Network security perception early warning method and system for smart power plant

Abstract

The invention provides a network security perception early warning method and system for a smart power plant, and relates to the technical field of power plant network security early warning, and the method comprises the steps: reading a multi-source monitoring data set of a first time zone, carrying out the abnormality judgment of the multi-source monitoring data set, and carrying out the deviation calculation of the multi-source monitoring data set through employing a parameter reference value if an abnormality index is 0, and performing space-time mapping distribution on the plurality of parameter deviation values according to the position coordinates and the timestamps, constructing a network attack sequence diagram, performing abnormal association identification based on the network attack sequence diagram, determining a global attack chain, performing historical risk backtracking according to the global attack chain, and outputting a risk early warning level. The technical problem that the potential network security risk of the power plant is difficult to warn in time due to the lack of comprehensive monitoring and analysis of the overall network security state of various devices and systems in the power plant in the prior art is solved. The technical effects of overall network security situation awareness and timely potential risk early warning of multiple devices and systems in the smart power plant are achieved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security early warning for power plants, and in particular to a network security perception early warning method and system for smart power plants. Background Art

[0002] With the rapid development of smart power plants, equipment and systems are becoming increasingly complex, placing higher demands on the safe operation of power plants. However, most of the existing power plant early warning systems have limitations and can usually only monitor a specific system or network behavior, such as monitoring the operation of an industrial control system or an IoT device alone. Although this single-perspective monitoring method can guarantee the stable operation of some systems to a certain extent, it ignores the complex connections and mutual influences between the various devices and systems within the smart power plant as a whole, and is unable to analyze the overall network security status of the various devices and systems in the smart power plant from a global perspective, posing a hidden danger to the overall operation safety of the power plant.

[0003] The existing technology lacks comprehensive monitoring and analysis of the overall network security status of various equipment and systems in power plants, resulting in technical problems such as difficulty in timely warning of potential network security risks in power plants. Summary of the invention

[0004] The present application provides a network security perception and early warning method and system for a smart power plant, which is used to solve the technical problem that the existing technology lacks comprehensive monitoring and analysis of the overall network security status of various equipment and systems in the power plant, resulting in difficulty in timely early warning of potential network security risks in the power plant.

[0005] In view of the above problems, the present application provides a network security perception and early warning method and system for a smart power plant.

[0006] The first aspect of the present application provides a network security perception and early warning method for a smart power plant, the method comprising: reading a multi-source monitoring data set of the smart power plant in a first time zone, wherein the monitoring data is identified with a location coordinate and a timestamp; performing an abnormality judgment on the multi-source monitoring data set, and if the abnormality index is 0, performing deviation calculation on the multi-source monitoring data set using a parameter reference value to determine a plurality of parameter deviation values; performing spatiotemporal mapping distribution of the plurality of parameter deviation values ​​according to the location coordinates and timestamps to construct a network attack timing diagram; performing abnormal association identification based on the network attack timing diagram to determine a global attack chain, and performing historical risk backtracking based on the global attack chain to output a risk warning level.

[0007] The second aspect of the present application provides a network security perception and early warning system for a smart power plant, the system comprising: a data acquisition module, the data acquisition module is used to read a multi-source monitoring data set of the smart power plant in a first time zone, wherein the monitoring data is identified with a location coordinate and a timestamp; a data anomaly judgment module, the data anomaly judgment module is used to perform anomaly judgment on the multi-source monitoring data set, if the anomaly index is 0, the deviation of the multi-source monitoring data set is calculated using a parameter reference value to determine a plurality of parameter deviation values; a timing diagram construction module, the timing diagram construction module is used to perform spatiotemporal mapping distribution of the plurality of parameter deviation values ​​according to the location coordinates and timestamps, and construct a network attack timing diagram; a risk warning level acquisition module, the risk warning level acquisition module is used to perform anomaly association identification based on the network attack timing diagram, determine a global attack chain, and perform historical risk backtracking based on the global attack chain to output a risk warning level.

[0008] In a third aspect, the present application provides an electronic device, comprising: a memory for storing executable instructions; and a processor for implementing the steps of any one of the methods described in the first aspect when executing the executable instructions stored in the memory.

[0009] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method steps described in any one of the first aspects are implemented.

[0010] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0011] The method provided in the embodiment of the present application reads a multi-source monitoring data set of a smart power plant in the first time zone, wherein the monitoring data is identified with a location coordinate and a timestamp; performs an abnormality judgment on the multi-source monitoring data set, and if the abnormality index is 0, performs deviation calculation on the multi-source monitoring data set using a parameter reference value to determine multiple parameter deviation values; performs spatiotemporal mapping distribution of the multiple parameter deviation values ​​according to the location coordinates and timestamps to construct a network attack timing diagram; performs abnormal association identification based on the network attack timing diagram, determines a global attack chain, and performs historical risk backtracking based on the global attack chain to output a risk warning level. The technical effect of realizing overall network security situation awareness and timely warning of potential risks for multiple systems in a smart power plant through collaborative analysis of security data from different sources is achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0013] Figure 1 A flowchart of a network security perception and early warning method for a smart power plant provided in this application;

[0014] Figure 2 A schematic diagram of the structure of a network security perception and early warning system for a smart power plant provided in this application;

[0015] Figure 3 A schematic diagram of the structure of an electronic device provided in this application.

[0016] Explanation of the accompanying drawings: data acquisition module 11, data anomaly judgment module 12, time sequence diagram construction module 13, risk warning level acquisition module 14, input device 401, processor 402, memory 403, output device 404. DETAILED DESCRIPTION

[0017] This application provides a network security perception and early warning method and system for a smart power plant, which is used to solve the technical problem that the prior art lacks comprehensive monitoring and analysis of the overall network security status of multiple devices and systems in the power plant, resulting in difficulty in timely early warning of potential network security risks in the power plant. The technical effect of achieving overall network security situation awareness and timely early warning of potential risks for multiple systems in the smart power plant through collaborative analysis of security data from different sources is achieved.

[0018] Below, the technical solutions in the present invention will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments of the present invention. It should be understood that the present invention is not limited to the example embodiments described herein. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. It should also be noted that, for the convenience of description, only the parts related to the present invention are shown in the accompanying drawings, rather than all of them.

[0019] Embodiment 1, as Figure 1 As shown, the present application provides a network security perception and early warning method for a smart power plant, the method comprising:

[0020] The multi-source monitoring data set of the smart power plant in the first time zone is read, wherein the monitoring data is identified with location coordinates and timestamps.

[0021] Specifically, first, a variety of sensors and data acquisition devices are used to obtain real-time data generated by multiple devices in the first time zone from various types of equipment in the smart power plant. Sensors such as temperature sensors for monitoring temperature changes of power plant equipment (such as generators and transformers), voltage and current sensors for monitoring the working status of power equipment, video monitoring devices for real-time monitoring of key areas of the power plant, network traffic monitors for monitoring network traffic conditions inside the smart power plant, and equipment log recorders, etc. Then these data are sorted in chronological order to form a multi-source monitoring data set in the same time period, that is, the first time zone. The specific duration of the time period is determined according to the monitoring requirements. The first time zone is mainly used to distinguish and classify data at different time points to ensure that the data in the same time zone has temporal consistency. The multi-source monitoring data set includes multiple equipment systems such as network traffic, equipment status, and operation logs distributed in the smart power plant. Each monitoring data in the multi-source monitoring data set has a location coordinate and a timestamp. The location coordinate is used to locate the specific collection location of the data, such as the location of a certain power equipment or the geographical location of the data sensor. The timestamp refers to the time recorded for each piece of monitoring data, which is used to reflect the timeliness and accuracy of data collection. The timestamp is a sequence of characters or coded information. By acquiring multi-source monitoring data sets including location coordinates and timestamps, real-time monitoring and precise analysis of the power plant's operating status can be achieved, providing accurate and reliable data support for network security situation analysis and risk warning of smart power plants.

[0022] An abnormality judgment is performed on the multi-source monitoring data set. If the abnormality index is 0, a deviation calculation is performed on the multi-source monitoring data set using a parameter reference value to determine a plurality of parameter deviation values.

[0023] Specifically, the data in the multi-source monitoring data set from multiple sources are compared and analyzed with the abnormal standards to detect whether there is data information of abnormal conditions. The judgment process involves multiple indicators, such as the temperature, vibration, sudden increase or decrease of network traffic of the equipment, etc. If the data abnormality is detected through analysis, the abnormal indicator is recorded. When the abnormal indicator in the multi-source monitoring data set is 0 through judgment and analysis, that is, no abnormality is detected, then the deviation of each data in the multi-source monitoring data set is calculated based on the parameter reference value. The parameter reference value refers to the reference value set according to historical data or parameters under normal operating conditions, for example, the normal range of temperature range, voltage, and current of the equipment under normal operating conditions. By comparing the collected monitoring data with the reference value, multiple parameter deviation values ​​are calculated, and the parameter deviation value refers to the difference between the current monitoring data and the reference value. By calculating the parameter deviation value for the monitoring data without abnormalities, potential threats that do not show obvious abnormalities can be identified to ensure the safe and efficient operation of various equipment in smart power plants.

[0024] Furthermore, anomaly judgment is performed on the multi-source monitoring data set, including: obtaining a historical monitoring data set of a preset period; performing network environment fluctuation and historical attack trend analysis based on the historical monitoring data set, and adaptively correcting the parameter warning threshold according to the analysis result to obtain a dynamic warning threshold; anomaly judgment is performed on the multi-source monitoring data set according to the dynamic warning threshold, and anomaly indicators are captured. If the anomaly indicator is not 0, a network risk warning is performed based on the anomaly indicator.

[0025] Specifically, the existing power plant early warning is generally based on a fixed set of rules or models, and cannot be adaptively adjusted according to changes in the network environment, resulting in the system's lack of flexibility in the face of changing attack patterns or new threats, and the inability to dynamically adjust detection rules or strategies to respond to emerging threats. This application first obtains a historical monitoring data set for a preset period, and the preset period is a time range set in the historical data according to actual needs, such as data in the past few days or weeks. By obtaining historical data within this period, a comprehensive analysis of the device behavior and network activities of the smart power plant in different time periods can be performed. Then, the network environment fluctuations and historical attack trends are analyzed based on the historical monitoring data set. The network environment fluctuations refer to the dynamic changes in behaviors such as communication traffic and device interaction in the network. Analyzing network environment fluctuations can identify the change pattern in the normal operation of the power plant and avoid false alarms. The historical attack trend analysis refers to analyzing the attack events recorded in the history and identifying the behavior patterns of historical attacks, including attack types, attack times, and attack methods. According to the analysis results of the network environment fluctuations and historical attack trends, the set parameter warning threshold is adaptively corrected. The parameter warning threshold refers to the numerical standard set for judging whether the device or network is in an abnormal state. Through adaptive correction, the parameter warning threshold can be dynamically adjusted according to the actual network situation to obtain a dynamic warning threshold. For example, if the network environment fluctuates greatly, the threshold can be appropriately relaxed to avoid frequent false alarms; conversely, if the historical attack trend indicates a potential threat, the threshold can be appropriately tightened to capture attack signs in advance. Then, based on the dynamic warning threshold, the data in the current multi-source monitoring data set are judged as abnormal. If a parameter exceeds the dynamic threshold range, it means that the parameter is abnormal data, and the corresponding abnormal indicator is captured. When the detection of abnormal indicators in the multi-source monitoring data set, that is, the abnormal indicator is not 0, it means that there may be risks or attacks in the current equipment or network of the power plant. According to the abnormal indicator, the corresponding network risk warning is triggered. Through this adaptive adjustment, anomalies can be captured more accurately, and more accurate risk warnings can be provided when the actual network environment changes, helping smart power plants to respond to risks in a timely manner, take measures to prevent the spread of potential attacks or faults, and ensure the safe operation of power plants.

[0026] The multiple parameter deviation values ​​are distributed in time and space according to the position coordinates and timestamps to construct a network attack timing diagram.

[0027] Furthermore, the multiple parameter deviation values ​​are time-space mapped and distributed according to the position coordinates and timestamps to construct a network attack timing diagram, including: in a three-dimensional simulation space, the multiple parameter deviation values ​​are spatially mapped according to the position coordinates to construct an abnormal parameter distribution; the timestamps are classified according to predetermined time zones to determine a plurality of attack time zones; the abnormal parameter distribution is divided based on the plurality of attack time zones to determine a plurality of attack feature graphs, and the plurality of attack feature graphs are sequentially arranged to generate the network attack timing diagram.

[0028] Specifically, the calculated multiple parameter deviation values ​​are processed, and the multiple parameter deviation values ​​are subjected to spatiotemporal mapping analysis according to their position coordinates and timestamps, that is, in a three-dimensional simulation space, the multiple parameter deviation values ​​are distributed in corresponding time and space positions, and the three-dimensional space refers to a virtual simulation environment for spatial mapping and visualization of monitoring data of multiple devices or systems in a smart power plant. First, in the three-dimensional simulation space, the multiple parameter deviation values ​​are spatially mapped according to the position coordinates, the abnormal parameters of different physical positions are visualized, and an abnormal parameter distribution map is constructed, which is used to display the abnormal conditions of each device or system in the smart power plant. For example, if the temperature of a certain device deviates, in the three-dimensional space, the spatial position of the device is associated with the corresponding abnormal temperature deviation value, and the specific spatial distribution of the device abnormality is presented. Through projection, it can intuitively reflect which areas in the power plant have abnormal conditions. Then, according to the predetermined time zone, the data is classified according to the timestamp, and the multiple parameter deviation values ​​are divided into different attack time zones. The attack time zone is to segment the timestamp according to the set time step, and each time period is a time zone. For example, different time zones can be divided into units such as hours or minutes, and the abnormal data set in each time zone will be used as a representative of an attack or potential risk. Finally, according to the multiple attack time zones divided, the abnormal parameter distribution in each time zone is further divided to generate multiple attack feature graphs, which refer to the abnormal parameter distribution in different devices or systems in each time period. For example, in a certain time zone, if multiple devices have different degrees of parameter deviation values ​​at the same time, these abnormal conditions will be drawn into an attack feature graph to show the abnormal conditions of the devices in the time period. Each feature graph corresponds to a different time zone and shows the abnormal characteristics in a specific time period. Finally, multiple attack feature graphs are arranged in chronological order to generate a complete network attack sequence diagram, which shows the abnormal conditions of the equipment or network in different time zones of the smart power plant, which can not only show the current abnormal distribution, but also identify the propagation path of the attack. By constructing a network attack sequence diagram, the smart power plant can more accurately understand the temporal and spatial associations of complex attacks and respond promptly and accurately.

[0029] Based on the network attack timing diagram, abnormal association identification is performed to determine the global attack chain, and historical risk backtracking is performed based on the global attack chain to output the risk warning level.

[0030] Furthermore, abnormal correlation identification is performed based on the network attack timing diagram to determine a global attack chain, including: based on the power equipment correlation map, abnormal correlation identification is performed on the network attack timing diagram to determine timing correlation features, spatial correlation features and parameter similarity features; attack chain identification is performed according to the timing correlation features, spatial correlation features and parameter similarity features to determine the timing attack chain, spatial attack chain and parameter attack chain; the timing attack chain, spatial attack chain and parameter attack chain are merged to output the global attack chain.

[0031] Specifically, combined with the power equipment association map, according to the network attack timing diagram, by performing time series analysis on the monitoring data of multiple devices and systems in the network, the anomalies between different time periods and devices are associated and identified, and the associations that exist in time, space and parameter characteristics are obtained, namely, time series association characteristics, space association characteristics and parameter similarity characteristics. The power equipment association map describes the logical relationship and interdependence of various equipment systems in the smart power plant. For example, the operating status of a generator and transformer may be closely related. The abnormal association between devices can be identified through the equipment association map. The temporal correlation feature refers to the temporal correlation of abnormal events of multiple devices or systems in the network attack time sequence diagram. By analyzing the temporal sequence of abnormal events, it is determined whether there is temporal continuity of the attack behavior. The spatial correlation feature refers to the connection between multiple abnormal events in physical space. By combining the location coordinates of the device, the geographical distribution between devices can be analyzed to determine whether the abnormality has a propagation trend in space. The parameter similarity feature refers to the parameter deviation values ​​of abnormal events between different devices or systems have similar change patterns. For example, the temperature, pressure, flow and other parameters of multiple devices deviate from the normal value in a similar time period, and the deviation amplitude and direction are similar, which indicates that these devices may be affected by the same type of attack or failure. By analyzing these parameter similarities, the correlation between abnormal events can be further confirmed. Then, by analyzing the temporal correlation feature, the continuous path of the attack in the time dimension is identified, and the temporal attack chain is obtained. By analyzing the spatial correlation feature, the diffusion path of the attack in the spatial dimension is identified, and the spatial attack chain is obtained. By analyzing the parameter similarity feature, the correlation of multiple devices or systems in parameter anomalies is identified, and the parameter attack chain is obtained. After obtaining the timing attack chain, spatial attack chain and parameter attack chain, these chains are merged to generate a complete global attack chain, which includes the relevance of attacks from multiple angles of time, space and parameters. By obtaining the global attack chain, we can fully understand the propagation path, impact range and potential impact of smart power plant attacks, detect potential threats that do not show obvious abnormalities in a single system, especially complex attack behaviors across systems, and identify potential attack chains, helping smart power plants respond to risks in a timely manner, take measures to prevent the spread of potential attacks or faults, and ensure the safe and efficient operation of power plants.

[0032] Furthermore, the temporal attack chain, the spatial attack chain and the parameter attack chain are integrated to output the global attack chain, including: performing spatiotemporal integration on the temporal attack chain and the spatial attack chain, performing time parameter integration on the temporal attack chain and the parameter attack chain, performing space parameter integration on the spatial attack chain and the parameter attack chain, and determining the spatiotemporal attack chain, the time parameter attack chain and the space parameter attack chain; querying the historical network attack log to obtain the historical attack data set, and randomly selecting the first historical attack data from the historical attack data set, wherein the first historical attack data includes the first spatiotemporal attack chain, the first A time parameter attack chain, a first empty parameter attack chain and a first global attack chain; respectively perform similarity traversal on the time-space attack chain and the first time-space attack chain, the time parameter attack chain and the first time parameter attack chain, the empty parameter attack chain and the first empty parameter attack chain to determine a first similarity, a second similarity and a third similarity; if the first similarity, the second similarity and the third similarity all meet the similarity index, add the first global attack chain to the high-frequency global attack chain set, perform mode extraction on the high-frequency global attack chain set, and output the first global attack chain; determine the global attack chain based on the analysis of the first global attack chain.

[0033] Specifically, first, the time-series attack chain and the space-series attack chain are fused in time and space, and the time-series fusion is to combine the attack chains in the time dimension and the space dimension. By associating the attack events in time with the corresponding device geographic location, the time-series attack chain is determined, and the time-series attack chain is used to describe the spatial path of the attack propagation in the smart power plant as time progresses. Next, the time-series attack chain and the parameter attack chain are fused in time and parameter, and the time-series attack chain and the parameter attack chain are fused. The time-series attack chain and the parameter attack chain are fused to obtain the time-series attack chain, which can identify the consistency of the parameter changes in time and confirm whether the attack shows similar trends in the parameters of multiple devices. Then, the space-series attack chain and the parameter attack chain are fused in space and parameter, and the space-series attack chain and the parameter attack chain are fused. The space-series attack chain and the parameter attack chain are fused in space and parameter, which refers to combining the changes in the spatial position and the device parameters to determine whether the devices in the same physical area have similar abnormalities in the parameters. Through the space-series fusion, the space-series attack chain is obtained, and the relationship between multiple devices in a specific area in the parameter dimension can be identified.

[0034] After completing the fusion of space-time, time parameter and space parameter, query the historical network attack log to obtain the previously recorded historical attack data set, which includes the historical network attacks and their corresponding time series, space and parameter features. Randomly select a first historical attack data from the historical attack data set, and the first historical attack data includes the first space-time attack chain, the first time parameter attack chain, the first space parameter attack chain and the first global attack chain. Then, the currently identified and selected space-time attack chain and the first space-time attack chain, the time parameter attack chain and the first time parameter attack chain, the space parameter attack chain and the first space parameter attack chain are respectively traversed similarly. The similar traversal refers to comparing the similarity of the current attack chain and the historical attack chain one by one in the time, space and parameter dimensions, combining multiple algorithms, such as Euclidean distance, dynamic time warping, Pearson correlation coefficient, etc., to determine their respective similarities, and obtain the first similarity of the space-time attack chain, the second similarity of the time parameter attack chain and the third similarity of the space parameter attack chain through traversal. The first similarity, the second similarity and the third similarity are compared with the similarity index, and the similarity index refers to the preset threshold range. When the first similarity, the second similarity and the third similarity are all within the preset threshold range, it means that the first similarity, the second similarity and the third similarity all meet the similarity index, then the first global attack chain is added to the high-frequency global attack chain set, and the high-frequency global attack chain set is a set, which includes the high-frequency attack chains detected by the smart power plant. These high-frequency attack chains have similar characteristics in historical attack events, indicating attack modes that may appear frequently. Then, based on the high-frequency global attack chain set, multiple attack chains are extracted in mode, and the most frequently occurring chains are extracted to generate a representative first global attack chain. The first global attack chain has broad representativeness and consistency, reflecting the most common or most likely attack mode in the smart power plant. Finally, based on the first global attack chain, combined with the currently identified attack features, a global attack chain is obtained, which can fully display the propagation path and characteristics of the smart power plant attack in the time, space and parameter dimensions, and provides comprehensive attack chain identification and early warning capabilities for the network security of the smart power plant.

[0035] Furthermore, the global attack chain is determined based on the analysis of the first global attack chain, including: taking the smart power plant as the constraint feature, obtaining a sample spatiotemporal attack chain set, a sample time parameter attack chain set, a sample empty parameter attack chain set and a sample global attack chain set through big data retrieval; training a decision forest with the sample spatiotemporal attack chain set, the sample time parameter attack chain set, the sample empty parameter attack chain set and the sample global attack chain set to obtain an attack chain fusion plug-in; using the attack chain fusion plug-in to perform a fusion analysis on the spatiotemporal attack chain, the time parameter attack chain and the empty parameter attack chain, and output a second global attack chain; fitting the first global attack chain and the second global attack chain to output the global attack chain.

[0036] Specifically, the smart power plant is used as a constraint feature, and the attack chain data set related to the current smart power plant is obtained through big data retrieval, including sample spatiotemporal attack chain set, sample time parameter attack chain set, sample empty parameter attack chain set and sample global attack chain set. These sample sets are extracted from historical attack data, similar attack scenarios or monitoring data of related equipment, and are used as reference data for current attack chain analysis. Each sample set contains attack chain information in different dimensions, such as features in time, space and parameter dimensions. Then, the retrieved sample spatiotemporal attack chain set, sample time parameter attack chain set, sample empty parameter attack chain set and sample global attack chain set are used as training data to train the decision forest model and obtain the attack chain fusion plug-in. The decision forest is an integrated learning algorithm composed of multiple decision trees that can make judgments on different data dimensions. Through training with multiple sample sets, the decision forest can learn how to identify patterns and features in multi-dimensional attack chain data. Using the trained attack chain fusion plug-in, the spatiotemporal attack chain, the time parameter attack chain and the space parameter attack chain are fused and analyzed, and the attack chains in the time, space and parameter dimensions are comprehensively analyzed to determine whether there is an interactive correlation between the attack features of different dimensions. For example, if an attack event occurs in time sequence, and then the parameters of multiple devices are also abnormal, and the location distribution of these devices shows a certain spatial regularity, the correlation between these dimensions can be determined through fusion analysis, and a more comprehensive second global attack chain is output. Finally, the second global attack chain and the first global attack chain identified previously are fitted and analyzed. By comparing the time, space and parameter characteristics of the first global attack chain and the second global attack chain, the similarities or differences between the two are obtained, and the common features in the two attack chains are combined to generate a more comprehensive and accurate global attack chain. The global attack chain integrates information from all dimensions, showing the propagation path of the attack in time, the diffusion route in space, and the trend of parameter changes of each device. Through the global attack chain, not only can the starting point and propagation path of the attack be identified, but also the potential targets and risks of the attack can be predicted, providing comprehensive support for the safety protection of smart power plants.

[0037] Furthermore, historical risk backtracking is performed according to the global attack chain to output the risk warning level, including: querying historical network attack logs according to the global attack chain to obtain risk event probability, wherein the risk event probability is the ratio of the number of risk events to the number of attack events; inputting the risk event probability into a preset probability-level comparison table, and matching and outputting the risk warning level.

[0038] Specifically, according to the global attack chain, the historical network attack log stored in the database is queried. The global attack chain contains multi-dimensional attack information, such as the association of time, space and parameters, which can show the overall propagation path of the attack. By comparing these chain information with the historical attack logs, it is possible to trace back and locate events similar to or related to the current attack chain in the historical records. In the historical network attack logs, risk events matching the global attack chain are extracted. The risk events are attack events or abnormal behaviors that have been recorded and confirmed in the historical data, and then the occurrence frequency of the risk events is counted to calculate the probability of the risk events. The probability of the risk event is calculated by comparing the number of occurrences of the risk event with the total number of corresponding attack events. The degree of risk in each attack mode can be quantified by calculating the probability of the risk event. The calculated probability of the risk event is input into a preset probability-level comparison table. The probability-level comparison table is a mapping relationship table pre-defined according to the safety strategy, historical data, expert experience, etc. of the smart power plant, which is used to match different risk event probabilities with corresponding risk warning levels. Different probability intervals will correspond to different risk levels, such as low, medium, high, severe and other levels. For example, the higher the probability value, the greater the risk caused by this type of attack, and the higher the corresponding risk warning level. By querying the probability-level comparison table, the risk event probability is matched with the warning level, and the corresponding risk warning level is output. For example, if the probability of a risk event for a certain type of attack event exceeds 70%, it may correspond to a high risk warning level, and if the probability is lower, it may correspond to a low or medium risk level. Through this matching method, the possibility of risk events can be quantified, and a more accurate risk assessment level can be provided to ensure that the risk assessment results can comprehensively and accurately reflect the actual threat level under the current attack chain, helping smart power plants to promptly identify and respond to potential network security threats, and ensure the safe and efficient operation of power plants.

[0039] Embodiment 2 is based on the same inventive concept as the network security perception and early warning method of a smart power plant in the above embodiment. Figure 2 As shown, the present application provides a network security perception and early warning system for a smart power plant, the system comprising:

[0040] A data acquisition module 11, the data acquisition module 11 is used to read the multi-source monitoring data set of the smart power plant in the first time zone, wherein the monitoring data is identified with a location coordinate and a timestamp; a data anomaly judgment module 12, the data anomaly judgment module 12 is used to perform anomaly judgment on the multi-source monitoring data set. If the anomaly index is 0, the deviation of the multi-source monitoring data set is calculated using the parameter reference value to determine multiple parameter deviation values; a timing diagram construction module 13, the timing diagram construction module 13 is used to perform spatiotemporal mapping distribution of the multiple parameter deviation values ​​according to the location coordinates and timestamps, and construct a network attack timing diagram; a risk warning level acquisition module 14, the risk warning level acquisition module 14 is used to perform anomaly association identification based on the network attack timing diagram, determine the global attack chain, and perform historical risk backtracking based on the global attack chain to output the risk warning level.

[0041] Furthermore, the data anomaly judgment module 12 includes: a historical data acquisition unit, which is used to obtain a historical monitoring data set of a preset period; a historical data analysis unit, which is used to perform network environment fluctuation and historical attack trend analysis based on the historical monitoring data set, and adaptively correct the parameter warning threshold according to the analysis result to obtain a dynamic warning threshold; an abnormal indicator capture unit, which is used to perform anomaly judgment on the multi-source monitoring data set according to the dynamic warning threshold, capture abnormal indicators, and if the abnormal indicators are not 0, perform a network risk warning based on the abnormal indicators.

[0042] Furthermore, the timing diagram construction module 13 includes: an abnormal parameter distribution construction unit, which is used to spatially map the multiple parameter deviation values ​​according to the position coordinates in the three-dimensional simulation space to construct an abnormal parameter distribution; a timestamp classification unit, which is used to classify the timestamps according to predetermined time zones to determine multiple attack time zones; an abnormal parameter distribution division unit, which is used to divide the abnormal parameter distribution based on the multiple attack time zones to determine multiple attack feature graphs, and arrange the multiple attack feature graphs in sequence to generate the network attack timing diagram.

[0043] Furthermore, the risk warning level acquisition module 14 includes: an abnormal correlation identification unit, which is used to perform abnormal correlation identification on the network attack timing diagram based on the power equipment correlation map, and determine the timing correlation characteristics, spatial correlation characteristics and parameter similarity characteristics; an attack chain identification unit, which is used to perform attack chain identification according to the timing correlation characteristics, spatial correlation characteristics and parameter similarity characteristics, and determine the timing attack chain, spatial attack chain and parameter attack chain; a data fusion unit, which is used to fuse the timing attack chain, spatial attack chain and parameter attack chain, and output the global attack chain.

[0044] Furthermore, the data fusion unit is used to perform the following steps: perform spatiotemporal fusion on the temporal attack chain and the spatial attack chain, perform time-parameter fusion on the temporal attack chain and the parameter attack chain, perform space-parameter fusion on the spatial attack chain and the parameter attack chain, and determine the spatiotemporal attack chain, the time-parameter attack chain, and the space-parameter attack chain; query the historical network attack log, obtain the historical attack data set, and randomly select the first historical attack data in the historical attack data set, wherein the first historical attack data includes the first spatiotemporal attack chain, the first time-parameter attack chain, the first space-parameter attack chain, and the first global attack chain; perform similar traversal on the spatiotemporal attack chain and the first spatiotemporal attack chain, the time-parameter attack chain and the first time-parameter attack chain, the space-parameter attack chain and the first space-parameter attack chain, respectively, to determine the first similarity, the second similarity, and the third similarity; if the first similarity, the second similarity, and the third similarity all meet the similarity index, add the first global attack chain to the high-frequency global attack chain set, perform mode extraction on the high-frequency global attack chain set, and output the first global attack chain; determine the global attack chain based on the first global attack chain analysis.

[0045] Furthermore, the data fusion unit is also used to perform the following steps: taking the smart power plant as the constraint feature, the big data retrieves and obtains the sample spatiotemporal attack chain set, the sample time parameter attack chain set, the sample empty parameter attack chain set and the sample global attack chain set; the decision forest is trained with the sample spatiotemporal attack chain set, the sample time parameter attack chain set, the sample empty parameter attack chain set and the sample global attack chain set to obtain an attack chain fusion plug-in; the attack chain fusion plug-in is used to perform a fusion analysis on the spatiotemporal attack chain, the time parameter attack chain and the empty parameter attack chain, and output a second global attack chain; the first global attack chain and the second global attack chain are fitted, and the global attack chain is output.

[0046] Furthermore, the risk warning level acquisition module 14 includes: a risk event probability acquisition unit, which is used to query the historical network attack log according to the global attack chain to obtain the risk event probability, wherein the risk event probability is the ratio of the number of risk events to the number of attack events; a risk warning level matching unit, which is used to input the risk event probability into a preset probability-level comparison table and match and output the risk warning level.

[0047] Although the present application makes various references to certain modules in the device according to the embodiments of the present application, any number of different modules may be used and run on the user terminal and / or server, and the various units and modules included are only divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of the functional units are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.

[0048] Embodiment three, based on the above embodiments, the present application also provides an electronic device and a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by the processor of the electronic device, it can implement the method described in any of the above embodiments.

[0049] Figure 3 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, showing a block diagram of an exemplary electronic device suitable for implementing an implementation of the present invention. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention. The electronic device is in the form of a general computing device, and its components may include but are not limited to an input device 401, a processor 402, a memory 403, and an output device 404. Among them, the processor 402 may be one or more; the memory 403 may include a computer-readable medium and at least one program product, and the program product has a set (at least one) of program modules, which are configured to perform the functions of each embodiment of the present application.

[0050] The memory 403 shown in the embodiment of the present invention may adopt any combination of one or more computer-readable media; the computer-readable storage medium may be but is not limited to infrared, semiconductor devices, devices or components, or any combination of the above, for storing software programs, computer executable programs and modules, such as the program instructions / modules corresponding to the network security perception and early warning method for a smart power plant in the embodiment of the present invention. The processor 402 executes various functional applications and data processing of the computer device by running the software programs, instructions and modules stored in the memory 403, thereby realizing the above-mentioned network security perception and early warning method for a smart power plant.

[0051] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0052] This specification and the drawings are merely exemplary illustrations of the present application and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalents, the present application intends to include these modifications and variations.

Claims

1. A network security perception and early warning method for a smart power plant, characterized in that: include: Read the multi-source monitoring data set of the smart power plant in the first time zone, where the monitoring data is marked with location coordinates and timestamps; Anomaly judgment is performed on the multi-source monitoring data set. If the anomaly index is 0, deviation calculation is performed on the multi-source monitoring data set using parameter reference values ​​to determine multiple parameter deviation values; Performing spatiotemporal mapping distribution of the plurality of parameter deviation values ​​according to the position coordinates and timestamps to construct a network attack timing diagram; Based on the network attack timing diagram, abnormal association identification is performed to determine the global attack chain, and historical risk backtracking is performed based on the global attack chain to output the risk warning level.

2. According to claim 1, a network security perception and early warning method for a smart power plant is characterized in that: Performing abnormality judgment on the multi-source monitoring data set includes: Obtain historical monitoring data sets for a preset period; Based on the historical monitoring data set, the network environment fluctuation and historical attack trend analysis are performed, and the parameter warning threshold is adaptively corrected according to the analysis result to obtain a dynamic warning threshold; An abnormality judgment is performed on the multi-source monitoring data set according to the dynamic warning threshold, and an abnormal indicator is captured. If the abnormal indicator is not 0, a network risk warning is performed based on the abnormal indicator.

3. The network security perception and early warning method of a smart power plant according to claim 1 is characterized in that: The plurality of parameter deviation values ​​are distributed in time and space according to the position coordinates and timestamps to construct a network attack timing diagram, including: In the three-dimensional simulation space, spatially mapping the plurality of parameter deviation values ​​according to the position coordinates to construct abnormal parameter distribution; Classifying the timestamps according to predetermined time zones to determine a plurality of attack time zones; The abnormal parameter distribution is divided based on the multiple attack time zones, a plurality of attack feature graphs are determined, and the multiple attack feature graphs are arranged in sequence to generate the network attack timing diagram.

4. The network security perception and early warning method of a smart power plant according to claim 3 is characterized in that: Based on the network attack sequence diagram, abnormal correlation identification is performed to determine the global attack chain, including: Based on the power equipment association map, abnormal association identification is performed on the network attack timing diagram to determine the timing association features, spatial association features and parameter similarity features; According to the temporal correlation features, spatial correlation features and parameter similarity features, attack chains are identified respectively to determine a temporal attack chain, a spatial attack chain and a parameter attack chain; The temporal attack chain, the spatial attack chain and the parameter attack chain are fused to output the global attack chain.

5. The network security perception and early warning method of a smart power plant according to claim 4 is characterized in that: The temporal attack chain, the spatial attack chain and the parameter attack chain are integrated to output the global attack chain, including: Performing spatiotemporal fusion on the temporal attack chain and the spatial attack chain, performing time-parameter fusion on the temporal attack chain and the parameter attack chain, and performing space-parameter fusion on the spatial attack chain and the parameter attack chain to determine a spatiotemporal attack chain, a time-parameter attack chain, and a space-parameter attack chain; Query the historical network attack log to obtain a historical attack data set, and randomly select the first historical attack data from the historical attack data set, wherein the first historical attack data includes a first spatiotemporal attack chain, a first time parameter attack chain, a first empty parameter attack chain, and a first global attack chain; Performing similarity traversal on the spatiotemporal attack chain and the first spatiotemporal attack chain, the time parameter attack chain and the first time parameter attack chain, and the empty parameter attack chain and the first empty parameter attack chain respectively, and determining a first similarity, a second similarity, and a third similarity; If the first similarity, the second similarity, and the third similarity all meet the similarity index, adding the first global attack chain to the high-frequency global attack chain set, performing mode extraction on the high-frequency global attack chain set, and outputting the first global attack chain; The global attack chain is determined based on the first global attack chain analysis.

6. The network security perception and early warning method of a smart power plant according to claim 5 is characterized in that: Determining the global attack chain based on the first global attack chain analysis includes: Taking the smart power plant as the constraint feature, big data retrieval obtains the sample spatiotemporal attack chain set, sample time parameter attack chain set, sample space parameter attack chain set and sample global attack chain set; Training the decision forest with the sample spatiotemporal attack chain set, the sample time parameter attack chain set, the sample space parameter attack chain set and the sample global attack chain set to obtain an attack chain fusion plug-in; Using the attack chain fusion plug-in to perform fusion analysis on the spatiotemporal attack chain, the time parameter attack chain and the space parameter attack chain, and output a second global attack chain; The first global attack chain and the second global attack chain are fitted, and the global attack chain is output.

7. The network security perception and early warning method of a smart power plant according to claim 1 is characterized in that: According to the global attack chain, historical risk backtracking is performed to output risk warning levels, including: Query the historical network attack log according to the global attack chain to obtain the risk event probability, wherein the risk event probability is the ratio of the number of risk events to the number of attack events; The risk event probability is input into a preset probability-level comparison table, and the risk warning level is matched and output.

8. A network security perception and early warning system for a smart power plant, characterized in that: The system comprises: A data acquisition module, the data acquisition module is used to read a multi-source monitoring data set of the smart power plant in the first time zone, wherein the monitoring data is identified with a location coordinate and a timestamp; A data anomaly judgment module, wherein the data anomaly judgment module is used to judge anomalies of the multi-source monitoring data set. If the anomaly index is 0, a deviation calculation is performed on the multi-source monitoring data set using a parameter reference value to determine a plurality of parameter deviation values; A timing diagram construction module, the timing diagram construction module is used to perform spatiotemporal mapping distribution of the multiple parameter deviation values ​​according to the position coordinates and timestamps to construct a network attack timing diagram; The risk warning level acquisition module is used to identify abnormal associations based on the network attack sequence diagram, determine the global attack chain, perform historical risk backtracking based on the global attack chain, and output the risk warning level.

9. An electronic device, characterized in that: The electronic device comprises: a memory for storing executable instructions; and a processor for implementing the steps of the method according to any one of claims 1 to 7 when executing the executable instructions stored in the memory.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the method steps according to any one of claims 1 to 7.

Images