Power network security active defense method and system based on data mining

Abstract

The invention discloses a power network security active defense method and system based on data mining, and relates to the field of power network security and artificial intelligence. Comprising the following steps: step 1, acquiring and preprocessing multi-source data; 2, performing fusion mining on the multi-source data through a data mining technology; 3, performing secondary research and judgment and risk level identification on events monitored by the multi-source network security platform through a clustering algorithm; and step 4, performing active isolation on the high-risk event linkage firewall, and generating an event analysis report. In the working process, multi-source network security data are fused through the data mining technology, the reliability of risk identification is improved, firewall active isolation is achieved for high-risk risks, an isolation report is automatically generated and pushed to a superior management department, the power network security defense energy efficiency is further improved, and on-duty operation and maintenance human input is reduced.

Description

Technical Field

[0001] The present invention relates to the fields of power network security and artificial intelligence, and in particular to a data mining-based active defense method and system for power network security. Background Art

[0002] With the continuous advancement of information and digital technology, the power industry is increasingly dependent on the Internet. The power system has gradually realized functions such as autonomous monitoring and automatic control. The realization of these intelligent functions requires the support of network technology. However, while the Internet brings convenience, there are also risks. In recent years, risks such as hacker attacks and virus transmission have become increasingly prominent, leading to power network paralysis or safety accidents.

[0003] Traditional power network security protection mainly relies on the security equipment of third-party security vendors. At present, there are more than 6 sets of network security equipment deployed at the border of a certain municipal power grid company. Different vendors have different focuses on the prevention of each device, and each has its own advantages and disadvantages. However, each security device is independent of each other and lacks linkage, which is not conducive to the comprehensive analysis and linkage disposal of security incidents. At the same time, the evaluation indicators of the operating status of various types of equipment or systems are limited to a few characteristics such as the performance of the equipment itself and the operating environment. The key attribute characteristics that affect the operating status of the equipment or the safety and stability of the system have not been fully and deeply explored. There is a lack of systematic quantitative evaluation methods, which makes it impossible to accurately evaluate the status of equipment or systems, and it is impossible to realize the early detection and blocking of high-risk vulnerabilities and the automatic compilation and reporting of attack incident bulletins. Summary of the invention

[0004] In view of the above problems, the present invention provides a data mining-based active defense method and system for power network security.

[0005] The technical solution of the present invention is: a method for active defense of power network security based on data mining, comprising the following steps:

[0006] Step 1: Multi-source data acquisition and preprocessing;

[0007] Step 2: Use data mining technology to integrate and mine multi-source data;

[0008] Step 3: Use clustering algorithms to conduct secondary analysis and risk level identification on the events monitored by the multi-source network security platform;

[0009] Step 4: Actively isolate high-risk events through the firewall and generate an event analysis report.

[0010] Step 1 includes:

[0011] 1-1: Obtain multi-source data on power grid security; data sources include flow data and third-party network security platform data; flow data acquisition is based on the Kafka distributed message processing platform, which captures flow data in real time from various network devices in the power grid, including network packet header information, transport layer information, and application layer data;

[0012] The third-party network security platform data includes the firewall logs and alarm information of the firewall platform and the transmission records and isolation strategies of the security network gate platform;

[0013] 1-2: Data preprocessing: preprocess the acquired data, including data analysis, data cleaning and vectorization;

[0014] Among them, data parsing is the processing of traffic data, extracting each field information of the network packet through key character matching;

[0015] Data cleaning removes redundancy, errors, and invalid information from data;

[0016] Data vectorization converts data into vector form through the Word2vec network.

[0017] Step 2 includes:

[0018] 2-1: Multi-source data fusion and splicing: First, align and sort the multi-source data according to the timestamp; then, use the method of splicing multiple timestamp narrow tables into a multi-dimensional wide table to fuse and splice the multi-source data;

[0019] 2-2: Divide the spliced ​​multi-source data by sliding the time window; first determine the size of a time window, then create the first window at the beginning of the time series and fill it with data; then, the window slides forward on the time axis according to the set step size, and each slide updates the data content in the window until the entire time series is covered;

[0020] 2-3: Multi-source data mining based on multi-scale CNN neural network; build a CNN-based neural network to mine abnormal events on the data divided in step 2-2. The types of abnormalities include high-frequency scanning, malicious attacks, discovery of unregistered services, abnormal ledger type access, and identification of poisoned terminals.

[0021] In step 2-3, the network structure of the multi-scale CNN neural network is as follows: the multi-source data divided in step 2-2 is used as the model input and first passes through the convolution layers with convolution kernels of 1×1, 3×3, and 5×5 respectively, the results of different convolution layers are spliced, and then the output of the abnormal type is obtained through two layers of fully connected layers.

[0022] Considering the imbalance in the number of training samples of different anomaly types, Focal Loss is used as the loss function, as shown in formula (1):

[0023] F(p t )=-α t (1-p t ) Y |log(p t ) (1)

[0024] Among them, p t is the probability that the model predicts that the sample belongs to the true label category, α t is the weight of class t, which is used to balance samples of different classes, and γ is the focusing parameter.

[0025] Step 3 includes: using an unsupervised clustering algorithm to conduct secondary analysis on the multi-source data monitored by the multi-source network security platform, specifically including the following steps:

[0026] (1) Randomly select the first centroid from the dataset;

[0027] (2) Assume there are m data points, for each data point x j , calculate the shortest distance D(x) to the selected centroid O; for the n-dimensional data vector x j (a1,a2,a3,...,a n ) and O(b1,b2,b3,...,b n ), the distance between vectors A and B is calculated as D(x), as shown in formula (2):

[0028]

[0029] (3) Select a new data point as the next centroid, and the probability of selection is proportional to D(x), as shown in formula (3):

[0030]

[0031] (4) Repeat steps (2) and (3) until K centroids are selected;

[0032] In the clustering process, the optimization is continuously iterated. According to the distance between each data point and the centroid, the data point is assigned to the cluster represented by the nearest centroid, that is, vulnerabilities with similar characteristics are classified into the same category.

[0033] By analyzing the clustering results, we can identify those event clusters that do not belong to any known categories. These event clusters represent possibly unknown network abnormal events.

[0034] Conduct in-depth analysis of each abnormal event cluster and extract key features, including attack intensity, duration, and target importance, as an important basis for assessing risk levels;

[0035] Develop risk assessment standards by combining expertise and experience in the field of cybersecurity;

[0036] According to the risk assessment criteria, the risk level of each abnormal event cluster is determined; among them, the abnormal event cluster with a high risk level is characterized by an attack frequency that is 200% higher than the average level, the number of affected network nodes exceeds 100, or the impact range spans at least three different regions or departments;

[0037] A low-risk abnormal event cluster is characterized by an attack frequency that is the same as regular network traffic, an impact range that is limited to a single network node or local area, and involves low-sensitivity information or resources.

[0038] In step 4, the detected high-risk risks are defended and automatically blocked by automatically linking the firewall. Whitelist configuration is supported to protect some important services from being automatically blocked by the firewall.

[0039] Among them, firewall management includes: establishing firewall communication through configuration, maintaining the power ledger of the firewall after handshake, and realizing automatic triggering of the blocking function of the firewall after configuration; configuring the firewall blocking action whitelist through the firewall whitelist setting function to protect the core application services from being misjudged;

[0040] Active isolation records include: recording and displaying IP addresses that are identified as high-risk and isolated, and supporting one-click release of automatically isolated IP addresses.

[0041] An active defense system for power network security based on data mining, comprising:

[0042] The detection module is responsible for multi-source data acquisition and preprocessing;

[0043] The training module is used to conduct fusion mining of multi-source data through data mining technology;

[0044] The inspection module is used to identify anomalies through neural networks and conduct secondary analysis and risk level identification of events monitored by the multi-source network security platform through clustering algorithms;

[0045] The decision-making module is used to proactively isolate high-risk events through the firewall and generate event analysis reports.

[0046] Also includes:

[0047] The storage module is responsible for storing the network anomalies for secondary analysis and serves as a supplement to the samples of the training module.

[0048] In operation, the present invention integrates multi-source network security data through data mining technology to improve the reliability of risk identification, and realizes active firewall isolation of high-risk risks, automatically generates isolation reports and pushes them to superior management departments, further improving the power network security defense efficiency and reducing the manpower input of on-duty operation and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 is a flow chart of the method of the present invention,

[0050] Figure 2 It is the network structure diagram of the multi-scale CNN neural network.

[0051] Figure 3 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0052] like Figure 1-3 As shown, the present invention provides an active defense method for power network security based on data mining, comprising the following steps:

[0053] Step 1: Data acquisition and preprocessing;

[0054] Step 2: Use data mining technology to integrate and mine multi-source data (i.e., multi-source network security data);

[0055] Step 3: Use clustering algorithms to conduct secondary analysis and risk level identification on the events monitored by the multi-source network security platform;

[0056] Step 4: Actively isolate high-risk events through the firewall and generate an event analysis report.

[0057] Specifically, data mining technology, as a method to extract hidden information and knowledge from large amounts of data, has shown great application potential in the field of network security.

[0058] The present invention performs data mining and analysis based on real-time full-flow data collected by data communication network export equipment, realizes the identification of abnormal traffic (the types of abnormalities include high-frequency scanning, malicious attacks, discovery of unregistered services, access to abnormal ledger types, identification of poisoned terminals, etc.), eliminates false alarms through a series of analysis and judgment algorithms, links firewall equipment and other management and control systems, realizes automatic blocking and auxiliary decision-making of malicious attacks, and automatically compiles and reports attack event bulletins.

[0059] In this way, applying data mining technology to the active defense of power network security, fully mining the multi-source network security data of power grid companies, and realizing the third-generation firewall function without replacing hardware equipment has important research significance for protecting power information security.

[0060] Furthermore, step 1 specifically includes:

[0061] 1-1: Obtain multi-source data on power grid security. In order to ensure the safe operation of the power grid, the present invention obtains network security data from multiple sources in real time and accurately. The data sources specifically include flow data and third-party network security platform data. Among them, flow data acquisition is based on the Kafka distributed message processing platform, which captures flow data in real time from various network devices in the power grid (such as switches, routers, etc.), including network packet header information, transport layer information, and application layer data. In addition, the present invention adopts multiple methods such as API interface and database connection to obtain data from third-party platforms including firewall platforms, security network gate platforms, and situation awareness platforms. For example, for the firewall platform, the firewall log and alarm information are obtained in real time through the API interface; for the security network gate platform, the transmission records and isolation strategies of the network gate are obtained through the database connection; for the situation awareness platform, data is obtained by subscribing to the real-time security events it publishes.

[0062] 1-2: Data preprocessing. The acquired data is preprocessed, including data parsing, data cleaning and vectorization. Data parsing is the processing of traffic data. Through key character matching, various field information of network packets, such as source IP address, destination IP address, protocol type, port number, etc., is extracted. Data cleaning removes redundancy, errors and invalid information in the data to improve the efficiency and accuracy of subsequent data processing. Data vectorization converts data into vector form through the Word2vec network so that subsequent data algorithms can process more effectively.

[0063] Furthermore, step 2 specifically includes:

[0064] 2-1: Multi-source data fusion and splicing. First, align and sort the multi-source data according to the timestamp. Then, use a method similar to splicing multiple narrow tables with timestamps into a multi-dimensional wide table to fuse and splice the multi-source data. During the splicing process, the system also considers the relevance and consistency of the data, and performs format conversion and unified encoding of the multi-source data to ensure the integrity and accuracy of the spliced ​​data.

[0065] 2-2: Divide the spliced ​​multi-source data by sliding the time window. First, determine the size of a time window, then create the first window at the beginning of the time series and fill it with data; then, the window slides forward on the time axis according to the set step size, and each slide updates the data content in the window until the entire time series is covered; in this way, the original multi-source data is divided into multiple continuous and partially overlapping time windows, each of which contains data within the corresponding time period.

[0066] 2-3: Multi-source data mining based on multi-scale CNN neural network. The present invention builds a neural network based on CNN to mine abnormal events for the data divided in step 2-2. The types of abnormalities include high-frequency scanning, malicious attacks, unregistered service discovery, abnormal ledger type access, poisoned terminal identification, etc. Among them, the present invention improves the CNN network in two aspects. On the one hand, it introduces a multi-scale network structure, and on the other hand, it improves the loss function.

[0067] The overall architecture of the neural network and the loss function calculation of the present invention are described in detail below:

[0068] (1) Multi-scale CNN neural network

[0069] Considering that the traditional CNN network is based on a single-scale feature map for detection, but in actual applications, the feature size of the target object has a large variation range and the semantic information in different CNN layers is different, it is difficult for a single-scale CNN to perform effective feature extraction. Therefore, the present invention proposes a CNN neural network that uses multi-scale feature fusion. The network structure is as follows Figure 2 As shown in the figure, the model input (multi-source data divided in step 2-2) first passes through convolution layers with convolution kernels of (1×1, 3×3, 5×5), concatenates the results of different convolution layers, and then passes through two fully connected layers to obtain the output (anomaly type). The design of a multi-scale CNN network aims to solve the problems of single-scale CNN in terms of scale sensitivity and limited feature extraction capabilities.

[0070] (2) Loss function considering sample imbalance

[0071] Considering the imbalance in the number of training samples of different anomaly types, if the traditional cross loss function is used, it is easy for the model to be biased towards vulnerability types with more samples and cannot effectively learn vulnerability types with fewer samples. Therefore, the present invention uses Focal Loss as the loss function, as shown in formula (1).

[0072] F(p t )=-α t (1-p t ) Y log(p t ) (1)

[0073] Among them, p t is the probability that the model predicts that the sample belongs to the true label category, α t is the weight of category t, which is used to balance samples of different categories. γ is the focusing parameter, which is used to adjust the contribution of easy-to-classify samples and difficult-to-classify samples to the loss. When γ = 0, Focal loss degenerates into a cross-entropy loss function. The characteristic of Focal loss is that it can automatically reduce the weight of easy-to-classify samples during training, so that the model pays more attention to difficult-to-classify samples, thereby improving the classification performance of the model.

[0074] Furthermore, step 3 specifically includes:

[0075] Considering that the types of network anomalies currently recorded are limited, it is impossible to effectively identify anomalies beyond the scope through step 2. Therefore, the present invention uses an unsupervised clustering algorithm to conduct secondary research on the multi-source data monitored by the multi-source network security platform, and divides a large number of data points into several event clusters. The data points in each event cluster have high similarity, while the data points between different event clusters have great differences.

[0076] Since the traditional K-meansns clustering method uses random initialization to select cluster centers, the algorithm converges slowly and has poor stability. Therefore, the present invention uses the K-means++ algorithm for clustering, which specifically includes the following steps:

[0077] (1) Randomly select the first centroid from the dataset;

[0078] (2) Assume there are m data points, for each data point x j , calculate its shortest distance D(x) to the selected centroid O. For an n-dimensional data vector x j (a1,a2,a3,...,a n ) and O(b1,b2,b3,...,b n ), the distance between vectors A and B is calculated as D(x), as shown in formula (2):

[0079]

[0080] (3) Select a new data point as the next centroid, and the probability of selection is proportional to D(x), as shown in formula (3):

[0081]

[0082] (4) Repeat steps (2) and (3) until K centroids are selected.

[0083] During the clustering process, the algorithm will continuously iterate and optimize, and assign the data points to the cluster represented by the nearest centroid based on the distance between each data point and the centroid, that is, vulnerabilities with similar characteristics are classified into the same category.

[0084] By analyzing the clustering results, we can identify those event clusters that do not belong to any known categories. These event clusters represent possibly unknown network abnormal events. Next, we conduct an in-depth analysis of each abnormal event cluster to extract its key features, such as attack intensity, duration, target importance, etc. These features will serve as an important basis for assessing the risk level.

[0085] Based on these characteristics, combined with professional knowledge and experience in the field of network security, risk assessment standards are formulated. Finally, the risk level of each abnormal event cluster is judged according to the risk assessment standards. Abnormal event clusters with high risk levels have stronger aggressiveness, wider impact range or attack intentions against high-value targets, such as attack frequency 200% higher than the average level or being able to bypass more than 80% of conventional security protection measures; wider impact range, the number of affected network nodes exceeds 100 or the impact range spans at least three different regions or departments.

[0086] Low-risk abnormal event clusters appear as common or known network activities with less harm, such as attack frequencies that are no different from regular network traffic, impacts that are limited to a single network node or local area, and usually involve low-sensitivity information or resources.

[0087] Through this process, secondary analysis and risk level identification of events monitored by multi-source network security platforms can be achieved, providing strong support for network security protection.

[0088] In step 4, the detected high-risk risks are defended and automatically blocked by automatically linking the firewall. Whitelist configuration is supported to protect some important services from being automatically blocked by the firewall.

[0089] Among them, firewall management includes: establishing firewall communication through configuration, maintaining the power ledger of the firewall after handshake, and realizing automatic triggering of the blocking function of the firewall after configuration; configuring the firewall blocking action whitelist through the firewall whitelist setting function to protect the core application services from being misjudged;

[0090] Active isolation records include: recording and displaying IP addresses that are identified as high-risk and isolated, and supporting one-click release of automatically isolated IP addresses.

[0091] Compared with the traditional method (i.e. manually monitoring multiple sets of network security risk warnings, manually analyzing and determining which IPs need to be blocked, and manually clicking on the firewall for isolation), it is convenient and reliable.

[0092] An active defense system for power network security based on data mining includes a detection module responsible for collecting multi-source network security data, including flow data and third-party network security platform data; a training module uses the neural network built in step 2 to train the multi-source data; a verification module identifies anomalies through the neural network, and performs secondary judgment and risk level identification on events monitored by the multi-source network security platform through a clustering algorithm; a storage module is responsible for storing secondary judged network anomalies and supplementing them as samples of the training module; a decision module defends against detected high-risk risks, automatically blocks high-risk risks by automatically linking to a firewall, and supports whitelist configuration to protect some important services from being automatically blocked by the firewall.

[0093] In the application of the present invention, on the one hand, the method integrates network traffic data and third-party platform data, mines abnormal events through neural networks, and adopts clustering algorithms for secondary analysis, thereby increasing the recognition accuracy and the detection range; on the other hand, the method links high-risk IPs with firewalls for intelligent and active isolation, and automatically generates blocking event reports in accordance with power grid management specifications, saving labor costs.

[0094] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0095] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0096] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0097] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0098] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. An active defense method for power network security based on data mining, characterized in that: The following steps are involved: Step 1: Multi-source data acquisition and preprocessing; Step 2: Use data mining technology to integrate and mine multi-source data; Step 3: Use clustering algorithms to conduct secondary analysis and risk level identification on the events monitored by the multi-source network security platform; Step 4: Actively isolate high-risk events through the firewall and generate an event analysis report.

2. The active defense method for power network security based on data mining according to claim 1 is characterized in that: Step 1 includes: 1-1: Obtain multi-source data on power grid security; data sources include flow data and third-party network security platform data; flow data acquisition is based on the Kafka distributed message processing platform, which captures flow data in real time from various network devices in the power grid, including network packet header information, transport layer information, and application layer data; The third-party network security platform data includes the firewall logs and alarm information of the firewall platform and the transmission records and isolation strategies of the security network gate platform; 1-2: Data preprocessing: preprocess the acquired data, including data analysis, data cleaning and vectorization; Among them, data parsing is the processing of traffic data, extracting each field information of the network packet through key character matching; Data cleaning removes redundancy, errors, and invalid information from data; Data vectorization converts data into vector form through the Word2vec network.

3. The active defense method for power network security based on data mining according to claim 1 is characterized in that: Step 2 includes: 2-1: Multi-source data fusion and splicing: First, align and sort the multi-source data according to the timestamp; then, use the method of splicing multiple timestamp narrow tables into a multi-dimensional wide table to fuse and splice the multi-source data; 2-2: Divide the spliced ​​multi-source data by sliding the time window; first determine the size of a time window, then create the first window at the beginning of the time series and fill it with data; then, the window slides forward on the time axis according to the set step size, and each slide updates the data content in the window until the entire time series is covered; 2-3: Multi-source data mining based on multi-scale CNN neural network; build a CNN-based neural network to mine abnormal events on the data divided in step 2-2. The types of abnormalities include high-frequency scanning, malicious attacks, discovery of unregistered services, abnormal ledger type access, and identification of poisoned terminals.

4. The active defense method for power network security based on data mining according to claim 3 is characterized in that: In step 2-3, the network structure of the multi-scale CNN neural network is as follows: the multi-source data divided in step 2-2 is used as the model input and first passes through the convolution layers with convolution kernels of 1×1, 3×3, and 5×5 respectively, the results of different convolution layers are spliced, and then the output of the abnormal type is obtained through two layers of fully connected layers.

5. The active defense method for power network security based on data mining according to claim 4 is characterized in that: Considering the imbalance in the number of training samples of different anomaly types, Focal Loss is used as the loss function, as shown in formula (1): F(p t )=-α t (1-p t ) γ log(p t ) (1) Among them, p t is the probability that the model predicts that the sample belongs to the true label category, α t is the weight of class t, which is used to balance samples of different classes, and γ is the focusing parameter.

6. The active defense method for power network security based on data mining according to claim 4 is characterized in that: Step 3 includes: using an unsupervised clustering algorithm to conduct secondary analysis on the multi-source data monitored by the multi-source network security platform, specifically including the following steps: (1) Randomly select the first centroid from the dataset; (2) Assume there are m data points, for each data point x j , calculate the shortest distance D(x) to the selected centroid O; for the n-dimensional data vector x j (a1,a2,a3,...,a n ) and O(b1,b2,b3,...,b n ), the distance between vectors A and B is calculated as D(x), as shown in formula (2): (3) Select a new data point as the next centroid, and the probability of selection is proportional to D(x), as shown in formula (3): (4) Repeat steps (2) and (3) until K centroids are selected; In the clustering process, the optimization is continuously iterated. According to the distance between each data point and the centroid, the data point is assigned to the cluster represented by the nearest centroid, that is, vulnerabilities with similar characteristics are classified into the same category. By analyzing the clustering results, we can identify those event clusters that do not belong to any known categories. These event clusters represent possibly unknown network abnormal events. Conduct in-depth analysis of each abnormal event cluster and extract key features, including attack intensity, duration, and target importance, as an important basis for assessing risk levels; Develop risk assessment standards by combining expertise and experience in the field of cybersecurity; According to the risk assessment criteria, the risk level of each abnormal event cluster is determined; among them, the abnormal event cluster with a high risk level is characterized by an attack frequency that is 200% higher than the average level, the number of affected network nodes exceeds 100, or the impact range spans at least three different regions or departments; A low-risk abnormal event cluster is characterized by an attack frequency that is the same as regular network traffic, an impact range that is limited to a single network node or local area, and involves low-sensitivity information or resources.

7. The active defense method for power network security based on data mining according to claim 4 is characterized in that: In step 4, the detected high-risk risks are defended and automatically blocked by automatically linking the firewall. Whitelist configuration is supported to protect some important services from being automatically blocked by the firewall. Among them, firewall management includes: establishing firewall communication through configuration, maintaining the power ledger of the firewall after handshake, and realizing automatic triggering of the blocking function of the firewall after configuration; configuring the firewall blocking action whitelist through the firewall whitelist setting function to protect the core application services from being misjudged; Active isolation records include: recording and displaying IP addresses that are identified as high-risk and isolated, and supporting one-click release of automatically isolated IP addresses.

8. An active defense system for power network security based on data mining, characterized in that: The method for implementing the active defense method for power network security based on data mining as described in any one of claims 1 to 7 comprises: The detection module is responsible for multi-source data acquisition and preprocessing; The training module is used to conduct fusion mining of multi-source data through data mining technology; The inspection module is used to identify anomalies through neural networks and conduct secondary analysis and risk level identification of events monitored by the multi-source network security platform through clustering algorithms; The decision-making module is used to proactively isolate high-risk events through the firewall and generate event analysis reports.

9. The active defense system for power network security based on data mining according to claim 8 is characterized in that: Also includes: The storage module is responsible for storing the network anomalies for secondary analysis and serves as a supplement to the samples of the training module.

Images