Intelligent penetration detection method and system for electric power system

Abstract

The invention discloses an intelligent penetration detection method and system for a power system, and relates to the technical field of network security testing. The method comprises the following steps: carrying out penetration test on a power system; monitoring and acquiring penetration test parameter data in the penetration test process; performing data processing on the penetration test parameter data; and analyzing the safety condition of the power system according to the penetration test parameter data after data processing, and carrying out early warning reminding. The method comprises the following steps: performing penetration test on a power system; monitoring and acquiring penetration test parameter data in the penetration test process; performing data processing on the penetration test parameter data; the safety condition of the power system is analyzed according to the penetration test parameter data after data processing, and early warning reminding is carried out, so that the effect of accurately and efficiently analyzing the safety condition of the power system through penetration test is achieved; the problem that in the prior art, it is difficult to accurately and efficiently analyze the safety condition of the electric power system through penetration testing is solved.

Description

Technical Field

[0001] This invention relates to the field of network security testing technology, and in particular to an intelligent penetration testing method and system for power systems. Background Technology

[0002] With the rapid development of information technology, the informatization and intelligentization levels of power systems are constantly improving. However, they also face increasing cybersecurity threats, such as hacker attacks and virus intrusions, which can paralyze power systems and cause serious socio-economic losses. Penetration testing is a method that simulates hacker attacks to assess system security. Traditional power system security testing methods often rely on human experience, which is inefficient and unable to cope with complex and ever-changing cyberattacks. Therefore, an efficient and intelligent penetration testing method is needed.

[0003] Existing penetration testing systems identify vulnerabilities by attacking the target network, verifying these vulnerabilities, and generating penetration attack reports, thus achieving penetration testing functionality.

[0004] For example, the invention patent announcement CN111475818B discloses a penetration attack method for an AI-based automated penetration system, which includes: S1, determining the attack category; S2, prioritizing vulnerabilities; S3, detecting vulnerabilities one by one; S4, a specialized intelligent module matching other vulnerabilities; S5, prioritizing vulnerabilities; S6, detecting vulnerabilities one by one; S7, a specialized intelligent module optimizing and adjusting parameters; and S8, a penetration attack module generating vulnerability verification results and vulnerability exploitation results.

[0005] For example, patent application CN115659348A discloses a rapid penetration testing method and apparatus for mobile devices, comprising: determining whether the mobile device is undergoing its first penetration test; if the mobile device is undergoing its first penetration test, performing a test environment detection operation to obtain first environment detection information; determining test function modules based on the first environment detection information; performing corresponding penetration test operations based on the test function modules to generate corresponding first test results; if the mobile device is not undergoing its first penetration test, performing a test environment detection operation to obtain second environment detection information; determining whether the test environment has changed based on the second environment detection information; if the test environment has changed, determining updated function modules corresponding to the test environment; performing corresponding penetration test operations based on the updated function modules to generate second test results.

[0006] However, in the process of implementing the inventive technical solution in the embodiments of this application, it was found that the above-mentioned technology has at least the following technical problems:

[0007] In existing technologies, power monitoring systems have complex network structures. When a power system is attacked by hackers or other threats, many aspects of the power system will be affected. Penetration testing can be used to analyze the impact on the power system. However, due to the large amount of data obtained from penetration testing that reflects the impact on the power system, it is difficult to accurately and efficiently analyze the security status of the power system through penetration testing. Summary of the Invention

[0008] This application provides an intelligent penetration testing method and system for power systems, which solves the problem in the prior art that it is difficult to accurately and efficiently analyze the security status of power systems through penetration testing, and realizes accurate and efficient analysis of the security status of power systems through penetration testing.

[0009] This application provides an intelligent penetration testing method for power systems, comprising the following steps: conducting penetration testing on the power system; monitoring and acquiring penetration test parameter data during the penetration test; processing the penetration test parameter data; analyzing the power system security status based on the processed penetration test parameter data and issuing early warnings.

[0010] Furthermore, the power system security status includes: the degree of anomaly in the power system's network traffic, the degree of anomaly in the power system's system files, and the degree of anomaly in the power system's vulnerabilities; the penetration testing parameter data includes network traffic anomaly parameter data, system file anomaly parameter data, and vulnerability security parameter data; the specific analysis process for the degree of anomaly in the power system's network traffic is as follows: obtaining network traffic anomaly parameter data based on the penetration testing parameter data; analyzing the network traffic anomaly parameter data to obtain a network traffic anomaly assessment coefficient, which reflects the degree of anomaly in the power system's network traffic; and analyzing the degree of anomaly in the power system's network traffic based on the network traffic anomaly assessment coefficient.

[0011] Furthermore, the specific analysis process for analyzing the degree of anomaly in power system network traffic based on the network traffic anomaly assessment coefficient is as follows: obtain the network traffic anomaly assessment coefficient, obtain the network traffic anomaly threshold, compare the network traffic anomaly assessment coefficient with the network traffic anomaly threshold, and when the network traffic anomaly assessment coefficient is less than the network traffic anomaly threshold, it indicates that the power system is performing normally in terms of network traffic; when the network traffic anomaly assessment coefficient is greater than or equal to the network traffic anomaly threshold, it indicates that the power system is performing abnormally in terms of network traffic.

[0012] Furthermore, the specific analysis process for the degree of anomaly in the power system's system files is as follows: obtain system file anomaly parameter data based on penetration test parameter data; analyze the system file anomaly assessment index based on the system file anomaly parameter data, the system file anomaly assessment index being used to represent the degree of anomaly in the power system's system files; analyze the degree of anomaly in the power system's system files based on the system file anomaly assessment index.

[0013] Furthermore, the specific analysis process for analyzing the degree of anomaly in the power system regarding system files based on the system file anomaly assessment index is as follows: Obtain the system file anomaly assessment index; obtain the first threshold and the second threshold for system file anomaly; compare the system file anomaly assessment index with the first and second thresholds; when the system file anomaly assessment index is greater than the first threshold and less than the second threshold, it indicates that the power system is performing normally in terms of system files; when the system file anomaly assessment index is less than or equal to the first threshold or greater than or equal to the second threshold, it indicates that the power system is performing abnormally in terms of system files.

[0014] Furthermore, the specific analysis process for the degree of anomaly in the power system regarding vulnerabilities is as follows: obtaining vulnerability security level parameter data based on penetration test parameter data; normalizing the vulnerability security level parameter data; analyzing the normalized vulnerability security level parameter data to obtain a vulnerability security level assessment index, which is used to represent the degree of anomaly in the power system regarding vulnerabilities; and analyzing the degree of anomaly in the power system regarding vulnerabilities based on the vulnerability security level assessment index.

[0015] Furthermore, the specific analysis process for analyzing the abnormality of the power system in terms of vulnerabilities based on the vulnerability security level assessment index is as follows: obtain the vulnerability security level assessment index, obtain the first threshold and the second threshold of vulnerability security level. When the vulnerability security level assessment index is greater than the first threshold and less than the second threshold, it indicates that the power system is performing normally in terms of vulnerabilities; when it is in other situations, it indicates that the power system is performing abnormally in terms of vulnerabilities.

[0016] Furthermore, the specific analysis process for analyzing the power system security status and issuing early warnings is as follows: The power system security status is obtained; when one or fewer of the following conditions are observed in the power system security status—namely, abnormal network traffic, abnormal system files, and abnormal vulnerabilities—it indicates that the power system is operating normally, and no early warning is issued; when two or more of the following conditions are observed in the power system security status—namely, abnormal network traffic, abnormal system files, and abnormal vulnerabilities—it indicates that the power system is experiencing an anomaly, and an early warning is issued.

[0017] Furthermore, the specific method for obtaining the network traffic anomaly assessment coefficient is as follows: Penetration testing is performed on the power system to obtain the number of penetration tests, and these tests are numbered; multiple data acquisitions are performed during each penetration test, and the number of data acquisitions is numbered; the preset number of ports used by the power system and the weight ratio of HTTP protocol traffic and FTP protocol traffic used by the power system are obtained from the database; network traffic anomaly parameter data is obtained; and a network traffic anomaly assessment coefficient calculation formula is constructed based on the network traffic anomaly parameter data; the specific network traffic anomaly assessment coefficient calculation formula is as follows:

[0018]

[0019] In the formula, This represents the network traffic anomaly assessment coefficient of the power system at the k0th penetration test, where k0 = 1, 2, ..., k, k0 represents the number of the penetration test, and k represents the total number of penetration tests. This represents the number of power system ports used during the k0th penetration test and the h0th data acquisition, where h0 = 1, 2, ..., h, h0 represents the data acquisition number, and h represents the total number of data acquisitions. This represents the reference number of power system ports used during the k0th penetration test. This represents the Modbus protocol traffic used by the power system during the h0th data acquisition in the k0th penetration test. This represents the power system DNP3 protocol traffic during the k0th penetration test and the h0th data acquisition. This represents the HTTP protocol traffic used by the power system during the h0th data acquisition in the k0th penetration test. D1 represents the power system's FTP protocol traffic during the h0th data acquisition in the k0th penetration test; D2 represents the weight ratio of the number of ports used by the power system in the network traffic anomaly assessment coefficient; and D3 represents the weight ratio of the power system's HTTP protocol traffic and FTP protocol traffic in the network traffic anomaly assessment coefficient.

[0020] This application provides an intelligent penetration testing system for power systems, comprising: a penetration testing module, a parameter acquisition module, a data processing module, and an early warning analysis module; wherein, the penetration testing module is used to perform penetration testing on the power system; the parameter acquisition module is used to monitor and acquire penetration testing parameter data during the penetration testing process; the data processing module is used to process the penetration testing parameter data; and the early warning analysis module is used to analyze the power system security status based on the processed penetration testing parameter data and issue early warning alerts.

[0021] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0022] 1. By conducting penetration testing on the power system, monitoring and acquiring penetration test parameter data during the penetration test process, and processing the penetration test parameter data, the security status of the power system can be analyzed and early warnings can be issued based on the processed penetration test parameter data. This achieves accurate and efficient analysis of the security status of the power system through penetration testing, effectively solving the problem in existing technologies that make it difficult to accurately and efficiently analyze the security status of the power system through penetration testing.

[0023] 2. By obtaining network traffic anomaly parameter data based on penetration test parameter data, analyzing the network traffic anomaly parameter data to obtain the network traffic anomaly assessment coefficient, and then analyzing the degree of anomaly in the power system in terms of network traffic based on the network traffic anomaly assessment coefficient, a detailed and accurate analysis of the degree of anomaly in the power system in terms of network traffic is achieved.

[0024] 3. By obtaining system file anomaly parameter data based on penetration test parameter data, and analyzing the system file anomaly parameter data to obtain the system file anomaly assessment index, the anomaly degree of the power system in terms of system files can be analyzed based on the system file anomaly assessment index, thereby achieving accurate analysis of the anomaly degree of the power system in terms of system files. Attached Figure Description

[0025] Figure 1 A flowchart of an intelligent penetration testing method for power systems provided in this application embodiment;

[0026] Figure 2 The system file anomaly assessment index curve provided for embodiments of this application;

[0027] Figure 3 This is a schematic diagram of the structure of an intelligent penetration detection system for a power system, provided as an embodiment of this application. Detailed Implementation

[0028] This application provides an intelligent penetration testing method and system for power systems, solving the problem in the prior art that it is difficult to accurately and efficiently analyze the security status of power systems through penetration testing. By conducting penetration testing on the power system, monitoring and acquiring penetration test parameter data during the penetration test process, and processing the penetration test parameter data, the security status of the power system can be analyzed based on the processed penetration test parameter data, and early warning reminders can be issued. This achieves accurate and efficient analysis of the security status of the power system through penetration testing.

[0029] The technical solution in this application is to address the problem mentioned above, which makes it difficult to accurately and efficiently analyze the security status of a power system through penetration testing. The overall approach is as follows:

[0030] The process involves: conducting penetration testing on the power system; monitoring and acquiring penetration test parameter data during the penetration test; processing the penetration test parameter data; obtaining network traffic anomaly parameter data based on the processed penetration test parameter data; analyzing the network traffic anomaly parameter data to obtain a network traffic anomaly assessment coefficient; analyzing the anomaly degree of the power system in terms of network traffic based on the network traffic anomaly assessment coefficient; obtaining system file anomaly parameter data based on the penetration test parameter data; analyzing the system file anomaly parameter data to obtain a system file anomaly assessment index based on the system file anomaly assessment index; analyzing the anomaly degree of the power system in terms of system files based on the system file anomaly assessment index; obtaining vulnerability security parameter data based on the penetration test parameter data; normalizing the vulnerability security parameter data; analyzing the vulnerability security parameter data based on the normalized vulnerability security parameter data to obtain a vulnerability security assessment index; and analyzing the power system based on the vulnerability security assessment index. The penetration testing assesses the degree of anomalies in the power system's security status, including anomalies in network traffic, system files, and vulnerabilities. Penetration test parameters include parameters for network traffic anomalies, system file anomalies, and vulnerability security levels. If one or fewer of these anomalies occur, the power system is considered to be operating normally, and no warning is issued. If two or more of these anomalies occur, an anomaly is identified, and a warning is issued. This approach achieves the goal of accurately and efficiently analyzing the power system's security status through penetration testing.

[0031] In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0032] like Figure 1 The diagram shown is a flowchart of an intelligent penetration testing method for power systems provided in an embodiment of this application. The method includes the following steps: performing penetration testing on the power system; monitoring and acquiring penetration test parameter data during the penetration testing process; processing the penetration test parameter data; analyzing the power system security status based on the processed penetration test parameter data and issuing early warnings.

[0033] In this embodiment, with the promotion of smart grids, power monitoring systems have become more complex and larger. These systems are responsible for real-time monitoring and control of the power system's operating status, ensuring the stability and security of power supply. With the widespread application of information technology in power systems, cybersecurity threats are increasing. Hacker attacks and virus intrusions can paralyze power systems, causing severe socio-economic losses. Penetration testing is a method that simulates hacker attacks to assess system security. In power systems, penetration testing can help discover potential security vulnerabilities. By combining penetration testing data with penetration testing parameters, the security status of the power system can be analyzed more accurately and efficiently.

[0034] By processing the penetration test parameter data, duplicate or erroneous data are removed, and the data are made to be of the same order of magnitude and range. This facilitates a more accurate analysis of the power system's security status and enables early warnings based on the penetration test parameter data.

[0035] Furthermore, the security status of the power system includes: the degree of anomaly in the power system's network traffic, the degree of anomaly in the power system's system files, and the degree of anomaly in the power system's vulnerabilities. The specific analysis process for the degree of anomaly in the power system's network traffic is as follows: obtaining network traffic anomaly parameter data based on penetration test parameter data; analyzing the network traffic anomaly parameter data to obtain a network traffic anomaly assessment coefficient, which is used to reflect the degree of anomaly in the power system's network traffic; and analyzing the degree of anomaly in the power system's network traffic based on the network traffic anomaly assessment coefficient.

[0036] In this embodiment, the following situations indicate that the network traffic of the power system is abnormally affected and requires further analysis: sudden increase or decrease in traffic, which may be related to distributed denial-of-service attacks or network equipment failures; unusual packet size or packet type, which may indicate malware or probing behavior; traffic activity on illegal ports, which may mean that someone is trying to exploit known vulnerabilities; unauthorized remote access attempts, especially from external networks; and port scanning activity, where attackers may be looking for open ports to attack.

[0037] In this embodiment, the network traffic anomaly assessment coefficient is obtained by analyzing the network traffic anomaly parameter data. Then, the anomaly degree of the power system in terms of network traffic is analyzed based on the network traffic anomaly assessment coefficient, making the analysis of the anomaly degree of the power system in terms of network traffic more accurate.

[0038] Furthermore, the specific method for obtaining the network traffic anomaly assessment coefficient is as follows: Penetration testing is performed on the power system to obtain the number of penetration tests, and these tests are numbered; multiple data acquisitions are performed during each penetration test, and the number of data acquisitions is numbered; the preset number of ports used by the power system and the weight ratio of HTTP protocol traffic and FTP protocol traffic used by the power system are obtained from the database; network traffic anomaly parameter data is obtained; and a calculation formula for the network traffic anomaly assessment coefficient is constructed based on the network traffic anomaly parameter data; the specific calculation formula for the network traffic anomaly assessment coefficient is as follows:

[0039]

[0040] Where, This represents the network traffic anomaly assessment coefficient of the power system at the k0th penetration test, where k0 = 1, 2, ..., k, k0 represents the number of the penetration test, and k represents the total number of penetration tests. This represents the number of power system ports used during the k0th penetration test and the h0th data acquisition, where h0 = 1, 2, ..., h, h0 represents the data acquisition number, and h represents the total number of data acquisitions. This represents the reference number of power system ports used during the k0th penetration test. This represents the Modbus protocol traffic used by the power system during the h0th data acquisition in the k0th penetration test. This represents the power system DNP3 protocol traffic during the k0th penetration test and the h0th data acquisition. This represents the HTTP protocol traffic used by the power system during the h0th data acquisition in the k0th penetration test. D1 represents the power system's FTP protocol traffic during the h0th data acquisition in the k0th penetration test; D2 represents the weight ratio of the number of ports used by the power system in the network traffic anomaly assessment coefficient; and D3 represents the weight ratio of the power system's HTTP protocol traffic and FTP protocol traffic in the network traffic anomaly assessment coefficient.

[0041] In this embodiment, historical network traffic anomaly parameter data is acquired. By analyzing this data, the relationship between the number of ports used by the power system, the HTTP and FTP traffic used by the power system, and the network traffic anomaly assessment coefficient is identified. A fitting curve is obtained using multiple linear regression. The fitting effect is determined by analyzing the mean squared error of the fitting curve. The fitting curve with the smallest mean squared error is selected as the first fitting curve, and the corresponding weight ratios are obtained from this first fitting curve. Real-time data on the number of ports used by the power system, the HTTP and FTP traffic used by the power system are then input into the first fitting curve to obtain the corresponding weight ratios.

[0042] The network traffic anomaly parameters include the number of ports used by the power system, the reference number of ports used by the power system, the traffic of the power system using the Modbus protocol, the traffic of the power system using the DNP3 protocol, the traffic of the power system using the HTTP protocol, and the traffic of the power system using the FTP protocol.

[0043] Historical network traffic anomaly parameters include the number of ports used by the power system in history, the reference number of ports used by the power system, the traffic of the power system using the Modbus protocol, the traffic of the power system using the DNP3 protocol, the traffic of the power system using the HTTP protocol, and the traffic of the power system using the FTP protocol.

[0044] When a power system uses an unusual port, it may be a listening port for a backdoor program. An attacker may have successfully installed a backdoor for remote control and data transmission. Unauthorized data transmission could indicate the leakage of sensitive information or the system being used as a springboard for further attacks. When abnormal protocol traffic is detected in a power system, such as when monitoring a SCADA (Supervision, Control, and Data Acquisition) network, only Modbus (serial communication protocol) or DNP3 (Distributed Network Protocol version 3) traffic should typically be observed, used to control devices and sensors within the power system. If a large amount of HTTP (Hypertext Transfer Protocol) or FTP (File Transfer Protocol) traffic is detected, this is likely abnormal. An attacker may be attempting to use HTTP or FTP to communicate with a component in the system to execute commands or transfer data. This abnormal protocol traffic may indicate that an attacker is attempting to exploit known vulnerabilities or perform lateral movement. Therefore, it is necessary to monitor and analyze the ports and protocol traffic used by the power system.

[0045] In the algorithm of this embodiment, the network traffic anomaly parameter data is nonlinearly transformed by using a hyperbolic cosine function to smooth out excessively large or small data in the network traffic anomaly parameter data, which helps to obtain a more accurate evaluation coefficient of network traffic anomaly.

[0046] Under normal operating conditions without external interference, network scanning tools such as network scanners or network management software are used to detect which ports of the power system are open on the network. The number of open ports is counted to obtain the reference number of ports used by the power system. After penetration testing of the power system, the above process is repeated to obtain the number of ports used by the power system. Network traffic analyzers or dedicated SCADA network monitoring tools are then used to capture and analyze network data packets to identify Modbus protocol traffic, DNP3 protocol traffic, HTTP protocol traffic, and FTP protocol traffic. This yields the power system's Modbus protocol traffic, DNP3 protocol traffic, HTTP protocol traffic, and FTP protocol traffic.

[0047] Furthermore, the specific analysis process for analyzing the degree of anomaly in power system network traffic based on the network traffic anomaly assessment coefficient is as follows: obtain the network traffic anomaly assessment coefficient, obtain the network traffic anomaly threshold, compare the network traffic anomaly assessment coefficient with the network traffic anomaly threshold, when the network traffic anomaly assessment coefficient is less than the network traffic anomaly threshold, it indicates that the power system is performing normally in terms of network traffic; when the network traffic anomaly assessment coefficient is greater than or equal to the network traffic anomaly threshold, it indicates that the power system is performing abnormally in terms of network traffic.

[0048] In this embodiment, historical network traffic anomaly parameter data is obtained, and historical network traffic anomaly assessment coefficients are analyzed based on the historical network traffic anomaly parameter data. The network traffic anomaly assessment coefficients that indicate that the power system is performing normally in terms of network traffic are arranged in descending order, and the network traffic anomaly assessment coefficient that ranks first is used as the network traffic anomaly threshold.

[0049] Obtain the network traffic anomaly assessment coefficient and the network traffic anomaly threshold, denoted as φ, where φ ranges from [1.65, 1.67]. Compare the network traffic anomaly assessment coefficient with the network traffic anomaly threshold. When the network traffic anomaly assessment coefficient is less than the network traffic anomaly threshold, i.e. When the network traffic anomaly assessment coefficient is greater than or equal to the network traffic anomaly threshold, it indicates that the power system is performing normally in terms of network traffic; when the network traffic anomaly assessment coefficient is greater than or equal to the network traffic anomaly threshold, it indicates that the power system is performing normally in terms of network traffic. This indicates that the power system is exhibiting abnormal behavior in terms of network traffic.

[0050] Furthermore, the specific analysis process for the degree of anomaly in the power system's system files is as follows: obtain system file anomaly parameter data based on penetration test parameter data; analyze the system file anomaly assessment index based on the system file anomaly parameter data, which is used to represent the degree of anomaly in the power system's system files; and analyze the degree of anomaly in the power system's system files based on the system file anomaly assessment index.

[0051] In this embodiment, when abnormal file modification or creation or system file corruption occurs in the power system, the power system exhibits anomalies in terms of system files, which may pose a risk of information leakage. Therefore, it is necessary to analyze the power system's system files. Here, the system file anomaly assessment index is obtained by analyzing the system file anomaly degree parameter data. Based on the system file anomaly degree assessment index, the degree of anomaly in the power system's system files is analyzed, making the analysis of the power system's system file anomalies more accurate.

[0052] The method for obtaining the system file anomaly assessment index is as follows: Retrieve the weighted ratio of the preset number of storage configuration files and the number of normally accessible storage configuration files from the database; obtain system file anomaly parameter data; construct the system file anomaly assessment index calculation formula based on the system file anomaly parameter data; the specific system file anomaly assessment index calculation formula is as follows:

[0053]

[0054] Where, This represents the system file anomaly assessment index of the power system at the k0th penetration test. This represents the number of stored configuration files during the k0th penetration test and the h0th data acquisition. This represents the number of stored configuration file references during the k0th penetration test. This represents the number of accessible storage configuration files during the k0th penetration test and the h0th data acquisition. W1 represents the number of normally accessible storage configuration files in the k0th penetration test, W2 represents the weight ratio of the number of storage configuration files in the system file anomaly assessment index, and W3 represents the weight ratio of the number of normally accessible storage configuration files in the system file anomaly assessment index.

[0055] The system file anomaly level parameters include the number of stored configuration files, the number of stored configuration file references, the number of normally accessible stored configuration files, and the number of normally accessible stored configuration file references.

[0056] Based on historical system file anomaly parameters, a mapping table is established between the number of stored configuration files, the number of normally accessible stored configuration files, and the system file anomaly assessment index. The mapping table is then queried based on the real-time number of stored configuration files and the number of normally accessible stored configuration files to obtain their respective weighted proportions.

[0057] When abnormal file modifications or creations occur in a power system—for example, on a power system server, there might be a directory specifically for storing configuration files. During routine monitoring, a new file is discovered in this directory, created outside of maintenance hours. This newly created file could be a compressed file created by an attacker to steal configuration information, or a backdoor file for persistent access. If the configuration file contains sensitive information (such as database passwords, system credentials, etc.), this file could be used for further system attacks. Furthermore, if the file is malware, it could execute arbitrary code within the system. When abnormal system file corruption occurs in a power system, it could be due to hardware failure, software errors, or malicious attacks. In the event of a security incident, attackers might intentionally tamper with or delete critical files to compromise the system. System file corruption can prevent the system from booting normally, affecting the stable operation of the power system. If an attacker tampers with system files, it could also lead to unauthorized access or execution of malicious code.

[0058] Before conducting penetration testing on a power system, the total number of configuration files in the power system's file manager is used to determine the number of reference storage configuration files. The number of readable files within these references represents the number of normally accessible reference storage configuration files. After penetration testing, the number of stored configuration files and the number of readable files within them are used to determine the number of stored configuration files and the number of normally accessible storage configuration files. In the algorithm of this embodiment, a more accurate system file anomaly assessment index is obtained by using the arctangent function to perform a nonlinear transformation on the system file anomaly parameter data. This is beneficial for accurately analyzing the degree of anomalies in the power system's system files based on the system file anomaly assessment index.

[0059] In one specific embodiment, such as Figure 2 The figure shown is a system file anomaly assessment index curve provided in this application embodiment, with the number of stored configuration files as the independent variable and the system file anomaly assessment index as the dependent variable. For example, when performing one data acquisition for the third penetration test, the increase or decrease of curves one, two, and three can be seen from the analysis that when the number of stored configuration files is larger, the system file anomaly assessment index is larger; when the number of stored configuration files is smaller, the system file anomaly assessment index is smaller. The statistical table of relevant data for the system file anomaly assessment index is shown in Table 1:

[0060] Table 1. Statistical Table of Relevant Data for System File Anomaly Assessment Index

[0061]

[0062]

[0063] When the number of normally accessible storage configuration files for Curve 1, Curve 2, and Curve 3 are 45, 44, and 43 respectively, and other parameters are the same, the system file anomaly assessment indices for Curve 1, Curve 2, and Curve 3 are 0.79, 0.46, and 0.35 respectively. It can be seen that when the number of storage configuration files and other parameters are the same, the larger the number of normally accessible storage configuration files, the larger the system file anomaly assessment index.

[0064] Furthermore, the specific analysis process for analyzing the degree of anomaly in the power system regarding system files based on the system file anomaly assessment index is as follows: Obtain the system file anomaly assessment index; obtain the first threshold and the second threshold for system file anomaly; compare the system file anomaly assessment index with the first and second thresholds; when the system file anomaly assessment index is greater than the first threshold and less than the second threshold, it indicates that the power system is performing normally in terms of system files; when the system file anomaly assessment index is less than or equal to the first threshold or greater than or equal to the second threshold, it indicates that the power system is performing abnormally in terms of system files.

[0065] In this embodiment, historical system file anomaly parameter data is obtained. This data includes the number of historical stored configuration files, the number of referenced stored configuration files, the number of normally accessible stored configuration files, and the number of referenced normally accessible stored configuration files. Based on this data, a historical system file anomaly assessment index is obtained. This index represents the normal performance of the power system in terms of system files. The historical system file anomaly assessment indices are then arranged in ascending order. The first and last historical system file anomaly assessment indices are used as the first and second thresholds for system file anomaly.

[0066] Obtain a first threshold and a second threshold for the system file anomaly level, A1 and A2, respectively. The value range of A1 is [0.74, 0.75], and the value range of A2 is [0.80, 0.81]. Compare the system file anomaly level evaluation index with the first and second thresholds. When the system file anomaly level evaluation index is greater than the first threshold and less than the second threshold, i.e., When the system file anomaly assessment index is less than or equal to the first threshold for system file anomaly, or greater than or equal to the second threshold for system file anomaly, it indicates that the power system is performing normally in terms of system files; when the system file anomaly assessment index is less than or equal to the first threshold for system file anomaly, or greater than or equal to the second threshold for system file anomaly, it indicates that the power system is performing normally in terms of system files. or This indicates that the power system is exhibiting abnormal behavior in its system files.

[0067] Furthermore, the specific analysis process for the degree of anomaly in the power system regarding vulnerabilities is as follows: vulnerability security level parameter data is obtained based on penetration testing parameter data; the vulnerability security level parameter data is normalized; the vulnerability security level assessment index is obtained based on the normalized vulnerability security level parameter data, and this index is used to represent the degree of anomaly in the power system regarding vulnerabilities; the degree of anomaly in the power system regarding vulnerabilities is analyzed based on the vulnerability security level assessment index.

[0068] In this embodiment, by normalizing the vulnerability security level parameter data, the data in the vulnerability security level parameter data maintain the same magnitude and range, making it less prone to errors in the process of calculating the vulnerability security level assessment index, and thus helping to obtain a more accurate vulnerability security level assessment index.

[0069] As critical infrastructure, the security vulnerabilities of power systems can have significant impacts on national security, the economy, and people's lives. Here are some common cybersecurity vulnerabilities in power systems: Software and system vulnerabilities: Many power systems rely on complex software platforms that may contain programming errors or design flaws, providing opportunities for hackers. Communication protocol vulnerabilities: Communication protocols in power systems may be insecure and vulnerable to interception, tampering, or forgery. Weak physical security: Inadequate physical access controls to power infrastructure can lead to security vulnerabilities; for example, unauthorized personnel may gain access to critical equipment. When power systems have numerous vulnerabilities, they are highly susceptible to external interference.

[0070] The method for obtaining the vulnerability security level assessment index is as follows: Obtain vulnerability security level parameter data; retrieve the pre-defined weighted proportions of the number of Type I vulnerabilities, the total number of vulnerabilities, and the number of Type II vulnerabilities from the database; construct the vulnerability security level assessment index based on the vulnerability security level parameter data; the specific formula for calculating the vulnerability security level assessment index is as follows:

[0071]

[0072] In the formula, This represents the vulnerability security level assessment index of the power system at the k0th penetration test. This represents the number of Type I vulnerabilities in the k0th penetration test during the h0th data collection. This represents the number of existing vulnerabilities in the power system at the k0th penetration test. This represents the total number of vulnerabilities in the k0th penetration test at the h0th data collection time. L1 represents the number of Type II vulnerabilities in the k0th penetration test at the h0th data collection time, L2 represents the weight ratio of the number of Type I vulnerabilities in the vulnerability security level assessment index, L3 represents the weight ratio of the total number of vulnerabilities in the vulnerability security level assessment index, and L4 represents the weight ratio of the number of Type II vulnerabilities in the vulnerability security level assessment index.

[0073] The vulnerability security level parameters include the number of Category 1 vulnerabilities, the number of existing vulnerabilities in the power system, the total number of vulnerabilities, and the number of Category 2 vulnerabilities.

[0074] Based on historical vulnerability security level parameter data, including the number of historical Category I vulnerabilities, the number of existing vulnerabilities in the power system, the total number of vulnerabilities, and the number of Category II vulnerabilities, a mapping relationship table is established between the number of Category I vulnerabilities, the total number of vulnerabilities, the number of Category II vulnerabilities, and the vulnerability security level assessment index. By querying the mapping relationship table based on the real-time number of Category I vulnerabilities, the total number of vulnerabilities, and the number of Category II vulnerabilities, the weighted proportions of each category are obtained.

[0075] Before conducting penetration testing on the power system, vulnerability scanning tools are used to detect existing vulnerabilities and their counts are calculated; this is the number of existing vulnerabilities in the power system. After conducting penetration testing, vulnerability scanning tools are used to find all vulnerabilities, and the total number of all vulnerabilities is recorded as the total number of vulnerabilities. The number of vulnerabilities that overlap with the number of existing vulnerabilities in the total number of vulnerabilities is counted, and this number is recorded as the first category of vulnerabilities. The number of vulnerabilities successfully exploited during the penetration test is counted, and this number is recorded as the second category of vulnerabilities.

[0076] When a power system undergoes penetration testing, a significant discrepancy between the total number of vulnerabilities and the number of existing or secondary vulnerabilities indicates a substantial vulnerability problem. The algorithm in this embodiment uses a hyperbolic sine function to perform a non-linear transformation on the vulnerability security level parameter data, smoothing out the influence of extreme values ​​and resulting in a more accurate vulnerability security level assessment index.

[0077] Furthermore, the specific analysis process for analyzing the degree of abnormality in power system vulnerabilities based on the vulnerability security level assessment index is as follows: obtain the vulnerability security level assessment index, obtain the first threshold and the second threshold of vulnerability security level. When the vulnerability security level assessment index is greater than the first threshold and less than the second threshold, it indicates that the power system is performing normally in terms of vulnerabilities; when it is in other situations, it indicates that the power system is performing abnormally in terms of vulnerabilities.

[0078] In this embodiment, historical vulnerability security level parameter data is obtained, and historical vulnerability security level assessment index is obtained based on the historical vulnerability security level parameter data. The historical vulnerability security level assessment index that indicates that the power system is performing normally in terms of vulnerabilities is extracted and arranged in ascending order. The historical vulnerability security level assessment index that ranks first and last is used as the first threshold and second threshold of vulnerability security level.

[0079] Obtain the vulnerability security level assessment index, and obtain the first and second thresholds for vulnerability security level. When the vulnerability security level assessment index is greater than the first threshold and less than the second threshold, i.e. When this occurs, it indicates that the power system is functioning normally in terms of vulnerabilities; under other circumstances, i.e. or This indicates that the power system is behaving abnormally in terms of vulnerabilities.

[0080] Furthermore, the specific analysis process for analyzing the power system security status and issuing early warnings is as follows: Obtain the power system security status; when one or fewer of the following conditions are present in the power system security status—namely, abnormal network traffic, abnormal system files, or abnormal vulnerabilities—it indicates that the power system is operating normally, and no early warning is issued; when two or more of the following conditions are present in the power system security status—namely, abnormal network traffic, abnormal system files, or abnormal vulnerabilities—it indicates that the power system is experiencing an anomaly, and an early warning is issued.

[0081] In this embodiment, when one or fewer of the following situations occur in the power system security situation—namely, abnormal network traffic, abnormal system files, and abnormal vulnerabilities—it indicates that the power system may be affected by minor external anomalies, but these do not affect its operation, and the power system is operating normally without any warning. Conversely, when two or more of these three situations occur, it indicates that the power system may be affected by serious external anomalies, impacting its operation, and an anomaly is detected, prompting a warning.

[0082] like Figure 3 The diagram shown is a structural schematic of an intelligent penetration testing system for power systems provided in an embodiment of this application. The intelligent penetration testing system for power systems provided in this embodiment includes: a penetration testing module, a parameter acquisition module, a data processing module, and an early warning analysis module. The penetration testing module is used to perform penetration testing on the power system; the parameter acquisition module is used to monitor and acquire penetration testing parameter data during the penetration testing process; the data processing module is used to process the penetration testing parameter data; and the early warning analysis module is used to analyze the power system security status based on the processed penetration testing parameter data and issue early warning alerts.

[0083] In this embodiment, the parameter acquisition module stores the power system security status and penetration test parameter data. The power system security status includes: the degree of anomaly of the power system in terms of network traffic, the degree of anomaly of the power system in terms of system files, and the degree of anomaly of the power system in terms of vulnerabilities. The penetration test parameter data includes network traffic anomaly parameter data, system file anomaly parameter data, and vulnerability security parameter data.

[0084] The early warning analysis module analyzes the power system security status based on the penetration test parameters after data processing. Specifically, it analyzes the anomalies in network traffic, system files, and vulnerabilities of the power system through the processed network traffic anomaly parameters, system file anomaly parameters, and vulnerability security parameters, thereby analyzing the power system security status and issuing early warnings.

[0085] The technical solution in the above-described embodiments of this application obtains network traffic anomaly parameter data based on penetration test parameter data, analyzes the network traffic anomaly parameter data to obtain a network traffic anomaly assessment coefficient, and then analyzes the anomaly degree of the power system in terms of network traffic based on the network traffic anomaly assessment coefficient, thereby achieving a detailed and accurate analysis of the anomaly degree of the power system in terms of network traffic.

[0086] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0088] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0089] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0090] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0091] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An intelligent penetration detection method for a power system, characterized in that: The following steps are involved: Conduct penetration testing of power systems; Monitor and obtain penetration test parameter data during the penetration test; Performing data processing on the penetration test parameter data; The safety status of the power system is analyzed based on the penetration test parameter data after data processing and early warning reminders are issued.

2. An intelligent penetration detection method for a power system as claimed in claim 1, characterized in that: The power system security situation includes: the abnormality degree of the power system in terms of network traffic, the abnormality degree of the power system in terms of system files, and the abnormality degree of the power system in terms of vulnerabilities; The penetration test parameter data includes network traffic abnormality degree parameter data, system file abnormality degree parameter data and vulnerability security degree parameter data; The specific analysis process of the abnormality of the power system in terms of network traffic is as follows: Obtaining network traffic anomaly degree parameter data according to the penetration test parameter data; Analyzing the network flow abnormality parameter data to obtain a network flow abnormality evaluation coefficient, wherein the network flow abnormality evaluation coefficient is used to reflect the abnormality of the power system in terms of network flow; The abnormality degree of the power system in terms of network traffic is analyzed based on the network traffic abnormality evaluation coefficient.

3. An intelligent penetration detection method for a power system as claimed in claim 2, characterized in that: The specific analysis process of analyzing the abnormality degree of the power system in terms of network flow according to the network flow abnormality degree evaluation coefficient is as follows: Obtaining a network traffic anomaly evaluation coefficient, obtaining a network traffic anomaly threshold, and comparing the network traffic anomaly evaluation coefficient with the network traffic anomaly threshold. When the network traffic anomaly evaluation coefficient is less than the network traffic anomaly threshold, it indicates that the power system is performing normally in terms of network traffic. When the network flow anomaly degree assessment coefficient is greater than or equal to the network flow anomaly degree threshold, it means that the power system behaves abnormally in terms of network flow.

4. The intelligent penetration detection method for a power system as claimed in claim 2, characterized in that: The specific analysis process of the abnormality degree of the power system in terms of system files is as follows: Obtain system file abnormality degree parameter data based on penetration test parameter data; According to the system file abnormality degree parameter data analysis, a system file abnormality degree evaluation index is obtained, wherein the system file abnormality degree evaluation index is used to express the abnormality degree of the power system in terms of system files; The abnormality level of the power system in terms of system files is analyzed based on the system file abnormality evaluation index.

5. An intelligent penetration detection method for a power system as claimed in claim 4, characterized in that: The specific analysis process of analyzing the abnormality degree of the power system in terms of system files according to the system file abnormality degree evaluation index is as follows: Obtaining a system file abnormality evaluation index, obtaining a first system file abnormality threshold and a second system file abnormality threshold, comparing the system file abnormality evaluation index with the first system file abnormality threshold and the second system file abnormality threshold, when the system file abnormality evaluation index is greater than the first system file abnormality threshold and less than the second system file abnormality threshold, it indicates that the power system is performing normally in terms of system files; When the system file abnormality evaluation index is less than or equal to the first system file abnormality threshold or the system file abnormality evaluation index is greater than or equal to the second system file abnormality threshold, it indicates that the power system behaves abnormally in terms of system files.

6. An intelligent penetration detection method for a power system as claimed in claim 2, characterized in that: The specific analysis process of the abnormal degree of the power system in terms of vulnerability is as follows: Obtain vulnerability security degree parameter data based on penetration test parameter data; Normalize the vulnerability security parameter data; Obtaining a vulnerability safety level assessment index according to the normalized vulnerability safety level parameter data analysis, wherein the vulnerability safety level assessment index is used to express the abnormality of the power system in terms of vulnerability; The abnormality level of the power system in terms of vulnerability is analyzed based on the vulnerability safety level assessment index.

7. An intelligent penetration detection method for a power system as claimed in claim 6, characterized in that: The specific analysis process of analyzing the abnormality degree of the power system in terms of vulnerability according to the vulnerability safety degree assessment index is as follows: Obtaining a vulnerability safety level assessment index, obtaining a first vulnerability safety level threshold and a second vulnerability safety level threshold. When the vulnerability safety level assessment index is greater than the first vulnerability safety level threshold and less than the second vulnerability safety level threshold, it indicates that the power system is performing normally in terms of vulnerability. When in other situations, it means that the power system behaves abnormally in terms of vulnerability.

8. The intelligent penetration detection method for a power system as claimed in claim 1, characterized in that: The specific analysis process of analyzing the safety situation of the power system and providing early warning reminders is as follows: Obtain the safety status of the power system; When one or more of the following situations occur in the power system security situation, namely, the power system is abnormal in terms of network traffic, the power system is abnormal in terms of system files, and the power system is abnormal in terms of vulnerabilities, it means that the power system is operating normally and no early warning reminder is issued; When two or more of the power system security situations include abnormal network traffic, abnormal system files, and abnormal vulnerabilities, it indicates that the power system is abnormal and an early warning alert is issued.

9. An intelligent penetration detection method for a power system as claimed in claim 2, characterized in that: The specific method for obtaining the network traffic anomaly degree evaluation coefficient is as follows: Perform penetration testing on the power system, obtain the number of penetration testing times, and number the number of penetration testing times; During each penetration test, multiple data acquisitions are performed and the data acquisition times are numbered; Obtaining from the database the preset number of ports used by the power system and the weight ratio of HTTP protocol traffic used by the power system and FTP protocol traffic used by the power system; Obtain parameter data on the degree of abnormality of network traffic; Construct a network traffic anomaly evaluation coefficient calculation formula based on network traffic anomaly parameter data; The specific network traffic anomaly evaluation coefficient calculation formula is: In the formula, It is represented as the network traffic anomaly evaluation coefficient of the power system at the k0th penetration detection, k0=1,2,...,k, k0 represents the number of penetration detection times, k represents the total number of penetration detection times, It is represented by the number of ports used by the power system during the h0th data collection of the k0th penetration detection, h0=1,2,...,h, h0 represents the number of data acquisition times, h represents the total number of data acquisition times, It is represented as the reference number of ports used by the power system at the k0th penetration detection of the power system, It represents the Modbus protocol flow rate of the power system during the k0th penetration detection and the h0th data collection. It is represented by the DNP3 protocol flow rate of the power system during the k0th penetration test and the h0th data collection. It is represented by the HTTP protocol traffic used by the power system during the k0th penetration detection and the h0th data collection. It is represented by the FTP protocol traffic used by the power system during the h0 data collection during the k0th penetration detection. D1 is represented by the weight ratio of the number of ports used by the power system in the network traffic anomaly degree assessment coefficient. D2 is represented by the weight ratio of the HTTP protocol traffic used by the power system and the FTP protocol traffic used by the power system in the network traffic anomaly degree assessment coefficient.

10. An intelligent penetration detection system for a power system, characterized in that: include: Penetration testing module, parameter acquisition module, data processing module and early warning analysis module; Wherein, the penetration test module is used to perform penetration test on the power system; The parameter acquisition module is used to monitor and acquire penetration test parameter data during the penetration test process; The data processing module is used to process the penetration test parameter data; The early warning analysis module is used to analyze the safety status of the power system and issue early warning reminders based on the penetration test parameter data after data processing.

Images