Network security attack and defense confrontation capability evaluation method, system and device for power monitoring system, and storage medium

Abstract

The invention discloses a network security attack and defense confrontation capability evaluation method for a power monitoring system. The method comprises the following steps: a simulation attack module transmits simulation attack information to a simulation service module through a switch; the simulation service module records attack information and transmits the attack information to the manager module; the network security protection equipment monitors and analyzes network traffic through the switch traffic mirror image port, generates an alarm log and transmits the alarm log to the type II monitoring device; the manager module obtains an alarm day of the network security protection equipment from the type-II monitoring device or directly obtains an alarm log from the network security protection equipment; the manager module obtains an effective alarm log through quintuple association analysis and an AI large model evaluation technology in combination with the simulation attack information sent by the simulation service module, and then calculates a countermeasure ability score of the security protection equipment; according to the invention, the accuracy of adversarial ability evaluation is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security of electric power monitoring systems, and in particular to a network security attack and defense confrontation capability assessment method, system, device and storage medium for electric power monitoring systems. Background Art

[0002] With the rapid development of information technology, network security issues in power monitoring systems have become increasingly prominent, and various types of network attack methods have emerged one after another. In order to cope with these threats, network security equipment plays a key role in protecting information systems. However, in the face of ever-changing network attack methods, how to accurately evaluate the monitoring capabilities of network security equipment has become an urgent problem to be solved. Existing network security equipment evaluation methods usually focus on equipment performance, functions, etc., while ignoring the performance of the equipment in actual confrontation environments. Summary of the invention

[0003] Purpose of the invention: The purpose of the present invention is to provide a network security attack and defense capability assessment method, system, device and storage medium for power monitoring systems. By simulating real network attack scenarios, the monitoring and response capabilities of network security equipment are comprehensively tested, providing an important basis for equipment optimization and improvement.

[0004] Technical solution: The network security attack and defense confrontation capability assessment method for an electric power monitoring system described in the present invention comprises the following steps: a simulated attack module transmits simulated attack information to a simulated service module through a switch; after receiving the simulated attack sent by the simulated attack module, the simulated service module records the attack information and transmits it to the manager module; the network security protection device monitors and analyzes the network traffic through the switch traffic mirror port, generates an alarm log for the attack traffic, and transmits it to the type-II monitoring device; the manager module obtains the alarm date of the network security protection device from the type-II monitoring device or directly obtains the alarm log from the network security protection device; the manager module obtains an effective alarm log through quintuple association analysis and AI large model evaluation technology, and calculates the confrontation capability score of the security protection device according to the number of effective alarms and the total number of simulated attacks in combination with the simulated attack information sent by the simulated service module.

[0005] Furthermore, the simulated attack information includes: simulated attack script ID, simulated attack name, source IP, source port, destination IP, destination port, protocol, and time when the simulated attack occurs.

[0006] Furthermore, the alarm log information includes: the name of the network security protection device that alarmed, the alarm name, the source IP, the source port, the destination IP, the destination port, the protocol, and the alarm time.

[0007] Furthermore, the five-tuple information is source IP, source port, destination IP, destination port, and protocol.

[0008] Furthermore, the confrontation capability score formula of the security protection equipment is calculated based on the number of valid alarms and the total number of simulated attacks as follows: confrontation capability score = number of valid alarms / total number of simulated attacks.

[0009] The network security attack and defense capability evaluation system for a power monitoring system of the present invention comprises: Simulation attack module: used to transmit the simulation attack information to the simulation service module through the switch; Simulation service module: used to record the attack information after receiving the simulated attack sent by the simulation attack module and transmit it to the manager module; Network security protection equipment: used to monitor and analyze network traffic through the switch traffic mirror port, generate alarm logs for attack traffic, and transmit them to the Type II monitoring device; Manager module: used to obtain the alarm date of network security protection equipment from the type-II monitoring device or directly obtain the alarm log from the network security protection equipment; used to obtain effective alarm logs through quintuple association analysis and AI large model evaluation technology, and combined with the simulated attack information sent by the simulation service module, calculate the confrontation capability score of the security protection equipment according to the number of effective alarms and the total number of simulated attacks.

[0010] Furthermore, in the simulated attack module, the simulated attack information includes: simulated attack script ID, simulated attack name, source IP, source port, destination IP, destination port, protocol, and time when the simulated attack occurs.

[0011] Furthermore, in the network security protection device, the alarm log information includes: the name of the network security protection device of the alarm, the alarm name, the source IP, the source port, the destination IP, the destination port, the protocol, and the alarm time.

[0012] Furthermore, in the manager module, the five-tuple information is source IP, source port, destination IP, destination port, and protocol.

[0013] Furthermore, in the manager module, the anti-attack capability score formula of the security protection equipment is calculated based on the number of valid alarms and the total number of simulated attacks as follows: Anti-attack capability score = number of valid alarms / total number of simulated attacks.

[0014] A device described in the present invention includes a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, any one of the methods for evaluating network security attack and defense capabilities for a power monitoring system is implemented.

[0015] A storage medium described in the present invention stores a computer program, and the computer program is designed to implement any one of the methods for evaluating network security attack and defense capabilities for a power monitoring system when running.

[0016] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: a method of using simulated service perception to simulate attacks, which can ensure that the simulated attack traffic passes through the switch and is then monitored by the network security protection device; five-tuple matching combined with AI large model intelligent evaluation to filter alarm logs improves the accuracy of the adversarial capability assessment; a comprehensive assessment of the monitoring capability of network security protection equipment in an actual adversarial environment is achieved, thereby providing an important basis for equipment optimization and improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flow chart of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0019] like Figure 1 As shown, an embodiment of the present invention provides a network security attack and defense confrontation capability assessment method for an electric power monitoring system, comprising the following steps: a simulated attack module transmits simulated attack information to a simulated service module through a switch; after receiving the simulated attack sent by the simulated attack module, the simulated service module records the attack information and transmits it to the manager module; the network security protection device monitors and analyzes the network traffic through the switch traffic mirror port, generates an alarm log for the attack traffic, and transmits it to the type-two monitoring device; the manager module obtains the alarm date of the network security protection device from the type-two monitoring device or directly obtains the alarm log from the network security protection device; the manager module obtains an effective alarm log through quintuple association analysis and AI large model evaluation technology, and calculates the confrontation capability score of the security protection device according to the number of effective alarms and the total number of simulated attacks in combination with the simulated attack information sent by the simulated service module.

[0020] Among them, the simulated attack information includes: simulated attack script ID, simulated attack name, source IP, source port, destination IP, destination port, protocol, and the time when the simulated attack occurred. The alarm log information includes: the name of the network security protection device that alarmed, the alarm name, source IP, source port, destination IP, destination port, protocol, and alarm time. The five-tuple information used for correlation analysis is source IP, source port, destination IP, destination port, and protocol. The specific process is as follows: The simulated attack module uses a short connection to send simulated attacks, thereby ensuring that the simulated attack script ID corresponds to the source port one by one.

[0021] Furthermore, after the simulated service module is subjected to a simulated attack, the simulated attack information is recorded and sent to the manager module.

[0022] Furthermore, the network security protection device monitors the network traffic, generates alarm logs and finally sends them to the manager module.

[0023] Furthermore, the manager module finds the correspondence between the simulated attack script ID and the alarm name through quintuple association analysis.

[0024] Furthermore, the manager module uses AI big model evaluation technology to analyze the semantic relevance between the simulated attack name and the alarm name, thereby eliminating false alarms and screening out effective alarms. The specific prompt words are as follows: "You are a network security expert and are evaluating the monitoring capabilities of security equipment. The name of the attack test script is <simulated attack name>, and the alarm name of the security equipment is <alarm name>. Is the name of the attack test script related to the alarm name of the security equipment? Your conclusion is one of "not relevant, generally relevant, very relevant". Answer in the following format: \nConclusion: not relevant, generally relevant, or very relevant \nReason: your explanation." Finally, the anti-attack capability score formula of the security protection equipment is calculated based on the number of effective alarms and the total number of simulated attacks as follows: Anti-attack capability score = number of effective alarms / total number of simulated attacks.

[0025] The embodiment of the present invention provides a network security attack and defense capability assessment system for a power monitoring system, comprising: Simulated attack module: used to transmit simulated attack information to the simulated service module through the switch; the simulated attack information includes: simulated attack script ID, simulated attack name, source IP, source port, destination IP, destination port, protocol, and the time when the simulated attack occurs.

[0026] Simulation service module: used to record the attack information after receiving the simulated attack sent by the simulation attack module and transmit it to the manager module; Network security protection equipment: used to monitor and analyze network traffic through the switch traffic mirror port, generate alarm logs for attack traffic, and transmit them to the Type II monitoring device; the alarm log information includes: the name of the network security protection equipment that alarmed, the alarm name, source IP, source port, destination IP, destination port, protocol, and alarm time.

[0027] Manager module: used to obtain the alarm date of network security protection equipment from the second-type monitoring device or directly obtain the alarm log from the network security protection equipment; used to obtain effective alarm logs through quintuple association analysis and AI large model evaluation technology, and combined with the simulated attack information sent by the simulation service module, calculate the confrontation capability score of the security protection equipment according to the number of effective alarms and the total number of simulated attacks. Among them, the quintuple information is source IP, source port, destination IP, destination port, and protocol.

[0028] The formula for calculating the security protection equipment's confrontation capability score based on the number of valid alarms and the total number of simulated attacks is as follows: confrontation capability score = number of valid alarms / total number of simulated attacks.

[0029] An embodiment of the present invention provides a device, including a memory, a processor, and a program stored in the memory and executable on the processor. When the processor executes the program, any one of the methods for evaluating network security attack and defense capabilities for a power monitoring system is implemented.

[0030] An embodiment of the present invention provides a storage medium storing a computer program, wherein the computer program is designed to implement any one of the methods for evaluating network security attack and defense capabilities for a power monitoring system when running.

Claims

1. A network security attack and defense capability assessment method for a power monitoring system, characterized in that: The following steps are involved: The simulated attack module transmits the simulated attack information to the simulated service module through the switch; After the simulation service module receives the simulated attack sent by the simulated attack module, it records the attack information and transmits it to the manager module; the network security protection device monitors and analyzes the network traffic through the switch traffic mirroring port, generates an alarm log for the attack traffic, and transmits it to the Type II monitoring device; the manager module obtains the alarm date of the network security protection device from the Type II monitoring device or directly obtains the alarm log from the network security protection device; the manager module combines the simulated attack information sent by the simulation service module, obtains the effective alarm log through quintuple association analysis and AI large model evaluation technology, and calculates the security protection device's confrontation capability score based on the number of effective alarms and the total number of simulated attacks.

2. According to claim 1, a network security attack and defense capability assessment method for a power monitoring system is characterized in that: The simulated attack information includes: simulated attack script ID, simulated attack name, source IP, source port, destination IP, destination port, protocol, and the time when the simulated attack occurred.

3. According to claim 1, a network security attack and defense capability assessment method for a power monitoring system is characterized in that: The alarm log information includes: the name of the network security protection device that alarmed, the alarm name, the source IP, the source port, the destination IP, the destination port, the protocol, and the alarm time.

4. According to claim 1, a network security attack and defense capability assessment method for a power monitoring system is characterized in that: The five-tuple information is source IP, source port, destination IP, destination port, and protocol.

5. The method for evaluating network security attack and defense capabilities of a power monitoring system according to claim 1, characterized in that: The formula for calculating the security protection equipment's confrontation capability score based on the number of valid alarms and the total number of simulated attacks is as follows: confrontation capability score = number of valid alarms / total number of simulated attacks.

6. A network security attack and defense capability assessment system for power monitoring systems, characterized in that: include: Simulation attack module: used to transmit the simulation attack information to the simulation service module through the switch; Simulation service module: used to record the attack information after receiving the simulated attack sent by the simulation attack module and transmit it to the manager module; Network security protection equipment: used to monitor and analyze network traffic through the switch traffic mirror port, generate alarm logs for attack traffic, and transmit them to the Type II monitoring device; Manager module: used to obtain the alarm date of network security protection equipment from the type-II monitoring device or directly obtain the alarm log from the network security protection equipment; used to obtain effective alarm logs through quintuple association analysis and AI large model evaluation technology, and combined with the simulated attack information sent by the simulation service module, calculate the confrontation capability score of the security protection equipment according to the number of effective alarms and the total number of simulated attacks.

7. A network security attack and defense capability assessment system for a power monitoring system according to claim 6, characterized in that: In the simulated attack module, the simulated attack information includes: simulated attack script ID, simulated attack name, source IP, source port, destination IP, destination port, protocol, and the time when the simulated attack occurs.

8. The network security attack and defense capability evaluation system for electric power monitoring system according to claim 6 is characterized in that: In network security protection devices, the alarm log information includes: the name of the network security protection device that alarms, the alarm name, the source IP, the source port, the destination IP, the destination port, the protocol, and the alarm time.

9. A network security attack and defense capability assessment system for a power monitoring system according to claim 6, characterized in that: In the manager module, the five-tuple information is source IP, source port, destination IP, destination port, and protocol.

10. A network security attack and defense capability assessment system for a power monitoring system according to claim 6, characterized in that: In the manager module, the formula for calculating the security protection equipment's confrontation capability score is as follows based on the number of valid alarms and the total number of simulated attacks: confrontation capability score = number of valid alarms / total number of simulated attacks.

11. A device comprising a memory, a processor, and a program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements a network security attack and defense capability assessment method for a power monitoring system as described in any one of claims 1-5.

12. A storage medium storing a computer program, characterized in that: The computer program is designed to implement, when running, a method for evaluating network security attack and defense capabilities for a power monitoring system according to any one of claims 1 to 5.

Images