Method and device for predicting and protecting attacked path of power grid system

Abstract

The invention discloses a path prediction and protection method and device for an attacked power grid system. The method comprises the following steps: acquiring an attack graph generated according to historical attack log data, and extracting feature data from the attack graph; the feature data comprises an adjacent matrix, node attribute features of each node in the attack graph and connection edge attribute features of each connection edge; through an improved graph attention network, extracting node characterization of each node and connection edge characterization of each connection edge in the attack graph from the feature data; inputting all the node representations and the connection edge representations into a preset multi-layer perceptron, and obtaining a first probability of forming an attack path between any two nodes in the attack graph; and traversing all the first probabilities, and when the first probabilities are greater than a first preset threshold value, determining that an attack path is formed between two nodes corresponding to the first probabilities. Through the application, the accuracy of attack path prediction can be improved, and the attack protection capability of a power grid system is improved.

Description

Technical Field

[0001] The present application relates to the field of network security protection, and in particular to a method and device for predicting and protecting a power grid system from attacks. Background Art

[0002] With the continuous integration of power grid systems and computer networks, the information security of power grid systems will face huge challenges. Various network attacks or virus attacks will seriously affect the normal operation of power grid systems. Existing attack methods usually require remote access to the target network or host to perform abnormal operations. When preventing such remote attacks, existing technologies often filter out abnormal attack events based on all access logs in the current network, supplement relevant protection patches for such attack events, or further encrypt internal information, but still cannot prevent other types of attacks next time.

[0003] Therefore, after encountering an attack, how to improve the accuracy of predictions for subsequent attack events and take corresponding protective measures is a technical problem that needs to be solved in the current power grid system security issues. Summary of the invention

[0004] The present application provides a method and device for predicting and protecting the path of an attack on a power grid system, so as to solve the technical problem of how to improve the accuracy of predicting subsequent attack behaviors when the network system is attacked.

[0005] In order to solve the above technical problems, in a first aspect, an embodiment of the present application provides a method for predicting a path of an attack on a power grid system, comprising:

[0006] Acquire an attack graph generated according to historical attack log data, and extract feature data from the attack graph; the feature data includes: an adjacency matrix, node attribute features of each node in the attack graph, and connection edge attribute features of each connection edge;

[0007] Extracting, from the feature data, node representations of each node and edge representations of each edge in the attack graph through an improved graph attention network;

[0008] Inputting all the node representations and all the connection edge representations into a preset multi-layer perceptron to obtain a first probability of forming an attack path between any two nodes in the attack graph;

[0009] All the first probabilities are traversed, and when the first probability is greater than a first preset threshold, it is determined that an attack path will be formed between two nodes corresponding to the first probability.

[0010] Compared with the prior art, the above embodiment has the following beneficial effects: an attack graph is generated through historical attack log data, and the attack graph includes the possible attack sequence and attack means when the attacker attacks. According to such data information, the node attribute features and the connection edge attribute features in the attack graph are extracted; further, the adjacent relationship between each node can be obtained according to the adjacency matrix, and the attribute features of each adjacent node can be considered when performing deep extraction of feature data to obtain a deep node representation and connection edge representation that include the influence of adjacent nodes, thereby improving the accuracy of further obtaining the attack path through the multi-layer perceptron. According to the accurate attack path, the protection effect against subsequent attack events can be improved.

[0011] In some embodiments of the first aspect of the present application, extracting the node representation of each node in the attack graph and the connection edge representation of each connection edge from the feature data through the improved graph attention network includes:

[0012] According to the node attribute features of each node in the attack graph and the connection edge attribute features of each connection edge, combined with a multi-head attention mechanism, the node representation of each node in the attack graph is obtained;

[0013] The node representations of the nodes at both ends of each connection edge in the attack graph are concatenated to obtain the connection edge representation of the corresponding connection edge.

[0014] Compared with the prior art, the above embodiments have the following beneficial effects: by combining the multi-head attention mechanism, the complex interaction relationships and features between nodes and connecting edges are extracted from the node attribute features and the connecting edge attribute features, thereby obtaining richer node and connecting edge representations; and through the multi-head attention mechanism, its focus can be dynamically adjusted to adapt to the ever-changing environment and improve the accuracy of the subsequently extracted node representations.

[0015] In some embodiments of the first aspect of the present application, the node representation of each node in the attack graph is obtained according to the node attribute characteristics of each node in the attack graph and the connection edge attribute characteristics of each connection edge, in combination with a multi-head attention mechanism, including:

[0016] Traversing each node in the attack graph, taking the currently traversed node as the first node, and sequentially obtaining the first similarity coefficient between the first node and each of the second nodes according to the node attribute characteristics of the first node and the node attribute characteristics of each of the second nodes adjacent to the first node, in combination with the adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node;

[0017] Calculate a first weight coefficient between the first node and each of the second nodes through a normalization operation according to the first similarity coefficient between the first node and all the second nodes;

[0018] The node representation of the first node is obtained based on a first weight coefficient between the first node and all the second nodes, a node attribute feature of the first node, and the node attribute feature of all the second nodes, and in combination with the multi-head attention mechanism.

[0019] Compared with the prior art, the above embodiment has the following beneficial effects: by calculating the first weight coefficient of the first node and each adjacent second node through the first similarity coefficient between the two nodes, it is possible to have a deeper understanding of the relationship between each first node and its adjacent second node, so that the subsequently acquired node representation contains more information about the adjacent nodes; at the same time, according to the multi-head attention mechanism, it is possible to focus on selecting the second node that has a greater influence on the first node and expand its influence, thereby improving the accuracy of the subsequently acquired node representation.

[0020] In some embodiments of the first aspect of the present application, the acquiring the node representation of the first node according to the first weight coefficient between the first node and all the second nodes, the node attribute feature of the first node, and the node attribute feature of all the second nodes, in combination with the multi-head attention mechanism, includes:

[0021] The node characterization calculation formula of the first node is specifically:

[0022]

[0023] Among them, x′ i (K) represents the node representation of the first node; K represents the number of attention mechanisms to be considered; σ(·) represents the nonlinear activation function; represents the set of the first node corresponding to the second node; x j represents the jth second node corresponding to the first node; represents the first weight coefficient between the first node and the jth second node; W k Represents the linear transformation matrix of the input features under the k-th attention mechanism.

[0024] Compared with the prior art, the above embodiment has the following beneficial effects: the influence of each second node on each first node can be objectively evaluated through the first weight coefficient, and the introduction of the attention mechanism allows the user to flexibly adjust the degree of influence of each second node on the first node according to the importance of the second node. The combination of the two can make the graph attention network model have higher stability in the processing of the attack graph, while improving the accuracy of node representation.

[0025] In some embodiments of the first aspect of the present application, the first similarity coefficient between the first node and all corresponding second nodes is calculated by normalizing the first weight coefficient between the first node and the corresponding second nodes in combination with the adjacency matrix, including:

[0026] The calculation formula of the first weight coefficient is specifically:

[0027]

[0028] Where exp(·) represents the exponential operation function; e ij is the first similarity coefficient between the first node and the jth second node; Represents the set of all second nodes corresponding to the first node; E i is a set of first similarity coefficients between the first node and each second node; softmax(·) is a normalization function; α ij A first weight coefficient between the first node and the j-th second node.

[0029] Compared with the prior art, the above embodiment has the following beneficial effects: through the normalization operation and the first similarity coefficient between each node, the influence of each second node on the first node is objectively evaluated. The more similar the second node is to the first node, the greater the influence of the second node on the first node. At this time, when subsequently generating the node representation of the first node, the node attribute characteristics corresponding to the second node should be given priority consideration.

[0030] In some embodiments of the first aspect of the present application, the first similarity coefficients between the first node and each of the second nodes are sequentially obtained according to the node attribute characteristics of the first node and the node attribute characteristics of each second node adjacent to the first node, in combination with the adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node, including:

[0031] The calculation formula of the first similarity coefficient is specifically:

[0032] e ij =LeakyReLU(a T [Wx i ||Wx j ||y ij ])

[0033] Wherein, W represents a shared parameter matrix used to perform feature transformation on the node feature attributes of each node; represents the set of the first node corresponding to the second node; LeakyReLU(·) represents the activation function; x iis the node characteristic attribute of the first node; x j is the node characteristic attribute of the jth second node of the first node; a T is the adjacency matrix; ij The connection edge attribute feature of the first connection edge between the first node and the j-th second node; e ij is the first similarity coefficient between the first node and the jth second node.

[0034] Compared with the prior art, the above embodiment has the following beneficial effects: when judging the first similarity coefficient between two nodes, not only the node attribute characteristics between the two nodes are considered, but also the connection edge attribute characteristics of the connection edge between the two nodes are introduced, thereby improving the accuracy of evaluating the similarity between the two nodes.

[0035] In a second aspect, the embodiment of the present application further provides a method for preventing a power grid system from being attacked, comprising:

[0036] Obtain the first IP address attacked by the current attacker and the first attack method corresponding to the attack behavior;

[0037] Determine, according to the first IP address and the first attack type suffered, a first attack path with the highest probability of being attacked, in combination with all predicted attack paths and the first probability of each attack path; the attack path and the first probability corresponding to the attack path are obtained by any one of the path prediction methods for attacking a power grid system described in the embodiments of the present application;

[0038] According to the node information of the subsequent nodes of the first attack path, the threat intelligence knowledge base is retrieved to obtain and execute the corresponding response strategies of each subsequent node; wherein the threat intelligence knowledge base includes a number of threat intelligence; the threat intelligence includes: threat source, threat type, attack target, attack means, attack time period and response strategy.

[0039] Compared with the prior art, the above embodiment has the following beneficial effects: after obtaining the IP address currently under attack, the first attack path corresponding to the current attack can be obtained by accurately predicting all attack paths, and then the subsequent node information of the first attack path can be known based on all attack paths. At this time, the response strategy for the attack corresponding to each node can be obtained from the threat intelligence knowledge base, thereby effectively improving the success rate of attack prevention.

[0040] In a third aspect, an embodiment of the present application further provides a path prediction device for a power grid system being attacked, comprising: a feature data extraction module, a characterization data extraction module, a first probability acquisition module, and an attack path determination module;

[0041] The feature data extraction module is used to obtain an attack graph generated according to historical attack log data and extract feature data from the attack graph; the feature data includes: an adjacency matrix, node attribute features of each node in the attack graph, and connection edge attribute features of each connection edge;

[0042] The representation data extraction module is used to extract the node representation of each node and the connection edge representation of each connection edge in the attack graph from the feature data through an improved graph attention network;

[0043] The first probability acquisition module is used to input all the node representations and all the connection edge representations into a preset multi-layer perceptron to obtain a first probability of forming an attack path between any two nodes in the attack graph;

[0044] The attack path determination module is used to traverse all the first probabilities, and when the first probability is greater than a first preset threshold, determine that an attack path will be formed between two nodes corresponding to the first probability.

[0045] In some embodiments of the third aspect, extracting, from the feature data, a node representation of each node in the attack graph and a connection edge representation of each connection edge through an improved graph attention network, comprises:

[0046] According to the node attribute features of each node in the attack graph and the connection edge attribute features of each connection edge, combined with a multi-head attention mechanism, the node representation of each node in the attack graph is obtained;

[0047] The node representations of the nodes at both ends of each connection edge in the attack graph are concatenated to obtain the connection edge representation of the corresponding connection edge.

[0048] In a fourth aspect, an embodiment of the present application further provides a device for preventing a power grid system from being attacked, comprising: an attack detection module, a first path confirmation module, and a protection strategy execution module;

[0049] The attack detection module is used to obtain the first IP address attacked by the current attacker and the first attack method corresponding to the attack behavior;

[0050] The first path confirmation module is used to determine a first attack path with the highest probability of being attacked based on the first IP address and the first attack type suffered, combined with all predicted attack paths and the first probability of each attack path; the attack path and the first probability corresponding to the attack path are obtained by any one of the path prediction devices for power grid systems being attacked as described in the embodiments of the present application;

[0051] The protection strategy execution module is used to retrieve the threat intelligence knowledge base according to the node information of the subsequent nodes of the first attack path, and obtain and execute the response strategy corresponding to each subsequent node; wherein the threat intelligence knowledge base includes a number of threat intelligence; the threat intelligence includes: threat source, threat type, attack target, attack means, attack time period and response strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 A schematic flow chart of a method for predicting a path of an attack on a power grid system provided in some embodiments of the present application;

[0053] Figure 2 This is an example diagram of an attack graph provided in some embodiments of the present application;

[0054] Figure 3 A flowchart of a method for preventing a power grid system from being attacked provided in some embodiments of the present application;

[0055] Figure 4 An example diagram of a threat intelligence knowledge base provided in some embodiments of the present application;

[0056] Figure 5 A schematic diagram of the structure of a path prediction device for a power grid system under attack provided in some embodiments of the present application;

[0057] Figure 6 A schematic diagram of the structure of a device for preventing a power grid system from being attacked provided in some embodiments of the present application. DETAILED DESCRIPTION

[0058] Existing attack methods usually require remote access to the target network or host to perform abnormal operations. When preventing such remote attacks, existing technologies often filter out abnormal attack events based on all access logs in the current network, add relevant protection patches for such attack events, or further encrypt internal information. However, they still cannot prevent other types of attack events next time, thus posing a threat to the security of the power grid system.

[0059] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0060] Embodiment 1

[0061] Please refer to Figure 1, a method for predicting a path of an attack on a power grid system provided in an embodiment of the present application, includes S10 to S40, specifically:

[0062] S10: Obtain an attack graph generated according to historical attack log data, and extract feature data from the attack graph; the feature data includes: an adjacency matrix, node attribute features of each node in the attack graph, and connection edge attribute features of each connection edge.

[0063] refer to Figure 2 , is an example of an attack graph provided in some embodiments of the present application, the node set of the attack graph is V = {v0,v1,v2,v3,v4,v5,v6,v7,v8,v9,v 10}, from one node to another, certain attack conditions and attack means need to be met, and the edges in the attack graph can be regarded as a set of attack conditions and attack means, such as: {C(e2), A(e2)} = {{c2}, {a2}}, where C(e2) is the set of attack conditions that need to be met when the attack path e2 is formed, and the specific set is {c2}; A(e2) is the set of attack actions that the attacker needs to perform when the attack path e2 is formed, and the specific set is {a2}.

[0064] Figure 2 The set of all attack conditions of the attack graph shown is C = {c1,c2,c3,c4,c5,c6,c7,c8,c9,c 10 ,c 11}, where C(e1) = {c1} indicates a successful phishing email attack; C(e2) = {c2} indicates exploiting a vulnerability in a user terminal device; C(e3) = {c3} indicates discovering and exploiting a weak password in the internal network; C(e4) = {c4} indicates exploiting a vulnerability in a Web server; C(e5) = {c5} indicates discovering a privilege escalation vulnerability in a database server; C(e6) = {c6} indicates exploiting a vulnerability in a SCADA (Supervisory Control and Data Acquisition) system; C(e7) = {c7} indicates breaking through the protective measures of a substation control system; C(e8) = {c8} indicates network scanning; C(e9) = {c9} indicates discovering a vulnerability in a network firewall; C(e 10 )={c 10} indicates that the intrusion monitoring system is passed; C(e 11 )={c 11} means obtaining management backend permissions.

[0065] Figure 2The set of all attack methods in the attack graph shown is set A = {a1, a2, a3, a4, a5, a6, a7, a8, a9, a 10 ,a 11}, where A(e1) = {a1} indicates obtaining access rights to user terminal devices; A(e2) = {a2} indicates entering the company's internal network; A(e3) = {a3} indicates accessing the Web server; A(e4) = {a4} indicates accessing the database server; A(e5) = {a5} indicates accessing the SCADA system; A(e6) = {a6} indicates accessing the substation control system; A(e7) = {a7} indicates operating substation equipment, A(e8) = {a8} indicates discovering and bypassing the network firewall; A(e9) = {a9} indicates disabling or bypassing the intrusion monitoring system; A(e 10 )={a 10} indicates access to the management backend; A(e 11 )={a 11} indicates controlling the substation control system.

[0066] Combining the above information, Figure 2 One of the attack path chains in can be expressed as p= <v0-(c1,a1)→v1-(c2,a2)→v2-(c3,a3)→v3-(c4,a4)→v4-(c5,a5)→v5-(c6,a6)→v6-(c7,a7)→v 10 >, where v0-(c1,a1)→v1 represents the transition from node 0 to node 1, which requires the attacker to successfully complete the phishing email attack and execute an attack action to obtain access rights to the user's terminal device.

[0067] Therefore, it can be seen that the nodes and connecting edges in the attack graph contain a lot of semantic information, and it is necessary to extract features from the above information so that these semantic information can be processed by the subsequent graph attention network.

[0068] Preferably, in some embodiments of the present application, the adjacency matrix, the node attribute features of each node, and the connection edge attribute features of each connection edge are extracted from the attack graph through the following preferred implementation:

[0069] S11: Obtain the adjacency matrix of the attack graph. The specific method is: if there is a connecting edge between two nodes, the corresponding matrix element value is set to 1, otherwise it is set to 0, and the adjacency matrix A is obtained;

[0070] S12: Extracting node attribute features of each node. The specific method is as follows:

[0071] S121: Select attribute data that has a greater impact on the attack path from the attribute data of the node, such as:

[0072] Node type, security level, operating system, number of vulnerabilities, etc., please refer to Table 1 for details;

[0073] S122: For attribute data such as node type, security level, and operating system, which are semantic information, a binary vector is obtained by one-hot encoding, and the binary vector is further input into the input of the Word2Vec model to obtain feature data. For example, there are three types of security levels: high, medium, and low. The security level of the node is mapped to a three-dimensional vector, and the code for "high" is [1,0,0], and the code for "medium" is

[0074] [0,1,0], the encoding of "low" is [0,0,1];

[0075] S123: For attribute data of numerical type such as the number of vulnerabilities, normalization processing can be directly performed to scale it to between 0 and 1 to obtain feature data;

[0076] S124: The feature data obtained from S122 to S123 are concatenated to form node attribute features of the corresponding nodes, and a node attribute feature matrix X = (x1, x2, ..., x i ,…,x n ) T , where n represents the number of nodes, x i is the node attribute feature of the i-th node.

[0077] Table 1 Node attribute data

[0078]

[0079]

[0080] S13: Extracting the connection edge attribute features of each connection edge, the specific method is as follows:

[0081] S131: Select attribute data that has a greater impact on the attack path from the attribute data of the connection edge, such as: connection edge type, protocol, bandwidth, etc. For details, please refer to Table 2;

[0082] S132: For attribute data such as connection edge type and protocol, which are semantic information, a binary vector is obtained by one-hot encoding, and the binary vector is further input into the input of the Word2Vec model to obtain feature data;

[0083] S133: For attribute data of numerical type such as bandwidth, normalization processing can be directly performed to scale it to between 0 and 1 to obtain feature data;

[0084] S134: concatenate the feature data obtained from S132 to S133 to form the connection edge attribute features of the corresponding connection edges, and generate the connection edge attribute feature matrix E = (e1, e2, ..., e i ,…,e m ) T , where m represents the number of connected edges, e i is the edge attribute feature of the i-th edge.

[0085] Table 2 Attribute data of connecting edges

[0086]

[0087]

[0088] S20: extracting the node representation of each node and the connection edge representation of each connection edge in the attack graph from the feature data through the improved graph attention network.

[0089] In some embodiments of the present application, the node representation of each node in the attack graph and the connection edge representation of each connection edge are extracted from the feature data through the improved graph attention network, including:

[0090] S21: acquiring the node representation of each node in the attack graph according to the node attribute features of each node in the attack graph and the connection edge attribute features of each connection edge in combination with a multi-head attention mechanism;

[0091] S22: Concatenate the node representations of the nodes at both ends of each connection edge in the attack graph to obtain the connection edge representation of the corresponding connection edge.

[0092] Combined with the multi-head attention mechanism, the complex interaction relationships and features between nodes and connecting edges are extracted from the node attribute features and the connecting edge attribute features, so as to obtain richer node and connecting edge representations; and through the multi-head attention mechanism, its focus can be dynamically adjusted to adapt to the ever-changing environment and improve the accuracy of the subsequently extracted node representations.

[0093] In some embodiments of the present application, the node representation of each node in the attack graph is obtained according to the node attribute characteristics of each node in the attack graph and the connection edge attribute characteristics of each connection edge, in combination with a multi-head attention mechanism, including:

[0094] S211: traversing each node in the attack graph, taking the currently traversed node as the first node, and sequentially obtaining first similarity coefficients between the first node and each of the second nodes according to the node attribute characteristics of the first node and the node attribute characteristics of each of the second nodes adjacent to the first node, in combination with the adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node;

[0095] S212: Calculate a first weight coefficient between the first node and each of the second nodes through a normalization operation according to the first similarity coefficient between the first node and all the second nodes;

[0096] S213: Obtain the node representation of the first node based on the first weight coefficient between the first node and all the second nodes, the node attribute characteristics of the first node and the node attribute characteristics of all the second nodes, and in combination with the multi-head attention mechanism.

[0097] By calculating the first weight coefficient of the first node and each adjacent second node through the first similarity coefficient between two nodes, we can have a deeper understanding of the relationship between each first node and its adjacent second node, so that the subsequently obtained node representation contains more information about adjacent nodes; at the same time, according to the multi-head attention mechanism, we can focus on selecting the second node that has a greater impact on the first node and expand its influence, thereby improving the accuracy of the subsequently obtained node representation.

[0098] Preferably, the above steps S211 to S213 can be performed by the following preferred implementations:

[0099] S211′: For each first node, calculate the similarity coefficient e between the first node and each second node one by one using the following formula: ij :

[0100] e ij =LeakyReLU(a T [Wx i ||Wx j ||y ij ])

[0101] Wherein, W represents a shared parameter matrix used to perform feature transformation on the node feature attributes of each node; represents the set of the first node corresponding to the second node; LeakyReLU(·) represents the activation function; x i is the node characteristic attribute of the first node; x j is the node characteristic attribute of the jth second node of the first node; a T is the adjacency matrix; ijThe connection edge attribute feature of the first connection edge between the first node and the j-th second node; e ij is the first similarity coefficient between the first node and the jth second node.

[0102] S212′: Perform a self-attention operation on each first node to obtain a first weight coefficient between the first node and each of the second nodes using the following formula:

[0103]

[0104] Where exp(·) represents the exponential operation function; e ij is the first similarity coefficient between the first node and the jth second node; Represents the set of all second nodes corresponding to the first node; E i is a set of first similarity coefficients between the first node and each second node; softmax(·) is a normalization function; α ij A first weight coefficient between the first node and the j-th second node.

[0105] S213′: By using the following formula and combining K attention mechanisms, linear transformation is performed on the node attribute features of the input second node to obtain the node representation of each first node:

[0106]

[0107] Among them, x′ i (K) represents the node representation of the first node; K represents the number of attention mechanisms to be considered; σ(·) represents the nonlinear activation function; represents the set of the first node corresponding to the second node; x j represents the jth second node corresponding to the first node; represents the first weight coefficient between the first node and the jth second node; W k Represents the linear transformation matrix of the input features under the k-th attention mechanism.

[0108] It can be seen from the above S211′ to S213′ that through the normalization operation and the first similarity coefficient between each node, the influence of each second node on the first node can be objectively evaluated, so that an accurate first weight coefficient can be obtained; further, the influence of each second node on each first node can be objectively evaluated through the first weight coefficient, and the introduction of the attention mechanism allows the user to flexibly adjust the influence of each second node on the first node according to the importance of the second node. The combination of the two can make the graph attention network model have higher stability in the processing of the attack graph, while improving the accuracy of node representation.

[0109] S30: Input all the node representations and all the connection edge representations into a preset multi-layer perceptron to obtain a first probability of forming an attack path between any two nodes in the attack graph.

[0110] Preferably, in some embodiments of the present application, attack path prediction is identified as a binary classification problem, and the preset multi-layer perceptron is trained by the following loss function:

[0111]

[0112] Among them, Loss is the loss function; Z is the number of potential connection edges; l z is the true label of the zth potential connection edge, with a value of 1 or 0; is the predicted probability of the zth potential connection edge.

[0113] Preferably, a large amount of preprocessed historical network attack data is used to provide training samples for the graph attention network, and the error between the first probability value output by the graph attention network after passing through the multi-layer perceptron and the actual attack event is calculated according to a predefined loss function, and the parameters of the graph attention network are optimized by the Adam algorithm to reduce the error.

[0114] S40: Traversing all the first probabilities, and when the first probability is greater than a first preset threshold, determining that an attack path will be formed between two nodes corresponding to the first probability.

[0115] Preferably, step S40 can be performed through the following preferred implementation: if the output value of the multilayer perceptron is greater than 0.5, it indicates that an attack path will be formed between the two nodes. Since the two ends of the attack path are nodes, multiple attack paths can be connected through the two end nodes. These attack paths show the possible action routes that the attacker may take.

[0116] In summary, the path prediction method for a power grid system under attack provided in an embodiment of the present application has the following beneficial effects: an attack graph is generated through historical attack log data, the attack graph includes the possible attack sequence and attack means when the attacker attacks, and based on such data information, the node attribute features and connection edge attribute features in the attack graph are extracted; further, the adjacent relationship between each node can be obtained based on the adjacency matrix, and the attribute features of each adjacent node can be considered when deeply extracting the feature data, to obtain a deep node representation and connection edge representation that includes the influence of the adjacent nodes, thereby improving the accuracy of the subsequent acquisition of the attack path through a multi-layer perceptron, and based on the accurate attack path, the protection effect against subsequent attack events can be improved.

[0117] Embodiment 2

[0118] refer to Figure 3 , a method for preventing a power grid system from being attacked provided in an embodiment of the present application, comprising: S50 to S70, specifically:

[0119] S50: Obtain the first IP address attacked by the current attacker and the first attack method corresponding to the attack behavior;

[0120] S60: Determine a first attack path with the highest probability of being attacked, based on the first IP address and the first attack type suffered, in combination with all predicted attack paths and the first probability of each attack path; the attack path and the first probability corresponding to the attack path are obtained by any one of the path prediction methods for attacking a power grid system described in the embodiments of the present application;

[0121] S70: According to the node information of the subsequent nodes of the first attack path, the threat intelligence knowledge base is retrieved to obtain and execute the corresponding response strategy of each subsequent node; wherein the threat intelligence knowledge base includes a number of threat intelligence; the threat intelligence includes: threat source, threat type, attack target, attack means, attack time period and response strategy.

[0122] Preferably, reference Figure 4 , is an example diagram of a threat intelligence knowledge base provided in some embodiments of the present application. The threat intelligence knowledge base can be built through the following preferred implementation methods: collect threat intelligence data from various security information sources (such as security device logs, network traffic monitoring, security communities, threat intelligence sharing platforms, etc.), organize, clean, deduplicate and standardize the collected threat intelligence data to ensure the accuracy and consistency of the data. Using known threat intelligence data, according to the defined six-tuple CTI = {Source, Type, Target, Means, Time, Response}, identify and extract the six element information of each threat intelligence data, organize the extracted threat intelligence into a knowledge base in the form of a threat list in the format of a six-tuple, each threat intelligence contains six element information, namely, threat source, threat type, attack target, attack means, attack period and response strategy, regularly update the threat list, add new threat intelligence in a timely manner, update the data of existing threat intelligence, and maintain and optimize the threat intelligence knowledge base.

[0123] Further, in steps S60 to S70, the first attack path and subsequent nodes can be determined by the following preferred implementation: after knowing the first IP address and the first attack means corresponding to the attack behavior, the third node in the attack graph corresponding to the current attack can be determined, and the attack path with the highest first probability is selected as the first attack path according to all attack paths related to the third node; after the first attack path is determined for the first time, the next node after the third node, i.e., the fourth node, can be known; the fourth node is used as the starting node, and all attack paths related to the fourth node are obtained, and the attack path with the highest first probability is selected as the next first attack path in combination with the first probability of each attack path. By analogy, several first attack paths and several nodes at both ends of the first attack paths can be obtained.

[0124] After obtaining the subsequent nodes of the first attack path, the corresponding response strategies can be retrieved in the threat intelligence knowledge base according to the nodes, so as to implement preventive measures against attacks on the power grid system.

[0125] In summary, the method for preventing power grid systems from being attacked provided in the embodiments of the present application has the following beneficial effects: after obtaining the IP address currently under attack, the first attack path corresponding to the current attack can be obtained by accurately predicting all attack paths, and then the subsequent node information of the first attack path can be known based on all attack paths. At this time, the response strategy for the attack corresponding to each node can be obtained from the threat intelligence knowledge base, thereby effectively improving the success rate of attack prevention.

[0126] Embodiment 3

[0127] refer to Figure 5 , a path prediction device for a power grid system under attack provided in an embodiment of the present application, includes: a feature data extraction module 11, a characterization data extraction module 12, a first probability acquisition module 13 and an attack path determination module 14.

[0128] In some embodiments of the present application, the feature data extraction module 11 is used to obtain an attack graph generated according to historical attack log data, and extract feature data from the attack graph; the feature data includes: an adjacency matrix, node attribute features of each node in the attack graph, and connection edge attribute features of each connection edge; the representation data extraction module 12 is used to extract the node representation of each node in the attack graph and the connection edge representation of each connection edge from the feature data through an improved graph attention network; the first probability acquisition module 13 is used to input all the node representations and all the connection edge representations into a preset multi-layer perceptron to obtain the first probability of forming an attack path between any two nodes in the attack graph; the attack path determination module 14 is used to traverse all the first probabilities, and when the first probability is greater than a first preset threshold, determine that an attack path will be formed between two nodes corresponding to the first probability.

[0129] In some embodiments of the present application, the node representation of each node in the attack graph and the connection edge representation of each connection edge are extracted from the feature data through an improved graph attention network, including: according to the node attribute characteristics of each node in the attack graph and the connection edge attribute characteristics of each connection edge, combined with a multi-head attention mechanism, the node representation of each node in the attack graph is obtained; the node representations of the nodes at both ends of each connection edge in the attack graph are spliced ​​to obtain the connection edge representation of the corresponding connection edge.

[0130] In some embodiments of the present application, the node representation of each node in the attack graph is obtained according to the node attribute characteristics of each node in the attack graph and the connection edge attribute characteristics of each connection edge, combined with a multi-head attention mechanism, including: traversing each node in the attack graph, taking the currently traversed node as the first node, and according to the node attribute characteristics of the first node and the node attribute characteristics of each second node adjacent to the first node, combined with an adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node, sequentially obtaining the first similarity coefficient between the first node and each second node; according to the first similarity coefficient between the first node and all the second nodes, calculating the first weight coefficient between the first node and each second node through a normalization operation; according to the first weight coefficient between the first node and all the second nodes, the node mathematical characteristics of the first node and the node attribute characteristics of all the second nodes, and combined with the multi-head attention mechanism, obtaining the node representation of the first node.

[0131] In some embodiments of the present application, the step of acquiring the node representation of the first node according to the first weight coefficient between the first node and all the second nodes, the node mathematical feature of the first node, and the node attribute feature of all the second nodes, in combination with the multi-head attention mechanism, includes:

[0132] The node characterization calculation formula of the first node is specifically:

[0133]

[0134] Among them, x′ i (K) represents the node representation of the first node; K represents the number of attention mechanisms to be considered; σ(·) represents the nonlinear activation function; represents the set of the first node corresponding to the second node; x j represents the jth second node corresponding to the first node; represents the first weight coefficient between the first node and the jth second node; W k Represents the linear transformation matrix of the input features under the k-th attention mechanism.

[0135] In some embodiments of the present application, the first similarity coefficient between the first node and all corresponding second nodes is calculated by normalizing the first weight coefficient between the first node and the corresponding second nodes in combination with the adjacency matrix, including:

[0136] The calculation formula of the first weight coefficient is specifically:

[0137]

[0138] Where exp(·) represents the exponential operation function; e ij is the first similarity coefficient between the first node and the jth second node; Represents the set of all second nodes corresponding to the first node; E i is a set of first similarity coefficients between the first node and each second node; softmax(·) is a normalization function; α ij A first weight coefficient between the first node and the j-th second node.

[0139] In some embodiments of the present application, the first similarity coefficients between the first node and each of the second nodes are sequentially obtained according to the node attribute characteristics of the first node and the node attribute characteristics of each second node adjacent to the first node, in combination with the adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node, including:

[0140] The calculation formula of the first similarity coefficient is specifically:

[0141] e ij =LeakyReLU(a T [Wx i ||Wx j ||y ij ])

[0142] W represents a shared parameter matrix used to perform feature transformation on the node feature attributes of each node; represents the set of the first node corresponding to the second node; LeakyReLU(·) represents the activation function; x i is the node characteristic attribute of the first node; x j is the node characteristic attribute of the jth second node of the first node; a T is the adjacency matrix; ij The connection edge attribute feature of the first connection edge between the first node and the j-th second node; e ij is the first similarity coefficient between the first node and the jth second node.

[0143] In summary, a path prediction device for an attack on a power grid system provided in an embodiment of the present application has the following beneficial effects: an attack graph is generated through historical attack log data, the attack graph includes the possible attack sequence and attack means when the attacker attacks, and based on such data information, node attribute features and connection edge attribute features in the attack graph are extracted; further, the adjacency relationship between each node can be obtained based on the adjacency matrix, and the attribute features of each adjacent node can be considered when deeply extracting feature data, to obtain a deep node representation and connection edge representation that includes the influence of adjacent nodes, thereby improving the accuracy of further obtaining the attack path through a multi-layer perceptron, and based on the accurate attack path, the protection effect against subsequent attack events can be improved.

[0144] Embodiment 4

[0145] refer to Figure 6 , a device for preventing a power grid system from being attacked provided in an embodiment of the present application, includes: an attack detection module 15, a first path confirmation module 16 and a protection strategy execution module 17.

[0146] In some embodiments of the present application, the attack detection module 15 is used to obtain the first IP address attacked by the current attacker and the first attack means corresponding to the attack behavior; the first path confirmation module 16 is used to determine the first attack path with the highest probability of being attacked based on the first IP address and the first attack type suffered, combined with all predicted attack paths and the first probability of each attack path; the attack path and the first probability corresponding to the attack path are obtained through any one of the path prediction devices for the power grid system attacked as described in the embodiments of the present application; the protection strategy execution module 17 is used to retrieve the threat intelligence knowledge base according to the node information of the subsequent nodes of the first attack path, and obtain and execute the corresponding response strategy of each subsequent node; wherein the threat intelligence knowledge base includes a number of threat intelligence; the threat intelligence includes: threat source, threat type, attack target, attack means, attack time period and response strategy.

[0147] In summary, the device for preventing power grid systems from being attacked provided in the embodiment of the present application has the following beneficial effects: after obtaining the IP address currently under attack, the first attack path corresponding to the current attack can be obtained by accurately predicting all attack paths, and then the subsequent node information of the first attack path can be known based on all attack paths. At this time, the response strategy for the attack corresponding to each node can be obtained from the threat intelligence knowledge base, thereby effectively improving the success rate of attack prevention.

Claims

1. A method for predicting a path of an attack on a power grid system, characterized in that: include: Obtaining an attack graph generated according to historical attack log data, and extracting feature data from the attack graph; The feature data includes: an adjacency matrix, node attribute features of each node in the attack graph, and connection edge attribute features of each connection edge; Extracting, from the feature data, node representations of each node and edge representations of each edge in the attack graph through an improved graph attention network; Inputting all the node representations and all the connection edge representations into a preset multi-layer perceptron to obtain a first probability of forming an attack path between any two nodes in the attack graph; All the first probabilities are traversed, and when the first probability is greater than a first preset threshold, it is determined that an attack path will be formed between two nodes corresponding to the first probability.

2. A method for predicting a path of an attack on a power grid system as claimed in claim 1, characterized in that: The step of extracting the node representation of each node and the connection edge representation of each connection edge in the attack graph from the feature data through the improved graph attention network includes: According to the node attribute features of each node in the attack graph and the connection edge attribute features of each connection edge, combined with a multi-head attention mechanism, the node representation of each node in the attack graph is obtained; The node representations of the nodes at both ends of each connection edge in the attack graph are concatenated to obtain the connection edge representation of the corresponding connection edge.

3. A method for predicting a path of an attack on a power grid system as claimed in claim 2, characterized in that: The step of obtaining the node representation of each node in the attack graph according to the node attribute features of each node in the attack graph and the connection edge attribute features of each connection edge in combination with a multi-head attention mechanism includes: Traversing each node in the attack graph, taking the currently traversed node as the first node, and sequentially obtaining the first similarity coefficient between the first node and each of the second nodes according to the node attribute characteristics of the first node and the node attribute characteristics of each of the second nodes adjacent to the first node, in combination with the adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node; Calculate a first weight coefficient between the first node and each of the second nodes through a normalization operation according to the first similarity coefficient between the first node and all the second nodes; The node representation of the first node is obtained based on a first weight coefficient between the first node and all the second nodes, a node attribute feature of the first node, and the node attribute feature of all the second nodes, and in combination with the multi-head attention mechanism.

4. A method for predicting a path of an attack on a power grid system as claimed in claim 3, characterized in that: The acquiring the node representation of the first node according to the first weight coefficient between the first node and all the second nodes, the node attribute feature of the first node, and the node attribute feature of all the second nodes, and in combination with the multi-head attention mechanism, includes: The node characterization calculation formula of the first node is specifically: Among them, x ′ i (K) represents the node representation of the first node; K represents the number of attention mechanisms to be considered; σ(·) represents the nonlinear activation function; represents the set of the first node corresponding to the second node; x j represents the jth second node corresponding to the first node; represents the first weight coefficient between the first node and the jth second node; W k Represents the linear transformation matrix of the input features under the k-th attention mechanism.

5. A method for predicting a path of an attack on a power grid system as claimed in claim 3, characterized in that: The calculating, according to the first similarity coefficient between the first node and all corresponding second nodes, of the first weight coefficient between the first node and corresponding second nodes by normalizing the adjacency matrix, includes: The calculation formula of the first weight coefficient is specifically: Where exp(·) represents the exponential operation function; e ij is the first similarity coefficient between the first node and the jth second node; Represents the set of all second nodes corresponding to the first node; E i is a set of first similarity coefficients between the first node and each second node; softmax(·) is a normalization function; α ij A first weight coefficient between the first node and the j-th second node.

6. A method for predicting a path of an attack on a power grid system as claimed in claim 3, characterized in that: The obtaining, in sequence, the first similarity coefficients between the first node and each of the second nodes according to the node attribute characteristics of the first node and the node attribute characteristics of each of the second nodes adjacent to the first node, in combination with the adjacency matrix and the connection edge attribute characteristics of the first connection edge between the first node and the second node, includes: The calculation formula of the first similarity coefficient is specifically: e ij =LeakyReLU(a T [Wx i ||Wx j ||y ij ]) Wherein, W represents a shared parameter matrix used to perform feature transformation on the node feature attributes of each node; represents the set of the first node corresponding to the second node; LeakyReLU(·) represents the activation function; x i is the node characteristic attribute of the first node; x j is the node characteristic attribute of the jth second node of the first node; a T is the adjacency matrix; ij The connection edge attribute feature of the first connection edge between the first node and the j-th second node; e ij is the first similarity coefficient between the first node and the jth second node.

7. A method for preventing a power grid system from being attacked, characterized in that: include: Obtain the first IP address attacked by the current attacker and the first attack method corresponding to the attack behavior; According to the first IP address and the first attack type suffered, combined with all predicted attack paths and the first probability of each attack path, determine the first attack path with the highest probability of being attacked; the attack path and the first probability corresponding to the attack path are obtained by the path prediction method for the power grid system being attacked according to any one of claims 1 to 6; According to the node information of the subsequent nodes of the first attack path, the threat intelligence knowledge base is retrieved to obtain and execute the corresponding response strategies of each subsequent node; wherein the threat intelligence knowledge base includes a number of threat intelligence; the threat intelligence includes: threat source, threat type, attack target, attack means, attack time period and response strategy.

8. A device for predicting a path of an attack on a power grid system, characterized in that: include: A feature data extraction module, a characterization data extraction module, a first probability acquisition module, and an attack path determination module; The feature data extraction module is used to obtain an attack graph generated according to historical attack log data and extract feature data from the attack graph; the feature data includes: an adjacency matrix, node attribute features of each node in the attack graph, and connection edge attribute features of each connection edge; The representation data extraction module is used to extract the node representation of each node and the connection edge representation of each connection edge in the attack graph from the feature data through an improved graph attention network; The first probability acquisition module is used to input all the node representations and all the connection edge representations into a preset multi-layer perceptron to obtain a first probability of forming an attack path between any two nodes in the attack graph; The attack path determination module is used to traverse all the first probabilities, and when the first probability is greater than a first preset threshold, determine that an attack path will be formed between two nodes corresponding to the first probability.

9. The device for predicting a path of an attack on a power grid system according to claim 8, characterized in that: The step of extracting the node representation of each node and the connection edge representation of each connection edge in the attack graph from the feature data through the improved graph attention network includes: According to the node attribute features of each node in the attack graph and the connection edge attribute features of each connection edge, combined with a multi-head attention mechanism, the node representation of each node in the attack graph is obtained; The node representations of the nodes at both ends of each connection edge in the attack graph are concatenated to obtain the connection edge representation of the corresponding connection edge.

10. A device for preventing a power grid system from being attacked, characterized in that: include: Attack detection module, first path confirmation module and protection strategy execution module; The attack detection module is used to obtain the first IP address attacked by the current attacker and the first attack method corresponding to the attack behavior; The first path confirmation module is used to determine a first attack path with the highest probability of being attacked based on the first IP address and the first attack type suffered, combined with all predicted attack paths and the first probability of each attack path; the attack path and the first probability corresponding to the attack path are obtained by the path prediction device for the power grid system being attacked according to any one of claims 8 to 9; The protection strategy execution module is used to retrieve the threat intelligence knowledge base according to the node information of the subsequent nodes of the first attack path, and obtain and execute the response strategy corresponding to each subsequent node; wherein the threat intelligence knowledge base includes a number of threat intelligence; the threat intelligence includes: threat source, threat type, attack target, attack means, attack time period and response strategy.

Images