An artificial intelligence-based substation network security defense system

Abstract

A network security defense system for substations based on artificial intelligence. The system includes a data collection module that collects substation network data; an anomaly detection module that identifies abnormal patterns and intrusion behaviors; a threat intelligence analysis module that identifies potential threats and vulnerability information; an intelligent security monitoring and response module that assesses network security status; a malicious code detection module that detects, analyzes, and isolates malware; an intelligent security prediction module that predicts network security events and issues early warning prompts; an adaptive security policy module that automatically adjusts or updates the optimal security policy; a system update and maintenance module that updates and maintains system modules and functions; a user interface and alarm module that provides users with security status displays and alarms; a data backup and recovery module that backs up and recovers critical data; and a compliance audit module that ensures that operations and configurations comply with safety standards. This invention achieves hierarchical, intelligent, and proactive protection for substation networks.

Description

Technical Field

[0001] The present invention belongs to the field of substation security, and in particular relates to a substation network security defense system based on artificial intelligence. Background Art

[0002] Cybersecurity has become a crucial component in protecting critical infrastructure, such as substations. Substation network systems typically consist of control centers, servers, workstations, and field devices, interconnected via communication networks for data exchange and remote monitoring. However, this interconnectedness also exposes substation networks to a variety of external and internal threats, such as malware attacks, unauthorized access, and system configuration flaws.

[0003] Traditional substation network security operations primarily rely on passive defense technologies such as firewalls, intrusion detection systems (IDS), and antivirus software. While these methods can identify and block known attack patterns to a certain extent, they often fall short in the face of increasingly complex security threats, zero-day vulnerabilities, and advanced persistent threat (APT) attacks. Furthermore, due to the unique and critical nature of substation networks, a serious attack could lead to grid instability or even widespread power outages, resulting in significant social impact and economic losses.

[0004] Therefore, in order to meet these challenges, it is necessary to provide a more advanced, proactive and comprehensive network security protection system to monitor network activities in real time, analyze potential risks, predict unknown attacks, automatically respond to security incidents, and be able to adapt to the real-time changing security environment. At the same time, it must meet industry standards and regulatory requirements to ensure that substations can maintain safe and stable operation in the face of various network threats. Summary of the Invention

[0005] In order to address the deficiencies in the existing technology, the present invention provides an artificial intelligence-based substation network security defense system to ensure the safe operation of critical infrastructure, respond to increasingly complex network security threats, and solve the technical problem of improving the information security protection capabilities of the power system in the networking era.

[0006] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0007] The present invention first discloses an artificial intelligence-based substation network security defense system, comprising:

[0008] Data collection module, used to collect traffic data, log information, threat intelligence and related data of the substation network;

[0009] Anomaly detection module, which applies machine learning and deep learning algorithms to automatically identify abnormal patterns and potential intrusions in substation network traffic;

[0010] Threat intelligence analysis module, used to collect network threat intelligence data, analyze and process the network threat intelligence data, and identify potential threats and vulnerability information;

[0011] Intelligent security monitoring and response module, which collects log and event data from substation network devices and systems, assesses the substation network security status, and automatically triggers corresponding defense actions based on the network security status;

[0012] Malicious code detection module, which is used to detect, analyze, and isolate malware by inspecting suspicious files and simulating the execution of suspicious code;

[0013] Intelligent security prediction module, which is used to predict possible future cybersecurity incidents and provide early warnings based on analysis of time series data and machine learning algorithms;

[0014] Adaptive security policy module, which is used to analyze the current network status and historical security data, determine the dynamic changes of the substation network environment, and automatically adjust or update the optimal security policy according to the dynamic changes of the network environment;

[0015] System update and maintenance module, which is used to regularly check for security-related updates and continuously update and maintain the system modules and their functions by verifying the updates found;

[0016] User interface and alarm module, used to convert network security data into graphical and chart interfaces, and provide users with security status display and alarm notifications when security events or abnormal behaviors are detected;

[0017] Data backup and recovery module, used to automatically back up key data of the substation network according to a predefined plan, and to restore key data when a system failure or security incident is detected;

[0018] The compliance audit module is used to monitor the operation and configuration of the substation network security system and match it with the preset security standards. According to the matching results, the operation and configuration are adjusted to comply with the preset security standards.

[0019] The present invention further includes the following preferred embodiments:

[0020] The anomaly detection module further includes a traffic analysis submodule and a behavior analysis submodule;

[0021] The traffic analysis submodule collects raw traffic data from the data collection module in real time, preprocesses the data to remove noise, and classifies the cleaned data into normal or abnormal traffic; extracts key traffic features and uses machine learning algorithms to conduct in-depth analysis of the features to identify abnormal behaviors that do not match normal patterns; immediately triggers an alarm when an anomaly is detected and executes a response action according to predefined security protocols;

[0022] The behavioral analysis submodule is used to monitor the behavior of network entities to identify activities that do not match normal behavior patterns. First, a baseline pattern of normal behavior is established and activity data in the network is captured in real time. By applying machine learning algorithms, actual behavior is compared and analyzed to identify activities that deviate from the predefined pattern. Once potential abnormal behavior is detected, an alarm is triggered and a response action is executed. The response action may include secondary verification, session termination, or initiation of further security investigation. Normal behavior patterns are continuously updated and refined.

[0023] The threat intelligence analysis module further includes an intelligence collection submodule and a data analysis submodule;

[0024] The intelligence collection submodule is used to automatically collect threat intelligence from multiple sources to support the system's threat analysis and response actions. It first establishes connections with multiple intelligence channels; then continuously monitors all channels to obtain real-time information about newly generated threats, vulnerability disclosures, attack patterns, and malware activities; then transmits the collected intelligence to the system for further processing and analysis; and performs preliminary evaluation of the collected intelligence;

[0025] The data analysis submodule is used to deeply analyze and process the threat intelligence gathered by the intelligence collection submodule to identify potential attack vectors and security threats. First, the raw intelligence data is preprocessed, including cleaning, normalization and classification; then key information is extracted from text, image or sound intelligence, including the identity of the attacker, the technology used, the affected systems, and the time and location of the attack; the extracted information is compared with the existing threat database to confirm whether the new intelligence is a variant of a known threat or a completely new threat; the processed data is converted into security indicators and warnings for evaluation and taking corresponding defensive actions.

[0026] The intelligent security monitoring and response module further includes a real-time monitoring submodule and a response coordination submodule;

[0027] The real-time monitoring submodule is used to observe network activities in real time and identify potential threats or violations. It first collects raw log and event data from network devices and systems, then analyzes the data in real time to look for abnormal patterns, suspicious behavior, or unauthorized access attempts. It identifies important security indicators by applying detection algorithms. Once a possible security incident is discovered, it immediately triggers a predefined response process, including issuing an alert, generating a detailed incident report, and initiating appropriate mitigation actions. The detection results are fed back to the system to continuously optimize the detection strategy and response mechanism.

[0028] The response coordination submodule is used to coordinate and execute various emergency actions when potential threats are detected. Once abnormal behavior or potential threats are identified by the real-time monitoring submodule, the pre-set emergency plan is immediately activated, attempting to isolate the affected system and taking action to block communications with malicious domains or IP addresses to prevent attacks; at the same time, relevant security incidents are notified to the network security team through designated channels; in addition, the response coordination submodule is linked with other security systems to collaboratively complete response tasks; the network is divided into multiple security zones through physical or virtual LAN network segmentation technology, and a micro-isolation strategy is implemented to limit cross-zone access.

[0029] The malicious code detection module further includes a static analysis submodule and a dynamic analysis submodule;

[0030] The static analysis submodule is used to perform non-runtime inspections on suspicious files to identify potential malware. It first receives suspicious file samples from different parts of the network. It then analyzes the received samples using a variety of static analysis techniques, including examining the binary structure of the files, decompiling the code to view its logic, and analyzing the file's hash value and digital signature to confirm its known attributes. Once malicious characteristics are identified or a match is found with samples in a known malware library, the sample is marked as high-risk and the security team is notified for processing.

[0031] The dynamic analysis submodule is used to execute malicious code in a controlled and isolated environment so as to monitor and analyze its behavior in real time. First, a safe sandbox environment is prepared. The sandbox environment is a closed test space that simulates a real system environment and is used to execute suspicious files without affecting the actual production network. The malicious code is run in the sandbox, and various monitoring tools are used to track and record the behavioral characteristics of the code. Any network traffic and file samples generated when the code is running are captured to facilitate further in-depth analysis. Once the analysis is completed, a complete report is generated.

[0032] The intelligent safety prediction module further includes a time series analysis submodule and a machine learning prediction submodule;

[0033] The time series analysis submodule is used to process and analyze the time series data of security events to identify periodic patterns, long-term trends, and abnormal fluctuations. It collects timestamp data from security event logs and uses time series analysis algorithms to model the data and extract key features. If the data deviates from the normal pattern, it will issue an alert.

[0034] The machine learning prediction submodule applies machine learning algorithms to analyze historical and real-time data to provide predictions of future threats to the substation network security system. It first collects network behavior data and security event records, then uses data preprocessing to construct a feature set suitable for machine learning. It uses various algorithms to discover patterns and abnormal behaviors in the data, identify security threat patterns, and predict future attack trends.

[0035] The adaptive security policy module further includes a policy generation submodule and a policy optimization submodule;

[0036] The policy generation submodule uses data analysis and pattern recognition algorithms to analyze current network conditions and historical security data, assess the effectiveness of existing security operations, and recommend adjustments or updates to optimal security policies, including modifying firewall rules, adjusting intrusion detection system parameters, and developing new access control policies. By collaborating with execution tools, the above policies are automatically deployed and continuously optimized dynamically.

[0037] The policy optimization submodule refines and improves network security policies through continuous feedback and learning mechanisms, collects various network behavior data and security events after the implementation of the policy, and evaluates the effectiveness of the above policy in preventing threats and reducing vulnerabilities; adjusts existing policies or recommends new actions; the policy optimization submodule further works in conjunction with the machine learning prediction submodule, using predictive analysis to guide policy fine-tuning.

[0038] The system update and maintenance module includes an automatic update submodule and a maintenance scheduling submodule;

[0039] The automatic update submodule continuously ensures that the substation network security system is kept up to date by regularly checking for security-related updates, including security patches, virus definitions, and system upgrades. It begins by connecting to the update servers of various software vendors and security providers to obtain the latest update information. Once new updates are available, they are verified for compatibility with the current system and scheduled for download and installation without affecting the normal operation of the network. During the download process, the integrity and authenticity of the files are verified. After the installation is complete, the update history is recorded and the administrator is notified.

[0040] The maintenance scheduling submodule is used to plan and execute regular reviews and maintenance tasks for the substation network security system, develop a maintenance plan that determines the review frequency and type of maintenance activities based on the characteristics of the network equipment and security system; then automatically set these tasks to run during off-peak hours to minimize the impact on network operations; when performing maintenance operations, system backups, configuration checks, performance monitoring, and security vulnerability scanning operations are performed; after completion, a detailed report is generated that summarizes the problems found and the remedial actions implemented, and the relevant personnel are notified for review.

[0041] The user interface and alarm module further includes a visualization submodule and a notification submodule;

[0042] The visualization submodule converts network security data into intuitive graphs and charts, collects key data from various monitoring and analysis submodules, and uses data visualization technology to convert the collected data into dashboards, trend charts and reports, allowing users to customize the content and format of the display as needed, as well as set thresholds and alert levels;

[0043] When the notification submodule detects an important security event or abnormal behavior, it will immediately send a notification and alarm to the user, monitor the alarm information output by other submodules in real time, and determine whether it is necessary to send a notification to the user based on the predefined alarm level and notification policy. Once it is determined that the user needs to be notified, the alarm information will be conveyed through multiple channels; it supports custom settings, allowing users to choose the notification method and adjust the notification frequency according to their own needs and preferences.

[0044] The data backup and recovery module further includes a regular backup submodule and a disaster recovery submodule;

[0045] The regular backup submodule is used to ensure that key data in the substation network security system is automatically backed up according to a predefined plan. First, the type of data to be backed up and the storage location are determined. Then a specific backup plan is formulated. When the scheduled time arrives, the backup operation is automatically executed, and the selected data is copied to a secure storage medium. After the backup is completed, the integrity and recoverability of the backup data are verified to ensure that it can be restored smoothly when needed. The regular backup submodule further records the detailed information of each backup and promptly notifies the administrator of the backup status.

[0046] The disaster recovery submodule is used to activate the preset disaster recovery plan when a system failure or security incident is detected, including using the latest backup data to rebuild the damaged system and application, while ensuring that all key configurations and files are restored, and verifying the consistency and integrity of the data during the recovery process.

[0047] The compliance audit module further includes a standards compliance submodule and an audit record submodule;

[0048] The standards compliance submodule is used to regularly perform security configuration and compliance checks, automatically reviewing system settings, security policies, and operational procedures, and comparing them with national or international security standards. When any deviations or non-compliances are detected, reports are generated and remediation recommendations are made to ensure that system settings and operations comply with industry security standards. New industry trends and updated standards are tracked, alerting administrators to make necessary adjustments.

[0049] The audit record submodule provides a log recording function for the substation network security system for audit and analysis work, stores logs in a tamper-proof log warehouse, and supports efficient log query and retrieval functions.

[0050] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0051] The storage medium is used to store instructions;

[0052] The processor is used to operate according to the instructions to implement the aforementioned artificial intelligence-based substation network security defense system.

[0053] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements the aforementioned artificial intelligence-based substation network security defense system.

[0054] The beneficial effects of the present invention lie in that, compared to existing technologies, it provides an artificial intelligence-based substation network security defense system. Through real-time monitoring and automated rapid response mechanisms, it effectively prevents, detects, and mitigates security threats, reduces security incidents caused by external attacks or internal misoperations, and significantly enhances the security protection capabilities of substation networks. Leveraging machine learning and data analysis technologies, it can learn and adapt to new threat patterns in real time, intelligently identifying and defending against unknown attacks. This improves the intelligence level of network protection, while ensuring that the configuration and operation of the substation network security system comply with the latest industry standards and regulatory requirements, reducing the risk of non-compliance during operations. In the event of a catastrophic event, it can quickly restore critical data and services, significantly minimizing the impact of business interruptions and ensuring the stability and reliability of the power grid, playing a significant role in maintaining social and economic activities and public safety. Comprehensive audit tracking and log management not only improves system transparency but also provides detailed data support for subsequent analysis and continuous improvement of security vulnerabilities. An intuitive data visualization interface simplifies the complexity of network security, enabling non-professionals to easily understand and assess the current network security status, thereby strengthening overall security management. Timely and effective notification and alarm systems ensure that relevant personnel can receive alerts at critical moments and take appropriate actions to prevent or mitigate security incidents, further enhancing the emergency response capabilities of the substation network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a module diagram of the substation network security defense system based on artificial intelligence in the present invention. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0057] The embodiments described in this application are only part of the embodiments of the present invention, not all of the embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without making creative work are all within the scope of protection of the present invention.

[0058] To address the shortcomings of existing technologies, the present invention proposes an artificial intelligence-based substation network security defense system, which realizes real-time threat monitoring and effective prevention in the substation network environment. It integrates data analysis and machine learning algorithms into network security strategies to improve the detection capabilities of unknown attacks and zero-day vulnerabilities, ensuring that the security configuration, operation, and behavior of the substation network system comply with industry security standards and best practices while meeting regulatory requirements. It can quickly restore critical data and services in the event of a catastrophic event, minimize system downtime, and maintain business continuity. It enhances the adaptive capabilities of existing security systems, enabling them to automatically optimize security operations based on real-time changing threat intelligence and network behavior. Through a detailed audit record and log management system, it provides complete security incident tracing and analysis capabilities to support post-incident investigations and continuous security improvements. It provides intuitive data visualization through a user-friendly interface, allowing non-professionals to easily understand complex network security situations. It establishes a comprehensive notification and alarm mechanism to ensure that relevant personnel can be notified and take action in a timely manner when important security incidents are detected, thus realizing hierarchical, intelligent, and proactive protection of the substation network, significantly enhancing the security, stability, and resilience of the network. At the same time, it optimizes the operation and maintenance process, reduces the complexity and cost of safety management, and provides strong technical support and guarantee for the safe and reliable operation of the power grid.

[0059] like Figure 1 As shown, the substation network security defense system based on artificial intelligence of the present invention includes:

[0060] Data collection module, used to collect traffic data, log information, threat intelligence and related data of the substation network;

[0061] The anomaly detection module applies machine learning and deep learning algorithms to automatically identify abnormal patterns and potential intrusions in substation network traffic. The anomaly detection module further includes a traffic analysis submodule and a behavior analysis submodule. The traffic analysis submodule collects raw traffic data from the data collection module in real time, preprocesses the data to remove noise, and then classifies the cleaned data as normal or abnormal traffic. It then extracts key traffic features and uses machine learning algorithms to conduct in-depth analysis of these features to identify abnormal behavior that does not match normal patterns, which may indicate unauthorized access or an ongoing attack. Upon detecting an anomaly, the submodule immediately triggers an alarm and executes response actions according to predefined security protocols, such as blocking malicious communications. Furthermore, the traffic analysis submodule optimizes its detection capabilities through real-time monitoring and feedback mechanisms, allowing it to more effectively adapt to new threats and changing network environments. Deploy high-bandwidth network probes with at least 20 Gbps processing power and deep packet inspection (DPI) equipment that supports at least 10 Gbps of traffic decoding. These devices are configured to adaptively adjust and continuously monitor data exchanges within and outside the substation through TCP session reestablishment, application-layer data filtering, and traffic trend analysis. They monitor all network traffic entering and exiting the data center and export traffic data in real time via NetFlow or IPFIX protocols, providing comprehensive visibility into the substation network. They can capture and record all network activity to provide immediate alerts to potential threats and facilitate further analysis. The behavioral analysis submodule monitors the behavior of network entities to identify activity that deviates from normal patterns. Leveraging multi-factor authentication (MF) and biometric security: In addition to traditional password authentication, all users accessing control systems and sensitive data are required to utilize a multi-factor authentication solution based on FIDO standards, combined with biometric technologies such as fingerprint or facial recognition, such as fingerprint scanning, facial recognition, or iris scanning, to enhance authentication security and prevent unauthorized access. First, a baseline pattern of normal behavior is established, capturing real-time network activity data, such as user login habits, device access frequency, and service usage. Then, by applying machine learning algorithms, such as behavioral modeling and anomaly scoring, actual behavior is compared and analyzed to identify activity that deviates from the predefined pattern. Once potentially anomalous behavior is detected, this submodule triggers an alert and assists in executing appropriate response actions, such as secondary authentication, session termination, or initiating further security investigation. Furthermore, as new data is collected in real time, the behavioral analysis submodule continuously updates and refines normal behavior patterns to improve detection accuracy and adaptability. It employs a series of advanced machine learning algorithms to establish a baseline of normal network behavior and identify anomalous activities that deviate from this norm. First, through behavioral modeling techniques and clustering algorithms (K-means, DBSCAN), normal patterns of user or system behavior are constructed.Using an anomaly scoring mechanism, the Isolation Forest model, each behavior is assigned an anomaly score to quantify its degree of deviation from normal behavior. The time series analysis algorithm, the Autoregressive Model (AR), is applied to analyze behavioral data that changes over time to detect abnormal fluctuations. In some scenarios, single-class anomaly detection algorithms such as One-Class Support Vector Machine (SVM) are used to identify anomalies from unlabeled data. The chi-square test is also used to determine whether individual observations are anomalous. Using an ensemble learning method, the Gradient Boosted Decision Tree (GBDT), an ensemble of multiple weak prediction models is constructed to improve anomaly detection performance. The combined use of these algorithms enables the behavioral analysis submodule to comprehensively and accurately monitor network behavior and promptly identify potential security threats. Through continuous model training and optimization, the behavioral analysis submodule can adapt to the ever-changing network environment and maintain its efficient anomaly detection capabilities.

[0062] The threat intelligence analysis module is used to collect network threat intelligence data and parse and process it to identify potential threats and vulnerability information. The threat intelligence analysis module further includes an intelligence collection submodule and a data analysis submodule. The intelligence collection submodule is used to automatically collect threat intelligence from multiple sources to support the system's threat analysis and response actions. It first establishes connections with multiple intelligence channels, including open source intelligence platforms, commercial security service providers, peer networks, and public safety organizations. It then continuously monitors all channels to obtain real-time information on emerging threats, vulnerability disclosures, attack patterns, and malware activity. The collected intelligence is then transmitted to the system for further processing and analysis, such as deduplication, formatting, and storage, to ensure accuracy and accessibility. Furthermore, the collected intelligence undergoes a preliminary assessment to determine its relevance and reliability, laying the foundation for further in-depth analysis. Through this automated and dynamic information collection process, the intelligence collection submodule can provide timely and comprehensive external threat intelligence support for the substation network security defense system. The data analysis submodule is responsible for deeply analyzing and processing the threat intelligence gathered by the intelligence collection submodule to identify potential attack vectors and security threats. The workflow begins with preprocessing the raw intelligence data, including cleaning, normalization, and classification to ensure data quality. Then, various analytical techniques, such as natural language processing (NLP) and pattern recognition, are used to extract key information from text, image, or audio intelligence, such as the attacker's identity, the techniques used, the affected systems, and the time and location of the attack.

[0063] In a preferred embodiment, the threat intelligence analysis module applies natural language processing (NLP) and pattern recognition techniques to extract key information:

[0064] The natural language processing (NLP) includes text classification, sentiment analysis, and named entity recognition (NER) tasks.

[0065] The sentiment analysis uses a logistic regression model: Among them, p is the probability of positive sentiment, β is the model parameter, and x is the text feature.

[0066] The named entity recognition (NER) is based on the conditional random field (CRF) model, and its formula is: Where: P(Y|O) represents the conditional probability of the label sequence Y given the observation sequence O. Z(O) is the normalization factor (partition function) used to ensure that the sum of the probabilities is 1; is the weight of the feature function associated with a single label, corresponding to the observation o i and label y i ; is the weight of the feature function associated with the label pair, corresponding to the adjacent observation o i , o i+1 and label pair y i ,y i+1 ; N is the length of the sequence.

[0067] The pattern recognition uses support vector machines (SVM) for image classification:

[0068]

[0069] Among them, w and b are model parameters, x i is the eigenvector, y i is a label, ξ i is a slack variable.

[0070] The extracted information is compared with the existing threat database to confirm whether the new intelligence is a variant of a known threat or a completely new threat. Finally, the data analysis submodule converts the processed data into feasible security indicators and warnings for the network security team to evaluate and take corresponding defensive actions. Through this process, the data analysis submodule can convert the original threat intelligence into actually usable intelligence assets to ensure the security of the substation network; the analysis results of the threat intelligence analysis module are used to further feed back to the data collection module to guide it to optimize the data collection strategy, ensure that the system can more accurately capture data indicating threats, and improve the defense capabilities against complex network threats;

[0071] The intelligent security monitoring and response module collects log and event data from substation network devices and systems, assesses the substation's network security status, and automatically triggers appropriate defensive actions based on this status. This intelligent security monitoring and response module further includes a real-time monitoring submodule and a response coordination submodule. The real-time monitoring submodule, as the core of the intelligent security monitoring and response system, observes network activity in real time to quickly identify potential threats or violations. Its workflow begins by collecting raw log and event data from network devices and systems, then analyzing this data in real time to identify unusual patterns, suspicious behavior, or unauthorized access attempts. By applying detection algorithms, such as a rules engine and abnormal behavior detection, it accurately identifies important security indicators from billions of events. The rules engine evaluates network events in real time using a series of pre-set logical rules, such as the conditional statement "IF (A AND B) THEN C," where A and B represent event attributes and C represents the triggered action. Upon detecting a pattern that matches the rules, the rules engine immediately initiates the predetermined response measures, ensuring a rapid response to known threats. Simultaneously, the abnormal behavior detection algorithm employs statistical and machine learning techniques to conduct in-depth analysis of network behavior. For example, using threshold-based methods, by setting the limit of a specific indicator, such as IF X>Threshold THEN Alert, where X is the observed network behavior indicator and Threshold is the upper limit of the normal behavior range determined in advance. In addition, clustering algorithms such as K-means or DBSCAN optimize the objective function Where: J is the objective function to be minimized, which represents the total squared error. k is the number of clusters. x is the data point. S i is the set of points in the i-th cluster. i is the center of the i-th cluster. i is the distance from data point x to cluster center μ i The Euclidean distance of . Realize the pattern recognition of network behavior and the detection of abnormal points. Based on the long short-term memory network (LSTM), through h t =LSTM(h t-1 , x t ) to learn the temporal dependency of sequence data, where h t is the hidden state at time step t, x tThe system uses inputs to identify complex network behavior patterns. The combination of these algorithms improves the ability to identify known attack patterns and enhances the prediction and defense against unknown threats. Once a potential security incident is detected, a predefined response process is immediately triggered, including alerting the security team, generating a detailed incident report, and initiating appropriate mitigation actions. The real-time monitoring submodule integrates security event log collection, event correlation analysis, and real-time alarming capabilities. It deploys a security event management system with at least 100TB of storage capacity and the ability to process 100,000 events per second. The system provides key performance indicators (KPIs) and key security indicators (KSIs), and pushes critical alerts via email, SMS, or mobile apps. This enables rapid response and effective management of security incidents. It also supports Complex Event Processing (CEP) and Security Orchestration Automation Response (SOAR) to improve incident handling efficiency. Furthermore, the real-time monitoring submodule feeds detection results back into the system to continuously optimize detection strategies and response mechanisms, ensuring that network security protection remains up-to-date. Through this real-time monitoring, the security status of the substation network is strictly controlled. The response coordination submodule is responsible for rapidly coordinating and executing various emergency actions when potential threats are detected. Its specific workflow is as follows: Once abnormal behavior or potential threats are identified by the real-time monitoring sub-module, the pre-set emergency plan is immediately activated. First, try to isolate the affected system to prevent the threat from spreading to other parts of the network. Then, take action to block communications with malicious domains or IP addresses to prevent attack behaviors. At the same time, it ensures that the details of relevant security incidents are recorded and notified to the network security team through designated channels such as email, SMS or visual dashboards. In addition, the response coordination sub-module also interacts with other security systems, such as firewalls, intrusion prevention systems, etc., to jointly complete more complex response tasks. Divide the network into multiple security zones through physical or virtual LAN network segmentation technology, implement micro-isolation strategies, and restrict cross-regional access. Reduce the attack surface and improve the overall security of the network. Through this efficient and orderly automated response mechanism, the response coordination sub-module ensures that the substation network can quickly respond to various security threats and minimize potential damage;

[0072] The malicious code detection module is used to detect, analyze, and isolate malware by inspecting suspicious files and simulating the execution of suspicious code. The malicious code detection module further includes a static analysis submodule and a dynamic analysis submodule. The static analysis submodule is used to perform non-runtime inspections of suspicious files to identify potential malware. Its workflow is as follows: first, suspicious file samples are received from different parts of the network. Then, the received samples are analyzed using a variety of static analysis techniques, including inspecting the file's binary structure, decompiling the code to examine its logic, and analyzing the file's hash value and digital signature to confirm its known attributes. Binary analysis tools are used to parse the file's format and structure, such as the PE (Portable Executable) structure for executable files on Windows systems. By examining the file header, section table, import table, and export table, the program's composition and functionality can be understood. A decompiler (such as IDA Pro or Ghidra) is used to convert the binary code into assembly language, pseudocode, or even high-level language code. By analyzing the decompiled code, security analysts can manually examine the program's logic and look for signs of malicious behavior, such as system call misuse or suspicious API call sequences. Calculate the hash value of the file (such as MD5, SHA-1, SHA-256) to determine the integrity and identification of the file. By comparing it with the hash value database of known malware, it can quickly identify whether it is a known malicious sample. Check whether the file is accompanied by a valid digital signature and whether the signature is issued by a trusted certificate authority (CA). Use the formula to verify the signature. In the RSA signature scheme, verify Where y is the digital signature, d is the recipient's public key exponent, x is the hash value of the original message, e is the sender's private key exponent, and n is the modulus. Heuristic analysis techniques are applied to identify files that do not directly match known malware but may exhibit malicious behavior. This may include analyzing strings contained in the file, API functions called, and file import and export behavior. Static analysis may be combined with a sandbox environment to observe the file's behavior in a controlled environment and further verify its security. Integrating the above techniques into an automated static analysis platform enables rapid analysis of large numbers of suspicious files. These methods can assess the file's potential behavior and intent without actually executing it. Once malicious signatures are identified or a match is found with samples from a known malware library, the file is flagged as high-risk and notified to the security team for action. Furthermore, static analysis results help update and optimize malware detection rules and defense mechanisms. Through this comprehensive static analysis process, the substation network security system can effectively identify and isolate malware, preventing it from causing damage to the network. The dynamic analysis submodule is used to execute malicious code in a controlled and isolated environment to monitor and analyze its behavior in real time. The workflow involves first preparing a secure sandbox environment—a closed testing space that simulates a real-world system environment, allowing suspicious files to execute without impacting the actual production network. The malicious code is then run within the sandbox, while various monitoring tools are used to track and record the code's behavioral characteristics, such as network communications, file operations, registry changes, and process creation. Furthermore, the dynamic analysis submodule captures any network traffic and file samples generated during code execution for further in-depth analysis. Once the analysis is complete, the submodule generates a comprehensive report, including the malware's behavioral characteristics, scope of impact, propagation methods, and possible infection sources. Through precise dynamic analysis, the substation network security system provides a deep understanding of malware attack mechanisms and effectively addresses complex security threats. Encrypted communication protocols and endpoint protection utilize technologies such as TLS / SSL, VPN, and IPSec to ensure secure data transmission. At least 256-bit AES encryption is enabled for all data transmission, and all remote access is required to be performed through a VPN tunnel with a CA certificate of at least 2048 bits. Deploy antivirus software, advanced threat protection (ATP) solutions, and EDR (Endpoint Detection and Response) systems on endpoint devices, update definition files at least weekly, and enable real-time monitoring to prevent malware infection and data leakage. Combine signature-based detection with abnormal behavior analysis to identify malicious activity. Use high-performance IDS / IPS devices with at least 10Gbps intrusion detection and prevention capabilities, equipped with the latest threat intelligence database, which is automatically updated every four hours.Take proactive actions, such as blocking attack traffic, isolating infected systems, and tracing the attack source, to prevent the spread of threats and protect critical infrastructure. Effectively identify and block malicious traffic, reducing the risk of security breaches.

[0073] The intelligent security prediction module is used to predict possible future cybersecurity incidents and issue early warnings based on analysis of time series data and machine learning algorithms. The intelligent security prediction module further includes a time series analysis submodule and a machine learning prediction submodule. The time series analysis submodule processes and analyzes time series data of security incidents to identify periodic patterns, long-term trends, and abnormal fluctuations. Its workflow involves using a historical dataset containing at least 180 days of network traffic logs to collect timestamp data from security event logs, such as the time, duration, and frequency of the incidents. It then uses time series analysis algorithms, such as autoregressive (AR), moving average (MA), seasonal decomposition, and exponential smoothing (Holt-Winters), to model the data and extract key features. These algorithms detect regular behavior in the data, such as regular network traffic spikes or frequent security incidents within a specific time period. If the data deviates from the normal pattern or shows subtle trend changes, the time series analysis submodule will issue an early warning, alerting the cybersecurity team to potential risks or attack activities. Furthermore, the analysis results are used to guide the adjustment and optimization of cybersecurity protection measures, such as strengthening monitoring during specific time periods or deploying preventative security policies. By continuously monitoring time series data, the substation network security defense system provides an effective tool for predicting and preventing future security threats. The machine learning prediction submodule applies machine learning algorithms to analyze historical and real-time data, providing predictions of future threats for the substation network security system. It first collects a large amount of network behavior data and security event records, then uses data preprocessing techniques to construct a feature set suitable for machine learning. Using various algorithms such as decision trees, random forests, artificial neural networks (ANNs), support vector machines (SVMs), and deep learning, models are trained to discover patterns and abnormal behaviors in the data, identify security threat patterns, and predict future attack trends, thus implementing an intelligent threat warning system. After rigorous evaluation and tuning, these models are used to analyze historical and real-time network data to identify and warn of potential security risks, and transmit intelligence to the response system to take appropriate action. With the real-time influx of new data and the cycle of learning feedback, the prediction submodule continuously improves its accuracy and response speed, making network security defense more proactive and precise.

[0074] In a preferred embodiment, the time series analysis uses an autoregressive integrated moving average (ARIMA) model:

[0075]

[0076] Among them, X t is the value of the time series at time point t, c is a constant term, and θ are model parameters, ∈ t is the error term.

[0077] The adaptive security policy module is used to analyze the current network status and historical security data, determine the dynamic changes in the substation network environment, and automatically adjust or update the optimal security policy according to the dynamic changes in the network environment. Through dynamic access control (DAC) and role-based access control (RBAC) policies, the access control list (ACL) and firewall rules are dynamically adjusted according to real-time risk assessment. The linkage between security events and policy adjustments is realized, and the response time does not exceed 5 minutes. Improve the flexibility and response speed of network security policies. The adaptive security policy module further includes a policy generation submodule and a policy optimization submodule. The policy generation submodule uses data analysis and pattern recognition algorithms to analyze the current network status and historical security data, evaluate the effectiveness of existing security operations, and recommend adjustments or updates to the optimal security policy based on this information. The data analysis and pattern recognition algorithms first collect key data from multiple nodes of the substation network through data collection and integration. Subsequently, in the data preprocessing stage, data cleaning and normalization are performed, using the minimum-maximum normalization formula To unify the data format and ensure the accuracy of analysis. Feature engineering further extracts and selects key features related to security, and uses statistical metrics such as mutual information to evaluate the effectiveness of features. K-means clustering algorithm is used to minimize reconstruction error. To identify the inherent patterns in the data, algorithms such as One-Class SVM are used to identify abnormal points that deviate from the normal pattern. ci is the cluster center, x i Each data point represents an instance in the network behavior data and may include features such as timestamp, traffic volume, source address, and destination address.

[0078] On this basis, the logistic regression machine learning model was used to Where P(y=1|x) is the probability that an event belongs to category 1 (e.g., representing a security threat) given the feature vector x. w is the weight vector. b is the bias term. x is the feature vector containing all the features used for prediction. The loss function for logistic regression is typically logarithmic loss (also known as cross-extraction loss), which is formulated as: Where: n is the number of samples. i is the actual label of the i-th sample. iis the feature vector of the i-th sample. The gradient descent algorithm is used to minimize the loss function L by iteratively updating the weight w and bias b. The update rule is: Among them: α is the learning rate, which controls the learning step size. and are the partial derivatives of the loss function with respect to weights and biases, respectively. Security policy generation and optimization are achieved by adjusting model parameters (weights and biases) to minimize the loss from security events. This can be achieved using a logistic regression model and a gradient descent algorithm, where the model parameters are updated to improve the accuracy of identifying security threats. Automated tools deploy the updated security policy to the network and continuously monitor its effectiveness. This ensures that the policy can adapt to changes in the network environment and continuously learn and adapt through feedback and iteration, forming a closed-loop continuous improvement process. In this way, the logistic regression model and gradient descent algorithm together provide an intelligent security protection barrier for the substation, capable of effectively predicting and responding to various security threats.

[0079] The System Update and Maintenance Module is responsible for regularly checking for security-related updates and, by verifying discovered updates, continuously updating and maintaining all system modules and their functions. This module includes an automatic update submodule and a maintenance scheduling submodule. The automatic update submodule continuously ensures the substation network security system remains up-to-date by regularly checking for security-related updates, including security patches, virus definitions, and system upgrades. Its workflow begins by connecting to the update servers of various software vendors and security providers to obtain the latest update information. Once new updates are available, their compatibility with the current system is verified and their download and installation are scheduled without impacting normal network operations. During the download process, file integrity and authenticity are verified to prevent the installation of malicious or corrupted updates. After installation, the automatic update submodule records the update history and notifies the administrator, ensuring transparency and traceability. This ensures that the substation network's security protection actions can promptly respond to emerging threats and vulnerabilities, maintaining the stability and security of the network environment. The maintenance scheduling submodule is responsible for planning and executing regular reviews and maintenance tasks for the substation network security system. Its workflow first involves developing a maintenance plan that determines the review frequency and type of maintenance activities based on the characteristics of network devices and security systems and industry best practices. These tasks are then automatically set to run during off-peak hours to minimize the impact on network operations. While performing maintenance work, operations such as system backup, configuration check, performance monitoring, and security vulnerability scanning are performed. Upon completion, the maintenance scheduling submodule generates a detailed report summarizing the problems found and the repair actions implemented, and notifies relevant personnel for review. Through this orderly maintenance process, the maintenance scheduling submodule ensures that the substation network security system continues to operate in an optimal state, while promptly discovering and resolving potential security issues;

[0080] The User Interface and Alert Module converts network security data into graphical and chart-based interfaces, providing users with security status displays and alert notifications when security events or abnormal behavior are detected. The User Interface and Alert Module further includes a visualization submodule and a notification submodule. The visualization submodule converts complex network security data into intuitive graphs and charts, allowing users to easily understand the network's security status. Its workflow begins by collecting key data from the various monitoring and analysis submodules, such as threat detection, event logs, and system performance metrics. It then utilizes data visualization techniques to transform this information into easy-to-interpret dashboards, trend charts, and reports. These visual elements not only display real-time security events and alerts, but also include output from historical trend analysis and predictive models. The visualization submodule also allows users to customize the display content and format, as well as set thresholds and alert levels, providing a personalized monitoring experience. This interactive visual interface enables rapid identification of problem areas, informed decision-making, and effective communication of network security status to non-technical personnel. The notification submodule immediately issues notifications and alerts to users when significant security events or abnormal behavior are detected. Its workflow involves real-time monitoring of alert information output by other submodules and determining whether user notifications are necessary based on predefined alert levels and notification policies. Once a user is determined to be notified, the submodule ensures timely dissemination of the alert information through various channels, such as email, SMS, mobile app push notifications, or desktop pop-ups. Furthermore, the notification submodule supports custom settings, allowing users to select notification methods and adjust notification frequency based on their needs and preferences. This timely and flexible notification mechanism enables security teams to respond quickly to potential threats, thereby shortening incident response times and reducing security risks.

[0081] The data backup and recovery module automatically backs up critical data in the substation network according to a predefined schedule and restores it when a system failure or security incident occurs. Snapshots and real-time data replication technologies are used to ensure timely backup of critical data. Disaster recovery plans are developed and tested to quickly restore normal operations in the event of a system compromise, minimizing service interruption. The data backup and recovery module also includes offline and cloud storage solutions, ensuring that critical data and services are restored within one hour, ensuring data redundancy and recoverability. Cloud storage services provide 99.999% data reliability, minimizing the impact of disasters on substation operations. The data backup and recovery module further includes a scheduled backup submodule and a disaster recovery submodule. The scheduled backup submodule ensures that critical data in the substation network security system is automatically backed up according to a predefined schedule. The data types and storage locations to be backed up are first determined, and then a specific backup plan is developed, including backup frequency, time points, and retention period. At the scheduled time, the backup operation is automatically executed, copying the selected data to a secure storage medium, which may include a local disk, network-attached storage (NAS), or cloud storage service. After the backup is complete, the integrity and recoverability of the backup data are verified to ensure a smooth restoration when needed. The scheduled backup submodule further records detailed information about each backup and promptly notifies the administrator of the backup status, enabling prompt action in the event of any issues. Through this automated and reliable backup mechanism, the substation cybersecurity system provides a strong barrier against data loss or corruption. The disaster recovery submodule plays an emergency response role within the substation cybersecurity system, rapidly restoring critical data and services when the system is severely compromised. When a system failure or major security incident is detected, the pre-defined disaster recovery plan is immediately activated. This involves using the latest backup data to rebuild the damaged system and applications, ensuring that all critical configurations and files are restored. During the recovery process, data consistency and integrity are verified to ensure a successful recovery. The disaster recovery submodule also seamlessly collaborates with the scheduled backup submodule to ensure that the most recent and uninfected backup copy is used. This efficient and orderly recovery mechanism minimizes system downtime and ensures that critical substation operations can quickly return to normal.

[0082] The compliance audit module monitors the operation and configuration of the substation's cybersecurity system, compares them with pre-set security standards, and adjusts them based on the matching results to ensure compliance. The compliance audit module further includes a standards compliance submodule and an audit logging submodule. The standards compliance submodule monitors the operation and configuration of the substation's cybersecurity system to ensure compliance with relevant industry standards and best practices. This workflow includes regular security configuration and compliance checks, automatically reviewing system settings, security policies, and operational procedures, and comparing them against national or international security standards such as ISO / IEC 27001 and the NIST framework. When any deviations or non-compliances are detected, a report is generated with remediation recommendations to ensure that system settings and operations comply with industry security standards such as NIST SP 800-53, International Electrotechnical Commission (IEC) standards, and national and regional regulatory requirements. Furthermore, the standards compliance submodule tracks new industry trends and updated standards, promptly alerting administrators to any necessary adjustments. Through this continuous monitoring and assessment mechanism, the standards compliance submodule helps maintain the substation's cybersecurity system within a clearly defined compliance framework, reducing the risk of non-compliance and improving the overall security posture. The audit record submodule provides detailed logging capabilities for the substation network security system to facilitate future audits and analysis. Its workflow covers the automatic capture and classification of details of all security-related events, including intrusion attempts, system warnings, user operations, and configuration changes. These logs are securely stored in an unalterable log repository to prevent data loss or tampering. At the same time, it supports efficient log query and retrieval functions, allowing security analysts to quickly locate specific events, analyze potential security threats, or audit the overall operation of the system. Through this comprehensive recording mechanism, the audit record submodule not only helps meet compliance requirements, but also provides valuable data support for identifying patterns, optimizing security policies, and improving network behavior.

[0083] The substation network security defense method based on artificial intelligence disclosed in the present invention includes the following steps:

[0084] Collecting traffic data, log information, threat intelligence and related data of the substation network through the data collection module;

[0085] Automatically identify abnormal patterns and potential intrusion behaviors in the collected substation network traffic by applying machine learning and deep learning algorithms through the anomaly detection module;

[0086] The threat intelligence analysis module collects network threat intelligence data, analyzes and processes the network threat intelligence data, and identifies potential threats and vulnerability information;

[0087] The intelligent security monitoring and response module collects log and event data from substation network devices and systems, evaluates the substation network security status, and automatically triggers corresponding defense actions based on the network security status;

[0088] The malicious code detection module checks suspicious files and simulates the execution of suspicious code to detect, analyze and isolate malware;

[0089] The intelligent security prediction module performs analysis based on time series data and machine learning algorithms to predict possible future network security incidents and provide early warning prompts;

[0090] The adaptive security policy module analyzes the current network status and historical security data, determines the dynamic changes of the substation network environment, and automatically adjusts or updates the optimal security policy according to the dynamic changes of the network environment;

[0091] Regularly check for security-related updates through the system update and maintenance module, and continuously update and maintain the system modules and their functions by verifying the updates found;

[0092] The user interface and alarm module convert network security data into a graphical and chart interface, and provide users with security status display and alarm notification when security events or abnormal behaviors are detected;

[0093] The data backup and recovery module automatically backs up the key data of the substation network according to a predefined plan and recovers the key data when a system failure or security incident is detected;

[0094] The compliance audit module monitors the operation and configuration of the substation network security system and matches them with the preset security standards. The operation and configuration are adjusted according to the matching results to comply with the preset security standards.

[0095] The beneficial effects of the present invention lie in that, compared to existing technologies, it provides an artificial intelligence-based substation network security defense system. Through real-time monitoring and automated rapid response mechanisms, it effectively prevents, detects, and mitigates security threats, reduces security incidents caused by external attacks or internal misoperations, and significantly enhances the security protection capabilities of substation networks. Leveraging machine learning and data analysis technologies, it can learn and adapt to new threat patterns in real time, intelligently identifying and defending against unknown attacks. This improves the intelligence level of network protection, while ensuring that the configuration and operation of the substation network security system comply with the latest industry standards and regulatory requirements, reducing the risk of non-compliance during operations. In the event of a catastrophic event, it can quickly restore critical data and services, significantly minimizing the impact of business interruptions and ensuring the stability and reliability of the power grid, playing a significant role in maintaining social and economic activities and public safety. Comprehensive audit tracking and log management not only improves system transparency but also provides detailed data support for subsequent analysis and continuous improvement of security vulnerabilities. An intuitive data visualization interface simplifies the complexity of network security, enabling non-professionals to easily understand and assess the current network security status, thereby strengthening overall security management. Timely and effective notification and alarm systems ensure that relevant personnel can receive alerts at critical moments and take appropriate actions to prevent or mitigate security incidents, further enhancing the emergency response capabilities of the substation network environment.

[0096] Based on the spirit of the present invention, those skilled in the art will readily appreciate that a computer program product can be derived from the aforementioned AI-based substation network security defense method. This computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure. Specifically, the present application also includes a terminal comprising a processor and a storage medium; the storage medium is configured to store instructions; and the processor is configured to operate according to the instructions to execute the steps of the aforementioned AI-based substation network security defense method.

[0097] Computer-readable storage medium can be the tangible device that can keep and store the instruction used by instruction execution device.Computer-readable storage medium can be, for example, but not limited to, electric storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or above-mentioned any suitable combination.The more specific example (non-exhaustive list) of computer-readable storage medium comprises: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical coding device, for example, punch card or the convex structure in the groove that stores instruction thereon and above-mentioned any suitable combination.Computer-readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave (for example, by the light pulse of fiber optic cable) that waveguide or other transmission medium propagates or the electric signal that is transmitted by wire.

[0098] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0099] The computer program instructions for performing the operation of the present disclosure can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. Computer-readable program instructions can be executed entirely on a user's computer, partially on a user's computer, executed as an independent software package, partially on a user's computer and partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer via any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., utilizing an Internet service provider to connect via the Internet). In some embodiments, by utilizing the state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. An artificial intelligence-based substation network security defense system, characterized by: include: Data collection module, used to collect traffic data, log information, threat intelligence and related data of the substation network; Anomaly detection module, which applies machine learning and deep learning algorithms to automatically identify abnormal patterns and potential intrusions in substation network traffic; Threat intelligence analysis module, used to collect network threat intelligence data, analyze and process the network threat intelligence data, and identify potential threats and vulnerability information; Intelligent security monitoring and response module, which collects log and event data from substation network devices and systems, assesses the substation network security status, and automatically triggers corresponding defense actions based on the network security status; Malicious code detection module, which is used to detect, analyze, and isolate malware by inspecting suspicious files and simulating the execution of suspicious code; Intelligent security prediction module, which is used to predict possible future cybersecurity incidents and provide early warnings based on analysis of time series data and machine learning algorithms; Adaptive security policy module, which is used to analyze the current network status and historical security data, determine the dynamic changes of the substation network environment, and automatically adjust or update the optimal security policy according to the dynamic changes of the network environment; System update and maintenance module, which is used to regularly check for security-related updates and continuously update and maintain the system modules and their functions by verifying the updates found; User interface and alarm module, used to convert network security data into graphical and chart interfaces, and provide users with security status display and alarm notifications when security events or abnormal behaviors are detected; Data backup and recovery module, used to automatically back up key data of the substation network according to a predefined plan, and to restore key data when a system failure or security incident is detected; The compliance audit module is used to monitor the operation and configuration of the substation network security system and match it with the preset security standards. According to the matching results, the operation and configuration are adjusted to comply with the preset security standards.

2. The substation network security defense system based on artificial intelligence according to claim 1 is characterized in that: The anomaly detection module further includes a traffic analysis submodule and a behavior analysis submodule; The traffic analysis submodule collects raw traffic data from the data collection module in real time, preprocesses the data to remove noise, and classifies the cleaned data into normal or abnormal traffic; extracts key traffic features and uses machine learning algorithms to conduct in-depth analysis of the features to identify abnormal behaviors that do not match normal patterns; Immediately trigger an alarm when an anomaly is detected and execute response actions according to predefined security protocols; The behavioral analysis submodule is used to monitor the behavior of network entities to identify activities that do not match normal behavior patterns. First, a baseline pattern of normal behavior is established and activity data in the network is captured in real time. By applying machine learning algorithms, actual behavior is compared and analyzed to identify activities that deviate from the predefined pattern. Once potential abnormal behavior is detected, an alarm is triggered and a response action is executed. The response action may include secondary verification, session termination, or initiation of further security investigation. Normal behavior patterns are continuously updated and refined.

3. The substation network security defense system based on artificial intelligence according to claim 2 is characterized in that: The threat intelligence analysis module further includes an intelligence collection submodule and a data analysis submodule; The intelligence collection submodule is used to automatically collect threat intelligence from multiple sources to support the system's threat analysis and response actions. It first establishes connections with multiple intelligence channels; then continuously monitors all channels to obtain real-time information about newly generated threats, vulnerability disclosures, attack patterns, and malware activities; then transmits the collected intelligence to the system for further processing and analysis; and performs preliminary evaluation of the collected intelligence; The data analysis submodule is used to deeply analyze and process the threat intelligence gathered by the intelligence collection submodule to identify potential attack vectors and security threats. First, the raw intelligence data is preprocessed, including cleaning, normalization and classification; then key information is extracted from text, image or sound intelligence, including the identity of the attacker, the technology used, the affected systems, and the time and location of the attack; the extracted information is compared with the existing threat database to confirm whether the new intelligence is a variant of a known threat or a completely new threat; the processed data is converted into security indicators and warnings for evaluation and taking corresponding defensive actions.

4. The substation network security defense system based on artificial intelligence according to claim 3 is characterized in that: The intelligent security monitoring and response module further includes a real-time monitoring submodule and a response coordination submodule; The real-time monitoring submodule is used to observe network activities in real time and identify potential threats or violations. It first collects raw log and event data from network devices and systems, and then analyzes the data in real time to look for abnormal patterns, suspicious behavior or unauthorized access attempts. It also identifies important security indicators by applying detection algorithms. Once a possible security incident is discovered, a predefined response process is immediately triggered, including issuing an alert, generating a detailed incident report, and initiating appropriate mitigation actions. Detection results are fed back into the system to continuously optimize detection strategies and response mechanisms. The response coordination submodule is used to coordinate and execute various emergency actions when potential threats are detected. Once abnormal behavior or potential threats are identified by the real-time monitoring submodule, the pre-set emergency plan is immediately activated, attempting to isolate the affected system and taking action to block communications with malicious domains or IP addresses to prevent attacks; at the same time, relevant security incidents are notified to the network security team through designated channels; in addition, the response coordination submodule is linked with other security systems to collaboratively complete response tasks; the network is divided into multiple security zones through physical or virtual LAN network segmentation technology, and a micro-isolation strategy is implemented to limit cross-zone access.

5. The substation network security defense system based on artificial intelligence according to claim 4 is characterized in that: The malicious code detection module further includes a static analysis submodule and a dynamic analysis submodule; The static analysis submodule is used to perform non-runtime inspections on suspicious files to identify potential malware. It first receives suspicious file samples from different parts of the network. It then analyzes the received samples using a variety of static analysis techniques, including examining the binary structure of the files, decompiling the code to view its logic, and analyzing the file's hash value and digital signature to confirm its known attributes. Once malicious characteristics are identified or a match is found with samples in a known malware library, the sample is marked as high-risk and the security team is notified for processing. The dynamic analysis submodule is used to execute malicious code in a controlled and isolated environment so as to monitor and analyze its behavior in real time. First, a safe sandbox environment is prepared. The sandbox environment is a closed test space that simulates a real system environment and is used to execute suspicious files without affecting the actual production network. The malicious code is run in the sandbox, and various monitoring tools are used to track and record the behavioral characteristics of the code. Any network traffic and file samples generated when the code is running are captured to facilitate further in-depth analysis. Once the analysis is completed, a complete report is generated.

6. The substation network security defense system based on artificial intelligence according to claim 5 is characterized in that: The intelligent safety prediction module further includes a time series analysis submodule and a machine learning prediction submodule; The time series analysis submodule is used to process and analyze the time series data of security events to identify periodic patterns, long-term trends, and abnormal fluctuations, collect timestamp data from security event logs, and use time series analysis algorithms to model the data and extract key features; If the data deviates from the normal pattern, an alert will be issued; The machine learning prediction submodule analyzes historical and real-time data using machine learning algorithms to predict future threats to the substation network security system. It first collects network behavior data and security event records, and then uses data preprocessing to construct a feature set suitable for machine learning. Use various algorithms to discover patterns and abnormal behaviors in data, identify security threat patterns and predict future attack trends.

7. The substation network security defense system based on artificial intelligence according to claim 6 is characterized in that: The adaptive security policy module further includes a policy generation submodule and a policy optimization submodule; The policy generation submodule uses data analysis and pattern recognition algorithms to analyze current network conditions and historical security data, assess the effectiveness of existing security operations, and recommend adjustments or updates to optimal security policies, including modifying firewall rules, adjusting intrusion detection system parameters, and developing new access control policies. By collaborating with execution tools, the above policies are automatically deployed and continuously optimized dynamically. The policy optimization submodule refines and improves network security policies through continuous feedback and learning mechanisms, collects various network behavior data and security events after the implementation of the policy, and evaluates the effectiveness of the above policy in preventing threats and reducing vulnerabilities; adjusts existing policies or recommends new actions; the policy optimization submodule further works in conjunction with the machine learning prediction submodule, using predictive analysis to guide policy fine-tuning.

8. The substation network security defense system based on artificial intelligence according to claim 7 is characterized in that: The system update and maintenance module includes an automatic update submodule and a maintenance scheduling submodule; The automatic update submodule continuously ensures that the substation network security system is kept up to date by regularly checking for security-related updates, including security patches, virus definitions, and system upgrades; starting with connecting to the update servers of various software vendors and security providers to obtain the latest update information; Once new updates are available, verify their compatibility with the current system and arrange for their download and installation without affecting the normal operation of the network. During the download process, verify the integrity and authenticity of the files. After the installation is complete, record the update history and notify the administrator. The maintenance scheduling submodule is used to plan and execute regular reviews and maintenance tasks for the substation network security system, develop a maintenance plan that determines the review frequency and type of maintenance activities based on the characteristics of the network equipment and security system; then automatically set these tasks to run during off-peak hours to minimize the impact on network operations; when performing maintenance operations, system backups, configuration checks, performance monitoring, and security vulnerability scanning operations are performed; after completion, a detailed report is generated that summarizes the problems found and the remedial actions implemented, and the relevant personnel are notified for review.

9. The substation network security defense system based on artificial intelligence according to claim 8 is characterized in that: The user interface and alarm module further includes a visualization submodule and a notification submodule; The visualization submodule converts network security data into intuitive graphs and charts, collects key data from various monitoring and analysis submodules, and uses data visualization technology to convert the collected data into dashboards, trend charts and reports, allowing users to customize the content and format of the display as needed, as well as set thresholds and alert levels; When the notification submodule detects an important security event or abnormal behavior, it will immediately send a notification and alarm to the user, monitor the alarm information output by other submodules in real time, and determine whether it is necessary to send a notification to the user based on the predefined alarm level and notification policy. Once it is determined that the user needs to be notified, the alarm information will be conveyed through multiple channels; it supports custom settings, allowing users to choose the notification method and adjust the notification frequency according to their own needs and preferences.

10. The substation network security defense system based on artificial intelligence according to claim 9 is characterized in that: The data backup and recovery module further includes a regular backup submodule and a disaster recovery submodule; The periodic backup submodule is used to ensure that key data in the substation network security system is automatically backed up according to a predefined plan. First, the type of data and storage location to be backed up are determined, and then a specific backup plan is formulated. When the scheduled time arrives, the backup operation is automatically executed to copy the selected data to a secure storage medium. After the backup is completed, the integrity and recoverability of the backup data are verified to ensure that it can be restored smoothly when needed. The regular backup submodule further records the detailed information of each backup and promptly notifies the administrator of the backup status; The disaster recovery submodule is used to activate the preset disaster recovery plan when a system failure or security incident is detected, including using the latest backup data to rebuild the damaged system and application, while ensuring that all key configurations and files are restored, and verifying the consistency and integrity of the data during the recovery process.

11. The substation network security defense system based on artificial intelligence according to claim 10 is characterized in that: The compliance audit module further includes a standards compliance submodule and an audit record submodule; The standards compliance submodule is used to regularly perform security configuration and compliance checks, automatically reviewing system settings, security policies, and operational procedures, and comparing them with national or international security standards. When any deviations or non-compliances are detected, reports are generated and remediation recommendations are made to ensure that system settings and operations comply with industry security standards. New industry trends and updated standards are tracked, alerting administrators to make necessary adjustments. The audit record submodule provides a log recording function for the substation network security system for audit and analysis work, stores logs in a tamper-proof log warehouse, and supports efficient log query and retrieval functions.

12. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to implement the artificial intelligence-based substation network security defense system according to any one of claims 1-11.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, an artificial intelligence-based substation network security defense system according to any one of claims 1 to 11 is implemented.

Images