Power data attack tracking and tracing method and system

Abstract

The invention relates to a power data attack tracking and tracing method and system. The method comprises the following steps: acquiring an abnormal node of a power system, and determining an initial attack path of the power system according to the abnormal node; determining a tree diagram corresponding to the initial attack path; the tree diagram comprises at least one tree diagram node; according to the node parameters of the tree diagram nodes, correcting the tree diagram; and determining a target attack path of the power system according to the corrected tree diagram. By adopting the method, the accuracy of power data attack tracing can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of data security management, and in particular to a method and system for tracking and tracing power data attacks. Background Art

[0002] As one of the key infrastructures, the safety and stability of the power system are closely related to economic development and social stability. With the development of informatization and intelligence, the power system has gradually integrated a large number of network communication and data transmission technologies, which makes the power system not only face traditional physical threats, but also face increasingly complex network security risks. Malicious attackers can disrupt the normal operation of the power system by tampering, forging or hijacking power data, and even cause large-scale power outages. Therefore, how to effectively track and trace power data attacks has become one of the key challenges to ensure the safety and stable operation of the power system. Traditional security protection measures, such as firewalls and intrusion detection systems, can resist attacks to a certain extent, but they often fail to provide sufficient traceability capabilities when facing highly complex and hidden attacks. Therefore, there is an urgent need to accurately identify attack paths, locate attack sources, and effectively defend and respond to attack behaviors in complex environments.

[0003] At present, the user characteristic data of the power system can be first decomposed into tensors, and then the behavior baseline analysis can be performed through a pre-configured behavior baseline prediction model. Finally, the obtained behavior baseline can be analyzed using an ant colony algorithm to obtain the user attack path. However, the comprehensiveness and reliability of this method in tracing and tracing are low, and the traceability capability in large-scale and complex power networks is low, which is prone to misjudgment due to data errors or random disturbances.

[0004] Therefore, there are inaccuracies in the current power data attack tracking and tracing technology. Summary of the invention

[0005] Based on this, it is necessary to provide a more accurate method, device, computer equipment, computer-readable storage medium and computer program product for tracking and tracing power data attacks in response to the above-mentioned technical problems.

[0006] In a first aspect, the present application provides a method for tracing and tracing a power data attack, comprising:

[0007] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0008] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0009] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0010] According to the modified tree diagram, a target attack path of the power system is determined.

[0011] In one embodiment, the method further comprises:

[0012] Determining at least one attack type corresponding to the tree diagram node;

[0013] Determining a decision criterion corresponding to each of the attack types;

[0014] Obtaining a type score corresponding to each of the attack types according to the criterion weight of the decision criterion;

[0015] The type scores are sorted to obtain node parameters of the tree diagram nodes.

[0016] In one embodiment, the modifying the dendrogram according to the node parameters of the dendrogram nodes includes:

[0017] Determine the upper confidence bound score of each child node connected to the current node according to the node parameters;

[0018] Determining a target child node from among the child nodes according to the upper confidence bound score;

[0019] The tree diagram is modified according to the target child node.

[0020] In one embodiment, the modifying the tree diagram according to the target child node includes:

[0021] Determining node parameters of the target child node;

[0022] According to the node parameters of the target child node, the upper confidence bound score of the current node is updated, and the process of determining the target child node from the child nodes according to the upper confidence bound score is returned until a preset termination condition is met;

[0023] The tree diagram is modified according to each determined target sub-node.

[0024] In one embodiment, obtaining abnormal nodes of the power system includes:

[0025] Formatting the power data of the power system;

[0026] Normalizing the formatted power data;

[0027] Inputting the normalized power data into a pre-trained recognition model to obtain attack features of the power data;

[0028] According to the attack characteristics, abnormal nodes of the power system are determined.

[0029] In one embodiment, determining the initial attack path of the power system according to the abnormal node includes:

[0030] Connecting the abnormal nodes to obtain candidate attack paths for the power system;

[0031] The initial attack path is determined from the candidate attack paths by simulating the power system.

[0032] In one embodiment, the method further comprises:

[0033] Determining the location and identity of the attack source in the power system according to the target attack path;

[0034] The location and identity of the attack source are displayed.

[0035] In a second aspect, the present application also provides a power data attack tracking and tracing device, comprising:

[0036] An acquisition module, used for acquiring abnormal nodes of the power system, and determining an initial attack path of the power system according to the abnormal nodes;

[0037] A determination module, used to determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0038] A correction module, used for correcting the tree diagram according to the node parameters of the tree diagram nodes;

[0039] The tracking module is used to determine the target attack path of the power system according to the modified tree diagram.

[0040] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0041] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0042] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0043] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0044] According to the modified tree diagram, a target attack path of the power system is determined.

[0045] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0046] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0047] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0048] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0049] According to the modified tree diagram, a target attack path of the power system is determined.

[0050] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0051] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0052] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0053] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0054] According to the modified tree diagram, a target attack path of the power system is determined.

[0055] The above-mentioned power data attack tracing and source tracing method, device, computer equipment, computer-readable storage medium and computer program product obtain abnormal nodes of the power system, determine the initial attack path of the power system according to the abnormal nodes, determine the tree diagram corresponding to the initial attack path, correct the tree diagram according to the node parameters of the tree diagram nodes, and determine the target attack path of the power system according to the corrected tree diagram; the attack path in the power system can be identified based on the tree diagram, and the accuracy of the tree diagram can be improved by continuously correcting the tree diagram to improve the accuracy of the power data attack tracing and source tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0057] FIG1 is a schematic diagram of a flow chart of a method for tracing and tracing a power data attack in one embodiment;

[0058] FIG2 is a schematic diagram of a flow chart of a method for tracing and tracing a power data attack in another embodiment;

[0059] FIG3 is a structural block diagram of a power data attack tracing and source tracking system in one embodiment;

[0060] FIG4 is a schematic diagram of a flow chart of a method for tracing and tracing a power data attack in another embodiment;

[0061] FIG5 is a structural block diagram of a power data attack tracing and source tracking device in one embodiment;

[0062] FIG. 6 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0065] In an exemplary embodiment, as shown in FIG1 , a method for tracing and tracing the source of an attack on power data is provided. This embodiment uses the method applied to a terminal as an example. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0066] Step S102, obtaining abnormal nodes of the power system, and determining an initial attack path of the power system according to the abnormal nodes.

[0067] The power system may be an electric energy production and consumption system composed of power plants, power transmission and transformation lines, power distribution stations, and power consumption. The abnormal node may be a node in the power system that is attacked and has abnormal data, such as a power plant or power distribution station with abnormal data. The initial attack path may be an initially determined attack path.

[0068] In the specific implementation, data from each node in the power system can be collected and input into the terminal. The terminal identifies abnormal data from the input data and determines the node corresponding to the abnormal data as an abnormal node. The terminal can also build a topology map based on the connection between the nodes in the power system, mark the abnormal nodes in the topology map, and form an initial attack path based on the routing links between the abnormal nodes.

[0069] For example, the voltage, current, power, flow, equipment status, port information, etc. of nodes such as power plants and power distribution stations in the power system can be obtained, and nodes with abnormal voltage or current fluctuations, abnormal power changes, abnormal equipment status, abnormal flow peaks, abnormal communication paths or ports, etc. can be identified as abnormal nodes. Assuming that there are abnormal nodes A, B, C, D, E, F, and G, the initial attack paths ABD, ABE, ACF, and ACG can be formed based on the routing links of the abnormal nodes in the topology map.

[0070] Step S104, determining a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node.

[0071] The tree diagram node may be a node in the tree diagram, including a root node and child nodes.

[0072] In a specific implementation, the terminal may obtain a tree diagram according to the initial attack path. The tree diagram includes a root node and multiple child nodes under the root node. The root node and the child nodes may constitute a tree diagram node.

[0073] For example, for the initial attack paths ABD, ABE, ACF, and ACG, A can be used as the root node, the first-level child nodes under the root node are B and C, the second-level child nodes are D, E, F, and G, and the tree diagram nodes are A, B, C, D, E, F, and G.

[0074] Step S106, modifying the dendrogram according to the node parameters of the dendrogram nodes.

[0075] The node parameter may be a score obtained by the tree diagram node under a specified attack type according to a preset decision criterion.

[0076] In a specific implementation, the terminal may pre-set one or more attack types for each tree diagram node, determine one or more decision criteria corresponding to each attack type, and the weight corresponding to each decision criterion. The attack types, decision criteria, and weights corresponding to different tree diagram nodes may be different. Then, for each tree diagram node, the decision criteria may be weighted and summed according to the weight to obtain the score corresponding to the corresponding one or more attack types. The score may constitute the node parameter of the tree diagram node, and the tree diagram may be corrected using the node parameter.

[0077] For example, the node parameters o, p, q, r, s, t, and u of A, B, C, D, E, F, and G may be determined in sequence, and the node parameters may be vectors. If the same attack type exists in o, p, and r, and the score corresponding to the attack type meets a preset condition (for example, the score exceeds a preset score), and the same attack type does not exist in other node parameters, or the score corresponding to the same attack type does not meet the preset condition, then only ABD may be retained in the tree diagram determined in step S104, and other initial attack paths may be removed to obtain a modified tree diagram.

[0078] Step S108, determining the target attack path of the power system according to the modified tree diagram.

[0079] The target attack path may be a finally determined attack path of the power system.

[0080] In a specific implementation, the terminal can determine the target attack path of the power system according to the tree structure in the modified tree diagram.

[0081] For example, ABD is retained in the tree diagram, so the target attack path of the power system can be determined to be ABD. Furthermore, the starting point of the target attack path can be determined based on the time when A, B, and D are attacked respectively. For example, if D is attacked earlier than A, D can be determined as the starting point and the target attack path is DBA.

[0082] The above-mentioned power data attack tracing and source tracing method obtains the abnormal nodes of the power system, determines the initial attack path of the power system according to the abnormal nodes, determines the tree diagram corresponding to the initial attack path, modifies the tree diagram according to the node parameters of the tree diagram nodes, and determines the target attack path of the power system according to the modified tree diagram; the attack path in the power system can be identified based on the tree diagram, and the accuracy of the tree diagram can be improved by continuously modifying the tree diagram to improve the accuracy of the power data attack tracing and source tracing.

[0083] It is understandable that, before the above step S106, it may also include: determining at least one attack type corresponding to the tree diagram node; determining the decision criteria corresponding to each attack type; obtaining the type score corresponding to each attack type according to the criterion weight of the decision criteria; and sorting the type scores to obtain the node parameters of the tree diagram node.

[0084] The attack type may be the type of attack on power data, such as database attack, phishing attack, denial of service attack, etc. The decision criterion may be a criterion for evaluating the attack type, including but not limited to a calculation formula, a scoring rule, etc. The criterion weight may be the weight of the decision criterion. The type score may be the score of the attack type.

[0085] In a specific implementation, the terminal can pre-set one or more attack types according to the properties of each tree diagram node, determine one or more decision criteria corresponding to each attack type, and the criterion weight corresponding to each decision criterion, perform weighted summation of the decision criteria according to the criterion weights, obtain the type scores corresponding to the corresponding one or more attack types, sort the type scores in descending order, and obtain the node parameters of the tree diagram nodes.

[0086] In this embodiment, by determining at least one attack type corresponding to a dendrogram node; determining a decision criterion corresponding to each attack type; obtaining a type score corresponding to each attack type based on the criterion weight of the decision criterion; and sorting the type scores to obtain node parameters of the dendrogram nodes, node parameters can be generated based on the impact of various attack types on the dendrogram nodes, and the impact of the attack type on the dendrogram nodes can be quantified, thereby improving the accuracy of power data attack tracking and tracing.

[0087] In an exemplary embodiment, the above step S106 may specifically include: determining the upper confidence bound score of each child node connected to the current node according to the node parameters; determining the target child node from each child node according to the upper confidence bound score; and modifying the dendrogram according to the target child node.

[0088] The upper confidence bound score may be a score obtained by an upper confidence bound algorithm (Upper Confidence Bound 1, UCB1). The current node may be the current dendrogram node. The child node may be a child node of the current node. The target child node may be a selected child node.

[0089] In a specific implementation, the terminal can substitute the node parameters into the UCB1 formula, and use the UCB1 formula to calculate the upper confidence bound score of each child node connected to the current node in the tree diagram. If the upper confidence bound score meets the preset conditions (for example, the upper confidence bound score is the highest), the corresponding child node is determined as the target child node. After that, the above processing can be performed on each child node below the target child node to select a new target child node until the bottom layer of the tree diagram is reached. Finally, the tree diagram can be corrected according to the target child nodes selected from each layer, so that only the target child nodes of each layer are retained in the tree diagram, and these target child nodes can constitute the target attack path.

[0090] For example, the child nodes connected to the current node A are B and C, and the upper confidence bound score of B is higher than the upper confidence bound score of C, so B is selected as the target child node; the child nodes connected to B are D and E, and the upper confidence bound score of D is higher than the upper confidence bound score of E, so D is selected as the new target child node; therefore, the dendrogram is modified according to ABD so that only ABD is retained in the dendrogram, and the target attack path can be determined to be ABD.

[0091] In this embodiment, the upper confidence bound score of each child node connected to the current node is determined according to the node parameters; the target child node is determined from each child node according to the upper confidence bound score; the tree diagram is corrected according to the target child node, and the target attack path can be determined through iteration to improve the accuracy of power data attack tracking and tracing.

[0092] In an exemplary embodiment, the above-mentioned step of modifying the tree diagram according to the target child node may specifically include: determining the node parameters of the target child node; updating the upper confidence bound score of the current node according to the node parameters of the target child node, and returning to the step of determining the target child node from each child node according to the upper confidence bound score until a preset termination condition is met; and modifying the tree diagram according to each determined target child node.

[0093] The preset termination condition may be reaching a preset number of iterations or reaching a preset search time.

[0094] In a specific implementation, the terminal can calculate the node parameters of the target child node, pass the node parameters of the target child node back to the current child node, and substitute them into the UCB1 formula to obtain the upper confidence bound score of the current node, and repeat the above process of determining the target child node from each child node according to the upper confidence bound score until a preset number of iterations or a preset search time is reached, and select an optimal target child node (for example, the one with the highest similarity to the current node) from the one or more target child nodes finally determined, and retain the target child node in the tree diagram to achieve the correction of the tree diagram.

[0095] In practical applications, the currently known attack path or starting point is used as the root node. The initial state of the root node is initialized according to the current simulation results and actual power data. Each attack path selection or state change is used as a child node, and the root node is connected to each child node. The path value and the number of visits of each node are initialized. The upper confidence bound score of each group of nodes is calculated by the UCB1 formula, and the node with the highest confidence bound score on each subsequent child node of the current node is selected as the current optimal path node. It is detected whether the selected node is a fully expanded node. If so, the new path branch is expanded from the selected optimal node to generate a new child node. Otherwise, the node selection is performed again, and the selection and expansion are repeated until the preset maximum depth is reached and then stopped. The newly expanded path is simulated by simulating the execution of the attack path to evaluate the effect of the path and Calculate the path value of the new node as the initial benefit of the node, then return the path value obtained by simulation and add it to the cumulative path value of each corresponding node, increase the number of visits to the node, return the evaluation result of the new path node layer by layer, update the upper confidence bound score of the parent node and its ancestor node, repeat the selection, expansion, simulation and backtracking process, and use the upper confidence bound strategy to select the optimal node for expansion in each iteration. When the preset number of iterations or search time is reached, terminate the iterative process and select the path with the highest cumulative benefit as the optimal path. Based on the selected optimal path, correct the attack tracing path, and verify the corrected attack tracing path by comparing it with the simulation results and actual power data. After verification, output the corrected attack tracing path as the final result, and generate a detailed report for decision support.

[0096] In this embodiment, by determining the node parameters of the target sub-node; updating the upper confidence bound score of the current node according to the node parameters of the target sub-node, and returning to the step of determining the target sub-node from each sub-node according to the upper confidence bound score until the preset termination condition is met; and correcting the tree diagram according to each determined target sub-node, the target attack path can be quickly determined, thereby improving the efficiency of power data attack tracking and tracing.

[0097] In an exemplary embodiment, the above step S102 may specifically include: formatting the power data of the power system; normalizing the formatted power data; inputting the normalized power data into a pre-trained recognition model to obtain attack features of the power data; and determining abnormal nodes of the power system based on the attack features.

[0098] The recognition model may be, but is not limited to, a neural network model, such as a long short-term memory network (LSTM). The attack feature may be data reflecting that the power data is under attack, including but not limited to abnormal voltage or current fluctuations, abnormal power changes, abnormal device status, abnormal traffic peaks, abnormal communication paths or ports, etc.

[0099] In a specific implementation, after obtaining the power data of the power system, the terminal can first format the power data, then normalize the formatted power data, and then input the normalized power data into a pre-trained recognition model to obtain the attack characteristics of the power data, and determine the abnormal nodes in the power system based on the attack characteristics and the topological connection between the nodes in the power system.

[0100] For example, the current, voltage, power, equipment status, flow, port and other data of each node in the power system are collected, formatted and normalized, and then input into the pre-trained LSTM model to identify abnormal voltage or current fluctuations, abnormal power changes, abnormal equipment status, abnormal flow peaks, communication path or port abnormalities, etc., and the nodes where these situations occur are regarded as abnormal nodes.

[0101] In this embodiment, by formatting the power data of the power system; normalizing the formatted power data; inputting the normalized power data into a pre-trained recognition model to obtain the attack characteristics of the power data; and determining the abnormal nodes of the power system based on the attack characteristics, the abnormal nodes in the power system can be quickly and accurately identified, thereby improving the accuracy and efficiency of power data attack tracking and tracing.

[0102] In an exemplary embodiment, the above step S102 may further specifically include: connecting abnormal nodes to obtain candidate attack paths of the power system; and determining an initial attack path from the candidate attack paths by simulating the power system.

[0103] The candidate attack path may be a candidate initial attack path.

[0104] In a specific implementation, the terminal can connect the abnormal nodes according to the topological connection between the abnormal nodes to obtain one or more candidate attack paths. By simulating the power system, incorrect attack paths are screened out from the candidate attack paths and deleted. The remaining attack paths are the initial attack paths.

[0105] In this embodiment, by connecting abnormal nodes, candidate attack paths for the power system are obtained; by simulating the power system, an initial attack path is determined from the candidate attack paths, and the candidate attack paths can be screened through simulation to obtain a more reliable initial attack path, thereby improving the accuracy of power data attack tracking and tracing.

[0106] It is understandable that after the above step S108, the following may also be included: determining the location and identity of the attack source in the power system according to the target attack path; and displaying the location and identity of the attack source.

[0107] The location may be, but is not limited to, an IP address or a geographical location of the attack source. The identity may be an identity identifier of the attack source.

[0108] In a specific implementation, after determining the target attack path, the terminal can determine the location of the attack source in the power system and the identity of the attack source according to the target attack path, and display the location and identity of the attack source on the display.

[0109] In this embodiment, the location and identity of the attack source in the power system are determined according to the target attack path; the location and identity of the attack source are displayed, which can assist management personnel in formulating response strategies in a timely manner for power data attacks.

[0110] In order to facilitate those skilled in the art to have a deeper understanding of the embodiments of the present application, a specific example will be described below.

[0111] In one embodiment, referring to FIG. 2 , a method for tracing and tracing the source of power data attacks is proposed. The specific steps of the tracing method are as follows:

[0112] Step S201, collecting data from each node of the power system and extracting attack features.

[0113] Specifically, each group of collected power data and network flow data is formatted, and then each group of processed data is normalized and scaled to [0,1] or [-1,1], and each group of normalized data is divided in chronological order to form a training set and a validation set, and a set of LSTM network models is constructed. The training data is input into the LSTM network model, and then the LSTM network model gradually updates the weights and biases of the model through the forward propagation algorithm and the back propagation algorithm. At the same time, after each round of training cycle, the model performance is evaluated through the validation set data, and the model hyperparameters are adjusted according to the evaluation results. After the LSTM network model is trained, the model is used to forward propagate the current power data and network flow data, and the feature data in each data is captured through the hidden layer of the LSTM network model. Then, the high-dimensional features are reduced in dimension through the t-Stochastic Neighborhood Embedding (t-SNE) method, and the processed feature data is stored in the database or memory.

[0114] Step S202: prioritize and record different attack types and attack paths.

[0115] Specifically, identifying and sorting different attack types and attack paths is set as a decision-making goal, and decision criteria for evaluating attack types and attack paths are generated based on the decision goal. According to the expert scoring method and the safety requirements and risk assessment of the power system generated by the hierarchical analysis method, a weight is assigned to each decision criterion, and the information on attack complexity and potential hazards contained in the historical attack data corresponding to each decision criterion and the feature data extracted by the LSTM network model are collected. The data under different criteria are processed by normalization or standardization, and a decision matrix is ​​constructed for all the data of all attack types and paths according to each decision criterion. The rows of the matrix represent different attack types or paths, and the columns represent different decision criteria. The comprehensive score of each attack path is calculated by weighted average. According to the calculated comprehensive score, all attack types and attack paths are sorted from high to low, and the attack paths or types with higher scores are considered to have higher threats. At the same time, the priority sorting results are presented in the form of charts or reports for reference by safety managers of the power system.

[0116] Step S203, generating an attack path according to the abnormal points of the power data and optimizing the path information.

[0117] Step S204: Perform simulation analysis on the power system to verify the accuracy of the traceability path.

[0118] Step S205, correct the attack tracing path based on the simulation results and the actual power data.

[0119] Specifically, the currently known attack path or starting point is used as the root node, and the initial state of the root node is initialized according to the current simulation results and actual power data. Each attack path selection or state change is used as a child node, and the root node is connected to each child node. The path value of each node (the path value specifically includes the power state index and network traffic index of the node, as well as the weight of the path, i.e., attack risk and response time, etc.) and the number of visits are initialized. The upper confidence bound score of each group of nodes is calculated by the UCB1 formula (specifically related to the potential impact of the attack path, the number of historical visits to the path, the attack success rate, the path risk, and the simulation results), and the node with the highest confidence bound score on each subsequent child node of the current node is selected as the current optimal path node. It is detected whether the selected node is a fully expanded node. If so, starting from the selected optimal node, a new path branch is expanded to generate a new child node. Otherwise, the node selection is performed again, and the selection and expansion are repeated until it reaches the optimal node. It stops after the preset maximum depth, simulates the newly extended path by simulating the execution of the attack path, evaluates the effect of the path, and calculates the path value of the new node as the initial benefit of the node. Then, the path value obtained by simulation is returned and accumulated to the cumulative path value of each corresponding node. At the same time, the number of visits to the node is increased, and the evaluation results of the new path node are returned layer by layer, and the upper confidence bound scores of the parent node and its ancestor nodes are updated. The selection, expansion, simulation and backtracking process are repeated. In each iteration, the upper confidence bound strategy is used to select the optimal node for expansion. When the preset number of iterations or search time is reached, the iterative process is terminated, and the path with the highest cumulative benefit is selected as the optimal path. Based on the selected optimal path, the attack tracing path is corrected, and the corrected attack tracing path is verified by comparing it with the simulation results and actual power data. After verification, the corrected attack tracing path is output as the final result, and a detailed report is generated for decision support.

[0120] Step S206: Analyze each node in the path to determine the location and identity of the attack source.

[0121] Step S207, output the traceability results and assist management personnel in formulating response strategies.

[0122] In another embodiment, referring to FIG. 3 , a power data attack tracking and tracing system is proposed, including an acquisition and processing module, a feature extraction module, a parameter optimization module, an attack detection module, a path initialization module, a simulation analysis module, a correction evaluation module, a tracing and locating module, and a report output module.

[0123] The acquisition and processing module is used to collect power data and network traffic data from the power system and perform data cleaning and formatting. The feature extraction module is used to extract key attack features from the fused data through the LSTM network model. The parameter optimization module is used to monitor the feature extraction process in real time and optimize the parameter settings.

[0124] The attack detection module is used to detect potential attack behaviors based on attack characteristics through classification algorithms and trigger alarms; the path initialization module is used to prioritize each attack path and preliminarily determine the attack path with the highest processing priority; the simulation analysis module is used to simulate different attack paths in a virtual simulation environment and evaluate their feasibility and impact on the power system.

[0125] The correction evaluation module is used to deeply explore and optimize the preliminary path, and to correct the preliminary attack path by combining simulation and actual data; the source tracing and positioning module is used to analyze the final corrected path and locate the source of the attack.

[0126] Specifically, the corrected attack path is matched and analyzed with the key data in the multi-source information, and different weights are assigned to the nodes in the path according to the analysis results of the multi-source information. The larger the weight, the more likely the node is the attack source or close to the attack source. According to the importance of the path and the distribution of the nodes, the control points are selected, the set control points are calculated by the Bailey curve formula, and the corresponding curves are drawn to generate a smooth path. Multiple groups of intermediate points are inserted into the generated path, and the interpolated curves are fitted with the original path. The fitted path is segmented, and the abnormal areas on the path are identified. The identified areas are then marked as candidate points of key nodes to generate preliminary key node candidates. Select a set, calculate the feature weight of each candidate node in the key node candidate set, and sort the candidate nodes from high to low according to the feature weight. According to the preset feature weight threshold, the nodes that do not reach the threshold in the key node candidate set are screened out, and the screened key nodes are compared and verified with the original power data and network traffic data. After the verification, the extracted key nodes are analyzed in combination with the correlation of multi-source information, and based on the analysis results, the location of the attack source is finally determined, and the determined attack source location is compared with the actual power system data and network traffic. If the degree of consistency between the positioning and the actual system situation exceeds the preset threshold, the positioning is completed. If it is lower than the preset threshold, the positioning fails and re-positioning is performed.

[0127] The report output module is used to generate a detailed report of the final attack tracing path.

[0128] Compared with the prior art, the beneficial effect of the above embodiment is that: the power data attack tracing and source tracing method takes the currently known attack path or starting point as the root node, initializes the initial state of the root node according to the current simulation results and the actual power data, selects each attack path or changes the state as a child node, and connects the root node with each child node, selects the node with the highest confidence bound score on each subsequent child node of the current node as the current optimal path node, and expands new path branches, generates new child nodes, and repeatedly selects and expands until the preset maximum depth is reached and stops, simulates the newly expanded path by simulating the execution of the attack path, evaluates the effect of the path, and calculates the path value of the new node as the initial benefit of the node, then returns the simulated path value and accumulates it to the corresponding cumulative path value of each node, and increases the number of visits to the node at the same time. The evaluation results of the new path nodes are transmitted back layer by layer, and the upper confidence bound scores of the parent nodes and their ancestor nodes are updated. The selection, expansion, simulation and backtracking processes are repeated. In each iteration, the upper confidence bound strategy is used to select the optimal node for expansion. When the preset number of iterations or search time is reached, the iteration process is terminated, and the path with the highest cumulative benefit is selected as the optimal path. The attack tracing path is corrected based on the selected optimal path, and the corrected attack tracing path is verified by comparing it with the simulation results and actual power data. After the verification, the corrected attack tracing path is output as the final result, and a detailed report is generated for decision support, which improves the accuracy of the corrected path and the comprehensiveness and reliability of the tracing, enhances the tracing capability in large-scale complex power networks, reduces misjudgments caused by data errors or random disturbances, and greatly reduces the complexity and workload of manual operations.

[0129] Moreover, the power data attack tracking and tracing system matches and analyzes the corrected attack path with the key data in the multi-source information, and assigns different weights to each node in the path according to the analysis results of the multi-source information. According to the importance of the path and the distribution of the nodes, the control points are selected, the set control points are calculated, and the corresponding curves are drawn to generate a smooth path. Multiple groups of intermediate points are inserted on the generated path, and the interpolated curves are fitted with the original path, and the abnormal areas on the path are identified. The identified areas are then marked as candidate points for the key nodes, the feature weights of each candidate node are calculated, and the candidate nodes are sorted from high to low according to the feature weights. According to the preset features, The weight threshold is used to filter out nodes that do not reach the threshold in the key node candidate set, and the filtered key nodes are compared with the original power data and network traffic data for verification. After the verification, the extracted key nodes are analyzed in combination with the correlation of multi-source information, and the location of the attack source is finally determined based on the analysis results. The determined attack source location is compared with the actual power system data and network traffic. If the degree of consistency between the positioning and the actual system situation exceeds the preset threshold, the positioning is completed. If it is lower than the preset threshold, the positioning fails and re-positioning is performed. It can comprehensively analyze various types of information, improve the accuracy of attack source positioning, ensure that the system can stably locate the attack source, and improve the security of the overall power system.

[0130] In one embodiment, as shown in FIG4 , a method for tracing and tracing a power data attack is provided, comprising the following steps:

[0131] Step S401, obtaining abnormal nodes of the power system, and determining an initial attack path of the power system according to the abnormal nodes;

[0132] Step S402, determining a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0133] Step S403, determining at least one attack type corresponding to a dendrogram node, determining a decision criterion corresponding to each attack type, obtaining a type score corresponding to each attack type according to a criterion weight of the decision criterion, sorting the type scores, and obtaining node parameters of the dendrogram nodes;

[0134] Step S404, modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0135] Step S405, determining a target attack path of the power system according to the modified tree diagram;

[0136] Step S406, determining the location and identity of the attack source in the power system according to the target attack path, and displaying the location and identity of the attack source.

[0137] In a specific implementation, the terminal can identify abnormal data from the power data, determine the power node corresponding to the abnormal data as an abnormal node, generate an initial attack path according to the topological connection between the abnormal nodes, generate a tree diagram according to the initial attack path, set one or more attack types in advance according to the properties of each tree diagram node, determine one or more decision criteria corresponding to each attack type, and the criterion weight corresponding to each decision criterion, perform weighted summation of the decision criteria according to the criterion weights, obtain the type score corresponding to the corresponding one or more attack types, sort the type scores in descending order, obtain the node parameters of the tree diagram node, determine the upper confidence bound score of each child node connected to the current node according to the node parameters, determine the target child node from each child node according to the upper confidence bound score, modify the tree diagram according to the target child node, determine the target attack path of the power system according to the modified tree diagram, determine the location and identity of the attack source in the power system based on the target attack path, and display the location and identity on the display.

[0138] The above-mentioned power data attack tracing and source tracing method obtains abnormal nodes of the power system, determines the initial attack path of the power system according to the abnormal nodes, determines the tree diagram corresponding to the initial attack path, determines at least one attack type corresponding to the tree diagram node, determines the decision criteria corresponding to each attack type, obtains the type score corresponding to each attack type according to the criterion weight of the decision criteria, sorts the type scores, obtains the node parameters of the tree diagram nodes, corrects the tree diagram according to the node parameters of the tree diagram nodes, determines the target attack path of the power system according to the corrected tree diagram, determines the location and identity of the attack source in the power system according to the target attack path, and displays the location and identity of the attack source; the attack path in the power system can be identified based on the tree diagram, and the accuracy of the tree diagram can be improved by continuously correcting the tree diagram.

[0139] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0140] Based on the same inventive concept, the embodiment of the present application also provides a power data attack tracing and tracing device for implementing the power data attack tracing and tracing method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more power data attack tracing and tracing device embodiments provided below can refer to the limitations of the power data attack tracing and tracing method above, and will not be repeated here.

[0141] In an exemplary embodiment, as shown in FIG5 , a power data attack tracing and source tracking device is provided, including: an acquisition module 502 , a determination module 504 , a correction module 506 and a tracking module 508 , wherein:

[0142] An acquisition module 502 is used to acquire abnormal nodes of the power system and determine an initial attack path of the power system according to the abnormal nodes;

[0143] A determination module 504 is used to determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0144] A correction module 506, used for correcting the tree diagram according to the node parameters of the tree diagram nodes;

[0145] The tracking module 508 is used to determine the target attack path of the power system according to the modified tree diagram.

[0146] In an exemplary embodiment, the above-mentioned power data attack tracking and tracing device also includes a parameter module, which is used to determine at least one attack type corresponding to the tree diagram node; determine the decision criteria corresponding to each of the attack types; obtain the type score corresponding to each of the attack types according to the criterion weights of the decision criteria; sort the type scores to obtain the node parameters of the tree diagram nodes.

[0147] In an exemplary embodiment, the correction module 506 is further used to determine the upper confidence bound score of each child node connected to the current node according to the node parameters; determine the target child node from the child nodes according to the upper confidence bound score; and correct the tree diagram according to the target child node.

[0148] In an exemplary embodiment, the correction module 506 is also used to determine the node parameters of the target child node; based on the node parameters of the target child node, update the upper confidence bound score of the current node, and return to the step of determining the target child node from the child nodes based on the upper confidence bound score until a preset termination condition is met; and based on the determined target child nodes, correct the tree diagram.

[0149] In an exemplary embodiment, the acquisition module 502 is also used to format the power data of the power system; normalize the formatted power data; input the normalized power data into a pre-trained recognition model to obtain attack features of the power data; and determine abnormal nodes of the power system based on the attack features.

[0150] In an exemplary embodiment, the acquisition module 502 is further used to connect the abnormal nodes to obtain candidate attack paths of the power system; and to determine the initial attack path from the candidate attack paths by simulating the power system.

[0151] In an exemplary embodiment, the above-mentioned power data attack tracking and tracing device also includes a display module, which is used to determine the location and identity of the attack source in the power system according to the target attack path; and display the location and identity of the attack source.

[0152] Each module in the above-mentioned power data attack tracking and tracing device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0153] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG6. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a method for tracking and tracing the source of power data attacks is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0154] Those skilled in the art will understand that the structure shown in FIG. 6 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0155] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0156] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0157] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0158] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0159] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0160] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0161] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for tracing and tracing power data attacks, characterized in that: The method comprises: Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes; Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node; Modifying the dendrogram according to the node parameters of the dendrogram nodes; According to the modified tree diagram, a target attack path of the power system is determined.

2. The method according to claim 1, characterized in that The method further comprises: Determining at least one attack type corresponding to the tree diagram node; Determining a decision criterion corresponding to each of the attack types; Obtaining a type score corresponding to each of the attack types according to the criterion weight of the decision criterion; The type scores are sorted to obtain node parameters of the tree diagram nodes.

3. The method according to claim 1, characterized in that The step of modifying the dendrogram according to the node parameters of the dendrogram nodes comprises: Determine the upper confidence bound score of each child node connected to the current node according to the node parameters; Determining a target child node from among the child nodes according to the upper confidence bound score; The tree diagram is modified according to the target child node.

4. The method according to claim 3, characterized in that The step of modifying the tree diagram according to the target child node includes: Determine node parameters of the target child node; According to the node parameters of the target child node, the upper confidence bound score of the current node is updated, and the process of determining the target child node from the child nodes according to the upper confidence bound score is returned until a preset termination condition is met; The tree diagram is modified according to each determined target sub-node.

5. The method according to claim 1, characterized in that The obtaining of abnormal nodes of the power system includes: Formatting the power data of the power system; Normalizing the formatted power data; Inputting the normalized power data into a pre-trained recognition model to obtain attack features of the power data; According to the attack characteristics, abnormal nodes of the power system are determined.

6. The method according to claim 1, characterized in that The determining an initial attack path of the power system according to the abnormal node comprises: Connecting the abnormal nodes to obtain candidate attack paths for the power system; The initial attack path is determined from the candidate attack paths by simulating the power system.

7. The method according to claim 1, characterized in that The method further comprises: Determining the location and identity of the attack source in the power system according to the target attack path; The location and identity of the attack source are displayed.

8. A power data attack tracing device, characterized in that: The device comprises: An acquisition module, used for acquiring abnormal nodes of the power system, and determining an initial attack path of the power system according to the abnormal nodes; A determination module, used to determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node; A correction module, used for correcting the dendrogram according to the node parameters of the dendrogram nodes; The tracking module is used to determine the target attack path of the power system according to the modified tree diagram.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images