A method and system for tracing the origin of power data attacks

Abstract

The application relates to a power data attack tracking and tracing method and system. The method comprises the following steps: acquiring an abnormal node of a power system, determining an initial attack path of the power system according to the abnormal node, determining a tree diagram corresponding to the initial attack path, wherein the tree diagram comprises at least one tree diagram node, modifying the tree diagram according to a node parameter of the tree diagram node, and determining a target attack path of the power system according to the modified tree diagram. The method can improve the accuracy of power data attack tracking and tracing.

Description

Technical Field

[0001] The present application relates to the technical field of data security management, and in particular to a method and system for tracking and tracing power data attacks. Background Art

[0002] As a critical infrastructure, the security and stability of the power system are closely linked to economic development and social stability. With the advancement of informatization and intelligentization, power systems have gradually integrated a wide range of network communication and data transmission technologies. This exposes power systems not only to traditional physical threats but also to increasingly complex cybersecurity risks. Malicious attackers can disrupt the normal operation of the power system and even trigger large-scale power outages by tampering with, forging, or hijacking power data. Therefore, effectively tracking and tracing attacks on power data has become a key challenge in ensuring the safe and stable operation of power systems. Traditional security measures, such as firewalls and intrusion detection systems, can provide some protection against attacks, but they often lack sufficient tracing capabilities when faced with highly complex and covert attacks. Therefore, there is an urgent need to accurately identify attack paths and locate attack sources in complex environments, and to effectively defend against and respond to attacks.

[0003] Currently, the user characteristic data of the power system can be first tensor-decomposed, and then a behavioral baseline analysis can be performed using a pre-configured behavioral baseline prediction model. Finally, the obtained behavioral baseline can be analyzed using an ant colony algorithm to obtain the user attack path. However, this method has low comprehensiveness and reliability in tracing and tracing, and has low traceability capabilities in large-scale and complex power networks, and is prone to misjudgment due to data errors or random disturbances.

[0004] Therefore, there are inaccuracies in the current power data attack tracking and tracing technology. Summary of the Invention

[0005] Based on this, it is necessary to provide a more accurate method, device, computer equipment, computer-readable storage medium and computer program product for tracking and tracing power data attacks in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for tracing and tracing power data attacks, comprising:

[0007] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0008] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0009] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0010] According to the modified tree diagram, a target attack path of the power system is determined.

[0011] In one embodiment, the method further comprises:

[0012] Determining at least one attack type corresponding to the tree diagram node;

[0013] Determining a decision criterion corresponding to each of the attack types;

[0014] Obtaining a type score corresponding to each of the attack types according to the criterion weight of the decision criterion;

[0015] The type scores are sorted to obtain node parameters of the tree diagram nodes.

[0016] In one embodiment, the modifying the dendrogram according to the node parameters of the dendrogram nodes includes:

[0017] Determining an upper confidence bound score of each child node connected to the current node based on the node parameters;

[0018] Determining a target child node from the child nodes according to the upper confidence bound score;

[0019] The tree diagram is modified according to the target child node.

[0020] In one embodiment, the modifying the tree diagram according to the target child node includes:

[0021] Determining node parameters of the target child node;

[0022] updating the upper confidence bound score of the current node according to the node parameters of the target child node, and returning to the step of determining the target child node from the child nodes according to the upper confidence bound score, until a preset termination condition is met;

[0023] The tree diagram is modified according to the determined target sub-nodes.

[0024] In one embodiment, obtaining abnormal nodes of the power system includes:

[0025] Formatting the power data of the power system;

[0026] Normalizing the formatted power data;

[0027] Inputting the normalized power data into a pre-trained recognition model to obtain attack features of the power data;

[0028] According to the attack characteristics, abnormal nodes in the power system are determined.

[0029] In one embodiment, determining the initial attack path of the power system according to the abnormal node includes:

[0030] Connecting the abnormal nodes to obtain candidate attack paths for the power system;

[0031] The initial attack path is determined from the candidate attack paths by simulating the power system.

[0032] In one embodiment, the method further comprises:

[0033] determining the location and identity of the attack source in the power system based on the target attack path;

[0034] The location and identity of the attack source are displayed.

[0035] In a second aspect, the present application also provides a power data attack tracking and tracing device, comprising:

[0036] an acquisition module, configured to acquire abnormal nodes of the power system and determine an initial attack path of the power system according to the abnormal nodes;

[0037] A determination module, configured to determine a tree diagram corresponding to the initial attack path; the tree diagram comprising at least one tree diagram node;

[0038] A correction module, configured to correct the tree diagram according to node parameters of the tree diagram nodes;

[0039] The tracking module is used to determine the target attack path of the power system according to the modified tree diagram.

[0040] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0041] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0042] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0043] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0044] According to the modified tree diagram, a target attack path of the power system is determined.

[0045] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0046] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0047] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0048] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0049] According to the modified tree diagram, a target attack path of the power system is determined.

[0050] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0051] Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes;

[0052] Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0053] Modifying the dendrogram according to the node parameters of the dendrogram nodes;

[0054] According to the modified tree diagram, a target attack path of the power system is determined.

[0055] The above-mentioned power data attack tracing and source tracing method, device, computer equipment, computer-readable storage medium and computer program product obtain the abnormal nodes of the power system, determine the initial attack path of the power system based on the abnormal nodes, determine the tree diagram corresponding to the initial attack path, correct the tree diagram according to the node parameters of the tree diagram nodes, and determine the target attack path of the power system based on the corrected tree diagram; the attack path in the power system can be identified based on the tree diagram, and the accuracy of the tree diagram can be improved by continuously correcting the tree diagram, thereby improving the accuracy of power data attack tracing and source tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0057] Figure 1 1. A flowchart of a method for tracing and tracing a power data attack in one embodiment;

[0058] Figure 2 A flowchart of a method for tracing and tracing power data attacks in another embodiment;

[0059] Figure 3 This is a structural block diagram of a power data attack tracing and source tracking system in one embodiment;

[0060] Figure 4 A flowchart of a method for tracing and tracing power data attacks in another embodiment;

[0061] Figure 5 This is a structural block diagram of a power data attack tracing and source tracking device in one embodiment;

[0062] Figure 6 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0064] It should be noted that the terms "first," "second," and the like in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the numbers used in this manner are interchangeable where appropriate so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of apparatus and methods consistent with certain aspects of the present disclosure as detailed in the appended claims.

[0065] In an exemplary embodiment, Figure 1 As shown, a method for tracing and tracing power data attacks is provided. This embodiment uses the method applied to a terminal as an example. It is understandable that the method can also be applied to a server, and can also be applied to a system including a terminal and a server, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0066] Step S102: Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes.

[0067] The power system can be an electric energy production and consumption system consisting of power plants, transmission and transformation lines, power distribution stations, and power consumption. An abnormal node can be a node in the power system that has been attacked and has experienced data anomalies, such as a power plant or power distribution station experiencing data anomalies. The initial attack path can be an initially determined attack path.

[0068] In a specific implementation, data from each node in the power system can be collected and input into a terminal. The terminal then identifies abnormal data from the input and identifies the node corresponding to the abnormal data as an abnormal node. The terminal can also construct a topological map based on the connections between the nodes in the power system, mark the abnormal nodes in the topological map, and form an initial attack path based on the routing links between the abnormal nodes.

[0069] For example, the voltage, current, power, flow, equipment status, port information, etc. of nodes such as power plants and power distribution stations in the power system can be obtained, and nodes with abnormal voltage or current fluctuations, abnormal power changes, abnormal equipment status, abnormal flow peaks, abnormal communication paths or ports, etc. can be identified as abnormal nodes. Assuming that there are abnormal nodes A, B, C, D, E, F, and G, the initial attack paths ABD, ABE, ACF, and ACG can be formed based on the routing links of the abnormal nodes in the topology map.

[0070] Step S104: determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node.

[0071] The tree diagram node may be a node in the tree diagram, including a root node and child nodes.

[0072] In a specific implementation, the terminal may obtain a tree diagram according to the initial attack path. The tree diagram includes a root node and multiple child nodes under the root node. The root node and the child nodes may form a tree diagram node.

[0073] For example, for the initial attack paths ABD, ABE, ACF, and ACG, A can be used as the root node, the first-level child nodes under the root node are B and C, the second-level child nodes are D, E, F, and G, and the tree diagram nodes are A, B, C, D, E, F, and G.

[0074] Step S106: modifying the dendrogram according to the node parameters of the dendrogram nodes.

[0075] The node parameter may be a score obtained by the tree diagram node under a specified attack type according to a preset decision criterion.

[0076] In a specific implementation, the terminal can pre-set one or more attack types for each tree diagram node, determine one or more decision criteria corresponding to each attack type, and the weight corresponding to each decision criterion. The attack types, decision criteria, and weights corresponding to different tree diagram nodes may be different. Then, for each tree diagram node, the decision criteria can be weighted and summed according to the weight to obtain the score corresponding to the corresponding one or more attack types. The score can constitute the node parameter of the tree diagram node, and the tree diagram can be corrected using the node parameter.

[0077] For example, the node parameters o, p, q, r, s, t, and u of A, B, C, D, E, F, and G can be determined in sequence. The node parameters can be vectors. If the same attack type exists in o, p, and r, and the score corresponding to the attack type meets the preset conditions (for example, the score exceeds the preset score), and the same attack type does not exist in other node parameters, or the score corresponding to the same attack type does not meet the preset conditions, then only ABD can be retained in the tree diagram determined in step S104, and the other initial attack paths can be removed to obtain a revised tree diagram.

[0078] Step S108: determining a target attack path of the power system according to the modified tree diagram.

[0079] The target attack path may be the finally determined attack path of the power system.

[0080] In a specific implementation, the terminal can determine the target attack path of the power system according to the tree structure in the modified tree diagram.

[0081] For example, if ABD is retained in the tree diagram, the target attack path of the power system can be determined to be ABD. Furthermore, the starting point of the target attack path can be determined based on the time when A, B, and D are attacked respectively. For example, if D is attacked earlier than A, D can be determined as the starting point and the target attack path can be determined to be DBA.

[0082] The above-mentioned power data attack tracing and source tracing method obtains abnormal nodes of the power system, determines the initial attack path of the power system based on the abnormal nodes, determines the tree diagram corresponding to the initial attack path, corrects the tree diagram according to the node parameters of the tree diagram nodes, and determines the target attack path of the power system based on the corrected tree diagram; the attack path in the power system can be identified based on the tree diagram, and the accuracy of the tree diagram can be improved by continuously correcting the tree diagram, thereby improving the accuracy of the power data attack tracing and source tracing.

[0083] It is understandable that, before the above-mentioned step S106, the following steps may also be included: determining at least one attack type corresponding to a tree diagram node; determining a decision criterion corresponding to each attack type; obtaining a type score corresponding to each attack type based on the criterion weight of the decision criterion; and sorting the type scores to obtain node parameters of the tree diagram nodes.

[0084] The attack type may be the type of attack on power data, such as a database attack, phishing attack, or denial of service attack. The decision criterion may be a criterion for evaluating the attack type, including but not limited to a calculation formula or scoring rules. The criterion weight may be the weight of the decision criterion. The type score may be the score of the attack type.

[0085] In a specific implementation, the terminal can pre-set one or more attack types according to the properties of each tree diagram node, determine one or more decision criteria corresponding to each attack type, and the criterion weight corresponding to each decision criterion, perform weighted summation of the decision criteria according to the criterion weight, obtain the type score corresponding to the corresponding one or more attack types, sort the type scores in descending order, and obtain the node parameters of the tree diagram node.

[0086] In this embodiment, at least one attack type corresponding to a tree diagram node is determined; a decision criterion corresponding to each attack type is determined; a type score corresponding to each attack type is obtained based on the criterion weight of the decision criterion; the type scores are sorted to obtain node parameters of the tree diagram node. Node parameters can be generated based on the impact of various attack types on the tree diagram nodes, and the impact of attack types on the tree diagram nodes can be quantified, thereby improving the accuracy of power data attack tracing and source tracking.

[0087] In an exemplary embodiment, the above step S106 may specifically include: determining an upper confidence bound score of each child node connected to the current node based on the node parameters; determining a target child node from each child node based on the upper confidence bound score; and modifying the dendrogram based on the target child node.

[0088] The upper confidence bound score can be a score obtained using an upper confidence bound 1 (UCB1) algorithm. The current node can be the current dendrogram node. The child node can be a child node of the current node. The target child node can be a selected child node.

[0089] In a specific implementation, the terminal can substitute the node parameters into the UCB1 formula and use the UCB1 formula to calculate the upper confidence bound score of each child node connected to the current node in the tree diagram. If the upper confidence bound score meets the preset conditions (for example, the upper confidence bound score is the highest), the corresponding child node is determined as the target child node. After that, the above processing can be performed on each child node below the target child node to select a new target child node until the bottom layer of the tree diagram is reached. Finally, the tree diagram can be corrected according to the target child nodes selected at each layer, so that only the target child nodes of each layer are retained in the tree diagram. These target child nodes can constitute the target attack path.

[0090] For example, the child nodes connected to the current node A are B and C. The upper confidence bound score of B is higher than the upper confidence bound score of C, so B is selected as the target child node; the child nodes connected to B are D and E. The upper confidence bound score of D is higher than the upper confidence bound score of E, so D is selected as the new target child node; therefore, the dendrogram is modified according to ABD so that only ABD is retained in the dendrogram, and the target attack path can be determined to be ABD.

[0091] In this embodiment, the upper confidence bound score of each child node connected to the current node is determined based on the node parameters; the target child node is determined from each child node based on the upper confidence bound score; and the tree diagram is corrected based on the target child node. The target attack path can be determined through iteration, thereby improving the accuracy of power data attack tracing and source tracing.

[0092] In an exemplary embodiment, the above-mentioned step of correcting the tree diagram according to the target child node may specifically include: determining the node parameters of the target child node; updating the upper confidence bound score of the current node according to the node parameters of the target child node, and returning to the step of determining the target child node from each child node according to the upper confidence bound score until the preset termination condition is met; and correcting the tree diagram according to each determined target child node.

[0093] The preset termination condition may be reaching a preset number of iterations or reaching a preset search time.

[0094] In a specific implementation, the terminal can calculate the node parameters of the target child node, pass the node parameters of the target child node back to the current child node, and substitute them into the UCB1 formula to obtain the upper confidence bound score of the current node. The above process of determining the target child node from each child node based on the upper confidence bound score is repeated until the preset number of iterations or the preset search time is reached. From the one or more target child nodes finally determined, an optimal target child node (for example, the one with the highest similarity to the current node) is selected, and the target child node is retained in the tree diagram to achieve the correction of the tree diagram.

[0095] In practical applications, the currently known attack path or starting point is used as the root node. The initial state of the root node is initialized according to the current simulation results and actual power data. Each attack path selection or state change is used as a child node, and the root node is connected to each child node. The path value and visit count of each node are initialized. The upper confidence bound score of each group of nodes is calculated by the UCB1 formula, and the node with the highest confidence bound score on each subsequent child node of the current node is selected as the current optimal path node. It is detected whether the selected node is a fully expanded node. If so, starting from the selected optimal node, a new path branch is extended to generate a new child node. Otherwise, the node selection is repeated, and the selection and expansion are repeated until the preset maximum depth is reached and then stopped. The newly expanded path is simulated by simulating the execution of the attack path to evaluate the effect of the path and The path value of the new node is calculated as the initial benefit of the node. The path value obtained by simulation is then returned and added to the cumulative path value of each corresponding node. At the same time, the number of visits to the node is increased, and the evaluation results of the new path node are returned layer by layer. The upper confidence bound scores of the parent node and its ancestor nodes are updated, and the selection, expansion, simulation and backtracking processes are repeated. In each iteration, the upper confidence bound strategy is used to select the optimal node for expansion. When the preset number of iterations or search time is reached, the iterative process is terminated, and the path with the highest cumulative benefit is selected as the optimal path. Based on the selected optimal path, the attack tracing path is corrected and verified by comparing it with the simulation results and actual power data. After verification, the corrected attack tracing path is output as the final result, and a detailed report is generated for decision support.

[0096] In this embodiment, by determining the node parameters of the target sub-node; updating the upper confidence bound score of the current node according to the node parameters of the target sub-node, and returning to the step of determining the target sub-node from each sub-node according to the upper confidence bound score, until the preset termination condition is met; and correcting the tree diagram according to each determined target sub-node, the target attack path can be quickly determined, thereby improving the efficiency of power data attack tracking and tracing.

[0097] In an exemplary embodiment, the above-mentioned step S102 may specifically include: formatting the power data of the power system; normalizing the formatted power data; inputting the normalized power data into a pre-trained recognition model to obtain attack characteristics of the power data; and determining abnormal nodes of the power system based on the attack characteristics.

[0098] The recognition model can be, but is not limited to, a neural network model, such as a long short-term memory (LSTM) network. Attack features can be data reflecting an attack on power data, including but not limited to abnormal voltage or current fluctuations, abnormal power changes, abnormal device status, abnormal traffic peaks, and abnormal communication paths or ports.

[0099] In a specific implementation, after obtaining the power data of the power system, the terminal can first format the power data, then normalize the formatted power data, and then input the normalized power data into a pre-trained recognition model to obtain the attack characteristics of the power data. According to the attack characteristics and the topological connection between the nodes in the power system, the abnormal nodes in the power system are determined.

[0100] For example, data such as current, voltage, power, equipment status, flow, and ports are collected from each node in the power system, formatted and normalized, and then input into a pre-trained LSTM model to identify abnormal voltage or current fluctuations, abnormal power changes, abnormal equipment status, abnormal flow peaks, abnormal communication paths or ports, and the nodes where these situations occur are identified as abnormal nodes.

[0101] In this embodiment, by formatting the power data of the power system; normalizing the formatted power data; inputting the normalized power data into a pre-trained recognition model to obtain the attack characteristics of the power data; and determining the abnormal nodes of the power system based on the attack characteristics, the abnormal nodes in the power system can be identified quickly and accurately, thereby improving the accuracy and efficiency of tracking and tracing power data attacks.

[0102] In an exemplary embodiment, the above step S102 may further specifically include: connecting abnormal nodes to obtain candidate attack paths of the power system; and determining an initial attack path from the candidate attack paths by simulating the power system.

[0103] The candidate attack path may be a candidate initial attack path.

[0104] In the specific implementation, the terminal can connect the abnormal nodes according to the topological connection between the abnormal nodes to obtain one or more candidate attack paths. By simulating the power system, the incorrect attack paths are screened out from the candidate attack paths and deleted. The remaining attack paths are the initial attack paths.

[0105] In this embodiment, by connecting abnormal nodes, candidate attack paths for the power system are obtained; by simulating the power system, an initial attack path is determined from the candidate attack paths. The candidate attack paths can be screened through simulation to obtain a more reliable initial attack path, thereby improving the accuracy of power data attack tracing and source tracing.

[0106] It is understandable that after the above step S108, the following steps may also be included: determining the location and identity of the attack source in the power system according to the target attack path; and displaying the location and identity of the attack source.

[0107] The location may be, but is not limited to, an IP address or a geographical location of the attack source, etc. The identity may be an identification of the attack source.

[0108] In a specific implementation, after determining the target attack path, the terminal can determine the location of the attack source in the power system and the identity of the attack source based on the target attack path, and display the location and identity of the attack source on the display.

[0109] In this embodiment, the location and identity of the attack source in the power system are determined based on the target attack path; the location and identity of the attack source are displayed to assist management personnel in formulating response strategies in a timely manner for power data attacks.

[0110] In order to facilitate those skilled in the art to have a deeper understanding of the embodiments of the present application, a specific example will be used for illustration below.

[0111] In one embodiment, referring to Figure 2 , a power data attack tracing method is proposed. The specific steps of this tracing method are as follows:

[0112] Step S201: collect data from each node of the power system and extract attack features.

[0113] Specifically, each group of collected power data and network traffic data is formatted, and then each group of processed data is normalized and scaled to [0,1] or [-1,1], and each group of normalized data is divided in chronological order to form a training set and a validation set, and a group of LSTM network models is constructed. The training data is input into the LSTM network model, and then the LSTM network model gradually updates the model weights and biases through the forward propagation algorithm and the backpropagation algorithm. At the same time, after each round of training cycle, the model performance is evaluated by the validation set data, and the model hyperparameters are adjusted according to the evaluation results. After the LSTM network model training is completed, the model is used to forward propagate the current power data and network traffic data, and the feature data in each data is captured through the hidden layer of the LSTM network model. The high-dimensional features are then reduced in dimensionality through the t-Stochastic Neighbor Embedding (t-SNE) method, and the processed feature data is stored in the database or memory.

[0114] Step S202: Prioritize and record different attack types and attack paths.

[0115] Specifically, identifying and sorting different attack types and attack paths is set as the decision-making goal, and decision criteria for evaluating attack types and attack paths are generated based on the decision-making goal. According to the expert scoring method and the safety requirements and risk assessment of the power system generated by the hierarchical analysis method, a weight is assigned to each decision criterion. The attack complexity and potential hazards contained in the historical attack data corresponding to each decision criterion and the feature data extracted by the LSTM network model are collected. The data under different criteria are processed by normalization or standardization, and a decision matrix is ​​constructed for all the data of all attack types and paths according to each decision criterion. The rows of the matrix represent different attack types or paths, and the columns represent different decision criteria. The comprehensive score of each attack path is then calculated by weighted average. According to the calculated comprehensive score, all attack types and attack paths are sorted from high to low, and the attack paths or types with higher scores are considered to have higher threats. At the same time, the priority sorting results are presented in the form of charts or reports for reference by power system security managers.

[0116] Step S203: generating an attack path based on the abnormal points of the power data and optimizing the path information.

[0117] Step S204: Perform simulation analysis on the power system to verify the accuracy of the traceability path.

[0118] Step S205: Correct the attack tracing path based on the simulation results and actual power data.

[0119] Specifically, the currently known attack path or starting point is used as the root node, and the initial state of the root node is initialized according to the current simulation results and actual power data. Each attack path selection or state change is used as a child node, and the root node is connected to each child node. The path value of each node is initialized (the path value specifically includes the power status indicator of the node and the network traffic indicator, as well as the weight of the path, that is, the attack risk and response time, etc.) and the number of visits are initialized. The upper confidence bound score of each group of nodes is calculated by the UCB1 formula (specifically related to the potential impact of the attack path, the number of historical visits to the path, the attack success rate, the path risk and the simulation results), and the node with the highest confidence bound score on each subsequent child node of the current node is selected as the current optimal path node. It is detected whether the selected node is a fully expanded node. If so, starting from the selected optimal node, a new path branch is expanded to generate a new child node. Otherwise, the node selection is repeated, and the selection and expansion are repeated until it reaches the optimal node. It stops after the preset maximum depth, simulates the newly extended path by simulating the execution of the attack path, evaluates the effect of the path, and calculates the path value of the new node as the initial benefit of the node. Then, the path value obtained by simulation is returned and added to the cumulative path value of each corresponding node. At the same time, the number of visits to the node is increased, and the evaluation results of the new path node are returned layer by layer. The upper confidence bound scores of the parent node and its ancestor nodes are updated, and the selection, expansion, simulation and backtracking processes are repeated. In each iteration, the upper confidence bound strategy is used to select the optimal node for expansion. When the preset number of iterations or search time is reached, the iterative process is terminated, and the path with the highest cumulative benefit is selected as the optimal path. Based on the selected optimal path, the attack tracing path is corrected, and the corrected attack tracing path is verified by comparing it with the simulation results and actual power data. After verification, the corrected attack tracing path is output as the final result, and a detailed report is generated for decision support.

[0120] Step S206: Analyze each node in the path to determine the location and identity of the attack source.

[0121] Step S207: Output the traceability results and assist management personnel in formulating response strategies.

[0122] In another embodiment, referring to Figure 3 ,A power data attack tracking and tracing system is proposed, which includes ,acquisition and processing module, feature extraction module, parameter optimization module, ,attack detection module, path initialization module, simulation and ,analysis module, correction and evaluation module, ,tracing and positioning module, and report output module.

[0123] The acquisition and processing module is used to collect power data and network traffic data from the power system and perform data cleaning and formatting. The feature extraction module is used to extract key attack features from the fused data through the LSTM network model. The parameter optimization module is used to monitor the feature extraction process in real time and optimize parameter settings.

[0124] The attack detection module is used to detect potential attack behaviors based on attack characteristics through classification algorithms and trigger alarms; the path initiation module is used to prioritize each attack path and preliminarily determine the attack path with the highest priority; the simulation analysis module is used to simulate different attack paths in a virtual simulation environment to evaluate their feasibility and impact on the power system.

[0125] The correction evaluation module is used to deeply explore and optimize the preliminary path, and to correct the preliminary attack path by combining simulation and actual data; the source tracing and positioning module is used to analyze the final corrected path and locate the source of the attack.

[0126] Specifically, the corrected attack path is matched and analyzed with the key data in the multi-source information, and different weights are assigned to each node in the path according to the analysis results of the multi-source information. The larger the weight, the node is the attack source or close to the attack source. According to the importance of the path and the distribution of the nodes, the control points are selected, the set control points are calculated by the Bailey curve formula, and the corresponding curve is drawn to generate a smooth path. Multiple groups of intermediate points are inserted on the generated path, and the interpolated curve is fitted with the original path. The fitted path is segmented, and the abnormal areas on the path are identified. The identified areas are then marked as candidate points for key nodes to generate preliminary key node candidates. Select a set, calculate the feature weight of each candidate node in the key node candidate set, and sort the candidate nodes from high to low according to the feature weight. Screen out the nodes that do not reach the threshold in the key node candidate set according to the preset feature weight threshold, and compare and verify the screened key nodes with the original power data and network traffic data. After the verification is passed, analyze the extracted key nodes in combination with the correlation of multi-source information, and finally determine the location of the attack source based on the analysis results. Compare the determined attack source location with the actual power system data and network traffic. If the degree of consistency between the positioning and the actual system situation exceeds the preset threshold, the positioning is completed. If it is lower than the preset threshold, the positioning fails and is re-positioned.

[0127] The report output module is used to generate a detailed report of the final attack tracing path.

[0128] Compared with the prior art, the beneficial effect of the above embodiment is that: the power data attack tracing and tracing method takes the currently known attack path or starting point as the root node, initializes the initial state of the root node according to the current simulation results and actual power data, selects each attack path or state change as a child node, and connects the root node with each child node, selects the node with the highest confidence bound score on each subsequent child node of the current node as the current optimal path node, and expands new path branches, generates new child nodes, and repeats the selection and expansion until the preset maximum depth is reached and stops, simulates the newly expanded path by simulating the execution of the attack path, evaluates the effect of the path, and calculates the path value of the new node as the initial benefit of the node, and then returns the simulated path value and accumulates it to the cumulative path value of each corresponding node, while increasing the number of visits to the node. The evaluation results of the new path nodes are passed back layer by layer, and the upper confidence bound scores of the parent node and its ancestor nodes are updated. The selection, expansion, simulation and backtracking processes are repeated. The upper confidence bound strategy is used to select the optimal node for expansion in each iteration. When the preset number of iterations or search time is reached, the iteration process is terminated, and the path with the highest cumulative benefit is selected as the optimal path. Based on the selected optimal path, the attack tracing path is corrected, and the corrected attack tracing path is verified by comparing it with the simulation results and actual power data. After verification, the corrected attack tracing path is output as the final result, and a detailed report is generated for decision support, which improves the accuracy of the corrected path and the comprehensiveness and reliability of the tracing, enhances the tracing capability in large-scale complex power networks, reduces misjudgments caused by data errors or random disturbances, and greatly reduces the complexity and workload of human operations.

[0129] Moreover, the power data attack tracking and tracing system matches and analyzes the corrected attack path with the key data in the multi-source information, and assigns different weights to each node in the path according to the analysis results of the multi-source information. According to the importance of the path and the distribution of the nodes, the control points are selected, the set control points are calculated, and the corresponding curves are drawn to generate a smooth path. Multiple groups of intermediate points are inserted on the generated path, and the interpolated curves are fitted with the original path. The abnormal areas on the path are identified, and the identified areas are marked as candidate points of the key nodes. The feature weight of each candidate node is calculated, and the candidate nodes are sorted from high to low according to the feature weight. According to the preset features, The weight threshold screens out nodes that do not reach the threshold in the key node candidate set, and compares and verifies the screened key nodes with the original power data and network traffic data. After verification, the extracted key nodes are analyzed in combination with the correlation of multi-source information, and based on the analysis results, the location of the attack source is finally determined, and the determined attack source location is compared with the actual power system data and network traffic. If the degree of consistency between the positioning and the actual situation of the system exceeds the preset threshold, the positioning is completed. If it is lower than the preset threshold, the positioning fails and re-positioning is performed. It can comprehensively analyze various types of information, improve the accuracy of attack source positioning, ensure that the system can stably locate the attack source, and improve the security of the overall power system.

[0130] In one embodiment, Figure 4 As shown, a method for tracing and tracing power data attacks is provided, including the following steps:

[0131] Step S401: Acquire abnormal nodes of the power system and determine the initial attack path of the power system according to the abnormal nodes;

[0132] Step S402: determining a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node;

[0133] Step S403: Determine at least one attack type corresponding to a tree diagram node, determine a decision criterion corresponding to each attack type, obtain a type score corresponding to each attack type based on the criterion weight of the decision criterion, sort the type scores, and obtain node parameters for the tree diagram node;

[0134] Step S404, modifying the tree diagram according to the node parameters of the tree diagram nodes;

[0135] Step S405, determining a target attack path of the power system according to the modified tree diagram;

[0136] Step S406: Determine the location and identity of the attack source in the power system according to the target attack path, and display the location and identity of the attack source.

[0137] In specific implementation, the terminal can identify abnormal data from the power data, determine the power nodes corresponding to the abnormal data as abnormal nodes, generate an initial attack path according to the topology connection conditions between the abnormal nodes, generate a tree diagram according to the initial attack path, set one or more attack types in advance according to the properties of each node of the tree diagram, determine one or more decision criteria corresponding to each attack type and the criterion weight corresponding to each decision criterion, weight and sum the decision criteria according to the criterion weight, obtain the type score corresponding to the one or more attack types, sort the type scores in descending order to obtain the node parameters of the tree diagram nodes, determine the upper confidence limit score of each child node connected to the current node according to the node parameters, determine the target child node from the child nodes according to the upper confidence limit score, modify the tree diagram according to the target child node, determine the target attack path of the power system according to the modified tree diagram, determine the position and identity of the attack source in the power system based on the target attack path, and display the position and identity on the display.

[0138] The power data attack tracking and tracing method described above can obtain abnormal nodes of a power system, determine an initial attack path of the power system according to the abnormal nodes, determine a tree diagram corresponding to the initial attack path, determine at least one attack type corresponding to a node of the tree diagram, determine decision criteria corresponding to each attack type, obtain type scores corresponding to each attack type according to the criterion weight of the decision criteria, sort the type scores to obtain node parameters of the nodes of the tree diagram, modify the tree diagram according to the node parameters of the nodes of the tree diagram, determine a target attack path of the power system according to the modified tree diagram, determine the position and identity of an attack source in the power system according to the target attack path, and display the position and identity of the attack source; the attack path in the power system can be identified based on the tree diagram, the accuracy of the tree diagram is improved by continuously modifying the tree diagram, and the accuracy of power data attack tracking and tracing can be improved.

[0139] It should be understood that, although each step in the flowchart involved in each embodiment as described above is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other orders. Moreover, at least part of the steps in the flowchart involved in each embodiment as described above can include multiple steps or stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or stages in other steps.

[0140] Based on the same inventive concept, the embodiments of the present application also provide a power data attack tracking and tracing device for implementing the power data attack tracking and tracing method described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more power data attack tracking and tracing device embodiments provided below can refer to the limitations of the power data attack tracking and tracing method described above, which will not be repeated here.

[0141] In one exemplary embodiment, as shown in Figure 5 A power data attack tracking and tracing device is provided, comprising: an acquisition module 502, a determination module 504, a correction module 506, and a tracking module 508, wherein:

[0142] The acquisition module 502 is configured to acquire an abnormal node of a power system, and determine an initial attack path of the power system according to the abnormal node;

[0143] The determination module 504 is configured to determine a tree diagram corresponding to the initial attack path; the tree diagram comprises at least one tree diagram node;

[0144] The correction module 506 is configured to correct the tree diagram according to a node parameter of the tree diagram node;

[0145] The tracking module 508 is configured to determine a target attack path of the power system according to the corrected tree diagram.

[0146] In one exemplary embodiment, the power data attack tracking and tracing device described above further comprises a parameter module configured to determine at least one attack type corresponding to the tree diagram node; determine a decision criterion corresponding to each attack type; obtain a type score corresponding to each attack type according to a criterion weight of the decision criterion; and sort the type scores to obtain the node parameter of the tree diagram node.

[0147] In one exemplary embodiment, the correction module 506 is further configured to determine an upper confidence bound score of each child node connected to a current node according to the node parameter; determine a target child node from the child nodes according to the upper confidence bound score; and correct the tree diagram according to the target child node.

[0148] In one exemplary embodiment, the correction module 506 is further configured to determine a node parameter of the target child node; update the upper confidence bound score of the current node according to the node parameter of the target child node, and return to the step of determining a target child node from the child nodes according to the upper confidence bound score until a preset termination condition is met; and correct the tree diagram according to each determined target child node.

[0149] In an exemplary embodiment, the acquisition module 502 is further used to format the power data of the power system; normalize the formatted power data; input the normalized power data into a pre-trained recognition model to obtain attack features of the power data; and determine abnormal nodes of the power system based on the attack features.

[0150] In an exemplary embodiment, the acquisition module 502 is further configured to connect the abnormal nodes to obtain candidate attack paths for the power system; and determine the initial attack path from the candidate attack paths by simulating the power system.

[0151] In an exemplary embodiment, the above-mentioned power data attack tracking and tracing device also includes a display module for determining the location and identity of the attack source in the power system according to the target attack path; and displaying the location and identity of the attack source.

[0152] Each module in the aforementioned power data attack tracking and tracing device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor within a computer device in hardware form, or stored in a computer device's memory as software, allowing the processor to call and execute the corresponding operations of each module.

[0153] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interface. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals via wired or wireless communication. Wireless communication can be achieved via Wi-Fi, mobile cellular networks, near-field communication (NFC), or other technologies. When executed by the processor, the computer program implements a method for tracking and tracing power data attacks. The display unit of the computer device is used to produce visual images and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse.

[0154] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0155] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0156] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0157] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0158] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0159] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0160] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0161] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for tracing and tracing power data attacks, characterized in that: The method comprises: Acquire abnormal nodes of the power system, and determine an initial attack path of the power system according to the abnormal nodes; Determine a tree diagram corresponding to the initial attack path; the tree diagram includes at least one tree diagram node; Determining an upper confidence bound score for each child node connected to the current node based on a node parameter of the dendrogram node; the node parameter being the score obtained by the dendrogram node under a specified attack type according to a pre-set decision criterion, the decision criterion being a criterion for evaluating the attack type; Determining a target child node from the child nodes according to the upper confidence bound score; Determining node parameters of the target child node, updating the upper confidence bound score of the current node based on the node parameters of the target child node, and returning to the step of determining the target child node from the child nodes based on the upper confidence bound score, until a preset termination condition is met; Modifying the tree diagram according to the determined target sub-nodes; According to the modified tree diagram, a target attack path of the power system is determined.

2. The method according to claim 1, characterized in that The method further comprises: Determining at least one attack type corresponding to the tree diagram node; Determining a decision criterion corresponding to each of the attack types; Obtaining a type score corresponding to each of the attack types according to the criterion weights of the decision criterion; The type scores are sorted to obtain node parameters of the tree diagram nodes.

3. The method according to claim 1, characterized in that The obtaining of abnormal nodes of the power system includes: Formatting the power data of the power system; Normalizing the formatted power data; Inputting the normalized power data into a pre-trained recognition model to obtain attack features of the power data; According to the attack characteristics, abnormal nodes in the power system are determined.

4. The method according to claim 1, wherein The determining an initial attack path of the power system according to the abnormal node includes: Connecting the abnormal nodes to obtain candidate attack paths for the power system; The initial attack path is determined from the candidate attack paths by simulating the power system.

5. The method according to claim 1, wherein The method further comprises: determining the location and identity of the attack source in the power system based on the target attack path; The location and identity of the attack source are displayed.

6. A power data attack tracing device, characterized in that: The device comprises: an acquisition module, configured to acquire abnormal nodes of the power system and determine an initial attack path of the power system according to the abnormal nodes; A determination module, configured to determine a tree diagram corresponding to the initial attack path; the tree diagram comprising at least one tree diagram node; a correction module, configured to determine, based on the node parameters of the dendrogram node, an upper confidence bound score of each child node connected to the current node; determine a target child node from each child node based on the upper confidence bound score; determine the node parameters of the target child node, update the upper confidence bound score of the current node based on the node parameters of the target child node, and return to the step of determining the target child node from each child node based on the upper confidence bound score until a preset termination condition is met; and correct the dendrogram based on each determined target child node; the node parameter is a score obtained by the dendrogram node under a specified attack type according to a preset decision criterion, and the decision criterion is a criterion for evaluating the attack type; The tracking module is used to determine the target attack path of the power system according to the modified tree diagram.

7. The device according to claim 6, characterized in that The device further comprises: A parameter module is configured to determine at least one attack type corresponding to the tree diagram node; determine a decision criterion corresponding to each of the attack types; obtain a type score corresponding to each of the attack types based on the criterion weights of the decision criterion; and sort the type scores to obtain node parameters for the tree diagram nodes.

8. The device according to claim 6, characterized in that The acquisition module is further used to format the power data of the power system; normalize the formatted power data; input the normalized power data into a pre-trained recognition model to obtain attack characteristics of the power data; and determine abnormal nodes of the power system based on the attack characteristics.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images