Security protection system for cloud side end collaborative interaction of power distribution Internet of Things

Abstract

The invention relates to the technical field of information security, in particular to a power distribution Internet of Things cloud side end collaborative interaction security protection system, which comprises a network flow monitoring module, an abnormal flow identification module, a security threat response module, a network attack early warning module, a behavior pattern analysis module and an access authority management module. According to the method, the network flow data is collected and analyzed in real time, the abnormal flow recognition speed and accuracy are enhanced, the security threat response speed and efficiency are improved, measures are taken in time at the early stage of a problem, the risks of data leakage and network attacks are reduced, and the timeliness of defense measures is improved by combining security threat response and network attack early warning; by analyzing the relevance between threat events, the complex multi-stage attack activity is effectively predicted and identified, the access data and the communication mode of the equipment are monitored in real time, and the access authority and the trust level are adjusted, so that the security protection is more targeted and flexible, and the management efficiency of the risk equipment is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technologies, and in particular to a security protection system for cloud-edge-terminal collaborative interaction in a power distribution Internet of Things. Background Art

[0002] The field of information security technology focuses on protecting data security in computer systems and network environments to prevent unauthorized access, leakage, destruction and tampering of data. It includes network security, application security, data encryption, intrusion detection and response, security policy and standard formulation. Through a full range of security measures from hardware and software solutions to operating procedures and management policies, it ensures the integrity, confidentiality and availability of information technology systems, helping enterprises and government departments maintain operational security.

[0003] Among them, the security protection system of the collaborative interaction between the cloud, edge and end of the distribution Internet of Things is used to enhance data security and network protection in the power Internet of Things environment. It aims to respond to various network threats through adaptive security measures, ensure the safe transmission and processing of data in the cloud and edge computing environments, and encrypt communication protocols and network traffic by implementing dynamic permission management and real-time security monitoring to prevent data leakage and unauthorized access, thereby improving the overall security of the intelligent distribution system.

[0004] In the power distribution Internet of Things environment, the traditional cloud-edge-end collaborative interactive security protection system has incomplete analysis and immediate response mechanisms for real-time data streams, resulting in a slow response to emergencies, and unable to effectively block attacks or reduce losses. When processing batch data, it lacks sufficient flexibility and scalability, and it is difficult to match the growing network equipment and complex security requirements. In terms of multi-stage attack identification and early warning, it relies on known attack patterns and signatures, and it is difficult to effectively identify new or variant attack strategies, resulting in the failure to timely discover security protection system vulnerabilities, increasing the operation and maintenance burden of network administrators, and causing security incidents and economic losses. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings existing in the prior art and propose a security protection system for collaborative interaction between the cloud, edge and end of the power distribution Internet of Things.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things includes:

[0007] The network traffic monitoring module collects network traffic data in real time and performs time series analysis based on collaborative interaction traffic data, identifies the changing characteristics of data volume, and generates network pattern recognition results;

[0008] The abnormal traffic identification module uses the network pattern identification results to monitor and identify abnormal network traffic in real time, including abnormal data volume and data packets that do not comply with the communication protocol, and generates abnormal network activity records;

[0009] The security threat response module analyzes multiple network security threat events based on the abnormal network activity records, identifies threat types and responds, and generates response execution records;

[0010] The network attack warning module analyzes the correlation between multiple security events according to the response execution record, predicts and identifies multi-stage attack activities, adjusts network traffic monitoring parameters, and generates monitoring parameter adjustment records;

[0011] The behavior pattern analysis module receives the monitoring parameter adjustment record, monitors the access data and communication patterns of multiple IoT devices in real time, identifies abnormal activities, and generates abnormal behavior information of the devices;

[0012] The access permission management module adopts the abnormal behavior information of the device, identifies multiple risky power distribution Internet of Things devices by analyzing the device access information, adjusts the access permissions, and generates security protection control parameters.

[0013] As a further solution of the present invention, the network pattern recognition results include traffic peak data, data transmission rate information, and communication protocol usage records; the abnormal network activity records include abnormal data packet types, protocol violation types, and abnormal occurrence time; the response execution records include isolation operation execution records, early warning information matching results, and threat level assessment results; the monitoring parameter adjustment records include traffic monitoring thresholds, network monitoring parameter adjustment records, and alarm trigger threshold parameters; the device abnormal behavior information includes abnormal login attempt records, abnormal data access patterns, and communication anomaly identification results; the security protection control parameters include device access permission levels, trust level adjustment records, and device identity authentication parameters.

[0014] As a further solution of the present invention, the network traffic monitoring module includes:

[0015] The traffic data collection submodule collects network traffic data of IoT devices in real time based on collaborative interaction traffic data, analyzes and records the size, transmission rate, protocol used, and time information of data packets, and generates a network traffic data set;

[0016] The data trend assessment submodule identifies and calculates the changing trend, seasonal changes and periodic fluctuations of network data traffic through time series analysis based on the network traffic data set, and generates traffic trend analysis results;

[0017] Based on the traffic trend analysis results, the pattern analysis and recording submodule uses an autoregressive moving average model algorithm to identify and record key change points of network data traffic, evaluate the distribution characteristics of traffic in time series, and output network pattern recognition results.

[0018] As a further solution of the present invention, the autoregressive moving average model algorithm is according to the formula:

[0019]

[0020] Calculate the network traffic value, where X t is the network traffic value at the current moment, c is a constant term, t is the error term, φ i is the autoregression coefficient, X t-i is the network traffic data before period i, θ i is the moving average coefficient, t-i is the error term before period i, γ is the seasonal adjustment coefficient, S t-m is the data before period m, δ is the external influence coefficient, E t is the external influencing factor of the current period, p is the order of the autoregressive model, q is the order of the moving average model, i is the index used to specify the historical period or error term currently processed in the summation operation, and m is the length of the seasonal cycle.

[0021] As a further solution of the present invention, the abnormal traffic identification module includes:

[0022] The network traffic monitoring submodule monitors network traffic in real time based on the network pattern recognition results, identifies and records data volume anomalies, including sharp changes in data packet size, unexpected traffic peaks, and frequent short-time requests, and generates abnormal traffic recognition records;

[0023] The data packet verification submodule analyzes and verifies the structure of the abnormal traffic data packet based on the abnormal traffic identification record, evaluates the compliance of the data packet communication protocol, and formulates a compliance verification record;

[0024] The abnormal event recording submodule identifies and records the identified network threats and protocol violation events according to the compliance verification records, including the types of violations and the time when the events occurred, and generates abnormal network activity records.

[0025] As a further solution of the present invention, the security threat response module includes:

[0026] The threat event analysis submodule analyzes the data of multiple network security threat events based on the abnormal network activity records, identifies the types and causes of threat events, and generates threat analysis data;

[0027] The response measure matching submodule evaluates the risk levels of multiple network security threat events based on the threat analysis data and matches response measures, including traffic isolation, sending warning information, and generating risk level assessment information;

[0028] The response process recording submodule records the response process of the threat event based on the risk level assessment information, including the response time, participants, and response effect, and generates a response execution record.

[0029] As a further solution of the present invention, the network attack warning module includes:

[0030] The correlation evaluation submodule analyzes the correlation between multiple network security threat events based on the response execution record and in combination with the historical security event log, identifies the correlation between the events, and generates event correlation analysis results;

[0031] The attack target prediction submodule predicts multi-stage attack activities, identifies attack chains and attack targets, and generates attack warning information based on the event correlation analysis results;

[0032] The adjustment demand assessment submodule evaluates and adjusts the network traffic monitoring parameters of multiple IoT devices based on the attack warning information and the attack chain prediction results, and generates a monitoring parameter adjustment record.

[0033] As a further solution of the present invention, the behavior pattern analysis module includes:

[0034] The data real-time monitoring submodule adjusts the records based on the monitoring parameters, monitors the network access data and communication modes of multiple IoT devices in real time, records the time, frequency and data type of access activities, and generates device activity monitoring results;

[0035] The behavior comparison and evaluation submodule uses the device activity monitoring results to compare with a preset behavior pattern database, analyzes behavior deviations and abnormal behaviors, uses a cosine similarity algorithm to evaluate consistency and differences with normal patterns, and generates behavior deviation analysis results;

[0036] The severity assessment submodule analyzes the severity of multiple behavioral deviations according to the behavioral deviation analysis results, assesses the risk levels of multiple abnormal behaviors, and generates device abnormal behavior information.

[0037] As a further solution of the present invention, the cosine similarity algorithm is according to the formula:

[0038]

[0039] Calculate the behavior consistency score, where MCS is the cosine similarity value, A is the device behavior vector, B is the preset behavior pattern vector, w is the device type weight, S is the environmental stability score, V is the data volume, t′ is the time parameter, ∥A∥ is the modulus of vector A, and ∥B∥ is the modulus of vector B.

[0040] As a further solution of the present invention, the access permission management module includes:

[0041] The access information analysis submodule uses the device abnormal behavior information, combined with the user identity, location and time information in the device access request, to verify the legitimacy of the visitor and the security level of the access, and generates an access identity authentication result;

[0042] The trust level assessment submodule assesses the risk level of the device and the user based on the access identity authentication result, adjusts the access rights of the device and the user trust level, and generates a permission adjustment result;

[0043] The access control adjustment submodule adjusts the device access control parameters, including the device data access scope and the control authority level, according to the permission adjustment result, and generates security protection control parameters.

[0044] Compared with the prior art, the advantages and positive effects of the present invention are:

[0045] In the present invention, by real-time collection and analysis of network traffic data, the recognition speed and accuracy of abnormal traffic are enhanced, the speed and efficiency of responding to security threats are improved, measures are taken in time at the early stage of the problem, the risks of data leakage and network attacks are reduced, and the timeliness of defense measures is improved by combining security threat response with network attack warning. By analyzing the correlation between threat events, complex multi-stage attack activities are effectively predicted and identified, the access data and communication mode of the device are monitored in real time, and the access rights and trust levels are adjusted, so that security protection is more targeted and flexible, and the management efficiency of risky devices is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a system flow chart of the present invention;

[0047] Figure 2 It is a schematic diagram of the system framework of the present invention;

[0048] Figure 3 It is a flow chart of the network traffic monitoring module of the present invention;

[0049] Figure 4 This is a flow chart of the abnormal traffic identification module of the present invention;

[0050] Figure 5 It is a flow chart of the security threat response module of the present invention;

[0051] Figure 6 This is a flow chart of the network attack warning module of the present invention;

[0052] Figure 7 It is a flow chart of the behavior pattern analysis module of the present invention;

[0053] Figure 8 This is a flow chart of the access authority management module of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0055] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0056] See also Figure 1 to Figure 2 , a security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things includes:

[0057] The network traffic monitoring module collects network traffic data in real time and performs time series analysis based on collaborative interaction traffic data, identifies the changing characteristics of data volume, and generates network pattern recognition results;

[0058] The abnormal traffic identification module uses the network pattern recognition results to monitor and identify abnormal network traffic in real time, including abnormal data volume and data packets that do not comply with the communication protocol, and generates abnormal network activity records;

[0059] The security threat response module analyzes multiple network security threat events based on abnormal network activity records, identifies threat types and responds to them, and generates response execution records;

[0060] The network attack warning module analyzes the correlation between multiple security events based on the response execution records, predicts and identifies multi-stage attack activities, adjusts network traffic monitoring parameters, and generates monitoring parameter adjustment records;

[0061] The behavior pattern analysis module receives monitoring parameter adjustment records, monitors the access data and communication patterns of multiple IoT devices in real time, identifies abnormal activities, and generates abnormal behavior information of devices;

[0062] The access rights management module uses abnormal device behavior information to analyze device access information, identify multiple risky power distribution IoT devices, adjust access rights, and generate security protection control parameters.

[0063] The network pattern recognition results include traffic peak data, data transmission rate information, and communication protocol usage records. Abnormal network activity records include abnormal data packet type, protocol violation type, and abnormal occurrence time. Response execution records include isolation operation execution records, warning information matching results, and threat level assessment results. Monitoring parameter adjustment records include traffic monitoring thresholds, network monitoring parameter adjustment records, and alarm trigger threshold parameters. Device abnormal behavior information includes abnormal login attempt records, abnormal data access patterns, and communication anomaly identification results. Security protection control parameters include device access permission levels, trust level adjustment records, and device identity authentication parameters.

[0064] See also Figure 2 and Figure 3 , the network traffic monitoring module includes:

[0065] The traffic data collection submodule collects network traffic data of IoT devices in real time based on collaborative interaction traffic data, analyzes and records the size, transmission rate, protocol used, and time information of data packets, and generates the network traffic data set in the following process:

[0066] In the traffic data collection submodule, based on the collaborative interactive traffic data, through the sensors and monitoring devices deployed at multiple nodes, the network traffic of each IoT device is captured in real time, including the size of each data packet, transmission rate, protocol used, and timestamp. Each data packet is filtered to remove redundant and erroneous packets, and the clean data is encoded and temporarily stored in a temporary storage area. The data aggregation model is adopted, and the formula is: Among them, D z is the total data volume, is the size of the i0th packet, is the corresponding transmission rate, For the transmission time interval, the network traffic at multiple times is recorded to generate a network traffic dataset.

[0067] The data trend assessment submodule is based on the network traffic data set. Through time series analysis, it identifies and calculates the changing trend, seasonal changes and periodic fluctuations of network data traffic. The specific process of generating traffic trend analysis results is as follows:

[0068] In the data trend assessment submodule, based on the network traffic data set, a daily, weekly, and monthly traffic aggregation framework is constructed to perform hierarchical statistical analysis on the data, match the daily traffic data with the corresponding date and time, analyze the seasonal pattern and periodic fluctuation of the data, and apply the time series analysis model. The formula is: in, For the tth z Traffic trend value at a time point, is the traffic data at the previous time point, is the seasonal adjustment factor, α z is the weight factor of historical traffic data for current trend estimation, β z It is the weight of the seasonal adjustment factor. Through retrospective analysis of historical data, traffic changes are predicted and traffic trend analysis results are generated.

[0069] The pattern analysis and recording submodule uses the autoregressive moving average model algorithm based on the traffic trend analysis results to identify and record the key change points of network data traffic, evaluate the distribution characteristics of traffic in time series, and output the network pattern recognition results. The specific process is as follows:

[0070] In the pattern analysis and recording submodule, based on the traffic trend analysis results, an autoregressive moving average model is constructed to monitor the network in real time to obtain the current network traffic and the network traffic in multiple periods in the past, analyze the key change points and patterns of the traffic data, evaluate the distribution characteristics of the traffic in the time series through parameter adjustment, record and identify key traffic patterns, and output network pattern recognition results.

[0071] The autoregressive moving average model algorithm is based on the formula:

[0072]

[0073] Calculate the network traffic value, where X t is the network traffic value at the current moment, which is used to indicate the current network traffic status. c is a constant term, which is used to adjust the baseline level of the model. t is the error term, which indicates the deviation between the current predicted value of the model and the actual value, φ i is the autoregression coefficient, which is used to measure X t-i For the current value X t The impact of X t-i is the network traffic data before period i, which is used to predict the current traffic based on historical data, θ i is the moving average coefficient, which is used to measure t-i The impact on the current error, t-i is the error term before period i, indicating the deviation between the historical forecast value and the actual value, and γ is the seasonal adjustment coefficient, which is used to adjust the seasonal variable S t-mThe impact on the model, S t-m is the data before period m, representing the seasonal pattern, used to capture periodic changes, and δ is the external influence coefficient, used to adjust the external influence variable E t The impact on the model, E t is the external influencing factor of the current period, including the impact of various dates or events on network traffic, p is the order of the autoregressive model, which specifies the number of historical periods considered in the model, q is the order of the moving average model, which determines the number of historical error terms used for averaging, i is the index used to specify the historical period or error term currently processed in the summation operation, and m is the length of the seasonal cycle, which specifies the historical period referenced in the seasonal adjustment.

[0074] The specific execution process of the formula is as follows:

[0075] By monitoring the network in real time, obtain the current network traffic X t And the network traffic X in the past p periods t-i , while collecting the error terms for the past q periods t-i , using historical data to calculate the autoregressive coefficient φ i and the moving average coefficient θ i , identify the seasonal pattern S t-m and collect external influences E t Data, determine the weight coefficients γ and δ through statistical analysis to ensure that the overall prediction error of the model is minimized, substitute the parameters into the formula, calculate and analyze the network traffic at the current moment, and identify and respond to anomalies and attack behaviors.

[0076] See also Figure 2 and Figure 4 ,The abnormal traffic identification module includes:

[0077] The network traffic monitoring submodule monitors network traffic in real time based on the network pattern recognition results, identifies and records data volume anomalies, including sharp changes in packet size, unexpected traffic peaks, and frequent short-time requests. The specific process of generating abnormal traffic identification records is as follows;

[0078] In the network traffic monitoring submodule, based on the network pattern recognition results, the deployed monitoring system monitors the traffic of the entire network in real time, identifies the sharp changes in packet size, unexpected traffic peaks, and frequent short-time requests, and uses the real-time analysis algorithm. The formula is: Among them, E x represents the abnormality index, is the rate of change, is the current packet size, It is the average value of normal data packet size, records abnormal traffic, and generates abnormal traffic identification records.

[0079] The data packet verification submodule analyzes and verifies the structure of abnormal traffic data packets based on abnormal traffic identification records, evaluates the compliance of data packet communication protocols, and formulates the compliance verification record process as follows;

[0080] In the packet verification submodule, based on the abnormal traffic identification record, each packet marked as abnormal is structurally analyzed. Through the packet parsing technology, the header and payload of each abnormal packet are decoded to evaluate whether it complies with the specifications of the network communication protocol. The formula is: Among them, C x Score compliance, is the weight factor, is the actual parameter of the data packet, It is a parameter specified by the communication protocol. The degree of compliance of each parameter will be assigned a weight. The weighted sum determines the compliance of the data packet. By analyzing the compliance of the data packet structure, a compliance verification record is generated.

[0081] The abnormal event recording submodule identifies and records the identified network threats and protocol violation events based on the compliance verification records, including the type of violation and the time of the event. The specific process of generating abnormal network activity records is as follows;

[0082] In the abnormal event recording submodule, according to the compliance verification record, the identified abnormal data packets are analyzed to determine whether there are network threats or protocol violations. Complex event processing technology is used to analyze multiple data sources to identify violation patterns, including log files and real-time alerts. The formula is: Among them, R x represents the event risk score, is a risk factor, is the event type parameter to be identified, U x It generates abnormal network activity records by quantifying the risk of each violation event based on standard event parameters.

[0083] See also Figure 2 and Figure 5 , the security threat response module includes:

[0084] The threat event analysis submodule analyzes the data of multiple network security threat events based on abnormal network activity records, identifies the types and causes of threat events, and generates threat analysis data in the following process:

[0085] In the threat event analysis submodule, based on abnormal network activity records, multivariate statistical analysis methods are used to analyze security events, including classifying the data of each record, identifying the attack type, including DoS attacks and phishing attacks, extracting key features, including attack source, target IP, attack duration, peak traffic, and using a cluster analysis model to determine the type and potential cause of the threat. The formula is: Among them, A c represents the threat analysis score, is the weight of each threat type, It is the characteristic factor of the corresponding threat event, determines the severity and cause of the event, and generates threat analysis data.

[0086] The response measure matching submodule evaluates the risk levels of multiple network security threat events based on threat analysis data and matches response measures, including traffic isolation and sending warning information. The specific process of generating risk level assessment information is as follows:

[0087] In the response measure matching submodule, based on threat analysis data, a quantitative risk model is used to evaluate the risk level of multiple network security events, taking into account the potential damage of the event, the complexity of the attack, the scope of the affected system, and the duration of the attack. The formula is: Among them, R c For risk assessment score, is the risk weight, Q is the potential impact of the event. c The probability of an event occurring is determined by matching response measures based on the assessment results, including sending warning emails for low-risk events, isolating traffic for high-risk events, or disconnecting the affected system from the network, to ensure that risks are minimized and generate risk level assessment information.

[0088] The response process record submodule records the response process of threat events based on risk level assessment information, including response time, participants, and response effects. The specific process of generating response execution records is as follows:

[0089] In the response process recording submodule, based on the risk level assessment information, the execution details of each response measure are recorded, including the start and end time of the response, the list of team members involved in the response, and the specific operation steps, including the start time of isolation, the duration of isolation, the end conditions of isolation, and the network activities monitored during isolation. The formula is: Among them, S c The response success rate is is the effect weight of each response measure, Generate response execution records to measure the time of implementing response measures, analyze the effectiveness of response measures, and evaluate the contribution to mitigation and resolution of security incidents.

[0090] See also Figure 2 and Figure 6 , the network attack warning module includes:

[0091] The correlation assessment submodule analyzes the correlation between multiple network security threat events based on the response execution record and historical security event logs, identifies the correlation between events, and generates the event correlation analysis results. The specific process is as follows:

[0092] In the relevance assessment submodule, based on the response execution record, key information is extracted from the historical security event log, including event type, attack vector, affected assets and timestamp. Data mining technology is used to analyze the potential connection between events. The statistical correlation between event features is calculated. The formula is: Among them, C v represents the correlation score between events, is the weight of each feature, is the current event feature set, It is a collection of historical event features, which determines the connection between multiple security events and generates event correlation analysis results.

[0093] The attack target prediction submodule predicts multi-stage attack activities based on the event correlation analysis results, identifies the attack chain and attack targets, and generates attack warning information in the following process:

[0094] In the attack target prediction submodule, based on the event correlation analysis results, a machine learning model is used to predict multi-stage attack activities. By analyzing the patterns and sequences in the event chain, potential attack targets and attack trends are identified, including building an attack behavior model and predicting attack targets. The formula is: Among them, P v Predict the score for the attack target, is the pattern importance weight, Generate attack warning information for attack behavior indicators in the event chain.

[0095] The adjustment demand assessment submodule evaluates and adjusts the network traffic monitoring parameters of multiple IoT devices based on the attack warning information and the attack chain prediction results, and generates the monitoring parameter adjustment record in the following process:

[0096] In the adjustment demand assessment submodule, based on the attack warning information, the key parameters of network monitoring are evaluated and adjusted to enhance the defense capability against future attacks, including analyzing the potential target devices mentioned in the attack warning and reconfiguring the monitoring system to strengthen the monitoring of the target devices. The formula is: Among them, M v Indicates the monitoring parameter adjustment value. To adjust the sensitivity, is the original monitoring parameter, ΔQ v To optimize the protection level of IoT devices in the face of new threats and generate monitoring parameter adjustment records based on the increase or decrease in risk assessment adjustments.

[0097] See also Figure 2 and Figure 7 , the behavior pattern analysis module includes:

[0098] The data real-time monitoring submodule adjusts the records based on the monitoring parameters, monitors the network access data and communication modes of multiple IoT devices in real time, records the time, frequency and data type of access activities, and generates the device activity monitoring results in the following process:

[0099] In the real-time data monitoring submodule, records are adjusted according to monitoring parameters, and sensors and monitoring tools are set to track the network access data and communication modes of multiple IoT devices in real time, including recording the access request time, request frequency, and data transmission type of each device, which are collected and stored through a high-speed data processing pipeline. The formula is: Among them, A b Indicates the device activity monitoring score. To monitor the parameter weights, For access time, is the frequency, Generates device activity monitoring results for data types.

[0100] The behavior comparison evaluation submodule uses the device activity monitoring results to compare with the preset behavior pattern database, analyzes behavior deviations and abnormal behaviors, and uses the cosine similarity algorithm to evaluate the consistency and difference with the normal pattern. The specific process of generating behavior deviation analysis results is as follows;

[0101] In the behavior comparison and evaluation submodule, the device activity monitoring results are used and compared with the preset behavior pattern database. The cosine similarity algorithm is used to obtain the device behavior vector through real-time monitoring and compare it with the preset behavior pattern vector stored in the database. The cosine similarity between the behavior data of each device and the preset pattern is calculated, the behavior deviation is evaluated and abnormal behavior is detected, and the behavior deviation analysis results are generated.

[0102] Cosine similarity algorithm, according to the formula:

[0103]

[0104] Calculate the behavior consistency score, where MCS is the cosine similarity value, which is used to measure the similarity between the device behavior vector and the preset behavior pattern vector, A is the device behavior vector, which is used to represent the behavior data of the device during the monitoring period, B is the preset behavior pattern vector, which is used to represent the behavior data of the device during normal operation, w is the device type weight, which is used to adjust the influence of multiple device types in the behavior evaluation, S is the environmental stability score, which is used to adjust the influence of changes in the device operating environment on the behavior consistency, V is the data volume, which is used to represent the amount of data collected within a given time t′, t′ is the time parameter, which represents the time span of data collection, ∥A∥ is the modulus of vector A, which is used to calculate the length of vector A, and ∥B∥ is the modulus of vector B, which is used to calculate the length of vector B.

[0105] The specific execution process of the formula is as follows:

[0106] The device behavior vector A is obtained through real-time monitoring and compared with the preset behavior pattern vector B stored in the database. The weight w and environmental stability score S are determined according to the device type. The cosine similarity algorithm is used to calculate the dot product of A and B and consider the weight and environmental factors. The calculation result is substituted into the formula to obtain the behavior consistency score MCS, which is used to evaluate the normality and abnormality of device behavior.

[0107] The severity assessment submodule analyzes the severity of various behavioral deviations based on the behavioral deviation analysis results, evaluates the risk levels of various abnormal behaviors, and generates the device abnormal behavior information in the following specific process:

[0108] In the severity assessment submodule, the severity of behavioral deviations is analyzed based on the behavioral deviation analysis results, and the risk levels of various abnormal behaviors are evaluated. The risk assessment formula is used to classify and rate abnormal behaviors by considering the frequency and type of behavioral deviations. The formula is: Among them, S b Score the risk, is the risk factor weight, Score behavioral deviation, L b It is a behavior severity threshold, determines the risk level of abnormal behavior, and generates device abnormal behavior information.

[0109] See also Figure 2 and Figure 8 , the access rights management module includes:

[0110] The access information analysis submodule uses the device abnormal behavior information, combined with the user identity, location and time information in the device access request, to verify the legitimacy of the visitor and the security level of the access, and generates the access identity authentication result in the following process:

[0111] In the access information analysis submodule, the abnormal behavior information of the device is used to verify the legitimacy of the visitor and the security level of the access in combination with the user identity, location and time information in the device access request, including verifying the user's identity authentication information, comparing the device access record with the user's common geographic location and access time window. When the geographic location is abnormal and the access time is inconsistent, it is recorded as high risk. The formula is: Among them, V q Indicates the access legitimacy score, is the weight of each factor, is the user identity matching score, is the position matching score, is the time matching score, generating the access authentication result.

[0112] The trust level assessment submodule assesses the risk level of the device and user based on the access identity authentication result, adjusts the access rights of the device and the user trust level, and generates the permission adjustment result in the following process:

[0113] In the trust level assessment submodule, the risk level of the device and user is assessed based on the access identity authentication results, taking into account the user's historical behavior, the sensitivity of the device, and the recent access pattern, and adjusting the device's access rights and the user's trust level. The formula is: Among them, R q represents the risk assessment score, is the adjustment factor, is the user's behavior score, Y q It is a preset security baseline. Through this assessment, permission adjustment results are generated.

[0114] The access control adjustment submodule adjusts the device access control parameters according to the permission adjustment results, including the device data access scope and control permission level, and generates the security protection control parameters in the following process:

[0115] In the access control adjustment submodule, the device access control parameters are adjusted according to the permission adjustment results, including limiting and expanding the access scope of device data, adjusting the user's control permission level, and adjusting based on the user's trust level and the device's security requirements. The formula is:

[0116] Among them, C q Indicates the control parameter adjustment value, To adjust the sensitivity, is the original control parameter, ΔZ q Generate safety protection control parameters for adjustment increases or decreases based on risk assessment.

[0117] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things, characterized by: The system comprises: The network traffic monitoring module collects network traffic data in real time and performs time series analysis based on collaborative interaction traffic data, identifies the changing characteristics of data volume, and generates network pattern recognition results; The abnormal traffic identification module uses the network pattern identification results to monitor and identify abnormal network traffic in real time, including abnormal data volume and data packets that do not comply with the communication protocol, and generates abnormal network activity records; The security threat response module analyzes multiple network security threat events based on the abnormal network activity records, identifies threat types and responds, and generates response execution records; The network attack warning module analyzes the correlation between multiple security events according to the response execution record, predicts and identifies multi-stage attack activities, adjusts network traffic monitoring parameters, and generates monitoring parameter adjustment records; The behavior pattern analysis module receives the monitoring parameter adjustment record, monitors the access data and communication patterns of multiple IoT devices in real time, identifies abnormal activities, and generates abnormal behavior information of the devices; The access permission management module adopts the abnormal behavior information of the device, identifies multiple risky power distribution Internet of Things devices by analyzing the device access information, adjusts the access permissions, and generates security protection control parameters.

2. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The network pattern recognition results include traffic peak data, data transmission rate information, and communication protocol usage records; the abnormal network activity records include abnormal data packet types, protocol violation types, and abnormal occurrence time; the response execution records include isolation operation execution records, early warning information matching results, and threat level assessment results; the monitoring parameter adjustment records include traffic monitoring thresholds, network monitoring parameter adjustment records, and alarm trigger threshold parameters; the device abnormal behavior information includes abnormal login attempt records, abnormal data access patterns, and communication anomaly identification results; the security protection control parameters include device access permission levels, trust level adjustment records, and device identity authentication parameters.

3. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The network traffic monitoring module includes: The traffic data collection submodule collects network traffic data of IoT devices in real time based on collaborative interaction traffic data, analyzes and records the size, transmission rate, protocol used, and time information of data packets, and generates a network traffic data set; The data trend assessment submodule identifies and calculates the changing trend, seasonal changes and periodic fluctuations of network data traffic through time series analysis based on the network traffic data set, and generates traffic trend analysis results; Based on the traffic trend analysis results, the pattern analysis and recording submodule uses an autoregressive moving average model algorithm to identify and record key change points of network data traffic, evaluate the distribution characteristics of traffic in time series, and output network pattern recognition results.

4. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 3 is characterized in that: The autoregressive moving average model algorithm is based on the formula: Calculate the network traffic value, where X t is the network traffic value at the current moment, c is a constant term, t is the error term, φ i is the autoregression coefficient, X t-i is the network traffic data before period i, θ i is the moving average coefficient, t-i is the error term before period i, γ is the seasonal adjustment coefficient, S t-m is the data before period m, δ is the external influence coefficient, E t is the external influencing factor of the current period, p is the order of the autoregressive model, q is the order of the moving average model, i is the index used to specify the historical period or error term currently processed in the summation operation, and m is the length of the seasonal cycle.

5. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The abnormal traffic identification module includes: The network traffic monitoring submodule monitors network traffic in real time based on the network pattern recognition results, identifies and records data volume anomalies, including sharp changes in data packet size, unexpected traffic peaks, and frequent short-time requests, and generates abnormal traffic recognition records; The data packet verification submodule analyzes and verifies the structure of the abnormal traffic data packet based on the abnormal traffic identification record, evaluates the compliance of the data packet communication protocol, and formulates a compliance verification record; The abnormal event recording submodule identifies and records the identified network threats and protocol violation events according to the compliance verification records, including the types of violations and the time when the events occurred, and generates abnormal network activity records.

6. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The security threat response module includes: The threat event analysis submodule analyzes the data of multiple network security threat events based on the abnormal network activity records, identifies the types and causes of threat events, and generates threat analysis data; The response measure matching submodule evaluates the risk levels of multiple network security threat events based on the threat analysis data and matches response measures, including traffic isolation, sending warning information, and generating risk level assessment information; The response process recording submodule records the response process of the threat event based on the risk level assessment information, including the response time, participants, and response effect, and generates a response execution record.

7. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The network attack early warning module includes: The correlation evaluation submodule analyzes the correlation between multiple network security threat events based on the response execution record and in combination with the historical security event log, identifies the correlation between the events, and generates event correlation analysis results; The attack target prediction submodule predicts multi-stage attack activities, identifies attack chains and attack targets, and generates attack warning information based on the event correlation analysis results; The adjustment demand assessment submodule evaluates and adjusts the network traffic monitoring parameters of multiple IoT devices based on the attack warning information and the attack chain prediction results, and generates a monitoring parameter adjustment record.

8. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The behavior pattern analysis module includes: The data real-time monitoring submodule adjusts the records based on the monitoring parameters, monitors the network access data and communication modes of multiple IoT devices in real time, records the time, frequency and data type of access activities, and generates device activity monitoring results; The behavior comparison and evaluation submodule uses the device activity monitoring results to compare with a preset behavior pattern database, analyzes behavior deviations and abnormal behaviors, uses a cosine similarity algorithm to evaluate consistency and differences with normal patterns, and generates behavior deviation analysis results; The severity assessment submodule analyzes the severity of multiple behavioral deviations according to the behavioral deviation analysis results, assesses the risk levels of multiple abnormal behaviors, and generates device abnormal behavior information.

9. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 8 is characterized in that: The cosine similarity algorithm is based on the formula: Calculate the behavior consistency score, where MCS is the cosine similarity value, A is the device behavior vector, B is the preset behavior pattern vector, w is the device type weight, S is the environmental stability score, V is the data volume, t′ is the time parameter, ∥A∥ is the modulus of vector A, and ∥B∥ is the modulus of vector B.

10. The security protection system for cloud-edge-end collaborative interaction of power distribution Internet of Things according to claim 1 is characterized in that: The access rights management module includes: The access information analysis submodule uses the device abnormal behavior information, combined with the user identity, location and time information in the device access request, to verify the legitimacy of the visitor and the security level of the access, and generates an access identity authentication result; The trust level assessment submodule assesses the risk level of the device and the user based on the access identity authentication result, adjusts the access rights of the device and the user trust level, and generates a permission adjustment result; The access control adjustment submodule adjusts the device access control parameters, including the device data access scope and the control authority level, according to the permission adjustment result, and generates security protection control parameters.

Images