Security assessment method and device based on integrated inspection data, computer equipment and readable storage medium

Abstract

The invention relates to a safety assessment method and device based on integrated inspection data, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring real-time monitoring data acquired by an Internet of Things sensor and intelligent inspection equipment deployed in a power grid inspection area; optimizing the real-time monitoring data based on an inspection demand of an inspection task corresponding to the power grid inspection area to obtain optimized real-time monitoring data; acquiring and storing network activity information associated with the power grid system; the network activity information is obtained by monitoring network flow and network activity associated with the power grid system within a preset time; and according to the network activity information and the optimized real-time monitoring data, evaluating the security risk degree of the power grid to determine the inspection security level of the power grid. By adopting the method, the reliability of power grid safety assessment can be improved.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a security assessment method, device, computer equipment, computer-readable storage medium and computer program product based on integrated inspection data. Background Art

[0002] With the rapid development of smart grids, the complexity of power grid systems and the high requirements for safety have become increasingly prominent. Traditional power grid inspection methods rely on regular manual inspections, which is not only time-consuming and labor-intensive, but also limited by personnel's professional knowledge and experience, making it difficult to fully and timely discover potential safety hazards in the power grid.

[0003] Although the existing power grid inspection technology has achieved real-time monitoring of the power grid operation status, it still has deficiencies in data processing and security assessment. Specifically, the existing system often simply collects and stores monitoring data, but it is difficult to quickly and accurately identify key security issues and cannot comprehensively assess the security level of the power grid when facing network threats, making the security assessment of the power grid lack comprehensiveness and accuracy, and it is difficult to respond to complex network security challenges in a timely manner.

[0004] Therefore, there is a problem of poor reliability of power grid security assessment in related technologies. Summary of the invention

[0005] Based on this, it is necessary to provide a security assessment method, device, computer equipment, computer-readable storage medium and computer program product based on integrated inspection data that can improve the reliability of power grid security assessment in response to the above technical problems.

[0006] In a first aspect, the present application provides a safety assessment method based on integrated inspection data, comprising:

[0007] Obtain real-time monitoring data collected by IoT sensors and smart inspection equipment deployed in the power grid inspection area;

[0008] Based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area, the real-time monitoring data is optimized to obtain optimized real-time monitoring data;

[0009] Acquire and store network activity information associated with the power grid system; the network activity information is obtained by monitoring network traffic and network activities associated with the power grid system within a preset time;

[0010] The degree of power grid security risk is evaluated based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection safety level.

[0011] In one embodiment, the step of evaluating the degree of power grid security risk based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection security level includes:

[0012] According to the network activity information, the occurrence frequency of the target event in the power grid system is determined, and whether a data leakage event occurs in the power grid system is determined to obtain a security risk determination result; the target event is an event that triggers a security response mechanism of the power grid system;

[0013] Determine a security level determination strategy for the optimized real-time monitoring data according to the security risk determination result; the security level determination strategy is used to deal with security risks of different levels;

[0014] The power grid inspection safety level is determined based on the safety level determination strategy and the data description information of the optimized real-time monitoring data; the power grid inspection safety level is used to guide the inspection work of the power grid inspection area and the safety management of the power grid system.

[0015] In one embodiment, judging the occurrence frequency of a target event in the power grid system and judging whether a data leakage event occurs in the power grid system according to the network activity information to obtain a security risk judgment result includes:

[0016] Obtaining a business requirement tag corresponding to the power grid system;

[0017] Determining a security policy associated with the business requirement tag;

[0018] An event that will trigger the security response mechanism of the security policy is used as the target event; the target event includes but is not limited to at least one of an unauthorized access attempt event, a malware activity event, and a sensitive file transfer event.

[0019] In one embodiment, judging the occurrence frequency of a target event in the power grid system and judging whether a data leakage event occurs in the power grid system according to the network activity information to obtain a security risk judgment result includes:

[0020] Parsing the network activity information to obtain key information of the network activity information; the key information includes at least one of a key field and a key feature of the network activity information;

[0021] Matching the key information with a predefined target event pattern to determine whether the target event occurs in the power grid system;

[0022] If yes, the target event is counted to obtain the occurrence frequency of the target event.

[0023] In one embodiment, judging the occurrence frequency of a target event in the power grid system and judging whether a data leakage event occurs in the power grid system according to the network activity information to obtain a security risk judgment result includes:

[0024] When the data leakage event does not occur in the power grid system and the occurrence frequency of the target event is less than or equal to a first threshold, determining that the security risk judgment result is a low security risk;

[0025] When the data leakage event occurs in the power grid system and the occurrence frequency of the target event is greater than the first threshold, determining that the security risk judgment result is a high security risk;

[0026] When the data leakage event does not occur in the power grid system and the occurrence frequency of the target event is greater than the first threshold, the security risk judgment result is determined to be a moderate security risk.

[0027] In one embodiment, the obtaining and storing network activity information associated with the power grid system includes:

[0028] Based on at least one of a network traffic monitoring tool, an intrusion detection system and a log management tool, as well as pre-configured monitoring parameters and a monitoring range, the network traffic and network activity associated with the power grid system are monitored within the preset time to obtain the network activity information; the monitoring range includes the traffic and activity of a specified network segment, a specified device or a specified application.

[0029] In a second aspect, the present application also provides a safety assessment device based on integrated inspection data, comprising:

[0030] The monitoring data acquisition module is used to obtain real-time monitoring data collected by IoT sensors and intelligent inspection equipment deployed in the power grid inspection area;

[0031] An optimization module, used to optimize the real-time monitoring data based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area to obtain optimized real-time monitoring data;

[0032] An activity information acquisition module, used to acquire and store network activity information associated with the power grid system; the network activity information is obtained by monitoring the network traffic and network activities associated with the power grid system within a preset time;

[0033] The level determination module is used to evaluate the degree of power grid security risk based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection security level.

[0034] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of the above method are implemented.

[0035] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0036] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the above method are implemented.

[0037] The above-mentioned security assessment method, device, computer equipment, computer-readable storage medium and computer program product based on integrated inspection data obtain real-time monitoring data collected by Internet of Things sensors and intelligent inspection equipment deployed in the power grid inspection area; optimize the real-time monitoring data based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area to obtain optimized real-time monitoring data; obtain network activity information associated with the power grid system and store it; the network activity information is obtained by monitoring the network traffic and network activities associated with the power grid system within a preset time; based on the network activity information and the optimized real-time monitoring data, the degree of power grid security risk is evaluated to determine the power grid inspection safety level.

[0038] In this way, through the combination of IoT sensors and intelligent inspection equipment, real-time monitoring of the inspection area is achieved, which greatly reduces the reliance on manual inspections and improves the efficiency and coverage of inspections. At the same time, based on the inspection requirements of the inspection tasks, the steps of optimizing the real-time monitoring data ensure the accuracy and usefulness of the monitoring data, and provide a reliable basis for subsequent security assessments. Combining real-time monitoring data with network activity information realizes a comprehensive assessment of the security risks of the power grid. This comprehensive assessment method not only considers the operating status of the power grid equipment itself, but also pays attention to the security status of the external network environment, making the assessment results more accurate and comprehensive. Through real-time monitoring and rapid data processing, the present application can timely discover potential safety hazards in the power grid, including equipment failures, network attacks, etc. This helps operation and maintenance personnel to respond quickly, take corresponding measures, avoid the expansion of accidents, and ensure the safe and stable operation of the power grid. The monitoring and storage of network activity information enables the power grid system to better respond to network threats. By analyzing network activity information, potential network attacks can be discovered and prevented in a timely manner, and the network security protection capabilities of the power grid system can be improved. Based on the comprehensive evaluation results of real-time monitoring data and network activity information, operation and maintenance personnel can more scientifically formulate and optimize the operation and maintenance strategies of the power grid. For example, maintenance needs can be predicted based on the operating status of the equipment, and maintenance plans can be arranged in advance; safety protection measures can be adjusted according to the laws of network activities, etc. The comprehensive inspection safety level assessment results provide strong decision-making support for the management. Based on the assessment results, the management can reasonably allocate resources, optimize the grid structure, and improve the overall safety and reliability of the grid. In summary, this technical solution has obvious beneficial effects in improving inspection efficiency, comprehensively assessing grid safety, responding to safety hazards in a timely manner, enhancing network security protection, optimizing operation and maintenance strategies, and improving decision-making support capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A schematic diagram of a flow chart of a safety assessment method based on integrated inspection data in one embodiment;

[0041] Figure 2 A schematic diagram of a flow chart of steps for determining a power grid inspection safety level in one embodiment;

[0042] Figure 3 A schematic diagram of a flow chart of a safety assessment method based on integrated inspection data in another embodiment;

[0043] Figure 4 It is a structural block diagram of a safety assessment device based on integrated inspection data in one embodiment;

[0044] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0046] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0047] In one embodiment, Figure 1 As shown, a security assessment method based on integrated inspection data is provided. This embodiment uses the method applied to a computer device as an example. It can be understood that the computer device can be a terminal, a server, or a system including a terminal and a server. In this embodiment, the method includes the following steps:

[0048] Step S110, obtaining real-time monitoring data collected by IoT sensors and intelligent inspection devices deployed in the power grid inspection area.

[0049] Among them, the real-time monitoring data may include the environmental parameters of the power grid inspection area collected by the Internet of Things sensors and the operating status data of the power grid equipment in the power grid inspection area.

[0050] The real-time monitoring data may also include visible light images and infrared images of power grid equipment within the power grid inspection area collected by the intelligent inspection equipment.

[0051] Specifically, appropriate IoT sensors can be selected according to the characteristics and needs of the power grid inspection area. These sensors can include temperature sensors, humidity sensors, vibration sensors, pressure sensors, gas detection sensors, etc., which are used to monitor various environmental parameters and equipment status in the power grid inspection area.

[0052] Among them, intelligent inspection equipment is configured, such as intelligent inspection robots, drones, and intelligent cameras. These devices should have functions such as autonomous navigation, data collection, and real-time transmission, and can conduct inspections according to preset inspection routes or task instructions. Integrate IoT sensors, intelligent inspection equipment, and central control systems to form a complete intelligent inspection system. Reasonably deploy IoT sensors and intelligent inspection equipment in the power grid inspection area to ensure the comprehensiveness and accuracy of monitoring.

[0053] Among them, IoT sensors collect environmental parameters and equipment status data in the inspection area in real time through built-in sensing elements. These data include temperature, humidity, vibration, pressure, gas concentration, etc., which are the basis for subsequent analysis and evaluation.

[0054] The collected real-time monitoring data is transmitted to the central control system via wired or wireless means. Wireless transmission methods such as Wi-Fi, Bluetooth, LoRa (Long Range Radio), NB-IoT (Narrow Band Internet of Things), etc. are flexible and convenient; wired transmission methods such as Ethernet, optical fiber, etc. are stable and reliable. Through the web page or mobile application to provide a real-time monitoring interface, users can view the various data collected by the sensor, as well as related status information and alarm information in real time. The interface supports a variety of data display methods, such as charts, curves, etc.

[0055] Specifically, various IoT sensors can be deployed on key nodes and grid equipment, such as voltage sensors, current sensors, temperature sensors, humidity sensors, vibration sensors, etc. These sensors can monitor the operating status and environmental parameters of grid equipment in real time. Sensors should have high precision, high reliability and anti-electromagnetic interference capabilities to ensure the accuracy and stability of data.

[0056] For the configuration of intelligent inspection equipment, intelligent inspection robots, drones or intelligent inspection vehicles can be configured. These devices can be equipped with monitoring equipment such as high-definition cameras, infrared thermal imagers, RFID (Radio Frequency Identification) readers, etc., to achieve close inspection and accurate identification of power grid equipment. Intelligent inspection equipment can have functions such as autonomous navigation, automatic obstacle avoidance, and real-time data transmission to improve inspection efficiency and safety.

[0057] Among them, IoT sensors collect the operating status and environmental parameter data of power grid equipment in real time through built-in sensing elements, such as voltage, current, temperature, humidity, etc. During the inspection process, the intelligent inspection equipment uses high-definition cameras to shoot the appearance of the equipment and infrared thermal imagers to detect abnormal temperature of the equipment, and associates these data with the equipment information in the RFID tag. The collected data is transmitted to the central control system or cloud server via wireless methods (such as Wi-Fi, LoRa, NB-IoT, etc.). The security and integrity of the data should be ensured during the transmission process, and encryption technology and verification mechanisms should be used to prevent data leakage and tampering.

[0058] Step S120, based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area, the real-time monitoring data is optimized to obtain optimized real-time monitoring data.

[0059] In some embodiments, real-time monitoring data can be cleaned to remove or correct erroneous, incomplete or inconsistent parts of the data. For missing data, according to the inspection requirements of the inspection task, filling (such as filling with mean, median, mode or specific value), interpolation (such as linear interpolation, polynomial interpolation) or deletion (if the missing data accounts for a small proportion and does not affect the overall analysis) and other methods can be used for processing. Statistical methods (such as Z-score (standard score method), IQR (interquartile range, interquartile range method), etc.) or model-based methods (such as clustering algorithms) are used to detect outliers, and outliers are retained, replaced or deleted according to actual conditions. Check and delete duplicate data records to avoid deviations in subsequent analysis.

[0060] In some embodiments, the original real-time monitoring data can be converted into a form more suitable for analysis, such as standardization, normalization or encoding. The data is scaled to fall into a small specific interval (such as between 0 and 1) to eliminate the influence of different dimensions on the analysis. Common standardization methods include minimum-maximum standardization and Z-score standardization.

[0061] In some embodiments, the real-time monitoring data can also be normalized, aggregated and sampled. The purpose is to aggregate or sample the real-time monitoring data according to the inspection requirements of the inspection task to reduce the amount of data or extract key information. Aggregate the data according to the time window (such as every hour, every day) or spatial area, and calculate statistical indicators such as the average, maximum, and minimum. If the amount of data is large, sampling methods (such as random sampling and stratified sampling) can be used to reduce the amount of data while maintaining the representativeness of the data.

[0062] Specifically, features useful for inspection tasks can be extracted from the original real-time monitoring data, and irrelevant or redundant features can be eliminated. Features such as spectrum features and texture features can be extracted from the original data using signal processing, image processing and other technologies. The importance of features is evaluated by statistical methods (such as chi-square test, correlation coefficient analysis) or machine learning algorithms (such as random forest, gradient boosting tree), and the most useful features for inspection tasks are selected, that is, the features with importance evaluation values ​​greater than the threshold are selected. Ensure that the quality of the pre-processed data meets the inspection requirements of the inspection task, and store the processed real-time monitoring data (i.e., optimized real-time monitoring data) in an appropriate location for subsequent use. Verify the quality of the pre-optimized data through visualization, statistical testing and other methods to ensure that no new errors or deviations are introduced. Store the optimized real-time monitoring data in a database, data warehouse or distributed storage system for subsequent data analysis and inspection task execution. Through the above steps, optimized real-time monitoring data can be obtained, which is more accurate, clear and suitable for subsequent analysis and decision support.

[0063] Step S130, obtaining and storing network activity information associated with the power grid system.

[0064] The network activity information is obtained by monitoring the network traffic and network activities associated with the power grid system within a preset time.

[0065] In some embodiments, based on at least one of a network traffic monitoring tool, an intrusion detection system, and a log management tool, as well as preconfigured monitoring parameters and a monitoring range, network traffic and network activities associated with the power grid system can be monitored within a preset time, network activity information can be obtained, the network activity information can be stored, and performance indicators of the network traffic monitoring tool, the intrusion detection system, and the log management tool can be monitored according to a specified period.

[0066] The monitoring scope includes the traffic and activities of a specified network segment, specified device, or specified application.

[0067] Among them, the network traffic monitoring tool is used to collect IP addresses, port numbers, protocol types, data packet sizes and transmission times.

[0068] Among them, intrusion detection systems are used to monitor network traffic in real time, identify and respond to malicious activities.

[0069] It is understandable that monitoring and storing network activity information within a preset time is an important step in network security monitoring. The following is a detailed and specific implementation method:

[0070] First, you need to determine the specific range of the preset time, such as the past 24 hours, a specific time period within a week, or the time period before and after a specific event. This time range should be determined based on actual monitoring needs and business scenarios. Then, you can choose appropriate network monitoring tools, which may include: Network traffic analysis tools: used to capture network data packets and perform detailed analysis. Intrusion detection system: Able to monitor network traffic in real time, identify and respond to potential malicious activities. Log management tools: used to collect, store and analyze log data from various sources (such as servers, network devices, applications, etc.). Network security information and event management system: Integrate multiple data sources to provide comprehensive security monitoring and response capabilities.

[0071] Furthermore, the parameters of the monitoring tool may be configured according to monitoring requirements, including at least one of the following parameters:

[0072] Monitoring scope: Determine which network segments, devices, or applications’ traffic and activities need to be monitored;

[0073] Filtering rules: Set rules to exclude unnecessary traffic (such as internal communications that are known to be safe) and focus only on traffic that may contain security risks;

[0074] Alarm threshold: Set the conditions that trigger the alarm, such as when a specific type of traffic reaches a certain amount or frequency.

[0075] After that, you can capture network activity information, start the monitoring tool, and start capturing network activity information within a preset time. This information may include at least one of the following:

[0076] Network traffic data: such as IP address, port number, protocol type, packet size, transmission time, etc.;

[0077] Session information: records the establishment, data transmission and termination process of network connections;

[0078] Log data: Detailed log records from network devices, servers, applications, etc.

[0079] Afterwards, the captured network activity information can be stored in a secure and reliable data storage system for subsequent analysis and auditing. The storage method may include at least one of the following storage methods:

[0080] Local storage: Store data on the local hard disk or server where the monitoring tool is located;

[0081] Remote storage: back up data to a remote storage device or cloud storage service to prevent data loss or damage;

[0082] Encrypted storage: Encrypt sensitive data to ensure the security of data during storage.

[0083] Step S140, evaluating the degree of power grid security risk based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection safety level.

[0084] In some embodiments, Figure 2 As shown, step S140 includes the following steps S210 to S230:

[0085] Step S210, judging the occurrence frequency of target events in the power grid system and judging whether a data leakage event occurs in the power grid system according to the network activity information, and obtaining a security risk judgment result.

[0086] The target event is an event that triggers the security response mechanism of the power grid system.

[0087] Step S220: Determine a security level determination strategy for the optimized real-time monitoring data according to the security risk determination result.

[0088] Among them, the security level determination strategy is used to deal with different levels of security risks.

[0089] Step S230, determining the power grid inspection safety level based on the safety level determination strategy and the data description information of the optimized real-time monitoring data.

[0090] Among them, the power grid inspection safety level is used to guide the inspection work in the power grid inspection area and the safety management of the power grid system.

[0091] In some embodiments, target events can be determined based on business requirement tags and preset security policies, and the target events include at least one of unauthorized access attempt events, malware activity events (such as viruses, Trojans, ransomware, etc.), and sensitive file transfer events (such as documents containing personal information or business secrets).

[0092] Specifically, the computer device can obtain the business demand tag corresponding to the power grid system; determine the security policy associated with the business demand tag; and use the event that triggers the security response mechanism of the security policy as the target event.

[0093] In actual applications, for example, business requirement tags include "protecting the security of the power grid control system" and "ensuring user data privacy". These two tags are directly related to the safe operation of the power grid and the protection of user data, and are an important basis for formulating security policies. Based on the above business requirement tags, the following preset security policies are formulated:

[0094] Prevent unauthorized access: Ensure that only authenticated and authorized users can access the grid control system. Any unauthorized access attempt should be considered a potential security threat and trigger an alarm immediately;

[0095] Detect malware activity: deploy antivirus software and intrusion detection systems to monitor network traffic and system behavior in real time to detect and prevent the spread and execution of malware, including but not limited to viruses, Trojans, ransomware, etc.

[0096] Monitor sensitive file transfers: Encrypt and control permissions for files containing sensitive information, and monitor file transfer activities on the network to prevent sensitive files from being illegally obtained or leaked. Sensitive files may include user personal information, power grid design drawings, equipment operating parameters, etc.

[0097] Based on the above business requirement tags and preset security policies, the following target events can be determined:

[0098] Unauthorized access attempt event: Any attempt by an unauthenticated or unauthorized user to access the power grid control system, which may include logging in with an illegal username and password, exploiting vulnerabilities for penetration testing, etc.

[0099] Example: A login request from an unknown IP address uses a non-existent user name to try to log in to the power grid control system.

[0100] Malware activity events: The presence or behavior of malware is detected in the power grid control system or related networks. This may include virus scan results, abnormal system processes, malicious code in network traffic, etc.

[0101] Example: Antivirus software detects a known Trojan virus file on the server of the power grid control system.

[0102] Sensitive file transfer event: Detects that a file containing sensitive information is transferred to an unauthorized address or through an insecure channel.

[0103] Example: A network monitoring system discovers that an employee has emailed an Excel file containing user personal information to an external email address.

[0104] Among them, the target event is the key focus. Once it occurs, it will immediately trigger the corresponding security response mechanism of the security strategy to ensure the safe operation of the power grid and the protection of user data.

[0105] In some embodiments, the frequency of occurrence of target events in the power grid system is determined based on network activity information, and whether a data leakage incident occurs in the power grid system is determined to obtain a security risk judgment result, including: parsing the network activity information to obtain key information of the network activity information; the key information includes at least one of the key fields and key features of the network activity information; matching the key information with a predefined target event pattern to determine whether the target event occurs in the power grid system; if so, counting the target events to obtain the frequency of occurrence of the target event.

[0106] Furthermore, key information of network activity information can also be matched with predefined sensitive data patterns to determine whether a data leakage event occurs in the power grid system, wherein a data leakage event includes at least one of the following events: sending sensitive data to an unauthorized address; transmitting sensitive data through an unsecure channel or storing sensitive data in an unsecure location.

[0107] In this way, the security risk judgment result can be determined based on the frequency of occurrence of the target event and whether a data leakage incident occurs.

[0108] It should be noted that network activity information can be parsed in real time or periodically to extract key fields and key features as key information, such as source IP, destination IP, port number, transmission data content, etc., and the key information obtained after parsing is matched with predefined target event patterns. These patterns can be based on regular expressions, behavioral pattern libraries, or machine learning models to identify potential security threats. The identified target events are counted to determine the frequency of occurrence of these target events.

[0109] Among them, frequency calculation can be performed based on time windows (such as hourly, daily) to track trends and changes.

[0110] Similarly, the key information obtained after parsing is matched with predefined sensitive data patterns to detect whether there is a data leakage incident. Sensitive data patterns may include specific file types, keywords, data formats, or encryption tags.

[0111] In this way, the security risk judgment result can be determined according to the following logic based on the frequency of occurrence of the target event and whether a data leakage event has occurred:

[0112] A data breach occurs: Directly judged as a medium security risk or higher, depending on the severity and scope of the data breach.

[0113] It should be noted that patterns of target events such as unauthorized access attempts, malware activity events, and sensitive file transfers can be defined based on business needs and security policies. These patterns may be based on specific network traffic characteristics, system behavior, or file content. Match the parsed key information with predefined target event patterns. This can be achieved through regular expressions, string searches, behavioral analysis algorithms, or machine learning models. If the key information successfully matches a target event pattern, the corresponding target event is identified. Record each identified target event, including detailed information such as event type, occurrence time, source address, and target address. Based on the recorded event information, calculate the frequency of each target event within a certain time window. This helps to assess the severity and trend of security threats.

[0114] In some embodiments, in the event of a data breach, the security risk determination result may be determined to be a moderate security risk;

[0115] In the case where no data leakage event occurs and the occurrence frequency of the target event is less than or equal to the first threshold, determining that the security risk judgment result is a low security risk;

[0116] When a data leakage event occurs and the frequency of occurrence of the target event is greater than a first threshold, determining that the security risk judgment result is a high security risk;

[0117] When no data leakage incident occurs and the occurrence frequency of the target incident is greater than the first threshold, the security risk judgment result is determined to be a moderate security risk.

[0118] If the frequency of occurrence of the target event is greater than the first threshold value at the same time as a data leakage event occurs, the security risk judgment result is a high security risk. This means that not only has the data leakage event occurred, but the frequent occurrence of related risk events (target events) has further aggravated the severity of the security risk. If a data leakage event occurs but the frequency of occurrence of the target event is less than or equal to the first threshold value, the security risk judgment result is a moderate security risk. This means that although data leakage has occurred, the frequency of related risk events is still within a controllable range, and the risk level is relatively moderate. If the frequency of occurrence of the target event is greater than the first threshold value, the security risk judgment result is a moderate security risk. This means that although there is no direct data leakage, the frequent occurrence of the target event indicates a potential security threat. If the frequency of occurrence of the target event is less than or equal to the first threshold value, the security risk judgment result is a low security risk. This means that the system or data is in a relatively safe state, and the frequency of occurrence of risk events is within an acceptable range.

[0119] Furthermore, according to the security risk assessment results (low security risk, medium security risk, high security risk), corresponding security level assessment strategies are formulated. These strategies may include different response measures, such as strengthening monitoring, improving access control levels, conducting security audits, implementing data encryption, etc., to deal with different levels of security risks.

[0120] Afterwards, the security level of the power grid inspection can be finally determined based on the security level determination strategy and the optimized data description information of the real-time monitoring data (such as data sensitivity, storage location, access rights, etc.). This level will guide the subsequent inspection work of the power grid inspection area and the security management of the power grid system to ensure data security and compliance.

[0121] In the above-mentioned security assessment method based on integrated inspection data, real-time monitoring data collected by IoT sensors and intelligent inspection equipment deployed in the power grid inspection area is obtained; based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area, the real-time monitoring data is optimized to obtain optimized real-time monitoring data; network activity information associated with the power grid system is obtained and stored; the network activity information is obtained by monitoring the network traffic and network activities associated with the power grid system within a preset time; based on the network activity information and the optimized real-time monitoring data, the degree of power grid security risk is evaluated to determine the power grid inspection safety level.

[0122] In this way, through the combination of IoT sensors and intelligent inspection equipment, real-time monitoring of the inspection area is achieved, which greatly reduces the reliance on manual inspections and improves the efficiency and coverage of inspections. At the same time, based on the inspection requirements of the inspection tasks, the steps of optimizing the real-time monitoring data ensure the accuracy and usefulness of the monitoring data, and provide a reliable basis for subsequent security assessments. Combining real-time monitoring data with network activity information realizes a comprehensive assessment of the security risks of the power grid. This comprehensive assessment method not only considers the operating status of the power grid equipment itself, but also pays attention to the security status of the external network environment, making the assessment results more accurate and comprehensive. Through real-time monitoring and rapid data processing, the present application can timely discover potential safety hazards in the power grid, including equipment failures, network attacks, etc. This helps operation and maintenance personnel to respond quickly, take corresponding measures, avoid the expansion of accidents, and ensure the safe and stable operation of the power grid. The monitoring and storage of network activity information enables the power grid system to better respond to network threats. By analyzing network activity information, potential network attacks can be discovered and prevented in a timely manner, and the network security protection capabilities of the power grid system can be improved. Based on the comprehensive evaluation results of real-time monitoring data and network activity information, operation and maintenance personnel can more scientifically formulate and optimize the operation and maintenance strategies of the power grid. For example, maintenance needs can be predicted based on the operating status of the equipment, and maintenance plans can be arranged in advance; safety protection measures can be adjusted according to the laws of network activities, etc. The comprehensive inspection safety level assessment results provide strong decision-making support for the management. Based on the assessment results, the management can reasonably allocate resources, optimize the grid structure, and improve the overall safety and reliability of the grid. In summary, this technical solution has obvious beneficial effects in improving inspection efficiency, comprehensively assessing grid safety, responding to safety hazards in a timely manner, enhancing network security protection, optimizing operation and maintenance strategies, and improving decision-making support capabilities.

[0123] In another embodiment, Figure 3 As shown, a security assessment method based on integrated inspection data is provided, which is described by taking the method applied to computer equipment as an example, and includes the following steps:

[0124] Step S302, obtaining real-time monitoring data collected by IoT sensors and intelligent inspection devices deployed in the power grid inspection area.

[0125] Step S304, based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area, the real-time monitoring data is optimized to obtain optimized real-time monitoring data.

[0126] Step S306: Acquire and store network activity information associated with the power grid system.

[0127] Step S308: Obtain the business requirement tag corresponding to the power grid system.

[0128] Step S310: determine the security policy associated with the business requirement tag.

[0129] Step S312, the event that triggers the security response mechanism of the security policy is used as the target event.

[0130] Step S314, parsing the network activity information to obtain key information of the network activity information.

[0131] Step S316, matching the key information with the predefined target event pattern to determine whether the target event occurs in the power grid system.

[0132] Step S318: If yes, count the target event to obtain the occurrence frequency of the target event.

[0133] Step S320, obtaining a security risk judgment result based on the occurrence frequency of the target event in the power grid system and judging whether a data leakage event occurs in the power grid system.

[0134] Step S322, determining a security level determination strategy for the optimized real-time monitoring data according to the security risk determination result.

[0135] Step S324, determining the power grid inspection safety level based on the safety level determination strategy and the data description information of the optimized real-time monitoring data.

[0136] It should be noted that the specific limitations of the above steps can refer to the specific limitations of a safety assessment method based on integrated inspection data above.

[0137] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0138] Based on the same inventive concept, the embodiment of the present application also provides a safety assessment device based on integrated inspection data for implementing the above-mentioned safety assessment method based on integrated inspection data. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more embodiments of the safety assessment device based on integrated inspection data provided below can refer to the limitations of the safety assessment method based on integrated inspection data above, and will not be repeated here.

[0139] In an exemplary embodiment, Figure 4 As shown, a safety assessment device based on integrated inspection data is provided, including: a monitoring data acquisition module 410, an optimization module 420, an activity information acquisition module 430 and a level determination module 440, wherein:

[0140] The monitoring data acquisition module 410 is used to obtain real-time monitoring data collected by the Internet of Things sensors and intelligent inspection devices deployed in the power grid inspection area.

[0141] The optimization module 420 is used to optimize the real-time monitoring data based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area to obtain optimized real-time monitoring data.

[0142] The activity information acquisition module 430 is used to acquire and store network activity information associated with the power grid system; the network activity information is obtained by monitoring the network traffic and network activities associated with the power grid system within a preset time.

[0143] The level determination module 440 is used to evaluate the degree of power grid security risk based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection security level.

[0144] In one of the embodiments, the level determination module 440 is specifically used to determine the frequency of occurrence of target events in the power grid system and whether a data leakage event occurs in the power grid system based on the network activity information, to obtain a security risk judgment result; the target event is an event that triggers a security response mechanism of the power grid system; based on the security risk judgment result, a security level determination strategy for the optimized real-time monitoring data is determined; the security level determination strategy is used to deal with different levels of security risks; based on the security level determination strategy and the data description information of the optimized real-time monitoring data, the power grid inspection security level is determined; the power grid inspection security level is used to guide the inspection work of the power grid inspection area and the security management of the power grid system.

[0145] In one embodiment, the level determination module 440 is specifically used to obtain a business requirement tag corresponding to the power grid system; determine a security policy associated with the business requirement tag; and use an event that triggers a security response mechanism of the security policy as the target event; the target event includes but is not limited to at least one of an unauthorized access attempt event, a malware activity event, and a sensitive file transfer event.

[0146] In one of the embodiments, the level determination module 440 is specifically used to parse the network activity information to obtain key information of the network activity information; the key information includes at least one of the key fields and key features of the network activity information; the key information is matched with a predefined target event pattern to determine whether the target event occurs in the power grid system; if so, the target event is counted to obtain the occurrence frequency of the target event.

[0147] In one embodiment, the level determination module 440 is specifically used to determine that the security risk judgment result is a low security risk when the data leakage incident does not occur in the power grid system and the occurrence frequency of the target event is less than or equal to a first threshold; determine that the security risk judgment result is a high security risk when the data leakage incident occurs in the power grid system and the occurrence frequency of the target event is greater than the first threshold; and determine that the security risk judgment result is a moderate security risk when the data leakage incident does not occur in the power grid system and the occurrence frequency of the target event is greater than the first threshold.

[0148] In one of the embodiments, the activity information acquisition module 430 is specifically used to monitor the network traffic and network activity associated with the power grid system within the preset time based on at least one of a network traffic monitoring tool, an intrusion detection system and a log management tool, and pre-configured monitoring parameters and monitoring range, to obtain the network activity information; the monitoring range includes the traffic and activity of a specified network segment, a specified device or a specified application.

[0149] Each module in the above-mentioned safety assessment device based on integrated inspection data can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0150] In an exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a safety assessment method based on integrated inspection data is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0151] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0152] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0153] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0154] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0155] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0156] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0157] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0158] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A safety assessment method based on integrated inspection data, characterized in that: The method comprises: Obtain real-time monitoring data collected by IoT sensors and smart inspection equipment deployed in the power grid inspection area; Based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area, the real-time monitoring data is optimized to obtain optimized real-time monitoring data; Acquire and store network activity information associated with the power grid system; the network activity information is obtained by monitoring network traffic and network activities associated with the power grid system within a preset time; The degree of power grid security risk is evaluated based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection safety level.

2. The method according to claim 1, characterized in that The step of evaluating the degree of power grid security risk according to the network activity information and the optimized real-time monitoring data to determine the power grid inspection security level includes: According to the network activity information, the occurrence frequency of the target event in the power grid system is determined, and whether a data leakage event occurs in the power grid system is determined to obtain a security risk determination result; the target event is an event that triggers a security response mechanism of the power grid system; Determine a security level determination strategy for the optimized real-time monitoring data according to the security risk determination result; the security level determination strategy is used to deal with security risks of different levels; The power grid inspection safety level is determined based on the safety level determination strategy and the data description information of the optimized real-time monitoring data; the power grid inspection safety level is used to guide the inspection work of the power grid inspection area and the safety management of the power grid system.

3. The method according to claim 2, characterized in that The step of determining the occurrence frequency of a target event in the power grid system and determining whether a data leakage event occurs in the power grid system according to the network activity information to obtain a security risk determination result includes: Obtaining a business requirement tag corresponding to the power grid system; Determining a security policy associated with the business requirement tag; An event that will trigger the security response mechanism of the security policy is used as the target event; the target event includes but is not limited to at least one of an unauthorized access attempt event, a malware activity event, and a sensitive file transfer event.

4. The method according to claim 2, characterized in that: The step of determining the occurrence frequency of a target event in the power grid system and determining whether a data leakage event occurs in the power grid system according to the network activity information to obtain a security risk determination result includes: Parsing the network activity information to obtain key information of the network activity information; the key information includes at least one of a key field and a key feature of the network activity information; Matching the key information with a predefined target event pattern to determine whether the target event occurs in the power grid system; If yes, the target event is counted to obtain the occurrence frequency of the target event.

5. The method according to claim 4, characterized in that The step of determining the occurrence frequency of a target event in the power grid system and determining whether a data leakage event occurs in the power grid system according to the network activity information to obtain a security risk determination result includes: When the data leakage event does not occur in the power grid system and the occurrence frequency of the target event is less than or equal to a first threshold, determining that the security risk judgment result is a low security risk; When the data leakage event occurs in the power grid system and the occurrence frequency of the target event is greater than the first threshold, determining that the security risk judgment result is a high security risk; When the data leakage event does not occur in the power grid system and the occurrence frequency of the target event is greater than the first threshold, the security risk judgment result is determined to be a moderate security risk.

6. The method according to any one of claims 1 to 5, characterized in that: The obtaining and storing network activity information associated with the power grid system includes: Based on at least one of a network traffic monitoring tool, an intrusion detection system and a log management tool, as well as pre-configured monitoring parameters and a monitoring range, the network traffic and network activity associated with the power grid system are monitored within the preset time to obtain the network activity information; the monitoring range includes the traffic and activity of a specified network segment, a specified device or a specified application.

7. A safety assessment device based on integrated inspection data, characterized in that: The device comprises: The monitoring data acquisition module is used to obtain real-time monitoring data collected by IoT sensors and intelligent inspection equipment deployed in the power grid inspection area; An optimization module, used to optimize the real-time monitoring data based on the inspection requirements of the inspection tasks corresponding to the power grid inspection area to obtain optimized real-time monitoring data; An activity information acquisition module, used to acquire and store network activity information associated with the power grid system; the network activity information is obtained by monitoring the network traffic and network activities associated with the power grid system within a preset time; The level determination module is used to evaluate the degree of power grid security risk based on the network activity information and the optimized real-time monitoring data to determine the power grid inspection security level.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images