Network security operation and maintenance recommendation method for shore power system

Abstract

The invention discloses a shore power system network security operation and maintenance recommendation method, which belongs to the technical field of electric power engineering informatization, and comprises the following steps: constructing a shore power network security operation and maintenance knowledge base, extracting multi-modal data related to shore power network security operation and maintenance from multiple data sources, dynamically generating a structured knowledge graph by utilizing the pre-trained large model and a preset cue word; performing lightweight fine tuning on the pre-trained large model by using an LISA method; and shore power network security operation and maintenance recommendation: based on the fine-tuned pre-trained large model, searching a related community abstract in a community structure of the knowledge graph by using a retrieval enhancement generation method, and generating an operation and maintenance suggestion or a security solution. According to the method, the network security protocol data, the operation and maintenance log and the user behavior data are analyzed to dynamically adapt to changes of the network security risk and the operation and maintenance environment, so that the operation security and reliability of the shore power system are improved, and the operation and maintenance efficiency and economic benefits are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power engineering informatization, and in particular to a shore power system network security operation and maintenance recommendation method. Background Art

[0002] With the automation construction of shore power systems, a large number of industrial control network terminal devices need to be connected to the shore power system. Since ports and terminals are usually open, shore power equipment is not suitable for closed operation and maintenance management. Therefore, the shore power network urgently needs an open and safe operation and maintenance method. In the context of the construction of new shore power network systems, the types of access equipment are more complex, the internal and external interactions are more frequent, and the boundaries are more blurred. The security monitoring and security protection of industrial control networks face the challenges of a wide variety of business types and increasing workload. In this case, it is difficult to ensure the safe and stable operation of the shore power network by simply relying on manual comprehensive system maintenance.

[0003] Therefore, how to provide a recommended method for shore power system network security operation and maintenance that can efficiently and specifically perform maintenance is a difficult problem that needs to be solved urgently in this field. Summary of the invention

[0004] The purpose of the present invention is to provide a shore power system network security operation and maintenance recommendation method. By analyzing the shore power system network security protocol data, user behavior logs and image data, etc., a multi-dimensional description of network events is made, and an open and dynamically updated shore power system network security operation and maintenance knowledge base is established. By building a multi-level community structure, problems can be quickly located, in-depth analysis can be performed from the global to the local, and targeted operation and maintenance solutions can be provided.

[0005] To achieve the above object, the present invention provides a shore power system network security operation and maintenance recommendation method, the steps comprising: S1. Build a knowledge base for shore power network security operation and maintenance, extract multimodal data related to shore power network security operation and maintenance from multiple data sources, and dynamically generate a structured knowledge graph using a pre-trained large model and preset prompt words; S2. Use the LISA method to perform lightweight fine-tuning on the pre-trained large model; S3, shore power network security operation and maintenance recommendation, based on the fine-tuned pre-trained large model, uses the retrieval enhancement generation method to find relevant community summaries in the community structure of the knowledge graph to generate operation and maintenance suggestions or security solutions.

[0006] Preferably, building a shore power network security operation and maintenance knowledge base in step S1 includes: S11. Collect data related to shore power network security operation and maintenance from various data sources, mainly including text data and image data; S12, segmenting the acquired text data and image data, and integrating the segmented data into the shore power network security operation and maintenance knowledge base to form structured data; S13, using the pre-trained large model and preset prompt words to extract information from the segmented text data and image data, extracting basic elements in the knowledge graph, including nodes, relationship edges and attributes, to construct a knowledge graph; S14. Manually verify the correctness of information in the knowledge graph, correct inaccurate or erroneous data, and update the knowledge graph; S15, generating a summary for each entity, wherein entities with high similarity are merged; S16. Use community detection algorithm to divide strongly associated knowledge graph nodes into communities to form multiple subgraphs, and generate multi-level community structures based on multiple subgraphs; S17. After the community detection is completed, a summary report is generated for each community, describing the overall situation of the entities in the community and the relationships between entities. The summary of each community is generated layer by layer from overview to details.

[0007] Preferably, the text data in step S11 includes network security protocol data, operation and maintenance logs, user behavior data, equipment operation reports, fault analysis documents and security incident reports, and the image data includes equipment monitoring images, panel status screenshots and fault site pictures.

[0008] Preferably, segmenting the acquired text data and image data in step S12 includes: Text data segmentation, dividing text data into multiple text blocks; Image data segmentation divides images into multiple batches based on time, device type, or event relevance.

[0009] Preferably, extracting information from text data and image data in step S13 includes: Text entity recognition: Use a pre-trained large model to analyze text blocks and extract key information and specific attributes. Key information includes device name, fault type, and network security events. Specific attributes include device status, fault occurrence time, and event impact range. Text relationship extraction: Identify the relationship between entities described in the text, express them through the edge of the knowledge graph, and attach relevant descriptions. The relationship between entities includes the association between backup and failure, and between protocol and attack behavior. Image entity recognition, using a pre-trained large model to extract important information about a device from an image, including its physical state and operating status; Combining image information and text: Match the entities recognized in the image with the entities in the text block to form a complete multimodal node.

[0010] Preferably, in step S16, each community represents a specific device group, network event or fault type.

[0011] Preferably, in step S2, using the LISA method to perform lightweight fine-tuning on the pre-trained large model includes: S21. Perform importance analysis on each layer of the pre-trained large model, measure the contribution of each layer to the operation and maintenance task, calculate the gradient of each layer weight, and determine the importance of the layer based on the gradient change. The more important the layer, the better it will be selected for update, while the less important layer will be randomly frozen. S22, select important layers for weight update through LISA method and randomly freeze unimportant layers; S23. According to the progress of training, the LISA method dynamically adjusts the importance of the layers, randomly samples unimportant layers each time for unfreezing, and updates the weights of the unfrozen layers.

[0012] Preferably, step S33 specifically includes: searching for relevant community summaries in the community hierarchy of the knowledge graph through a retrieval enhancement generation method, disrupting the community summaries and dividing them into multiple fragments, generating a preliminary answer for each fragment through a large model, calculating the relevance score of each preliminary answer, and combining answers with higher relevance to generate a final answer.

[0013] Therefore, the present invention adopts the above-mentioned shore power system network security operation and maintenance recommendation method, which has the following beneficial effects: (1) By analyzing the network security protocol data, user behavior logs and image data of the shore power system, a multi-dimensional description of network events is made, and an open and dynamically updated knowledge base for network security operation and maintenance of the shore power system is established to dynamically adapt to changes in network security risks and operation and maintenance environment, improve the operational safety and reliability of the shore power system, and enhance operation and maintenance efficiency and economic benefits; (2) By building a multi-level community structure, we can quickly locate problems, conduct in-depth analysis from the global to the local level, and provide targeted operation and maintenance solutions; (3) Use the LISA method to fine-tune the pre-trained large model, significantly reducing the consumption of computing resources while maintaining the excellent performance of the model in operation and maintenance tasks, which is suitable for operation and maintenance scenarios with limited resources; (4) A retrieval enhancement generation method is used to search from the shore power system network security operation and maintenance knowledge base, and personalized operation and maintenance suggestions or security solutions are generated based on the large model, which improves the accuracy and relevance of operation and maintenance recommendations.

[0014] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1is a flow chart of a method according to an embodiment of the present invention; Figure 2 A method architecture diagram of an embodiment of the present invention; Figure 3 The present invention is a schematic diagram of the process of building a shore power network security operation and maintenance knowledge base according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0017] Reference Figure 1 and Figure 2 The present invention provides a shore power system network security operation and maintenance recommendation method, the steps comprising: S1. Build a knowledge base for shore power network security operation and maintenance, extract multimodal data related to shore power network security operation and maintenance from multiple data sources, and use pre-trained large models and preset prompt words to dynamically generate structured knowledge graphs to lay the foundation for shore power system network security operation and maintenance recommendations.

[0018] The available pre-trained large models include but are not limited to Llama3.2, LLaMA-Adapter V2, and Qwen2-VL.

[0019] like Figure 3 As shown, the steps include: Get source data Data related to shore power network security operation and maintenance are collected from various data sources, mainly including text data and image data.

[0020] Text data includes but is not limited to network security protocol data, operation and maintenance logs, user behavior data, equipment operation reports, fault analysis documents and security incident reports. These text data provide important information support for the network security operation and maintenance of shore power systems.

[0021] Image data includes but is not limited to equipment monitoring images, panel status screenshots, and fault site pictures, etc. These image data provide intuitive visual information for identifying abnormal conditions of physical equipment.

[0022] Data segmentation The acquired text data and image data are segmented and integrated into the shore power network security operation and maintenance knowledge base to form structured data.

[0023] Text data segmentation: The text data is segmented into multiple text blocks to ensure that the text can provide support for node generation in the knowledge graph. It should be noted that the size of the text block is limited by the context window of the large model.

[0024] Image data segmentation: images are divided into multiple batches based on time, device type, or event relevance. For example, fault site images are divided into chronological order, and device monitoring images are grouped according to different types.

[0025] Get element instance The pre-trained large model and preset prompt words are used to extract information from the segmented text data and image data, and extract the basic elements in the knowledge graph, including nodes, relationship edges, and attributes. During information extraction, each round will check whether important entities or relationships are missed, and gradually improve the basic elements in the graph.

[0026] Entity recognition in text: Analyze text blocks through the ability of pre-trained large models to extract key information, such as device name, fault type, network security events, etc. Each entity has specific attributes, such as the status of the device, the time when the fault occurred, the scope of the event, etc.

[0027] Relationship extraction: Identify the relationships between entities described in the text, such as the association between equipment and faults, and between protocols and attack behaviors. These relationships are represented by edges in the knowledge graph and attached with relevant descriptions. For example: equipment and faults (such as circuit breakers and overloads), protocols and attack behaviors (such as network protocols and data leaks), operations and security events (such as user operations and intrusion attempts), etc.

[0028] Entity recognition in images: Use pre-trained large models to process image data and extract important information such as the physical state and operating status of the device from the image. For example, identify that the temperature of a faulty device is too high or an abnormal indicator light appears on the device panel.

[0029] Combining image information with text: The system matches entities identified in the image with entities in the text block. For example, the image information of a device (such as panel status, indicator light color) is combined with the device's operation log or fault report to form a complete multimodal node, ensuring that the entities in the knowledge graph contain rich multimodal information.

[0030] In this embodiment, the prompt word format for guiding the model to perform entity recognition and entity relationship recognition and processing is as follows.

[0031] Entity recognition prompt words: automatically select entities or predefine the entity set to be recognized based on the actual situation. Prompt words are used to identify key entities and their attributes in text or images. The format is {entity name, entity category, entity description}.

[0032] Prompt word example: "Please identify key entities and their attributes in the text or image, including device entities, fault entities, network entities, security event entities, etc. The format of each entity is {entity name, entity category, entity description}. For example: {"Device A", "Device", "Status: Normal"}." Identification example: "The following entities were identified: {"Device A", "Device", "Status: Normal"}, {"Device B", "Device", "Status: Failed"}." Entity relationship recognition prompt words: The model further identifies the associations between entities. The format is set as {starting entity, ending entity, relationship, relationship weight}, which is used to describe the interaction or dependency between different entities. When identifying entity relationships, weights are automatically assigned according to the strength of the association between entities. The weight value reflects the strength of the relationship. The weight value usually ranges from 0 to 1, and the higher the value, the stronger the association.

[0033] Prompt example: "Please identify the relationship between entities, including equipment and faults, protocols and attack behaviors, etc. The format of each relationship is {starting point entity, end point entity, relationship, relationship weight}, where "relationship" describes the connection between the two, and "relationship weight" indicates the strength of the relationship." Example of relation identification: "In the text, I identified the following relations: {"device A", "device B", "communication", "0.85"}, {"device A", "network A", "connection", "0.90"}, {"network protocol C", "data breach", "involved", "0.90"}." Manual verification Manually verify the correctness of the information in the knowledge graph. Professionals check the information in the knowledge graph, confirm the accuracy of information extraction, correct inaccurate or erroneous data, and update the knowledge graph to maintain data accuracy and reliability.

[0034] Generate element summary A summary is generated for each entity, where entities with high similarity are merged.

[0035] The extracted nodes and their relationships are analyzed using a pre-trained large model to generate a comprehensive summary that reflects explicit and implicit information, describes their attributes, roles, and associations with other entities, and links the summary to the corresponding node. In order to avoid entity duplication (such as an entity being referenced by different names in multiple contexts), similar entities are detected and entities with high similarity are merged to ensure that the nodes in the knowledge graph are unique and consistent. At the same time, the generated summary is processed using vectorized encoding technology to convert the attributes and relationships of the nodes into dense vector representations. In this way, the description of the node can be represented in a compact numerical form, and the relationship between entities is also modeled through vectorization, thereby improving the representation efficiency and retrieval capabilities of the knowledge graph.

[0036] Generate community graph The community detection algorithm is used to divide the strongly associated knowledge graph into communities to form multiple subgraphs. Each community represents a specific device group, network event or fault type, reflecting the close connection between the relevant entities in the operation and maintenance process. A multi-level community structure is generated based on multiple subgraphs; higher-level communities cover a wide range of concepts and problem domains, while lower-level communities focus on specific operation and maintenance details. This hierarchical structure supports knowledge queries from global to local.

[0037] Available community detection algorithms include but are not limited to the Girvan-Newman algorithm and the Leiden algorithm.

[0038] Generate community summary After the community detection is completed, a summary report is generated for each community, describing the overall situation of the entities in the community and their relationships. The community summary can help users quickly understand the security status or problem domain in a specific area and support further in-depth analysis. The summary of each community is generated layer by layer from overview to details. Users can quickly grasp the key topics by browsing the summaries of high-level communities, and then further drill down to view the details of low-level communities. The community summary can not only serve as an independent report to help users understand the safety status of the shore power system, but also as part of the knowledge graph index to quickly respond to users' operation and maintenance queries.

[0039] S2. Use the LISA method to perform lightweight fine-tuning on the pre-trained large model to meet the complex task requirements in shore power network security operation and maintenance scenarios. The steps include: S21. Layer importance analysis: Perform importance analysis on each layer of the pre-trained large model, measure the contribution of each layer to the operation and maintenance tasks, calculate the gradient size of each layer weight, and determine the importance of the layer based on the gradient change. The more important the layer, the higher the priority. The less important the layer, the random freezing of the less important layer.

[0040] S22. Select important layers for weight update and randomly freeze unimportant layers through the LISA method. LISA uses a dynamic sampling mechanism to update only the parameters of important layers, thereby reducing the computational burden of large-scale parameter updates. The frozen layers retain their original weights and do not consume additional computing resources.

[0041] S23. Based on the progress of training, the LISA method dynamically adjusts the importance of layers, randomly samples unimportant layers each time, unfreezes them, and updates the weights of the unfrozen layers. In the early stages, more important layers are updated frequently, while in the later stages, more layers may be dynamically activated or frozen to ensure that the large model always adapts to the current task requirements. This dynamic optimization enables the model to flexibly respond to constant changes in the operation and maintenance process and update the recommendation strategy in a timely manner based on new data.

[0042] In practical applications, the fine-tuning method LoRA is characterized by the fact that except for the top and bottom layers of the network, the weights of most intermediate layers are small. Therefore, LISA sets a lower sampling probability for the intermediate layers and controls the number of unfrozen layers through sampling strategies.

[0043] The layer thawing probability is set to ; in, is a factor that controls the number of unfreezing levels during the optimization process, is the number of layers in the model, and the top and bottom layers have a thaw probability of 1.0, ensuring that these layers are always updated.

[0044] In order to control memory consumption, LISA randomly samples several intermediate layers for unfreezing each time. By randomly sampling, LISA ensures that the number of unfrozen layers during training does not exceed the preset maximum value.

[0045] In each sampling period Internal The thawing of the intermediate layers, where the number of sampling layers is , and use the AdamW optimizer to update the weights of the unfrozen layers.

[0046] S3, shore power network security operation and maintenance recommendation, based on the fine-tuned pre-trained large model, uses the retrieval enhancement generation method to find relevant community summaries in the community structure of the knowledge graph to generate operation and maintenance suggestions or security solutions.

[0047] In this embodiment, the retrieval enhancement generation method is used to search for relevant community summaries in the community hierarchy of the knowledge graph, and the community summaries are disrupted and divided into multiple segments. A preliminary answer is generated for each segment through a large model, and each answer is scored. The relevance score of each preliminary answer is calculated to indicate the degree of help of the generated answer in answering the target question, and high-quality answers are screened out. The answers with high relevance are combined into the final context to generate the final answer, providing users with the best operation and maintenance suggestions or security solutions.

[0048] Therefore, the present invention adopts the above-mentioned shore power system network security operation and maintenance recommendation method, which can provide efficient and personalized operation and maintenance suggestions according to the user's operation and maintenance needs or system abnormalities, thereby improving operation and maintenance efficiency.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A shore power system network security operation and maintenance recommendation method, characterized in that the steps include: S1. Build a knowledge base for shore power network security operation and maintenance, extract multimodal data related to shore power network security operation and maintenance from multiple data sources, and dynamically generate a structured knowledge graph using a pre-trained large model and preset prompt words; S2. Use the LISA method to perform lightweight fine-tuning on the pre-trained large model; S3, shore power network security operation and maintenance recommendation, based on the fine-tuned pre-trained large model, uses the retrieval enhancement generation method to find relevant community summaries in the community structure of the knowledge graph to generate operation and maintenance suggestions or security solutions.

2. A shore power system network security operation and maintenance recommendation method according to claim 1, characterized in that: Step S1 constructs the shore power network security operation and maintenance knowledge base including: S11. Collect data related to shore power network security operation and maintenance from various data sources, mainly including text data and image data; S12, segmenting the acquired text data and image data, and integrating the segmented data into the shore power network security operation and maintenance knowledge base to form structured data; S13, using the pre-trained large model and preset prompt words to extract information from the segmented text data and image data, and extract the basic elements in the knowledge graph, including nodes, relationship edges and attributes, to construct the knowledge graph; S14. Manually verify the correctness of the information in the knowledge graph, correct inaccurate or erroneous data, and update the knowledge graph; S15, generating a summary for each entity, wherein entities with high similarity are merged; S16. Use community detection algorithm to divide strongly associated knowledge graph nodes into communities to form multiple subgraphs, and generate multi-level community structures based on multiple subgraphs; S17. After the community detection is completed, a summary report is generated for each community, describing the overall situation of the entities in the community and the relationships between entities. The summary of each community is generated layer by layer from overview to details.

3. A shore power system network security operation and maintenance recommendation method according to claim 2, characterized in that: The text data in step S11 includes network security protocol data, operation and maintenance logs, user behavior data, equipment operation reports, fault analysis documents and security incident reports, and the image data includes equipment monitoring images, panel status screenshots and fault site pictures.

4. A shore power system network security operation and maintenance recommendation method according to claim 3, characterized in that: The segmentation of the acquired text data and image data in step S12 includes: Text data segmentation, dividing text data into multiple text blocks; Image data segmentation divides images into multiple batches based on time, device type, or event relevance.

5. A shore power system network security operation and maintenance recommendation method according to claim 4, characterized in that: The information extraction from the text data and the image data in step S13 includes: Text entity recognition: Use a pre-trained large model to analyze text blocks and extract key information and specific attributes. Key information includes device name, fault type, and network security events. Specific attributes include device status, fault occurrence time, and event impact range. Text relationship extraction: Identify the relationship between entities described in the text, express them through the edge of the knowledge graph, and attach relevant descriptions. The relationship between entities includes the association between backup and failure, and between protocol and attack behavior. Image entity recognition, using a pre-trained large model to extract important information about a device from an image, including its physical state and operating status; Combining image information and text: Match the entities recognized in the image with the entities in the text block to form a complete multimodal node.

6. A shore power system network security operation and maintenance recommendation method according to claim 5, characterized in that: Step S16: Each community represents a specific device group, network event or fault type.

7. A shore power system network security operation and maintenance recommendation method according to claim 6, characterized in that: In step S2, the LISA method is used to perform lightweight fine-tuning on the pre-trained large model, including: S21. Perform importance analysis on each layer of the pre-trained large model, measure the contribution of each layer to the operation and maintenance task, calculate the gradient of each layer weight, and determine the importance of the layer based on the gradient change. The more important the layer, the better it will be selected for update, while the less important layer will be randomly frozen. S22, select important layers for weight update through LISA method and randomly freeze unimportant layers; S23. According to the progress of training, the LISA method dynamically adjusts the importance of the layers, randomly samples unimportant layers each time for unfreezing, and updates the weights of the unfrozen layers.

8. A shore power system network security operation and maintenance recommendation method according to claim 7, characterized in that: Step S33 specifically includes: searching for relevant community summaries in the community hierarchy of the knowledge graph through a retrieval enhancement generation method, disrupting the community summaries and dividing them into multiple fragments, generating a preliminary answer for each fragment through a large model, calculating the relevance score of each preliminary answer, and combining answers with higher relevance to generate a final answer.

Images