Safety equipment feature library updating method and system for power system

Abstract

The invention discloses a safety equipment feature library updating method for a power system. The method comprises the following steps: acquiring existing safety equipment information data; matching an existing power system safety equipment feature library with the obtained safety equipment information data to obtain an optimal feature library; acquiring corresponding feature library file data information; performing format conversion, data cleaning, data processing, data compression and verification on the feature library file data information, and transmitting the information to the interior of the power system; and the electric power system completes updating of the safety equipment feature library of the electric power system according to the data information transmitted to the inside. The invention also discloses a system for realizing the security equipment feature library updating method for the power system. According to the method, through the acquisition of the safety equipment features and the innovative feature comparison and matching process, the updating of the safety equipment feature library for the electric power system can be realized, and the method is higher in reliability, better in accuracy and higher in efficiency.

Description

Technical Field

[0001] The present invention belongs to the field of power system data security, and in particular relates to a method and system for updating a safety device feature library for a power system. Background Art

[0002] With the development of economy and technology and the improvement of people's living standards, electricity has become an indispensable secondary energy source in people's production and life, bringing endless convenience to people's production and life. Therefore, ensuring the stable and reliable supply of electricity has become one of the most important tasks of the power system.

[0003] At present, the degree of digitization and networking of power systems is getting higher and higher, so the digital security issues faced by power systems are becoming more and more severe. In order to cope with the increasingly serious digital security threats, security equipment (antivirus equipment, WAF, etc.) as the first line of defense for network security protection needs to continuously improve its performance and protection capabilities. As an important part of security equipment, the security equipment feature library is of great significance.

[0004] At present, the security device signature database has been rapidly developed. With the rapid changes in the network environment and the diversification of user needs, the security device signature database also needs to be continuously updated to meet new security protection needs.

[0005] At present, the update scheme of the safety equipment feature library of the power system still adopts the manual update scheme, that is, the power staff obtains the corresponding safety equipment features from various safety equipment manufacturers, manually imports them into the power system, and then manually updates the safety equipment feature library of the power system. However, this manual update scheme of the safety equipment feature library is not only time-consuming and labor-intensive, but also inefficient, and has problems of poor reliability and accuracy. Summary of the invention

[0006] One of the purposes of the present invention is to provide a method for updating a safety device signature library for a power system with high reliability, good accuracy and high efficiency.

[0007] A second object of the present invention is to provide a system for implementing the method for updating the safety device feature library for the power system.

[0008] The method for updating the safety device signature library for a power system provided by the present invention comprises the following steps:

[0009] S1. Obtain existing security equipment information data;

[0010] S2. Using a matching algorithm, the existing power system safety equipment feature library is matched with the safety equipment information data obtained in step S1 to obtain the optimal feature library;

[0011] S3. According to the optimal feature library data information obtained in step S2, obtain the corresponding feature library file data information;

[0012] S4. Convert the feature library file data information obtained in step S3 into a new format;

[0013] S5. Clean and process the data information obtained in step S4 to remove redundant data information;

[0014] S6. Perform data compression and verification on the data obtained in step S5;

[0015] S7. The data information obtained in step S6 is transmitted to the power system;

[0016] S8. The power system completes the update of the safety equipment feature library of the power system based on the data information transmitted to the internal part.

[0017] The step S1 of obtaining the existing security device information data specifically includes the following steps:

[0018] Obtain data information on existing and up-to-date security equipment;

[0019] The data information includes device number, device version, signature library version number, signature library major version, signature library minor version, release date and file size;

[0020] The acquired data information is formed into a device information table.

[0021] The matching algorithm described in step S2 is used to match the existing power system safety equipment feature library with the safety equipment information data obtained in step S1 to obtain the optimal feature library, which specifically includes the following steps:

[0022] A. Data preprocessing: preprocess the device number and feature library version number to achieve data standardization; the preprocessing includes removing characters and unifying the format;

[0023] B. Feature extraction: extract key information from the pre-processed device number and feature library version number; the key information includes device model, version number and revision number;

[0024] Security device feature data extraction:

[0025] Use regular expressions to match device numbers;

[0026] After the regular expression is matched successfully, the device type, device model, version number, major version number and minor version number are extracted respectively;

[0027] Feature library feature data extraction:

[0028] Use regular expressions for matching;

[0029] After the regular expression is matched successfully, the firmware type, firmware model, major version number, minor version number and revision number are extracted respectively;

[0030] C. Similarity calculation:

[0031] The similarity between the ith device number and the signature database version number is calculated using the following formula:

[0032]

[0033] Where S i (D i ',V i ') is the i-th device number after preprocessing D i ' and the i-th feature library version number V after preprocessing i ' Similarity value between; LD(D i ',V i ') is D i ' and V i 'The Levenshtein distance between them; len() is the length of the string;

[0034] D. For the similarity values ​​between several device numbers and feature library version numbers, the following formula is used to calculate the total similarity S total :

[0035]

[0036] Where w i is the i-th weight value;

[0037] E. Use the following formula to calculate the total score P total :

[0038] P total =α·S total +β·C+γ·R

[0039] Where α is the similarity weight value; β is the matching weight value; C is the matching value, which is used to measure the similarity between the device number and the feature library version number, and LD(D',V') is the Levenshtein distance between the device number and the feature library version number, len(D') is the length of the device number, and len(V') is the length of the feature library version number; γ is the relevance weight value; R is the relevance value, which is used to measure the relevance of the matching item to the target task. For example, in device compatibility retrieval, some device versions may be more suitable for specific application scenarios. The relevance score is usually defined based on business context or specific rules. It can be adjusted based on experience, actual usage scenarios, or the accuracy of historical matching. Generally, the higher the relevance, the larger the score;

[0040] F. Select several matching items with the highest total score as the final optimal features and build an optimal feature library.

[0041] The step S3 of obtaining corresponding feature library file data information according to the optimal feature library data information obtained in step S2 specifically includes the following steps:

[0042] According to the optimal feature library data information obtained in step S2, corresponding feature library file data information is collected;

[0043] The signature library file data information includes manufacturer name, data source address, protocol name, device number, device model, device version, signature library major version, signature library minor version, release date, file size and signature library file stream data;

[0044] During the data collection process, save the collection log.

[0045] Step S4 converts the format of the feature library file data information obtained in step S3, and specifically includes the following steps:

[0046] The characteristic library file data information obtained in step S3 is converted into a format using a set format conversion scheme to unify the data format;

[0047] The format conversion scheme includes JSON format conversion and XML format conversion.

[0048] Step S5, in which the data information obtained in step S4 is cleaned and processed to remove redundant data information, specifically includes the following steps:

[0049] The data information obtained in step S4 is cleaned and processed to remove redundant data information;

[0050] The data cleaning and data processing include unifying the date format and deleting redundant data.

[0051] Step S6 of compressing and verifying the data obtained in step S5 specifically includes the following steps:

[0052] Before compression, the data obtained in step S5 is verified, and the data that fails the verification is stored separately and an alarm is issued; the data that passes the verification is added to the result list;

[0053] Compress the data in the result list to reduce the amount of data transmission.

[0054] The data information obtained in step S6 is transmitted to the power system in step S7, which specifically includes the following steps:

[0055] Define the data transmission interface, interface call protocol and rules for the power system intranet and extranet;

[0056] Encrypt the compressed data information and generate signature data;

[0057] The encrypted data is transmitted to the power system intranet through the API interface;

[0058] The API data transmission interface is called, and after the power system intranet receives the data, data integrity verification is performed and data decryption is performed.

[0059] The present invention also provides a system for implementing the method for updating the safety device feature library for the electric power system, comprising a data acquisition module, a feature matching module, a file collection module, a format conversion module, a data cleaning module, a compression verification module, a data transmission module and a feature library update module; the data acquisition module, the feature matching module, the file collection module, the format conversion module, the data cleaning module, the compression verification module, the data transmission module and the feature library update module are connected in series in sequence; the data acquisition module is used to acquire existing safety device information data and upload the data information to the feature matching module; the feature matching module is used to match the existing power system safety device feature library with the acquired safety device information data according to the received data information and adopt a matching algorithm to obtain an optimal feature library, and upload the data information to the file collection module; the file collection module is used to, according to the received data information, according to the acquired optimal feature library data information, Obtain the corresponding feature library file data information and upload the data information to the format conversion module; the format conversion module is used to convert the format of the acquired feature library file data information according to the received data information, and upload the data information to the data cleaning module; the data cleaning module is used to clean and process the obtained data information according to the received data information to remove redundant data information, and upload the data information to the compression verification module; the compression verification module is used to compress and verify the obtained data according to the received data information, and upload the data information to the data transmission module; the data transmission module is used to transmit the obtained data information to the inside of the power system according to the received data information, and upload the data information to the feature library update module; the feature library update module is used to complete the update of the safety equipment feature library of the power system according to the received data information, and the power system completes the update of the safety equipment feature library of the power system according to the data information transmitted to the inside.

[0060] The method and system for updating the safety device feature library for the power system provided by the present invention can not only realize the update of the safety device feature library for the power system through the acquisition of safety device features and the innovative feature comparison and matching process, but also has higher reliability, better accuracy and higher efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 The figure is a schematic diagram of the method flow of the present invention.

[0062] Figure 2 Schematic diagram of the functional modules of the system of the present invention. DETAILED DESCRIPTION

[0063] like Figure 1 The method flow chart of the method of the present invention is shown as follows: The method for updating the safety device feature library for the power system disclosed in the present invention comprises the following steps:

[0064] S1. Obtaining existing security device information data; specifically includes the following steps:

[0065] Obtain data information on existing and up-to-date security equipment;

[0066] The data information includes device number, device version, signature library version number, signature library major version, signature library minor version, release date and file size;

[0067] The acquired data information is formed into a device information table;

[0068] S2. Using a matching algorithm, the existing power system safety equipment feature library is matched with the safety equipment information data obtained in step S1 to obtain an optimal feature library; specifically, the following steps are included:

[0069] A. Data preprocessing: Preprocess the device number and feature library version number to achieve data standardization; the preprocessing includes removing characters and unifying the format; at the same time, it is also necessary to remove non-numeric characters in the device number and normalize the letter part of the feature library version number.

[0070] B. Feature extraction: extract key information from the pre-processed device number and feature library version number; the key information includes device model, version number and revision number;

[0071] Security device feature data extraction:

[0072] Use regular expressions to match device numbers; the control command used is r"([A-Za-z]+)(\d+)([.\d+-]*)";

[0073] After the regular expression is matched successfully, the device type, device model, version number, major version number and minor version number are extracted respectively;

[0074] The control command for extracting the device type is device_type=match.group(1);

[0075] The control command for extracting the device model is model_number=match.group(2);

[0076] The control command to extract the version number is version_info = match.group(3).split('-');

[0077] The control command to extract the main version number is main_version=version_info[0];

[0078] The control command to extract the minor version number is sub_version=version_info[1];

[0079] Finally, the matching parsed result variables device_type, model_number, main_version and sub_version are returned;

[0080] Feature library feature data extraction:

[0081] Regular expressions are used for matching; the control command used is r"([A-Za-z]+)(\d+)-(\d+)\.(\d+)\.(\d+)";

[0082] After the regular expression is matched successfully, the firmware type, firmware model, major version number, minor version number and revision number are extracted respectively;

[0083] in,

[0084] The control command for extracting the firmware type is firmware_type=match.group(1);

[0085] The control command to extract the firmware model is firmware_model=match.group(2);

[0086] The control command to extract the major version number is major_version = int(match.group(3))

[0087] The control command to extract the minor version number is minor_version = int(match.group(4))

[0088] The control command to extract the revision number is revision = int (match.group (5))

[0089] Finally, the matching parsed result variables firmware_type, firmware_model, major_version, minor_version and revision are returned;

[0090] C. Similarity calculation:

[0091] The present invention proposes a new similarity calculation scheme, which weights the matching results of different features to comprehensively evaluate the overall matching quality;

[0092] The similarity between the ith device number and the signature database version number is calculated using the following formula:

[0093]

[0094] Where S i (D i ',V i ') is the i-th device number after preprocessing D i ' and the i-th feature library version number V after preprocessing i ' Similarity value between; LD(D i ',V i ') is D i ' and V i 'The Levenshtein distance between them; len() is the length of the string;

[0095] D. For the similarity values ​​between several device numbers and feature library version numbers, the following formula is used to calculate the total similarity S total :

[0096]

[0097] Where w i is the i-th weight value;

[0098] E. The solution of the present invention also adds a scoring mechanism, which can provide quality feedback of matching results and sort them according to scores to help users choose the best matching items;

[0099] The total score P is calculated using the following formula: total :

[0100] P total =α·S total +β·C+γ·R

[0101] Where α is the similarity weight value; β is the matching weight value; C is the matching value, which is used to measure the similarity between the device number and the feature library version number, and LD(D',V') is the Levenshtein distance between the device number and the feature library version number, len(D') is the length of the device number, and len(V') is the length of the feature library version number; γ is the relevance weight value; R is the relevance value, which is used to measure the relevance of the matching item to the target task. For example, in device compatibility retrieval, some device versions may be more suitable for specific application scenarios. The relevance score is usually defined based on business context or specific rules. It can be adjusted based on experience, actual usage scenarios, or the accuracy of historical matching. Generally, the higher the relevance, the larger the score;

[0102] F. Select several matching items with the highest total score as the final optimal features and build an optimal feature library. At this point, users can make further decisions based on these results, such as device compatibility verification, software version selection, etc.

[0103] S3. According to the optimal feature library data information obtained in step S2, obtain the corresponding feature library file data information; specifically comprising the following steps:

[0104] According to the optimal feature library data information obtained in step S2, corresponding feature library file data information is collected;

[0105] The signature library file data information includes manufacturer name, data source address, protocol name, device number, device model, device version, signature library major version, signature library minor version, release date, file size and signature library file stream data;

[0106] During the data collection process, save the collection log;

[0107] S4. Convert the data information of the feature library file obtained in step S3 into a format; specifically comprising the following steps:

[0108] The characteristic library file data information obtained in step S3 is converted into a format using a set format conversion scheme to unify the data format;

[0109] The format conversion scheme includes JSON format conversion and XML format conversion;

[0110] S5. Clean and process the data information obtained in step S4 to remove redundant data information; specifically, the steps include:

[0111] The data information obtained in step S4 is cleaned and processed to remove redundant data information;

[0112] The data cleaning and data processing include standardizing date formats and deleting redundant data;

[0113] S6. Compress and verify the data obtained in step S5; specifically comprising the following steps:

[0114] Before compression, the data obtained in step S5 is verified, and the data that fails the verification is stored separately and an alarm is issued; the data that passes the verification is added to the result list;

[0115] In specific implementation, the verification can be done by Hash or MD5 value verification;

[0116] Compress the data in the result list to reduce the amount of data transmission;

[0117] S7. The data information obtained in step S6 is transmitted to the power system; specifically, the steps include:

[0118] Define the data transmission interface, interface call protocol and rules for the power system intranet and extranet;

[0119] Encrypt the compressed data information and generate signature data;

[0120] The encrypted data is transmitted to the power system intranet through the API interface;

[0121] Call the API data transmission interface, and after the power system intranet receives the data, verify the data integrity and decrypt the data;

[0122] S8. The power system completes the update of the safety equipment feature library of the power system based on the data information transmitted to the internal part.

[0123] like Figure 2 The functional module schematic diagram of the system of the present invention is shown as follows: the system disclosed in the present invention for implementing the method for updating the safety device feature library for the electric power system comprises a data acquisition module, a feature matching module, a file collection module, a format conversion module, a data cleaning module, a compression verification module, a data transmission module and a feature library update module; the data acquisition module, the feature matching module, the file collection module, the format conversion module, the data cleaning module, the compression verification module, the data transmission module and the feature library update module are connected in series in sequence; the data acquisition module is used to acquire existing safety device information data and upload the data information to the feature matching module; the feature matching module is used to match the existing electric power system safety device feature library with the acquired safety device information data according to the received data information by using a matching algorithm to obtain the optimal feature library, and upload the data information to the file collection module; the file collection module is used to obtain the optimal feature library according to the received data information The characteristic library data information obtains the corresponding characteristic library file data information, and uploads the data information to the format conversion module; the format conversion module is used to convert the format of the acquired characteristic library file data information according to the received data information, and upload the data information to the data cleaning module; the data cleaning module is used to clean and process the obtained data information according to the received data information to remove redundant data information, and upload the data information to the compression verification module; the compression verification module is used to compress and verify the obtained data according to the received data information, and upload the data information to the data transmission module; the data transmission module is used to transmit the obtained data information to the inside of the power system according to the received data information, and upload the data information to the characteristic library update module; the characteristic library update module is used to complete the update of the safety equipment characteristic library of the power system according to the data information transmitted to the inside according to the received data information.

Claims

1. A method for updating a safety device feature library for a power system, comprising the following steps: S1. Obtain existing security equipment information data; S2. Using a matching algorithm, the existing power system safety equipment feature library is matched with the safety equipment information data obtained in step S1 to obtain the optimal feature library; S3. According to the optimal feature library data information obtained in step S2, obtain the corresponding feature library file data information; S4. Convert the feature library file data information obtained in step S3 into a new format; S5. Clean and process the data information obtained in step S4 to remove redundant data information; S6. Perform data compression and verification on the data obtained in step S5; S7. The data information obtained in step S6 is transmitted to the power system; S8. The power system completes the update of the safety equipment feature library of the power system based on the data information transmitted to the internal part.

2. The method for updating the safety device signature library for a power system according to claim 1, characterized in that The step S1 of obtaining the existing security device information data specifically includes the following steps: Obtain data information on existing and up-to-date security equipment; The data information includes device number, device version, signature library version number, signature library major version, signature library minor version, release date and file size; The acquired data information is formed into a device information table.

3. The method for updating the safety device signature library for a power system according to claim 2, characterized in that The matching algorithm described in step S2 is used to match the existing power system safety equipment feature library with the safety equipment information data obtained in step S1 to obtain the optimal feature library, which specifically includes the following steps: A. Data preprocessing: preprocess the device number and feature library version number to achieve data standardization; the preprocessing includes removing characters and unifying the format; B. Feature extraction: extract key information from the pre-processed device number and feature library version number; the key information includes device model, version number and revision number; Security device feature data extraction: Use regular expressions to match device numbers; After the regular expression is matched successfully, the device type, device model, version number, major version number and minor version number are extracted respectively; Feature library feature data extraction: Use regular expressions for matching; After the regular expression is matched successfully, the firmware type, firmware model, major version number, minor version number and revision number are extracted respectively; C. Similarity calculation: The similarity between the ith device number and the signature database version number is calculated using the following formula: Where S i (D i ',V i ') is the i-th device number after preprocessing D i ' and the i-th feature library version number V after preprocessing i ' Similarity value between; LD(D i ',V i ') is D i ' and V i 'The Levenshtein distance between them; len() is the length of the string; D. For the similarity values ​​between several device numbers and feature library version numbers, the following formula is used to calculate the total similarity S total : Where w i is the i-th weight value; E. Use the following formula to calculate the total score P total : P total =α·S total +β·C+γ·R Where α is the similarity weight value; β is the matching weight value; C is the matching value, and LD(D',V') is the Levenshtein distance between the device number and the feature library version number, len(D') is the length of the device number, and len(V') is the length of the feature library version number; γ is the correlation weight value; R is the correlation value; F. Select several matching items with the highest total score as the final optimal features and build an optimal feature library.

4. The method for updating the safety device signature library for a power system according to claim 3, characterized in that The step S3 of obtaining corresponding feature library file data information according to the optimal feature library data information obtained in step S2 specifically includes the following steps: According to the optimal feature library data information obtained in step S2, corresponding feature library file data information is collected; The signature library file data information includes manufacturer name, data source address, protocol name, device number, device model, device version, signature library major version, signature library minor version, release date, file size and signature library file stream data; During the data collection process, save the collection log.

5. The method for updating the safety device signature library for a power system according to claim 4, characterized in that Step S4 converts the format of the feature library file data information obtained in step S3, and specifically includes the following steps: The characteristic library file data information obtained in step S3 is converted into a format using a set format conversion scheme to unify the data format; The format conversion scheme includes JSON format conversion and XML format conversion.

6. The method for updating the safety device signature library for a power system according to claim 5, characterized in that Step S5, in which the data information obtained in step S4 is cleaned and processed to remove redundant data information, specifically includes the following steps: The data information obtained in step S4 is cleaned and processed to remove redundant data information; The data cleaning and data processing include unifying the date format and deleting redundant data.

7. The method for updating the safety device signature library for a power system according to claim 6, characterized in that Step S6 of compressing and verifying the data obtained in step S5 specifically includes the following steps: Before compression, the data obtained in step S5 is verified, and the data that fails the verification is stored separately and an alarm is issued; the data that passes the verification is added to the result list; Compress the data in the result list to reduce the amount of data transmission.

8. The method for updating the safety device signature library for a power system according to claim 7, characterized in that The data information obtained in step S6 is transmitted to the power system in step S7, which specifically includes the following steps: Define the data transmission interface, interface call protocol and rules for the power system intranet and extranet; Encrypt the compressed data information and generate signature data; The encrypted data is transmitted to the power system intranet through the API interface; The API data transmission interface is called, and after the power system intranet receives the data, data integrity verification is performed and data decryption is performed.

9. A system for implementing the method for updating a safety device signature library for a power system as claimed in any one of claims 1 to 8, characterized in that It includes a data acquisition module, a feature matching module, a file collection module, a format conversion module, a data cleaning module, a compression verification module, a data transmission module and a feature library update module; the data acquisition module, the feature matching module, the file collection module, the format conversion module, the data cleaning module, the compression verification module, the data transmission module and the feature library update module are connected in series in sequence; the data acquisition module is used to obtain the existing security device information data and upload the data information to the feature matching module; The feature matching module is used to match the existing power system safety equipment feature library with the acquired safety equipment information data using a matching algorithm according to the received data information, so as to obtain the optimal feature library, and upload the data information to the file collection module; The file collection module is used to obtain the corresponding feature library file data information according to the received data information and the obtained optimal feature library data information, and upload the data information to the format conversion module; The format conversion module is used to convert the acquired feature library file data information into a format according to the received data information, and upload the data information to the data cleaning module; The data cleaning module is used to clean and process the received data information to remove redundant data information, and upload the data information to the compression verification module; The compression and verification module is used to compress and verify the received data according to the received data information, and upload the data information to the data transmission module; The data transmission module is used to transmit the received data information to the inside of the power system and upload the data information to the feature library update module; The feature library update module is used to complete the update of the safety equipment feature library of the power system according to the received data information and the data information transmitted to the internal of the power system.

Images