Power network security event linkage response and co-processing method, system and equipment

Abstract

The invention relates to the technical field of power network security, and particularly discloses a power network security event linkage response and co-processing method, system and equipment, and the method comprises the steps: collecting the power parameters of a power network and evaluating the network security index of the power network, so as to timely discover potential security threats in the power network, and improve the safety of the power network. Scientific basis is provided for accurately matching the intelligent decision scheme of the power network, so that each detection device to which the power network belongs carries out cooperative processing on the intelligent decision scheme and judges the effect of the intelligent decision scheme, thereby carrying out feedback adjustment on the intelligent decision scheme of the power network. And finally, the optimized power parameters of the power network and the optimized disposal completion operation parameters of each detection device are collected, an intelligent decision adjustment scheme of the power network security events is fed back, and the adaptability and effectiveness of the intelligent decision adjustment scheme can be improved by optimizing the intelligent decision adjustment scheme. And safe and stable operation of the power network is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power network security, and specifically to a method, system and equipment for coordinated response and coordinated handling of electric power network security incidents. Background Art

[0002] As the power system becomes increasingly dependent on the network, power network security incidents occur frequently, posing a serious threat to the safe and stable operation of the power system. Traditional power network security protection methods are often limited to independent protection in a single mode and lack self-adjustment and optimization capabilities, making it difficult to effectively respond to complex and changeable network attacks.

[0003] For example, the invention patent publication number is "Processing power parameters of the power network, operation parameters of each detection device belonging to the power network, optimized power parameters of the power network, and optimized operation parameters of each detection device belonging to the power network, obtaining the safety energy efficiency factor of the power network system, and transmitting it to the power network feedback system through data communication", which discloses a hierarchical collaborative processing method and system for network threats in a power monitoring system. The method includes: when a network threat event is monitored, determining the impact scope of the network threat event; determining the blocking level of the network threat according to the impact scope, when the impact scope is a single device, multiple devices in the same network segment, and multiple devices in multiple network segments, determining the blocking levels to be single-device level blocking, local level blocking, and regional level blocking respectively; hierarchical disposal of the network threat according to the location of the network threat and the blocking level, when the location is the master station side, the hierarchical disposal includes master station area blocking, master station equipment blocking, and master station session blocking, when the location is the plant station side, the hierarchical disposal includes plant station area blocking and plant station equipment blocking.

[0004] For example, the invention patent with publication number CN115603989A discloses a network attack correlation analysis method for a source-grid-load-storage collaborative control system. The network security is designed. First, the log file of the source-grid-load-storage collaborative control system is obtained for parsing to obtain data on abnormal events involving network attack scenarios. Secondly, the collected data is preprocessed to filter out irrelevant items and duplicate items, and a set of network attack abnormal event items is generated. The FP-Growth algorithm is used to perform event correlation analysis on the data to mine the association rules between abnormal information and network attack scenarios. Finally, an attack correlation matching rule library for the source-grid-load-storage collaborative control system is established to monitor system events in real time, and the network attack scenarios are quickly identified in combination with the network attack rule library.

[0005] However, in the process of implementing the embodiments of the present application, it was found that the above-mentioned technology has at least the following technical problems: the current analysis and disposal of power network security often focuses on static and preset processes, while the actual power network security is dynamically changing and is often accompanied by new attack methods and technologies, which may lead to the inability to adopt effective disposal methods when similar power network security risks occur again, making it impossible to effectively control and resolve power network security. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a method, system and equipment for linked response and coordinated handling of power network security incidents, which can effectively solve the problems involved in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: The first aspect of the present invention provides a method for coordinated response and collaborative disposal of power network security events, including: S1. Based on the coordinated response of each detection device belonging to the power network, the power parameters of the power network are collected, thereby evaluating the network security index of the power network and comparing it with the network security threshold; S2. When the network security index of the power network is less than the network security threshold, an intelligent decision-making plan for the power network is matched, thereby the various detection devices belonging to the power network coordinately dispose of the intelligent decision-making plan; S3. Based on the coordinated disposal of the intelligent decision-making plan by each detection device belonging to the power network, the disposal completion operation parameters of each detection device belonging to the power network are obtained, and the power network is analyzed. The efficiency evaluation coefficient of the detection equipment belonging to the power network is calculated and compared with the efficiency evaluation threshold; S4. When the efficiency evaluation coefficient of the detection equipment belonging to the power network is less than the efficiency evaluation threshold, the intelligent decision-making plan of the power network is fed back and adjusted, and marked as the intelligent decision-making adjustment plan of the power network, thereby the detection equipment belonging to the power network coordinates the intelligent decision-making adjustment plan; S5. Based on the coordinated disposal of the intelligent decision-making adjustment plan by the detection equipment belonging to the power network, the optimized power parameters of the power network and the optimized disposal operation parameters of the detection equipment belonging to the power network are collected, and the safety energy efficiency factor of the power network system is determined, thereby the power network feedback system feeds back the intelligent decision-making adjustment plan for the power network security incident.

[0008] As a further method, the detection devices belonging to the power network collaboratively handle the intelligent decision-making scheme. The specific processing process is: based on the matched intelligent decision-making scheme of the power network, a collaborative processing instruction corresponding to the intelligent decision-making scheme of the power network is generated, and the collaborative processing instruction is sent to the detection devices belonging to the power network, thereby the detection devices belonging to the power network collaboratively handle the intelligent decision-making scheme.

[0009] As a further method, the intelligent decision-making plan of the power network is feedback-adjusted, and the specific analysis of the feedback adjustment is: based on the performance evaluation coefficient of the detection equipment belonging to the power network being less than the performance evaluation threshold, difference processing is performed to obtain the performance evaluation deviation value of the detection equipment belonging to the power network, and the performance adjustment plan of the detection equipment belonging to the power network is matched, which is recorded as the intelligent decision-making adjustment plan of the power network, thereby adjusting the intelligent decision-making plan of the power network and providing feedback.

[0010] As a further method, the intelligent decision-making adjustment plan for the power network security incident is fed back, and the specific feedback process is: if the safety energy efficiency factor of the power network system is greater than the safety energy efficiency threshold, the intelligent decision-making adjustment plan of the power network is updated to the corresponding intelligent decision-making plan, and the update result is fed back; if the safety energy efficiency factor of the power network system is less than or equal to the safety energy efficiency threshold, the intelligent decision-making adjustment plan for the power network security incident is fed back and warned.

[0011] The second aspect of the present invention provides a system for the coordinated response and coordinated disposal of power network security events, which is characterized by comprising: a network security assessment module, which is used to collect power parameters of the power network based on the coordinated response of each detection device belonging to the power network, thereby evaluating the network security index of the power network and comparing it with the network security threshold; a decision-making scheme matching module, which is used to match an intelligent decision-making scheme for the power network when the network security index of the power network is less than the network security threshold, thereby the various detection devices belonging to the power network coordinately dispose of the intelligent decision-making scheme; an equipment efficiency analysis module, which is used to coordinately dispose of the intelligent decision-making scheme based on the various detection devices belonging to the power network, obtain the operation parameters of the disposal completion of each detection device belonging to the power network, and analyze the detection equipment belonging to the power network. The efficiency evaluation coefficient of the equipment is collected and compared with the efficiency evaluation threshold; the decision-making scheme adjustment module is used to feedback and adjust the intelligent decision-making scheme of the power network when the efficiency evaluation coefficient of the detection equipment belonging to the power network is less than the efficiency evaluation threshold, and mark it as the intelligent decision-making adjustment scheme of the power network, thereby the detection equipment belonging to the power network coordinates the intelligent decision-making adjustment scheme; the decision-making scheme feedback module is used to coordinate the intelligent decision-making adjustment scheme based on the detection equipment belonging to the power network, collect the optimized power parameters of the power network and the optimized disposal operation parameters of the detection equipment belonging to the power network, and determine the safety energy efficiency factor of the power network system, thereby the power network feedback system feeds back the intelligent decision-making adjustment scheme of the power network security incident.

[0012] The third aspect of the present invention provides an application such as a device for the linked response and coordinated disposal method of power network security incidents, characterized in that it includes: a detection device, a central control platform and a power network feedback system; the detection device and the central control platform are connected via data communication; the central control platform is used to process the power parameters of the power network, the disposal and operation parameters of each detection device belonging to the power network, the optimized power parameters of the power network and the optimized disposal and operation parameters of each detection device belonging to the power network, obtain the safety energy efficiency factor of the power network system, and transmit it to the power network feedback system via data communication; the power network feedback system is used to receive the safety energy efficiency factor of the power network system transmitted by the central control platform, and finally provide feedback on the intelligent decision-making adjustment plan for the power network security incident.

[0013] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects:

[0014] (1) The present invention provides a method, system and device for coordinated response and coordinated handling of power network security incidents. By collecting the power parameters of the power network and evaluating the network security index of the power network, potential security threats in the power network can be discovered in a timely manner, providing a scientific basis for accurately matching the intelligent decision-making plan of the power network. As a result, the detection devices belonging to the power network coordinate the intelligent decision-making plan, analyze the operation parameters of the disposal of the detection devices belonging to the power network, and judge the effect of the intelligent decision-making plan. Feedback and adjustment are performed on the intelligent decision-making plan of the power network to improve the ability and efficiency of the entire power network to respond to security incidents. Finally, the optimized power parameters of the power network and the optimized disposal operation parameters of the detection devices belonging to the power network are collected, and feedback is provided on the intelligent decision-making adjustment plan for power network security incidents. By continuously optimizing the intelligent decision-making plan, its adaptability and effectiveness can be improved to ensure the safe and stable operation of the power network.

[0015] (2) The present invention analyzes the security risks in the power network by analyzing the data in the logs of each detection device, thereby innovatively solving the shortcomings that the current analysis of logs is limited to the passive response level and cannot infer that the network environment is in a certain bad state based on certain logs, thereby improving the automation level of power network security risk management.

[0016] (3) The present invention can determine the effect of the intelligent decision-making plan by analyzing the operating parameters of each detection device after the execution of the intelligent decision-making plan of the power network, so as to adjust and update the intelligent decision-making plan, so that the intelligent decision-making plan for power network security incidents can be continuously optimized, thereby improving the effectiveness and reliability of the intelligent decision-making plan. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0018] Figure 1 It is a schematic diagram of the method steps of the present invention;

[0019] Figure 2 It is a schematic diagram of system module connection of the present invention. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0021] Reference Figure 1 As shown, the first aspect of the present invention provides a method for linked response and coordinated handling of power network security events, including: S1. Based on the linked response of each detection device belonging to the power network, the power parameters of the power network are collected, thereby evaluating the network security index of the power network and comparing it with the network security threshold.

[0022] It should be explained that the above-mentioned power parameters include various data packets belonging to the power network.

[0023] The above-mentioned linkage response based on various detection devices means that during the operation of the power network, when an abnormal situation of the power network is detected, the central control platform automatically triggers a series of preset response mechanisms, such as sending intelligent decision-making plan instructions to various detection devices belonging to the power network, and through the collaborative work between various detection devices, the power network status can be quickly adjusted and optimized to ensure the safe, stable and efficient operation of the power network; the above-mentioned network security threshold represents the minimum value of the reasonable range of the network security index of the power network, which is extracted from the network security database. The network security engineers understand and analyze the historical power network attack data, and set a reasonable network security threshold to remind timely repair of network security risks.

[0024] It should be explained that the above-mentioned detection equipment includes common network equipment (such as routers, switches), network security equipment (such as firewalls, IDS), host systems, dedicated network security equipment, servers and workstation equipment.

[0025] It also needs to be further explained that the above-mentioned central control platform is a thinking unit. Based on the results of in-depth analysis of power network data and data from various detection equipment, it makes emergency decisions for risky issues, accumulates emergency response experience, and intelligently orchestrates and handles security risk issues. The core business of the central control platform is the "intelligent analysis-decision orchestration-emergency response" function of threats based on self-evolving AI.

[0026] Among them, the central control platform adopts a multi-layer software architecture model design, which is composed of the display layer, logic layer, resource layer, support layer, and physical layer from top to bottom; the display layer is a user-oriented data display and operation interface, providing platform initialization, terminal list display, network topology display, system traffic display, alarm log and system risk display, intelligent decision-making orchestration result display, emergency disposal suggestions and result display, traffic collection, data analysis, risk decision, emergency disposal template upgrade and display, historical traffic, threat, decision, disposal and other information retrieval, real-time business traffic retrieval and other functions; the logic layer processes user requests of the display layer and secondary analysis and disposal of terminal data according to predetermined business logic , including platform users, network management, terminal address, certificate, version and template policy management, template management, intelligent analysis and decision-making arrangement of traffic and threats, formulation of emergency response actions and post-execution tracking. The intelligent learning module is responsible for learning various analysis and judgment, decision-making, and response strategies, and making suggestions on alarm logs; the resource layer provides comprehensive resource access function support and shields the source of resources from the upper layer, mainly including various databases, configuration files and basic API libraries; the support layer refers to the operating system and drivers of various physical devices; the physical layer provides carrier resources for platform operation, including CPU, memory, hard disk, network card, graphics card, encryption card, etc.

[0027] Specifically, the network security index of the power network, in this embodiment, is obtained by comprehensive analysis of the abnormal flow ratio, abnormal event frequency and total number of network attack types of the power network during the security detection period, and is a numerical value used to evaluate the network security degree of the power network. The specific expression is:

[0028]

[0029] ABT is the abnormal traffic ratio of the power network during the security detection cycle, which refers to the proportion of abnormal traffic in the power network to the total traffic during the security detection cycle. An increase in the abnormal traffic ratio may mean that the power network is under attack or is about to fail, providing timely early warning signals for security managers.

[0030] FA is the frequency of abnormal events in the power network during the safety detection cycle, which refers to the number of abnormal events that occur in the power network during the safety detection cycle. The frequency of abnormal events directly reflects the stability level of the network. A high frequency of abnormal events may mean that there are serious problems in the network and immediate measures need to be taken to resolve them.

[0031] AC is the total number of network attack types encountered by the power network during the security detection cycle. It refers to the number of different types of network attacks suffered by the power network during the security detection cycle. The increase in the total number of network attack types reflects the increasingly diverse threats faced by the power network, and may also indirectly indicate that the power network faces a high degree of risk.

[0032] e is a natural constant, cn1 is an impact factor corresponding to the unit value of the abnormal flow ratio preset in the network security database, which represents the numerical value of the impact degree of the unit value of the abnormal flow ratio on the network security index of the power network. When used, the impact factor corresponding to the unit value of the abnormal flow ratio can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the abnormal flow ratio and the impact factor corresponding to the unit value of the abnormal flow ratio preset in the network security database form a mapping set, and the real-time abnormal flow ratio is input into the mapping set to obtain the impact factor corresponding to the unit value of the abnormal flow ratio. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0033] cn2 is the impact factor corresponding to the unit value of the abnormal event frequency preset in the network security database, which represents the numerical value of the impact degree of the unit value of the abnormal event frequency on the network security index of the power network. When used, the impact factor corresponding to the unit value of the abnormal event frequency can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the abnormal event frequency and the impact factor corresponding to the unit value of the abnormal event frequency preset in the network security database form a mapping set, and the real-time abnormal event frequency is input into the mapping set to obtain the impact factor corresponding to the unit value of the abnormal event frequency. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0034] cn3 is the impact factor corresponding to the unit value of the total number of network attack types preset in the network security database, which represents the numerical value of the impact degree of the unit value of the total number of network attack types on the network security index of the power network. When used, the impact factor corresponding to the unit value of the total number of network attack types can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the total number of network attack types and the impact factors corresponding to the unit values ​​of the total number of network attack types preset in the network security database form a mapping set, and the real-time total number of network attack types is input into the mapping set to obtain the impact factor corresponding to the unit value of the total number of network attack types. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0035] Among them, δ is the network security index of the power network. The increase in the frequency of abnormal events is often accompanied by an increase in the abnormal traffic ratio, because abnormal events (such as network attacks, equipment failures, etc.) usually lead to abnormal changes in network traffic, such as traffic surges and abnormal traffic patterns. Therefore, during the security detection cycle, if the frequency of abnormal events is high, then the abnormal traffic ratio is also likely to increase accordingly. There is a certain positive correlation between the frequency of abnormal events and the total number of network attack types. Although not all abnormal events are network attacks, network attacks are one of the important causes of abnormal events. When the network suffers from multiple types of attacks, the frequency of abnormal events will increase. At the same time, the diversity of network attack types also reflects that attackers may adopt multiple strategies and means, thereby increasing the security risks of the power network. Therefore, the abnormal traffic ratio, the frequency of abnormal events and the total number of network attack types are interrelated and mutually influential in the network security assessment of the power network, and jointly reflect the security status and stability level of the power network. It is necessary to pay close attention to the changes in these parameters in order to promptly discover and respond to potential security threats.

[0036] In this exemplary embodiment, the table showing changes in the network security index of the power network and its corresponding parameters is shown in Table 1:

[0037] Table 1 Changes in the network security index of the power network and its corresponding parameters

[0038]

[0039] In this example embodiment, the value of the impact factor corresponding to the unit value of the abnormal traffic ratio is set to 0.4, the value of the impact factor corresponding to the unit value of the abnormal event frequency is set to 0.35, and the value of the impact factor corresponding to the unit value of the total number of network attack types is set to 0.5. It can be seen from Table 1 that when the abnormal traffic ratio is 20%, the abnormal event frequency is 1 per hour, and the total number of network attack types is 3, the abnormal traffic ratio, the abnormal event frequency and the total number of network attack types are all the minimum values ​​of the corresponding columns in Table 1. At this time, the network security index is 15.9%, which is the maximum value of the network security index column in Table 1. The abnormal traffic ratio, the abnormal event frequency and the total number of network attack types are all negatively correlated with the network security index.

[0040] Furthermore, the specific evaluation process of evaluating the network security index of the power network is as follows:

[0041] Extract and parse each data packet belonging to the power network from the power parameters of the power network, thereby obtaining the power parsing parameters of the power network, extract the total abnormal flow of the power network during the safety detection period and the total flow of the power network during the safety detection period from the power parsing parameters of the power network, and perform ratio processing to obtain the abnormal flow ratio of the power network during the safety detection period; the above-mentioned data packets belonging to the power network refer to the log data uploaded to the central control platform by the various detection devices belonging to the power network, so it is necessary to parse the log data through a network packet capture tool (such as a network packet analyzer) to obtain the power parsing parameters of the power network, and the above-mentioned abnormal flow ratio of the power network during the safety detection period has The overall analysis process is as follows: during the safety detection cycle of the power network, each detection device belonging to the power network analyzes the collected traffic, identifies unknown traffic by counting the data flow frequency of a specific five-tuple (IP+protocol+port) and detecting abnormal data packets (such as teardrop-type overlapping offset problems), and uploads the results of the preliminary analysis to the central control platform in the form of data packets. The central control platform further summarizes and analyzes the unknown traffic and determines its legality or illegality, thereby clearly marking and classifying the unknown traffic to obtain the abnormal total traffic. At the same time, the total traffic during the safety monitoring cycle is counted, and the central control platform calculates the ratio of the abnormal total traffic to the total traffic during the safety detection cycle, that is, the abnormal traffic ratio.

[0042] It should be explained that the above-mentioned safety detection cycle refers to the time period for analyzing the operating status of the power network. The specific duration is determined by network security engineers based on the actual operating conditions of the power network, such as maintenance cycles, etc., to formulate a reasonable detection time period to ensure the feasibility and effectiveness of the detection work.

[0043] The total number of abnormal events in the power network within the safety detection period is extracted from the power analysis parameters of the power network, and the ratio is processed with the duration corresponding to the safety detection period to obtain the frequency of abnormal events in the power network within the safety detection period; the above-mentioned abnormal events include network attacks, communication interruptions, illegal intrusions and control signal abnormalities. The total number of abnormal events is obtained by statistically analyzing the abnormal events of each data packet belonging to the power network.

[0044] The total number of network attack types on the power network within a security detection period is extracted from the power parsing parameters of the power network, thereby comprehensively evaluating the network security index of the power network; in an example embodiment, the total number of network attack types on the power network within the security detection period is extracted from the parameters of each data packet belonging to the parsed power network, wherein the network attack types include distributed denial of service attacks, advanced persistent attacks, vulnerability exploit attacks, and malware attacks.

[0045] S2. When the network security index of the power network is less than the network security threshold, an intelligent decision-making plan for the power network is matched, and the various detection devices belonging to the power network coordinately handle the intelligent decision-making plan.

[0046] It needs to be explained that when the network security index of the power network is greater than or equal to the network security threshold, the power parameters of the power network are continuously monitored.

[0047] Specifically, each detection device belonging to the power network performs collaborative processing on the intelligent decision-making scheme, and the specific processing process is: based on the matched intelligent decision-making scheme of the power network, a collaborative processing instruction corresponding to the intelligent decision-making scheme of the power network is generated, and the collaborative processing instruction is sent to each detection device belonging to the power network, thereby each detection device belonging to the power network performs collaborative processing on the intelligent decision-making scheme; the above-mentioned intelligent decision-making scheme of the power network is matched, and the specific matching process is: the central control platform receives data from each node in the power network (that is, the data of each detection device), including the power grid load and the operating status parameters of each detection device (such as response time and attack success rate), and forms it into a data set for this detection, and the central control platform includes The data set contains data of each historical detection and the corresponding intelligent decision-making scheme. The data set of each historical detection contains the data of each node in the power network during each historical detection process (that is, the data of each detection device), including the power grid load and the operating status parameters of each detection device (such as response time and attack success rate). The intelligent decision-making scheme corresponding to each historical detection is formulated by the operation and maintenance personnel. When the central control platform contains the number of intelligent decision-making schemes that meet the expectations of the operation and maintenance personnel, the intelligent decision-making scheme can be automatically matched. The similarity between the data set of this detection and the data set of each historical detection is calculated by the Jaccard similarity algorithm, and the similarities are sorted in order from large to small. The first-ranked similarity is extracted, and the The intelligent decision-making solution corresponding to the data set of a certain historical detection corresponding to the similarity is the intelligent decision-making solution for this detection; the above-mentioned intelligent decision-making solution instruction corresponding to the intelligent decision-making solution of the power network is generated, and the specific generation process is: the central control platform determines the power network communication protocol (such as TCP protocol) and the message encapsulation format (such as JSON), encodes the intelligent decision-making solution of the power network according to the determined message encapsulation format, and adds metadata (such as message type, version number and timestamp), and uses the selected network communication protocol to process the encoded message and encapsulate it into a data packet, which is the intelligent decision-making solution instruction. The above-mentioned sending of the intelligent decision-making solution instruction to each detection device belonging to the power network refers to the intelligent decision-making solution instruction in this data packet The port number of the detection device is set as the header information, and routing and forwarding are performed through intermediate nodes (such as servers, etc.), so as to send the intelligent decision-making solution instructions to the detection devices belonging to the power network; the detection devices belonging to the above-mentioned power network jointly handle the intelligent decision-making solution, and the specific handling process is: each detection device listens to the intelligent decision-making solution instructions from the central control node through the network communication interface (such as Ethernet interface), and parses the intelligent decision-making solution instructions through the previously determined message encapsulation format (such as JSON). Each detection device will perform corresponding actions according to the parsed intelligent decision-making solution content. After executing the action, each detection device will send execution result (such as success, failure, partial success, etc.) log information to the central control platform.

[0048] In an example embodiment, the grid load during a certain historical detection process is 1200 megawatts and the operating status parameters of detection device 1 (response time is 80 milliseconds and attack success rate is 2%), the operating status parameters of detection device 2 (response time is 90 milliseconds and attack success rate is 3.5%), and the operating status parameters of detection device 3 (response time is 60 milliseconds and attack success rate is 3%), and the corresponding intelligent decision-making plan includes strengthening security protection measures for all detection devices, including updating configured firewall rules and deploying intrusion detection systems; the grid load during a certain historical detection process is 1500 megawatts and the operating status parameters of detection device 1 (response time is 120 milliseconds and attack success rate is 6%), the operating status parameters of detection device 2 (response time is 130 milliseconds and attack success rate is 6.35%), and the operating status parameters of detection device 3 (response time is 123 milliseconds and attack success rate is 7%), and the corresponding intelligent decision-making plan includes increasing the deployment of intrusion detection and prevention systems (IDS / IPS) and updating security patches.

[0049] S3. Based on the coordinated processing of the intelligent decision-making plan by the various detection equipment belonging to the power network, the processing completion operation parameters of the detection equipment belonging to the power network are obtained, the efficiency evaluation coefficient of the detection equipment belonging to the power network is analyzed, and compared with the efficiency evaluation threshold.

[0050] The above-mentioned performance evaluation threshold represents the minimum value of the reasonable range of the performance evaluation coefficient of the detection equipment belonging to the power network, which is extracted from the network security database. The equipment administrator analyzes the historical operation data of the equipment, the safety goals of the equipment, and the business continuity plan to formulate a reasonable performance evaluation threshold to meet the actual needs and safety requirements of the equipment.

[0051] In a specific embodiment, the present invention analyzes the security risks in the power network by analyzing the data in the logs of each detection device, thereby innovatively solving the shortcomings that the current analysis of logs is limited to the passive response level and cannot infer that the network environment is in a certain bad state based on certain logs, thereby improving the level of automation of power network security risk management.

[0052] Specifically, the efficiency evaluation coefficient of the detection equipment belonging to the power network is analyzed, and the specific analysis process is: extracting the total number of successful request instructions and the total number of request instructions of each detection equipment belonging to the power network within the performance detection cycle from the disposal completion operation parameters of each detection equipment belonging to the power network, and performing data processing to obtain the request failure rate of each detection equipment belonging to the power network within the performance detection cycle; the total number of successful request instructions and the total number of request instructions of each detection equipment belonging to the power network within the performance detection cycle are analyzed by a log parsing tool (such as a Splunk log management platform) for the logs of each detection equipment belonging to the power network within the performance detection cycle. The specific parsing process is: the log file path, network listening port and API interface of each detection equipment are input into the configuration of the Splunk log management platform, and the network data administrator creates a log parsing rule, and uses Splunk's search language (SPL) to construct a query to retrieve the key parameters within the performance detection cycle, thereby obtaining the above parameters; the above request failure rate, the specific data processing process is: the result of subtracting the total number of successful request instructions from the total number of request instructions divided by the total number of request instructions is the request failure rate.

[0053] It needs to be explained that the above-mentioned performance detection cycle refers to the period for detecting the operating status of each detection equipment belonging to the power network after handling the intelligent decision-making plan. The starting time point of the performance detection is the time point when the central control platform receives the last execution result log information. The specific duration of the performance detection cycle is determined by the equipment operation and maintenance administrator based on historical experience.

[0054] The response time of each request instruction of each detection device belonging to the power network within the performance detection cycle is extracted from the disposal completion operation parameters of each detection device belonging to the power network, and the average response time of the request instructions of each detection device belonging to the power network within the performance detection cycle is obtained by mean processing; the total traffic used by each detection device belonging to the power network within the performance detection cycle is extracted from the disposal completion operation parameters of each detection device belonging to the power network. The above-mentioned response time of each request instruction of each detection device belonging to the power network within the performance detection cycle and the total traffic used by each detection device belonging to the power network within the performance detection cycle are consistent with the method of obtaining the total number of successful request instructions and the total number of request instructions of each detection device belonging to the power network within the performance detection cycle; the request instruction response time includes the request success instruction response time and the request failure instruction response time. It should be explained that the instructions that are not responded within the performance detection cycle are also marked as request failure instructions.

[0055] The efficiency evaluation coefficient of the detection equipment belonging to the power network is thus comprehensively analyzed. In this embodiment, the efficiency evaluation coefficient of the detection equipment belonging to the power network is obtained by comprehensively analyzing the request failure rate, the average response time of the request instruction, and the total flow used by the sth detection equipment belonging to the power network during the performance detection cycle. It is used to evaluate the value of the operating efficiency of each detection equipment after using the intelligent decision-making solution. The specific expression is:

[0056]

[0057] QL s It is the request failure rate of the s-th detection device belonging to the power network during the performance detection cycle, which refers to the ratio of the number of requests that the s-th detection device failed to respond successfully to the total number of requests during the performance detection cycle, reflecting the stability and reliability of the detection device in processing requests, where a request refers to a request from other devices to the detection device, and a response refers to the detection device’s corresponding processing of the request.

[0058] TE s It is the average response time of the request instructions of the sth detection device belonging to the power network during the performance detection cycle, which refers to the average time of the sth detection device responding to each request instruction. A longer response time may mean that there is a bottleneck or insufficient performance in the power network.

[0059] TDU s It is the total traffic used by the s-th detection device belonging to the power network during the performance detection cycle, indicating the total amount of network traffic used by the s-th detection device during the performance detection cycle. By comparing and analyzing it with the reference total traffic, abnormal network activities can be identified.

[0060] ΔTDU is the reference total flow rate, which is extracted from the network security database. It represents the reference value of the total flow rate used by the sth detection device belonging to the power network during the performance detection cycle. Based on the historical flow rate range of each detection device, the reference total flow rate is obtained by comprehensive evaluation.

[0061] cr1 is the impact factor corresponding to the request failure rate unit value preset in the network security database, which represents the numerical value of the impact degree of the request failure rate unit value on the performance evaluation coefficient of the detection equipment belonging to the power network. When used, the impact factor corresponding to the request failure rate unit value can be directly obtained from the network security database. The corresponding relationship can be a preset mapping relationship. For example, the request failure rate and the impact factor corresponding to the request failure rate unit value preset in the network security database form a mapping set. The real-time request failure rate is input into the mapping set to obtain the impact factor corresponding to the request failure rate unit value. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is

[0062] [0,1].

[0063] cr2 is the impact factor corresponding to the unit value of the average response time of the request instruction preset in the network security database, which represents the numerical value of the influence of the unit value of the average response time of the request instruction on the performance evaluation coefficient of the detection equipment belonging to the power network. When used, the impact factor corresponding to the unit value of the average response time of the request instruction can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the average response time of the request instruction and the impact factor corresponding to the unit value of the average response time of the request instruction preset in the network security database form a mapping set, and the real-time average response time of the request instruction is input into the mapping set to obtain the impact factor corresponding to the unit value of the average response time of the request instruction. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0064] cr3 is the correction factor corresponding to the total flow usage preset in the network security database, which represents the numerical value of the degree of correction for the change in the total flow usage. When used, the correction factor corresponding to the total flow usage can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the total flow usage and the correction factor corresponding to the total flow usage preset in the network security database form a mapping set, and the real-time total flow usage is input into the mapping set to obtain the correction factor corresponding to the total flow usage. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0065] e is a natural constant, s is the serial number of each detection device, s={1,2,3,...,q}, q is the total number of detection devices.

[0066] Among them, EC is the efficiency evaluation coefficient of the detection equipment belonging to the power network. A high request failure rate is often accompanied by an increase in the average response time, because failed requests may occupy power network system resources (such as CPU, memory, network bandwidth, etc.), resulting in successful response requests taking longer to be processed. In addition, some failed requests may trigger a retry mechanism, further increasing the burden on the power network system and the average response time, causing the total traffic used by the detection equipment to deviate significantly from the reference total traffic. The three parameters jointly increase the cost and burden of transmission between the power network and each detection device, and may also pose a threat to the overall stability and security of the power network system. Therefore, we should attach great importance to the changes in these indicators, and take timely measures to investigate and optimize them to ensure the stable operation and efficient service of each detection equipment belonging to the power network.

[0067] In a specific embodiment, the present invention can determine the effectiveness of the intelligent decision-making plan by analyzing the operating parameters of each detection device after the execution of the intelligent decision-making plan of the power network, so that the intelligent decision-making plan can be adjusted and updated, so that the intelligent decision-making plan for power network security incidents can be continuously optimized, thereby improving the effectiveness and reliability of the intelligent decision-making plan.

[0068] S4. When the performance evaluation coefficient of the detection equipment belonging to the power network is less than the performance evaluation threshold, feedback adjustment is made to the intelligent decision-making plan of the power network and it is marked as the intelligent decision-making adjustment plan of the power network, thereby the detection equipment belonging to the power network coordinately handles the intelligent decision-making adjustment plan.

[0069] The above-mentioned performance evaluation threshold represents the minimum value of the reasonable range of the performance evaluation coefficient of the detection equipment belonging to the power network, which is extracted from the network security database. The equipment administrator analyzes the historical operation data of the equipment, the safety goals of the equipment, and the business continuity plan to formulate a reasonable performance evaluation threshold to meet the actual needs and safety requirements of the equipment.

[0070] It needs to be explained that when the performance evaluation coefficient of the detection equipment belonging to the power network is greater than or equal to the performance evaluation threshold, it indicates that the operating effect of the detection equipment belonging to the power network after the coordinated disposal of the intelligent decision-making plan has reached the requirements of the performance evaluation threshold. Therefore, the adjustment of the power network is completed, and a visual pop-up box is displayed saying "the disposal has been completed as expected."

[0071] Specifically, the feedback adjustment is performed on the intelligent decision-making scheme of the power network, and the specific analysis of the feedback adjustment is as follows:

[0072] Based on the fact that the performance evaluation coefficient of the detection equipment belonging to the power network is less than the performance evaluation threshold, difference processing is performed to obtain the performance evaluation deviation value of the detection equipment belonging to the power network, and the performance adjustment plan of the detection equipment belonging to the power network is matched, which is recorded as the intelligent decision-making adjustment plan of the power network, thereby adjusting the intelligent decision-making plan of the power network and providing feedback; the performance evaluation coefficient of the detection equipment belonging to the above-mentioned power network is less than the performance evaluation threshold, indicating that the operating effect of the detection equipment belonging to the power network after the collaborative disposal of the intelligent decision-making plan has not met the requirements of the performance evaluation threshold, so it is necessary to match the performance adjustment plan of the detection equipment belonging to the power network from the network security database, and compare the performance evaluation deviation value of the detection equipment belonging to the power network with the performance evaluation deviation value stored in the security database. If the performance evaluation deviation value is matched with the value interval, the intelligent decision-making adjustment plan corresponding to the performance evaluation deviation value interval to which the performance evaluation deviation value belongs is the intelligent decision-making adjustment plan of the power network. In an example embodiment, if the performance evaluation deviation value is 200%, the intelligent decision-making adjustment plan that matches it includes transferring part of the load from the detection device with low performance to other devices with better performance to achieve load balancing, and increasing the computing resources or memory resources allocated to the detection device to improve its processing capacity; if the performance evaluation deviation value is 400%, the intelligent decision-making adjustment plan that matches it includes isolating the detection device with low performance from the network to prevent its fault from spreading to other devices, and immediately replacing the hardware device with low performance to avoid causing greater impact on the entire power network.

[0073] S5. Based on the coordinated handling of intelligent decision-making adjustment plans by various detection equipment belonging to the power network, the optimized power parameters of the power network and the optimized operation parameters of various detection equipment belonging to the power network are collected, and the safety energy efficiency factor of the power network system is determined. The power network feedback system then provides feedback on the intelligent decision-making adjustment plans for power network security incidents.

[0074] The above-mentioned detection equipment belonging to the power network coordinates the intelligent decision-making adjustment plan, which is consistent with the process of coordinated processing of the intelligent decision-making plan by the detection equipment belonging to the power network.

[0075] Specifically, the intelligent decision-making adjustment plan for the power network security incident is fed back, and the specific feedback process is:

[0076] If the safety energy efficiency factor of the power network system is greater than the safety energy efficiency threshold, the intelligent decision-making adjustment plan of the power network is updated to the corresponding intelligent decision-making plan, and the update result is fed back; the above-mentioned safety energy efficiency threshold represents the minimum value of the reasonable range of the safety energy efficiency factor of the power network system, which is extracted from the network security database. Network security engineers collect and analyze historical power network system data, power network system industry data and actual operation data of the power network system to understand the energy efficiency performance and safety status of the power network system under different operating conditions, so as to formulate a safety energy efficiency threshold. If the safety energy efficiency factor of the power network system is greater than the safety energy efficiency threshold, it means that according to the power network system, The power network system after adjustment of the intelligent decision-making adjustment plan of the power network can meet the requirements of the safety and energy efficiency factors, that is, the power network system can operate safely and efficiently. At this time, the intelligent decision-making plan used in this detection stored in the central control platform is replaced and updated to the intelligent decision-making adjustment plan used in this detection. After the update, the update result is fed back, that is, a visual pop-up box "Scheme Update Completed" is displayed. The central control platform can continuously optimize and learn the decision-making plan, continuously receive actual operation data, analyze system performance, and verify the decision-making effect, and automatically adjust and intelligently make decision-making adjustment plans accordingly. The central control platform is gradually building a set of intelligent management systems that can self-improve and adapt to changes.

[0077] If the safety energy efficiency factor of the power network system is less than or equal to the safety energy efficiency threshold, the intelligent decision-making adjustment plan for the power network security incident is fed back and warned; if the safety energy efficiency factor of the power network system is less than or equal to the safety energy efficiency threshold, it indicates that the power network system adjusted according to the intelligent decision-making adjustment plan of the power network still cannot meet the requirements of the safety energy efficiency factor. Therefore, the power network feedback system feeds back and warns the intelligent decision-making adjustment plan for the power network security incident, that is, a visual pop-up box "manual adjustment of the intelligent decision-making adjustment plan is required", then the network security engineer adjusts the intelligent decision-making adjustment plan according to the actual operation status and historical work experience of the power network system, and marks it as the intelligent decision-making optimization plan of the power network, and coordinates the intelligent decision-making optimization plan based on the various detection equipment belonging to the power network, determines the safety energy efficiency factor of the power network system after the disposal, and compares it with the safety energy efficiency threshold, thereby performing a continuous optimization strategy. If it is impossible to adjust the intelligent decision-making optimization plan that meets the requirements, the network security engineer can increase manual monitoring and limit some non-critical businesses of the power network system, and seek the opinions of external expert consultants, especially experts with rich experience in the field of power network security and energy efficiency management, thereby providing new perspectives and solutions.

[0078] Furthermore, the specific determination process of determining the safety energy efficiency factor of the power network system is as follows:

[0079] The number of unauthorized accesses to each detection device belonging to the power network within the optimized detection period is extracted from the optimized disposal completed operating parameters of each detection device belonging to the power network, and the ratio is processed with the duration corresponding to the optimized detection period to obtain the frequency of unauthorized access to each detection device belonging to the power network within the optimized detection period, and the average frequency of unauthorized access to the detection devices belonging to the power network within the optimized detection period is obtained by average processing; the above-mentioned optimized detection period refers to the time period for detecting the performance of the power network and each detection device belonging to the power network, and its specific duration is equal to the duration of the performance detection period; the number of unauthorized accesses to each detection device belonging to the power network within the optimized detection period is consistent with the total number of successful request instructions and the total number of request instructions of each detection device belonging to the power network within the performance detection period, wherein unauthorized access includes illegal login attempts, unauthorized access, data theft, denial of service attacks and unauthorized physical access.

[0080] The total traffic used by each detection equipment belonging to the power network during the optimization detection period is extracted from the optimization disposal completed operating parameters of each detection equipment belonging to the power network. At the same time, the packet loss rate of the power network during the optimization detection period is extracted from the optimized power parameters of the power network. The above-mentioned total traffic used by each detection equipment belonging to the power network during the optimization detection period and the packet loss rate of the power network during the optimization detection period are consistent with the method of obtaining the total number of successful request instructions and the total number of request instructions of each detection equipment belonging to the power network during the performance detection period.

[0081] The safety energy efficiency factor of the power network system is thus comprehensively determined. In this embodiment, the safety energy efficiency factor of the power network system is obtained by comprehensively analyzing the average frequency of unauthorized access of the detection equipment belonging to the power network during the optimized detection period, the packet loss rate of the power network during the optimized detection period, and the total flow used by the sth detection equipment belonging to the power network during the optimized detection period. It is a value used to evaluate the safety energy efficiency of the power network system. The specific expression is:

[0082]

[0083] It should be explained that, in this embodiment, the power network system refers to the power network and various detection devices belonging to the power network.

[0084] RF is the average frequency of unauthorized access to the detection equipment of the power network during the optimized detection cycle. Unauthorized access refers to the access of unauthorized or unlicensed users or systems to network resources. The average frequency of authorized access directly reflects the security level of the network. If the average frequency of unauthorized access is high, it means that the network has a greater security risk and may face risks such as data leakage and service interruption.

[0085] DL is the packet loss rate of the power network during the optimization detection cycle. The packet loss rate refers to the proportion of data packets lost due to various reasons during data transmission. Packet loss is one of the common problems in network communication. It may be caused by many reasons, such as network congestion, equipment failure, signal interference, configuration errors, etc. The level of packet loss rate directly affects the reliability of the network and the efficiency of data transmission. A high packet loss rate will increase data transmission delays, reduce service quality, and may even lead to communication interruption.

[0086] TDU s is the total flow used by the sth detection equipment belonging to the power network during the optimized detection cycle, ΔTDU is the reference total flow used. It should be explained that the total flow used can appear in both the performance evaluation coefficient of the detection equipment belonging to the power network and the safety energy efficiency factor of the power network system. This is because the security risks in the power network system are usually closely related to abnormal flow. Abnormal flow may manifest as characteristics such as traffic surge. These abnormal flows may be caused by security threats such as hacker attacks, virus propagation, and malware. By monitoring and analyzing these abnormal flows in the total flow used, security threats can be discovered and located in a timely manner. Therefore, it can appear in two expressions at the same time, both of which are for detecting abnormalities in the power network system.

[0087] cu1 is the impact factor corresponding to the unauthorized access average frequency unit value preset in the network security database, which represents the numerical value of the impact degree of the unauthorized access average frequency unit value on the safety energy efficiency factor of the power network system. When used, the impact factor corresponding to the unauthorized access average frequency unit value can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the unauthorized access average frequency and the impact factor corresponding to the unauthorized access average frequency unit value preset in the network security database form a mapping set, and the real-time unauthorized access average frequency is input into the mapping set to obtain the impact factor corresponding to the unauthorized access average frequency unit value. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0088] cu2 is the impact factor corresponding to the unit value of packet loss rate preset in the network security database, which represents the numerical value of the impact degree of the unit value of packet loss rate on the safety energy efficiency factor of the power network system. When used, the impact factor corresponding to the unit value of packet loss rate can be directly obtained from the network security database, and the corresponding relationship can be a preset mapping relationship. For example, the packet loss rate and the impact factor corresponding to the unit value of packet loss rate preset in the network security database form a mapping set, and the real-time packet loss rate is input into the mapping set to obtain the impact factor corresponding to the unit value of packet loss rate. The mapping relationship can be one-to-one or many-to-one. In this example, its value range is [0,1].

[0089] cr3 is the correction factor corresponding to the total usage flow preset in the network security database, e is a natural constant, s is the number of each detection device, s = {1, 2, 3, ..., q}, q is the total number of detection devices.

[0090] Among them, δ is the safety energy efficiency factor of the power network system. When the detection equipment is subject to high-frequency unauthorized access, these illegal accesses will occupy network bandwidth and computing resources, thereby consuming a large amount of network resources and usage traffic, resulting in an abnormal increase in usage traffic and a large deviation from the reference usage traffic, which further leads to the failure to process the requests of legitimate users or services in a timely manner. In this case, the network may be congested, that is, data packets have to wait in queue or even be discarded during transmission due to insufficient network resources. Therefore, high-frequency unauthorized access will indirectly lead to an increase in packet loss rate, affecting network reliability and data transmission efficiency. Therefore, the overall performance of the intelligent decision-making adjustment scheme after coordinated disposal is determined from the two aspects of the power network and the detection equipment, thereby enhancing the power network system's ability to respond to security risks.

[0091] It needs to be explained that the analysis of the implementation effect of the intelligent decision-making plan focuses on the operating parameters of the detection equipment that has been implemented, and verifies the effectiveness of the intelligent decision-making plan by quantitatively evaluating its performance in actual operations. As for the intelligent decision-making adjustment plan, which is a plan formulated but not implemented by network security administrators, it is necessary to comprehensively consider the optimized power parameters of the power network and the optimized operating parameters of each detection equipment, and conduct a forward-looking evaluation to ensure the scientificity, rationality and feasibility of the adjustment plan.

[0092] In a specific embodiment, the present invention provides a method, system and equipment for linked response and coordinated handling of power network security incidents. By collecting the power parameters of the power network and evaluating the network security index of the power network, potential security threats in the power network can be discovered in a timely manner, providing a scientific basis for accurately matching the intelligent decision-making scheme of the power network. As a result, the detection equipment belonging to the power network coordinates the intelligent decision-making scheme, analyzes the operation parameters of the disposal of each detection equipment belonging to the power network, and judges the effect of the intelligent decision-making scheme. Feedback and adjustment are performed on the intelligent decision-making scheme of the power network to improve the ability and efficiency of the entire power network to respond to security incidents. Finally, the optimized power parameters of the power network and the optimized disposal operation parameters of each detection equipment belonging to the power network are collected, and feedback is provided on the intelligent decision-making adjustment scheme for power network security incidents. By continuously optimizing the intelligent decision-making scheme, its adaptability and effectiveness can be improved to ensure the safe and stable operation of the power network.

[0093] Reference Figure 2As shown, the second aspect of the present invention provides a power network security incident linkage response and collaborative handling system, including: a network security assessment module, a decision scheme matching module, an equipment efficiency analysis module, a decision scheme adjustment module and a decision scheme feedback module.

[0094] The second aspect of the present invention provides a system for the coordinated response and coordinated handling of power network security incidents, which also includes a network security database, which is used to store the impact factor corresponding to the unit value of the abnormal flow ratio, the impact factor corresponding to the unit value of the abnormal event frequency, the impact factor corresponding to the unit value of the total number of network attack types, the impact factor corresponding to the unit value of the request failure rate, the impact factor corresponding to the unit value of the average response time of the request instruction, the correction factor corresponding to the total flow usage, the impact factor corresponding to the unit value of the average frequency of unauthorized access, the impact factor corresponding to the unit value of the packet loss rate, the correction factor corresponding to the total flow usage, the network security threshold, the reference total flow usage, the performance evaluation threshold and the safety energy efficiency threshold.

[0095] The network security assessment module is connected to the decision scheme matching module and the network security database respectively, the decision scheme matching module is connected to the equipment effectiveness analysis module and the network security database respectively, the equipment effectiveness analysis module is connected to the decision scheme adjustment module and the network security database respectively, the decision scheme adjustment module is connected to the decision scheme feedback module and the network security database respectively, and the decision scheme feedback module is connected to the network security database.

[0096] The network security assessment module is used to collect power parameters of the power network based on the linkage response of each detection device belonging to the power network, thereby evaluating the network security index of the power network and comparing it with the network security threshold.

[0097] The decision-making scheme matching module is used to match an intelligent decision-making scheme for the power network when the network security index of the power network is less than the network security threshold, so that each detection device belonging to the power network can coordinate the intelligent decision-making scheme.

[0098] The equipment efficiency analysis module is used to coordinate the intelligent decision-making plan based on the various detection devices belonging to the power network, obtain the operation parameters of the disposal completion of each detection device belonging to the power network, analyze the efficiency evaluation coefficient of the detection equipment belonging to the power network, and compare it with the efficiency evaluation threshold.

[0099] The decision-making scheme adjustment module is used to provide feedback and adjust the intelligent decision-making scheme of the power network when the performance evaluation coefficient of the detection equipment belonging to the power network is less than the performance evaluation threshold, and mark it as the intelligent decision-making adjustment scheme of the power network, so that the detection equipment belonging to the power network can coordinate the intelligent decision-making adjustment scheme.

[0100] The decision-making scheme feedback module is used to coordinate the intelligent decision-making adjustment scheme based on the various detection devices belonging to the power network, collect the optimized power parameters of the power network and the optimized operation parameters of the various detection devices belonging to the power network, and determine the safety energy efficiency factor of the power network system. The power network feedback system thus provides feedback on the intelligent decision-making adjustment scheme for power network security events.

[0101] The third aspect of the present invention provides an application such as a device for the linked response and coordinated disposal method of power network security incidents, characterized in that it includes: a detection device, a central control platform and a power network feedback system; the detection device and the central control platform are connected via data communication; the central control platform is used to process the power parameters of the power network, the disposal and operation parameters of each detection device belonging to the power network, the optimized power parameters of the power network and the optimized disposal and operation parameters of each detection device belonging to the power network, obtain the safety energy efficiency factor of the power network system, and transmit it to the power network feedback system via data communication; the power network feedback system is used to receive the safety energy efficiency factor of the power network system transmitted by the central control platform, and finally provide feedback on the intelligent decision-making adjustment plan for the power network security incident.

[0102] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the present invention, they should all fall within the protection scope of the present invention.

Claims

1. A method for coordinated response and coordinated handling of power network security incidents, characterized in that: include: S1. Based on the linkage response of each detection device belonging to the power network, the power parameters of the power network are collected, thereby evaluating the network security index of the power network and comparing it with the network security threshold; S2. When the network security index of the power network is less than the network security threshold, an intelligent decision-making plan of the power network is matched, and the detection devices belonging to the power network coordinate the intelligent decision-making plan; S3. Based on the coordinated disposal of the intelligent decision-making scheme by each detection device belonging to the power network, the disposal completion operation parameters of each detection device belonging to the power network are obtained, the efficiency evaluation coefficient of the detection device belonging to the power network is analyzed, and compared with the efficiency evaluation threshold; S4. When the performance evaluation coefficient of the detection equipment belonging to the power network is less than the performance evaluation threshold, the intelligent decision-making plan of the power network is adjusted by feedback and marked as the intelligent decision-making adjustment plan of the power network, so that the detection equipment belonging to the power network coordinates the intelligent decision-making adjustment plan; S5. Based on the coordinated handling of intelligent decision-making adjustment plans by various detection equipment belonging to the power network, the optimized power parameters of the power network and the optimized operation parameters of various detection equipment belonging to the power network are collected, and the safety energy efficiency factor of the power network system is determined. The power network feedback system then provides feedback on the intelligent decision-making adjustment plans for power network security incidents.

2. The method for coordinated response and coordinated handling of power network security incidents according to claim 1, characterized in that: The specific evaluation process of evaluating the network security index of the power network is as follows: Extracting and parsing each data packet belonging to the power network from the power parameters of the power network, thereby obtaining the power parsing parameters of the power network, extracting the abnormal total flow of the power network within the safety detection period and the total flow of the power network within the safety detection period from the power parsing parameters of the power network, and performing ratio processing to obtain the abnormal flow ratio of the power network within the safety detection period; The total number of abnormal events in the power network within the safety detection period is extracted from the power analysis parameters of the power network, and the ratio is processed with the duration corresponding to the safety detection period to obtain the frequency of abnormal events in the power network within the safety detection period; The total number of network attack types of the power network within the security detection cycle is extracted from the power analysis parameters of the power network, and the network security index of the power network is comprehensively evaluated.

3. The method for coordinated response and coordinated handling of power network security incidents according to claim 2 is characterized in that: The network security index of the power network is specifically expressed as: Among them, δ is the network security index of the power network, ABT is the abnormal flow ratio of the power network during the security detection period, FA is the abnormal event frequency of the power network during the security detection period, AC is the total number of network attack types of the power network during the security detection period, e is a natural constant, cn1 is the impact factor corresponding to the unit value of the abnormal flow ratio preset in the network security database, cn2 is the impact factor corresponding to the unit value of the abnormal event frequency preset in the network security database, and cn3 is the impact factor corresponding to the unit value of the total number of network attack types preset in the network security database.

4. The method for coordinated response and coordinated handling of power network security incidents according to claim 1 is characterized in that: The detection equipment of the power network coordinates the intelligent decision-making scheme, and the specific processing process is as follows: According to the matched intelligent decision-making scheme of the power network, a collaborative processing instruction corresponding to the intelligent decision-making scheme of the power network is generated, and the collaborative processing instruction is sent to each detection device belonging to the power network, thereby each detection device belonging to the power network performs collaborative processing on the intelligent decision-making scheme.

5. The method for coordinated response and coordinated handling of power network security incidents according to claim 1 is characterized in that: The feedback adjustment of the intelligent decision-making scheme of the power network is specifically analyzed as follows: Based on the fact that the performance evaluation coefficient of the detection equipment belonging to the power network is less than the performance evaluation threshold, difference processing is performed to obtain the performance evaluation deviation value of the detection equipment belonging to the power network, and a performance adjustment plan for the detection equipment belonging to the power network is matched, which is recorded as the intelligent decision-making adjustment plan of the power network. The intelligent decision-making plan of the power network is adjusted and fed back.

6. The method for coordinated response and coordinated handling of power network security incidents according to claim 1, characterized in that: The specific analysis process of analyzing the efficiency evaluation coefficient of the detection equipment belonging to the power network is as follows: Extracting the total number of successful request instructions and the total number of request instructions of each detection device belonging to the power network within the performance detection cycle from the disposal completion operation parameters of each detection device belonging to the power network, and performing data processing to obtain the request failure rate of each detection device belonging to the power network within the performance detection cycle; Extracting the response time of each request instruction of each detection device belonging to the power network within the performance detection cycle from the disposal completion operation parameters of each detection device belonging to the power network, and performing average processing to obtain the average response time of each request instruction of each detection device belonging to the power network within the performance detection cycle; The total usage flow of each detection equipment belonging to the power network during the performance detection cycle is extracted from the disposal completion operation parameters of each detection equipment belonging to the power network, and the efficiency evaluation coefficient of the detection equipment belonging to the power network is comprehensively analyzed.

7. The method for coordinated response and coordinated handling of power network security incidents according to claim 1, characterized in that: The specific determination process of determining the safety energy efficiency factor of the power network system is as follows: Extract the number of unauthorized accesses of each detection device belonging to the power network within the optimized detection period from the optimized disposal completed operation parameters of each detection device belonging to the power network, perform ratio processing with the duration corresponding to the optimized detection period, and obtain the frequency of unauthorized accesses of each detection device belonging to the power network within the optimized detection period, and perform mean processing to obtain the average frequency of unauthorized accesses of the detection devices belonging to the power network within the optimized detection period; The total flow used by each detection equipment belonging to the power network during the optimized detection period is extracted from the optimized operation parameters of each detection equipment belonging to the power network. At the same time, the packet loss rate of the power network during the optimized detection period is extracted from the optimized power parameters of the power network, thereby comprehensively determining the safety and energy efficiency factors of the power network system.

8. The method for coordinated response and coordinated handling of power network security incidents according to claim 1, characterized in that: The intelligent decision-making adjustment plan for power network security events is fed back, and the specific feedback process is as follows: If the safety energy efficiency factor of the power network system is greater than the safety energy efficiency threshold, the intelligent decision-making adjustment plan of the power network is updated to the corresponding intelligent decision-making plan, and the update result is fed back; If the safety energy efficiency factor of the power network system is less than or equal to the safety energy efficiency threshold, feedback and early warning will be given to the intelligent decision-making adjustment plan for the power network security incident.

9. The power network security incident linkage response and coordinated disposal system is characterized by: include: A network security assessment module is used to collect power parameters of the power network based on the linkage response of each detection device belonging to the power network, thereby evaluating the network security index of the power network and comparing it with the network security threshold; A decision-making scheme matching module is used to match an intelligent decision-making scheme for the power network when the network security index of the power network is less than the network security threshold, so that each detection device belonging to the power network can coordinately deal with the intelligent decision-making scheme; The equipment efficiency analysis module is used to coordinate the intelligent decision-making scheme based on the various detection devices belonging to the power network, obtain the operation parameters of the disposal completion of each detection device belonging to the power network, analyze the efficiency evaluation coefficient of the detection equipment belonging to the power network, and compare it with the efficiency evaluation threshold; A decision-making scheme adjustment module is used to provide feedback and adjust the intelligent decision-making scheme of the power network when the performance evaluation coefficient of the detection equipment belonging to the power network is less than the performance evaluation threshold, and mark it as the intelligent decision-making adjustment scheme of the power network, so that the detection equipment belonging to the power network can coordinate the intelligent decision-making adjustment scheme; The decision-making scheme feedback module is used to coordinate the intelligent decision-making adjustment scheme based on the various detection equipment belonging to the power network, collect the optimized power parameters of the power network and the optimized operation parameters of the various detection equipment belonging to the power network, and determine the safety energy efficiency factor of the power network system. The power network feedback system thus provides feedback on the intelligent decision-making adjustment scheme for power network security incidents.

10. A device for applying any one of claims 1 to 8 to a method for coordinated response and coordinated handling of power network security incidents, characterized in that: include: Testing equipment, central control platform and power network feedback system; The detection equipment and the central control platform are connected via data communication; The central control platform is used to process the power parameters of the power network, the operation parameters of each detection device belonging to the power network, the optimized power parameters of the power network and the optimized operation parameters of each detection device belonging to the power network, obtain the safety energy efficiency factor of the power network system, and transmit it to the power network feedback system through data communication; The power network feedback system is used to receive the safety energy efficiency factor of the power network system transmitted by the central control platform, and finally provide feedback on the intelligent decision-making adjustment plan for the power network security incident.

Images