Network attack defense method and system for distributed new energy grid-connected system

Abstract

The invention relates to a network attack defense method and system for a distributed new energy grid-connected system, and the method comprises the steps: generating a dynamic defense strategy based on an IP address for the network abnormal flow and an attack sensing result when a new energy terminal is accessed; generating a random routing scheme based on a preset depth deterministic policy gradient; and performing dynamic defense in combination with the dynamic defense strategy and the random routing scheme. The method has the advantages that the comprehensiveness and comprehensiveness of network attack defense of the new energy grid-connected system are improved, and the network and data security of the new energy grid-connected system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack defense for new energy systems, and in particular to a network attack defense method and system for a distributed new energy grid-connected system. Background Art

[0002] With the continuous growth of global energy demand and the enhancement of environmental protection awareness, distributed new energy grid-connected systems, as a clean and renewable energy solution, are gradually becoming an important development direction in the energy field. However, with the widespread application and high integration of these systems, the cybersecurity threats they face are becoming increasingly severe. Distributed new energy grid-connected systems not only involve a large amount of energy data collection and transmission, but also rely on complex network communication technologies and Internet of Things (IoT) devices, which makes them a potential target for cyber attackers.

[0003] At present, the network security protection of distributed renewable energy grid-connected systems focuses more on single-point protection, such as installing firewalls, intrusion detection systems, etc. However, this single-point protection strategy is powerless in the face of complex and changeable network attacks. Since distributed renewable energy systems involve multiple links and multiple devices, single-point protection cannot fully cover all potential attack paths and is prone to security vulnerabilities. In addition, data is the core resource of distributed renewable energy grid-connected systems, including sensitive information such as users' energy usage and energy suppliers' supply capabilities. Existing data protection mechanisms often focus on encryption during data transmission, while ignoring the importance of data storage and access control. This results in the risk of leakage and tampering during storage and access, even if the data is encrypted and protected during transmission. Summary of the invention

[0004] In order to improve the comprehensiveness and integratedness of network attack defense of new energy grid-connected systems and ensure the network and data security of new energy grid-connected systems, the present application provides a network attack defense method and system for a distributed new energy grid-connected system.

[0005] In the first aspect, the above-mentioned invention objective of the present application is achieved through the following technical solutions: A network attack defense method for a distributed new energy grid-connected system, the network attack defense method for a distributed new energy grid-connected system comprising: Generate dynamic defense strategies based on IP addresses based on abnormal network traffic and attack perception results when new energy terminals are connected; Generate random routing solutions based on preset deep deterministic policy gradients; Dynamic defense is performed by combining the dynamic defense strategy and the random routing solution.

[0006] By adopting the above technical solutions, the network abnormal traffic and attack perception results when the new energy terminal is connected are monitored in real time, and targeted defense strategies are generated accordingly, which can accurately identify and isolate potential attack sources, effectively reduce false positives and false negatives, and improve the accuracy and timeliness of defense. By dynamically adjusting the defense strategy, the network system of the new energy grid-connected system can quickly adapt to the ever-changing network threat environment and ensure the stable operation of the new energy grid-connected system; the random routing scheme based on DDPG uses the deep deterministic policy gradient algorithm to generate random routing schemes, which can increase the complexity and unpredictability of network traffic, thereby effectively resisting network attacks such as distributed denial of service (DDoS), breaking the attacker's prediction mode, and making the attack traffic difficult to detect. By focusing on attacking a specific target, the resilience and anti-attack capability of the entire network system can be improved; the dynamic defense strategy based on IP address is combined with the random routing scheme based on DDPG. It not only focuses on the security threats when new energy terminals are connected, but also builds a comprehensive security protection system through the combination of dynamic defense strategy and random routing scheme. It covers all aspects and levels of the new energy grid-connected system, effectively resists various internal and external network attacks, improves the overall security of the system, and achieves the effect of comprehensive defense and coordinated operations. The dynamic defense strategy is responsible for accurately identifying and isolating the attack source, while the random routing scheme is responsible for dispersing and confusing the attack traffic. The two complement each other and jointly build an indestructible network security defense line.

[0007] In a preferred example, the present application may be further configured as follows: the dynamic defense is performed by combining the dynamic defense strategy and the random routing scheme, including: Establishing an information sharing path between the dynamic defense strategy and the random routing scheme; Sharing information based on the information sharing path, and performing dynamic defense by using the shared information in combination with the dynamic defense strategy and the random routing solution; Perform a security audit on the dynamic defense strategy and the random routing scheme, and adjust the dynamic defense strategy and the random routing scheme according to the security audit result.

[0008] By adopting the above technical solution, by establishing an information sharing path between the dynamic defense strategy and the random routing scheme, close coordination between the two is achieved, ensuring that when facing a network attack, the dynamic defense strategy can respond and adjust quickly, and the random routing scheme can also dynamically adjust the routing strategy according to the changes in the defense strategy, thereby enhancing the collaborative combat capability of the entire defense system and effectively improving the overall defense effect of the system. Based on the real-time information sharing of the information sharing path, the dynamic defense strategy and the random routing scheme can be adjusted in real time according to the latest situation and characteristics of the network attack, so that the defense system can quickly respond to the ever-changing network threats, effectively reducing the risk of being bypassed or broken through the defense by the attacker, and ensuring the stable operation of the new energy grid-connected system; regularly conducting security audits on the dynamic defense strategy and the random routing scheme can not only timely discover and repair potential security vulnerabilities and weaknesses, but also continuously optimize and improve the defense strategy according to the audit results, improve the robustness and reliability of the defense system, and ensure that the new energy grid-connected system always maintains a high level of defense when facing complex and changeable network threats.

[0009] In a preferred example, the present application may be further configured as follows: the establishing of the information sharing path between the dynamic defense strategy and the random routing scheme includes: According to the dynamic defense strategy, a dynamic defense perception result is obtained; The dynamic defense perception result is used as an input to the random routing solution, and the routing strategy of the random routing solution is used as an input to the dynamic defense strategy, and an information sharing path between the dynamic defense strategy and the random routing solution is established.

[0010] By adopting the above technical solution, the perception results of the dynamic defense strategy are used as the input of the random routing solution, and the routing strategy of the random routing solution is used as the input of the dynamic defense strategy, so as to realize the instant feedback mechanism between the two. The two-way information flow enables the dynamic defense strategy to adjust its defense measures in time based on the changes of the routing strategy. At the same time, the routing strategy can also optimize its routing selection according to the needs of the defense strategy, which significantly improves the response speed and accuracy of the defense system to network threats. The establishment of the information sharing path makes the dynamic defense strategy and the random routing solution no longer isolated system components, but forms an interdependent and collaboratively optimized whole. In the defense process, the two can make collaborative decisions based on the shared information, jointly respond to network attacks, improve the effectiveness and pertinence of the defense strategy, and ensure that the routing strategy can achieve efficient transmission of network traffic under the premise of ensuring network security. The information sharing between the dynamic defense perception results and the random routing strategy promotes the deep integration and intelligent analysis of the internal information of the defense system. Through the processing of shared information by intelligent algorithms, the defense system can automatically identify the type, scale and scope of influence of network threats, and generate the optimal defense strategy and routing solution accordingly.

[0011] In a preferred example, the present application may be further configured as follows: the use of the shared information, combined with the dynamic defense strategy and the random routing scheme, to perform dynamic defense includes: Using the shared information, when dynamically allocating IP addresses of new energy terminals based on the dynamic defense strategy, combined with the random routing scheme, determine security threat areas that data packets can avoid during transmission; Using the shared information, the known attack source IP addresses are added to the blacklist. When allocating routes based on the random routing scheme, the attack source IP addresses are used as key network areas that cannot be routed, and a whitelist mechanism is used to restrict legitimate IP addresses from performing predetermined operations or accessing predetermined resources.

[0012] By adopting the above technical solution, combined with the dynamic defense strategy and the random routing solution, when allocating the IP address of the new energy terminal, it is possible to intelligently identify and avoid potential security threat areas based on shared information, reduce the risk of malicious interception or tampering of data packets during transmission, and ensure the safe transmission path of key data, thereby significantly improving the overall security of network transmission; adding the known attack source IP addresses to the blacklist, and treating these addresses as key network areas that cannot be routed in the random routing solution, can quickly isolate and block threats from known attack sources to prevent them from further infiltration and spread. At the same time, combined with the whitelist mechanism, only legal IP addresses are allowed to perform specific operations or access specific resources, further strengthening the security line of the system and reducing the risk of unauthorized access and malicious operations; in the dynamic defense process, reasonable allocation of network resources through shared information can not only ensure the safe transmission of key data, but also optimize the utilization efficiency of network resources. For example, avoiding security threat areas when allocating routes can reduce unnecessary network congestion and delays, and improve the efficiency and stability of data transmission. At the same time, the combined use of blacklist and whitelist mechanisms can also help reduce the system's processing burden on invalid or malicious requests, further improving the overall operation efficiency of the system.

[0013] In a preferred example, the present application may be further configured as follows: performing a security audit on the dynamic defense strategy and the random routing scheme, and adjusting the dynamic defense strategy and the random routing scheme according to the security audit result, including: Using the preset security audit mechanism, regularly conduct security audits on the security status of new energy terminals accessing the network, including network security equipment configuration audits, security policy execution audits, and routing solution execution effect audits; The dynamic defense strategy and the random routing scheme are dynamically adjusted according to the audit results and changes in the network security situation.

[0014] By adopting the above technical solutions, the preset security audit mechanism regularly conducts a comprehensive audit on the security status of new energy terminals accessing the network, including network security equipment configuration, security policy execution, routing scheme execution effect and other dimensions, ensuring real-time monitoring of system security and timely discovery of potential security risks and loopholes. Security audit is not only an assessment of system security, but also a test of the effectiveness of defense strategies and routing schemes. Through the feedback of audit results, it is possible to accurately judge whether the current defense strategies and routing schemes meet current security needs and whether there are redundancies or deficiencies, so as to dynamically adjust the defense strategies and routing schemes, which can significantly improve their adaptability and accuracy, and ensure that in a complex and changing network environment, the system can always maintain the best security defense state. At the same time, according to the audit results and changes in the network security situation, the dynamic defense strategy and random routing scheme are dynamically adjusted so that the defense system can keep up with the development trend of security threats.

[0015] In the second aspect, the above invention objective of the present application is achieved through the following technical solutions: A network attack defense system for a distributed renewable energy grid-connected system, the network attack defense system for the distributed renewable energy grid-connected system comprising: Dynamic defense strategy module, used to generate dynamic defense strategies based on IP addresses for abnormal network traffic and attack perception results when new energy terminals are connected; A random routing scheme module, used to generate random routing schemes based on a preset deep deterministic policy gradient; The defense combination module is used to combine the dynamic defense strategy and the random routing solution to perform dynamic defense.

[0016] Optionally, the defense combination module includes: A shared path establishment submodule, used to establish an information sharing path between the dynamic defense strategy and the random routing scheme; A combined defense submodule is used to share information based on the information sharing path, and to perform dynamic defense by using the shared information in combination with the dynamic defense strategy and the random routing scheme; Combined with the audit submodule, it is used to perform a security audit on the dynamic defense strategy and the random routing scheme, and adjust the dynamic defense strategy and the random routing scheme according to the security audit results.

[0017] Optionally, the shared path establishment submodule includes: A dynamic defense result unit, used to obtain a dynamic defense perception result according to the dynamic defense strategy; A path establishing unit is used to use the dynamic defense perception result as an input to the random routing scheme, use the routing strategy of the random routing scheme as an input to the dynamic defense strategy, and establish an information sharing path between the dynamic defense strategy and the random routing scheme.

[0018] In the third aspect, the above invention objective of the present application is achieved through the following technical solutions: A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the network attack defense method for the above-mentioned distributed new energy grid-connected system when executing the computer program.

[0019] In a fourth aspect, the above-mentioned invention objective of the present application is achieved through the following technical solutions: A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the network attack defense method for the above-mentioned distributed new energy grid-connected system.

[0020] In summary, the present application includes at least one of the following beneficial technical effects: 1. Real-time monitoring of abnormal network traffic and attack perception results when new energy terminals are connected, and generating targeted defense strategies based on this, which can accurately identify and isolate potential attack sources, effectively reduce false positives and missed positives, and improve the accuracy and timeliness of defense. By dynamically adjusting the defense strategy, the network system of the new energy grid-connected system can quickly adapt to the ever-changing network threat environment and ensure the stable operation of the new energy grid-connected system; the random routing scheme based on DDPG uses the deep deterministic policy gradient algorithm to generate random routing schemes, which can increase the complexity and unpredictability of network traffic, thereby effectively resisting network attacks such as distributed denial of service (DDoS), breaking the attacker's prediction model, and making it difficult for attack traffic to concentrate attacks A specific goal is to improve the resilience and anti-attack capability of the entire network system; the dynamic defense strategy based on IP address is combined with the random routing solution based on DDPG. It not only focuses on the security threats when new energy terminals are connected, but also builds a comprehensive security protection system through the combination of dynamic defense strategy and random routing solution. It covers all links and levels of the new energy grid-connected system, effectively resists various network attacks from inside and outside, improves the overall security of the system, and achieves the effect of comprehensive defense and coordinated operations. The dynamic defense strategy is responsible for accurately identifying and isolating the attack source, while the random routing solution is responsible for dispersing and confusing the attack traffic. The two complement each other and jointly build an indestructible network security defense line; 2. By establishing an information sharing path between the dynamic defense strategy and the random routing scheme, close coordination between the two is achieved, ensuring that the dynamic defense strategy can respond and adjust quickly when facing network attacks, and the random routing scheme can also dynamically adjust the routing strategy according to the changes in the defense strategy, thereby enhancing the collaborative combat capability of the entire defense system and effectively improving the overall defense effect of the system. Based on the real-time information sharing of the information sharing path, the dynamic defense strategy and the random routing scheme can be adjusted immediately according to the latest situation and characteristics of the network attack, so that the defense system can quickly respond to the ever-changing network threats, effectively reducing the risk of being bypassed or broken through by the attacker, and ensuring the stable operation of the new energy grid-connected system; regular security audits of dynamic defense strategies and random routing schemes can not only timely discover and repair potential security vulnerabilities and weaknesses, but also continuously optimize and improve the defense strategy based on the audit results, improve the robustness and reliability of the defense system, and ensure that the new energy grid-connected system always maintains a high level of defense when facing complex and changing network threats; 3. The perception results of the dynamic defense strategy are used as the input of the random routing scheme, and the routing strategy of the random routing scheme is used as the input of the dynamic defense strategy, realizing an instant feedback mechanism between the two. The two-way information flow enables the dynamic defense strategy to adjust its defense measures in time based on the changes in the routing strategy. At the same time, the routing strategy can also optimize its routing selection according to the needs of the defense strategy, significantly improving the response speed and accuracy of the defense system to network threats. The establishment of information sharing paths makes the dynamic defense strategy and the random routing scheme no longer isolated system components, but forms an interdependent and collaboratively optimized whole. In the defense process, the two can make collaborative decisions based on shared information, jointly respond to network attacks, improve the effectiveness and pertinence of the defense strategy, and ensure that the routing strategy can achieve efficient transmission of network traffic under the premise of ensuring network security. The information sharing between the dynamic defense perception results and the random routing strategy promotes the deep integration and intelligent analysis of the internal information of the defense system. Through the processing of shared information by intelligent algorithms, the defense system can automatically identify the type, scale and impact range of network threats, and generate the optimal defense strategy and routing scheme accordingly. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flow chart for implementing a network attack defense method for a distributed new energy grid-connected system in an embodiment of the present application; Figure 2 It is a flowchart for implementing S30 of the network attack defense method of the distributed new energy grid-connected system in the embodiment of the present application; Figure 3 It is a flow chart for implementing S31 of the network attack defense method of the distributed new energy grid-connected system in the embodiment of the present application; Figure 4 It is a flow chart for implementing S32 of the network attack defense method of the distributed new energy grid-connected system in the embodiment of the present application; Figure 5 It is a flowchart for implementing S33 of the network attack defense method of the distributed new energy grid-connected system in the embodiment of the present application; Figure 6 This is a principle block diagram of a network attack defense system for a distributed new energy grid-connected system in an embodiment of the present application; Figure 7 It is a diagram of the internal structure of a computer device in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The following is combined with Figure 1-7 This application is described in further detail.

[0023] In one embodiment, if Figure 1 As shown, the present application discloses a network attack defense method for a distributed new energy grid-connected system, which specifically includes the following steps: S10: Generate a dynamic defense strategy based on IP addresses based on the abnormal network traffic and attack perception results when the new energy terminal is connected.

[0024] Specifically, use network monitoring tools to monitor the network traffic data of new energy terminals accessing the network in real time, including IP addresses, port numbers, and protocol types, collect network traffic data when the terminal devices are accessed, and analyze them to determine abnormal traffic and attack types, for example, perform deep packet inspection (DPI) on network traffic, analyze the content of data packets, identify abnormal traffic patterns, or build a normal traffic database and an abnormal traffic database based on historical network traffic data, and use machine learning or statistical methods, such as cluster analysis, anomaly detection algorithms, etc., to classify real-time network traffic data and distinguish normal traffic from abnormal traffic; Secondly, combined with the results of network traffic analysis, identify attack behaviors, such as distributed denial of service (DDoS) attacks, IP spoofing, address resolution protocol (ARP) spoofing, etc., and extract features of attack behaviors, such as attack source IP, attack type and attack intensity. Once attack behavior is discovered, for abnormal traffic and attacks, identify the IP address and formulate corresponding defense strategies, and immediately trigger the response mechanism, including blocking, restricting access, blocking the attack source IP, adjusting firewall rules and isolating the attacked device, etc., and record attack logs to provide a basis for subsequent security analysis and tracing.

[0025] Furthermore, the dynamic defense strategy based on IP address can also include: Dynamic IP address allocation strategy: New energy terminals are assigned dynamic IP addresses and their IP addresses are changed regularly, making it more difficult for attackers to track and locate them. Ensure the continuity and stability of network services when changing IP addresses; IP address blacklist and whitelist strategies: Maintain an IP address blacklist, add known attack source IP addresses to it, and deny access requests from these IP addresses; At the same time, establish an IP address whitelist and only allow IP addresses in the whitelist to perform specific operations or access specific resources; IP address access control policy: Implement strict IP address access control policies to limit unnecessary IP address access rights; Encrypt key resources and sensitive data to prevent data from being stolen or tampered with during transmission; Dynamically adjust firewall policies: Dynamically adjust firewall rules based on network traffic and attack perception results to enhance defense capabilities against new attacks and unknown threats; Regularly review and update firewall rules to ensure the effectiveness and security of the firewall; IP / MAC binding policy: Bind IP addresses to MAC addresses to deny illegal access that does not meet the binding requirements; Intrusion prevention strategy: Formulate attack detection strategies based on five-tuple (source IP, destination IP, source port, destination port, service), count and reject abnormal attacks, and release normal services; Behavioral Learning and Baseline Management Strategies: Common IoT terminals use industrial control protocols such as Modbus, IEC104, GOOSE, MMS, SV, and protocols such as MQTT for sensor transmission. By learning these network flows and analyzing the protocols in the flows, we can build basic information about current new energy devices and form a baseline for behavior. By comparing subsequent flows with the baseline flow, we can filter and report sensor information that differs greatly from the baseline (temperature and humidity changes, pressure changes, switch opening and closing) to generate risk alerts.

[0026] S20: Generate a random routing solution based on a preset deep deterministic policy gradient.

[0027] Specifically, the Deep Deterministic Policy Gradient (DDPG) method is a reinforcement learning algorithm that can be used to solve the control problem of continuous state and action space. Random routing is also a kind of dynamic defense. The random routing strategy based on DDPG in distributed new energy scenarios is studied to reduce the probability of successful attacks by attackers and improve the security of the system. Therefore, generating a random routing solution that takes into account both security and service quality requirements based on a preset deep deterministic policy gradient may specifically include the following steps: Network status monitoring: Use in-band network telemetry technology to monitor and obtain network status information in real time, including key indicators such as link status, traffic distribution, latency, and packet loss rate; Strategy network construction: Design and train a deep neural network as a policy network (Actor Network), which receives the current network state as input and outputs a deterministic routing action (i.e., the next hop address or path that the data packet should be transmitted); Evaluation network construction: At the same time, a critic network is constructed to evaluate the quality of the routing action output by the policy network. The critic network receives the current state, the routing action, and the new state after executing the action as input, and outputs a scalar value, which represents the expected return that can be obtained from the current state, executing the routing action and reaching the new state; Strategy Optimization: Through optimization algorithms such as gradient descent, the parameters of the policy network and the evaluation network are continuously adjusted to maximize the scalar value output by the evaluation network, so that the policy network can gradually learn the optimal routing action under a given network state; Random routing scheme generation: After the policy network training is completed, the policy network is used to generate a random routing plan based on the real-time network status. It should be noted that the "random" here does not mean that the routing action itself is random, but that the routing plan can be dynamically adjusted according to different network states, thereby achieving defense against potential attacks and ensuring service quality requirements.

[0028] Furthermore, the routing scheme can be executed by the programmable switch under the P4 framework to execute the generated random routing scheme. The P4 framework provides a high degree of flexibility, allowing network administrators to customize the data packet processing flow according to actual needs, thereby achieving random routing defense at the packet level granularity.

[0029] S30: Dynamic defense is performed by combining dynamic defense strategies and random routing schemes.

[0030] Specifically, the dynamic defense strategy based on IP addresses mainly monitors abnormal traffic and attack behaviors in the network in real time, identifies potential threat sources (such as the attacker's IP address), and dynamically adjusts the network configuration or security policy to prevent or restrict these threat sources from accessing network resources. The random routing solution based on the DDPG method mainly uses the deep deterministic policy gradient algorithm to dynamically adjust the transmission path of data packets according to changes in network status, so as to increase the difficulty of tracking and predicting attackers and improve network security. Therefore, by combining the two defense methods, the dynamic defense strategy based on IP addresses can quickly identify and respond to known or suspected attack sources, while the random routing scheme based on the DDPG method can increase the security of the network at a broader level and prevent potential unknown threats.

[0031] In one embodiment, if Figure 2 As shown, in step S30, dynamic defense is performed by combining the dynamic defense strategy and the random routing solution, including: S31: Establish information sharing paths for dynamic defense strategies and random routing schemes.

[0032] Specifically, the abnormal traffic and attack perception results monitored in the dynamic defense strategy based on IP addresses are used as the input of the random routing scheme, so as to establish an information sharing path between the dynamic defense strategy and the random routing scheme.

[0033] S32: Share information based on the information sharing path, and use the shared information to perform dynamic defense in combination with dynamic defense strategies and random routing solutions.

[0034] Specifically, information sharing is performed based on the information sharing path. The random routing scheme can dynamically adjust the routing strategy according to the input abnormal information to avoid routing data packets to network areas that may be attacked or have abnormal traffic. Combined with the front-end defense of the dynamic defense strategy, the network attack defense effect can be further improved.

[0035] S33: Perform a security audit on the dynamic defense strategy and the random routing scheme, and adjust the dynamic defense strategy and the random routing scheme according to the security audit results.

[0036] Specifically, the security audit mechanism is used to regularly audit the security status of distributed new energy terminals accessing the network, including network security equipment configuration, security policy execution, and the execution effect of random routing schemes. Then, according to the audit results and changes in the network security situation, the dynamic defense strategy based on IP addresses and DDPG routing schemes are dynamically adjusted to ensure the continued effectiveness of the network security protection system.

[0037] In one embodiment, if Figure 3 As shown, in step S31, an information sharing path of a dynamic defense strategy and a random routing scheme is established, including: S311: Obtain a dynamic defense perception result according to the dynamic defense strategy.

[0038] Specifically, through network monitoring mechanisms, for example, using high-performance network packet capture tools or hardware to ensure that data packets can be fully captured even in high-speed network environments without missing potential threat information, and pre-processing the captured data packets, such as deduplication, protocol parsing, and session reorganization, to reduce the pressure of subsequent analysis and improve accuracy. For example, using hardware acceleration technology (such as FPGA, ASIC) to perform preliminary filtering and parsing of data packets can significantly improve processing speed; Analyze the traffic characteristics of the captured data packets (such as packet size, transmission frequency), source IP, target IP, port number, protocol type and other key information. In addition, it can also analyze more complex features such as packet size distribution, time interval pattern and session duration, more accurately identify complex attack patterns, process the parsed information in real time, and then use machine learning, statistical analysis or rule matching algorithms to conduct in-depth analysis of the monitored network traffic, identify abnormal traffic patterns, such as DDoS attacks, SQL injections, malicious scanning, etc., and integrate the detected abnormal traffic and attack perception results into structured reports or events, including detailed information such as abnormal type, occurrence time, impact range and attack source IP; further, unsupervised learning (such as cluster analysis) can be used to discover abnormal traffic patterns, combined with supervised learning (such as classifiers) to identify known attack types. At the same time, an online learning mechanism is introduced to enable the model to be adaptively updated to adapt to new attack methods; Use machine learning algorithms (such as neural networks, decision trees, random forests, etc.) to train network traffic data and establish a behavior model of normal traffic. When the actual traffic deviates significantly from the model prediction, it can be regarded as abnormal traffic, or By analyzing the statistical characteristics of network traffic (such as mean, variance, distribution, etc.), thresholds are set to determine whether the traffic is abnormal. For example, when a certain IP address sends a large number of data packets in a short period of time, it may indicate a DDoS attack, or Write rules to match abnormal behaviors in network traffic based on known attack patterns or signature libraries; Integrate the detected abnormal traffic and attack perception results into structured reports or events. For example, the integrated information can include the following details: Clearly indicate the type of abnormal traffic detected (such as DDoS attack, SQL injection, malicious scanning, etc.); Record the time when abnormal traffic first occurs and the duration of the traffic; Assess the impact of abnormal traffic on the network, including the affected IP addresses, ports, and services; Record the IP address that initiated the attack to provide a basis for subsequent blacklist management; Information such as traffic volume, attack intensity, and possible attack targets.

[0039] S312: Using the dynamic defense perception result as an input to the random routing solution, using the routing strategy of the random routing solution as an input to the dynamic defense strategy, and establishing an information sharing path between the dynamic defense strategy and the random routing solution.

[0040] Specifically, the dynamic defense perception result is used as the input to the random routing scheme, and the routing strategy of the random routing scheme is used as the input to the dynamic defense strategy. An information sharing path between the dynamic defense strategy and the random routing scheme is established. At the same time, in order to ensure the confidentiality, integrity and availability of information during transmission, security measures can be taken. For example, encryption technology is used to encrypt the transmitted information to prevent the information from being stolen or tampered with during transmission; identity authentication and authorization are performed on the information recipient to ensure that only legitimate recipients can receive and process the information; reliable communication protocols and transmission mechanisms are used to ensure that information is not lost or damaged during transmission.

[0041] In one embodiment, the dynamic defense system can capture and analyze abnormal traffic and potential threats in the network in real time through efficient monitoring mechanisms and advanced anomaly detection algorithms, including key information such as attack source IP, attack type, attack intensity, and impact range, which will be transmitted to the random routing decision system in real time or quasi-real time; After receiving the threat intelligence provided by the dynamic defense system, the random routing decision system will immediately conduct a risk assessment, not only considering conventional factors such as network topology, link load, and node status, but also focusing on analyzing the potential attack paths and high-risk areas mentioned in the threat intelligence. Based on the risk assessment results, the random routing decision system will dynamically adjust the routing strategy, such as changing the transmission path of data packets, increasing the randomness of routing, and enabling backup links, etc., to avoid potential security threat areas and ensure the security and reliability of data transmission.

[0042] In order to cope with the ever-changing network threat environment, the random routing decision system needs to be able to continuously receive threat intelligence from the dynamic defense system and adjust the routing strategy in real time based on this intelligence.

[0043] In addition, the random routing decision system not only adjusts the routing strategy based on the threat intelligence of the dynamic defense system, but also feeds back the adjusted routing strategy to the dynamic defense system, so that the dynamic defense system can understand the actual flow and distribution of the current network traffic, thereby more accurately evaluating the security situation of the network; For example, if a routing path is frequently attacked, the dynamic defense system can strengthen security monitoring and defense measures on the path; if a backup link is proven to be safe, the dynamic defense system can incorporate it into the regular defense strategy to improve the overall defense effect; By establishing an information sharing path, a close synergistic relationship is formed between the dynamic defense strategy and the random routing scheme. In order to ensure that the information sharing path between the dynamic defense strategy and the random routing scheme is unobstructed, a series of security measures need to be taken, such as encrypting the transmitted information to ensure the confidentiality and integrity of the information during transmission; authenticating and authorizing all parties involved in information sharing to ensure that only legitimate users can access shared information; performing redundant backup of key information to prevent serious impact on the system caused by information loss or damage; and monitoring the information sharing path in real time. Once an abnormal situation is found, the alarm mechanism is immediately triggered so that timely measures can be taken to respond.

[0044] In one embodiment, if Figure 4 As shown, in step S32, the shared information is used in combination with the dynamic defense strategy and the random routing scheme to perform dynamic defense, including: S321: Utilizing the shared information, when dynamically allocating IP addresses of new energy terminals based on dynamic defense strategies, combined with random routing schemes, determine security threat areas that data packets can avoid during transmission.

[0045] Specifically, by using shared information, when dynamically allocating IP addresses of new energy terminals based on dynamic defense strategies, combined with random routing schemes, determine the security threat areas that data packets can avoid during transmission. For example, first establish a dynamic IP address pool for IP address allocation of new energy terminals. The address pool should be updated regularly to ensure the availability and security of IP addresses. Then, combined with the DDPG routing scheme, an intelligent IP address allocation algorithm is designed. When allocating IP addresses, the algorithm will consider multiple factors such as network status, security threats, and terminal types to ensure that the allocated IP addresses can avoid potential security threat areas. After the IP address allocation is completed, according to the DDPG routing scheme, the optimal routing path is generated for the new energy terminal. The path should avoid known attack sources and abnormal traffic areas as much as possible to ensure the security and efficiency of data transmission.

[0046] S322: Using the shared information, add the known attack source IP addresses to the blacklist. When allocating routes based on the random routing scheme, use the attack source IP addresses as key network areas that cannot be routed, and use the whitelist mechanism to restrict legitimate IP addresses from performing predetermined operations or accessing predetermined resources.

[0047] Specifically, using the shared information, a blacklist database is established, and the known attack source IP addresses are added to the blacklist database to store the known attack source IP addresses. The database should be updated regularly to reflect the latest security threat information. At the same time, a whitelist database is established to store legitimate IP addresses and terminal information. Only IP addresses and terminals that meet the whitelist conditions can access critical network areas or perform specific operations.

[0048] In one embodiment, after receiving the abnormal information, the routing decision system will immediately start the real-time analysis mechanism, for example, to understand the topology of the current network, including node distribution, link connection status, etc., so as to consider the overall layout of the network when adjusting the routing strategy; monitor the load of each link, including indicators such as bandwidth utilization, delay and packet loss rate, so as to determine which links may become bottlenecks or potential security threat points; check the operating status of each node in the network, including CPU usage, memory occupancy, disk space, etc.; Based on the results of real-time analysis and the received abnormal information, the random routing decision system will also conduct risk assessments on network areas that may be attacked or have abnormal traffic. For example, it will assess the threat level of abnormal traffic or potential attacks to the network, including attack intensity, impact range, etc.; analyze the specific impact that abnormal traffic or potential attacks may have on the network, such as service interruption, data leakage, etc.; assess the vulnerability of each node and service in the network to determine which parts are more vulnerable to attack or impact; When a potential security threat or abnormal traffic is discovered, the random routing decision system will dynamically change the transmission path of the data packet based on the results of real-time analysis and risk assessment to avoid potential security threat areas and transfer the data packet from links that may be attacked or have high risks to safer and more stable paths. For example, based on the current network topology and link load conditions, the optimal routing path will be recalculated and planned, and known attack sources, abnormal traffic areas, and overloaded links will be avoided as much as possible to ensure the efficiency and security of data transmission, or When there are multiple paths to choose from in the network, the random routing decision system may choose to enable backup links to transmit data packets. Backup links are usually links that are not often used under normal circumstances, but when the main link is threatened or fails, they can quickly take over the data transmission task to ensure the continuity and stability of the network. When adjusting the routing strategy, the system will also consider the load balancing factor. By reasonably allocating network traffic to different links and nodes, it can prevent some links or nodes from becoming new security threat points due to overload. In addition to changing the transmission path, the random routing decision system can also optimize the routing strategy by adjusting the routing weight. The routing weight is an indicator obtained by comprehensively evaluating factors such as link performance, security, and reliability. By adjusting the weights of different links, data packets can be guided to be transmitted preferentially through links with better performance and higher security. For example, for links that have passed security inspections and no abnormal traffic is found, the system can appropriately increase the weight so that data packets are more likely to choose these links for transmission. For links with potential threats or abnormal traffic, the system can reduce their weights to reduce the possibility of data packets passing through these links. In addition, during the process of routing decision optimization, the random routing decision system can also enable corresponding security policies based on the results of risk assessment. For example, for detected abnormal traffic, a traffic cleaning mechanism can be enabled to filter and clean the traffic to remove malicious components and ensure that only legitimate traffic can enter the network. For high-risk network areas or nodes, security isolation measures can be implemented to isolate them from other network areas or nodes to prevent abnormal traffic or attacks from spreading in the network.

[0049] In one embodiment, if Figure 5 As shown, in step S33, a security audit is performed on the dynamic defense strategy and the random routing scheme, and the dynamic defense strategy and the random routing scheme are adjusted according to the security audit result, including: S331: Use the preset security audit mechanism to regularly conduct security audits on the security status of new energy terminals accessing the network. The security audits include network security equipment configuration audits, security policy execution audits, and routing solution execution effect audits.

[0050] Specifically, the preset security audit mechanism is used to conduct a comprehensive audit of the security status of new energy terminals accessing the network on a regular basis. The combination of automated audit tools and manual audits can be used to conduct in-depth inspections and analyses of various contents within the audit scope. For example, professional network security audit software or tools can be used to automatically scan and test network security equipment and policies to discover security issues and configuration errors such as unpatched vulnerabilities, weak passwords, and insecure protocol versions. On the basis of automated audits, in-depth manual analysis and evaluation are conducted. Manual audits focus on the understanding and judgment of complex security issues, such as the logical rationality of security policies and the potential threats of abnormal traffic. The audit scope includes network security equipment configuration (such as firewalls, intrusion detection systems), security policy implementation (such as access control policies, data encryption policies), and the implementation effect of DDPG routing solutions; More specifically, the audit scope includes but is not limited to: Network security equipment configuration: Detailed inspection of the configuration of key security equipment such as firewalls, intrusion detection systems (IDS / IPS), and security event information management (SIEM) systems, the effectiveness of rule sets, policy consistency, log integrity, and interoperability between devices, as well as whether there are unauthorized configuration changes or potential security vulnerabilities; Security policy implementation: Evaluate the implementation of security policies such as access control policies, data encryption policies, identity authentication and authorization mechanisms, check whether the policies are correctly implemented, whether there are policy conflicts or policy bypasses, verify whether the policies are suitable for the current network environment and business needs, and whether they need to be adjusted to deal with new security threats; DDPG routing solution execution effect: In-depth analysis of the DDPG (distributed deep packet inspection) routing solution execution effect, including the accuracy and real-time performance of routing decisions, the responsiveness to network anomalies or attacks, whether the routing strategy effectively avoids potential security threat areas, and whether the security and reliability of data transmission are ensured; Terminal security status: operating system patch updates, antivirus software installation and updates, security configuration (such as disabling unnecessary services and ports), etc.

[0051] Furthermore, a detailed audit report is generated based on the audit results, which includes all security issues found during the audit process, including problem description, scope of impact and severity, etc. For each problem, specific evidence and supporting materials such as screenshots should be provided; the potential impact of each problem on network security is evaluated, including possible consequences such as service interruption and data leakage. At the same time, the root causes and causes of the problems are analyzed to provide a basis for subsequent problem rectification; specific improvement measures and suggestions are proposed for the problems found in the audit.

[0052] S332: Dynamically adjust dynamic defense strategies and random routing solutions based on audit results and changes in network security situation.

[0053] Specifically, dynamic defense strategies and random routing schemes are dynamically adjusted based on audit results and changes in network security situation. For example, the parameters and rules of the monitoring mechanism are adjusted based on security issues and vulnerabilities discovered in the audit to improve the accuracy and real-time performance of monitoring. New monitoring technologies and tools can also be introduced to respond to new security threats. Routing strategies are dynamically adjusted based on changes in network topology and the evolution of security threats.

[0054] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0055] In one embodiment, a network attack defense system for a distributed renewable energy grid-connected system is provided, and the network attack defense system for the distributed renewable energy grid-connected system corresponds one-to-one to the network attack defense method for the distributed renewable energy grid-connected system in the above embodiment. Figure 6 As shown, the network attack defense system of the distributed new energy grid-connected system includes a dynamic defense strategy module, a random routing solution module and a defense combination module. The detailed description of each functional module is as follows: Dynamic defense strategy module, used to generate dynamic defense strategies based on IP addresses for abnormal network traffic and attack perception results when new energy terminals are connected; A random routing scheme module, used to generate random routing schemes based on a preset deep deterministic policy gradient; The defense combination module is used to combine dynamic defense strategies and random routing schemes for dynamic defense.

[0056] Optional, defense-combined modules include: The shared path establishment submodule is used to establish the information sharing path of the dynamic defense strategy and the random routing scheme; Combined with the defense submodule, it is used to share information based on the information sharing path, and use the shared information to combine dynamic defense strategies and random routing schemes to perform dynamic defense; Combined with the audit submodule, it is used to perform security audits on dynamic defense strategies and random routing schemes, and adjust dynamic defense strategies and random routing schemes based on the security audit results.

[0057] Optionally, the shared path establishment submodule includes: A dynamic defense result unit, used to obtain a dynamic defense perception result according to a dynamic defense strategy; The path establishment unit is used to use the dynamic defense perception result as the input to the random routing scheme, use the routing strategy of the random routing scheme as the input of the dynamic defense strategy, and establish an information sharing path between the dynamic defense strategy and the random routing scheme.

[0058] Optionally, combined with defense submodules including: A dynamic direction combining unit is used to utilize the shared information to determine the security threat areas that data packets can avoid during transmission in combination with a random routing scheme when dynamically allocating IP addresses of new energy terminals based on a dynamic defense strategy; The random routing direction combining unit is used to use the shared information to add the known attack source IP addresses to the blacklist. When allocating routes based on the random routing scheme, the attack source IP addresses are used as key network areas that cannot be routed, and the whitelist mechanism is used to restrict only legal IP addresses to perform specific operations or access specific resources.

[0059] Optionally, combined with the audit submodule include: The audit unit is used to use the preset security audit mechanism to regularly conduct security audits on the security status of new energy terminals accessing the network. The security audits include network security equipment configuration audits, security policy execution audits, and routing solution execution effect audits.

[0060] The dynamic adjustment unit is used to dynamically adjust the dynamic defense strategy and random routing scheme according to the audit results and changes in the network security situation.

[0061] For the specific definition of the network attack defense system of the distributed new energy grid-connected system, please refer to the definition of the network attack defense method of the distributed new energy grid-connected system above, which will not be repeated here. Each module in the network attack defense system of the above-mentioned distributed new energy grid-connected system can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0062] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store network abnormal traffic, attack perception results, dynamic defense strategies and random routing schemes, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network attack defense method for a distributed new energy grid-connected system is implemented.

[0063] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: Generate dynamic defense strategies based on IP addresses based on abnormal network traffic and attack perception results when new energy terminals are connected; Generate random routing solutions based on preset deep deterministic policy gradients; Dynamic defense is performed by combining dynamic defense strategies and random routing schemes.

[0064] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: Generate dynamic defense strategies based on IP addresses based on abnormal network traffic and attack perception results when new energy terminals are connected; Generate random routing solutions based on preset deep deterministic policy gradients; Dynamic defense is performed by combining dynamic defense strategies and random routing schemes.

[0065] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0066] Those skilled in the art will clearly understand that for the sake of convenience and brevity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above.

[0067] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A network attack defense method for a distributed new energy grid-connected system, characterized in that: The network attack defense method of the distributed new energy grid-connected system includes: Generate dynamic defense strategies based on IP addresses based on abnormal network traffic and attack perception results when new energy terminals are connected; Generate random routing solutions based on preset deep deterministic policy gradients; Dynamic defense is performed by combining the dynamic defense strategy and the random routing solution.

2. The network attack defense method for a distributed new energy grid-connected system according to claim 1 is characterized in that: The combining the dynamic defense strategy and the random routing scheme to perform dynamic defense includes: Establishing an information sharing path between the dynamic defense strategy and the random routing scheme; Sharing information based on the information sharing path, and performing dynamic defense by using the shared information in combination with the dynamic defense strategy and the random routing solution; Perform a security audit on the dynamic defense strategy and the random routing scheme, and adjust the dynamic defense strategy and the random routing scheme according to the security audit result.

3. The network attack defense method for the distributed new energy grid-connected system according to claim 2 is characterized in that: The establishing of the information sharing path between the dynamic defense strategy and the random routing scheme includes: According to the dynamic defense strategy, a dynamic defense perception result is obtained; The dynamic defense perception result is used as an input to the random routing solution, and the routing strategy of the random routing solution is used as an input to the dynamic defense strategy, and an information sharing path between the dynamic defense strategy and the random routing solution is established.

4. The network attack defense method for a distributed new energy grid-connected system according to claim 2 is characterized in that: The utilizing the shared information, combining the dynamic defense strategy and the random routing scheme, to perform dynamic defense includes: Using the shared information, when dynamically allocating IP addresses of new energy terminals based on the dynamic defense strategy, combined with the random routing scheme, determine security threat areas that data packets can avoid during transmission; Using the shared information, the known attack source IP addresses are added to the blacklist. When allocating routes based on the random routing scheme, the attack source IP addresses are used as key network areas that cannot be routed, and a whitelist mechanism is used to restrict legitimate IP addresses from performing predetermined operations or accessing predetermined resources.

5. The network attack defense method for the distributed new energy grid-connected system according to claim 2 is characterized in that: The performing a security audit on the dynamic defense strategy and the random routing scheme, and adjusting the dynamic defense strategy and the random routing scheme according to the security audit result, includes: Using the preset security audit mechanism, regularly conduct security audits on the security status of new energy terminals accessing the network, including network security equipment configuration audits, security policy execution audits, and routing solution execution effect audits; The dynamic defense strategy and the random routing scheme are dynamically adjusted according to the audit results and changes in the network security situation.

6. A network attack defense system for a distributed new energy grid-connected system, characterized in that: The network attack defense system of the distributed new energy grid-connected system includes: Dynamic defense strategy module, used to generate dynamic defense strategies based on IP addresses for abnormal network traffic and attack perception results when new energy terminals are connected; A random routing scheme module, used to generate random routing schemes based on a preset deep deterministic policy gradient; The defense combination module is used to combine the dynamic defense strategy and the random routing solution to perform dynamic defense.

7. The network attack defense system for the distributed new energy grid-connected system according to claim 6 is characterized in that: The defense combination module includes: A shared path establishment submodule, used to establish an information sharing path between the dynamic defense strategy and the random routing scheme; A combined defense submodule is used to share information based on the information sharing path, and to perform dynamic defense by using the shared information in combination with the dynamic defense strategy and the random routing scheme; Combined with the audit submodule, it is used to perform a security audit on the dynamic defense strategy and the random routing scheme, and adjust the dynamic defense strategy and the random routing scheme according to the security audit results.

8. The network attack defense system for the distributed new energy grid-connected system according to claim 7 is characterized in that: The shared path establishment submodule includes: A dynamic defense result unit, used to obtain a dynamic defense perception result according to the dynamic defense strategy; A path establishing unit is used to use the dynamic defense perception result as an input to the random routing scheme, use the routing strategy of the random routing scheme as an input to the dynamic defense strategy, and establish an information sharing path between the dynamic defense strategy and the random routing scheme.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the network attack defense method for the distributed new energy grid-connected system as described in any one of claims 1 to 5 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network attack defense method for the distributed new energy grid-connected system as claimed in any one of claims 1 to 5 are implemented.

Images