Substation network security defense system based on artificial intelligence

Abstract

The invention discloses a substation network security defense system based on artificial intelligence. The system comprises a data collection module for collecting transformer substation network data; the anomaly detection module is used for identifying an abnormal mode and an intrusion behavior; the threat intelligence analysis module is used for identifying potential threat and vulnerability information; the intelligent security monitoring and response module is used for evaluating the network security state; the malicious code detection module is used for detecting, analyzing and isolating malicious software; the intelligent security prediction module is used for predicting a network security event and carrying out early warning prompt; the self-adaptive security policy module is used for automatically adjusting or updating an optimal security policy; the system updating and maintaining module is used for updating and maintaining system modules and functions; the user interface and alarm module is used for providing safety state display and alarm for a user; the data backup and recovery module is used for backing up and recovering key data; and a compliance auditing module which makes operation and configuration accord with security standards. According to the invention, hierarchical, intelligent and active protection of the transformer substation network is realized.

Description

Technical Field

[0001] The present invention belongs to the field of substation security, and in particular relates to a substation network security defense system based on artificial intelligence. Background Art

[0002] Cybersecurity has become an important part of protecting critical infrastructure such as substations. Substation network systems usually include control centers, servers, workstations, and field devices, which are interconnected through communication networks to achieve data exchange and remote monitoring. However, this interconnectivity also exposes substation networks to a variety of external and internal threats, such as malware attacks, unauthorized access, and system configuration flaws.

[0003] Traditional substation network security operations mainly rely on passive defense technologies such as firewalls, intrusion detection systems (IDS) and antivirus software. Although these methods can identify and intercept known attack patterns to a certain extent, they are often unable to cope with increasingly complex security threats, zero-day vulnerabilities and persistent threat (APT) attacks. In addition, due to the particularity and importance of substation networks, once they are seriously attacked, it may cause unstable power grid operation or even large-scale power outages, causing significant social impact and economic losses.

[0004] Therefore, in order to meet these challenges, it is necessary to provide a more advanced, proactive and comprehensive network security protection system to monitor network activities in real time, analyze potential risks, predict unknown attacks, automatically respond to security incidents, and be able to adapt to the real-time changing security environment while meeting industry standards and regulatory requirements to ensure that substations can maintain safe and stable operation in the face of various network threats. Summary of the invention

[0005] In order to address the deficiencies in the prior art, the present invention provides an artificial intelligence-based substation network security defense system to ensure the safe operation of critical infrastructure, respond to increasingly complex network security threats, and solve the technical problem of improving the information security protection capabilities of the power system in the networking era.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0007] The present invention first discloses a substation network security defense system based on artificial intelligence, comprising:

[0008] Data collection module, used to collect traffic data, log information, threat intelligence and related data of the substation network;

[0009] Anomaly detection module, which applies machine learning and deep learning algorithms to automatically identify abnormal patterns and potential intrusions in substation network traffic;

[0010] A threat intelligence analysis module is used to collect network threat intelligence data, parse and process the network threat intelligence data, and identify potential threats and vulnerability information;

[0011] Intelligent security monitoring and response module, which is used to collect log and event data from substation network devices and systems, evaluate the substation network security status, and automatically trigger corresponding defense actions based on the network security status;

[0012] Malicious code detection module, which is used to detect, analyze and isolate malware by checking suspicious files and simulating the execution of suspicious code;

[0013] Intelligent security prediction module, which is used to predict possible future cybersecurity incidents and provide early warnings based on the analysis of time series data and machine learning algorithms;

[0014] Adaptive security strategy module, which is used to analyze the current network status and historical security data, determine the dynamic changes of the substation network environment, and automatically adjust or update the optimal security strategy according to the dynamic changes of the network environment;

[0015] System update and maintenance module, which is used to regularly check for security-related updates and continuously update and maintain the system modules and their functions by verifying the updates found;

[0016] User interface and alarm module, used to convert network security data into graphical and chart interfaces, and provide users with security status display and alarm notification when security events or abnormal behaviors are detected;

[0017] Data backup and recovery module, used to automatically back up the key data of the substation network according to a predefined plan, and to restore the key data when a system failure or security incident is detected;

[0018] The compliance audit module is used to monitor the operation and configuration of the substation network security system and match them with the preset security standards, and adjust the operation and configuration according to the matching results to comply with the preset security standards.

[0019] The present invention further includes the following preferred embodiments:

[0020] The anomaly detection module further includes a traffic analysis submodule and a behavior analysis submodule;

[0021] The traffic analysis submodule collects raw traffic data from the data collection module in real time, preprocesses the data to remove noise, and classifies the cleaned data into normal or abnormal traffic; extracts key traffic features, and uses machine learning algorithms to perform in-depth analysis of the features to identify abnormal behaviors that do not match the normal pattern; immediately triggers an alarm when an anomaly is detected, and executes a response action according to a predefined security protocol;

[0022] The behavior analysis submodule is used to monitor the behavior of network entities to identify activities that do not match normal behavior patterns. First, a baseline pattern of normal behavior is established to capture activity data in the network in real time; by applying machine learning algorithms, a comparative analysis of actual behaviors is performed to identify activities that deviate from predefined patterns; once potential abnormal behavior is detected, an alarm is triggered and a response action is executed, the response action includes secondary verification, session termination, or initiation of further security investigation; and the normal behavior pattern is continuously updated and refined.

[0023] The threat intelligence analysis module further includes an intelligence collection submodule and a data analysis submodule;

[0024] The intelligence collection submodule is used to automatically collect threat intelligence from multiple sources to support the system's threat analysis and response actions, first establishing connections with multiple intelligence channels; then continuously monitoring all channels to obtain real-time information about newly generated threats, vulnerability disclosures, attack patterns, and malware activities; subsequently transmitting the collected intelligence to the system for further processing and analysis; and performing preliminary evaluation of the collected intelligence;

[0025] The data analysis submodule is used to deeply analyze and process the threat intelligence gathered by the intelligence collection submodule to identify potential attack vectors and security threats. First, the raw intelligence data is preprocessed, including cleaning, normalization and classification; then key information is extracted from text, image or sound intelligence, including the identity of the attacker, the technology used, the affected system, and the time and place of the attack; the extracted information is compared with the existing threat database to confirm whether the new intelligence is a variant of a known threat or a completely new threat; the processed data is converted into security indicators and warnings for evaluation and taking corresponding defensive actions.

[0026] The intelligent security monitoring and response module further includes a real-time monitoring submodule and a response coordination submodule;

[0027] The real-time monitoring submodule is used to observe network activities in real time and identify potential threats or violations. It first collects raw log and event data from network devices and systems, and then analyzes the data in real time to find abnormal patterns, suspicious behaviors or unauthorized access attempts; identifies important security indicators by applying detection algorithms; once a possible security incident is discovered, immediately triggers a predefined response process, including issuing an alarm, generating a detailed incident report, and initiating corresponding mitigation actions; and feeds back the detection results to the system to continuously optimize the detection strategy and response mechanism;

[0028] The response coordination submodule is used to coordinate and perform various emergency actions when potential threats are detected. Once abnormal behavior or potential threats are identified by the real-time monitoring submodule, the pre-set emergency plan is immediately activated to try to isolate the affected system and take action to block communications with malicious domains or IP addresses to prevent attacks. At the same time, relevant security incidents are notified to the network security team through designated channels. In addition, the response coordination submodule is linked with other security systems to collaboratively complete response tasks. The network is divided into multiple security areas through physical or virtual LAN network segmentation technology, and a micro-isolation strategy is implemented to limit cross-regional access.

[0029] The malicious code detection module further includes a static analysis submodule and a dynamic analysis submodule;

[0030] The static analysis submodule is used to perform non-runtime checks on suspicious files to identify potential malware. First, suspicious file samples from different parts of the network are received; then the received samples are analyzed using a variety of static analysis techniques, including checking the binary structure of the file, decompiling the code to view its logic, and analyzing the hash value and digital signature of the file to confirm its known attributes; once malicious features are identified or matched with samples in the known malware library, they will be marked as high risk and the security team will be notified for processing;

[0031] The dynamic analysis submodule is used to execute malicious code in a controlled and isolated environment so as to monitor and analyze its behavior in real time. First, a safe sandbox environment is prepared. The sandbox environment is a closed test space that simulates a real system environment and is used to execute suspicious files without affecting the actual production network. Malicious code is run in the sandbox, and various monitoring tools are used to track and record the behavioral characteristics of the code, and any network traffic and file samples generated when the code is running are captured to facilitate further in-depth analysis. Once the analysis is completed, a complete report is generated.

[0032] The intelligent safety prediction module further includes a time series analysis submodule and a machine learning prediction submodule;

[0033] The time series analysis submodule is used to process and analyze the time series data of security events in order to identify periodic patterns, long-term trends and abnormal fluctuations, collect timestamp data in security event logs, use time series analysis algorithms to model the data and extract key features; and issue an early warning if the data deviates from the normal pattern;

[0034] The machine learning prediction submodule analyzes historical and real-time data by applying machine learning algorithms to provide predictions of future threats for the substation network security system. It first collects network behavior data and security event records, and then uses data preprocessing to construct a feature set suitable for machine learning. It uses various algorithms to discover patterns and abnormal behaviors in the data, identify security threat patterns and predict future attack trends.

[0035] The adaptive security policy module further includes a policy generation submodule and a policy optimization submodule;

[0036] The policy generation submodule uses data analysis and pattern recognition algorithms to analyze current network conditions and historical security data, evaluate the effectiveness of existing security operations, and recommend adjustments or updates to optimal security policies, including modifying firewall rules, adjusting intrusion detection system parameters, and developing new access control policies; by collaborating with execution tools, the above policies are automatically deployed and continuously optimized dynamically;

[0037] The policy optimization submodule refines and improves network security policies through continuous feedback and learning mechanisms, collects various network behavior data and security events after the implementation of the policies, evaluates the effectiveness of the above policies in preventing threats and reducing vulnerabilities; adjusts existing policies or recommends new actions; the policy optimization submodule further works in conjunction with the machine learning prediction submodule to use predictive analysis to guide the fine-tuning of policies.

[0038] The system update and maintenance module includes an automatic update submodule and a maintenance scheduling submodule;

[0039] The automatic update submodule continuously ensures that the substation network security system is kept up to date by regularly checking for security-related updates, including security patches, virus definitions, and system upgrades; starting with connecting to the update servers of various software vendors and security providers to obtain the latest update information; once new updates are found to be available, verifying the compatibility of these updates with the current system and arranging for download and installation without affecting the normal operation of the network; verifying the integrity and authenticity of the files during the download process, and after the installation is complete, recording the update history and notifying the administrator;

[0040] The maintenance scheduling submodule is used to plan and execute regular review and maintenance tasks of the substation network security system, formulate a maintenance plan, which determines the review frequency and type of maintenance activities based on the characteristics of the network equipment and security system; then automatically set these tasks to run during off-peak hours to minimize the impact on network operations; when performing maintenance operations, perform system backup, configuration checks, performance monitoring and security vulnerability scanning operations; after completion, generate a detailed report summarizing the problems found and the repair actions implemented, and notify relevant personnel for review.

[0041] The user interface and alarm module further includes a visualization submodule and a notification submodule;

[0042] The visualization submodule converts network security data into intuitive graphs and charts, collects key data from various monitoring and analysis submodules, and uses data visualization technology to convert the collected data into dashboards, trend charts and reports, receiving content and formats that allow users to customize the display as needed, as well as set thresholds and alert levels;

[0043] When an important security event or abnormal behavior is detected, the notification submodule immediately sends a notification and alarm to the user, monitors the alarm information output by other submodules in real time, and determines whether it is necessary to send a notification to the user based on the predefined alarm level and notification strategy. Once it is determined that the user needs to be notified, the alarm information is conveyed through multiple channels; it supports custom settings, allowing users to choose the notification method and adjust the notification frequency according to their needs and preferences.

[0044] The data backup and recovery module further includes a regular backup submodule and a disaster recovery submodule;

[0045] The regular backup submodule is used to ensure that the key data in the substation network security system is automatically backed up according to a predefined plan. First, the data type and storage location to be backed up are determined, and then a specific backup plan is formulated. When the planned time arrives, the backup operation is automatically executed to copy the selected data to a secure storage medium. After the backup is completed, the integrity and recoverability of the backup data are verified to ensure that it can be restored smoothly when needed. The regular backup submodule further records the detailed information of each backup and promptly notifies the administrator of the backup status;

[0046] The disaster recovery submodule is used to activate the preset disaster recovery plan when a system failure or security incident is detected, including using the latest backup data to rebuild the damaged system and application, while ensuring that all key configurations and files are restored, and verifying the consistency and integrity of the data during the recovery process.

[0047] The compliance audit module further includes a standards compliance submodule and an audit record submodule;

[0048] The standards compliance submodule is used to perform regular security configuration and compliance checks, automatically review system settings, security policies and operating procedures, and compare them with national or international security standards; when any deviations or non-compliance items are detected, a report is generated and repair suggestions are made to ensure that system settings and operations comply with industry security standards; new industry trends and updated standards are tracked to remind administrators to make necessary adjustments;

[0049] The audit record submodule provides a log record function for the substation network security system for audit and analysis work, stores logs in a tamper-proof log warehouse, and supports efficient log query and retrieval functions.

[0050] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0051] The storage medium is used to store instructions;

[0052] The processor is used to operate according to the instructions to implement the aforementioned artificial intelligence-based substation network security defense system.

[0053] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the aforementioned artificial intelligence-based substation network security defense system is implemented.

[0054] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a substation network security defense system based on artificial intelligence, which effectively prevents, detects and mitigates security threats through real-time monitoring and automated rapid response mechanisms, reduces security incidents caused by external attacks or internal misoperations, and significantly enhances the security protection capabilities of the substation network. By using machine learning and data analysis technology, it is possible to learn and adapt to new threat patterns in real time, thereby intelligently identifying and defending against unknown attacks, improving the intelligence level of network protection, and ensuring that the configuration and operation of the substation network security system meet the latest industry standards and regulatory requirements, reducing the risk of violations during operation. In the event of a catastrophic event, it is possible to quickly restore key data and services, greatly reduce the impact of business interruptions, ensure the stability and reliability of the power grid, and play an important role in maintaining social and economic activities and public safety. Comprehensive audit tracking and log management not only improves the transparency of the system, but also provides detailed data support for subsequent analysis and continuous improvement of security vulnerabilities. The intuitive data visualization interface simplifies the complexity of network security, allowing non-professionals to easily understand and evaluate the current network security status, and enhance the overall security management level. Timely and effective notification and alarm systems ensure that relevant personnel can receive alarms at critical moments and take appropriate actions to prevent or mitigate security incidents, further enhancing the emergency response capabilities of the substation network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 It is a module diagram of the substation network security defense system based on artificial intelligence in the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0057] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0058] In view of the shortcomings of the prior art, the present invention proposes a substation network security defense system based on artificial intelligence, which realizes real-time threat monitoring and effective prevention in the substation network environment, integrates data analysis and machine learning algorithms in the network security strategy, improves the detection capability of unknown attacks and zero-day vulnerabilities, ensures that the security configuration, operation and behavior of the substation network system meet industry security standards and best practices, and meet regulatory requirements; quickly restores key data and services in the event of a catastrophic event, minimizes system downtime, and maintains business continuity; enhances the adaptive capability of the existing security system so that it can automatically optimize security operations based on real-time changing threat intelligence and network behavior; provides complete security event tracing and analysis capabilities through a detailed audit record and log management system, supports post-investigation and continuous security improvement; provides intuitive data visualization through a user-friendly interface, so that non-professionals can easily understand complex network security situations; establishes a comprehensive notification and alarm mechanism to ensure that when an important security incident is detected, relevant personnel can be notified and take action in a timely manner, realizing hierarchical, intelligent and proactive protection of the substation network, and significantly enhancing the security, stability and resilience of the network. At the same time, it optimizes the operation and maintenance process, reduces the complexity and cost of safety management, and provides strong technical support and guarantee for the safe and reliable operation of the power grid.

[0059] like Figure 1 As shown, the substation network security defense system based on artificial intelligence of the present invention includes:

[0060] Data collection module, used to collect traffic data, log information, threat intelligence and related data of the substation network;

[0061] An anomaly detection module is used to apply machine learning and deep learning algorithms to automatically identify abnormal patterns and potential intrusion behaviors in the substation network traffic. The anomaly detection module further includes a traffic analysis submodule and a behavior analysis submodule. The traffic analysis submodule collects raw traffic data from the data collection module in real time, preprocesses the data to remove noise, and then classifies the cleaned data into normal or abnormal traffic. Then, key traffic features are extracted and the features are deeply analyzed using machine learning algorithms to identify abnormal behaviors that do not match the regular pattern, which may indicate unauthorized access or an ongoing attack. When an anomaly is detected, the submodule immediately triggers an alarm and performs a response action in accordance with a predefined security protocol, such as blocking malicious communications. In addition, the traffic analysis submodule optimizes its detection capabilities through monitoring and feedback mechanisms in real time, so as to more effectively adapt to new threats and changing network environments. Deploy high-bandwidth network probes with at least 20Gbps processing power, and deep packet inspection (DPI) devices that support at least 10Gbps traffic decoding capabilities. These devices are configured to adaptively adjust, continuously monitor data exchanges inside and outside the substation through TCP session reconstruction, application layer data filtering, and traffic trend analysis, fully monitor all network traffic in and out of the data center, and export traffic data in real time through NetFlow or IPFIX protocol to achieve comprehensive visibility of the substation network, and can capture and record all network activities to provide immediate alerts to potential threats and conduct further analysis. The behavior analysis submodule is used to monitor the behavior of network entities to identify activities that do not match normal behavior patterns. Utilize multi-factor authentication MF and biometric security: For all users who access control systems and sensitive data, in addition to traditional password authentication, a multi-factor authentication solution based on the FIDO standard is required, combined with biometric technologies such as fingerprint or facial recognition, such as fingerprint scanning, facial recognition or iris scanning, to enhance the security of identity authentication and prevent unauthorized access. First, a baseline pattern of normal behavior is established to capture activity data in the network in real time, such as user login habits, device access frequency, service usage, etc.; then, by applying machine learning algorithms, such as behavior modeling and anomaly scoring, the actual behavior is compared and analyzed to identify activities that deviate from the predefined pattern. Once potential abnormal behavior is detected, this submodule will trigger an alarm and assist in performing appropriate response actions, such as secondary verification, session termination, or initiating further security investigation. In addition, as new data is collected in real time, the behavior analysis submodule continuously updates and refines normal behavior patterns to improve detection accuracy and adaptability; a series of advanced machine learning algorithms are used to establish a baseline for normal network behavior and identify abnormal activities that deviate from the normal pattern. First, through behavioral modeling technology, clustering algorithms (K-means, DBSCAN), the normal pattern of user or system behavior is constructed.Using the anomaly scoring mechanism, Isolation Forest, an anomaly score is assigned to each behavior to quantify its degree of deviation from normal behavior. The time series analysis algorithm, Autoregressive Model (AR), is applied to analyze behavioral data that changes over time to detect abnormal fluctuations. In some scenarios, single-class anomaly detection algorithms such as One-ClassSVM are used to identify anomalies from unlabeled data. At the same time, the chi-square test is used to determine whether individual observations are abnormal. Using the ensemble learning method, Gradient Boosting Decision Tree (GBDT), an ensemble of multiple weak prediction models is constructed to improve the performance of anomaly detection. The combined use of these algorithms enables the behavior analysis submodule to comprehensively and accurately monitor network behavior and promptly detect potential security threats. Through continuous model training and optimization, the behavior analysis submodule can adapt to the ever-changing network environment and maintain its efficient anomaly detection capabilities.

[0062] The threat intelligence analysis module is used to collect network threat intelligence data, parse and process the network threat intelligence data, and identify potential threats and vulnerability information. The threat intelligence analysis module further includes an intelligence collection submodule and a data analysis submodule. The intelligence collection submodule is used to automatically collect threat intelligence from multiple sources to support the threat analysis and response actions of the system. First, connections are established with multiple intelligence channels, including open source intelligence platforms, commercial security service providers, peer networks, and public security organizations; then, all channels are continuously monitored to obtain real-time information about newly generated threats, vulnerability disclosures, attack patterns, and malware activities. The collected intelligence is then transmitted to the system for further processing and analysis, such as deduplication, formatting, and storage to ensure the accuracy and accessibility of the information. In addition, the collected intelligence is preliminarily evaluated to determine its relevance and reliability, laying the foundation for the next step of in-depth analysis. Through this automated and dynamic information collection process, the intelligence collection submodule can provide timely and comprehensive external threat intelligence support for the substation network security defense system. The data analysis submodule is used to deeply analyze and process the threat intelligence gathered by the intelligence collection submodule, so as to identify potential attack vectors and security threats. The workflow starts with the preprocessing of the raw intelligence data, including cleaning, normalization and classification, to ensure data quality. Then, various analysis techniques, such as natural language processing (NLP) and pattern recognition, are used to extract key information from text, image or sound intelligence, such as the identity of the attacker, the technology used, the affected systems, and the time and place of the attack.

[0063] In a preferred embodiment, the threat intelligence analysis module applies natural language processing (NLP) and pattern recognition techniques to extract key information:

[0064] The natural language processing (NLP) includes text classification, sentiment analysis, and named entity recognition (NER) tasks.

[0065] The sentiment analysis uses a logistic regression model: Among them, p is the probability of positive sentiment, β is the model parameter, and x is the text feature.

[0066] The named entity recognition (NER) is based on the conditional random field CRF model, and its formula is: In the formula: P(Y|O) represents the conditional probability of the label sequence Y given the observation sequence O. Z(O) is the normalization factor (partition function) used to ensure that the sum of the probabilities is 1; is the weight of the feature function associated with a single label, corresponding to observation o i and label y i ; is the weight of the feature function associated with the label pair, corresponding to the adjacent observation o i , o i+1 and label pair y i ,y i+1 ; N is the length of the sequence.

[0067] The pattern recognition uses support vector machine (SVM) for image classification:

[0068]

[0069] Among them, w and b are model parameters, x i is the eigenvector, y i is a label, i is a slack variable.

[0070] The extracted information is compared with the existing threat database to confirm whether the new intelligence is a variant of a known threat or a completely new threat. Finally, the data analysis submodule converts the processed data into feasible security indicators and warnings for the network security team to evaluate and take corresponding defensive actions. Through this process, the data analysis submodule is able to convert the original threat intelligence into actually usable intelligence assets to ensure the security of the substation network; the analysis results of the threat intelligence analysis module are used to further feed back to the data collection module to guide it to optimize the data collection strategy, ensure that the system can more accurately capture data indicating threats, and improve the defense capabilities against complex network threats;

[0071] The intelligent security monitoring and response module is used to collect log and event data from substation network devices and systems, evaluate the network security status of the substation, and automatically trigger corresponding defense actions based on the network security status. The intelligent security monitoring and response module further includes a real-time monitoring submodule and a response coordination submodule. The real-time monitoring submodule, as the core of the intelligent security monitoring and response system, is used to observe network activities in real time to quickly identify potential threats or violations. Its workflow first collects raw log and event data from network devices and systems, and then analyzes the data in real time to find abnormal patterns, suspicious behaviors or unauthorized access attempts. By applying detection algorithms, such as rule engines and abnormal behavior detection, important security indicators are accurately identified in hundreds of millions of events. The rule engine evaluates network events in real time through a series of preset logical rules, such as conditional statements IF (A AND B) THEN C, where A and B represent event attributes and C represents the triggered action. Once a pattern that meets the rules is detected, the rule engine immediately initiates the predetermined response measures to ensure a rapid response to known threats. At the same time, the abnormal behavior detection algorithm uses statistical and machine learning techniques to conduct in-depth analysis of network behavior. For example, using threshold-based methods, by setting limits on specific indicators, such as IF X>Threshold THEN Alert, where X is the observed network behavior indicator and Threshold is the upper limit of the predetermined normal behavior range. In addition, clustering algorithms such as K-means or DBSCAN optimize the objective function Where: J is the objective function to be minimized, which represents the total squared error. k is the number of clusters. x is the data point. S i is the set of points in the ith cluster. i is the center of the ith cluster. i is the distance from data point x to cluster center μ i The Euclidean distance of . This method realizes the pattern recognition of network behavior and the detection of abnormal points. Based on the long short-term memory network (LSTM), h t =LSTM(h t-1 , x t ) to learn the temporal dependency of sequence data, where h t is the hidden state at time step t, x tis input to identify complex network behavior patterns. Through the combination of these algorithms, the ability to identify known attack patterns is improved, and the prediction and defense of unknown threats are enhanced. Once a possible security incident is discovered, the predefined response process is immediately triggered, including sending an alert to the security team, generating a detailed incident report, and initiating corresponding mitigation actions. The real-time monitoring submodule integrates security event log collection, event correlation analysis, and real-time alarm functions, and deploys a security event management system with at least 100TB storage capacity and the ability to process 100,000 events per second. The system provides key performance indicators (KPIs) and key security indicators (KSIs), and pushes key alerts via email, SMS or mobile applications. It achieves rapid response and effective management of security incidents, and also supports complex event processing (CEP) and security orchestration automated response (SOAR) functions to improve event processing efficiency. In addition, the real-time monitoring submodule further feeds back the detection results to the system to continuously optimize the detection strategy and response mechanism to ensure that network security protection can keep pace with the times. Through the above real-time monitoring, the security status of the substation network is strictly controlled. The response coordination submodule is used to quickly coordinate and execute various emergency actions when potential threats are detected. The specific workflow is as follows: Once abnormal behavior or potential threats are identified by the real-time monitoring submodule, the pre-set emergency plan is immediately initiated. First, try to isolate the affected system to prevent the threat from spreading to other parts of the network. Then, take action to block communications with malicious domains or IP addresses to prevent attacks. At the same time, it ensures that the details of relevant security incidents are recorded and notified to the network security team through designated channels such as email, SMS or visual dashboards. In addition, the response coordination submodule also interacts with other security systems, such as firewalls, intrusion prevention systems, etc., to collaboratively complete more complex response tasks. The network is divided into multiple security areas through physical or virtual LAN network segmentation technology, and micro-isolation strategies are implemented to limit cross-regional access. Reduce the attack surface and improve the overall security of the network. Through this efficient and orderly automated response mechanism, the response coordination submodule ensures that the substation network can quickly respond to various security threats and minimize potential damage;

[0072] The malicious code detection module is used to detect, analyze and isolate malware by checking suspicious files and simulating the execution of suspicious codes. The malicious code detection module further includes a static analysis submodule and a dynamic analysis submodule. The static analysis submodule is used to perform non-runtime checks on suspicious files to identify potential malware. Its workflow is to first receive suspicious file samples from different parts of the network. Then, a variety of static analysis techniques are used to analyze the received samples, including checking the binary structure of the file, decompiling the code to view its logic, and analyzing the hash value and digital signature of the file to confirm its known properties. Binary analysis tools are used to parse the format and structure of the file, such as the executable file of the PE (Portable Executable) structure on the Windows system. By viewing the file header, section table, import table and export table, etc., the composition and function of the program can be understood. Use a decompiler (such as IDA Pro, Ghidra) to convert the binary code into assembly language or pseudocode, or even high-level language code. By analyzing the decompiled code, security analysts can manually check the logic of the program and look for signs of malicious behavior, such as abuse of system calls or suspicious API call sequences. Calculate the hash value of the file (such as MD5, SHA-1, SHA-256) to determine the integrity and identification of the file. By comparing with the hash value database of known malware, you can quickly identify whether it is a known malicious sample. Check whether the file is accompanied by a valid digital signature and whether the signature is issued by a trusted certificate authority (CA). Use a formula to verify the signature. In the RSA signature scheme, verify Where y is the digital signature, d is the public key exponent of the receiver, x is the hash value of the original message, e is the private key exponent of the sender, and n is the modulus. Heuristic analysis techniques are applied to identify files that do not directly match known malware but may exhibit malicious behavior. This may include analyzing the strings contained in the file, the API functions called, the import and export behavior of the file, etc. Static analysis may be used in conjunction with a sandbox environment to observe the behavior of the file in a controlled environment to further verify its security. The above techniques are integrated into an automated static analysis platform to enable rapid analysis of a large number of suspicious files. Through these methods, the possible behavior and intention of the file can be evaluated without actually executing the file. Once malicious features are identified or matched with samples in a known malware library, they will be marked as high risk and notified to the security team for processing. In addition, static analysis results also help update and optimize malware detection rules and defense mechanisms. Through this comprehensive static analysis process, the substation network security system can effectively identify and isolate malware to prevent it from causing damage to the network. The dynamic analysis submodule is used to execute malicious code in a controlled and isolated environment so that its behavior can be monitored and analyzed in real time. Its workflow includes first preparing a safe sandbox environment, which is a closed test space that simulates the real system environment and is used to execute suspicious files without affecting the actual production network. Then, the malicious code is run in the sandbox, while various monitoring tools are used to track and record the behavioral characteristics of the code, such as network communication, file operations, registry changes, process creation, etc. In addition, the dynamic analysis submodule also captures any network traffic and file samples generated when the code is running, which facilitates further in-depth analysis. Once the analysis is completed, the submodule will generate a complete report, including the behavioral characteristics of the malware, the scope of impact, the propagation method, and the possible source of infection. Through the precise dynamic analysis process, the substation network security system can deeply understand the attack mechanism of the malware and effectively respond to complex security threats; encrypted communication protocols and endpoint protection implement TLS / SSL, VPN, IPSec and other technologies to ensure the security of data transmission, enable at least 256-bit AES encryption for all data transmission, and force all remote access to pass through a VPN tunnel with at least 2048-bit CA certificates. At the same time, anti-virus software, advanced threat protection (ATP) solutions and EDR (Endpoint Detection and Response) systems are deployed on terminal devices, definition files are updated at least once a week, and real-time monitoring functions are enabled to prevent malware infection and data leakage. Signature-based detection and abnormal behavior analysis are combined to identify malicious activities. High-performance IDS / IPS devices are used, with at least 10Gbps intrusion detection and defense capabilities, and are configured with the latest threat intelligence database, which is automatically updated every 4 hours.Take proactive actions, such as blocking attack traffic, isolating infected systems, and performing attack source tracking to prevent the spread of threats and protect critical infrastructure. Effectively identify and block malicious traffic to reduce the risk of security vulnerabilities;.

[0073] The intelligent security prediction module is used to predict possible future network security events and provide early warning prompts based on the analysis of time series data and machine learning algorithms. The intelligent security prediction module further includes a time series analysis submodule and a machine learning prediction submodule. The time series analysis submodule is used to process and analyze the time series data of security events in order to identify periodic patterns, long-term trends, and abnormal fluctuations therein. Its workflow includes using a historical data set containing at least 180 days of network traffic logs to collect timestamp data in security event logs, such as the time, duration, and frequency of events. Then, using time series analysis algorithms such as autoregressive models (AR), moving average models (MA), seasonal decomposition, and exponential smoothing (Holt-Winters), the data is modeled and key features are extracted. These algorithms detect regular behaviors in the data, such as regular network traffic peaks or frequent security events in a specific time period. If the data is found to deviate from the normal pattern or there is an inconspicuous trend change, the time series analysis submodule will issue an early warning to alert the network security team of potential risks or attack activities. In addition, the analysis results are also used to guide the adjustment and optimization of network security protection actions, such as strengthening monitoring efforts during specific time periods or deploying preventive security strategies. By continuously monitoring time series data, an effective tool is provided for the substation network security defense system to predict and prevent possible security threats in the future. The machine learning prediction submodule analyzes historical and real-time data by applying machine learning algorithms to provide predictions of future threats for the substation network security system. It first collects a large amount of network behavior data and security event records, and then uses data preprocessing technology to construct a feature set suitable for machine learning. With the help of various algorithms such as decision trees, random forests, artificial neural networks (ANN), support vector machines (SVM) and deep learning, the model is trained to discover patterns and abnormal behaviors in the data, identify security threat patterns and predict future attack trends, and realize an intelligent threat warning system. After rigorous evaluation and adjustment, these models are used to analyze historical and real-time network data to identify and warn potential security risks, and pass intelligence to the response system to take corresponding actions. With the real-time access of new data and the cycle of learning feedback, the prediction submodule continues to improve its accuracy and response speed, making network security defense more proactive and accurate.

[0074] In a preferred embodiment, the time series analysis uses an autoregressive integrated moving average (ARIMA) model:

[0075]

[0076] Among them, X t is the value of the time series at time point t, c is a constant term, and θ are model parameters, ∈ t is the error term.

[0077] The adaptive security policy module is used to analyze the current network status and historical security data, determine the dynamic changes of the substation network environment, and automatically adjust or update the optimal security policy according to the dynamic changes of the network environment. Through dynamic access control (DAC) and role-based access control (RBAC) policies, the access control list (ACL) and firewall rules are dynamically adjusted according to real-time risk assessment. The linkage between security events and policy adjustments is realized, and the response time does not exceed 5 minutes. Improve the flexibility and response speed of network security policies. The adaptive security policy module further includes a policy generation submodule and a policy optimization submodule. The policy generation submodule uses data analysis and pattern recognition algorithms to analyze the current network status and historical security data, evaluate the effectiveness of existing security operations, and recommend adjustments or updates to the optimal security policy based on this information. The data analysis and pattern recognition algorithms first collect key data from multiple nodes of the substation network through data collection and integration. Subsequently, in the data preprocessing stage, data cleaning and normalization are performed, using the minimum-maximum normalization formula To unify the data format and ensure the accuracy of analysis. Feature engineering further extracts and selects key features related to security, and uses statistical measures such as mutual information to evaluate the effectiveness of features. The K-means clustering algorithm is used to minimize the reconstruction error. To identify the inherent patterns in the data, algorithms such as One-Class SVM are used to identify abnormal points that deviate from the normal pattern. ci is the cluster center, x i Each data point represents an instance in the network behavior data, which may include features such as timestamp, traffic size, source address, and destination address.

[0078] On this basis, the logistic regression machine learning model is used to Where: P(y=1|x) is the probability that an event belongs to category 1 (for example, representing a security threat) given the feature vector x. w is the weight vector. b is the bias term. x is the feature vector that contains all the features used for prediction. The loss function for logistic regression usually uses logarithmic loss (also called cross-extraction loss), which is formulated as: Where: n is the number of samples. i is the actual label of the i-th sample. iis the feature vector of the i-th sample. The gradient descent algorithm is used to minimize the loss function L by iteratively updating the weight w and bias b. The update rule is: Among them: α is the learning rate, which controls the learning step size. and are the partial derivatives of the loss function with respect to weights and biases, respectively. The generation and optimization of security policies is achieved by adjusting the model parameters (weights and biases) to minimize the loss of security events. This can be achieved through a logistic regression model and a gradient descent algorithm, where the update of the model parameters aims to improve the accuracy of identifying security threats. The automated tool deploys the updated security policy to the network and continuously monitors its effects. This ensures that the policy can adapt to changes in the network environment and continuously learn and adapt through feedback and iteration, forming a closed-loop continuous improvement process. In this way, the logistic regression model and the gradient descent algorithm together provide an intelligent security protection barrier for the substation, which can effectively predict and respond to various security threats.

[0079] The system update and maintenance module is used to regularly check for security-related updates, and continuously update and maintain the system modules and their functions by verifying the discovered updates. The system update and maintenance module includes an automatic update submodule and a maintenance scheduling submodule. The automatic update submodule continuously ensures that the substation network security system is kept up to date by regularly checking for security-related updates, including security patches, virus definitions, and system upgrades. Its workflow includes: starting with connecting to the update servers of various software vendors and security providers to obtain the latest update information. Once new updates are found to be available, verify the compatibility of these updates with the current system, and arrange for download and installation without affecting the normal operation of the network. During the download process, verify the integrity and authenticity of the file to avoid installing malicious or damaged updates. After the installation is completed, the automatic update submodule will record the update history and notify the administrator to ensure transparency and traceability, ensure that the security protection actions of the substation network can respond to newly generated threats and vulnerabilities in a timely manner, and maintain the stability and security of the network environment. The maintenance scheduling submodule is used to plan and execute regular review and maintenance tasks for the substation network security system. Its workflow first includes developing a maintenance plan that determines the review frequency and type of maintenance activities based on the characteristics of network devices and security systems and industry best practices. These tasks are then automatically set to run during off-peak hours to minimize the impact on network operations. When performing maintenance work, operations such as system backup, configuration check, performance monitoring, and security vulnerability scanning are performed. Upon completion, the maintenance scheduling submodule generates a detailed report summarizing the problems found and the repair actions implemented, and notifies relevant personnel for review. Through this orderly maintenance process, the maintenance scheduling submodule ensures that the substation network security system continues to operate in an optimal state, while promptly discovering and resolving potential security issues;

[0080] The user interface and alarm module is used to convert network security data into a graphical and chart interface, and provide security status display and alarm notification to the user when a security event or abnormal behavior is detected. The user interface and alarm module further includes a visualization submodule and a notification submodule. The visualization submodule converts complex network security data into intuitive graphics and charts so that users can easily understand the security status of the network. Its workflow begins with collecting key data from various monitoring and analysis submodules, such as threat detection, event logs, and system performance indicators. Then, data visualization technology is used to convert this information into easy-to-interpret dashboards, trend charts, and reports. These visual elements not only show real-time security events and alarms, but also include the output of historical trend analysis and predictive models. The visualization submodule also allows users to customize the content and format of the display as needed, as well as set thresholds and alarm levels, thereby providing a personalized monitoring experience. Through this interactive visualization interface, problem areas can be quickly identified, information-based decisions can be specified, and network security status can be effectively communicated to non-technical personnel. The notification submodule immediately sends notifications and alarms to users when important security events or abnormal behaviors are detected. Its workflow includes real-time monitoring of alarm information output by other submodules, and judging whether it is necessary to send notifications to users based on predefined alarm levels and notification policies. Once it is determined that users need to be notified, this submodule ensures timely communication of alarm information through multiple channels such as email, SMS, mobile app push or desktop pop-up windows. In addition, the notification submodule also supports custom settings, allowing users to choose notification methods and adjust notification frequency according to their needs and preferences. Through this timely and flexible notification mechanism, security teams can respond quickly to potential threats, thereby shortening incident response time and reducing security risks.

[0081] The data backup and recovery module is used to automatically back up the key data of the substation network according to a predefined plan, and to recover the key data when a system failure is detected or a security incident occurs. Use snapshots and real-time data replication technology to ensure timely backup of key data. Develop and test disaster recovery plans so that when the system is damaged, it can quickly recover to normal operation and minimize service interruption. The data backup and recovery module also includes offline and cloud storage solutions to ensure that key data and services are restored within 1 hour to achieve data redundancy and recoverability. The cloud storage service provides 99.999% data reliability to minimize the impact of disaster events on substation operations. The data backup and recovery module further includes a regular backup submodule and a disaster recovery submodule. The regular backup submodule is used to ensure that the key data in the substation network security system is automatically backed up according to a predefined plan. First, determine the type of data and storage location to be backed up, and then develop a specific backup plan, such as backup frequency, time point, and retention period. When the scheduled time arrives, the backup operation is automatically performed to copy the selected data to a secure storage medium, which may include a local disk, network attached storage (NAS) or cloud storage service. After the backup is completed, the integrity and recoverability of the backup data are verified to ensure that it can be restored smoothly when needed. The regular backup submodule further records the details of each backup and promptly notifies the administrator of the backup status so that quick action can be taken when any problems arise. Through this automated and reliable backup mechanism, the substation network security system is able to provide a strong protection barrier against data loss or damage. The disaster recovery submodule plays the role of emergency response in the substation network security system. When the system is seriously damaged, it can quickly restore critical data and services. When a system failure or a major security incident is detected, the preset disaster recovery plan is immediately activated. This includes using the latest backup data to rebuild the damaged system and application, while ensuring that all critical configurations and files are restored. During the recovery process, the consistency and integrity of the data are verified to ensure the success of the recovery operation. The disaster recovery submodule also works seamlessly with the regular backup submodule to ensure that the most recent and uninfected backup copy is used. Through this efficient and orderly recovery mechanism, system downtime is minimized, ensuring that the critical operations of the substation can quickly return to normal track.

[0082] The compliance audit module is used to monitor the operation and configuration of the substation network security system and match it with the preset security standards, and adjust the operation and configuration according to the matching results to comply with the preset security standards. The compliance audit module further includes a standard compliance submodule and an audit record submodule. The standard compliance submodule is used to monitor the operation and configuration of the substation network security system to ensure that they comply with relevant industry standards and best practices. The workflow includes regular security configuration and compliance checks, automatic review of system settings, security policies and operating procedures, and comparison with national or international security standards such as ISO / IEC 27001, NIST framework, etc. When any deviation is detected, that is, non-compliance items are found, a report is generated and repair suggestions are made to ensure that the system settings and operations comply with industry security standards such as NISTSP 800-53, International Electrotechnical Commission (IEC) standards, and national and regional regulatory requirements. In addition, the standard compliance submodule tracks new industry trends and updated standards, and promptly reminds administrators to make necessary adjustments. Through this continuous monitoring and evaluation mechanism, the standard compliance submodule helps the substation network security system maintain a clearly defined compliance framework, reducing the risk of violations and improving the overall security posture. The audit record submodule provides detailed logging capabilities for the substation network security system to facilitate future audits and analysis. Its workflow covers the automatic capture and classification of details of all security-related events, including intrusion attempts, system warnings, user operations, and configuration changes. These logs are securely stored in an unalterable log warehouse to prevent data loss or tampering. At the same time, it supports efficient log query and retrieval functions, allowing security analysts to quickly locate specific events, analyze potential security threats, or audit the overall operation of the system. Through this comprehensive recording mechanism, the audit record submodule not only helps meet compliance requirements, but also provides valuable data support for identifying patterns, optimizing security policies, and improving network behavior.

[0083] The substation network security defense method based on artificial intelligence disclosed in the present invention comprises the following steps:

[0084] The data collection module collects traffic data, log information, threat intelligence and related data of the substation network;

[0085] Automatically identify abnormal patterns and potential intrusion behaviors in the collected substation network traffic by applying machine learning and deep learning algorithms through the anomaly detection module;

[0086] The threat intelligence analysis module collects network threat intelligence data, and parses and processes the network threat intelligence data to identify potential threats and vulnerability information;

[0087] The intelligent security monitoring and response module collects log and event data from substation network devices and systems, evaluates the substation network security status, and automatically triggers corresponding defense actions based on the network security status;

[0088] The malicious code detection module checks suspicious files and simulates the execution of suspicious codes to detect, analyze and isolate malicious software;

[0089] The intelligent security prediction module performs analysis based on time series data and machine learning algorithms to predict possible future network security incidents and provide early warning prompts;

[0090] The adaptive security strategy module analyzes the current network status and historical security data, determines the dynamic changes of the substation network environment, and automatically adjusts or updates the optimal security strategy according to the dynamic changes of the network environment;

[0091] Regularly check security-related updates through the system update and maintenance module, and continuously update and maintain the system modules and their functions by verifying the updates found;

[0092] The network security data is converted into a graphical and chart interface through the user interface and the alarm module, and when a security incident or abnormal behavior is detected, a security status display and an alarm notification are provided to the user;

[0093] The data backup and recovery module automatically backs up the key data of the substation network according to a predefined plan, and recovers the key data when a system failure is detected or a security incident occurs;

[0094] The operation and configuration of the substation network security system are monitored by the compliance audit module and matched with the preset security standards. The operation and configuration are adjusted according to the matching results to comply with the preset security standards.

[0095] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a substation network security defense system based on artificial intelligence, which effectively prevents, detects and mitigates security threats through real-time monitoring and automated rapid response mechanisms, reduces security incidents caused by external attacks or internal misoperations, and significantly enhances the security protection capabilities of the substation network. By using machine learning and data analysis technology, it is possible to learn and adapt to new threat patterns in real time, thereby intelligently identifying and defending against unknown attacks, improving the intelligence level of network protection, and ensuring that the configuration and operation of the substation network security system meet the latest industry standards and regulatory requirements, reducing the risk of violations during operation. In the event of a catastrophic event, it is possible to quickly restore key data and services, greatly reduce the impact of business interruptions, ensure the stability and reliability of the power grid, and play an important role in maintaining social and economic activities and public safety. Comprehensive audit tracking and log management not only improves the transparency of the system, but also provides detailed data support for subsequent analysis and continuous improvement of security vulnerabilities. The intuitive data visualization interface simplifies the complexity of network security, allowing non-professionals to easily understand and evaluate the current network security status, and enhance the overall security management level. Timely and effective notification and alarm systems ensure that relevant personnel can receive alarms at critical moments and take appropriate actions to prevent or mitigate security incidents, further enhancing the emergency response capabilities of the substation network environment.

[0096] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned artificial intelligence-based substation network security defense method. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the aforementioned artificial intelligence-based substation network security defense method.

[0097] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electrical signal transmitted by wire.

[0098] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0099] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, executed as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A substation network security defense system based on artificial intelligence, characterized in that: include: Data collection module, used to collect traffic data, log information, threat intelligence and related data of the substation network; Anomaly detection module, which applies machine learning and deep learning algorithms to automatically identify abnormal patterns and potential intrusions in substation network traffic; A threat intelligence analysis module is used to collect network threat intelligence data, parse and process the network threat intelligence data, and identify potential threats and vulnerability information; Intelligent security monitoring and response module, which is used to collect log and event data from substation network devices and systems, evaluate the substation network security status, and automatically trigger corresponding defense actions based on the network security status; Malicious code detection module, which is used to detect, analyze and isolate malware by checking suspicious files and simulating the execution of suspicious code; Intelligent security prediction module, which is used to predict possible future cybersecurity incidents and provide early warnings based on the analysis of time series data and machine learning algorithms; Adaptive security strategy module, which is used to analyze the current network status and historical security data, determine the dynamic changes of the substation network environment, and automatically adjust or update the optimal security strategy according to the dynamic changes of the network environment; System update and maintenance module, which is used to regularly check for security-related updates and continuously update and maintain the system modules and their functions by verifying the updates found; User interface and alarm module, used to convert network security data into graphical and chart interfaces, and provide users with security status display and alarm notification when security events or abnormal behaviors are detected; Data backup and recovery module, used to automatically back up the key data of the substation network according to a predefined plan, and to restore the key data when a system failure or security incident is detected; The compliance audit module is used to monitor the operation and configuration of the substation network security system and match them with the preset security standards, and adjust the operation and configuration according to the matching results to comply with the preset security standards.

2. The substation network security defense system based on artificial intelligence according to claim 1 is characterized in that: The anomaly detection module further includes a traffic analysis submodule and a behavior analysis submodule; The traffic analysis submodule collects raw traffic data from the data collection module in real time, pre-processes the data to remove noise, and classifies the cleaned data into normal or abnormal traffic; extracts key traffic features, and uses machine learning algorithms to perform in-depth analysis of the features to identify abnormal behaviors that do not match regular patterns; When an anomaly is detected, an alarm is triggered immediately and response actions are executed according to the predefined security protocol; The behavior analysis submodule is used to monitor the behavior of network entities to identify activities that do not match normal behavior patterns. First, a baseline pattern of normal behavior is established to capture activity data in the network in real time; by applying machine learning algorithms, a comparative analysis of actual behaviors is performed to identify activities that deviate from predefined patterns; once potential abnormal behavior is detected, an alarm is triggered and a response action is executed, the response action includes secondary verification, session termination, or initiation of further security investigation; and the normal behavior pattern is continuously updated and refined.

3. The substation network security defense system based on artificial intelligence according to claim 2 is characterized in that: The threat intelligence analysis module further includes an intelligence collection submodule and a data analysis submodule; The intelligence collection submodule is used to automatically collect threat intelligence from multiple sources to support the system's threat analysis and response actions, first establishing connections with multiple intelligence channels; then continuously monitoring all channels to obtain real-time information about newly generated threats, vulnerability disclosures, attack patterns, and malware activities; subsequently transmitting the collected intelligence to the system for further processing and analysis; and performing preliminary evaluation of the collected intelligence; The data analysis submodule is used to deeply analyze and process the threat intelligence gathered by the intelligence collection submodule to identify potential attack vectors and security threats. First, the raw intelligence data is preprocessed, including cleaning, normalization and classification; then key information is extracted from text, image or sound intelligence, including the identity of the attacker, the technology used, the affected system, and the time and place of the attack; the extracted information is compared with the existing threat database to confirm whether the new intelligence is a variant of a known threat or a completely new threat; the processed data is converted into security indicators and warnings for evaluation and taking corresponding defensive actions.

4. The substation network security defense system based on artificial intelligence according to claim 3 is characterized in that: The intelligent security monitoring and response module further includes a real-time monitoring submodule and a response coordination submodule; The real-time monitoring submodule is used to observe network activities in real time and identify potential threats or violations. It first collects raw log and event data from network devices and systems, and then analyzes the data in real time to find abnormal patterns, suspicious behaviors or unauthorized access attempts; and identifies important security indicators by applying detection algorithms; Once a possible security incident is discovered, the predefined response process is immediately triggered, including issuing an alarm, generating a detailed incident report, and initiating corresponding mitigation actions; the detection results are fed back into the system to continuously optimize the detection strategy and response mechanism; The response coordination submodule is used to coordinate and perform various emergency actions when potential threats are detected. Once abnormal behavior or potential threats are identified by the real-time monitoring submodule, the pre-set emergency plan is immediately activated to try to isolate the affected system and take action to block communications with malicious domains or IP addresses to prevent attacks. At the same time, relevant security incidents are notified to the network security team through designated channels. In addition, the response coordination submodule is linked with other security systems to collaboratively complete response tasks. The network is divided into multiple security areas through physical or virtual LAN network segmentation technology, and a micro-isolation strategy is implemented to limit cross-regional access.

5. The substation network security defense system based on artificial intelligence according to claim 4 is characterized in that: The malicious code detection module further includes a static analysis submodule and a dynamic analysis submodule; The static analysis submodule is used to perform non-runtime checks on suspicious files to identify potential malware. First, suspicious file samples from different parts of the network are received; then the received samples are analyzed using a variety of static analysis techniques, including checking the binary structure of the file, decompiling the code to view its logic, and analyzing the hash value and digital signature of the file to confirm its known attributes; once malicious features are identified or matched with samples in the known malware library, they will be marked as high risk and the security team will be notified for processing; The dynamic analysis submodule is used to execute malicious code in a controlled and isolated environment so as to monitor and analyze its behavior in real time. First, a safe sandbox environment is prepared. The sandbox environment is a closed test space that simulates a real system environment and is used to execute suspicious files without affecting the actual production network. Malicious code is run in the sandbox, and various monitoring tools are used to track and record the behavioral characteristics of the code, and any network traffic and file samples generated when the code is running are captured to facilitate further in-depth analysis. Once the analysis is completed, a complete report is generated.

6. The substation network security defense system based on artificial intelligence according to claim 5 is characterized in that: The intelligent safety prediction module further includes a time series analysis submodule and a machine learning prediction submodule; The time series analysis submodule is used to process and analyze the time series data of security events in order to identify periodic patterns, long-term trends and abnormal fluctuations, collect timestamp data in security event logs, and use time series analysis algorithms to model the data and extract key features; If data is found to deviate from normal patterns, an alert is issued; The machine learning prediction submodule analyzes historical and real-time data by applying machine learning algorithms to provide predictions of future threats for the substation network security system. It first collects network behavior data and security event records, and then uses data preprocessing to construct a feature set suitable for machine learning. Use various algorithms to discover patterns and abnormal behaviors in data, identify security threat patterns and predict future attack trends.

7. The substation network security defense system based on artificial intelligence according to claim 6 is characterized in that: The adaptive security policy module further includes a policy generation submodule and a policy optimization submodule; The policy generation submodule uses data analysis and pattern recognition algorithms to analyze current network conditions and historical security data, evaluate the effectiveness of existing security operations, and recommend adjustments or updates to optimal security policies, including modifying firewall rules, adjusting intrusion detection system parameters, and developing new access control policies; by collaborating with execution tools, the above policies are automatically deployed and continuously optimized dynamically; The policy optimization submodule refines and improves network security policies through continuous feedback and learning mechanisms, collects various network behavior data and security events after the implementation of the policies, evaluates the effectiveness of the above policies in preventing threats and reducing vulnerabilities; adjusts existing policies or recommends new actions; the policy optimization submodule further works in conjunction with the machine learning prediction submodule to use predictive analysis to guide the fine-tuning of policies.

8. The substation network security defense system based on artificial intelligence according to claim 7 is characterized in that: The system update and maintenance module includes an automatic update submodule and a maintenance scheduling submodule; The automatic update submodule continuously ensures that the substation network security system is kept up to date by regularly checking for security-related updates, including security patches, virus definitions, and system upgrades; starting with connecting to the update servers of various software vendors and security providers to obtain the latest update information; Once new updates are found to be available, verify the compatibility of these updates with the current system and arrange for download and installation without affecting the normal operation of the network; verify the integrity and authenticity of the files during the download process, and after the installation is complete, record the update history and notify the administrator; The maintenance scheduling submodule is used to plan and execute regular review and maintenance tasks of the substation network security system, formulate a maintenance plan, which determines the review frequency and type of maintenance activities based on the characteristics of the network equipment and security system; then automatically set these tasks to run during off-peak hours to minimize the impact on network operations; when performing maintenance operations, perform system backup, configuration checks, performance monitoring and security vulnerability scanning operations; after completion, generate a detailed report summarizing the problems found and the repair actions implemented, and notify relevant personnel for review.

9. The substation network security defense system based on artificial intelligence according to claim 8 is characterized in that: The user interface and alarm module further includes a visualization submodule and a notification submodule; The visualization submodule converts network security data into intuitive graphs and charts, collects key data from various monitoring and analysis submodules, and uses data visualization technology to convert the collected data into dashboards, trend charts and reports, receiving content and formats that allow users to customize the display as needed, as well as set thresholds and alert levels; When an important security event or abnormal behavior is detected, the notification submodule immediately sends a notification and alarm to the user, monitors the alarm information output by other submodules in real time, and determines whether it is necessary to send a notification to the user based on the predefined alarm level and notification strategy. Once it is determined that the user needs to be notified, the alarm information is conveyed through multiple channels; it supports custom settings, allowing users to choose the notification method and adjust the notification frequency according to their needs and preferences.

10. The substation network security defense system based on artificial intelligence according to claim 9 is characterized in that: The data backup and recovery module further includes a regular backup submodule and a disaster recovery submodule; The periodic backup submodule is used to ensure that the key data in the substation network security system is automatically backed up according to a predefined plan. First, the data type and storage location to be backed up are determined, and then a specific backup plan is formulated. When the planned time arrives, the backup operation is automatically executed to copy the selected data to a secure storage medium. After the backup is completed, the integrity and recoverability of the backup data are verified to ensure that it can be restored smoothly when needed; The regular backup submodule further records detailed information of each backup and promptly notifies the administrator of the backup status; The disaster recovery submodule is used to activate the preset disaster recovery plan when a system failure or security incident is detected, including using the latest backup data to rebuild the damaged system and application, while ensuring that all key configurations and files are restored, and verifying the consistency and integrity of the data during the recovery process.

11. The substation network security defense system based on artificial intelligence according to claim 10 is characterized in that: The compliance audit module further includes a standards compliance submodule and an audit record submodule; The standards compliance submodule is used to perform regular security configuration and compliance checks, automatically review system settings, security policies and operating procedures, and compare them with national or international security standards; when any deviations or non-compliance items are detected, a report is generated and repair suggestions are made to ensure that system settings and operations comply with industry security standards; new industry trends and updated standards are tracked to remind administrators to make necessary adjustments; The audit record submodule provides a log record function for the substation network security system for audit and analysis work, stores logs in a tamper-proof log warehouse, and supports efficient log query and retrieval functions.

12. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to implement the artificial intelligence-based substation network security defense system according to any one of claims 1-11.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, an artificial intelligence-based substation network security defense system is implemented according to any one of claims 1-11.

Images