Host security assessment method and system based on smart grid distribution master station

Abstract

The invention provides an innovative host security assessment method and system based on a smart grid distribution master station. According to the method, the importance, the sensitivity and the security protection level of a current host in a distribution network master station are comprehensively evaluated, a judgment matrix is constructed by applying an analytic hierarchy process, an asset importance value and a vulnerability influence value are accurately calculated, and a plurality of security state factors are comprehensively considered, so that the security of the host is scientifically evaluated. According to the evaluation result, the system can intelligently judge the risk type and implement reasonable communication blocking, so that the safety and the stability of the intelligent power grid power distribution master station are effectively improved. The method has the beneficial effects that a scientific basis is provided for safety management of the intelligent power grid, a complex evaluation process is simplified, the accuracy and rationality of an evaluation result are ensured, and the method has important significance for ensuring stable operation and information safety of the intelligent power grid.

Description

Technical Field

[0001] The present invention relates to a field, and more specifically, to a host safety assessment method and system based on a smart grid distribution master station. Background Art

[0002] Relying on the application of advanced sensing and measurement technology, advanced equipment technology, advanced control methods and advanced decision support system technology, building an automated, information-based and interactive unified strong intelligent power grid is the future development trend.

[0003] At present, the installation of massive sensors and measuring equipment in the power system, the interconnection and information sharing of various links in the power grid, the automatic control and optimized scheduling of the power grid, and the intelligent decision-making system are all realized through the host in the distribution network master station.

[0004] The host of the distribution network master station is an important carrier of the operation of the smart grid, and its security performance is directly related to the stable operation of the smart grid. Host security assessment is a key link to ensure the stable operation and information security of the smart grid system. By conducting security assessments on each host system in the smart grid, security vulnerabilities and hidden dangers can be discovered and repaired in a timely manner, thereby improving the overall security performance of the smart grid. At the same time, host security assessment can also provide a scientific basis for the security management of the smart grid, guide the formulation of reasonable security strategies and measures, and ensure the stable operation and information security of the smart grid.

[0005] In the power system, the host equipment in the distribution network master station provides relatively fixed communication services according to the business model of the distribution network master station. The communication traffic of the host during normal operation is basically fixed, and the business type has a basis to rely on. The safety performance of the host has a vital impact on the safe operation of the power system distribution network master station.

[0006] However, up to now, there is no accurate host safety assessment method that can analyze the host status and safety performance of the host equipment in the distribution network master station based on the business model of the power system. Therefore, the host equipment in the distribution network master station has various potential risks such as asset risk and safety risk.

[0007] In view of the above problems, there is an urgent need for a host safety assessment method and system based on a smart grid distribution master station. Summary of the invention

[0008] In order to solve the deficiencies in the prior art, the present invention provides a host security assessment method and system based on a smart grid distribution master station, which accurately analyzes the security status of the current host by calculating and analyzing the asset importance value and vulnerability impact value of the current host, thereby implementing reasonable business blocking.

[0009] The present invention adopts the following technical solution.

[0010] The first aspect of the present invention relates to a host security assessment method based on a smart grid distribution master station, the method comprising the following steps: collecting the importance, sensitivity, and security protection level scores of the current host in the distribution network master station, and calculating the asset importance value of the current host based on the importance, sensitivity, and security protection level scores; querying all vulnerabilities corresponding to the current host, and converting the vulnerability impact value of the current host using the impact of each vulnerability on the current host; constructing a judgment matrix using a hierarchical analysis method, obtaining the weights of multiple security status factors of the current host based on the judgment matrix, and using the vulnerability impact value and the weights of multiple security status factors to calculate the values ​​of other security status factors other than the vulnerability impact; the vulnerability impact value and the values ​​of other security status factors other than the vulnerability impact constitute multiple security status impact factor values ​​of the current host; judging the risk type of the current host based on the asset importance value of the current host and the multiple security status impact factor values ​​of the current host, and implementing communication blocking for the current host.

[0011] Preferably, the importance, sensitivity, and safety protection level scores of the current host in the distribution network master station are collected, and the asset importance value of the current host is calculated based on the importance, sensitivity, and safety protection level scores, including: using expert opinions to obtain the importance, sensitivity, and safety protection level scores of the current host to construct an importance evaluation matrix, the row numbers of the elements in the importance evaluation matrix correspond to the importance, sensitivity, and safety protection level, respectively, and the column numbers correspond to the expert numbers, respectively; the importance evaluation matrix is ​​normalized to obtain a normalized matrix, and the amount of information of each column element is calculated through the normalized matrix, the importance weight of each column element is calculated based on the amount of information of each column element, and the prior score of each column element is calculated through the importance evaluation matrix; the asset importance value of the current host is solved using the importance weight and prior score of each column element.

[0012] Preferably, all vulnerabilities corresponding to the current host are queried, and the vulnerability impact value of the current host is converted using the impact of each vulnerability on the current host, including: the vulnerability impact value of the current host j is:

[0013]

[0014] Where VV leak is the impact of the leak on the current host j. The number of vulnerabilities of the current host j is L.

[0015] And the impact of the leak on the current host j is:

[0016] VV leak =10.41(1-(1-VC leak )(1-VI leak )(1-VA leak ))

[0017] Where, VC leak VI leak and VA leak They are respectively the confidentiality impact, integrity impact and availability impact of the leak-th vulnerability on the current host j.

[0018] Preferably, a judgment matrix is ​​constructed using a hierarchical analysis method, and weights of multiple security status factors of the current host are obtained based on the judgment matrix, including: the multiple security status factors of the current host include security alarm factors, baseline verification factors, vulnerability scanning factors, weak password scanning factors and open port factors; two security impact factors are randomly selected from the multiple security status factors and an importance collision is performed to obtain the collision amount between every two security impact factors, and the judgment matrix of the current host is constructed through the collision amount; the judgment matrix of the current host is calculated based on the hierarchical analysis method to obtain the weight of each security impact factor.

[0019] Preferably, the vulnerability impact value and the weights of multiple security status factors are used to calculate the values ​​of other security status factors other than the vulnerability impact, including: extracting the weight corresponding to any other security status factor value, and using the weight to weight the vulnerability response value divided by the weight to obtain any other security status factor value.

[0020] Preferably, the risk type of the current host is determined based on the asset importance value of the current host and the values ​​of multiple security status influencing factors of the current host, and communication blocking is implemented for the current host, including: using the asset importance value of the current host to rate the asset importance of the current host to obtain the asset importance level of the current host; using the security status factor value of the current host to analyze the comprehensive security status level of the current host; combining the asset importance level of the current host and the comprehensive security status level of the current host to determine whether communication blocking is needed and which type of communication blocking to implement.

[0021] Preferably, it is determined whether communication blocking is needed and which type of communication blocking is to be implemented, including: communication blocking types include session blocking, device blocking, network segment blocking, master station blocking and disconnection problem areas; the degree of blocking of session blocking, device blocking, network segment blocking, master station blocking and disconnection problem areas gradually increases.

[0022] The second aspect of the present invention relates to a host security assessment system based on a smart grid distribution master station using the method in the first aspect of the present invention, the system comprising a collection module, a conversion module, a judgment module and a blocking module; wherein the collection module is used to collect the importance, sensitivity and security protection level score of the current host in the distribution network master station, and calculate the asset importance value of the current host based on the importance, sensitivity and security protection level score; the conversion module is used to query all vulnerabilities corresponding to the current host, and convert the vulnerability impact value of the current host using the impact of each vulnerability on the current host; the judgment module is used to construct a judgment matrix using a hierarchical analysis method, obtain the weights of multiple security status factors of the current host based on the judgment matrix, and use the vulnerability impact value and the weights of multiple security status factors to calculate the values ​​of other security status factors other than the vulnerability impact; the vulnerability impact value and the values ​​of other security status factors other than the vulnerability impact constitute multiple security status impact factor values ​​of the current host; the blocking module is used to judge the risk type of the current host according to the asset importance value of the current host and the multiple security status impact factor values ​​of the current host, and implement communication blocking for the current host.

[0023] The third aspect of the present invention relates to a terminal, comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method in the first aspect of the present invention

[0024] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in the first aspect of the present invention.

[0025] The beneficial effect of the present invention is that, compared with the prior art, the host security assessment method and system based on the smart grid power distribution master station in the present invention accurately analyzes the security status of the current host by calculating and analyzing the asset importance value and vulnerability impact value of the current host, thereby implementing reasonable business blocking. The present invention reduces the difficulty of distinguishing and dividing the host security level, facilitates management personnel to perform security classification management, provides corresponding solutions for different risks, and fully improves the security of the host in the distribution network master station.

[0026] The beneficial effects of the present invention also include:

[0027] 1. In the present invention, the host security assessment provides a scientific basis for the security management of the smart grid through a small amount of data collection process and automated assessment and analysis, guides the formulation of reasonable security strategies and measures, and ensures the stable operation and information security of the smart grid.

[0028] 2. Based on the business characteristics of the host itself, the correlation between the vulnerability impact and other influencing factors is constructed, and the host's security in all aspects is comprehensively evaluated. This calculation method greatly simplifies the calculation and implementation process of the host security assessment, and does not reduce the accuracy of the assessment results.

[0029] 3. The present invention obtains the combined evaluation level of the security status influencing factors and the asset importance, and implements reasonable communication blocking of the host at different combined evaluation levels. The communication blocking method not only includes reasonable blocking of the device's own port and communication process, but can also be extended to the host's main station and communication area, ensuring the reasonableness of the blocking and ensuring the safety and stability of the host at the lowest cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of a process flow of a host safety assessment method based on a smart grid power distribution master station of the present invention;

[0031] Figure 2 The present invention is a schematic diagram of the module structure of a host safety assessment system based on a smart grid distribution master station. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention clearer and more correct, the technical solution of the present invention is described in detail through multiple specific implementations below. It is worth noting that the embodiments adopted in the present invention are only used to explain the present invention and are not used to limit the content of the present invention.

[0033] Figure 1 FIG. 1 is a flow chart of a host security assessment method based on a smart grid power distribution master station of the present invention. Figure 1 As shown, the first aspect of the present invention relates to a host security assessment method based on a smart grid distribution master station, and the method includes steps 1 to 4.

[0034] Step 1: Collect the importance, sensitivity, and security protection level scores of the current host in the distribution network master station, and calculate the asset importance value of the current host based on the importance, sensitivity, and security protection level scores.

[0035] The importance of the host is closely related to the business undertaken by each host. At present, the main distribution business includes: distribution network dispatching automation, distribution production emergency repair command, power load control management, electric energy collection, low-frequency and low-voltage load reduction, power grid geographic information, power marketing management, customer service, electricity consumption information collection, production management, etc.

[0036] When different businesses implement communication, analysis, and calculation in the mainframe of the power distribution master station, the importance of the mainframe equipment driving the business is inconsistent with the importance of the business. The importance of the mainframe can be comprehensively evaluated by scoring based on the importance of the running business, business sensitivity, and business environment security.

[0037] In the method of the present invention, the communication blocking and security protection of the distribution network master station also need to be judged according to the importance of the host device itself. When the host device undertakes more core and important communication functions, it needs to be protected by higher security protection measures and more redundant backup services. To this end, the present invention first evaluates the importance of the services undertaken by each host of the distribution network master station.

[0038] Preferably, the importance, sensitivity, and safety protection level scores of the current host in the distribution network master station are collected, and the asset importance value of the current host is calculated based on the importance, sensitivity, and safety protection level scores, including: using expert opinions to obtain the importance, sensitivity, and safety protection level scores of the current host to construct an importance evaluation matrix, the row numbers of the elements in the importance evaluation matrix correspond to the importance, sensitivity, and safety protection level, respectively, and the column numbers correspond to the expert numbers, respectively; the importance evaluation matrix is ​​normalized to obtain a normalized matrix, and the amount of information of each column element is calculated through the normalized matrix, the importance weight of each column element is calculated based on the amount of information of each column element, and the prior score of each column element is calculated through the importance evaluation matrix; the asset importance value of the current host is solved using the importance weight and prior score of each column element.

[0039] Importance refers to the degree of close connection between the host and the safe and stable operation of the power system. Businesses related to the efficient operation of the production control area are often given the highest level of importance. In contrast, although the business within the management area is critical, it is usually ranked second in importance. This classification not only reflects the direct support role of the business to the core functions of the power system, but also emphasizes the relative weight and priority of different business links in ensuring the stable operation of the system.

[0040] Sensitivity refers to the degree of influence of the host on the safe and stable operation of the power system. Specifically, if a business cannot operate normally for some reason, it can quickly spread and cause a large area of ​​the distribution network to lose control in a very short time, and then cause a power outage in a large area, then the business is undoubtedly given a higher sensitivity level. This sensitivity not only highlights the key position of the business in the power system, but also emphasizes the serious consequences that may arise if it is blocked, requiring special attention and key protection in daily operations.

[0041] The security protection level refers to the security level of different sites where the business is located. There are significant differences in the security protection levels between different sites. This difference directly causes the uneven resistance of each site to network attacks, which in turn affects the probability of the distribution network host being subjected to potential network attacks. Therefore, the different security levels of the business environment, as a key variable, have a profound impact on the overall security of the host. This means that when planning and managing the distribution network system, it is necessary to fully consider and adapt to the differences in security levels in order to formulate more accurate and effective security protection strategies to ensure the stable operation of the host and the entire distribution network system.

[0042] The above-mentioned influencing factors are difficult to evaluate directly. The present invention calculates the relative importance of the influencing factors based on experience and expert knowledge.

[0043] First, according to the Information Security Risk Assessment Specification, the assessment levels are set as L1 to L5, where L1 means very high, L2 means high, L3 means average, L4 means low, and L5 means very low. The L1 to L5 levels are scored 5, 4, 3, 2, and 1 respectively. N experts score the host assets according to the level classification. Based on the scoring results, the importance evaluation matrix of the current host is constructed.

[0044] The importance evaluation matrix M of the current host j j It is expressed as:

[0045]

[0046] Among them, m 1I to m nI are the host importance scores given by n experts, m 1S to m nS are the host sensitivity scores given by n experts, m 1E to m nE Where n is the host security protection level score given by experts.

[0047] Normalizing the above evaluation matrix gives the normalized matrix:

[0048]

[0049] Therefore, the information content of each column element of the normalized matrix is ​​calculated as follows:

[0050] The mean of the elements in the kth column is:

[0051]

[0052] k is 1, 2 or 3.

[0053] The discreteness parameter of the k-th column element is:

[0054]

[0055] Then the correlation coefficient between the elements in the kth column and the elements in the lth column is:

[0056]

[0057] l is 1, 2 or 3, and k≠l.

[0058] Therefore, the amount of information contained in the elements of column l is:

[0059] μ k =η k ∑ l∈[1,2,3] / k (1-v lk )

[0060] Thus, the weight of the k-th column element of the j-th host is obtained as:

[0061]

[0062] In the aforementioned importance evaluation matrix M of the current host j j In the example, the element in the i-th row and the k-th column is m. ik , then the prior score of the k-th column element is:

[0063]

[0064] The asset importance value of the current host j is:

[0065]

[0066] Step 2: query all vulnerabilities corresponding to the current host, and use the impact of each vulnerability on the current host to convert the vulnerability impact value of the current host.

[0067] The host's own security status is also an important factor affecting the assessment. The host asset security is quantitatively assessed based on the host network security risk assessment. The impact of each vulnerability on the current host includes confidentiality impact, integrity impact, and availability impact.

[0068] Preferably, all vulnerabilities corresponding to the current host are queried, and the vulnerability impact value of the current host is converted using the impact of each vulnerability on the current host, including: the vulnerability impact value of the current host j is:

[0069]

[0070] Where VV leak is the impact of the leak on the current host j. The number of vulnerabilities of the current host j is L.

[0071] And the impact of the Leakth vulnerability on the current host j is:

[0072] VV leak =10.41(1-(1-VC leak )(1-VI leak )(1-VA leak ))

[0073] Where, VC leak VI leak and VA leak They are respectively the confidentiality impact, integrity impact and availability impact of the leak-th vulnerability on the current host j.

[0074] Among them, the integrity index measures the impact of successfully exploiting the vulnerability on the integrity of the host. Integrity refers to the trustworthiness and accuracy of information. The higher the impact on the affected component, the higher the basic score of this item. The confidentiality index measures the impact of successfully exploiting the vulnerability on the confidentiality of information resources managed by software components in the host. Confidentiality represents the host's ability to limit the right to access and disclose information to authorized users and prevent unauthorized users from accessing and disclosing information. The availability index measures the degree of impact on the availability of the affected component due to the successful exploitation of the vulnerability. The unavailability of the affected component refers to the loss of availability of the affected component itself, such as network services.

[0075] In one implementation of the present invention, the impact value of host vulnerability is calculated in combination with CVSS (Common Vulnerability Scoring System). CVSS conducts a comprehensive evaluation of host vulnerabilities in three aspects: basic evaluation, life cycle evaluation, and environmental evaluation. The present invention focuses on the security status of the host itself, combines the CVSS evaluation method, and calculates the impact value of a single vulnerability of the host from three aspects: integrity, confidentiality, and availability.

[0076] Step 3, construct a judgment matrix using the hierarchical analysis method, obtain the weights of multiple security status factors of the current host based on the judgment matrix, and use the vulnerability impact value and the weights of multiple security status factors to calculate the values ​​of other security status factors other than the vulnerability impact; the vulnerability impact value and the values ​​of other security status factors other than the vulnerability impact constitute the multiple security status impact factor values ​​of the current host.

[0077] In the present invention, the security risk assessment content generally includes multiple dimensions of assessment indicators such as security alerts, baseline verification, vulnerability scanning, weak password scanning, and open ports. In addition, there is a potential correlation between the various indicators. Therefore, the present invention only calculates the impact value of one indicator, vulnerability scanning, and indirectly derives the impact values ​​of other indicators through relatively fixed weights between various indicators, thereby greatly simplifying the calculation while not reducing the confidence of the host assessment result.

[0078] Preferably, a judgment matrix is ​​constructed using a hierarchical analysis method, and weights of multiple security status factors of the current host are obtained based on the judgment matrix, including: the multiple security status factors of the current host include security alarm factors, baseline verification factors, vulnerability scanning factors, weak password scanning factors and open port factors; two security impact factors are randomly selected from the multiple security status factors and an importance collision is performed to obtain the collision amount between every two security impact factors, and the judgment matrix of the current host is constructed through the collision amount; the judgment matrix of the current host is calculated based on the hierarchical analysis method to obtain the weight of each security impact factor.

[0079] The AHP is a systematic analysis method that decomposes complex problems into multiple components and aggregates and combines the factors at different levels according to their interrelated influences and affiliations to form a multi-level analysis structure model for qualitative and quantitative analysis. The AHP compares the factors one by one, quantifies the relative importance of each factor, and then determines the weights of different security dimensions to achieve an objective and accurate assessment of the security status of the distribution network host.

[0080] In the present invention, a hierarchical model is first constructed. The host security status is evaluated from five aspects, including vulnerability scanning, security alerts, baseline verification, weak password scanning, and open ports. The importance of each element is judged using the importance scale. Combined with expert experience, the elements are compared to make importance judgments. The following are the evaluation scores obtained by the collision analysis between the two elements:

[0081]

[0082]

[0083] Table 1 Evaluation scores obtained by collision analysis between two elements

[0084] Combined with expert experience, if the security alert is extremely important relative to the verification result, the score of the security alert is 5, while the score of the verification result is 1. Similarly, the basic content of the above table is obtained using expert opinions.

[0085] Generally speaking, if two indicators are equally important, they will both be scored 1, if one indicator is slightly important, it will be scored 2, if it is obviously important, it will be scored 3, if it is strongly important, it will be scored 4, and if it is extremely important, it will be scored 5.

[0086] For any host, the content of the score table obtained through expert experience is different, so for any host, the collision amount can be obtained according to the importance of various factors.

[0087] In another method, the expert experience in step 1 and step 3 can be replaced by automatic judgment by a computer. First, extract the service type carried by each host, the data center where each host is located, the geographical location, the type of host equipment, the rated communication data volume, and other information to form a host feature vector, and solve the host feature vector through a pre-obtained model and pre-defined rules to obtain the score of the current host in each scoring item. For example, automatically obtain the importance, sensitivity, and security protection score of the current host, automatically obtain the judgment matrix of multiple security status factors of the current host, and so on.

[0088] According to the above table, a judgment matrix is ​​constructed. The value of each element in the matrix is ​​the quotient between evaluation dimension 1 and evaluation dimension 2. The judgment matrix is ​​a 5*5 matrix. The i-th row and j-th column are the quotient of the collision results between the i-th influencing factor and the j-th influencing factor. Therefore, the value range of the element is between 1 / 5 and 5. When the row and column numbers are equal, the element value is 1.

[0089] The judgment matrix is ​​checked for consistency through the hierarchical analysis method to ensure the reliability of the evaluation results. The purpose is to eliminate the inconsistency of the collision matrix caused by human factors, which affects the accuracy of the evaluation results. The calculation process is as follows:

[0090] The consistency index of the matrix is ​​CR = CI / RI. If CR < 0.1, the consistency of the collision matrix is ​​considered acceptable. Otherwise, the collision matrix needs to be readjusted. The calculation formula of CI is: RI is the average random consistency index, which is determined according to the order of the judgment matrix.

[0091] The above matrix is ​​combined with the consistency index formula to calculate CI and CR, and the consistency check of the collision matrix passes.

[0092] The analytic hierarchy process is used to calculate the matrix that has passed the verification and obtain the weight of each safety influencing factor.

[0093] Preferably, the vulnerability impact value and the weights of multiple security status factors are used to calculate the values ​​of other security status factors other than the vulnerability impact, including: extracting the weight corresponding to any other security status factor value, and using the weight to weight the vulnerability response value divided by the weight to obtain any other security status factor value.

[0094] In one embodiment, the vulnerability impact value HV(N host_j ) divided by the weight corresponding to the vulnerability impact factor, thus obtaining the weighted amount of the vulnerability impact value. Then, the weighted amount is weighted by the weights of other factors in turn, and then multiplied by the weights of each factor in turn to obtain the values ​​of other security status factors.

[0095] Step 4: According to the asset importance value of the current host and the values ​​of multiple security status influencing factors of the current host, the risk type of the current host is determined, and communication blocking is implemented for the current host.

[0096] When comprehensively evaluating the host security status, the evaluation results of the previous steps need to be deeply integrated to form a comprehensive and accurate judgment.

[0097] First, the business importance level and security assessment value of the hosts are carefully ranked. This process aims to clarify the strategic position of each host in the enterprise operation and its current security protection status. Then, the ranking results of these two aspects are combined for comprehensive consideration, especially focusing on those hosts with high business importance levels and high security assessment value scores. Such hosts not only carry key businesses in enterprise operations, but also expose significant loopholes or deficiencies in their security protection level, which directly reflects the current situation of their relatively low security level. Such situations must be given high attention and regarded as the top priority in security management.

[0098] Preferably, the risk type of the current host is determined based on the asset importance value of the current host and the values ​​of multiple security status influencing factors of the current host, and communication blocking is implemented for the current host, including: using the asset importance value of the current host to rate the asset importance of the current host to obtain the asset importance level of the current host; using the security status factor value of the current host to analyze the comprehensive security status level of the current host; combining the asset importance level of the current host and the comprehensive security status level of the current host to determine whether communication blocking is needed and which type of communication blocking to implement.

[0099] Using the preset threshold value, the asset importance values ​​of the current host with different scores are divided into different importance evaluation levels. A similar method can also be used to rate the factors affecting the security status. Different types of communication blocking are implemented according to the combined evaluation level of the above multiple parameters.

[0100] Preferably, it is determined whether communication blocking is needed and which type of communication blocking is to be implemented, including: communication blocking types include session blocking, device blocking, network segment blocking, master station blocking and disconnection problem areas; the degree of blocking of session blocking, device blocking, network segment blocking, master station blocking and disconnection problem areas gradually increases.

[0101] Among them, session blocking is to selectively block sessions of specific hosts in the distribution network master station in the distribution network environment. According to the IP address and port information of the host device, the potentially dangerous port session is disconnected to achieve session blocking and protect network security.

[0102] Device blocking is to block distribution equipment that poses security risks within the distribution network, such as smart meters and switchgear, based on the device's IP address, to prevent its network communication and prevent the further spread of security threats.

[0103] Network segment blocking is when a distribution device or terminal in the distribution network has a serious problem and the device is located in a specific network segment, the network segment is blocked and disabled to ensure the safety and stability of the entire distribution network.

[0104] Master station blocking is to block the communication between the problem device and the distribution network master station based on the IP address of the distribution equipment, restrict their data exchange, and reduce potential security risks.

[0105] Disconnecting the problem area means that if a certain area in the distribution network, such as a distribution room or a group of distribution equipment, has a serious problem, the communication between the area and the distribution network master station will be disconnected to ensure that the problem does not affect the entire distribution network.

[0106] In one embodiment, if the importance rating of the power distribution equipment is 1-2, and the scores of each safety assessment do not exceed 30 points, the safety issues of the equipment can be regarded as low risk and can be gradually corrected in daily operation and maintenance; if the assessment score exceeds 30 points, the session of the device is immediately blocked and the session is restored as soon as possible after repair.

[0107] If the importance rating of the power distribution equipment is 2-3, and the scores of each assessment do not exceed 50 points, the equipment will be blocked to restrict its network communication, and it will be restored after repair. If the assessment score exceeds 50 points, the network segment will be blocked to ensure the isolation of the risk area, and it will be restored after repair.

[0108] If the importance rating of the power distribution equipment is 3-5, and the evaluation score does not exceed 80 points, the main station of the equipment will be blocked, limiting its communication with the distribution network main station, and then restored after repair; if the evaluation score exceeds 80 points, the entire distribution area will be isolated and blocked until there are no high-risk equipment in the area before normal operation can be restored. At the same time, it is necessary to immediately report to the superior management department or dispatch center for dangerous emergency records.

[0109] In the following embodiments, the blocking process of a host is described as follows:

[0110] Through expert scoring or automatic scoring, the scoring matrix of importance, sensitivity, and security protection level of the host is obtained as follows:

[0111]

[0112] The normalized matrix is:

[0113]

[0114] The importance weights of each element are calculated as (0.2266, 0.2389, 0.5354), and the prior scores of each element are (2.2, 2.4, 3.8). Finally, the importance of the host is 1.70.

[0115] Then, the security check results of the host are evaluated. By scanning the host vulnerabilities, three vulnerabilities are found on the current host, namely: CVE-2016-0639, CVE-2016-3471, and CVE-2016-3477. The values ​​of the host confidentiality, integrity, and availability caused by one of the vulnerabilities are 0, 0.275, and 0.66, respectively. After comprehensive calculation of the three vulnerabilities, the vulnerability impact value of the host is 26.4.

[0116] A judgment matrix is ​​constructed for the current host, and the parameters of the judgment matrix are obtained as RI=1.12, CI=0.073092, and CR=0.065260<0.1.

[0117] Using the host vulnerability impact value, the impact values ​​of other factors are calculated to obtain Table 2.

[0118]

[0119]

[0120] Table 2 Safety status influencing factors

[0121] Figure 2 The schematic diagram of the module structure of a host safety assessment system based on a smart grid distribution master station of the present invention is shown in FIG. Figure 2 As shown, the second aspect of the present invention relates to a host security assessment system based on a smart grid distribution master station using the method in the first aspect of the present invention, the system comprising a collection module, a conversion module, a judgment module and a blocking module; wherein the collection module is used to collect the importance, sensitivity and security protection level score of the current host in the distribution network master station, and calculate the asset importance value of the current host based on the importance, sensitivity and security protection level score; the conversion module is used to query all vulnerabilities corresponding to the current host, and convert the vulnerability impact value of the current host using the impact of each vulnerability on the current host; the judgment module is used to construct a judgment matrix using a hierarchical analysis method, obtain the weights of multiple security status factors of the current host based on the judgment matrix, and use the vulnerability impact value and the weights of multiple security status factors to calculate the values ​​of other security status factors other than the vulnerability impact; the vulnerability impact value and the values ​​of other security status factors other than the vulnerability impact constitute multiple security status impact factor values ​​of the current host; the blocking module is used to judge the risk type of the current host according to the asset importance value of the current host and the multiple security status impact factor values ​​of the current host, and implement communication blocking for the current host.

[0122] A third aspect of the present invention relates to a terminal, comprising a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of the method in the first aspect of the present invention.

[0123] A fourth aspect of the present invention relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method in the first aspect of the present invention.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit them. Although the present invention is described in detail with reference to the above embodiments, it should be understood by those skilled in the art that the technical solutions of the present invention still include contents that can modify or replace the specific embodiments of the present invention. Any modification or replacement that does not depart from the spirit and scope of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A host security assessment method based on a smart grid distribution master station, characterized in that: The method comprises the following steps: Collect the importance, sensitivity, and security protection level scores of the current host in the distribution network master station, and calculate the asset importance value of the current host based on the importance, sensitivity, and security protection level scores; Query all vulnerabilities corresponding to the current host, and convert the impact of each vulnerability on the current host to obtain the vulnerability impact value of the current host; A judgment matrix is ​​constructed by using a hierarchical analysis method, and weights of multiple security status factors of the current host are obtained based on the judgment matrix. The values ​​of other security status factors other than the vulnerability impact are calculated by using the vulnerability impact value and the weights of the multiple security status factors; the vulnerability impact value and the values ​​of other security status factors other than the vulnerability impact constitute multiple security status impact factor values ​​of the current host; According to the asset importance value of the current host and the values ​​of multiple security status influencing factors of the current host, the risk type of the current host is judged, and communication blocking is implemented for the current host.

2. The host security assessment method based on the smart grid power distribution master station according to claim 1 is characterized in that: The importance, sensitivity, and security protection level score of the current host in the distribution network master station are collected, and the asset importance value of the current host is calculated based on the importance, sensitivity, and security protection level score, including: Using expert opinions to obtain the importance, sensitivity, and security protection level scores of the current host to construct an importance evaluation matrix, wherein the row numbers of the elements in the importance evaluation matrix correspond to the importance, sensitivity, and security protection level, respectively, and the column numbers correspond to the expert numbers, respectively; Normalizing the importance evaluation matrix to obtain a normalized matrix, and calculating the amount of information of each column element through the normalized matrix, calculating the importance weight of each column element based on the amount of information of each column element, and calculating the prior score of each column element through the importance evaluation matrix; The asset importance value of the current host is solved by using the importance weight of each column element and the priori score.

3. The host security assessment method based on the smart grid distribution master station according to claim 2 is characterized in that: The querying of all vulnerabilities corresponding to the current host and converting the vulnerability impact value of the current host using the impact of each vulnerability on the current host includes: The vulnerability impact value of the current host j is: Where VV leak is the impact of the leak on the current host j. The number of vulnerabilities of the current host j is L. And the impact of the leak on the current host j is: VV leak =10.41(1-(1-VC leak )(1-VI leak )(1-VA leak )) Where, VC leak VI leak and VA leak They are respectively the confidentiality impact, integrity impact and availability impact of the leak-th vulnerability on the current host j.

4. The host security assessment method based on the smart grid distribution master station according to claim 3 is characterized in that: The method of constructing a judgment matrix by using the hierarchical analysis method and obtaining weights of multiple security status factors of the current host based on the judgment matrix includes: The multiple security status factors of the current host include security warning factors, baseline verification factors, vulnerability scanning factors, weak password scanning factors and open port factors; Selecting two security influencing factors from a plurality of security status factors and performing importance collision to obtain a collision amount between each two security influencing factors, and constructing a judgment matrix of the current host through the collision amount; The judgment matrix of the current host is calculated based on the hierarchical analysis method to obtain the weight of each of the security influencing factors.

5. The host security assessment method based on the smart grid power distribution master station according to claim 4 is characterized in that: The using the vulnerability impact value and the weights of the multiple security status factors to calculate other security status factor values ​​other than the vulnerability impact, includes: The weight corresponding to any other security status factor value is extracted, and the weight is used to weight the weighted amount of the vulnerability response value to obtain any other security status factor value.

6. The host security assessment method based on the smart grid distribution master station according to claim 5 is characterized in that: The determining the risk type of the current host according to the asset importance value of the current host and the multiple security status influencing factor values ​​of the current host, and implementing communication blocking for the current host, includes: Using the asset importance value of the current host, rating the asset importance of the current host to obtain the asset importance level of the current host; Analyzing the comprehensive security status level of the current host using the security status factor value of the current host; The asset importance level of the current host and the comprehensive security status level of the current host are combined to determine whether communication blocking is required and what type of communication blocking is required.

7. A host security assessment method based on a smart grid power distribution master station according to claim 6, characterized in that: The determining whether communication blocking needs to be implemented and what type of communication blocking to implement includes: Communication blocking types include session blocking, device blocking, network segment blocking, master station blocking and disconnection problem area; The blocking degree of the session blocking, device blocking, network segment blocking, master station blocking and disconnection problem areas increases gradually.

8. A host safety assessment system based on a smart grid power distribution master station using the method according to any one of claims 1 to 7, characterized in that: The system includes a collection module, a conversion module, a judgment module and a blocking module; wherein, The acquisition module is used to collect the importance, sensitivity, and security protection level score of the current host in the distribution network master station, and calculate the asset importance value of the current host based on the importance, sensitivity, and security protection level score; The conversion module is used to query all vulnerabilities corresponding to the current host, and convert the vulnerability impact value of the current host using the impact of each vulnerability on the current host; The judgment module is used to construct a judgment matrix using a hierarchical analysis method, obtain the weights of multiple security status factors of the current host based on the judgment matrix, and use the vulnerability impact value and the weights of the multiple security status factors to calculate the values ​​of other security status factors other than the vulnerability impact; the vulnerability impact value and the values ​​of other security status factors other than the vulnerability impact constitute multiple security status impact factor values ​​of the current host; The blocking module is used to determine the risk type of the current host according to the asset importance value of the current host and the values ​​of multiple security status influencing factors of the current host, and implement communication blocking for the current host.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images