New energy power industry network security anomaly intrusion detection system
By introducing a dual judgment mechanism of the administrator client and control center module in the network security abnormal intrusion detection system of the new energy power industry, the problem of difficulty in identifying emerging network attacks in traditional systems is solved, and more efficient network security monitoring and processing is achieved.
Patent Information
- Application Number
- CN202411554078.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-04
- Publication Date
- 2025-02-11
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional intrusion detection methods are difficult to identify and handle emerging cyber attacks, and cannot process problematic communication data in a timely manner, making it difficult to defend against cybersecurity threats.
A new energy power industry network security abnormal intrusion detection system was designed, and the Ethernet communication data was initially judged through the administrator client, and the control center module made a secondary judgment, and the staff were notified to make the final judgment, discarding suspicious in real time. Data packets, blocking data flow.
It improves the security of the system, can handle emerging network attacks in a timely manner, reduces false alarm rates, and ensures the stability of normal business communications.
Smart Images
Figure CN119420545A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security, and in particular to a network security anomaly intrusion detection system for the new energy power industry. Background Art
[0002] The network security anomaly intrusion detection system in the new energy power industry refers to a security solution specially designed to monitor and analyze network activities in the new energy power system. The purpose of these systems is to identify and defend against potential cyber attacks and protect the stability and data security of the power system. With the rapid development of new energy technologies and the digitalization of power systems, network security has become particularly important because cyber attacks may lead to power outages, data leaks or other security incidents.
[0003] Traditional intrusion detection methods rely on known abnormal behavior patterns and perform detection based on the characteristics of monitored events. If the attacker's behavior is known to the detection system, this method has a high detection rate and a low false alarm rate; however, with the diversification of attack types, many new attack behaviors cannot be detected by this system, and problematic communication data cannot be processed in a timely manner. Summary of the invention
[0004] In order to solve the above technical problems, the present invention proposes a new energy power industry network security anomaly intrusion detection system. The administrator client makes a preliminary judgment on the communication data in the Ethernet, and then makes a secondary judgment on the communication data through the control center module, and notifies the staff at the same time, so that the staff can judge the results in the communication data. All suspicious data packets can be discarded in real time, blocking subsequent communications of the data stream, thereby improving the security of the system.
[0005] The technical solution to achieve the purpose of the present invention is: a network security anomaly intrusion detection system for the new energy power industry, including a network security anomaly intrusion detection system, the network security anomaly intrusion detection system including Ethernet, an administrator client, a user terminal, a data training module and a control center module;
[0006] The administrator client includes a response module, an intrusion detection module, a data preprocessing module and a data capture module;
[0007] The user end includes a power supply, a processor module, a display module, a storage module, an input module, and a network connection module;
[0008] The data training module includes a data planning processing module 1, a data analysis module and a storage module;
[0009] The control center module comprises a second power supply module, a second processor module, an output module, a database system and a judgment module.
[0010] Preferably, the Ethernet is connected to the administrator client, the administrator client is connected to the user terminal, the control center module and the data training module, the user terminal and the data training module are connected to each other, and the control center module and the data training module are connected to each other.
[0011] Preferably, the power supply 1 in the user end supplies power to the processor module 1, the display module, the storage module, the input module and the network connection module.
[0012] Preferably, the network connection module is connected to the administrator client, and Ethernet transmits the network communication data to the administrator client, so that the response module triggers the attack judgment mechanism of the intrusion detection module in the administrator client. If the judgment result is normal, the communication data is returned to the user end. The network connection module in the user end receives the communication data, sends the communication data to the processor module 1, outputs it to the outside through the display module, and stores it in the storage module at the same time. The user can process the received communication data through the input module.
[0013] Preferably, the power supply 2 supplies power to the processor module 2, the output module, the database system and the judgment module. When the result of the intrusion detection module's judgment is a new rule, the communication data is sent to the data preprocessing module, and the data preprocessing module decodes and analyzes the data. Finally, the communication data is packaged and returned to the control center module through the data capture module. The communication data is sent to the judgment module through the processor module 2 in the control center module, and the communication data after decoding and analysis is judged by the judgment module, and the judgment result is returned to the processor module 2, outputted to the outside through the output module, and an alarm is issued through the output module, and stored in the database system at the same time. At this time, the staff searches the communication data through the database system, decides whether there is a real intrusion with the participation of the staff, and stores the new rule. If it is judged that an intrusion occurs, it is handled by disconnecting the connection, closing the port, etc.
[0014] Preferably, the data planning processing module in the data training module reads the data in the database system in the control center module and the part about the communication data in the storage module in the user end, and then sends it to the data analysis module. The data analysis module identifies the user's behavior and matches it with the pattern characteristics of the user's normal behavior, so as to monitor certain activities with specific behavioral characteristics. If it is an unknown intrusion method, the data analysis module can make adaptive adjustments while collecting evidence and restoring data records.
[0015] Preferably, the data training module works in the detection phase of the system, and logically includes a network data packet capture thread and a host system call sequence capture thread. The network data packet capture thread uses network data as a data source to achieve real-time capture of network data packets flowing through the Ethernet, and performs corresponding initial processing operations based on the type of intercepted data packets, completes base conversion and initial storage, and processes enough data.
[0016] Preferably, the appropriate calling of the control center module can intercept the data packets transmitted in the network for analysis, and can also selectively obtain the required network data segments through program control.
[0017] Preferably, the storage system in the data training module records the events detected by the system for later analysis, and through the SQL query supported by the database system, its encapsulation of the search enables the analysis system to use a common interface.
[0018] Compared with the prior art, the present invention has the following significant advantages:
[0019] First, in the present invention, the administrator client makes a preliminary judgment on the communication data in the Ethernet, and then makes a secondary judgment on the communication data through the control center module, and notifies the staff at the same time, so that the staff can judge the results in the communication data, and can discard all suspicious data packets in real time, blocking the subsequent communication of the data stream, thereby improving the security of the system; and solves the problem that the existing system cannot process the communication data in a timely manner.
[0020] Second, the present invention processes the communication data through the data training module, and at the same time, it performs and updates the data in the communication data. When there is new problematic communication data in Ethernet, with the cooperation of the data training module and the control center module, the communication data sent by Ethernet can be processed in time, thereby improving the judgment efficiency of the communication data and improving the overall performance of the system.
[0021] Thirdly, in the present invention, the quality of the intrusion feature set must be guaranteed, because false alarms will lead to denial of service, and users must be able to believe that only suspicious communications will be blocked and normal business communications will not be affected. Through the processing of problematic communication data in the control center module by staff, one operation can make all communication data with the same rules effective, and there is no need to restart, thus achieving the effect of high-accuracy intrusion detection capability.
[0022] Fourthly, the present invention allows staff to judge the results of the control center module and uses the communication data with the same rules as a standard to compare the communication data according to the rules. The same rules in the communication data can be directly selected to be released or to issue an alarm, thereby improving the processing efficiency of the communication data.
[0023] Fifth: The present invention has advanced alarm processing and forensic analysis capabilities. Once a detector based on a certain method generates an alarm and sends it to the audit center, the audit center can provide real-time and historical alarm views and reports, check whether there is a correlation, investigate and ultimately decide what actions to take, thereby further improving the processing efficiency of communication data. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] The present invention will be further explained below in conjunction with the accompanying drawings and embodiments:
[0025] Figure 1 It is a schematic diagram of the network anomaly intrusion detection system module of the present invention;
[0026] Figure 2 It is a schematic diagram of the internal structure of the administrator client and the data training module of the present invention;
[0027] Figure 3 It is a schematic diagram of the internal structure of the user terminal of the present invention;
[0028] Figure 4 It is a schematic diagram of the internal structure of the control center module of the present invention. DETAILED DESCRIPTION
[0029] The present invention is described in detail below, and the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0030] The present invention provides a new energy power industry network security abnormal intrusion detection system through improvement. The technical solution of the present invention is:
[0031] like Figure 1-Figure 4 As shown, a new energy power industry network security anomaly intrusion detection system includes a network security anomaly intrusion detection system, and the network security anomaly intrusion detection system includes Ethernet, an administrator client, a user terminal, a data training module and a control center module;
[0032] The administrator client includes a response module, an intrusion detection module, a data preprocessing module and a data capture module;
[0033] The user end includes a power supply, a processor module, a display module, a storage module, an input module, and a network connection module;
[0034] The data training module includes a data planning processing module 1, a data analysis module and a storage module;
[0035] The control center module comprises a second power supply module, a second processor module, an output module, a database system and a judgment module.
[0036] The Ethernet is connected to the administrator client, the administrator client is connected to the user terminal and the control center module data training module, the user terminal and the data training module are connected to each other, and the control center module and the data training module are connected to each other.
[0037] The power supply 1 in the user end supplies power to the processor module 1, the display module, the storage module, the input module and the network connection module. The network connection module is connected to the administrator client. The Ethernet transmits the network communication data to the administrator client, so that the response module triggers the attack judgment mechanism of the intrusion detection module in the administrator client. If the judgment result is normal, the communication data is returned to the user end. The network connection module in the user end receives the communication data, sends the communication data to the processor module 1, outputs it to the outside through the display module, and stores it in the storage module at the same time. The user can process the received communication data through the input module;
[0038] The power supply 2 supplies power to the processor module 2, the output module, the database system and the judgment module. When the result of the intrusion detection module is a new rule, the communication data is sent to the data preprocessing module. The data preprocessing module decodes and analyzes the data. Finally, the communication data is packaged and returned to the control center module through the data capture module. The communication data is sent to the judgment module through the processor module 2 in the control center module. The communication data after decoding and analysis is judged by the judgment module, and the judgment result is returned to the processor module 2, outputted to the outside through the output module, and an alarm is issued through the output module. At the same time, it is stored in the database system. At this time, the staff searches the communication data through the database system, decides whether there is a real intrusion with the participation of the staff, and stores the new rule. If it is judged that an intrusion occurs, it is handled by disconnecting the connection, closing the port, etc.
[0039] The data plan processing module in the data training module will read the data in the database system in the control center module and the part about the communication data in the storage module in the user end, and then send it to the data analysis module. The user's behavior is identified by the data analysis module and matched with the pattern characteristics of the user's normal behavior, so as to monitor certain activities with specific behavior characteristics. If it is an unknown intrusion method, the data analysis module can collect evidence and recover data records while making adaptive adjustments. The control logic of this system is generated by the control center module. In order to improve the execution efficiency of the system and for future upgrades and maintenance, the function logic used in the system work is separated, and the control center module makes overall allocation and scheduling, and adds, removes, starts, shuts down, configures and authenticates the network detection unit and the host detection unit. Receive alarm information from the detection unit in real time, record it in the alarm log table, and display it on the screen to prompt the user. Query the alarm log, ordinary log and system operation log of any period, and support statistical analysis and correlation analysis. Define users of different levels, assign different permissions, and execute management of the system. Support user-defined network activity rules and send them to the network detection unit for execution.
[0040] The data training module works in the detection phase of the system, and logically includes a network data packet capture thread and a host system call sequence capture thread. The network data packet capture thread uses network data as a data source to achieve real-time capture of network data packets flowing through the Ethernet, and performs corresponding initial processing operations according to the type of intercepted data packets, completes the conversion of bases and initial storage work, processes enough data, and can intercept data packets transmitted in the network for analysis through appropriate calls to the control center module, and can also selectively obtain the required network data segments through program control. It supports filtering for network layers, protocols, hosts, networks or ports. This system is designed to pass the contents of the intercepted data packets to the data analysis module for processing, extract the attributes of interest, and remove redundant attributes. This system call sequence capture thread uses system calls as a data source, and temporarily stores the collected system call sequences of the process into a database, waiting for the data training module to read.
[0041] The storage system in the data training module records the events detected by the system for later analysis. At the same time, through the SQL query supported by the database system, its encapsulation of the search enables the analysis system to use a common interface. Depending on the scale of the intrusion detection system, the storage system also varies greatly. It may be a single data file storage system or a database system. For large-scale intrusion detection systems, it is also possible to configure a data warehouse as its storage system.
[0042] The specific working method is: Ethernet transmits network communication data to the administrator client, so that the response module triggers the attack judgment mechanism of the intrusion detection module in the administrator client. If the judgment result is normal, the communication data is returned to the user end. The network connection module in the user end receives the communication data, and sends the communication data to the processor module one, outputs it to the outside through the display module, and stores it in the storage module at the same time. The user can process the received communication data through the input module. When the result of the intrusion detection module's judgment is a new rule, the communication data is sent to the data preprocessing module, and the data is decoded and analyzed through the data preprocessing module. Finally, the communication data is packaged and returned to the control center module through the data capture module, and the communication data is sent to the judgment module through the processor module two in the control center module. The communication data after decoding and analysis is judged by the judgment module. The judgment result is returned to the processor module 2, outputted to the outside through the output module, an alarm is issued through the output module, and stored in the database system at the same time. At this time, the staff searches the communication data through the database system, and decides whether there is a real intrusion with the participation of the staff, and enters the new rules into the database. If an intrusion is judged to have occurred, it is handled by disconnecting the connection, closing the port, etc. The data plan processing module in the data training module reads the data in the database system in the control center module and the part about the communication data in the storage module in the user end, and then sends it to the data analysis module. The user's behavior is identified by the data analysis module and matched with the pattern characteristics of the user's normal behavior, so as to monitor certain activities with specific behavioral characteristics. If it is an unknown intrusion method, the data analysis module can make adaptive adjustments while collecting evidence and restoring data records.
[0043] The technical means disclosed in the solution of the present invention are not limited to the technical means disclosed in the above technical means, but also include technical solutions composed of equivalent replacement of the above technical features. Matters not covered in the present invention belong to the common knowledge of those skilled in the art.
Claims
1. A network security anomaly intrusion detection system for the new energy power industry, including a network security anomaly intrusion detection system, characterized in that: The network security anomaly intrusion detection system includes Ethernet, an administrator client, a user terminal, a data training module and a control center module; The administrator client includes a response module, an intrusion detection module, a data preprocessing module and a data capture module; The user end includes a power supply, a processor module, a display module, a storage module, an input module, and a network connection module; The data training module includes a data planning processing module 1, a data analysis module and a storage module; The control center module comprises a second power supply module, a second processor module, an output module, a database system and a judgment module.
2. According to claim 1, a new energy power industry network security abnormal intrusion detection system is characterized by: The Ethernet is connected to the administrator client, the administrator client is connected to the user terminal and the control center module data training module, the user terminal and the data training module are connected to each other, and the control center module and the data training module are connected to each other.
3. According to claim 1, a new energy power industry network security abnormal intrusion detection system is characterized by: The power supply 1 in the user end supplies power to the processor module 1, the display module, the storage module, the input module and the network connection module.
4. According to claim 3, a new energy power industry network security abnormal intrusion detection system is characterized by: The network connection module is connected to the administrator client, and Ethernet transmits the network communication data to the administrator client, so that the response module triggers the attack judgment mechanism of the intrusion detection module in the administrator client. If the judgment result is normal, the communication data is returned to the user end. The network connection module in the user end receives the communication data, sends the communication data to the processor module 1, outputs it to the outside through the display module, and stores it in the storage module at the same time. The user can process the received communication data through the input module.
5. According to claim 4, a new energy power industry network security abnormal intrusion detection system is characterized by: The power supply 2 supplies power to the processor module 2, the output module, the database system and the judgment module. When the result of the intrusion detection module's judgment is a new rule, the communication data is sent to the data preprocessing module. The data preprocessing module decodes and analyzes the data. Finally, the communication data is packaged and returned to the control center module through the data capture module. The communication data is sent to the judgment module through the processor module 2 in the control center module. The communication data after decoding and analysis is judged by the judgment module, and the judgment result is returned to the processor module 2, outputted to the outside through the output module, and an alarm is issued through the output module, and stored in the database system at the same time. At this time, the staff searches the communication data through the database system, decides whether there is a real intrusion with the participation of the staff, and stores the new rule. If it is judged that an intrusion occurs, it is handled by disconnecting the connection, closing the port, etc.
6. A new energy power industry network security anomaly intrusion detection system according to claim 5, characterized in that: The data planning processing module in the data training module will read the data in the database system in the control center module and the part about the communication data in the storage module in the user end, and then send it to the data analysis module. The data analysis module will identify the user's behavior and match it with the pattern characteristics of the user's normal behavior, so as to monitor certain activities with specific behavioral characteristics. If it is an unknown intrusion method, the data analysis module can make adaptive adjustments while collecting evidence and restoring data records.
7. A new energy power industry network security anomaly intrusion detection system according to claim 6, characterized in that: The data training module works in the detection phase of the system, and logically includes a network data packet capture thread and a host system call sequence capture thread. The network data packet capture thread uses network data as a data source to achieve real-time capture of network data packets flowing through the Ethernet, and performs corresponding initial processing operations based on the type of intercepted data packets, completes base conversion and initial storage, and processes enough data.
8. A new energy power industry network security anomaly intrusion detection system according to claim 7, characterized in that: The appropriate calling of the control center module can intercept the data packets transmitted in the network for analysis, and can also selectively obtain the required network data segments through program control.
9. A new energy power industry network security anomaly intrusion detection system according to claim 8, characterized in that: The storage system in the data training module records the events detected by the system for later analysis. At the same time, through the SQL query supported by the database system, its encapsulation of the search enables the analysis system to use a common interface.