Construction method and system for safety protection system of hydropower station monitoring system

Abstract

The invention discloses a construction method and system for a safety protection system of a hydropower station monitoring system, and relates to the technical field of information safety and network safety, and the construction method comprises the steps: constructing a multi-level and graded safety architecture, and enabling the safety measures of all levels to complement each other; real-time data is acquired from a network layer and a data layer for analysis, security threats are analyzed in real time by using an artificial intelligence technology, and a security policy is automatically adjusted; when the system is attacked or breaks down, the normal function is automatically repaired and recovered, and the system is combined with an AI dynamic security strategy; the AES encryption algorithm is adopted to encrypt data, and encryption guarantee is provided for security measures of all levels. According to the invention, the multi-level and graded security architecture is constructed, and the AI technology is combined to carry out real-time analysis and automatically adjust the security policy, so that mutual complementation and coordination of security measures of each level are realized. When attacks or faults occur, the system has automatic restoration and recovery functions, and continuous and stable operation and data security of the hydropower station monitoring system are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of information security and network security, and in particular to a method and system for constructing a safety protection system for a hydropower station monitoring system. Background Art

[0002] With the rapid development of information technology and automated control systems, the operation and management of modern hydropower stations are increasingly dependent on complex monitoring systems. These monitoring systems usually integrate multi-level data acquisition, transmission and processing functions to ensure the efficient and safe operation of hydropower stations. However, with the development of network technology and the increase of network threats, traditional hydropower station monitoring systems have gradually exposed the shortcomings of insufficient security protection capabilities. In particular, when dealing with increasingly complex network attacks and internal failures, the existing monitoring systems lack effective response mechanisms and recovery methods. In addition, with the large-scale application of IoT devices, the monitoring systems of hydropower stations face more severe security challenges, including device identity authentication, data integrity protection, and secure transmission of sensitive information.

[0003] The existing security protection system of the hydropower station monitoring system generally has deficiencies in the construction of a multi-level security architecture. On the one hand, the traditional security architecture often treats the security measures of the physical layer, network layer and application layer in isolation, lacking unified coordination and management, which makes it difficult for the system to form an effective linkage defense when facing cross-level security threats. On the other hand, the existing security protection system has limited security monitoring capabilities for the network layer and data layer, making it difficult to identify and respond to potential threats in a timely manner. In particular, there is a lack of the ability to use artificial intelligence technology for real-time data analysis and dynamic adjustment of security policies, which makes it impossible for the system to quickly adjust the protection strategy when facing sudden attacks or anomalies, which easily leads to a lag in system security protection. In addition, when the system is attacked or fails, the traditional monitoring system usually relies on manual intervention to restore the function, lacking an automatic repair and recovery mechanism, which seriously affects the stability and availability of the system.

[0004] The existing security technology of hydropower station monitoring systems has problems such as insufficient multi-level security architecture, lack of real-time data analysis and dynamic security policy adjustment mechanism, and imperfect automatic repair and recovery capabilities. The method for constructing a security protection system for a hydropower station monitoring system invented by us proposes solutions to the above problems. The present invention constructs a multi-level and graded security architecture, and uses artificial intelligence technology to perform real-time security threat analysis and automatically adjust security policies to ensure that security measures at all levels complement each other and operate in coordination. At the same time, the present invention designs automatic repair and recovery functions to deal with situations when the system is attacked or fails, ensuring the continuous and stable operation of the system. Therefore, the content of the present invention solves the problems of cross-level linkage defense, real-time threat response, and automatic repair and recovery in the security protection of hydropower station monitoring systems, and belongs to the field of information security and network security technology. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by the present invention is: how to solve the problems of lack of intelligence, weak dynamic adjustment capability, incomplete data encryption and the like in the safety protection measures of the existing hydropower station monitoring system.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: A method for constructing a safety protection system of a hydropower station monitoring system, comprising: constructing a multi-level and graded security architecture, and making the security measures at each level complement each other;

[0008] Obtain real-time data from the network layer and data layer for analysis, use artificial intelligence technology to analyze security threats in real time, and automatically adjust security policies;

[0009] When the system is attacked or fails, it automatically repairs and restores normal functions, and is combined with AI dynamic security strategies;

[0010] The AES encryption algorithm is used to encrypt data, providing encryption protection for security measures at all levels.

[0011] As a preferred solution of the method for constructing a safety protection system of a hydropower station monitoring system according to the present invention, wherein: the multi-level and hierarchical security architecture comprises a physical layer, a network layer, a data layer and an application layer;

[0012] The physical layer includes using biometric technology to authenticate the identity of people entering the monitoring center;

[0013] The network layer includes using firewalls and intrusion detection systems to prevent external attacks;

[0014] The data layer includes encrypting data using the Advanced Encryption Standard AES;

[0015] The application layer includes introducing access control and identity authentication mechanisms to ensure that only authorized users can access and operate the system.

[0016] As a preferred solution of the method for constructing a safety protection system for a hydropower station monitoring system according to the present invention, the security measures at each level complement each other and include: the physical layer uses biometric technology to authenticate the identity of personnel entering the monitoring center, and transmits the authentication result to the access control system of the application layer to ensure that only authenticated personnel can access and operate the system;

[0017] Firewalls and intrusion detection systems are deployed at the network layer to monitor network traffic in real time and detect abnormal behavior, and pass the detected abnormal behavior information to AI-driven dynamic security policies for analysis;

[0018] The data layer uses the Advanced Encryption Standard to encrypt data. The key management system ensures the security of the encryption keys and is used in the access control mechanism of the application layer to ensure that only authenticated users can decrypt and access the data.

[0019] AI technology analyzes data collected from all levels in real time, identifies abnormal behaviors and potential security threats, and combines with behavioral analysis technology to adjust access rights and security policies in real time based on user behavior pattern recognition results.

[0020] As a preferred solution of the method for constructing a safety protection system of a hydropower station monitoring system according to the present invention, wherein: the acquisition of real-time data from the network layer and the data layer includes collecting network flow data, network protocol data, intrusion detection data and network topology data from the network layer;

[0021] Collect data storage access logs, data integrity verification results, data encryption status, and database query logs from the data layer.

[0022] As a preferred solution of the method for constructing a safety protection system of a hydropower station monitoring system according to the present invention, the real-time analysis of security threats using artificial intelligence technology includes standardizing and preprocessing the collected data to make it suitable for input into a neural network;

[0023] The standardized data are and It is expressed as:

[0024]

[0025]

[0026] in, represents the standardized i-th input variable, represents the jth input variable after standardization; x i represents the i-th data point collected by the network layer, y j Represents the jth data point collected by the data layer; Represents the i-th data point x collected by the network layer i The mean of Represents the jth data point y collected by the data layer j The mean of Represents the i-th data point x collected by the network layer i The standard deviation of Represents the jth data point y collected by the data layer j The standard deviation of

[0027] In the first neural network, the standardized network layer data is subjected to preliminary feature extraction and processing, and weighted summation and activation function processing are performed, which can be expressed as:

[0028]

[0029] a1=f(z1)

[0030] Among them, z1 represents the weighted summation result of the first neural network, W1 represents the weight matrix, b1 represents the bias, N represents the number of input variables of the first neural network, α i represents the weight coefficient of the i-th input variable; f represents the activation function, and a1 represents the result after the activation function f acts;

[0031] Integral operation is introduced to capture the time variation of network layer information. The formula is:

[0032]

[0033] Among them, I1(τ) represents the integration result of the first neural network, t represents the current time and serves as the upper limit of the integration; τ represents the time variable in the integration process. During the integration process, τ changes from 0 to t, and the function value at each time point τ is gradually accumulated, and finally the cumulative result I1(τ) at time t is calculated;

[0034] The standardized data of the data layer is processed in the second neural network, and weighted summation and activation are performed, which can be expressed as:

[0035]

[0036] a2=f(z2)

[0037] Integral operation is introduced to capture the time change of data layer information. The formula is:

[0038]

[0039] Wherein, z2 represents the weighted summation result of the second neural network, I2(τ) represents the integral result of the second neural network, W2 represents the weight matrix, b2 represents the bias, M represents the number of input variables of the second neural network, β j Represents the weight coefficient of the jth input variable;

[0040] The standardized values ​​of the network layer and data layer data are logarithmically transformed, and the dynamic changes over time are accumulated through integral calculation to calculate the weights w of the network layer and data layer. x and w y , the formula is:

[0041]

[0042]

[0043] Among them, γ x and γ y Respectively represent the data volatility of the network layer and the data layer in the period [0, t]; x and λ y Indicates the time decay factor of the network layer and the data layer, which is used to adjust the impact of the current moment data;

[0044] The integral operation results of the first neural network and the second neural network are combined with the dynamic weight w x and w y Combined and processed by normalization function, the comprehensive safety score S(t) is obtained, which is expressed as:

[0045] S(t)=σ(w x I1(τ)+w y I2(τ)

[0046] Here, σ represents the normalization function.

[0047] As a preferred solution of the method for constructing a safety protection system of a hydropower station monitoring system according to the present invention, the automatic adjustment of the safety strategy includes setting thresholds θ1 and θ2 of the comprehensive safety score S(t), θ2>θ1, and dividing the system status into high risk, medium risk and low risk;

[0048] Monitor the changes of the comprehensive safety score S(t) in real time, and classify the current system status into different safety levels according to the preset thresholds θ1 and θ2;

[0049] Automatically trigger corresponding security policies based on the risk level of the system;

[0050] When the system is in a high-risk state, that is, S(t) ≥ θ2, restrict or prohibit high-privilege operations of specific users or roles, isolate the affected system or network segment, and send an emergency alert to the system administrator;

[0051] When the system is in a medium risk state, that is, θ1≤S(t)<θ2, increase the monitoring frequency of network traffic and system operations, enforce the multi-factor authentication process for all users, and review system changes and access records within 24 hours;

[0052] When the system is in a low-risk state, that is, S(t)<θ1, maintain regular monitoring and logging activities, regularly evaluate and apply the latest security patches and system updates, and send security reminders and training materials to users;

[0053] Record all automatically adjusted security policies, the comprehensive security score values ​​S(t) that trigger these policies, and related events to facilitate subsequent security analysis and policy optimization;

[0054] Regularly evaluate the effectiveness of security strategies and continuously optimize and adjust strategies based on the latest security threat intelligence and analysis results.

[0055] As a preferred solution of the method for constructing a safety protection system of a hydropower station monitoring system according to the present invention, the automatic repair and restoration of normal functions of the system when it is attacked or fails includes using the system health state vector H(t) to represent the health state of each part of the system at any time point t:

[0056]

[0057] Among them, h i (t) represents the health status of the i-th part of the system at time t, and the value range of i is [1, n];

[0058] When the i-th part of the system is completely normal at time t, h i (t) = 1;

[0059] When the i-th part of the system is attacked or fails at time t, h i (t) = 0;

[0060] The optimal repair strategy vector R(t) is calculated through the AI ​​model to guide the automatic repair of the system, which is expressed as:

[0061]

[0062] Among them, r(t) represents the candidate solution of the repair strategy vector, r i (t) represents the repair measures for the i-th part of the system.

[0063] A system for constructing a safety protection system for a hydropower station monitoring system, characterized in that it includes:

[0064] Security architecture building blocks: Build a multi-layered, hierarchical security architecture and make security measures at each level complement each other;

[0065] Security policy adjustment module: obtains real-time data from the network layer and data layer for analysis, uses artificial intelligence technology to analyze security threats in real time, and automatically adjusts security policies;

[0066] Repair module: automatically repairs and restores normal functions when the system is attacked or fails, and is combined with AI dynamic security strategies;

[0067] Encryption module: AES encryption algorithm is used to encrypt data, providing encryption protection for security measures at all levels.

[0068] Beneficial effects of the invention: The invention realizes the mutual complementation and coordination of security measures at all levels by constructing a multi-level and hierarchical security architecture, combining artificial intelligence technology to perform real-time security threat analysis and automatically adjust security strategies, and improves the overall protection capability of the system. In addition, the system has automatic repair and recovery functions when attacked or fails, effectively ensuring the continuous and stable operation and data security of the hydropower station monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the figures required for use in the description of the embodiments will be briefly introduced below. Obviously, the figures described below are only some embodiments of the present invention. For ordinary technicians in this field, other figures can be obtained based on these figures without paying creative work.

[0070] Figure 1 A flowchart of a method for constructing a safety protection system for a hydropower station monitoring system provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0071] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the specification drawings. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0072] Example 1, reference Figure 1 , which is an embodiment of the present invention, provides a method for constructing a safety protection system of a hydropower station monitoring system, comprising:

[0073] S1: Build a multi-layered and hierarchical security architecture and make the security measures at each level complement each other.

[0074] Build a multi-layered and hierarchical security architecture including the physical layer, network layer, data layer and application layer.

[0075] The physical layer includes the use of biometric technology to authenticate people entering the monitoring center to ensure that only authorized people enter.

[0076] The network layer includes the use of firewalls and intrusion detection systems to prevent external attacks and protect network security.

[0077] The data layer includes encrypting data using the Advanced Encryption Standard to ensure data confidentiality and integrity.

[0078] The application layer includes the introduction of access control and authentication mechanisms to ensure that only authorized users can access and operate the system.

[0079] The physical layer uses biometric technology to authenticate people entering the monitoring center and passes the verification results to the access control system at the application layer to ensure that only authenticated people can access and operate the system.

[0080] Firewalls and intrusion detection systems are deployed at the network layer to monitor network traffic in real time and detect abnormal behavior, and the detected abnormal behavior information is passed to the AI-driven dynamic security policy for analysis.

[0081] The data layer encrypts data using the Advanced Encryption Standard, and the key management system ensures the security of the encryption keys and is used in the access control mechanism of the application layer to ensure that only authenticated users can decrypt and access the data.

[0082] AI technology analyzes data collected from all levels in real time, identifies abnormal behaviors and potential security threats, and combines with behavioral analysis technology to adjust access rights and security policies in real time based on user behavior pattern recognition results.

[0083] It should be noted that biometric technology at the physical layer, such as fingerprint recognition or face recognition, ensures that people entering the monitoring center are strictly verified. This technology not only improves physical security, but also ensures that only authorized personnel are allowed to operate the system by passing the verification results to the access control system at the application layer. This multi-level verification method effectively prevents unauthorized personnel from entering the system and increases the security of the overall system.

[0084] The deployment of firewalls and intrusion detection systems at the network layer is one of the key steps. These systems can not only block known malicious attacks, but also detect and record abnormal behaviors by monitoring network traffic in real time. The detected information is passed to AI-driven dynamic security policies for further analysis. This design allows security protection to not only stay at the defense of known threats, but also dynamically adjust strategies to deal with unknown potential threats. This real-time response capability significantly improves the system's immunity to new attacks.

[0085] At the data layer, the Advanced Encryption Standard (AES) is used to encrypt data to ensure confidentiality and integrity during transmission and storage. Combined with the key management system, this layer ensures the secure management of encryption keys, making it difficult to decrypt and exploit even if the data is intercepted. The use of encryption technology provides a solid foundation for the application layer, as only authenticated users can decrypt and access the data, which significantly reduces the risk of data leakage.

[0086] The access control and authentication mechanism of the application layer is an important part of the present invention. By introducing multi-factor authentication and behavior analysis technology, this layer not only verifies the identity of the user, but also further enhances security by analyzing the user's behavior pattern. For example, by analyzing the user's operation pattern, the system can identify and block abnormal access requests, such as potential account theft. This multi-level verification and monitoring method effectively improves the security and credibility of the system.

[0087] S2: Obtain real-time data from the network layer and data layer for analysis, use artificial intelligence technology to analyze security threats in real time, and automatically adjust security policies.

[0088] Collect network traffic data, network protocol data, intrusion detection data and network topology data from the network layer; collect data storage access logs, data integrity verification results, data encryption status and database query logs from the data layer.

[0089] The collected data is standardized and preprocessed to make it suitable for input into the neural network.

[0090] The standardized data are and It is expressed as:

[0091]

[0092]

[0093] in, represents the standardized i-th input variable, represents the jth input variable after standardization; x irepresents the i-th data point collected by the network layer, y j Represents the jth data point collected by the data layer; Represents the i-th data point x collected by the network layer i The mean of Represents the jth data point y collected by the data layer j The mean of Represents the i-th data point x collected by the network layer i The standard deviation of Represents the jth data point y collected by the data layer j The standard deviation of .

[0094] In the first neural network, the standardized network layer data is subjected to preliminary feature extraction and processing, and weighted summation and activation function processing are performed, which can be expressed as:

[0095]

[0096] a1=f(z1)

[0097] Among them, z1 represents the weighted summation result of the first neural network, W1 represents the weight matrix, b1 represents the bias, N represents the number of input variables of the first neural network, α i represents the weight coefficient of the i-th input variable; f represents the activation function, and a1 represents the result after the activation function f is applied.

[0098] Integral operation is introduced to capture the time variation of network layer information. The formula is:

[0099]

[0100] Among them, I1(τ) represents the integration result of the first neural network, t represents the current time and serves as the upper limit of the integration; τ represents the time variable in the integration process. During the integration process, τ changes from 0 to t, and gradually accumulates the function value at each time point τ, and finally calculates the cumulative result I1(τ) at time t.

[0101] The standardized data of the data layer is processed in the second neural network, and weighted summation and activation are performed, which can be expressed as:

[0102]

[0103] a2=f(z2)

[0104] Integral operation is introduced to capture the time change of data layer information. The formula is:

[0105]

[0106] Wherein, z2 represents the weighted summation result of the second neural network, I2(τ) represents the integral result of the second neural network, W2 represents the weight matrix, b2 represents the bias, M represents the number of input variables of the second neural network, β j Represents the weight coefficient of the jth input variable.

[0107] The standardized values ​​of the network layer and data layer data are logarithmically transformed, and the dynamic changes over time are accumulated through integral calculation to calculate the weights w of the network layer and data layer. x and w y , the formula is:

[0108]

[0109]

[0110] Among them, γ x and γ y Respectively represent the data volatility of the network layer and the data layer in the period [0, t]; x and λ y Represents the time decay factor of the network layer and the data layer, which is used to adjust the impact of the current moment data.

[0111] It should be noted that by introducing the volatility parameter γ x (t) and γ y (t), and the time decay factor λ x and λ y , achieving dynamic adjustment of weights. This means that when data changes dramatically or the data of a certain layer fluctuates greatly, the weight of that layer will be appropriately increased to ensure that the system can better cope with real-time changes, improve response speed and decision-making accuracy. The influence of historical data is incorporated into the weight calculation through the time decay factor. This can balance short-term fluctuations and long-term trends, reasonably distribute the impact of network layer and data layer data, and avoid decision-making errors caused by short-term abnormal fluctuations.

[0112] The integral operation results of the first neural network and the second neural network are combined with the dynamic weight w x and w y Combined and processed by normalization function, the comprehensive safety score S(t) is obtained, which is expressed as:

[0113] S(t)=σ(w x I1(τ)+w y I2(τ)

[0114] Here, σ represents the normalization function.

[0115] Set the thresholds θ1 and θ2 of the comprehensive safety score S(t), θ2>θ1, and divide the system status into high risk, medium risk and low risk.

[0116] Monitor the changes of the comprehensive safety score S(t) in real time, and classify the current system status into different safety levels according to the preset thresholds θ1 and θ2.

[0117] Automatically trigger corresponding security policies based on the risk level of the system.

[0118] When the system is in a high-risk state, that is, S(t) ≥ θ2, high-privilege operations of specific users or roles are restricted or prohibited, the affected systems or network segments are isolated, and emergency alerts are sent to system administrators.

[0119] When the system is in a medium risk state, that is, θ1≤S(t)<θ2, increase the monitoring frequency of network traffic and system operations, enforce the multi-factor authentication process for all users, and review system changes and access records within 24 hours.

[0120] When the system is in a low-risk state, that is, S(t)<θ1, maintain regular monitoring and logging activities, regularly evaluate and apply the latest security patches and system updates, and send security reminders and training materials to users;

[0121] All automatically adjusted security policies, the comprehensive security score values ​​S(t) and related events that trigger these policies are recorded to facilitate subsequent security analysis and policy optimization.

[0122] Regularly evaluate the effectiveness of security strategies and continuously optimize and adjust strategies based on the latest security threat intelligence and analysis results.

[0123] Furthermore, by weighted summing the standardized network layer and data layer data, preliminary feature information can be extracted, and further nonlinear transformation can be performed through activation functions, which is crucial for the learning ability of neural networks. Specifically, the integral results of the first neural network and the second neural network are expressed as I1(t) and I2(t), respectively, which accurately capture the dynamic characteristics of the data layer and the network layer by accumulating the changing trend of data over time. This processing method can not only track the instantaneous changes in data, but also reflect the long-term trend of data, thereby providing more accurate security threat analysis.

[0124] Furthermore, by performing logarithmic transformation on the standardized values ​​of the network layer and data layer data and combining the time dynamic integral operation, the weights w of the network layer and data layer are calculated. x and w y , providing a more accurate weight adjustment for the final comprehensive security score S(t). The introduction of this dynamic weight ensures that the system can adaptively adjust the importance of data at different levels, thereby improving the flexibility and accuracy of the entire security protection system.

[0125] It should be noted that the present invention sets thresholds θ1 and θ2 for the comprehensive security score, and divides the system status into high risk, medium risk, and low risk. This setting is based on the comprehensive security score output by the multi-layer neural network, which effectively converts the abstract security score into specific operation instructions. By monitoring the score changes in real time, the system can automatically trigger the corresponding security strategy, for example, in a high-risk state, restrict high-authority operations and isolate the affected system. This dynamic response mechanism based on scoring makes the implementation of security strategies more accurate and efficient, and avoids security vulnerabilities caused by manual intervention delays in traditional security systems.

[0126] S3: Automatically repair and restore normal functions when the system is attacked or fails, and is combined with AI dynamic security strategies.

[0127] The system health state vector H(t) is used to represent the health status of each part of the system at any time point t:

[0128]

[0129] Among them, h i (t) represents the health status of the i-th part of the system at time t, and the value range of i is [1, n].

[0130] When the i-th part of the system is completely normal at time t, h i (t) = 1; when the i-th part of the system is attacked or fails at time t, h i (t)=0.

[0131] The optimal repair strategy vector R(t) is calculated through the AI ​​model to guide the automatic repair of the system, which is expressed as:

[0132]

[0133] Among them, r(t) represents the candidate solution of the repair strategy vector, r i (t) represents the repair measures for the i-th part of the system; the goal is to make each h i (t) Restore to health status of 1.

[0134] Furthermore, the system health status vector H(t) in the present invention provides a comprehensive monitoring framework that can detect the overall health status of the system in real time. In this way, the system can not only identify the current health status, but also detect potential threats or failures in a timely manner. This real-time monitoring function is crucial in maintaining system stability, especially in complex network environments, and can significantly improve the reliability and response speed of the system.

[0135] The AI ​​model is used to calculate the optimal repair strategy vector R(t). By considering multiple candidate solutions r(t) of the repair strategy, the AI ​​model can automatically select the most suitable repair measure based on the current health status H(t) of the system and external conditions. This not only simplifies the management process of complex systems, but also ensures the timeliness and effectiveness of the repair measures. For example, when the health status h of a part is detected, i (t) When the system drops below the normal level, the system can automatically select appropriate repair operations, such as restarting the device, reallocating resources, or updating software patches. Compared with traditional manual operations or static predefined strategies, the dynamic and intelligent repair method provided by the present invention greatly improves the system's recovery capability and operating efficiency.

[0136] By combining health status monitoring with AI-driven repair strategies, the present invention can respond quickly when the system is attacked or fails, and take corresponding measures to restore normal functions. This mechanism not only improves the security of the system, but also ensures its continuous and stable operation. In particular, through real-time analysis and automatic repair, the present invention effectively reduces system downtime and potential security risks, providing users with a higher level of service quality and security.

[0137] S4: Use the AES encryption algorithm to encrypt data and provide encryption protection for security measures at all levels.

[0138] Generate AES keys using a secure random number generator.

[0139] Divide the data into 16-byte blocks and fill the insufficient part with PKCS7.

[0140] Select CBC mode, and generate a random initialization vector (IV).

[0141] Encrypt the data using the AES key and IV.

[0142] Store or transmit the encrypted data and IV together.

[0143] When needed, decrypt using the same AES key and IV and strip the padding data.

[0144] It should be noted that generating high-quality random keys is the basis for ensuring encryption security. Using a secure random number generator can effectively prevent attackers from deciphering encrypted data by predicting keys or IVs. This measure ensures the randomness and unpredictability of keys, greatly improves the security of data encryption, and avoids security vulnerabilities caused by repeated or easy-to-guess keys.

[0145] Dividing data into 16-byte blocks is a basic requirement of the AES algorithm, and the PKCS7 padding method is used to handle the insufficient part. PKCS7 padding ensures that the length of all data blocks meets the requirements of AES encryption and can accurately restore the original data when decrypted. The standardized processing of this process allows the encryption and decryption process to adapt to data of any length while maintaining data integrity and consistency.

[0146] CBC (CipherBlock Chaining) mode is a secure encryption mode that uses the previous ciphertext block to perform an XOR operation with the next plaintext block before encryption, so that the same plaintext generates different ciphertexts in different blocks. Generating a random IV further ensures the uniqueness of each encryption process, even if the same data is encrypted multiple times, different ciphertexts will be generated. This unique encryption method prevents the repetition of ciphertext block patterns, making it difficult for attackers to infer the original data by analyzing repeated ciphertexts.

[0147] The data is encrypted using the AES key and IV, ensuring the confidentiality of the data during transmission and storage. The encrypted data is stored or transmitted together with the IV to ensure that the original data can be restored when decrypted. When decrypting, the same AES key and IV are used to accurately decrypt the data and remove the PKCS7 padding data. The design of this step ensures the integrity and confidentiality of the data, and it is difficult for attackers to crack the data content even if it is intercepted during data transmission.

[0148] The above embodiments also include a system for constructing a safety protection system for a hydropower station monitoring system, specifically:

[0149] Security architecture building blocks: Build a multi-layered, hierarchical security architecture and make security measures at each level complement each other.

[0150] Security policy adjustment module: obtains real-time data from the network layer and data layer for analysis, uses artificial intelligence technology to analyze security threats in real time, and automatically adjusts security policies.

[0151] Repair module: When the system is attacked or fails, it automatically repairs and restores normal functions, and combines with AI dynamic security strategies to ensure the continuous and stable operation of the system.

[0152] Encryption module: AES encryption algorithm is used to encrypt data, providing encryption protection for security measures at all levels.

[0153] The computer device may be a server. The computer device includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data cluster data of the power monitoring system. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for constructing a safety protection system for a hydropower station monitoring system is implemented.

[0154] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0155] Example 2 is an embodiment of the present invention, which provides a method for constructing a safety protection system for a hydropower station monitoring system. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation / comparative experiments.

[0156] In order to verify the effectiveness and advantages of the security protection system of the hydropower station monitoring system of the present invention, an experiment was carried out, which combined a multi-level security architecture and advanced encryption technology. The experiment was set up in a simulated hydropower station environment, including the physical layer, network layer, data layer and application layer. The main goal of the experiment was to evaluate the performance of the system under normal conditions, minor attacks, moderate attacks and severe attacks, and compare it with the existing conventional security architecture.

[0157] Test implementation steps:

[0158] Physical layer protection measures: Biometric technologies (such as fingerprint and face recognition) are implemented to verify the identity of people entering the monitoring center. The data includes the number of successful and failed authentication attempts, and the authentication results will be passed to the application layer through a secure channel to ensure that only authorized personnel can access the system.

[0159] Network layer security protection: Firewalls and intrusion detection systems (IDS) were deployed to monitor network traffic in real time and detect abnormal behavior. During the experiment, various network attacks such as DDoS attacks and malware injection were simulated to test the system's defense capabilities. The detected abnormal behavior data was passed to the AI-driven dynamic security policy module for analysis.

[0160] Data layer encryption protection: Use the AES-256 encryption algorithm to encrypt sensitive data. AES keys and IVs (initialization vectors) are generated using a secure random number generator, and the data is segmented and padded with PKCS7. The encrypted data is stored in a protected database, and decryption operations are performed when needed to ensure the confidentiality and integrity of the data during transmission and storage.

[0161] Application layer access control: Multi-factor authentication and access control mechanisms based on behavioral analysis are introduced. The system allows and blocks access for different users in simulation, and records the access control success rate and false rejection rate.

[0162] Dynamic security policy adjustment: AI technology is used to analyze data collected from the network layer and data layer in real time to generate a comprehensive security score for the system. Based on the score, the system automatically adjusts access rights and security policies. According to the preset high-risk, medium-risk, and low-risk thresholds, corresponding security measures are implemented respectively. The experimental data results are shown in Table 1.

[0163] Table 1 Experimental data table

[0164]

[0165]

[0166] The experimental data clearly demonstrates the performance of the hydropower station monitoring system of the present invention in various safety states, and compares and analyzes it with the existing technology. Under normal conditions, the health status of the system is 98.2%, showing a high degree of stability; under minor and moderate attack conditions, the health status drops slightly, but remains above 90%, significantly better than the performance of existing systems. The health status under severe attack conditions drops to 84.7%, but through AI-driven dynamic security policy adjustment and automatic repair functions, the system quickly recovers to 97.0%.

[0167] In terms of attack detection rate, the system of the present invention performs well in all states, especially in the upgraded state, with a detection rate of 96.7%, which is much higher than the average level of existing systems. This advantage is mainly due to the synergy of the system's integrated advanced firewall, IDS and AI analysis technology, which enables the system to quickly identify and respond to complex network threats.

[0168] The comparison of encryption and decryption time shows that the processing speed of the system of the present invention is better than the prior art in all states. The application of AES-256 encryption algorithm ensures the security of data while maintaining low time consumption. Under severe attack conditions, the encryption time is only 16.7ms and the decryption time is 19.9ms, showing strong processing power and efficiency.

[0169] The data of access control success rate shows that the system of the present invention reaches 99.4% in normal state and maintains above 91.2% in various attack states, indicating that its multi-factor identity authentication and behavior analysis mechanism perform well in preventing unauthorized access. Especially in severe attack states, potential security threats are effectively prevented by dynamically adjusting policies and automatically limiting high-authority operations.

[0170] The records of high-privilege restrictions and automatic repair time further demonstrate the system's ability to respond and recover quickly when attacked. When an attack occurs, the system can quickly restrict high-privilege operations, and the average automatic repair time is only 5.8 seconds in a severe attack state. After recovery, this time is further shortened to 1.5 seconds, indicating that the system has efficient self-healing capabilities.

[0171] In general, the hydropower station monitoring system of the present invention is not only superior to the existing technology in terms of security and response speed, but also significantly improves the security protection level of the system through innovative measures such as advanced encryption and dynamic policy adjustment. The experimental data fully proves the innovation and advantages of the present invention in practical applications, and provides a highly reliable and efficient solution for the safety management of hydropower stations.

[0172] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for constructing a safety protection system for a hydropower station monitoring system, characterized in that: include: Build a multi-layered and hierarchical security architecture, and make the security measures at each level complement each other; Obtain real-time data from the network layer and data layer for analysis, use artificial intelligence technology to analyze security threats in real time, and automatically adjust security policies; When the system is attacked or fails, it automatically repairs and restores normal functions, and is combined with AI dynamic security strategies; The AES encryption algorithm is used to encrypt data, providing encryption protection for security measures at all levels.

2. The method for constructing a safety protection system for a hydropower station monitoring system according to claim 1, characterized in that: The multi-layered and graded security architecture includes the physical layer, network layer, data layer and application layer; The physical layer includes using biometric technology to authenticate the identity of people entering the monitoring center; The network layer includes using firewalls and intrusion detection systems to prevent external attacks; The data layer includes encrypting data using the Advanced Encryption Standard AES; The application layer includes introducing access control and identity authentication mechanisms to ensure that only authorized users can access and operate the system.

3. The method for constructing a safety protection system for a hydropower station monitoring system according to claim 2, characterized in that: The security measures at each level complement each other and include the use of biometric technology at the physical layer to authenticate the identity of persons entering the monitoring center and pass the authentication results to the access control system at the application layer to ensure that only authenticated persons can access and operate the system; Firewalls and intrusion detection systems are deployed at the network layer to monitor network traffic in real time and detect abnormal behavior, and pass the detected abnormal behavior information to AI-driven dynamic security policies for analysis; The data layer uses the Advanced Encryption Standard to encrypt data. The key management system ensures the security of the encryption key and is used in the access control mechanism of the application layer to ensure that only authenticated users can decrypt and access the data. AI technology analyzes data collected from all levels in real time, identifies abnormal behaviors and potential security threats, and combines with behavioral analysis technology to adjust access rights and security policies in real time based on user behavior pattern recognition results.

4. The method for constructing a safety protection system for a hydropower station monitoring system according to claim 3, characterized in that: Acquiring real-time data from the network layer and the data layer includes collecting network traffic data, network protocol data, intrusion detection data and network topology data from the network layer; Collect data storage access logs, data integrity verification results, data encryption status, and database query logs from the data layer.

5. The method for constructing a safety protection system for a hydropower station monitoring system according to claim 4, characterized in that: The real-time analysis of security threats using artificial intelligence technology includes standardizing and preprocessing the collected data to make it suitable for input into a neural network; The standardized data are and It is expressed as: in, represents the standardized i-th input variable, represents the jth input variable after standardization; x i represents the i-th data point collected by the network layer, y j Represents the jth data point collected by the data layer; Represents the i-th data point x collected by the network layer i The mean of Represents the jth data point y collected by the data layer j The mean of Represents the i-th data point x collected by the network layer i The standard deviation of Represents the jth data point y collected by the data layer j The standard deviation of In the first neural network, the standardized network layer data is subjected to preliminary feature extraction and processing, and weighted summation and activation function processing are performed, which is expressed as: a1=f(z1 Among them, z1 represents the weighted summation result of the first neural network, W1 represents the weight matrix, b1 represents the bias, N represents the number of input variables of the first neural network, α i represents the weight coefficient of the i-th input variable; f represents the activation function, and a1 represents the result after the activation function f acts; Integral operation is introduced to capture the time variation of network layer information. The formula is: Among them, I1(τ) represents the integration result of the first neural network, t represents the current time and serves as the upper limit of the integration; τ represents the time variable in the integration process. During the integration process, τ changes from 0 to t, and the function value at each time point τ is gradually accumulated, and finally the cumulative result I1(τ) at time t is calculated; The standardized data of the data layer is processed in the second neural network, and weighted summation and activation are performed, which can be expressed as: a2=f(z2 Integral operation is introduced to capture the time change of data layer information. The formula is: Wherein, z2 represents the weighted summation result of the second neural network, I2(τ) represents the integral result of the second neural network, W2 represents the weight matrix, b2 represents the bias, M represents the number of input variables of the second neural network, β j Represents the weight coefficient of the jth input variable; The standardized values ​​of the network layer and data layer data are logarithmically transformed, and the dynamic changes over time are accumulated through integral calculation to calculate the weights w of the network layer and data layer. x and w y , the formula is: Among them, γ x and γ y Respectively represent the data volatility of the network layer and the data layer in the period [0, t]; x and λ y Indicates the time decay factor of the network layer and the data layer, which is used to adjust the impact of the current moment data; The integral operation results of the first neural network and the second neural network are combined with the dynamic weight w x and w y Combined and processed by normalization function, the comprehensive safety score S(t) is obtained, which is expressed as: S(t)=σ(w x ·I1(τ)+w y ·I2(τ)) Here, σ represents the normalization function.

6. The method for constructing a safety protection system for a hydropower station monitoring system according to claim 5, characterized in that: The automatic adjustment of the security strategy includes setting thresholds θ1 and θ2 of the comprehensive security score S(t), θ2>θ1, and dividing the system status into high risk, medium risk and low risk; Monitor the changes of the comprehensive safety score S(t) in real time, and classify the current system status into different safety levels according to the preset thresholds θ1 and θ2; Automatically trigger corresponding security policies based on the risk level of the system; When the system is in a high-risk state, that is, S(t) ≥ θ2, restrict or prohibit high-privilege operations of specific users or roles, isolate the affected system or network segment, and send an emergency alert to the system administrator; When the system is in a medium risk state, that is, θ1≤S(t)<θ2, increase the monitoring frequency of network traffic and system operations, enforce the multi-factor authentication process for all users, and review system changes and access records within 24 hours; When the system is in a low-risk state, that is, S(t)<θ1, maintain regular monitoring and logging activities, regularly evaluate and apply the latest security patches and system updates, and send security reminders and training materials to users; Record all automatically adjusted security policies, the comprehensive security score values ​​S(t) that trigger these policies, and related events to facilitate subsequent security analysis and policy optimization; Regularly evaluate the effectiveness of security strategies and continuously optimize and adjust strategies based on the latest security threat intelligence and analysis results.

7. The method for constructing a safety protection system for a hydropower station monitoring system according to claim 6, characterized in that: The automatic repair and restoration of normal functions of the system when it is attacked or fails includes using the system health state vector H(t) to represent the health state of each part of the system at any time point t: Among them, h i (t) represents the health status of the i-th part of the system at time t, and the value range of i is [1, n]; When the i-th part of the system is completely normal at time t, h i (t) = 1; When the i-th part of the system is attacked or fails at time t, h i (t) = 0; The optimal repair strategy vector R(t) is calculated through the AI ​​model to guide the automatic repair of the system, which is expressed as: Among them, r(t) represents the candidate solution of the repair strategy vector, r i (t) represents the repair measures for the i-th part of the system.

8. A system for constructing a safety protection system of a hydropower station monitoring system using the method according to any one of claims 1 to 7, characterized in that: Security architecture building blocks: Build a multi-layered, hierarchical security architecture and make security measures at each level complement each other; Security policy adjustment module: obtains real-time data from the network layer and data layer for analysis, uses artificial intelligence technology to analyze security threats in real time, and automatically adjusts security policies; Repair module: automatically repairs and restores normal functions when the system is attacked or fails, and is combined with AI dynamic security strategies; Encryption module: AES encryption algorithm is used to encrypt data, providing encryption protection for security measures at all levels.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images