of a power grid under attack according to claim 7, characterized in that: The partition identification module includes a topology partition submodule; The topology partitioning submodule includes a community iteration unit and a topology partitioning unit; The community iteration unit is used to regard a single node in the node topology map as a community to obtain multiple initial communities, and iterate the multiple initial communities according to the node topology map, merge the multiple initial communities according to the community merging gain of each initial community with the adjacent initial communities to obtain multiple updated communities, until the community merging gain of each updated community does not exceed a preset threshold, and output the multiple updated communities obtained by the final iteration; The topology division unit is used to divide the node topology graph according to the multiple updated communities obtained in the last iteration to obtain multiple sub-network graphs.
9. The device for constructing an attack graph of a power grid under attack according to claim 7, characterized in that: The partition identification module includes a path identification submodule; the data categories of the access path set include source node address, target node address and access type; The path identification submodule is used to select one subnetwork graph as the current subnetwork graph in turn, and determine the attack path set corresponding to the current subnetwork graph according to the access path set based on a preset path matching identification method, until the corresponding attack path sets are obtained for all the subnetwork graphs; Among them, the path matching and identification method includes: matching the access path set according to each node of the current sub-network graph to obtain multiple access paths, and combining the multiple access paths into an attack path set corresponding to the current sub-network graph; the access path satisfies that the nodes corresponding to the source node address and the target node address are all in the current sub-network graph.
10. The device for constructing an attack graph of a power grid under attack according to claim 7, characterized in that: The sub-attack graph construction module includes a weighted frequency determination sub-module, an attack probability calculation sub-module and a sub-attack graph construction sub-module; The weighted frequency determination submodule is used to determine the weighted frequencies of a plurality of edges of each of the plurality of subnetwork graphs according to the historical attack event set and the plurality of attack path sets; The attack probability calculation submodule is used to calculate the Bayesian attack probability between the nodes of the multiple subnetwork graphs according to the weighted frequencies of the respective edges in the multiple subnetwork graphs; The sub-attack graph construction submodule is used to construct multiple Bayesian sub-attack graphs corresponding to the multiple sub-network graphs according to the Bayesian attack probability.
11. The device for constructing an attack graph of a power grid under attack according to claim 7, characterized in that: The attack graph construction module includes an associated edge acquisition submodule and an attack graph construction submodule; The associated edge acquisition submodule is used to acquire a plurality of associated edges between the plurality of sub-network graphs according to the node topology graph; The attack graph construction submodule is used to select, for each subnetwork graph, the first associated edges between the current subnetwork graph and the corresponding adjacent subnetwork graphs according to the several associated edges, and to fuse the Bayesian sub-attack graph corresponding to the current subnetwork graph and the Bayesian sub-attack graphs corresponding to the corresponding adjacent subnetwork graphs according to the first associated edges, so as to obtain the network attack graph of the power grid system; wherein the first associated edge is the associated edge with the largest weight among all associated edges between the current subnetwork graph and the corresponding adjacent subnetwork graphs.
12. A device for preventing a power grid from being attacked, characterized in that: It includes attack graph acquisition module, attack path screening module and attack prevention module; The attack graph acquisition module is used to acquire a network attack graph of the power grid system; wherein the network attack graph is constructed by an attack graph construction device for a power grid under attack according to any one of claims 7 to 11; The attack path screening module is used to screen the network attack graph based on a preset probability threshold to obtain multiple predicted attack paths; The attack prevention module is used to generate corresponding multiple prevention strategies according to the node information and attack means of each of the multiple predicted attack paths, and perform prevention according to the multiple prevention strategies.