Ultra-high voltage power transmission inspection network security adaptive optimization method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an ultrahigh-voltage power transmission inspection network security adaptive optimization method and device, computer equipment, a readable storage medium and a program product. Outputting an analysis result containing an abnormal network flow mode and a network attack feature through a data analysis model based on an anomaly detection algorithm and a mode matching algorithm, and determining an abnormal access result based on a preset anomaly recognition rule in a preset security policy library, the abnormal network flow mode and the network attack feature, and according to the abnormal access result and a preset security policy matching table, updating the security policy of the ultrahigh-voltage power transmission inspection network. Compared with the traditional offline data analysis, the scheme analyzes the data acquired in real time through the data analysis model, outputs the network flow mode and identifies the attack characteristics, and updates the security policy of the ultrahigh-voltage power transmission inspection network in combination with the abnormal access result determined based on the preset security policy library and the preset security policy matching table. And the optimization efficiency of the ultrahigh-voltage power transmission inspection network is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, computer equipment, computer-readable storage medium and computer program product for self-adaptive optimization of network security for ultra-high voltage power transmission inspection. Background Art

[0002] With the rapid development of the power industry, the safety and stability of the ultra-high voltage transmission system, as the backbone network of the power grid, is directly related to the reliable operation of the entire power system. In order to ensure the safe operation of ultra-high voltage transmission lines, inspection systems have emerged. Real-time monitoring of line status through various data acquisition equipment has become an important means to prevent faults and ensure power supply safety. However, in the current ultra-high voltage transmission inspection system, although data acquisition and monitoring technology have made significant progress, it still faces many challenges and deficiencies in network security protection.

[0003] Traditional inspection systems often use offline or batch processing to analyze collected data, which results in poor timeliness of network security analysis and difficulty in real-time detection and response to potential network threats. When the system detects a security incident, the attack may have already caused a certain degree of damage.

[0004] Therefore, the current optimization method for ultra-high voltage transmission inspection network security has the defect of low optimization efficiency. Summary of the invention

[0005] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product for ultra-high voltage transmission inspection network security adaptive optimization that can improve optimization efficiency in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for adaptively optimizing the security of an ultra-high voltage transmission inspection network, the method comprising:

[0007] Obtain access data to be processed collected in real time by data acquisition equipment for ultra-high voltage transmission inspection network;

[0008] Inputting the access data to be processed into a trained data analysis model, and the data analysis model outputs a network security analysis result corresponding to the access data to be processed according to a preset anomaly detection algorithm and a preset pattern matching algorithm; the network security analysis result includes an identification result of an abnormal network traffic pattern and an identification result of a network attack feature;

[0009] Determine the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result;

[0010] An updated security policy is determined according to the abnormal access result and a preset security policy matching table, and the updated security policy is updated to the ultra-high voltage power transmission inspection network.

[0011] In one of the embodiments, determining the abnormal access result corresponding to the ultra-high voltage power transmission inspection system according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result includes:

[0012] Determine attack pattern characteristics, access address information, and access frequency based on the abnormal network traffic pattern and network attack characteristics;

[0013] According to the preset abnormality identification rules, as well as the attack mode characteristics, access address information and access frequency, the abnormal access results corresponding to the ultra-high voltage power transmission inspection network are determined.

[0014] In one of the embodiments, determining the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rule, the attack mode characteristics, the access address information and the access frequency includes:

[0015] According to the preset anomaly identification rules, determine the historical attack pattern characteristics and the preset access address information set;

[0016] If the similarity between the attack pattern feature and the historical attack pattern feature is greater than a preset similarity threshold or the access address information is not in the preset access address information set, then according to the preset abnormality identification rule, determine the preset importance level corresponding to the accessed resource in the ultra-high voltage power transmission inspection network;

[0017] The abnormal access result is determined according to the attack pattern characteristics, the preset importance level and the access frequency.

[0018] In one of the embodiments, the preset security policy matching table includes associations between each abnormality level and each preset security policy;

[0019] The step of determining an updated security policy according to the abnormal access result and a preset security policy matching table includes:

[0020] Determine the target abnormality level corresponding to the abnormal access result according to the preset security policy matching table;

[0021] If the target abnormality level is the first abnormality level, determining that the updated security policy is to record the abnormal access result and increase the monitoring frequency of the access address information corresponding to the abnormal access result;

[0022] If the target abnormality level is the second abnormality level, determining that the updated security policy is to limit the access rights of the access address information to a preset area in the ultra-high voltage power transmission inspection network, and performing abnormality detection on the preset area;

[0023] If the target abnormality level is the third abnormality level, it is determined that the updated security policy is to prohibit the access address information from accessing the ultra-high voltage power transmission inspection network, and perform abnormality detection on the ultra-high voltage power transmission inspection network.

[0024] In one of the embodiments, the abnormal access result includes an abnormal network traffic pattern and attack pattern characteristics and access frequency corresponding to the network attack characteristics, and a preset importance level corresponding to the accessed resource in the ultra-high voltage power transmission inspection network;

[0025] The determining, according to the preset security policy matching table, a target abnormality level corresponding to the abnormal access result includes:

[0026] If the access frequency is greater than the first access frequency threshold and less than the second access frequency threshold, or the preset importance level is the first importance level, or the similarity between the attack pattern feature and the historical attack pattern feature is greater than the preset similarity threshold and less than the first similarity threshold, then the target abnormality level is determined to be the first abnormality level;

[0027] If the access frequency is greater than or equal to the second access frequency threshold and less than the third access frequency threshold, or the preset importance level is the second importance level, or the similarity between the attack pattern feature and the historical attack pattern feature is greater than or equal to the first similarity threshold and less than the second similarity threshold, then the target abnormality level is determined to be the second abnormality level;

[0028] If the access frequency is greater than or equal to the third access frequency threshold, or the preset importance level is the third importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the second similarity threshold, then the target abnormality level is determined to be the third abnormality level.

[0029] In one embodiment, the step of obtaining the access data to be processed collected in real time by the data collection device for the ultra-high voltage power transmission inspection network includes:

[0030] Obtaining network traffic data, system logs, device status information, connection requests and data packet information collected in real time by the data acquisition device for the ultra-high voltage power transmission inspection network as original access data;

[0031] The original access data is cleaned to obtain access data to be processed.

[0032] In a second aspect, the present application provides an ultra-high voltage transmission inspection network security adaptive optimization device, the device comprising:

[0033] An acquisition module is used to acquire access data to be processed that is collected in real time by a data acquisition device for an ultra-high voltage transmission inspection network;

[0034] A detection module, used to input the access data to be processed into a trained data analysis model, and the data analysis model outputs a network security analysis result corresponding to the access data to be processed according to a preset anomaly detection algorithm and a preset pattern matching algorithm; the network security analysis result includes an identification result of an abnormal network traffic pattern and an identification result of a network attack feature;

[0035] A determination module, configured to determine the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result;

[0036] The optimization module is used to determine the updated security policy according to the abnormal access result and the preset security policy matching table, and update the updated security policy to the ultra-high voltage power transmission inspection network.

[0037] In a third aspect, the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0038] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0039] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the steps of the above method when executed by a processor.

[0040] The above-mentioned ultra-high voltage transmission inspection network security adaptive optimization method, device, computer equipment, computer-readable storage medium and computer program product, through the data analysis model based on the preset anomaly detection algorithm and the preset pattern matching algorithm, perform anomaly analysis on the access data to be processed for the ultra-high voltage transmission inspection network, output the analysis results containing abnormal network traffic patterns and network attack characteristics, determine the abnormal access results based on the preset anomaly identification rules, abnormal network traffic patterns and network attack characteristics in the preset security policy library, determine the updated security policy according to the abnormal access results and the preset security policy matching table, and update the updated security policy to the ultra-high voltage transmission inspection network. Compared with the traditional offline or batch processing method to analyze the collected data, this scheme uses the access data collected in real time, uses the data analysis model to identify the network traffic pattern and attack characteristics, combines the preset security policy library to determine the abnormal access results, and updates the security policy of the ultra-high voltage transmission inspection network based on the abnormal access results and the preset security policy matching table, thereby improving the optimization efficiency of the ultra-high voltage transmission inspection network. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0042] FIG1 is a schematic diagram of a process flow of a method for adaptively optimizing security of an ultra-high voltage power transmission inspection network in one embodiment;

[0043] FIG2 is a schematic diagram of a process flow of a method for adaptively optimizing ultra-high voltage transmission inspection network security in another embodiment;

[0044] FIG3 is a structural block diagram of a network adaptive optimization device for ultra-high voltage power transmission inspection in one embodiment;

[0045] FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] In one embodiment, as shown in FIG1 , a method for self-adaptive optimization of ultra-high voltage transmission inspection network security is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server, including the following steps S202 to S208. Among them:

[0048] Step S202, obtaining access data to be processed collected in real time by a data collection device for an ultra-high voltage power transmission inspection network.

[0049] Among them, the ultra-high voltage transmission inspection network is the backbone network in the power grid. In order to ensure the safe operation of the power system, it is necessary to ensure the security and stability of the ultra-high voltage transmission inspection network. In the face of evolving network threats, security policies need to be updated regularly to adapt to new security needs. However, existing systems often lack an automated security policy update mechanism, resulting in security policies lagging behind actual threats and being unable to effectively resist new attacks. Ultra-high voltage transmission inspection systems are usually interconnected with multiple other systems, such as monitoring systems and dispatching systems. However, the existing systems do not have strong synergy in network security protection, information sharing is not smooth, and it is difficult to form a joint force to jointly resist network attacks.

[0050] The existing ultra-high voltage transmission inspection system has defects in network security protection, such as delayed data processing, limited analysis capabilities, delayed policy updates, and insufficient coordination between systems. These problems seriously restrict the inspection system's ability to detect and effectively respond to network security threats in real time, and they urgently need to be solved through technological innovation and process optimization.

[0051] The server may be a server in an ultra-high voltage power transmission inspection network, and the server may perform adaptive optimization of the ultra-high voltage power transmission inspection network based on real-time collected data. For example, the server may obtain access data to be processed collected in real time by a data acquisition device for the ultra-high voltage power transmission inspection network. The access data may be access data for various areas in the ultra-high voltage power transmission inspection network. The access data to be processed may be obtained by preprocessing and cleaning the original access data by the server.

[0052] In one embodiment, access data to be processed that is collected in real time by a data acquisition device for an ultra-high voltage power transmission inspection network is obtained, including: obtaining network traffic data, system logs, device status information, connection requests, and data packet information collected in real time by the data acquisition device for the ultra-high voltage power transmission inspection network as original access data; and performing data cleaning on the original access data to obtain access data to be processed.

[0053] In this embodiment, the server can obtain the original access data collected by the data acquisition device in real time. There can be multiple types of original access data, and the server can obtain the access data to be processed after preprocessing and data cleaning the multiple types of original access data obtained. For example, the server can obtain the network traffic data, system logs, device status information, connection requests and data packet information collected by the data acquisition device in real time for the ultra-high voltage transmission inspection network as the original access data, and clean the original access data to obtain the access data to be processed.

[0054] Specifically, the data acquisition equipment includes at least various types of sensors, monitoring tools and network probes, among which the data acquisition equipment is deployed at the key nodes of the ultra-high voltage transmission inspection system to ensure the comprehensiveness and accuracy of data acquisition. The server can send the original access data to the data analysis engine based on the quantum encryption communication mechanism, and use the data analysis engine for preprocessing and data cleaning, so that the server can rely on the quantum encryption communication mechanism to provide a high degree of security for the transmission of the original access data, and transmit it safely and accurately to the data analysis engine.

[0055] Among them, in order to collect data more effectively, data acquisition equipment can also include smart meters, environmental monitoring sensors (such as temperature, humidity, wind speed, etc.), power quality monitoring equipment, etc. These devices can not only obtain basic information about system operation, but also monitor surrounding environmental factors, providing a more comprehensive basis for analyzing the operating status of ultra-high voltage transmission lines. In terms of data transmission, in addition to the quantum encryption communication mechanism, multi-path redundant transmission can also be used. That is, data is transmitted through multiple different communication lines at the same time. If one of the lines fails, the data can be transmitted normally through other lines, thereby further improving the reliability of data transmission. Data acquisition equipment deployed at key nodes can use self-powered technology, such as using electromagnetic induction or solar energy to obtain energy, so as to reduce dependence on external power supply and improve the stability and continuous working ability of the equipment. When the data acquisition equipment collects abnormal data, it can automatically trigger the early warning mechanism and send alarm information to relevant personnel in time, so as to take countermeasures quickly and reduce potential risks and losses. In addition, in order to ensure the normal operation of data acquisition equipment and the accuracy of data, a regular equipment calibration and maintenance mechanism should be established to detect, calibrate and repair the equipment to ensure its long-term stable operation and data quality.

[0056] Among them, sensor data is used to monitor the status and environmental conditions of power equipment, network traffic data is used to analyze communication conditions and possible attacks, system logs record system operating status and events, and device status information identifies device health, connection requests, and data packet content. Network traffic data is collected in real time through network probes and is used to analyze network communication patterns and detect abnormal traffic. System logs record system operating status, events, and anomalies for troubleshooting and system optimization. Device status information includes the health status and operating parameters of power equipment to help predict equipment maintenance needs. Connection requests and data packet content are captured by network probes and used to analyze communication patterns and data transmission.

[0057] The server can use quantum encryption technology to ensure the security and confidentiality of data transmission. Quantum encryption uses the characteristics of quantum mechanics to achieve highly secure data communication, which can effectively prevent eavesdropping and data tampering. In specific implementation, the data is encrypted at the acquisition device and transmitted to the data analysis engine through the quantum encryption channel. The integrity and security of the data must be guaranteed at each stage of data transmission to ensure that the data is not accessed or modified by unauthorized persons.

[0058] Among them, the ultra-high voltage transmission inspection system is a system designed to monitor and manage ultra-high voltage power transmission lines. Ultra-high voltage transmission lines usually refer to power transmission lines with voltage levels of 800 kV and above, which are used for long-distance, large-capacity power transmission. These systems are designed to ensure the safe operation of transmission lines, improve the reliability of the power grid, and promptly detect and handle possible problems or potential faults in the lines.

[0059] The server can preprocess and clean the original access data. The server can obtain the original access data from the data receiving interface through the data analysis engine and perform preprocessing and data cleaning. Among them, for data fields containing missing values, the server selects an appropriate processing method based on the characteristics of the data and business needs. Specifically, if there are few missing values ​​and the data is random, the server can delete the records containing missing values. If there are many missing values ​​or there is a certain pattern in the data, the server uses the mean, median or mode to fill. For time series data, the server can use linear interpolation or spline interpolation to estimate missing values. Based on specific fields or field combinations, the server identifies and deletes duplicate data records to ensure the uniqueness of the data.

[0060] The server can also use statistical methods, such as the 3σ principle (data outside the mean plus or minus 3 times the standard deviation is considered an outlier) or the box plot method to detect outliers. Outliers that are obviously wrong are deleted directly. For data that may be true but deviate from the norm, the server marks or processes it separately. Standardize or normalize data of different dimensions, such as mapping data to the [0, 1] interval or making it conform to the standard normal distribution. Methods such as minimum-maximum scaling and Z-score standardization can be used. Data in different formats, such as date, time, and numerical values, are uniformly converted into a format that is convenient for subsequent analysis.

[0061] The server can also extract, select, and construct meaningful features for access data. For example, for time series data, it calculates statistical features such as moving averages and variances. If there are first data from multiple sources, the server merges them according to the primary key or associated fields of the data to form a complete data set. After processing the original access data through the above steps, the cleaned and preprocessed access data to be processed is obtained, providing a more accurate, reliable, and effective data foundation for subsequent data analysis and decision-making.

[0062] Step S204, input the access data to be processed into the trained data analysis model, and the data analysis model outputs the network security analysis results corresponding to the access data to be processed according to the preset anomaly detection algorithm and the preset pattern matching algorithm; the network security analysis results include the recognition results of abnormal network traffic patterns and the recognition results of network attack characteristics.

[0063] The server may pre-train the data analysis model to be trained to obtain a trained data analysis model. For example, the server may use the access data sample and the corresponding network security analysis result sample to iteratively train the data analysis model to be trained, and then obtain the trained data analysis model when the preset training end condition is met. The preset training end condition may be that within the preset training times, the similarity between the network security analysis prediction result output by the above data analysis model and the corresponding network security analysis result sample is greater than or equal to the preset similarity threshold, or the training times reach the preset training times.

[0064] Thus, the server can use the trained data analysis model to perform network security analysis on the access data. The data analysis model can be a neural network model, and the data analysis model can include multiple neural network algorithms, such as a preset anomaly detection algorithm and a preset pattern matching algorithm. The server can input the above-mentioned access data to be processed into the trained data analysis model, and the data analysis model can perform network security analysis on the access data to be processed according to the preset anomaly detection algorithm and the preset pattern matching algorithm, and then determine the recognition result of the abnormal network pattern and the recognition result of the network attack feature corresponding to the access data to be processed, so that the server can output the network security analysis result corresponding to the access data to be processed based on the recognition result of the abnormal traffic pattern and the recognition result of the network attack feature.

[0065] Specifically, the server can use the data analysis model to identify the access data to be processed through an anomaly detection algorithm to obtain the identification result of the abnormal network traffic pattern. The server can also use the data analysis model to identify the access data to be processed through a pattern matching algorithm to obtain the identification result of the network attack characteristics. Among them, when the server is identifying abnormal network traffic patterns, it can first select an anomaly detection algorithm. Optionally, the server can use a statistical-based algorithm, such as the 3σ rule, that is, data points exceeding the mean plus or minus three times the standard deviation are considered abnormal; or use a clustering-based algorithm, such as K-Means clustering, to cluster the traffic data, and data points far away from the cluster center are considered abnormal; machine learning-based algorithms, such as the isolation forest algorithm, can also be used.

[0066] Among them, the server can also standardize or normalize the network traffic data in the access data to be processed so that it has a unified dimension and numerical range. The server can thus extract key features, such as traffic size, number of data packets, protocol type, etc. If the server selects a supervised or semi-supervised anomaly detection algorithm, it needs to be trained using known normal and abnormal traffic data samples. The preprocessed traffic data is input into the trained data analysis model. The data analysis model determines which traffic data belongs to the abnormal mode according to the set rules or learned patterns, and outputs the recognition result, that is, the above-mentioned network security analysis result.

[0067] Among them, for network attack feature recognition, the server can first build an attack feature library and collect various known network attack features, including attack packet patterns, specific protocol field values, abnormal port usage, etc. When the server selects a pattern matching algorithm, it can use a string matching algorithm, such as the KMP (Knuth-Morris-Pratt, string search) algorithm, or a more complex pattern matching algorithm, such as the AC automaton (Aho-Corasick automaton) algorithm, to parse the access data to be processed and extract fields and data segments related to network attack features. The server uses a data analysis model to pattern match the pre-processed data with the features in the attack feature library. If a matching feature is found, the server considers that the corresponding network attack feature is detected and outputs the recognition result.

[0068] For example, for the identification of abnormal network traffic patterns, take the isolation forest algorithm in the data analysis model as an example. The server normalizes the above network traffic data through the data analysis model, extracts features such as traffic size and connection duration, and then uses known normal traffic data to train the isolation forest model. When new traffic data arrives, the model calculates the anomaly score of each data point, and data points with high scores are considered to be abnormal network traffic patterns.

[0069] For network attack feature identification, the server can build a feature library containing common DDoS attack features. The data analysis model uses the AC automaton algorithm to match the packet protocol field values ​​extracted from the access data to be processed. If the server finds a field value that is consistent with the DDoS attack feature in the feature library, it determines that the corresponding network attack feature has been detected, and the data analysis model outputs the network security analysis results based on the abnormal network traffic pattern and network attack features.

[0070] Step S206, determining the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result.

[0071] Among them, the server can pre-build a preset security policy library, which includes multiple preset abnormal identification rules, and each preset abnormal identification rule can include multiple types of judgment rules for whether the access data is abnormal. Therefore, the server can detect and judge the abnormal network traffic pattern and network attack characteristics in the network security analysis results according to the preset abnormal identification rules in the preset security policy library, and determine the abnormal access results corresponding to the ultra-high voltage transmission inspection network. Among them, the abnormal access results include whether there is a real network attack on the access data to be processed, as well as information such as the target and nature of the network attack.

[0072] Step S208, determining an updated security policy according to the abnormal access result and a preset security policy matching table, and updating the updated security policy to the ultra-high voltage power transmission inspection network.

[0073] Among them, after the server obtains the abnormal access result, it can determine whether there is a network attack on the access data to be processed, as well as the target and nature of the network attack, so that the server can update the security policy of the ultra-high voltage power transmission inspection network according to the abnormal access result and the preset security policy matching table, and then obtain the updated security policy. The server can update the updated security policy to the ultra-high voltage power transmission inspection network, so that the ultra-high voltage power transmission inspection network can perform security detection of network traffic data according to the updated security policy, thereby improving the security of the ultra-high voltage power transmission inspection network.

[0074] The preset security policy matching table includes the association between each abnormal level and each preset security policy. The abnormal level indicates the abnormal level of the abnormal access result. The higher the abnormal level, the lower the security of the ultra-high voltage power transmission inspection network. The server can pre-construct the association between each abnormal level and each preset security policy, and construct a preset security policy matching table. The higher the abnormal level, the higher the security of the corresponding preset security policy, so as to ensure the security of the ultra-high voltage power transmission inspection network.

[0075] In the above-mentioned adaptive optimization method for ultra-high voltage transmission inspection network security, an abnormal analysis is performed on the access data to be processed for the ultra-high voltage transmission inspection network based on the preset abnormal detection algorithm and the preset pattern matching algorithm through the data analysis model, and the analysis results containing abnormal network traffic patterns and network attack characteristics are output, and the abnormal access results are determined based on the preset abnormal identification rules, abnormal network traffic patterns and network attack characteristics in the preset security policy library, and the updated security policy is determined according to the abnormal access results and the preset security policy matching table, and the updated security policy is updated to the ultra-high voltage transmission inspection network. Compared with the traditional offline or batch processing method to analyze the collected data, this scheme uses the access data collected in real time, uses the data analysis model to identify the network traffic pattern and attack characteristics, combines the preset security policy library to determine the abnormal access results, and updates the security policy of the ultra-high voltage transmission inspection network based on the abnormal access results and the preset security policy matching table, thereby improving the optimization efficiency of the ultra-high voltage transmission inspection network.

[0076] In one embodiment, based on preset anomaly identification rules in a preset security policy library, and abnormal network traffic patterns and network attack characteristics in network security analysis results, abnormal access results corresponding to the ultra-high voltage power transmission inspection system are determined, including: determining attack pattern characteristics, access address information and access frequency based on abnormal network traffic patterns and network attack characteristics; determining abnormal access results corresponding to the ultra-high voltage power transmission inspection network based on preset anomaly identification rules, and attack pattern characteristics, access address information and access frequency.

[0077] In this embodiment, the above-mentioned abnormal access results include multiple types of abnormal access information. For example, the server can determine the attack pattern characteristics, access address information and access frequency corresponding to the access data to be processed based on the abnormal network traffic pattern and network attack characteristics in the network security analysis results. Among them, the access address information represents the source address corresponding to the access data to be processed. The server can determine the abnormal access results corresponding to the ultra-high voltage transmission inspection network based on the preset abnormal identification rules, as well as the attack pattern characteristics, access address information and access frequency.

[0078] Specifically, the server can match the network security analysis results with the rules in the preset security policy library. The rules in the preset security policy library include attack pattern characteristics, the range of access address information allowed to be accessed, and the normal access frequency threshold. If the server detects that the matching result meets the first condition, the server can perform a threat assessment based on the risk assessment algorithm to obtain an assessment result, that is, the above-mentioned abnormal access result. The first condition includes detection of attack pattern characteristics and access address information.

[0079] Through this embodiment, the server can pre-build a preset security policy library, use the preset security policy library to analyze the abnormal characteristics of the network security analysis results, and then optimize and update the security policy of the ultra-high voltage power transmission inspection network based on the abnormal access results obtained by the analysis, thereby improving the security policy update efficiency of the ultra-high voltage power transmission inspection network.

[0080] In one embodiment, according to preset abnormality identification rules, as well as attack pattern characteristics, access address information and access frequency, abnormal access results corresponding to the ultra-high voltage power transmission inspection network are determined, including: according to the preset abnormality identification rules, historical attack pattern characteristics and a preset access address information set are determined; if the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than a preset similarity threshold or the access address information is not in the preset access address information set, then according to the preset abnormality identification rules, the preset importance level corresponding to the accessed resource in the ultra-high voltage power transmission inspection network is determined; according to the attack pattern characteristics, the preset importance level and the access frequency, the abnormal access results are determined.

[0081] In this embodiment, the server can determine the abnormal access result according to the above-mentioned preset abnormal identification rules, as well as the attack mode characteristics, access address information and access frequency determined based on the network security analysis results. Among them, the server can determine that there is abnormal access after detecting that the first condition is met, and perform further detection. For example, the server can determine the historical attack mode characteristics and the preset access address information set according to the preset abnormal identification rules. Among them, the historical attack mode characteristics represent the network attack characteristics corresponding to the network attack at the historical time point, and the preset access address information set represents the set of addresses that allow access to the ultra-high voltage transmission inspection network. If the server detects that the similarity between the attack mode characteristics and the historical attack mode characteristics is greater than the preset similarity threshold, or the access address information is not in the preset access address information set, the server can determine the preset importance level corresponding to the resource accessed in the ultra-high voltage transmission inspection network according to the preset abnormal identification rules. Among them, the ultra-high voltage transmission inspection network includes multiple resources, and the preset importance level of each resource represents the importance of the resource, and the preset importance level of each resource is different. Thus, the server can determine the abnormal access result according to the attack mode characteristics, the preset importance level and the access frequency.

[0082] Specifically, the server can determine the source region and network type of the unknown IP (Internet Protocol) address, and determine the similarity between the abnormal access request and the historical attack pattern to obtain a first result, so that the server can determine the importance level and sensitivity level corresponding to the accessed resource, and then determine the evaluation result based on the first result, the importance level and the sensitivity level.

[0083] Among them, the server can first organize and prepare the network security analysis results, and convert them into a format that can be compared with the security policy library rules. The server loads the preset security policy library to ensure the integrity and accuracy of the rules, and compares each data in the network security analysis results with the preset anomaly identification rules in the security policy library one by one. For example, the server checks whether the network traffic pattern is consistent with the known attack pattern characteristics, whether the accessed IP address is within the legal range, whether the access frequency exceeds the preset frequency threshold of normal access, etc. The server can define a first condition, such as when it is found that the similarity between the network traffic pattern and a specific attack pattern exceeds a certain threshold, or the accessed IP address is not within the legal range, etc., the server determines that the matching result meets the first condition. If the first condition is met, the server further obtains relevant information about the unknown IP address, and determines its source area and network type through the IP database or network service.

[0084] The server can use pattern matching and data analysis algorithms to determine the similarity between abnormal access requests and historical attack patterns. Evaluate the importance and sensitivity levels of the resources accessed in the ultra-high voltage transmission inspection network, for example, divide the levels according to factors such as the business criticality and data confidentiality of the resources. Therefore, the server can generate an evaluation result, i.e., an abnormal access result, based on the risk assessment algorithm, by comprehensively considering the above first result (the comparison result of the attack pattern characteristics and the historical attack pattern characteristics), the importance level and sensitivity level, and the access frequency. Among them, the server can assign different weights to each factor and obtain the total threat assessment score or level through weighted calculation. Afterwards, based on the evaluation results, a new network security analysis result can be output to clarify whether there is a potential network attack or vulnerability, and its threat level, i.e., the abnormal level.

[0085] Through this embodiment, the server can determine the abnormal access results of access data based on the attack pattern characteristics, the preset importance level of the resource and the access frequency, so that the server can update the security policy of the ultra-high voltage transmission inspection network based on the abnormal access results, thereby improving the efficiency of security policy updates.

[0086] In one embodiment, an updated security policy is determined based on abnormal access results and a preset security policy matching table, including: determining a target abnormality level corresponding to the abnormal access result based on the preset security policy matching table; if the target abnormality level is a first abnormality level, determining that the updated security policy is to record the abnormal access result and increase the monitoring frequency of the access address information corresponding to the abnormal access result; if the target abnormality level is a second abnormality level, determining that the updated security policy is to limit the access address information's access rights to a preset area in an ultra-high voltage power transmission inspection network, and performing abnormality detection on the preset area; if the target abnormality level is a third abnormality level, determining that the updated security policy is to prohibit the access address information from accessing the ultra-high voltage power transmission inspection network, and performing abnormality detection on the ultra-high voltage power transmission inspection network.

[0087] In this embodiment, the preset security policy matching table includes the association between each abnormal level and each preset security policy. Therefore, the server can determine the target abnormal level corresponding to the abnormal access result according to the preset security policy matching table. The target abnormal level can correspond to different abnormal levels based on the different abnormal degrees corresponding to the abnormal access result, and for different abnormal levels, the server can determine different preset security policies based on the preset security policy matching table.

[0088] For example, if the target abnormality level is the first abnormality level, the server can determine that the updated security policy is to record abnormal access results and increase the monitoring frequency of the access address information corresponding to the abnormal access results, wherein the increased monitoring frequency can be set according to the actual situation and is not limited here. If the target abnormality level is the second abnormality level, the server can determine that the updated security policy is to limit the access address information to the access rights of the preset area in the ultra-high voltage power transmission inspection network, and perform abnormality detection on the preset area. Among them, the ultra-high voltage power transmission inspection network includes multiple areas, and the above-mentioned preset area can be at least one area, for example, it can be the area accessed by the accessed data this time, and the preset area with restricted access cannot be accessed by the access address information corresponding to the above-mentioned access data.

[0089] If the target abnormality level is the third abnormality level, the server determines that the updated security policy is to prohibit the access address information from accessing the ultra-high voltage transmission inspection network, and perform abnormality detection on the ultra-high voltage transmission inspection network. That is, when the target abnormality level is the third abnormality level, it means that the severity of the abnormality is high. At this time, the server can prohibit the access address information corresponding to the above access data from accessing the entire ultra-high voltage transmission inspection network, and perform a comprehensive inspection of the ultra-high voltage transmission inspection network. Therefore, the server can update the corresponding updated security policy to the ultra-high voltage transmission inspection network according to the different target abnormality levels.

[0090] Specifically, the first abnormality level above indicates a low threat level, the second abnormality level indicates a medium threat level, and the third abnormality level indicates a high threat level. The security strategy corresponding to the low threat level is to record relevant access information, increase the monitoring frequency of the source, and notify relevant personnel to pay attention. The security strategy corresponding to the medium threat level is to temporarily restrict some access rights of the source, conduct a deep scan of the relevant area, and initiate some measures of the emergency plan. The security strategy corresponding to the high threat level is to immediately block all access to the source, conduct a comprehensive security check of the entire system, initiate a complete emergency plan, notify all relevant personnel, and report to the superior department.

[0091] Among them, the server can match the threat level standards defined in the above preset security policy matching table according to the number of abnormal accesses, the type of resources accessed, the similarity with historical attack patterns, etc. Once the threat level is determined, the corresponding security policy is immediately adopted. For example, if the server detects that access requests from an unknown IP appear frequently in a short period of time, access the core database, and the similarity with a known serious attack pattern reaches 80%, the server will determine it as a high threat level and immediately execute the high threat level security policy, such as blocking access, comprehensive inspection, etc.

[0092] Among them, when the server generates an updated security policy, it can first determine the threat level corresponding to the abnormal level, and the server evaluates the specific impact of the threat level on system security, including potential data leakage risks, service interruption risks, and possible economic losses. Therefore, the server can select the corresponding template from the preset security policy template library according to the threat level. Among them, these templates should cover the basic measures and optional measures to be taken under different threat levels. Low threat level templates may include enhanced monitoring, logging, and simple notifications; medium threat level templates may include access restrictions, deep scanning, and partial activation of emergency plans; high threat level templates may include comprehensive blocking, system inspection, and complete emergency plan execution. The server customizes the selected template according to the actual situation. This may include adjusting the monitoring frequency, specifying the specific access restriction range, determining the specific area of ​​deep scanning, and clarifying the specific execution steps of the emergency plan.

[0093] The server updates the updated security policy to the UHV power transmission inspection network. For example, the server can push the updated security policy to the relevant nodes and devices of the UHV power transmission inspection system through a secure and reliable network connection. On each node and device, install and enable the new security policy according to the predetermined process and authority. Manual confirmation and operation are required for key equipment and systems. After the deployment is completed, the server continuously monitors the operating status and network security of the system and collects data on the execution effect of the new policy. The server can also establish a feedback mechanism so that system administrators and relevant personnel can promptly report problems or anomalies that may be caused by the new policy. Furthermore, the server can make necessary adjustments and optimizations to the new policy based on the monitoring and feedback information to ensure that it minimizes interference with the normal operation of the UHV power transmission inspection system while ensuring network security.

[0094] Through this embodiment, the server can determine security policies of different degrees of strictness based on different abnormality levels as updated security policies, and use the updated security policies to update the ultra-high voltage power transmission inspection network, thereby improving the update efficiency of the ultra-high voltage power transmission inspection network.

[0095] In one embodiment, according to a preset security policy matching table, a target abnormality level corresponding to the abnormal access result is determined, including: if the access frequency is greater than a first access frequency threshold and less than a second access frequency threshold, or the preset importance level is the first importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than the preset similarity threshold and less than the first similarity threshold, then the target abnormality level is determined to be the first abnormality level; if the access frequency is greater than or equal to the second access frequency threshold and less than a third access frequency threshold, or the preset importance level is the second importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the first similarity threshold and less than the second similarity threshold, then the target abnormality level is determined to be the second abnormality level; if the access frequency is greater than or equal to the third access frequency threshold, or the preset importance level is the third importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the second similarity threshold, then the target abnormality level is determined to be the third abnormality level.

[0096] In this embodiment, the above-mentioned abnormal access results include the attack pattern characteristics and access frequency corresponding to the abnormal network traffic pattern and network attack characteristics, as well as the preset importance level corresponding to the resources accessed in the ultra-high voltage transmission inspection network. The server can determine the abnormal level corresponding to the abnormal access result according to the difference in the abnormal access results. For example, if the server detects that the access frequency is greater than the first access frequency threshold and less than the second access frequency threshold, or the preset importance level is the first importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than the preset similarity threshold and less than the first similarity threshold, the server can determine that the target abnormal level is the first abnormal level, that is, a low threat level.

[0097] If the server detects that the access frequency is greater than or equal to the second access frequency threshold and less than the third access frequency threshold, or the preset importance level is the second importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the first similarity threshold and less than the second similarity threshold, then the server can determine that the target anomaly level is the second anomaly level, that is, the medium threat level.

[0098] If the server detects that the access frequency is greater than or equal to the third access frequency threshold, or the preset importance level is the third importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the second similarity threshold, then the server can determine that the target abnormality level is the third abnormality level, that is, a high threat level.

[0099] Specifically, based on the above abnormal access results and preset abnormal identification rules, the server can determine the abnormal level corresponding to the abnormal access results. Among them, the first abnormal level corresponds to a low threat level, the second abnormal level corresponds to a medium threat level, and the third abnormal level corresponds to a high threat level. For a small number of abnormal access requests, and the resources accessed are not very important, and the similarity with known attack patterns is low, the server can determine it as a low threat level. For a certain number of abnormal accesses, more important resources are accessed, and there is a certain similarity with certain common attack patterns, the server can determine it as a medium threat level. For a large number of frequent abnormal accesses, targeting key resources, and highly similar to serious attack patterns, the server can determine it as a high threat level.

[0100] Through this embodiment, the server can determine the corresponding abnormal level based on the different abnormal access results, and then the server can determine the corresponding security policy based on the abnormal level, thereby improving the efficiency of updating the security policy of the ultra-high voltage transmission inspection network.

[0101] In an exemplary embodiment, as shown in FIG2 , FIG2 is a flow chart of an ultra-high voltage transmission inspection network security adaptive optimization method in another embodiment. In this embodiment, the server first collects the original access data in the ultra-high voltage transmission inspection system in real time based on the data acquisition device, and transmits the original access data to the data analysis engine, and performs data cleaning and preprocessing on the original access data based on the data analysis engine to obtain the access data to be processed, and processes the access data to be processed to obtain the network security analysis results. Among them, the network security analysis results include the recognition results of abnormal network traffic patterns and the recognition results of network attack characteristics.

[0102] The server can determine whether there are potential network attacks or vulnerabilities in the ultra-high voltage power transmission inspection network based on the network security analysis results and the rules in the preset security policy library, so that the server can determine the abnormal access results based on the identification results and the preset abnormal identification rules, and generate an updated security policy based on the abnormal access results. The server can apply the security policy to the ultra-high voltage power transmission inspection system for adjustment and optimization.

[0103] As a result, the server can instantly obtain first-hand data of the ultra-high voltage transmission inspection system through real-time data acquisition of data acquisition equipment, ensuring the timeliness and accuracy of the data. This provides a solid foundation for subsequent network security analysis and helps to timely discover potential security threats. The data analysis engine cleans and preprocesses the raw data, removes noise and redundant information, and improves data quality. At the same time, the preprocessing process may also include data format unification, missing value processing, etc., which reduces obstacles for subsequent analysis and improves processing efficiency. By performing network security analysis on the processed data, abnormal network traffic patterns and network attack characteristics can be identified. This helps to discover potential network attacks or vulnerabilities in advance, thereby enhancing the network security defense capabilities of the system. Based on the network security analysis results and the rules in the preset security policy library, the system can automatically judge and determine whether there are potential network attacks or vulnerabilities. This process realizes the intelligence of decision-making, reduces the subjectivity and uncertainty of human judgment, and improves the accuracy and efficiency of decision-making. According to the network security analysis results and the preset abnormal identification rules, the abnormal access results are determined, and the updated security policy is generated accordingly. This dynamic adjustment and optimization mechanism can ensure that the security policy always matches the security status of the system, improving the security and stability of the system. Applying the updated security strategy to the UHV power transmission inspection system not only enhances the system's network security defense capabilities, but also improves the overall system performance by optimizing system configuration and reducing the impact of security incidents on the system. This is of great significance for ensuring the stable operation of the UHV power transmission inspection system and the reliability of power supply.

[0104] Through the above embodiments, the server uses the access data collected in real time, uses the data analysis model to identify the network traffic pattern and attack characteristics, combines the preset security policy library to determine the abnormal access results, and updates the security policy of the ultra-high voltage power transmission inspection network based on the abnormal access results and the preset security policy matching table, thereby improving the optimization efficiency of the ultra-high voltage power transmission inspection network. In addition, the server significantly improves the network security defense capability and overall efficiency of the ultra-high voltage power transmission inspection system through real-time data collection, intelligent processing, network security analysis and dynamic security policy adjustment, providing a strong guarantee for the safe and stable operation of the power system.

[0105] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0106] Based on the same inventive concept, the embodiment of the present application also provides an ultra-high voltage transmission inspection network security adaptive optimization device for implementing the ultra-high voltage transmission inspection network security adaptive optimization method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more ultra-high voltage transmission inspection network security adaptive optimization device embodiments provided below can refer to the limitations of the ultra-high voltage transmission inspection network security adaptive optimization method above, and will not be repeated here.

[0107] In an exemplary embodiment, as shown in FIG3 , a device for adaptively optimizing the security of an ultra-high voltage transmission inspection network is provided, comprising: an acquisition module 500, a detection module 502, a determination module 504 and an optimization module 506, wherein:

[0108] The acquisition module 500 is used to acquire the to-be-processed access data collected in real time by the data acquisition device for the ultra-high voltage power transmission inspection network.

[0109] The detection module 502 is used to input the access data to be processed into the trained data analysis model, and the data analysis model outputs the network security analysis results corresponding to the access data to be processed according to the preset anomaly detection algorithm and the preset pattern matching algorithm; the network security analysis results include the recognition results of abnormal network traffic patterns and the recognition results of network attack characteristics.

[0110] The determination module 504 is used to determine the abnormal access results corresponding to the ultra-high voltage transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic patterns and network attack characteristics in the network security analysis results.

[0111] The optimization module 506 is used to determine an updated security policy according to the abnormal access result and a preset security policy matching table, and update the updated security policy to the ultra-high voltage power transmission inspection network.

[0112] In one embodiment, the above-mentioned determination module 504 is used to determine the attack pattern characteristics, access address information and access frequency based on the abnormal network traffic pattern and network attack characteristics; and determine the abnormal access results corresponding to the ultra-high voltage transmission inspection network based on preset abnormal identification rules, as well as the attack pattern characteristics, access address information and access frequency.

[0113] In one embodiment, the above-mentioned determination module 504 is used to determine the historical attack pattern characteristics and the preset access address information set according to the preset abnormality identification rules; if the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than the preset similarity threshold or the access address information is not in the preset access address information set, then according to the preset abnormality identification rules, the preset importance level corresponding to the accessed resources in the ultra-high voltage power transmission inspection network is determined; according to the attack pattern characteristics, the preset importance level and the access frequency, the abnormal access result is determined.

[0114] In one embodiment, the above-mentioned optimization module 506 is used to determine the target abnormality level corresponding to the abnormal access result according to the preset security policy matching table; if the target abnormality level is the first abnormality level, the updated security policy is determined to record the abnormal access result and increase the monitoring frequency of the access address information corresponding to the abnormal access result; if the target abnormality level is the second abnormality level, the updated security policy is determined to limit the access address information's access rights to the preset area in the ultra-high voltage power transmission inspection network, and perform abnormality detection on the preset area; if the target abnormality level is the third abnormality level, the updated security policy is determined to prohibit the access address information from accessing the ultra-high voltage power transmission inspection network, and perform abnormality detection on the ultra-high voltage power transmission inspection network.

[0115] In one embodiment, the above-mentioned optimization module 506 is used to determine that the target abnormality level is the first abnormality level if the access frequency is greater than the first access frequency threshold and less than the second access frequency threshold, or the preset importance level is the first importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than the preset similarity threshold and less than the first similarity threshold; if the access frequency is greater than or equal to the second access frequency threshold and less than the third access frequency threshold, or the preset importance level is the second importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the first similarity threshold and less than the second similarity threshold, then the target abnormality level is determined to be the second abnormality level; if the access frequency is greater than or equal to the third access frequency threshold, or the preset importance level is the third importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the second similarity threshold, then the target abnormality level is determined to be the third abnormality level.

[0116] In one embodiment, the above-mentioned device also includes: a preprocessing module, which is used to obtain network traffic data, system logs, equipment status information, connection requests and data packet information collected in real time by the data acquisition equipment for the ultra-high voltage power transmission inspection network as original access data; and perform data cleaning on the original access data to obtain access data to be processed.

[0117] Each module in the above-mentioned ultra-high voltage transmission inspection network security adaptive optimization device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0118] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG4. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store access data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for adaptive optimization of ultra-high voltage power transmission inspection network security is implemented.

[0119] Those skilled in the art will understand that the structure shown in FIG. 4 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0120] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the above-mentioned ultra-high voltage power transmission inspection network security adaptive optimization method is implemented.

[0121] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned ultra-high voltage power transmission inspection network security adaptive optimization method is implemented.

[0122] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the above-mentioned ultra-high voltage power transmission inspection network security adaptive optimization method.

[0123] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0124] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0125] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0126] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A self-adaptive optimization method for ultra-high voltage transmission inspection network security, characterized in that: The method comprises: Obtain access data to be processed collected in real time by data acquisition equipment for ultra-high voltage transmission inspection network; Inputting the access data to be processed into a trained data analysis model, and the data analysis model outputs a network security analysis result corresponding to the access data to be processed according to a preset anomaly detection algorithm and a preset pattern matching algorithm; the network security analysis result includes an identification result of an abnormal network traffic pattern and an identification result of a network attack feature; Determine the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result; An updated security policy is determined according to the abnormal access result and a preset security policy matching table, and the updated security policy is updated to the ultra-high voltage power transmission inspection network.

2. The method according to claim 1, characterized in that Determining the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result includes: Determine attack pattern characteristics, access address information, and access frequency based on the abnormal network traffic pattern and network attack characteristics; According to the preset abnormality identification rules, as well as the attack mode characteristics, access address information and access frequency, the abnormal access results corresponding to the ultra-high voltage power transmission inspection network are determined.

3. The method according to claim 2, characterized in that The determining, according to the preset abnormality identification rule, the attack mode characteristics, the access address information and the access frequency, the abnormal access result corresponding to the ultra-high voltage power transmission inspection network includes: According to the preset anomaly identification rules, determine the historical attack pattern characteristics and the preset access address information set; If the similarity between the attack pattern feature and the historical attack pattern feature is greater than a preset similarity threshold or the access address information is not in the preset access address information set, then according to the preset abnormality identification rule, determine the preset importance level corresponding to the accessed resource in the ultra-high voltage power transmission inspection network; The abnormal access result is determined according to the attack pattern characteristics, the preset importance level and the access frequency.

4. The method according to claim 1, characterized in that: The preset security policy matching table includes the association relationship between each abnormality level and each preset security policy; The step of determining an updated security policy according to the abnormal access result and a preset security policy matching table includes: Determine the target abnormality level corresponding to the abnormal access result according to the preset security policy matching table; If the target abnormality level is the first abnormality level, determining that the updated security policy is to record the abnormal access result and increase the monitoring frequency of the access address information corresponding to the abnormal access result; If the target abnormality level is the second abnormality level, determining that the updated security policy is to limit the access rights of the access address information to a preset area in the ultra-high voltage power transmission inspection network, and performing abnormality detection on the preset area; If the target abnormality level is the third abnormality level, it is determined that the updated security policy is to prohibit the access address information from accessing the ultra-high voltage power transmission inspection network, and perform abnormality detection on the ultra-high voltage power transmission inspection network.

5. The method according to claim 4, characterized in that The abnormal access result includes the abnormal network traffic pattern and the attack pattern characteristics and access frequency corresponding to the network attack characteristics, and the preset importance level corresponding to the accessed resources in the ultra-high voltage power transmission inspection network; The determining, according to the preset security policy matching table, a target abnormality level corresponding to the abnormal access result includes: If the access frequency is greater than the first access frequency threshold and less than the second access frequency threshold, or the preset importance level is the first importance level, or the similarity between the attack pattern feature and the historical attack pattern feature is greater than the preset similarity threshold and less than the first similarity threshold, then the target abnormality level is determined to be the first abnormality level; If the access frequency is greater than or equal to the second access frequency threshold and less than the third access frequency threshold, or the preset importance level is the second importance level, or the similarity between the attack pattern feature and the historical attack pattern feature is greater than or equal to the first similarity threshold and less than the second similarity threshold, then the target abnormality level is determined to be the second abnormality level; If the access frequency is greater than or equal to the third access frequency threshold, or the preset importance level is the third importance level, or the similarity between the attack pattern characteristics and the historical attack pattern characteristics is greater than or equal to the second similarity threshold, then the target abnormality level is determined to be the third abnormality level.

6. The method according to any one of claims 1 to 5, characterized in that: The acquisition of access data to be processed collected in real time by the data acquisition device for the ultra-high voltage transmission inspection network includes: Obtaining network traffic data, system logs, device status information, connection requests and data packet information collected in real time by the data acquisition device for the ultra-high voltage power transmission inspection network as original access data; The original access data is cleaned to obtain access data to be processed.

7. An ultra-high voltage transmission inspection network security adaptive optimization device, characterized in that: The device comprises: An acquisition module is used to acquire access data to be processed that is collected in real time by a data acquisition device for an ultra-high voltage transmission inspection network; A detection module, used to input the access data to be processed into a trained data analysis model, and the data analysis model outputs a network security analysis result corresponding to the access data to be processed according to a preset anomaly detection algorithm and a preset pattern matching algorithm; the network security analysis result includes an identification result of an abnormal network traffic pattern and an identification result of a network attack feature; A determination module, configured to determine the abnormal access result corresponding to the ultra-high voltage power transmission inspection network according to the preset abnormal identification rules in the preset security policy library and the abnormal network traffic pattern and network attack characteristics in the network security analysis result; The optimization module is used to determine the updated security policy according to the abnormal access result and the preset security policy matching table, and update the updated security policy to the ultra-high voltage power transmission inspection network.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images