Network security situation awareness method for electric power digitization

Abstract

The invention discloses a network security situation awareness method for electric power digitization, which relates to the technical field of energy digitization, and comprises the following steps: S1, constructing a situation assessment index system; s2, data acquisition and processing; s3, situation assessment and analysis; and S4, emergency response and recovery. According to the network security situation awareness method for electric power digitization, a more professional and detailed security situation assessment index system is constructed by combining the characteristics and actual requirements of an electric power monitoring system, and the method can be better suitable for the network security of the electric power monitoring system so as to improve the accuracy of situation awareness of the electric power monitoring system; and a sound emergency response mechanism is also established, after security threats are found, an alarm mechanism can be automatically triggered, an emergency response team is notified, and corresponding measures are synchronously taken to automatically carry out disposal and recovery work, so that the response time is effectively shortened, and troubleshooting and root cause analysis can be carried out aiming at fault causes.

Description

Technical Field

[0001] The present invention relates to the technical field of energy digitization, and in particular to a network security situation awareness method for power digitization. Background Art

[0002] Power digitalization refers to the use of digital technology and control technology based on power big data to optimize various links such as energy production, transmission and consumption, and achieve efficient management and precise matching of energy. This process not only improves the safety, productivity, availability and sustainability of the energy system, but also promotes the deep integration of traditional energy and new energy, and promotes the green transformation of the energy structure. Cybersecurity situational awareness of power digitalization refers to the ability to monitor, analyze and evaluate the overall situation of cybersecurity in the power system in real time. Based on technologies such as big data and artificial intelligence, it comprehensively analyzes and processes information such as network traffic, security incidents, and vulnerabilities in the power system to detect potential security threats in advance and take corresponding defensive measures.

[0003] However, the existing network security situation awareness indicator system is generally designed based on a general network environment, and does not fully consider the particularity of the power monitoring system. The power monitoring system includes various intelligent devices and power business systems, which are highly professional and complex. Its security threats and risk sources are different from those of the general network environment, so more professional and detailed indicators are needed. In addition, although the existing situation awareness system can automatically trigger defense measures after discovering security threats, it still requires manual intervention to respond, which increases the response time and false alarm rate.

[0004] Therefore, there is an urgent need to improve this shortcoming. The present invention studies and improves the existing technology and its shortcomings, and provides a network security situation awareness method for power digitization. Summary of the invention

[0005] The purpose of the present invention is to provide a network security situation awareness method for power digitization to solve the problems raised in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a network security situation awareness method for power digitalization, comprising the following steps:

[0007] S1. Constructing a situation assessment indicator system:

[0008] S11. Demand analysis: Determine the specific goals of network security situation awareness for the power monitoring system, investigate the current security status of the power monitoring system, and analyze the specific network security needs of the power monitoring system based on the goals and status;

[0009] S12. Indicator selection: According to the characteristics and requirements of the power monitoring system, determine the dimensions of security situation assessment, namely equipment security, network security, data security, and application security, and select specific assessment indicators under each assessment dimension, including equipment failure rate, network traffic anomaly, data leakage risk, and application vulnerability, and then clearly define each selected indicator, including its meaning, calculation method, data source, etc.;

[0010] S13. Establishment of index system: Establish an index system with a hierarchical structure, and assign corresponding weights according to the degree of influence of each index on the security situation of the power monitoring system. Then, conduct trial operation and evaluation based on the index system initially constructed, and adjust and improve the index system based on the evaluation results.

[0011] S2. Data collection and processing:

[0012] Clarify the source and scope of data collection, including various types of equipment, networks, and databases of the power monitoring system. Use data collection methods including sensors and log collection tools to collect data required for security situation assessment in real time or regularly. Then perform pre-processing operations such as cleaning, denoising, and standardization on the collected data to improve data quality and availability.

[0013] S3. Situation Assessment and Analysis:

[0014] Based on the constructed indicator system and data source, a machine learning algorithm is used to build a network security situation assessment model for the power monitoring system. The assessment model is used to conduct real-time assessment of the network security situation of the power monitoring system, and a security situation report is generated based on the assessment results of the model.

[0015] Based on historical data and real-time assessment results, the network security situation of the power monitoring system is predicted and analyzed to detect potential security threats in advance. The security situation of the system is quantitatively evaluated and risk rated according to the evaluation index system to clarify the severity and impact of security risks.

[0016] S4. Emergency Response and Recovery:

[0017] Establish an emergency response mechanism, clarify the emergency response process and division of responsibilities, and immediately trigger the alarm mechanism to notify the emergency response team when potential security threats are discovered. The alarm information includes key information such as threat type, scope of impact, severity, etc., so that the emergency response team can respond quickly. According to the preset emergency response plan, the automated response process is initiated at the same time, and corresponding measures are automatically taken to handle and restore the system. After the system is restored, summarize the experience and lessons learned, and manually improve the emergency response mechanism.

[0018] Furthermore, in step S11, the specific goals of the network security situation awareness of the power monitoring system include but are not limited to ensuring the stable operation of the power monitoring system, preventing external attacks, and timely detecting and handling internal threats. The existing security status includes but is not limited to existing security threats, historical security incidents, system architecture, and network topology.

[0019] Furthermore, in step S12, the definition of equipment failure rate specifically includes:

[0020] Meaning: The frequency of a device temporarily losing its specified function due to wear or operation during its life cycle. It is used to reflect the stability and reliability of the device operation.

[0021] Calculation method: Based on the ratio of the number of equipment failures within a certain period of time to the total equipment operating time, the calculation formula is: Equipment failure rate = number of failures / total operating time. The number of failures refers to the total number of equipment failures within a certain period of time, and the total operating time refers to the total working time of the equipment within the period of time.

[0022] Data source: Equipment operation records and maintenance records, which contain information such as the time, cause, and handling of equipment failures, and are the basis for calculating equipment failure rates.

[0023] Furthermore, in step S12, the definition of network traffic anomaly specifically includes:

[0024] Meaning: Data traffic that is inconsistent with normal working behavior in the network, specifically manifested as abnormal changes in transmission speed, frequency, packet size or number, etc.

[0025] Calculation method: By comparing the difference between actual traffic and normal traffic model, it is determined whether there is abnormality in network traffic. Specific calculation methods include mean variance analysis, spectrum analysis, support vector machine (SVM), decision tree, etc.

[0026] Data source: Network traffic logs and statistics generated by network devices (such as routers, switches) and monitoring tools. The data records the transmission of data packets in the network, including timestamp, source address, destination address, port number, protocol type, packet size and other information.

[0027] Furthermore, in step S12, the definition of data leakage risk specifically includes:

[0028] Meaning: The possibility of confidential, private, protected or sensitive information being acquired or exposed by unauthorized persons is used to reflect the threats and vulnerabilities faced by an organization in protecting sensitive data;

[0029] Calculation method: Use a risk assessment framework (such as NIST's risk assessment framework) to assess the likelihood, impact, and vulnerability of a data breach;

[0030] Data sources: including security vulnerability scan reports, penetration test results, employee security awareness training records, third-party risk assessment reports, etc., which provide important information about the organization's security status, potential threats and vulnerabilities.

[0031] Furthermore, in step S12, the definition of application vulnerability specifically includes:

[0032] Meaning: A flaw or weakness in a software application that can be exploited by an attacker to perform unauthorized operations or access sensitive data;

[0033] Computational methods: Discovery and assessment through vulnerability scanning and penetration testing, where vulnerability scanning tools can automatically detect known vulnerabilities and weaknesses in applications, while penetration testing evaluates the security and defense capabilities of applications by simulating attacks;

[0034] Data sources: The results of vulnerability scanning tools and penetration tests, as well as the latest information about application vulnerabilities obtained from security bulletins, vulnerability databases (such as CVE, CNVD), and other channels.

[0035] Furthermore, in step S13, the hierarchical structure includes a target layer, a criterion layer and an indicator layer, and the target layer is the overall goal of the network security situation assessment of the power monitoring system, the criterion layer is security indicators of different categories, and the indicator layer is specific evaluation indicators.

[0036] Furthermore, in step S13, the weight allocation is implemented by using an expert scoring method and a hierarchical analysis method;

[0037] The expert scoring method invites experts or experienced practitioners in related fields to score the importance of various indicators or factors, and then calculates the weights based on the scoring results. The specific steps are as follows:

[0038] Determine the evaluation indicators: clarify the specific indicators or factors that need to be evaluated;

[0039] Select experts: Invite experts with professional knowledge and rich experience in relevant fields to participate in scoring;

[0040] Design a scoring table: Develop a scoring table and clarify the scoring criteria or range of each indicator;

[0041] Collect scoring data: Experts score each indicator based on their own judgment;

[0042] Calculate weights: Based on the expert scoring results, use the weighted average and median methods to calculate the weights of each indicator;

[0043] The analytic hierarchy process (AHP) decomposes complex problems into multiple components, and groups the factors according to the dominant relationship to form a hierarchical structure. The relative importance of the factors in the hierarchy is determined by pairwise comparison, and then the order weight reflecting the relative importance of each factor is comprehensively calculated. The weight reflecting the relative importance order of all factors is calculated by the total ranking between all levels. The specific operation steps are as follows:

[0044] Establish a hierarchical model: divide the decision-making goals, factors to be considered (decision-making criteria) and decision-making objects into the highest level, the middle level and the lowest level according to their mutual relationships, and draw a hierarchical diagram;

[0045] Construct a judgment matrix: compare the elements at the same level in pairs, quantitatively describe their importance, and form a judgment matrix;

[0046] Calculate the weight vector and perform consistency test: Calculate the maximum eigenvalue and the corresponding eigenvector for each judgment matrix, and use the consistency index, random consistency index and consistency ratio to perform consistency test; if the test passes, the eigenvector (normalized) is the weight vector, if not, reconstruct it into a pair comparison matrix;

[0047] Calculate the combined weight vector and perform a combined consistency test: Calculate the combined weight vector of the lowest layer for the target, and perform a combined consistency test according to the formula. If the test passes, make a decision based on the result represented by the combined weight vector. Otherwise, reconsider the model or reconstruct the pairwise comparison arrays with larger consistency ratios.

[0048] Furthermore, in step S3, the predictive analysis of the network security situation includes historical data analysis, and the historical data analysis uses statistical analysis and time series analysis methods to perform trend analysis on historical data, identify the periodicity, seasonality, and suddenness characteristics of the network security situation, and identify potential security event patterns and attack behavior patterns in historical data through data mining and machine learning algorithms.

[0049] Furthermore, in step S4, the automatic handling and recovery specifically includes the following operations:

[0050] Threat isolation and blocking: Through network isolation technology, the threatened system or network area is isolated from other parts to prevent the threat from spreading further, and firewalls, intrusion prevention systems and other equipment are used to block and filter abnormal traffic;

[0051] System recovery: Use backup data and recovery strategies to quickly recover damaged systems, including database recovery, application restart, system configuration recovery, etc.

[0052] Troubleshooting and root cause analysis: After the system is restored, troubleshooting is performed to find out the root cause of the security threat. By analyzing logs, traffic records and other information, the source and propagation path of the threat are tracked to provide a basis for subsequent prevention work;

[0053] System repair: Based on the results of the root cause analysis, the system is comprehensively inspected and repaired to prevent similar threats from happening again by patching vulnerabilities and strengthening the system.

[0054] The present invention provides a network security situation awareness method for power digitalization, which has the following features:

[0055] Beneficial effects:

[0056] The present invention combines the characteristics and actual needs of the power monitoring system to construct a more professional and detailed security situation assessment index system, which can be better applied to the network security of the power monitoring system to improve the accuracy of its situation perception, so as to accurately predict and analyze the network security situation of the power monitoring system based on historical data and real-time evaluation results, and reduce the false alarm rate. In addition, the present invention has also established a sound emergency response mechanism, which can automatically trigger the alarm mechanism after discovering a security threat, notify the emergency response team, and simultaneously take corresponding measures to automatically handle and restore the work, effectively reducing the response time, and will also investigate and analyze the root cause of the fault, so as to comprehensively check and repair the system to prevent similar threats from happening again. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A schematic diagram of the steps of a method for network security situation awareness for power digitalization according to the present invention;

[0058] Figure 2 A schematic diagram of a situation assessment index system for constructing a network security situation awareness method for power digitalization according to the present invention. DETAILED DESCRIPTION

[0059] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0060] like Figure 1-Figure 2 As shown, a network security situation awareness method for power digitalization includes the following steps:

[0061] S1. Constructing a situation assessment indicator system:

[0062] S11. Demand analysis: Determine the specific goals of the power monitoring system's network security situation awareness, including ensuring the stable operation of the power monitoring system, preventing external attacks, and timely discovering and handling internal threats, and investigate the current security status of the power monitoring system, including existing security threats, historical security events, system architecture, network topology, etc. Based on the goals and status, analyze the specific needs of the power monitoring system in terms of network security, such as which links are vulnerable to attacks and which data need to be protected;

[0063] S12. Indicator selection: According to the characteristics and requirements of the power monitoring system, determine the dimensions of security situation assessment, namely equipment security, network security, data security, and application security, and select specific assessment indicators under each assessment dimension, including equipment failure rate, network traffic anomaly, data leakage risk, and application vulnerability, and then clearly define each selected indicator;

[0064] In this embodiment, each indicator is defined as follows:

[0065] 1) The definition of equipment failure rate specifically includes:

[0066] Meaning: The frequency of a device temporarily losing its specified function due to wear or operation during its life cycle. It is used to reflect the stability and reliability of the device operation.

[0067] Calculation method: Based on the ratio of the number of equipment failures within a certain period of time to the total equipment operating time, the calculation formula is: Equipment failure rate = number of failures / total operating time. The number of failures refers to the total number of equipment failures within a certain period of time, and the total operating time refers to the total working time of the equipment within the period of time.

[0068] Data source: Equipment operation records and maintenance records, which contain information such as the time, cause, and treatment of equipment failures, and are the basis for calculating equipment failure rates;

[0069] 2) The definition of network traffic anomaly includes:

[0070] Meaning: Data traffic that is inconsistent with normal working behavior in the network, specifically manifested as abnormal changes in transmission speed, frequency, packet size or number, etc.

[0071] Calculation method: By comparing the difference between actual traffic and normal traffic model, it is determined whether there is abnormality in network traffic. Specific calculation methods include mean variance analysis, spectrum analysis, support vector machine (SVM), decision tree, etc.

[0072] Data sources: Network traffic logs and statistics generated by network devices (such as routers, switches) and monitoring tools. The data records the transmission of data packets in the network, including timestamps, source addresses, destination addresses, port numbers, protocol types, packet sizes, and other information.

[0073] 3) The definition of data leakage risk specifically includes:

[0074] Meaning: The possibility of confidential, private, protected or sensitive information being acquired or exposed by unauthorized persons is used to reflect the threats and vulnerabilities faced by an organization in protecting sensitive data;

[0075] Calculation method: Use a risk assessment framework (such as NIST's risk assessment framework) to assess the likelihood, impact, and vulnerability of a data breach;

[0076] Data sources: including security vulnerability scanning reports, penetration test results, employee security awareness training records, third-party risk assessment reports, etc., which provide important information about the organization's security status, potential threats and vulnerabilities;

[0077] 4) The definition of application vulnerabilities specifically includes:

[0078] Meaning: A flaw or weakness in a software application that can be exploited by an attacker to perform unauthorized operations or access sensitive data;

[0079] Computational methods: Discovery and assessment through vulnerability scanning and penetration testing, where vulnerability scanning tools can automatically detect known vulnerabilities and weaknesses in applications, while penetration testing evaluates the security and defense capabilities of applications by simulating attacks;

[0080] Data sources: results of vulnerability scanning tools and penetration tests, as well as the latest information about application vulnerabilities obtained from security bulletins, vulnerability databases (such as CVE, CNVD), and other channels;

[0081] S13, establishment of index system: establish an index system with a hierarchical structure, which includes a target layer, a criterion layer and an index layer, and the target layer is the overall goal of the network security situation assessment of the power monitoring system, the criterion layer is the security indicators of different categories, and the index layer is the specific evaluation indicator. According to the degree of influence of each indicator on the security situation of the power monitoring system, the corresponding weight is assigned, and then the preliminary constructed index system is tested and evaluated, and the index system is adjusted and improved according to the evaluation results. In this step, the weight allocation is realized by the expert scoring method and the hierarchical analysis method;

[0082] The expert scoring method invites experts or experienced practitioners in related fields to score the importance of various indicators or factors, and then calculates the weights based on the scoring results. The specific steps are as follows:

[0083] Determine the evaluation indicators: clarify the specific indicators or factors that need to be evaluated;

[0084] Select experts: Invite experts with professional knowledge and rich experience in relevant fields to participate in scoring;

[0085] Design a scoring table: Develop a scoring table and clarify the scoring criteria or range of each indicator;

[0086] Collect scoring data: Experts score each indicator based on their own judgment;

[0087] Calculate weights: Based on the expert scoring results, use the weighted average and median methods to calculate the weights of each indicator;

[0088] The analytic hierarchy process (AHP) decomposes complex problems into multiple components, and groups the factors according to the dominant relationship to form a hierarchical structure. The relative importance of the factors in the hierarchy is determined by pairwise comparison, and then the order weight reflecting the relative importance of each factor is calculated comprehensively. The weight reflecting the relative importance order of all factors is calculated through the total ranking between all levels. The specific operation steps are as follows:

[0089] Establish a hierarchical model: divide the decision-making goals, factors to be considered (decision-making criteria) and decision-making objects into the highest level, the middle level and the lowest level according to their mutual relationships, and draw a hierarchical diagram;

[0090] Construct a judgment matrix: compare the elements at the same level in pairs and quantitatively describe their importance. In this embodiment, a 1-9 scale (i.e., equally important is 1, slightly important is 3, and strongly important is 7) is used to score and form a judgment matrix;

[0091] Calculate the weight vector and perform consistency test: Calculate the maximum eigenvalue and the corresponding eigenvector for each judgment matrix, and use the consistency index, random consistency index and consistency ratio to perform consistency test; if the test passes, the eigenvector (normalized) is the weight vector, if not, reconstruct it into a pair comparison matrix;

[0092] Calculate the combined weight vector and perform a combined consistency test: Calculate the combined weight vector of the lowest layer for the target, and perform a combined consistency test according to the formula. If the test passes, make a decision based on the result represented by the combined weight vector. Otherwise, reconsider the model or reconstruct the pairwise comparison arrays with larger consistency ratios.

[0093] S2. Data collection and processing:

[0094] Clarify the source and scope of data collection, including various types of equipment, networks, and databases of the power monitoring system. Use data collection methods including sensors and log collection tools to collect data required for security situation assessment in real time or regularly. Then perform pre-processing operations such as cleaning, denoising, and standardization on the collected data to improve data quality and availability.

[0095] S3. Situation Assessment and Analysis:

[0096] Based on the constructed indicator system and data source, a machine learning algorithm is used to build a network security situation assessment model for the power monitoring system. The assessment model is used to conduct real-time assessment of the network security situation of the power monitoring system, and a security situation report is generated based on the assessment results of the model.

[0097] In this embodiment, for network security situation assessment, the selected machine learning algorithms include classification algorithms (such as decision trees, random forests, support vector machines, etc.), clustering algorithms (such as K-means), time series analysis algorithms (such as ARIMA, LSTM, etc.) and integrated learning algorithms, etc., and the selected machine learning algorithms are trained using the preprocessed data; during the training process, the algorithm parameters are adjusted to optimize the model performance, and the generalization ability of the model is evaluated by methods such as cross-validation; and then the trained model is verified using an independent test data set;

[0098] The pre-processed real-time data is input into the trained machine learning model to conduct real-time assessment of the network security situation. The model will output the security situation score or level of the current power monitoring system;

[0099] Based on the evaluation results of the model, a network security situation report is automatically generated, and the report includes an overview of the current security situation, key indicator analysis, potential threat warnings, recommended measures, etc.

[0100] Based on historical data and real-time assessment results, the network security situation of the power monitoring system is predicted and analyzed to detect potential security threats in advance. The security situation of the system is quantitatively evaluated and risk rated according to the evaluation index system to clarify the severity and impact of security risks.

[0101] In this embodiment, the specific operations of predictive analysis of network security situation are as follows:

[0102] Collect network security-related data of the power monitoring system in the past year, half a year or longer, including but not limited to intrusion detection records, vulnerability scanning reports, system logs, application logs, and network traffic data, and use statistical analysis and time series analysis methods to conduct trend analysis on historical data to identify the periodicity, seasonality, and suddenness of network security trends. Then, through data mining and machine learning algorithms, identify potential security event patterns and attack behavior patterns in historical data to provide a basis for subsequent predictive analysis;

[0103] Integrate real-time assessment results with historical data analysis results, taking into account current situations and historical trends to gain a more comprehensive understanding of the security status of the system;

[0104] Based on the historical data analysis results and real-time evaluation results, a network security situation prediction model is constructed. The model can use time series analysis, machine learning and other methods to predict the security situation in the future based on historical data and current situation, and use the prediction model to discover potential security threats that may exist in the power monitoring system in advance, such as impending network attacks and system vulnerabilities being exploited.

[0105] S4. Emergency Response and Recovery:

[0106] Establish an emergency response mechanism, clarify the emergency response process and division of responsibilities, and immediately trigger the alarm mechanism to notify the emergency response team when a potential security threat is discovered. The alarm information includes key information such as threat type, impact range, and severity, so that the emergency response team can respond quickly. According to the preset emergency response plan, the automated response process is started at the same time, and corresponding measures are automatically taken to handle and restore the work, including the following operations:

[0107] Threat isolation and blocking: Through network isolation technology, the threatened system or network area is isolated from other parts to prevent the threat from spreading further, and firewalls, intrusion prevention systems and other equipment are used to block and filter abnormal traffic;

[0108] System recovery: Use backup data and recovery strategies to quickly recover damaged systems, including database recovery, application restart, system configuration recovery, etc.

[0109] Troubleshooting and root cause analysis: After the system is restored, troubleshooting is performed to find out the root cause of the security threat. By analyzing logs, traffic records and other information, the source and propagation path of the threat are tracked to provide a basis for subsequent prevention work;

[0110] System repair: Based on the root cause analysis results, the system is comprehensively inspected and repaired to prevent similar threats from happening again through vulnerability patching and system reinforcement;

[0111] In addition, after the system is restored, lessons learned are summarized and the emergency response mechanism is manually improved.

[0112] The embodiments of the present invention are given for the purpose of illustration and description, and are not intended to be exhaustive or to limit the invention to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present invention and to enable those of ordinary skill in the art to understand the present invention and thereby design various embodiments with various modifications suitable for specific uses.

Claims

1. A network security situation awareness method for power digitalization, characterized in that: The following steps are involved: S1. Constructing a situation assessment indicator system: S11. Demand analysis: Determine the specific goals of network security situation awareness for the power monitoring system, investigate the current security status of the power monitoring system, and analyze the specific network security needs of the power monitoring system based on the goals and status; S12. Indicator selection: Determine the dimensions of security situation assessment, namely, equipment security, network security, data security, and application security, and select specific assessment indicators under each assessment dimension, including equipment failure rate, network traffic anomaly, data leakage risk, and application vulnerability, and then clearly define each selected indicator; S13. Establishment of index system: Establish an index system with a hierarchical structure, and assign corresponding weights according to the degree of influence of each index on the security situation of the power monitoring system. Then, conduct trial operation and evaluation based on the index system initially constructed, and adjust and improve the index system based on the evaluation results. S2. Data collection and processing: Clarify the source and scope of data collection, use data collection methods including sensors and log collection tools to collect data required for security situation assessment in real time or regularly, and then pre-process the collected data; S3. Situation Assessment and Analysis: Based on the constructed indicator system and data source, a machine learning algorithm is used to build a network security situation assessment model for the power monitoring system. The assessment model is used to conduct real-time assessment of the network security situation of the power monitoring system, and a security situation report is generated based on the assessment results of the model. Based on historical data and real-time assessment results, the network security situation of the power monitoring system is predicted and analyzed to detect potential security threats in advance. The security situation of the system is quantitatively evaluated and risk rated according to the evaluation index system to clarify the severity and impact of security risks. S4. Emergency Response and Recovery: Establish an emergency response mechanism, clarify the emergency response process and division of responsibilities, and immediately trigger the alarm mechanism when potential security threats are discovered, notify the emergency response team, and simultaneously start the automated response process to automatically take corresponding measures to handle and recover the situation. After the system is restored, summarize the experience and lessons learned and manually improve the emergency response mechanism.

2. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S11, the specific goals of the network security situation awareness of the power monitoring system include but are not limited to ensuring the stable operation of the power monitoring system, preventing external attacks, and timely discovering and handling internal threats. The existing security status includes but is not limited to existing security threats, historical security incidents, system architecture, and network topology.

3. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S12, the definition of equipment failure rate specifically includes: Meaning: The frequency of a device temporarily losing its specified function due to wear or operation during its life cycle. It is used to reflect the stability and reliability of the device operation. Calculation method: Based on the ratio of the number of equipment failures within a certain period of time to the total equipment operating time, the calculation formula is: Equipment failure rate = number of failures / total operating time. The number of failures refers to the total number of equipment failures within a certain period of time, and the total operating time refers to the total working time of the equipment within the period of time. Data source: Equipment operation records and maintenance records. The records contain information on the time, cause, and handling of equipment failures, and are the basis for calculating equipment failure rates.

4. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S12, the definition of network traffic anomaly specifically includes: Meaning: Data traffic that is inconsistent with normal working behavior in the network, manifested as abnormal changes in transmission speed, frequency, packet size or number; Calculation method: By comparing the difference between actual traffic and normal traffic model, it is determined whether there is abnormality in network traffic. Specific calculation methods include mean variance analysis, spectrum analysis, support vector machine, and decision tree; Data source: Network traffic logs and statistics generated by network devices and monitoring tools. The data records the transmission of data packets in the network, including timestamp, source address, destination address, port number, protocol type, and packet size information.

5. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S12, the definition of data leakage risk specifically includes: Meaning: The possibility of confidential, private, protected or sensitive information being acquired or exposed by unauthorized persons is used to reflect the threats and vulnerabilities faced by an organization in protecting sensitive data; Calculation Methodology: Use a risk assessment framework to assess the likelihood, impact, and vulnerability of a data breach; Data sources: including security vulnerability scan reports, penetration test results, employee security awareness training records, and third-party risk assessment reports. These data provide important information about the organization’s security status, potential threats, and vulnerabilities.

6. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S12, the definition of application vulnerability specifically includes: Meaning: A flaw or weakness in a software application that can be exploited by an attacker to perform unauthorized operations or access sensitive data; Computational methods: Discovery and assessment through vulnerability scanning and penetration testing, where vulnerability scanning tools can automatically detect known vulnerabilities and weaknesses in applications, while penetration testing evaluates the security and defense capabilities of applications by simulating attacks; Data sources: The results of vulnerability scanning tools and penetration tests, as well as the latest information about application vulnerabilities obtained from security bulletins and vulnerability databases.

7. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S13, the hierarchical structure includes a target layer, a criterion layer and an indicator layer, and the target layer is the overall goal of the network security situation assessment of the power monitoring system, the criterion layer is security indicators of different categories, and the indicator layer is specific evaluation indicators.

8. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S13, weight allocation is implemented by expert scoring method and hierarchical analysis method; The expert scoring method invites experts or experienced practitioners in related fields to score the importance of various indicators or factors, and then calculates the weights based on the scoring results. The specific steps are as follows: Determine the evaluation indicators: clarify the specific indicators or factors that need to be evaluated; Select experts: Invite experts with professional knowledge and rich experience in relevant fields to participate in scoring; Design a scoring table: Develop a scoring table and clarify the scoring criteria or range of each indicator; Collect scoring data: Experts score each indicator based on their own judgment; Calculate weights: Based on the expert scoring results, use the weighted average and median methods to calculate the weights of each indicator; The analytic hierarchy process decomposes a complex problem into multiple components, and groups the factors according to the dominant relationship to form a hierarchical structure. The relative importance of the factors in the hierarchy is determined by pairwise comparison, and then the order weight reflecting the relative importance of each factor is comprehensively calculated. The weight reflecting the relative importance order of all factors is calculated by the total ranking between all levels. The specific operation steps are as follows: Establish a hierarchical model: divide the decision-making objectives, decision-making criteria and decision-making objects into the highest level, the middle level and the lowest level according to their mutual relationship, and draw a hierarchical diagram; Construct a judgment matrix: compare the elements at the same level in pairs, quantitatively describe their importance, and form a judgment matrix; Calculate the weight vector and perform consistency test: Calculate the maximum eigenvalue and the corresponding eigenvector for each judgment matrix, and use the consistency index, random consistency index and consistency ratio to perform consistency test; if the test passes, the eigenvector is the weight vector, if not, reconstruct it into a pair comparison matrix; Calculate the combined weight vector and perform a combined consistency test: Calculate the combined weight vector of the lowest layer for the target, and perform a combined consistency test according to the formula. If the test passes, make a decision based on the result represented by the combined weight vector. Otherwise, reconsider the model or reconstruct the pairwise comparison arrays with larger consistency ratios.

9. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S3, the predictive analysis of the network security situation includes historical data analysis, and the historical data analysis uses statistical analysis and time series analysis methods to perform trend analysis on historical data, identify the periodicity, seasonality, and suddenness characteristics of the network security situation, and identify potential security event patterns and attack behavior patterns in historical data through data mining and machine learning algorithms.

10. A network security situation awareness method for power digitalization according to claim 1, characterized in that: In step S4, the automatic handling and recovery specifically includes the following operations: Threat isolation and blocking: Use network isolation technology to isolate the threatened system or network area from other parts, and use firewalls and intrusion prevention systems to block and filter abnormal traffic; System recovery: Use backup data and recovery strategies to quickly recover damaged systems, including database recovery, application restart, and system configuration recovery operations; Troubleshooting and root cause analysis: After the system is restored, troubleshooting is performed to find out the root cause of the security threat, and the source and propagation path of the threat are tracked by analyzing logs and traffic record information; System repair: Based on the results of the root cause analysis, the system is comprehensively inspected and repaired to prevent similar threats from happening again by patching vulnerabilities and strengthening the system.

Images