Security evaluation method, device and equipment of power information system and medium

Abstract

The application discloses a kind of security evaluation method, device, equipment and medium of electric power information system. Among them, the method includes: the validity evaluation of the permission management mode of target electric power information system is obtained evaluation result;Wherein, target electric power information system adopts openEuler microservice architecture;According to the log record of target electric power information system, unauthorized access behavior and abnormal behavior are identified to obtain identification result;In high concurrency stress scene, the performance test of target electric power information system is obtained test result;According to evaluation result and identification result, the role and permission configuration in permission management mode are adjusted, and according to test result, the microservice configuration in permission management mode is adjusted.The technical scheme, can effectively solve the potential security risk problem caused by improper permission configuration and unauthorized access, ensure the security and efficiency of electric power information system, to guarantee the stable operation and reliability of electric power system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric power, and in particular to a security assessment method, device, equipment and medium for an electric power information system. BACKGROUND

[0002] In the field of electric power, the security and performance of information systems are of great importance. With the development of digitalization and intelligentization of electric power systems, more and more electric power enterprises adopt microservice architecture to build their information systems. Microservice architecture has the advantages of flexibility, scalability and ease of maintenance, but at the same time faces the challenges of complex permission management and high concurrency processing.

[0003] The security of microservice architecture mainly lies in permission management and access control. In microservice architecture, each microservice may need to manage permissions separately. Due to the large number of microservices and complex permission configuration, the following problems may occur: 1. Improper permission configuration: unreasonable configuration of roles and permissions, resulting in excessive or insufficient permissions, and potential security risks; 2. Unauthorized access: due to incorrect or missing permission configuration, some users or services may attempt to access unauthorized resources, causing potential security risks. SUMMARY

[0004] The present application provides a security assessment method, device, equipment and medium for an electric power information system, which can effectively solve the potential security risk problems caused by improper permission configuration and unauthorized access based on security assessment and configuration adjustment of the electric power information system, ensure the security and efficiency of the electric power information system, and thus guarantee the stable operation and reliability of the electric power system.

[0005] According to an aspect of the present application, a security assessment method for an electric power information system is provided, the method comprising:

[0006] performing effectiveness evaluation on the permission management mode of the target electric power information system to obtain an evaluation result; wherein the target electric power information system adopts openEuler microservice architecture, and the permission management mode is used to describe the mapping relationship between roles, permissions and microservices;

[0007] identify unauthorized access behavior and abnormal behavior according to log records of the target electric power information system to obtain an identification result; wherein the log records include request logs through an API gateway and access logs between microservices;

[0008] perform performance testing on the target electric power information system under a high concurrency pressure scenario to obtain a test result; wherein the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset number threshold;

[0009] The role and permission configurations in the permission management method are adjusted based on the evaluation results and the identification results, and the microservice configurations in the permission management method are adjusted based on the test results.

[0010] According to another aspect of the present invention, a security assessment device for a power information system is provided, the device comprising:

[0011] The effectiveness assessment module is used to assess the effectiveness of the access control method of the target power information system and obtain the assessment result; wherein, the target power information system adopts the openEuler microservice architecture, and the access control method is used to describe the mapping relationship between roles, permissions and microservices;

[0012] The behavior recognition module is used to identify unauthorized access behaviors and abnormal behaviors based on the log records of the target power information system to obtain recognition results; wherein, the log records include request logs through the API gateway and access logs between microservices;

[0013] The performance testing module is used to perform performance testing on the target power information system under high concurrency pressure scenarios and obtain test results; wherein, the high concurrency pressure scenario is a scenario in which the number of concurrent users exceeds a preset threshold.

[0014] The configuration adjustment module is used to adjust the role and permission configuration in the permission management method according to the evaluation results and the identification results, and to adjust the microservice configuration in the permission management method according to the test results.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] At least one processor; and,

[0017] A memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the security assessment method for the power information system according to any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the security assessment method for a power information system according to any embodiment of the present invention.

[0020] The technical solution of this invention first evaluates the effectiveness of the permission management method of the target power information system to obtain evaluation results. The target power information system adopts an openEuler microservice architecture, and the permission management method describes the mapping relationship between roles, permissions, and microservices. Then, it identifies unauthorized access and abnormal behaviors based on the log records of the target power information system to obtain identification results. These log records include request logs through the API gateway and access logs between microservices. Next, it conducts performance tests on the target power information system under high concurrency pressure scenarios to obtain test results. High concurrency pressure scenarios are those where the number of concurrent users exceeds a preset threshold. Finally, based on the evaluation and identification results, it adjusts the role and permission configurations in the permission management method, and adjusts the microservice configurations in the permission management method based on the test results. This technical solution, based on security assessment and configuration adjustments of the power information system, effectively solves potential security risks caused by improper permission configuration and unauthorized access, ensuring the security and efficiency of the power information system, thereby guaranteeing the stable operation and reliability of the power system.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of a security assessment method for a power information system provided in Embodiment 1 of the present invention;

[0024] Figure 2 This is a flowchart of a security assessment method for a power information system according to Embodiment 2 of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of a security assessment device for a power information system according to Embodiment 3 of the present invention;

[0026] Figure 4 This is a schematic diagram of the structure of an electronic device that implements a security assessment method for a power information system according to an embodiment of the present invention. Detailed Implementation

[0027] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first," "second," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0029] Example 1

[0030] Figure 1 This is a flowchart of a security assessment method for a power information system provided in Embodiment 1 of the present invention. This embodiment is applicable to situations involving security assessment and configuration adjustment of power information systems. The method can be executed by a security assessment device for the power information system, which can be implemented in hardware and / or software and can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0031] S110, the effectiveness of the access control method of the target power information system is evaluated and the evaluation results are obtained.

[0032] The target power information system can refer to a power information system that requires security assessment, and this system adopts the openEuler microservice architecture. For example, the target power information system could be a domestically developed system in the power sector. The access control method describes the mapping relationship between roles, permissions, and microservices; that is, it describes what permissions a role corresponds to and what microservices it is authorized to use.

[0033] In this embodiment, to evaluate the rationality of the permission configuration, the permission management methods of the target power information system adopting the openEuler microservice architecture are first obtained and organized, and the main data sources are extracted, including role definitions, permission definitions, and microservice definitions. For example, the above main data sources can be represented as follows:

[0034] Role A: System Administrator; Role B: Regular User;

[0035] Permission 1: Read permission; Permission 2: Write permission;

[0036] Microservice A: User management service; Microservice B: Order processing service.

[0037] Based on the above main data sources, the mapping relationship between roles, permissions, and microservices can be analyzed. A mapping table can be constructed to record the mapping relationships among these three elements. Then, the effectiveness of the permission management method can be evaluated based on the mapping relationships in the table to obtain the evaluation results. For example, a mapping table is shown in Table 1 below:

[0038] Table 1 Mapping Relationship Table

[0039] Role Permission Microservice Role A Permission 1 Microservice A Role A Permission 2 Microservice B Role B Permission 1 Microservice A

[0040] In this embodiment, optionally, the effectiveness of the access control method of the target power information system is evaluated to obtain the evaluation result, including: determining the access control coverage of each role based on the ratio of the number of permissions possessed by each role in the access control method to the total number of permissions of the target power information system; determining the access control applicability index of each role based on the ratio of the number of applicable permissions possessed by each role to the total number of permissions possessed by each role; and evaluating the effectiveness of the access control method of the target power information system based on the access control coverage and access control applicability index to obtain the evaluation result.

[0041] The permission coverage ratio describes the scope of permissions for each role, while the permission applicability index assesses whether each role's permissions are used within their responsibilities. For example, this can be achieved using the formula... Determine the permission coverage for each role, where f i Indicates the permission coverage of role i; j i,q Indicates the number of permissions that role i possesses; x q This represents the total number of permissions for the target power information system. It can be expressed using the formula... Determine the permission applicability index for each role, where s i Represents the permission applicability index for role i; j i,s This indicates the number of applicable permissions that role i possesses.

[0042] After determining the permission coverage rate and permission applicability index for each role, the effectiveness of the permission management method of the target power information system can be evaluated based on a pre-set threshold (as a critical reference value for effectiveness). Optionally, the evaluation results for the effectiveness of the permission management method of the target power information system based on the permission coverage rate and permission applicability index include: if the permission coverage rate is less than a first threshold, the permission management method is determined to have a risk; if the permission applicability index is less than a second threshold, the permission management method is determined to have a risk.

[0043] The first threshold and the second threshold can refer to preset critical reference values ​​corresponding to permission coverage and permission applicability, respectively. If the permission coverage is less than the first threshold or the permission applicability index is less than the second threshold, it can be determined that the permission management method has a risk in terms of effectiveness.

[0044] S120, based on the log records of the target power information system, identifies unauthorized access behavior and abnormal behavior to obtain identification results.

[0045] In this embodiment, the log records of the target power information system can be used to analyze the actual access between users and microservices, identify unauthorized access behaviors and abnormal behaviors, and thus achieve access control auditing. The log records include request logs from the API gateway and access logs between microservices. For example, request logs may include information such as the requester's identity (e.g., user ID or microservice ID), request path, request method, request time, and response status; access logs may include information such as the service call source (i.e., the called service), target service, call time, call result, and call parameters. For example, abnormal behavior types may include login anomalies, abnormal access, and data leakage attempts.

[0046] In this embodiment, optionally, the identification results for unauthorized access and abnormal behavior based on the log records of the target power information system include: preprocessing the log records of the target power information system to obtain a first log record; wherein, the data preprocessing includes deleting duplicate log records, standardizing the time format and field names of log records, and deleting log records unrelated to permission auditing; classifying the first log record based on request type and time to obtain a second log record; wherein, the request type includes user requests and service requests; performing permission verification on each request in the second log record according to the permission management method, and identifying unauthorized access behavior based on the verification results; and identifying abnormal behavior for each request in the second log record based on a preset abnormal behavior identification model.

[0047] Specifically, the log records of the target power information system are first preprocessed, including deleting duplicate log records, standardizing the time format and field names of log records, and deleting log records irrelevant to permission auditing (such as health check requests), resulting in the first log record. Then, the first log record is categorized by requester to distinguish between user requests and service requests, and further categorized by time to obtain the second log record. Next, each request in the second log record is checked against permission requirements based on the permission management method (specifically, refer to the mapping relationship between roles, permissions, and microservices recorded in the mapping relationship). If it meets the requirements, it is considered legitimate access; otherwise, it is considered unauthorized access. A pre-trained machine learning model (i.e., a preset abnormal behavior recognition model) is then used to identify abnormal behavior in each request in the second log record, resulting in abnormal access behaviors. The number of identified unauthorized access behaviors and the number of abnormal behaviors are counted, and a security risk is determined based on a pre-set first and second threshold. Specifically, if the number of unauthorized access behaviors exceeds the first threshold or the number of abnormal behaviors exceeds the second threshold, a security risk is identified.

[0048] Furthermore, an unauthorized access report can be generated, listing all unauthorized access attempts, including the requester, request time, request path, and response status. For example, an unauthorized access report might include: User ID: user123, Request Time: 2024-09-26 10:00:00, Request Path: / admin / data, Response Status: 403. Additionally, an abnormal behavior report can be generated, listing all identified abnormal behaviors, including the requester, abnormal behavior type, and abnormal time period. For example, an abnormal behavior report might include: User ID: serviceA, Abnormal Type: Frequent Failed Requests, Time Period: 2024-09-26 10:00:00-10:30:00.

[0049] The S130 was used to perform performance tests on the target power information system under high concurrency and pressure scenarios, and the test results were obtained.

[0050] High-concurrency pressure scenarios are those where the number of concurrent users exceeds a preset threshold. The preset threshold can be a reference value for the number of concurrent users pre-set based on actual needs.

[0051] In this embodiment, JMeter can be used for high-concurrency stress testing to simulate user behavior in real-world scenarios and record performance data. Simultaneously, penetration testing tools are used to perform security testing on the microservices, identifying potential security vulnerabilities and risks. Optionally, performance testing of the target power information system under high-concurrency stress scenarios to obtain test results includes: determining user operation scripts based on JMeter, setting thread group parameters, and initiating high-concurrency stress testing of the target power information system; during the high-concurrency stress testing process, determining the performance data of the target power information system, and determining performance evaluation indicators based on the performance data; wherein, the performance evaluation indicators include average response time, throughput, and error rate; and identifying performance bottlenecks of the target power information system based on the performance evaluation indicators.

[0052] Average response time can be used to analyze the system's response performance, throughput can be used to evaluate the system's processing capacity under high concurrency conditions, and error rate can be used to check the system's stability under high load. It should be noted that a lower average response time indicates better overall system performance, while a higher average response time indicates poorer overall system performance. Higher throughput indicates that the system can handle more requests and adapt to greater concurrent loads. A high error rate indicates that the system is unstable under high load and may have reliability issues.

[0053] Specifically, first, use JMeter's HTTP(S)Test Script Recorder to record user action scripts, or write scripts manually. All users can use the same action script, suitable for simple performance testing. Parameterization allows each user to use the same script but operate on different data. For example, different users can log in with different accounts or access different data entries. Furthermore, different types of user behavior can be simulated by creating multiple different scripts and assigning them to different thread groups, the specifics depending on the actual performance testing scenario. For example, one thread group can simulate ordinary user operations, and another can simulate administrator operations. After recording, thread group parameters can be set, including the number of threads to simulate concurrent users (e.g., 1000 for simulating 1000 concurrent users); the ramp-up time (the time required to start all threads, e.g., 60 seconds for gradually starting all threads over 60 seconds); and the number of times each thread executes the test (a fixed number or an indefinite loop).

[0054] Next, run the JMeter test plan to begin high-concurrency stress testing. During the test, record relevant performance data and monitor system resource usage (such as CPU, memory, disk I / O, network bandwidth, etc.) in real time. For example, performance data may include the response time for each request, the number of requests processed per unit time, and the request failure rate. Then, determine performance evaluation metrics based on the performance data, including average response time, throughput, and error rate. For example, this can be achieved using formulas... Calculate the average response time, where T i This represents the response time of the i-th request; n is the total number of requests. (Using the formula...) Calculate the throughput, where T total This represents the total test time. (Using the formula...) Calculate the error rate, where n error Indicates the number of erroneous requests.

[0055] After determining the performance evaluation indicators, the performance bottlenecks of the target power information system can be identified based on these indicators. Optionally, identifying performance bottlenecks of the target power information system based on the performance evaluation indicators includes: if the average response time of the target power information system is greater than a third threshold, then the target power information system is determined to have a performance bottleneck; if the throughput of the target power information system is less than a fourth threshold, then the target power information system is determined to have a performance bottleneck; if the error rate of the target power information system is greater than a fifth threshold, then the target power information system is determined to have a performance bottleneck.

[0056] The third threshold can refer to a pre-set reference value for the average response time. The fourth threshold can refer to a pre-set reference value for the throughput. The fifth threshold can refer to a pre-set reference value for the error rate. Specifically, if the average response time of the target power information system is greater than the third threshold, it indicates that the system's average response time is long and the overall system performance is poor, thus identifying a performance bottleneck. If the throughput of the target power information system is less than the fourth threshold, it indicates that the system can handle a small number of requests and cannot adapt to large concurrent loads, thus identifying a performance bottleneck. If the error rate of the target power information system is greater than the fifth threshold, it indicates that the system is unstable under high load and may have reliability issues, thus identifying a performance bottleneck.

[0057] Furthermore, the 90th percentile response time metric can be used to analyze system response performance. The 90th percentile response time refers to the response time of 90% of all requests being less than or equal to this value, while only 10% of requests have a response time greater than this value; data from the top 90% is used. The 90th percentile response time reflects user experience more accurately than the average response time, especially under high concurrency. A higher 90th percentile response time indicates significant latency in processing the slowest 10% of requests, indicating poor system performance and requiring further optimization.

[0058] S140, adjust the role and permission configuration in the permission management method based on the evaluation and identification results, and adjust the microservice configuration in the permission management method based on the test results.

[0059] In this embodiment, the role and permission configurations in the permission management method can be adjusted based on the evaluation and identification results to ensure that the access permissions of each microservice are minimized. Furthermore, the microservice configurations in the permission management method can be adjusted to address performance bottlenecks identified in the test results, optimizing the microservice calling logic and load balancing configuration. Specifically, if the evaluation result indicates no risk, there is no need to adjust the role and permission configurations; if the evaluation result indicates risk, the permissions of the roles need to be increased or adjusted to ensure that their permission coverage and permission applicability index meet the standards. For example, the permissions of each role can be checked one by one according to the principle of least privilege, eliminating redundant permissions and retaining only the necessary permissions, ensuring that each role only has the minimum set of permissions required to fulfill its responsibilities. Then, permission access auditing is performed again to verify whether the adjusted permission configuration meets security requirements, ensuring that unauthorized access and abnormal behavior are effectively controlled.

[0060] When optimizing microservice call logic, service call chains can be optimized to reduce unnecessary calls, merge duplicate or redundant service calls, and asynchronous calls or batch processing can be used to reduce the waiting time of synchronous calls. When optimizing microservice load balancing configuration, load balancing strategies can be adjusted based on throughput and response time data to ensure requests are reasonably distributed across service instances and prevent some instances from overloading. Furthermore, an auto-scaling strategy can be configured to automatically increase the number of service instances when the load increases, ensuring system stability. Caching techniques can also be used to cache frequently accessed data, reduce the number of database queries, and optimize database queries to ensure efficient query statements and avoid complex joins. Then, performance benchmark tests should be rerun to verify the effectiveness of the optimization measures and ensure that performance bottlenecks are effectively alleviated. Continuous monitoring of system performance and timely adjustments to optimization strategies are essential to ensure stable system operation under high concurrency conditions.

[0061] The technical solution of this invention first evaluates the effectiveness of the permission management method of the target power information system to obtain evaluation results. The target power information system adopts an openEuler microservice architecture, and the permission management method describes the mapping relationship between roles, permissions, and microservices. Then, it identifies unauthorized access and abnormal behaviors based on the log records of the target power information system to obtain identification results. These log records include request logs through the API gateway and access logs between microservices. Next, it conducts performance tests on the target power information system under high-concurrency pressure scenarios to obtain test results. High-concurrency pressure scenarios are those where the number of concurrent users exceeds a preset threshold. Finally, based on the evaluation and identification results, it adjusts the role and permission configurations in the permission management method, and adjusts the microservice configurations in the permission management method based on the test results. This technical solution, based on security assessment and configuration adjustments of the power information system, can effectively solve potential security risks caused by improper permission configuration and unauthorized access, ensuring the security and efficiency of the power information system, thereby guaranteeing the stable operation and reliability of the power system.

[0062] Example 2

[0063] Figure 2 This is a flowchart of a security assessment method for a power information system provided in Embodiment 2 of the present invention. This embodiment is based on the above embodiment and optimized. Specifically, the optimization is as follows: after identifying unauthorized access behavior and abnormal behavior based on the log records of the target power information system to obtain the identification results, the method further includes: determining the microservice call relationship based on the access logs between microservices, and generating a call relationship graph based on the microservice call relationship; wherein, the call relationship graph includes nodes and edges, nodes represent microservices, edges represent calls between microservices, and the direction of the edges represents the call direction; the permission management method is mapped to the call relationship graph to obtain a dependency relationship graph; wherein, the dependency relationship graph is used to describe the access paths and permission relationships between microservices.

[0064] like Figure 2 As shown, the method in this embodiment specifically includes the following steps:

[0065] S210, the effectiveness of the access control method of the target power information system is evaluated and the evaluation results are obtained.

[0066] The target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices.

[0067] S220 identifies unauthorized access and abnormal behavior based on the log records of the target power information system to obtain the identification results.

[0068] The logs include request logs from the API gateway and access logs between microservices.

[0069] S230: Determine the microservice call relationship based on the access logs between microservices, and generate a call relationship graph based on the microservice call relationship.

[0070] The call relationship graph includes nodes and edges. Nodes represent microservices, edges represent calls between microservices, and the direction of the edges indicates the call direction. Specifically, the microservice call relationships are extracted from the access logs between microservices, and a call relationship graph is generated, where each microservice is a node, the calls between microservices are edges, and the direction of the edges indicates the call direction.

[0071] S240 maps the permission management method to the call relationship graph to obtain the dependency relationship graph.

[0072] The dependency graph is used to describe the access paths and permission relationships between microservices. Specifically, the permission allocation information in the permission management method is mapped to the call relationship graph, and the permission relationship on each edge is labeled. A graphical tool is used to generate the dependency graph, displaying the access paths and permission relationships between services, where nodes label the microservice name and role information, and edges label the permission type and call frequency. For example, the dependency graph can be represented as follows:

[0073] Microservice A -> Microservice B (read access);

[0074] Microservice B -> Microservice C (write permission).

[0075] The S250 was used to perform performance tests on the target power information system under high concurrency and pressure scenarios, and the test results were obtained.

[0076] Among them, the high-concurrency pressure scenario is the scenario where the number of concurrent users exceeds the preset threshold.

[0077] S260 adjusts the role and permission configurations in the permission management method based on the evaluation and identification results, and adjusts the microservice configurations in the permission management method based on the test results.

[0078] The technical solution of this invention, after identifying unauthorized access and abnormal behavior based on the log records of the target power information system, determines the microservice call relationships based on the access logs between microservices, and generates a call relationship graph based on the microservice call relationships. The call relationship graph includes nodes and edges; nodes represent microservices, edges represent calls between microservices, and the direction of the edges indicates the call direction. The permission management method is mapped to the call relationship graph to obtain a dependency relationship graph. This dependency relationship graph describes the access paths and permission relationships between microservices. This technical solution can intuitively display the access paths and permission relationships between microservices through the generated dependency relationship graph.

[0079] Example 3

[0080] Figure 3 This is a schematic diagram of a security assessment device for a power information system provided in Embodiment 3 of the present invention. This device can execute the security assessment method for a power information system provided in any embodiment of the present invention, and possesses the corresponding functional modules and beneficial effects for executing the method. For example... Figure 3 As shown, the device includes:

[0081] The effectiveness evaluation module 310 is used to evaluate the effectiveness of the permission management method of the target power information system and obtain the evaluation result; wherein, the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices;

[0082] The behavior recognition module 320 is used to identify unauthorized access behavior and abnormal behavior based on the log records of the target power information system to obtain the recognition result; wherein, the log records include request logs through the API gateway and access logs between microservices;

[0083] The performance testing module 330 is used to perform performance testing on the target power information system under high concurrency pressure scenarios and obtain test results; wherein, the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset threshold.

[0084] The configuration adjustment module 340 is used to adjust the role and permission configuration in the permission management method according to the evaluation results and the identification results, and to adjust the microservice configuration in the permission management method according to the test results.

[0085] Optionally, the effectiveness evaluation module 310 includes:

[0086] The permission coverage determination unit is used to determine the permission coverage of each role based on the ratio of the number of permissions possessed by each role in the permission management method to the total number of permissions of the target power information system.

[0087] The permission applicability index determination unit is used to determine the permission applicability index of each role based on the ratio of the number of applicable permissions possessed by each role to the number of permissions possessed by each role in the permission management method.

[0088] The evaluation result determination unit is used to evaluate the effectiveness of the permission management method of the target power information system based on the permission coverage rate and the permission applicability index to obtain the evaluation result.

[0089] Optionally, the evaluation result determination unit is used for:

[0090] If the permission coverage rate is less than the first threshold, then the permission management method is determined to be risky.

[0091] If the permission applicability index is less than the second threshold, then the permission management method is determined to be risky.

[0092] Optionally, the behavior recognition module 320 is used for:

[0093] The log records of the target power information system are preprocessed to obtain the first log record; wherein, the data preprocessing includes deleting duplicate log records, standardizing the time format and field names of log records, and deleting log records that are not related to permission auditing;

[0094] The first log record is classified into a second log record based on the request type and time; wherein, the request type includes user requests and service requests;

[0095] According to the permission management method, each request in the second log record is subject to permission verification, and unauthorized access behavior is identified based on the verification result.

[0096] The abnormal behavior of each request in the second log record is identified based on a preset abnormal behavior recognition model.

[0097] Optionally, the apparatus further includes: a dependency graph determination module, used for:

[0098] After identifying unauthorized access and abnormal behavior based on the log records of the target power information system, the microservice call relationships are determined based on the access logs between the microservices, and a call relationship graph is generated based on the microservice call relationships. The call relationship graph includes nodes and edges, where nodes represent microservices, edges represent calls between microservices, and the direction of the edges represents the call direction.

[0099] The permission management method is mapped to the call relationship graph to obtain the dependency relationship graph; wherein, the dependency relationship graph is used to describe the access paths and permission relationships between microservices.

[0100] Optionally, the performance testing module 330 is used for:

[0101] The high-concurrency stress testing unit is used to determine the user operation script based on JMeter, set thread group parameters, and start the high-concurrency stress test of the target power information system.

[0102] The performance evaluation index determination unit is used to determine the performance data of the target power information system during high-concurrency stress testing, and to determine the performance evaluation index based on the performance data; wherein, the performance evaluation index includes average response time, throughput and error rate;

[0103] The system performance bottleneck identification unit is used to identify the performance bottleneck of the target power information system based on the performance evaluation indicators.

[0104] Optionally, the system performance bottleneck identification unit is used for:

[0105] If the average response time of the target power information system is greater than the third threshold, then it is determined that the target power information system has a performance bottleneck.

[0106] If the throughput of the target power information system is less than the fourth threshold, then it is determined that the target power information system has a performance bottleneck.

[0107] If the error rate of the target power information system is greater than the fifth threshold, then it is determined that the target power information system has a performance bottleneck.

[0108] The security assessment device for a power information system provided in this embodiment of the invention can execute the security assessment method for a power information system provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0109] Example 4

[0110] Figure 4A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0111] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0112] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0113] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as security assessment methods for power information systems.

[0114] In some embodiments, the security assessment method for a power information system may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the security assessment method for a power information system described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the security assessment method for a power information system by any other suitable means (e.g., by means of firmware).

[0115] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0117] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0118] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0119] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0120] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0121] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0122] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A security assessment method for a power information system, characterized in that, The method includes: An effectiveness evaluation of the access control method of the target power information system was conducted to obtain the evaluation results; wherein, the target power information system adopts the openEuler microservice architecture, and the access control method is used to describe the mapping relationship between roles, permissions and microservices; The identification results are obtained by identifying unauthorized access behaviors and abnormal behaviors based on the log records of the target power information system; wherein, the log records include request logs through the API gateway and access logs between microservices; The performance of the target power information system was tested under high concurrency pressure scenarios to obtain test results; wherein, the high concurrency pressure scenario is a scenario in which the number of concurrent users exceeds a preset threshold. The role and permission configurations in the permission management method are adjusted based on the evaluation results and the identification results, and the microservice configurations in the permission management method are adjusted based on the test results.

2. The method according to claim 1, characterized in that, The effectiveness evaluation of the access control method of the target power information system was conducted, and the evaluation results include: The permission coverage rate of each role is determined based on the ratio of the number of permissions possessed by each role in the permission management method to the total number of permissions of the target power information system. The permission applicability index of each role is determined based on the ratio of the number of applicable permissions possessed by each role to the total number of permissions possessed by each role in the permission management method. The effectiveness of the permission management method of the target power information system is evaluated based on the permission coverage rate and the permission applicability index.

3. The method according to claim 2, characterized in that, The effectiveness of the access control method of the target power information system is evaluated based on the access coverage rate and the access applicability index, and the evaluation results are as follows: If the permission coverage rate is less than the first threshold, then the permission management method is determined to be risky. If the permission applicability index is less than the second threshold, then the permission management method is determined to be risky.

4. The method according to claim 1, characterized in that, The identification results are obtained by identifying unauthorized access and abnormal behavior based on the log records of the target power information system, including: The log records of the target power information system are preprocessed to obtain the first log record; wherein, the data preprocessing includes deleting duplicate log records, standardizing the time format and field names of log records, and deleting log records that are not related to permission auditing; The first log record is classified into a second log record based on the request type and time; wherein, the request type includes user requests and service requests; According to the permission management method, each request in the second log record is subject to permission verification, and unauthorized access behavior is identified based on the verification result. The abnormal behavior of each request in the second log record is identified based on a preset abnormal behavior recognition model.

5. The method according to claim 1, characterized in that, After obtaining the identification results by identifying unauthorized access and abnormal behavior based on the log records of the target power information system, the process also includes: The microservice call relationships are determined based on the access logs between the microservices, and a call relationship graph is generated based on the microservice call relationships; wherein, the call relationship graph includes nodes and edges, the nodes represent microservices, the edges represent calls between microservices, and the direction of the edges represents the call direction; The permission management method is mapped to the call relationship graph to obtain the dependency relationship graph; wherein, the dependency relationship graph is used to describe the access paths and permission relationships between microservices.

6. The method according to claim 1, characterized in that, The performance of the target power information system under high concurrency and pressure scenarios was tested, and the test results were obtained, including: Based on JMeter, the user operation script is determined, thread group parameters are set, and a high-concurrency stress test of the target power information system is started. During high-concurrency stress testing, performance data of the target power information system is determined, and performance evaluation indicators are determined based on the performance data; wherein, the performance evaluation indicators include average response time, throughput, and error rate; The performance bottlenecks of the target power information system are identified based on the performance evaluation indicators.

7. The method according to claim 6, characterized in that, Identifying performance bottlenecks in the target power information system based on the performance evaluation metrics includes: If the average response time of the target power information system is greater than the third threshold, then it is determined that the target power information system has a performance bottleneck. If the throughput of the target power information system is less than the fourth threshold, then it is determined that the target power information system has a performance bottleneck. If the error rate of the target power information system is greater than the fifth threshold, then it is determined that the target power information system has a performance bottleneck.

8. A security assessment device for a power information system, characterized in that, The device includes: The effectiveness assessment module is used to assess the effectiveness of the access control method of the target power information system and obtain the assessment result; wherein, the target power information system adopts the openEuler microservice architecture, and the access control method is used to describe the mapping relationship between roles, permissions and microservices; The behavior recognition module is used to identify unauthorized access behaviors and abnormal behaviors based on the log records of the target power information system to obtain recognition results; wherein, the log records include request logs through the API gateway and access logs between microservices; The performance testing module is used to perform performance testing on the target power information system under high concurrency pressure scenarios and obtain test results; wherein, the high concurrency pressure scenario is a scenario in which the number of concurrent users exceeds a preset threshold. The configuration adjustment module is used to adjust the role and permission configuration in the permission management method according to the evaluation results and the identification results, and to adjust the microservice configuration in the permission management method according to the test results.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the security assessment method for the power information system according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the security assessment method for the power information system as described in any one of claims 1-7.

Images