APT attack detection method and device for digital substation, medium and electronic equipment

Abstract

The invention discloses an APT attack detection method and device for a digital substation, a medium and electronic equipment, relates to the technical field of computer network security, and mainly aims to solve the problem that the network security of the digital substation is difficult to guarantee due to the fact that APT attacks cannot be effectively detected in the prior art. Comprising the steps that a system activity data traceability graph of the digital substation is acquired, and the system activity data traceability graph is used for recording the interaction relation between system entities contained in system activities; performing label initialization processing on each system entity contained in the system activity data traceability graph, wherein the label initialization processing is used for marking a process type and a file type of the system entity; determining an APT attack stage label of each system entity according to the process type label, the file type label and the event flow direction of each system entity; and if the APT attack stage labels contained in the target system activity cover all the APT attack stages, determining that the target system activity is an APT attack.

Description

Technical Field

[0001] The present application relates to the field of computer network security technology, and in particular to an APT attack detection method and device, medium, and electronic equipment for a digital substation. Background Art

[0002] With the rapid development of digital substations, the protection of their network security has become particularly important. Digital substations are advanced systems that use modern information technology, automated control systems and intelligent equipment to upgrade and transform traditional power substations, and achieve real-time monitoring, analysis, control and management of the power system's operating status, equipment performance and data. As a critical infrastructure, digital substations need to take measures to protect them from cyber attacks and malicious behavior. Digital substations face a variety of cyber attacks, including distributed denial of service attacks (DDos), ransomware, supply chain attacks, advanced persistent threat (APT) attacks, etc. Among them, APT attacks are one of the most destructive security threats to digital substations, which refers to targeted attacks carried out by attacking organizations in order to obtain the core secrets of an important entity.

[0003] In the existing technology, digital substations usually intercept and kill APT attacks by configuring network security protection equipment. However, due to the high complexity and high customization of APT attacks, it is difficult for traditional firewalls and IDS, IPS and other equipment to effectively intercept and kill them; and the 0-day vulnerability invasion method used by APT attacks makes it impossible for detectors based on malicious code signatures to effectively detect them; at the same time, due to the long-term latent and slow attack characteristics of APT attacks, abnormal checks based on process records and system logs cannot effectively detect them. Summary of the invention

[0004] In view of this, the present application provides an APT attack detection method and device, medium, and electronic equipment for a digital substation, the main purpose of which is to improve the existing problem of being unable to effectively detect APT attacks, which in turn makes it difficult to ensure the network security of the digital substation.

[0005] According to one aspect of the present application, a method for detecting APT attacks in a digital substation is provided, comprising:

[0006] Obtaining a system activity data traceability diagram of a digital substation, wherein the system activity data traceability diagram is used to record the interaction relationship between various system entities included in the system activity;

[0007] Performing label initialization processing on each system entity included in the system activity data traceability diagram, wherein the label initialization processing is used to mark the process type and file type of the system entity;

[0008] Determine the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities;

[0009] If the APT attack stage labels included in the target system activity cover all APT attack stages, the target system activity is determined to be an APT attack.

[0010] Preferably, the label initialization processing includes process type label initialization processing and file type label initialization processing, and the label initialization processing of each system entity included in the system activity data traceability diagram specifically includes:

[0011] Matching the current process description of the system entity with a preset process description to determine a target process description, and marking the system entity based on a process type tag corresponding to the target process description to obtain a process type tag of the system entity;

[0012] And, matching the current file description of the system entity with the preset file description, determining the target file description, and marking the system entity based on the file type tag corresponding to the target file description to obtain the file type tag of the system entity.

[0013] Preferably, the determining of the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities specifically includes:

[0014] The process type label, file type label and event flow of the system entity are matched with the preset process type label, preset file type label and preset event flow in the APT attack stage inference rule respectively to determine the APT attack stage label of the system entity.

[0015] Preferably, obtaining the system activity data traceability diagram of the digital substation specifically includes:

[0016] Acquire a system activity data set of a digital substation, and generate an original system activity data traceability diagram based on the system activity data set;

[0017] Creating a first version of a system entity for each system entity included in the original system activity data traceability diagram;

[0018] When an interaction event directed to a target system entity is monitored, a second version system entity is created for the target system entity, and the interaction event is directed to the second version system entity to generate a system activity data traceability diagram for the digital substation.

[0019] Preferably, after obtaining the system activity data traceability diagram of the digital substation, the method further includes:

[0020] Counting all ending system entities when each system entity included in the system activity data traceability diagram is used as the starting system entity, and generating a set of ending system entities corresponding to each starting system entity;

[0021] Get the starting system entity and the ending system entity of each interaction event;

[0022] Acquire a corresponding end system entity set according to the start system entity of the interaction event, and determine whether the end system entity set already contains the end system entity of the interaction event;

[0023] If not included, adding the ending system entity of the interaction event to the ending system entity set;

[0024] If it is already included, deleting the interaction event;

[0025] Based on the above steps, the system activity data traceability graph is compressed to obtain a compressed system activity data traceability graph.

[0026] Preferably, after obtaining the system activity data traceability diagram of the digital substation, the method further includes:

[0027] Obtaining the latest version of the system entity of the end system entity of each interactive event included in the compressed system activity data traceability graph;

[0028] If the latest version system entity has no subsystem entity, then the end system entity of the interaction event is deleted, and only the latest version system entity is retained;

[0029] Based on the above steps, the compressed system activity data traceability graph is subjected to secondary compression processing to obtain a secondary compressed system activity data traceability graph;

[0030] The label initialization process for each system entity included in the system activity data traceability graph specifically includes:

[0031] Label initialization processing is performed on each system entity included in the secondary compressed system activity data traceability graph.

[0032] Preferably, if the APT attack stage label included in the target system activity covers all APT attack stages, after determining that the target system activity is an APT attack, the method further includes:

[0033] The process type label and the file type label of each system entity included in the target system activity are matched with the preset alarm rule, the target alarm rule is determined, and an alarm is issued to the user based on the alarm information corresponding to the target alarm rule.

[0034] According to another aspect of the present application, there is provided an APT attack detection device for a digital substation, comprising:

[0035] A module for obtaining a system activity data traceability diagram is used to obtain a system activity data traceability diagram of a digital substation, wherein the system activity data traceability diagram is used to record the interaction relationship between various system entities included in the system activity;

[0036] A label initialization module, used to perform label initialization processing on each system entity included in the system activity data traceability diagram, wherein the label initialization processing is used to mark the process type and file type of the system entity;

[0037] An APT attack inference module, used to determine the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities;

[0038] The APT attack determination module is used to determine that the target system activity is an APT attack if the APT attack stage label contained in the target system activity covers all APT attack stages.

[0039] Preferably, the label initialization process includes process type label initialization process and file type label initialization process, and the label initialization module is specifically used for:

[0040] Matching the current process description of the system entity with a preset process description to determine a target process description, and marking the system entity based on a process type tag corresponding to the target process description to obtain a process type tag of the system entity;

[0041] And, matching the current file description of the system entity with the preset file description, determining the target file description, and marking the system entity based on the file type tag corresponding to the target file description to obtain the file type tag of the system entity.

[0042] Preferably, the APT attack inference module is specifically used for:

[0043] The process type label, file type label and event flow of the system entity are matched with the preset process type label, preset file type label and preset event flow in the APT attack stage inference rule respectively to determine the APT attack stage label of the system entity.

[0044] Preferably, the module for obtaining the traceability diagram of system activity data is specifically used for:

[0045] Acquire a system activity data set of a digital substation, and generate an original system activity data traceability diagram based on the system activity data set;

[0046] Creating a first version of a system entity for each system entity included in the original system activity data traceability diagram;

[0047] When an interaction event directed to a target system entity is monitored, a second version system entity is created for the target system entity, and the interaction event is directed to the second version system entity to generate a system activity data traceability diagram for the digital substation.

[0048] Preferably, after obtaining the system activity data traceability diagram module, the device further includes a data traceability diagram compression module, which is specifically used to:

[0049] Counting all ending system entities when each system entity included in the system activity data traceability diagram is used as the starting system entity, and generating a set of ending system entities corresponding to each starting system entity;

[0050] Get the starting system entity and the ending system entity of each interaction event;

[0051] Acquire a corresponding end system entity set according to the start system entity of the interaction event, and determine whether the end system entity set already contains the end system entity of the interaction event;

[0052] If not included, adding the ending system entity of the interaction event to the ending system entity set;

[0053] If it is already included, deleting the interaction event;

[0054] Based on the above steps, the system activity data traceability graph is compressed to obtain a compressed system activity data traceability graph.

[0055] Preferably, after obtaining the system activity data traceability diagram module, the device further includes a secondary compression data traceability diagram module, which is specifically used to:

[0056] Obtaining the latest version of the system entity of the end system entity of each interactive event included in the compressed system activity data traceability graph;

[0057] If the latest version system entity has no subsystem entity, then the end system entity of the interaction event is deleted, and only the latest version system entity is retained;

[0058] Based on the above steps, the compressed system activity data traceability graph is subjected to secondary compression processing to obtain a secondary compressed system activity data traceability graph;

[0059] The label initialization module is specifically used for:

[0060] Label initialization processing is performed on each system entity included in the secondary compressed system activity data traceability graph.

[0061] Preferably, after the APT attack determination module, the device further includes:

[0062] The alarm module is used to match the process type label and file type label of each system entity included in the target system activity with the preset alarm rule, determine the target alarm rule, and issue an alarm to the user based on the alarm information corresponding to the target alarm rule.

[0063] According to another aspect of the present application, a storage medium is provided, in which at least one executable instruction is stored, and the executable instruction enables a processor to perform operations corresponding to the above-mentioned APT attack detection method for a digital substation.

[0064] According to another aspect of the present application, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus;

[0065] The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute operations corresponding to the above-mentioned APT attack detection method for a digital substation.

[0066] By means of the above technical solution, the technical solution provided by the embodiment of the present application has at least the following advantages:

[0067] The present application provides an APT attack detection method and device, medium, and electronic device for a digital substation. First, a system activity data traceability diagram of the digital substation is obtained, and the system activity data traceability diagram is used to record the interaction relationship between each system entity included in the system activity; secondly, label initialization processing is performed on each system entity included in the system activity data traceability diagram, and the label initialization processing is used to mark the process type and file type of the system entity; thirdly, the APT attack stage label of each system entity is determined according to the process type label, file type label, and event flow of each system entity; finally, if the APT attack stage label included in the target system activity covers all APT attack stages, the target system activity is determined to be an APT attack. Compared with the prior art, the embodiment of the present application first identifies potential attack targets and attack paths by marking system entities by process type and file type. At the same time, since the labels used for marking are suitable for different situations, the flexibility and applicability of APT attack detection are improved. Further, the APT attack stage label of each system entity is determined according to the process type label, file type label and event flow of the system entity, and the system activities covering all APT attack stages are determined as APT attacks. Through the inference and aggregation of labels, the APT attacks in the digital substation are effectively identified, which improves the accuracy and reliability of APT attack detection, thereby ensuring the network security of the digital substation.

[0068] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0070] Figure 1 A flow chart of an APT attack detection method for a digital substation provided by an embodiment of the present application is shown;

[0071] Figure 2 A flowchart of another APT attack detection method for a digital substation provided by an embodiment of the present application is shown;

[0072] Figure 3 The original system activity data traceability diagram provided by the embodiment of the present application is shown;

[0073] Figure 4 A system activity data traceability diagram provided in an embodiment of the present application is shown;

[0074] Figure 5 A compressed system activity data traceability diagram provided in an embodiment of the present application is shown;

[0075] Figure 6 The pseudo code of the redundant semantic deletion process provided by the embodiment of the present application is shown;

[0076] Figure 7 A traceability diagram of system activity data after secondary compression provided by an embodiment of the present application is shown;

[0077] Figure 8 The pseudo code of the invalid entity clearing process provided by the embodiment of the present application is shown;

[0078] Fig. 9 A block diagram of an APT attack detection device for a digital substation provided by an embodiment of the present application is shown;

[0079] Fig.10 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0080] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0081] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0082] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0083] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0084] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0085] The embodiments of the present application can be applied to computer systems / servers, which can operate with many other general or special computing system environments or configurations. Examples of well-known computing systems, environments and / or configurations suitable for use with computer systems / servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, small computer systems, large computer systems, and distributed cloud computing technology environments including any of the above systems, etc.

[0086] Computer systems / servers may be described in the general context of computer system executable instructions (such as program modules) executed by a computer system. In general, program modules may include routines, programs, object programs, components, logic, data structures, etc., which perform specific tasks or implement specific abstract data types. Computer systems / servers may be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules may be located on local or remote computing system storage media including storage devices.

[0087] The present application embodiment provides a method for detecting APT attacks in a digital substation. Figure 1 As shown, the method includes:

[0088] 101. Obtain the system activity data traceability diagram of the digital substation.

[0089] Among them, the system activity data provenance diagram is used to record the interaction relationship between each system entity contained in the system activity. It should be noted that the data provenance diagram is a form of metadata that can record the activities of each system entity in the data generation process. It is composed of multiple nodes and directed edges, where the node represents the system entity that appears in the system activity, which may include processes, files, sockets, etc.; the directed edge represents the interaction relationship between nodes (i.e., system entities), which may include read type, write type, execution type, create subprocess type, etc. Therefore, the data provenance diagram has very rich causal relationships on a larger time and space scale. System activities are used to characterize the network communication activities of digital substations, such as downloading files, reading user key directories, etc. In an embodiment of the present application, the current execution end may be a malicious attack detection unit of a digital substation.

[0090] It should be noted that the system activity data traceability diagram can adopt a standardized data traceability diagram. Since the standardized data traceability diagram has a directed acyclic characteristic, the system activity data traceability diagram obtained by subsequent processing can maintain the same characteristics as the system activity data traceability diagram in the embodiment of the present application.

[0091] 102. Perform label initialization processing on each system entity included in the system activity data traceability diagram.

[0092] The label initialization process is used to label the process type and file type of the system entity.

[0093] It can be understood that when the subjects of system activities are different, events of the same type may have different semantics. For example, in a file read event, reading a file downloaded from the network (R1) represents an untrusted data flow, and reading a text document in a user key directory (R2) represents a high-value data flow. The semantics of these two file read events are different. In the ATT&CK attack model, R1 is one of the behavioral characteristics of the initial access phase of an APT attack, which may lead to the execution of malicious code, while R2 may be that the attacker is stealing user information, corresponding to the data leakage phase of an APT attack. In order to distinguish the semantics of system entities, in an embodiment of the present application, label initialization processing is performed on each system entity to identify the semantics of each system entity, thereby identifying potential attack targets and attack paths. At the same time, by configuring labels suitable for different scenarios, the flexibility and applicability of APT attack detection are further improved.

[0094] It should be noted that process type labels are divided into state labels and behavior labels. The state labels can be passed to the child process created by the system activity using the fork operation, and the behavior labels indicate the operations performed by the system activity in the past, which can be used to accurately locate threats. File type labels are divided into untrusted labels and high-value labels. The untrusted labels are used to characterize files containing untrusted data, and the high-value labels are used to characterize files containing sensitive data.

[0095] 103. Determine the APT attack stage label of each system entity according to the process type label, file type label and event flow of each system entity.

[0096] Among them, process type labels can include status labels and behavior labels. Status labels include processes having network connections, processes accessing data in high-value data flow nodes, etc.; behavior labels include processes executing files from the network, processes executing sensitive files, etc. File type labels can include untrusted labels and high-value labels. Untrusted labels include files being uploaded, files containing data from the network, etc.; high-value labels include files that can control startup items, files that can control permissions, etc. Event flow is used to characterize the transmission direction of the label, which can include writing and reading. APT attack stage labels can include initial access stage, untrusted execution stage, lateral movement stage, suspicious behavior stage, and data leakage stage. Among them, the suspicious behavior stage also includes the establishment of a foothold stage, the authority escalation stage, the acquisition of access credentials stage, and the information collection stage.

[0097] It should be noted that system activities will generate corresponding information flows, which may include control flows and data flows, wherein control flows are used to characterize the derivative relationship of processes; data flows are used to characterize the dependency relationship of data content, which reflects the flow path of data. In the embodiment of the present application, the control flow and data flow can be used to propagate process type labels and file type labels between system entities, and the APT attack stage label of the system entity can be determined based on the process type label, file type label and event flow. Furthermore, when the attack involves multiple processes, monitoring untrusted control flows can achieve the association of multiple malicious processes; and because data flows can also be divided into untrusted data flows and high-value data flows, untrusted data flows reflect the flow path of external untrusted data, and high-value data flows reflect the escape path after the high-value content is stolen. Since untrusted control flows, untrusted data flows and high-value data flows have high attack risks, the attack chain can be accurately detected by tracking the above three information flows.

[0098] 104. If the APT attack stage labels contained in the target system activity cover all APT attack stages, the target system activity is determined to be an APT attack.

[0099] In an embodiment of the present application, when the APT attack stage label of a system activity contains all the above-mentioned APT attack stages, that is, it contains five APT attack stage labels of initial access stage, untrusted execution stage, lateral movement stage, suspicious behavior stage and data leakage stage, the system activity can be determined to be an APT attack.

[0100] Compared with the prior art, the embodiment of the present application first identifies potential attack targets and attack paths by marking system entities by process type and file type. At the same time, since the labels used for marking are suitable for different situations, the flexibility and applicability of APT attack detection are improved. Further, the APT attack stage label of each system entity is determined according to the process type label, file type label and event flow of the system entity, and the system activities covering all APT attack stages are determined as APT attacks. Through the inference and aggregation of labels, the APT attacks in the digital substation are effectively identified, which improves the accuracy and reliability of APT attack detection, thereby ensuring the network security of the digital substation.

[0101] The present application embodiment provides another APT attack detection method for a digital substation, such as Figure 2 As shown, the method includes:

[0102] 201. Obtain the system activity data traceability diagram of the digital substation.

[0103] In order to make the system activity data traceability diagram obtained by subsequent processing maintain the same characteristics as the system activity data traceability diagram in the embodiment of the present application, a standardized data traceability diagram can be obtained in the embodiment of the present application. Specifically, first obtain the system activity data set of the digital substation, that is, the network communication data set generated when the digital substation has system activities, and generate the original system activity data traceability diagram based on the system activity data set, such as Figure 3 As shown, A, B, C, and D represent system entities, and the numbered arrows represent interaction events 1-6. Further, the original system activity data traceability diagram is normalized. Specifically, a first version system entity (A0, B0, C0, and D0) is created for each system entity (A, B, C, and D) included in the original system activity data traceability diagram; when an interaction event pointing to a target system entity is detected, a second version system entity is created for the target system entity, and the interaction event is pointed to the second version system entity. For example, when an interaction event 1 pointing to system entity B is detected, a second version system entity B1 is created for system entity B, and interaction event 1 is pointed from A0 to the second version system entity B1 of system entity B; similarly, based on the above steps, the same processing is performed on interaction events 2-6 to generate a system activity data traceability diagram for a digital substation, as shown in FIG. Figure 4 shown.

[0104] Correspondingly, step 201 of the embodiment specifically includes: obtaining a system activity data set of the digital substation, and generating an original system activity data traceability diagram based on the system activity data set; creating a first version system entity for each system entity included in the original system activity data traceability diagram; when an interaction event pointing to a target system entity is monitored, creating a second version system entity for the target system entity, and pointing the interaction event to the second version system entity to generate a system activity data traceability diagram for the digital substation.

[0105] 202. Compress the system activity data traceability graph to obtain a compressed system activity data traceability graph.

[0106] It should be noted that the normalization processing in step 201 of the embodiment increases the scale of the data, thereby increasing the memory consumption and the algorithm running consumption. In order to save consumption, the system activity data traceability graph can be compressed. At the same time, in order to avoid destroying the original interaction relationship between system entities, in the embodiment of the present application, the interaction events in the system activity data traceability graph can be semantically deleted. That is, when the state of the starting system entity remains unchanged, since all interaction events from the starting system entity to any identical ending system entity cannot be semantically distinguished, only the interaction event with the earliest timestamp can be retained, and the subsequent interaction events can be deleted as redundant events, thereby achieving compression of the system activity data traceability graph. Specifically, all the ending system entities when each system entity included in the system activity data traceability diagram is used as the starting system entity are counted to generate the ending system entity sets Sem(A), Sem(B), Sem(C), and Sem(D) corresponding to each starting system entity; further obtain the starting system entity and the ending system entity of each interaction event, interaction event 1 (A→B), interaction event 2 (B→C), interaction event 3 (C→D), interaction event 4 (D→X), interaction event 5 (B→C), and interaction event 6 (C→D); then obtain the corresponding ending system entity set according to the starting system entity of the interaction event, and determine whether the ending system entity of the interaction event is already included in the ending system entity set; if not, add the ending system entity of the interaction event to the ending system entity set; if already included, delete the interaction event, as follows,

[0107] Interaction event 1 (A→B): Sem(A) is empty, add B to Sem(A);

[0108] Interaction event 2 (B→C): Sem(B) is empty, add C to Sem(B);

[0109] Interaction event 3 (C→D): Sem(C) is empty, add D to Sem(C);

[0110] Interaction event 4 (D→X): Sem(D) is empty, add X to Sem(D);

[0111] Interaction event 5 (B→C): Sem(B)=C, C is in Sem(B), delete the interaction event;

[0112] Interaction event 6 (C→D): Sem(C)=D, D is in Sem(C), delete the interaction event.

[0113] Since the state of system entity B did not change between interaction events 2-5, interaction event 5 is considered to be consistent with interaction event 2 and is a redundant event; the state of system entity C did not change between interaction events 3-6, so interaction event 6 is considered to be consistent with interaction event 3 and is a redundant event. Based on the above steps, redundant events 5 and 6 are deleted to compress the system activity data traceability graph, and the compressed system activity data traceability graph is obtained, as shown in FIG. Figure 5 shown.

[0114] In addition, the above redundant semantic deletion process can be based on Figure 6 Pseudocode implementation in .

[0115] Correspondingly, step 202 of the embodiment specifically includes: counting all the ending system entities when each system entity included in the system activity data traceability diagram is used as the starting system entity, and generating a set of ending system entities corresponding to each starting system entity; obtaining the starting system entity and the ending system entity of each interactive event; obtaining the corresponding ending system entity set according to the starting system entity of the interactive event, and judging whether the ending system entity of the interactive event is already included in the ending system entity set; if not, adding the ending system entity of the interactive event to the ending system entity set; if already included, deleting the interactive event; based on the above steps, compressing the system activity data traceability diagram, to obtain a compressed system activity data traceability diagram.

[0116] 203. Perform secondary compression on the compressed system activity data traceability graph to obtain a secondary compressed system activity data traceability graph.

[0117] In order to further save consumption, in the embodiment of the present application, invalid system entities can also be cleared from the system entities in the compressed system activity data traceability diagram to perform secondary compression processing, that is, when a system entity has the same ancestor system entity as another system entity and has no child nodes, it can be regarded as an invalid node and deleted. Specifically, for any interactive event, first obtain the latest version of the system entity of the end system entity of the interactive event, and determine the number of its child system entities. If it is zero, the end system entity can be regarded as an invalid entity and deleted, and only the latest version of the system entity is retained. For example, Figure 5 As shown,

[0118] For interaction event 1 (A→B): the latest version of the ending system entity B is B0, and there is no subsystem entity. At this time, the ending system entity B1 is regarded as an invalid entity and deleted, and B0 is retained;

[0119] Similarly, interaction event 2 (B→C): the latest version of the end system entity C is C0, and there is no subsystem entity. At this time, the end system entity C2 is regarded as an invalid entity and deleted, and C0 is retained;

[0120] Interaction event 3 (C→D): The latest version of the end system entity D is D0, and there is no subsystem entity. At this time, the end system entity D3 is regarded as an invalid entity and deleted, and D0 is retained.

[0121] Based on the above steps, invalid entities B1, C2, and D3 are deleted to achieve secondary compression of the system activity data traceability graph, and the secondary compressed system activity data traceability graph is obtained, as shown in Figure 7 shown.

[0122] In addition, the above invalid system entity removal process can be based on Figure 8 Pseudocode implementation in .

[0123] Correspondingly, step 203 of the embodiment specifically includes: obtaining the latest version system entity of the end system entity of each interactive event contained in the compressed system activity data traceability graph; if the latest version system entity has no subsystem entity, deleting the end system entity of the interactive event and retaining only the latest version system entity; based on the above steps, performing secondary compression processing on the compressed system activity data traceability graph to obtain a secondary compressed system activity data traceability graph.

[0124] 204. Perform label initialization processing on each system entity included in the system activity data traceability diagram after secondary compression.

[0125] Among them, the label initialization processing includes process type label initialization processing and file type label initialization processing. In the embodiment of the present application, based on the pre-established process type label and description mapping table, as shown in Table 1, the process type label initialization processing is performed on each system entity contained in the system activity data traceability diagram after secondary compression. Specifically, the current process description of the system entity is matched with the preset process description in Table 1, the target process description is determined, and the system entity is marked based on the process type label corresponding to the target process description to obtain the process type label of the system entity. For example, the current process description of a system entity is "including network connection", which matches the first line of the preset process description in Table 1 "the process has a network connection", then "the process has a network connection" is determined as the target process description, at this time, the process type label of the system entity can be marked as "PS1"; the current process description of a system entity is "executing commands without permission", which matches the 11th line of the preset process description in Table 1 "the process executed instructions", then "the process executed instructions" is determined as the target process description, at this time, the process type label of the system entity can be marked as "PB4".

[0126] Table 1 Process label and description mapping table

[0127]

[0128] At the same time, based on the pre-established file type label and description mapping table, as shown in Table 2, the file type label initialization processing is performed on each system entity contained in the system activity data traceability diagram after secondary compression. Specifically, the current file description of the system entity is matched with the preset file description in Table 2, the target file description is determined, and the system entity is marked based on the file type label corresponding to the target file description to obtain the file type label of the system entity. For example, the current file description of a system entity is "contains data from the network", and it matches the second line of the preset file description in Table 2 "The file contains data from the network", then "The file contains data from the network" is determined as the target file description. At this time, the file type label of the system entity can be marked as "FU2".

[0129] Table 2 File label and description mapping table

[0130]

[0131] Correspondingly, step 204 of the embodiment specifically includes: matching the current process description of the system entity with the preset process description, determining the target process description, and marking the system entity based on the process type tag corresponding to the target process description to obtain the process type tag of the system entity; and matching the current file description of the system entity with the preset file description, determining the target file description, and marking the system entity based on the file type tag corresponding to the target file description to obtain the file type tag of the system entity.

[0132] Since some system entities with specific tags may directly or indirectly cause potential damage to the security of the digital substation, preferably, in the embodiment of the present application, they are defined as potentially harmful processes (PHFs). Exemplarily, PS2, PS3, PS5 and PB1, PB2, PB5 are added to the PHF list, and the user can configure the PHF list according to actual security requirements.

[0133] 205. Determine the APT attack stage label of each system entity according to the process type label, file type label and event flow of each system entity.

[0134] In the embodiment of the present application, based on the pre-established APT attack stage inference rule mapping table, as shown in Table 3, the APT attack stage label of each system entity is inferred according to the process type label, file type label and event flow of the system entity. Specifically, the process type label, file type label and event flow of the system entity obtained by label initialization in step 204 of the embodiment are matched with the preset process type label (i.e., label 1), the preset file type label (i.e., label 2) and the preset event flow (i.e., direction) in Table 2, respectively, to determine the APT attack stage label (such as the initial access stage, the untrusted execution stage, etc.). For example, the process type label of a system entity is "PS1", the file type label is "FU2", and the event flow is "write". If it matches the first row in Table 3, it can be determined that the APT attack stage label of the system entity is "initial access stage"; if the process type label of a system entity is "PS3", the file type label is "FU2", and the event flow is "read", it can be matched to the second row in Table 3, then it can be determined that the APT attack stage label of the system entity is "initial access stage".

[0135] Table 3 APT attack stage inference rule mapping table

[0136]

[0137] Correspondingly, step 205 of the embodiment specifically includes: matching the process type label, file type label and event flow of the system entity with the preset process type label, preset file type label and preset event flow in the APT attack stage inference rule respectively to determine the APT attack stage label of the system entity.

[0138] 206. If the APT attack stage labels included in the target system activity cover all APT attack stages, the target system activity is determined to be an APT attack.

[0139] The technical solution implemented in the present application has been described in detail in step 104 of the embodiment and will not be repeated here.

[0140] 207. Send APT attack alerts to users.

[0141] It should be noted that, in order to enable users to quickly know the specific content of the attack when receiving an APT attack alarm, in an embodiment of the present application, based on a pre-established alarm rule mapping table, as shown in Table 4, the specific alarm content is determined according to the process type label and file type label of each system entity. Specifically, the process type label and file type label of the system entity are matched with the preset alarm rules (i.e., judgment rules) in Table 4. After determining the target alarm rule, the label situation corresponding to the target alarm rule and the alarm bar information are used as alarm information to issue an alarm to the user.

[0142] Table 4 Alert rule mapping table

[0143]

[0144]

[0145] Accordingly, step 207 of the embodiment specifically includes: matching the process type label and file type label of each system entity included in the target system activity with the preset alarm rule, determining the target alarm rule, and issuing an alarm to the user based on the alarm information corresponding to the target alarm rule.

[0146] The present application provides an APT attack detection method for a digital substation. First, a system activity data traceability diagram of the digital substation is obtained, and the system activity data traceability diagram is used to record the interaction relationship between each system entity included in the system activity; secondly, label initialization processing is performed on each system entity included in the system activity data traceability diagram, and the label initialization processing is used to mark the process type and file type of the system entity; thirdly, the APT attack stage label of each system entity is determined according to the process type label, file type label and event flow of each system entity; finally, if the APT attack stage label included in the target system activity covers all APT attack stages, the target system activity is determined to be an APT attack. Compared with the prior art, the embodiment of the present application first identifies potential attack targets and attack paths by marking system entities by process type and file type. At the same time, since the labels used for marking are suitable for different situations, the flexibility and applicability of APT attack detection are improved. Further, the APT attack stage label of each system entity is determined according to the process type label, file type label and event flow of the system entity, and the system activities covering all APT attack stages are determined as APT attacks. Through the inference and aggregation of labels, the APT attacks in the digital substation are effectively identified, which improves the accuracy and reliability of APT attack detection, thereby ensuring the network security of the digital substation.

[0147] Furthermore, as a response to the above Figure 1 The implementation of the method shown in the figure, the embodiment of the present application provides an APT attack detection device for a digital substation, such as Fig. 9 As shown, the device comprises:

[0148] A system activity data tracing diagram acquisition module 31, a label initialization module 32, an APT attack inference module 33, and an APT attack determination module 34.

[0149] A module 31 for obtaining a system activity data traceability diagram is used to obtain a system activity data traceability diagram of a digital substation, wherein the system activity data traceability diagram is used to record the interaction relationship between various system entities included in the system activity;

[0150] A label initialization module 32 is used to perform label initialization processing on each system entity included in the system activity data traceability diagram, and the label initialization processing is used to mark the process type and file type of the system entity;

[0151] An APT attack inference module 33, used to determine the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities;

[0152] The APT attack determination module 34 is configured to determine that the target system activity is an APT attack if the APT attack stage label contained in the target system activity covers all APT attack stages.

[0153] Preferably, the label initialization process includes process type label initialization process and file type label initialization process, and the label initialization module is specifically used for:

[0154] Matching the current process description of the system entity with a preset process description to determine a target process description, and marking the system entity based on a process type tag corresponding to the target process description to obtain a process type tag of the system entity;

[0155] And, matching the current file description of the system entity with the preset file description, determining the target file description, and marking the system entity based on the file type tag corresponding to the target file description to obtain the file type tag of the system entity.

[0156] Preferably, the APT attack inference module is specifically used for:

[0157] The process type label, file type label and event flow of the system entity are matched with the preset process type label, preset file type label and preset event flow in the APT attack stage inference rule respectively to determine the APT attack stage label of the system entity.

[0158] Preferably, the module for obtaining the traceability diagram of system activity data is specifically used for:

[0159] Acquire a system activity data set of a digital substation, and generate an original system activity data traceability diagram based on the system activity data set;

[0160] Creating a first version of a system entity for each system entity included in the original system activity data traceability diagram;

[0161] When an interaction event directed to a target system entity is monitored, a second version system entity is created for the target system entity, and the interaction event is directed to the second version system entity to generate a system activity data traceability diagram for the digital substation.

[0162] Preferably, after obtaining the system activity data traceability diagram module, the device further includes a data traceability diagram compression module, which is specifically used to:

[0163] Counting all ending system entities when each system entity included in the system activity data traceability diagram is used as the starting system entity, and generating a set of ending system entities corresponding to each starting system entity;

[0164] Get the starting system entity and the ending system entity of each interaction event;

[0165] Acquire a corresponding end system entity set according to the start system entity of the interaction event, and determine whether the end system entity set already contains the end system entity of the interaction event;

[0166] If not included, adding the ending system entity of the interaction event to the ending system entity set;

[0167] If it is already included, deleting the interaction event;

[0168] Based on the above steps, the system activity data traceability graph is compressed to obtain a compressed system activity data traceability graph.

[0169] Preferably, after obtaining the system activity data traceability diagram module, the device further includes a secondary compression data traceability diagram module, which is specifically used to:

[0170] Obtaining the latest version of the system entity of the end system entity of each interactive event included in the compressed system activity data traceability graph;

[0171] If the latest version system entity has no subsystem entity, then the end system entity of the interaction event is deleted, and only the latest version system entity is retained;

[0172] Based on the above steps, the compressed system activity data traceability graph is subjected to secondary compression processing to obtain a secondary compressed system activity data traceability graph;

[0173] The label initialization module is specifically used for:

[0174] Label initialization processing is performed on each system entity included in the secondary compressed system activity data traceability graph.

[0175] Preferably, after the APT attack determination module, the device further includes:

[0176] The alarm module is used to match the process type label and file type label of each system entity included in the target system activity with the preset alarm rule, determine the target alarm rule, and issue an alarm to the user based on the alarm information corresponding to the target alarm rule.

[0177] The present application provides an APT attack detection device for a digital substation. First, a system activity data traceability diagram of the digital substation is obtained, and the system activity data traceability diagram is used to record the interaction relationship between each system entity included in the system activity; secondly, label initialization processing is performed on each system entity included in the system activity data traceability diagram, and the label initialization processing is used to mark the process type and file type of the system entity; thirdly, the APT attack stage label of each system entity is determined according to the process type label, file type label and event flow of each system entity; finally, if the APT attack stage label included in the target system activity covers all APT attack stages, the target system activity is determined to be an APT attack. Compared with the prior art, the embodiment of the present application first identifies potential attack targets and attack paths by marking system entities by process type and file type. At the same time, since the labels used for marking are suitable for different situations, the flexibility and applicability of APT attack detection are improved. Further, the APT attack stage label of each system entity is determined according to the process type label, file type label and event flow of the system entity, and the system activities covering all APT attack stages are determined as APT attacks. Through the inference and aggregation of labels, the APT attacks in the digital substation are effectively identified, which improves the accuracy and reliability of APT attack detection, thereby ensuring the network security of the digital substation.

[0178] According to an embodiment of the present application, a storage medium is provided, wherein the storage medium stores at least one executable instruction, and the computer executable instruction can execute the APT attack detection method for a digital substation in any of the above method embodiments.

[0179] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0180] Fig.10 A schematic diagram of the structure of an electronic device provided according to an embodiment of the present application is shown. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0181] like Fig.10 As shown, the electronic device may include: a processor (processor) 402 , a communication interface (Communications Interface) 404 , a memory (memory) 406 , and a communication bus 408 .

[0182] The processor 402 , the communication interface 404 , and the memory 406 communicate with each other via a communication bus 408 .

[0183] The communication interface 404 is used to communicate with other devices such as clients or other servers.

[0184] The processor 402 is used to execute the program 410, and specifically can execute the relevant steps in the above-mentioned embodiment of the APT attack detection method for the digital substation.

[0185] Specifically, the program 410 may include program codes, which include computer operation instructions.

[0186] The processor 402 may be a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the computer device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0187] The memory 406 is used to store the program 410. The memory 406 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0188] The program 410 may be specifically configured to enable the processor 402 to perform the following operations:

[0189] Obtaining a system activity data traceability diagram of a digital substation, wherein the system activity data traceability diagram is used to record the interaction relationship between various system entities included in the system activity;

[0190] Performing label initialization processing on each system entity included in the system activity data traceability diagram, wherein the label initialization processing is used to mark the process type and file type of the system entity;

[0191] Determine the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities;

[0192] If the APT attack stage labels included in the target system activity cover all APT attack stages, the target system activity is determined to be an APT attack.

[0193] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the physical device of the APT attack detection method for the digital substation, and supports the operation of the information processing program and other software and / or programs. The network communication module is used to realize the communication between the components inside the storage medium, and the communication with other hardware and software in the information processing physical device.

[0194] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0195] The method and system of the present application may be implemented in many ways. For example, the method and system of the present application may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present application are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present application may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present application. Therefore, the present application also covers a recording medium storing a program for executing the method according to the present application.

[0196] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0197] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting APT attacks in a digital substation, characterized in that: include: Obtaining a system activity data traceability diagram of a digital substation, wherein the system activity data traceability diagram is used to record the interaction relationship between various system entities included in the system activity; Performing label initialization processing on each system entity included in the system activity data traceability diagram, wherein the label initialization processing is used to mark the process type and file type of the system entity; Determine the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities; If the APT attack stage labels included in the target system activity cover all APT attack stages, the target system activity is determined to be an APT attack.

2. The method according to claim 1, characterized in that: The label initialization processing includes process type label initialization processing and file type label initialization processing. The label initialization processing of each system entity included in the system activity data traceability diagram specifically includes: Matching the current process description of the system entity with a preset process description to determine a target process description, and marking the system entity based on a process type tag corresponding to the target process description to obtain a process type tag of the system entity; And, matching the current file description of the system entity with the preset file description, determining the target file description, and marking the system entity based on the file type tag corresponding to the target file description to obtain the file type tag of the system entity.

3. The method according to claim 1 or 2, characterized in that: The determining of the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities specifically includes: The process type label, file type label and event flow of the system entity are matched with the preset process type label, preset file type label and preset event flow in the APT attack stage inference rule respectively to determine the APT attack stage label of the system entity.

4. The method according to claim 1, characterized in that: The obtaining of the system activity data traceability diagram of the digital substation specifically includes: Acquire a system activity data set of a digital substation, and generate an original system activity data traceability diagram based on the system activity data set; Creating a first version of a system entity for each system entity included in the original system activity data traceability diagram; When an interaction event directed to a target system entity is monitored, a second version system entity is created for the target system entity, and the interaction event is directed to the second version system entity to generate a system activity data traceability diagram for the digital substation.

5. The method according to claim 1 or 4, characterized in that: After obtaining the system activity data traceability diagram of the digital substation, the method further includes: Counting all ending system entities when each system entity included in the system activity data traceability diagram is used as the starting system entity, and generating a set of ending system entities corresponding to each starting system entity; Get the starting system entity and the ending system entity of each interaction event; Acquire a corresponding end system entity set according to the start system entity of the interaction event, and determine whether the end system entity set already contains the end system entity of the interaction event; If not included, adding the ending system entity of the interaction event to the ending system entity set; If it is already included, deleting the interaction event; Based on the above steps, the system activity data traceability graph is compressed to obtain a compressed system activity data traceability graph.

6. The method according to claim 5, characterized in that After obtaining the system activity data traceability diagram of the digital substation, the method further includes: Obtaining the latest version of the system entity of the end system entity of each interactive event included in the compressed system activity data traceability graph; If the latest version system entity has no subsystem entity, then the end system entity of the interaction event is deleted, and only the latest version system entity is retained; Based on the above steps, the compressed system activity data traceability graph is subjected to secondary compression processing to obtain a secondary compressed system activity data traceability graph; The label initialization process for each system entity included in the system activity data traceability graph specifically includes: Label initialization processing is performed on each system entity included in the secondary compressed system activity data traceability graph.

7. The method according to any one of claims 1 to 6, characterized in that: If the APT attack stage labels included in the target system activity cover all APT attack stages, after determining that the target system activity is an APT attack, the method further includes: The process type label and the file type label of each system entity included in the target system activity are matched with the preset alarm rule, the target alarm rule is determined, and an alarm is issued to the user based on the alarm information corresponding to the target alarm rule.

8. An APT attack detection device for a digital substation, characterized in that: include: A module for obtaining a system activity data traceability diagram is used to obtain a system activity data traceability diagram of a digital substation, wherein the system activity data traceability diagram is used to record the interaction relationship between various system entities included in the system activity; A label initialization module, used to perform label initialization processing on each system entity included in the system activity data traceability diagram, wherein the label initialization processing is used to mark the process type and file type of the system entity; An APT attack inference module, used to determine the APT attack stage label of each of the system entities according to the process type label, file type label and event flow of each of the system entities; The APT attack determination module is used to determine that the target system activity is an APT attack if the APT attack stage label contained in the target system activity covers all APT attack stages.

9. A storage medium, wherein at least one executable instruction is stored in the storage medium, characterized in that: The executable instructions enable the processor to execute operations corresponding to the APT attack detection method for a digital substation according to any one of claims 1 to 7.

10. An electronic device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, wherein the executable instruction enables the processor to perform operations corresponding to the APT attack detection method for a digital substation according to any one of claims 1 to 7.

Images