Photovoltaic area network equipment safety monitoring method, device, equipment and medium

Abstract

The invention provides a photovoltaic area network equipment safety monitoring method and device, equipment and a medium, and belongs to the technical field of computer network security, and the photovoltaic area network equipment safety monitoring method comprises the steps: obtaining user login information of network equipment deployed in a photovoltaic area and real-time behavior data during user login; acquiring historical behavior data of the user based on the user login information; and based on the real-time behavior data and / or the historical behavior data, determining the security state of the network equipment in the photovoltaic area. According to the invention, the security of the network equipment does not need to be detected and monitored manually, and low-cost network security monitoring can be realized.

Description

Technical Field

[0001] The present invention relates to the field of computer network security technology, and in particular to a photovoltaic area network equipment security monitoring method, device, equipment and medium. Background Art

[0002] Clean energy is an important development direction of future energy. As a high-quality clean energy, solar energy has always been an important project target in the development of clean energy.

[0003] In the solar photovoltaic power generation grid, in order to facilitate the management of the photovoltaic area and the power grid, network equipment will be deployed in the photovoltaic area to facilitate management personnel to log in to the network equipment to count and view the operation status of the photovoltaic area. The photovoltaic area is generally set up in an open unmanned area, and more attention needs to be paid to the network security of the photovoltaic area. In addition, since most photovoltaic areas are located in remote areas, if technical personnel are dispatched to maintain the network security of the photovoltaic area, it will consume a lot of manpower and financial resources, and increase operating costs.

[0004] This shows that existing technologies cannot guarantee the network security of photovoltaic areas at a low cost. Summary of the invention

[0005] The purpose of the present invention is to provide a method, device, equipment and medium for security monitoring of photovoltaic area network equipment, which is used to solve the problem that the existing technology cannot ensure the network security of the photovoltaic area at a low cost. There is no need for manual detection and monitoring of the security of network equipment, and low-cost network security monitoring can be achieved.

[0006] In order to achieve the above objectives, in a first aspect, the present invention provides a photovoltaic area network equipment safety monitoring method, comprising: Obtain user login information of network devices deployed in the photovoltaic area and real-time behavior data during user login; Obtain the user's historical behavior data based on the user's login information; Based on the real-time behavior data and / or the historical behavior data, a security status of network devices in the photovoltaic zone is determined.

[0007] According to a photovoltaic area network equipment security monitoring method provided by the present invention, the real-time behavior data includes real-time traffic; obtaining the real-time behavior data during the user login period includes: Obtain the real-time inflow value, real-time outflow value and data packet size of the network device according to the preset frequency; Calculate the traffic security calculation value based on the real-time traffic inflow value, the real-time traffic outflow value and the data packet size; Based on real-time behavior data and / or historical behavior data, determine the security status of network devices in the photovoltaic area, including: When the traffic security calculation value is greater than the preset traffic security threshold, it is determined that there is a security risk in the network device.

[0008] According to a photovoltaic area network equipment security monitoring method provided by the present invention, the historical behavior data includes a historical flow inflow threshold, a historical flow outflow threshold and a historical data packet size threshold; the flow security calculation value is calculated based on the real-time flow inflow value, the real-time flow outflow value and the data packet size, including: Determining the traffic inflow abnormality frequency based on the number of abnormal traffic inflow values ​​in the real-time traffic inflow values, wherein the real-time traffic inflow value greater than the historical traffic inflow threshold value is the abnormal traffic inflow value; Determine the abnormal frequency of traffic outflow based on the number of abnormal traffic outflow values ​​in the real-time traffic outflow values, wherein the real-time traffic outflow value greater than the historical traffic outflow threshold is the abnormal traffic outflow value; Determining the frequency of abnormal data packets based on the number of abnormal data packets in the data packet size, wherein data packets larger than a historical data packet size threshold are abnormal data packets; The traffic safety calculation value is calculated based on the abnormal frequency of traffic inflow, abnormal frequency of traffic outflow, and abnormal frequency of data packets.

[0009] According to a photovoltaic area network equipment safety monitoring method provided by the present invention, a traffic safety calculation value is calculated based on the traffic inflow abnormal frequency, the traffic outflow abnormal frequency and the data packet abnormal frequency, including: The flow safety calculation value is calculated using formula (1):

[0010] in, Calculate the value for traffic safety, The abnormal frequency of traffic inflow, is the abnormal frequency of traffic outflow, is the abnormal frequency of data packets, , , is the preset weight coefficient.

[0011] According to a photovoltaic area network equipment security monitoring method provided by the present invention, the real-time behavior data includes the real-time operation behavior data of the user, and the historical behavior data includes the historical operation behavior data of the user. Based on the real-time behavior data and / or the historical behavior data, the security status of the photovoltaic area network equipment is determined, including: Calculate the similarity between real-time operation behavior data and historical operation behavior data; When the similarity is less than a preset similarity threshold, it is determined that there is a security risk in the network device. According to a photovoltaic area network equipment security monitoring method provided by the present invention, the real-time behavior data includes website access data; obtaining the real-time behavior data during the user login period includes: Obtain the number of visits and duration of users to unknown websites and the number of visits and duration of users to risky websites within a unit of time; Determine the total visit duration of the unknown website based on the number of visits and visit duration of the unknown website; When the duration of a user's single visit to a risky website exceeds a preset visit duration threshold, the risky website is determined to be a high-risk website, and the ratio of the number of visits to the high-risk website by the user per unit time to the number of visits to the risky website by the user is calculated.

[0012] According to a photovoltaic area network equipment security monitoring method provided by the present invention, based on real-time behavior data and / or historical behavior data, the security status of the photovoltaic area network equipment is determined, including: Formula (2) is used to calculate the website access safety factor. Formula (2) is:

[0013] in, For website access security factor, m is the number of visits to unknown websites by users per unit time, n is the number of visits to risky websites by users in a unit of time, T is the total duration of visits to unknown websites. is the ratio of the number of visits to high-risk websites to the number of visits to risky websites. is the preset weight coefficient, and ; When the website access safety factor is less than the preset safety factor threshold, it is determined that there is a security risk in the network device.

[0014] In a second aspect, the present invention provides a photovoltaic area network equipment safety monitoring device, comprising: A real-time data acquisition module is used to acquire user login information of network devices deployed in the photovoltaic area and real-time behavior data during user login; A historical data acquisition module is used to acquire the user's historical behavior data based on the user's login information; The data comparison module is used to determine the security status of the network equipment in the photovoltaic area based on the real-time behavior data and / or the historical behavior data.

[0015] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the photovoltaic area network equipment safety monitoring method of the first aspect when executing the computer program.

[0016] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the photovoltaic area network equipment safety monitoring method of the first aspect.

[0017] The present invention provides a photovoltaic area network equipment security monitoring method, device, equipment and medium, which obtains user login information of the photovoltaic area network equipment, collects real-time behavior data during the user's login to the network equipment, and obtains historical behavior data of the user during the historical login period. Through the real-time behavior data and / or historical behavior data, it is determined whether there are security risks in the photovoltaic area network equipment, and there is no need for manual detection and monitoring of the security of the network equipment, which can achieve low-cost network security monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] In the attached picture: Figure 1 It is a flow chart of the photovoltaic area network equipment safety monitoring method of the present invention; Figure 2 It is a structural block diagram of the photovoltaic area network equipment safety monitoring device of the present invention; Figure 3 It is a schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Some embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0022] See also Figure 1 The embodiment of the present invention provides a photovoltaic area network equipment security monitoring method, comprising: S101, obtaining user login information of network devices deployed in the photovoltaic area and real-time behavior data during user login; S102, obtaining historical behavior data of the user based on the user login information; S103: Determine the security status of the network equipment in the photovoltaic area based on the real-time behavior data and / or the historical behavior data.

[0023] In the embodiment of the present invention, multiple network devices are deployed in the photovoltaic area, and the network devices may be gateway devices for user access control, firewall devices for preventing network attacks, and devices with functions such as preventing users from climbing over the wall and preventing users from sharing. Each network device requires the user to log in and authenticate before use to ensure that the user is the administrator of the photovoltaic area. When the network device in the photovoltaic area receives the user login information, it determines the user who logs in to the network device and obtains the real-time behavior data of the user on the network device, wherein the real-time behavior data may be the user's operation behavior data or the traffic transmission data of the network device.

[0024] In an embodiment of the present invention, after determining the user who has logged into the network device based on the user login information, the historical behavior data of the user on the network device or other network devices can be obtained. Similarly, the historical behavior data can be the user's historical operation behavior data, or the historical traffic transmission data of the network device or other network devices, etc.

[0025] Furthermore, based on the real-time behavior data and / or historical behavior data, the safety status of the network equipment in the photovoltaic area can be determined; optionally, the safety status of the network equipment can be judged only by the real-time behavior data, or the safety status of the network equipment can be judged by combining the real-time behavior data and the historical behavior data. The specific judgment method will be described in detail later in the present invention.

[0026] The photovoltaic area network equipment security monitoring method provided by the present invention obtains user login information of the network equipment in the photovoltaic area, collects real-time behavior data of the network equipment during the user login, and obtains historical behavior data of the user during the historical login period. Through the real-time behavior data and historical behavior data, it is judged whether there are security risks in the network equipment in the photovoltaic area, and there is no need for manual detection and monitoring of the security of the network equipment, thereby realizing low-cost network security monitoring.

[0027] As a possible implementation mode of the present invention, in this implementation mode, the real-time behavior data includes real-time traffic, and obtaining the real-time behavior data during the user login period includes: S201, obtaining the real-time inflow value, the real-time outflow value and the data packet size of the network device according to a preset frequency; S202, calculating a traffic security calculation value based on a real-time traffic inflow value, a real-time traffic outflow value, and a data packet size; Based on this, based on real-time behavior data and / or historical behavior data, the safety status of each network device in the photovoltaic area is determined, including: S203, when the flow safety calculation value is greater than the preset flow safety threshold, it is judged that the network device has a safety hazard.

[0028] In an embodiment of the present invention, the real-time behavior data includes the real-time traffic data of the network device. Specifically, the real-time traffic data includes the real-time traffic inflow value flowing into the network device, the real-time traffic outflow value flowing out of the network device, and the data packet traffic transmitted through the network device. Based on this, the real-time behavior data during the user login period can be obtained by collecting the real-time traffic inflow value, the real-time traffic outflow value, and the data packet size of the network device according to the preset sampling frequency. Further, the traffic security calculation value is calculated based on the collected real-time traffic inflow value, the real-time traffic outflow value, and the data packet size, and then the network device is determined to have network security risks according to the size of the traffic security calculation value.

[0029] Furthermore, the historical behavior data includes a historical traffic inflow threshold, a historical traffic outflow threshold, and a historical data packet size threshold. The traffic security calculation value is calculated based on the real-time traffic inflow value, the real-time traffic outflow value, and the data packet traffic size, including: S301, determining a traffic inflow abnormality frequency based on the number of abnormal traffic inflow values ​​in the real-time traffic inflow values, wherein the real-time traffic inflow value greater than the historical traffic inflow threshold value is an abnormal traffic inflow value; S302, determining the traffic outflow abnormality frequency based on the number of abnormal traffic outflow values ​​in the real-time traffic outflow values, wherein the real-time traffic outflow value greater than the historical traffic outflow threshold is the abnormal traffic outflow value; S303, determining a data packet abnormality frequency based on the number of abnormal data packets in the data packet flow size, wherein a data packet larger than a historical data packet size threshold is an abnormal data packet; S304, calculating a traffic safety calculation value based on the traffic inflow abnormal frequency, the traffic outflow abnormal frequency, and the data packet abnormal frequency.

[0030] In an embodiment of the present invention, for the network device logged in by the user or other network devices that the user has logged in in the past, historical traffic data of the user's use is stored. The historical traffic data includes a historical traffic inflow threshold, a historical traffic outflow threshold, and a historical data packet size threshold. After collecting the real-time traffic data of the network device, it is necessary to analyze the collected real-time traffic data to determine whether the real-time traffic data is abnormal traffic data.

[0031] Specifically, for the multiple real-time traffic inflow values ​​collected, the real-time traffic inflow value greater than the historical traffic inflow threshold is regarded as the abnormal traffic inflow value, and the ratio of the number of abnormal traffic inflow values ​​to the number of collected traffic inflow values ​​is determined to obtain the traffic inflow abnormality frequency; similarly, for the multiple real-time traffic outflow values ​​collected, the real-time traffic outflow value greater than the historical traffic outflow threshold is regarded as the abnormal traffic outflow value, and the ratio of the number of abnormal traffic outflow values ​​to the number of collected traffic outflow values ​​is determined to obtain the traffic outflow abnormality frequency; similarly, for the multiple data packet flows collected, the data packets greater than the historical data packet size threshold are regarded as abnormal data packets, and the ratio of the number of abnormal data packets to the data volume of the collected data packets is determined to obtain the data packet abnormality frequency.

[0032] Furthermore, after determining the abnormal frequency of traffic inflow, abnormal frequency of traffic outflow, and abnormal frequency of data packets, the traffic safety calculation value can be calculated using formula (1): (1) in, Calculate the value for traffic safety, The abnormal frequency of traffic inflow, is the abnormal frequency of traffic outflow, is the abnormal frequency of data packets, , , is the preset weight coefficient.

[0033] The embodiment of the present invention monitors the traffic of the network device and compares it with the historical driving data of the user, so as to accurately determine whether there is abnormal traffic in the network device and discover network security risks in time.

[0034] As a possible implementation mode of the present invention, in this implementation mode, the real-time behavior data includes the real-time operation behavior data of the logged-in user, and the historical behavior data includes the historical operation behavior data of the logged-in user. Based on the real-time behavior data and the historical behavior data, the security status of the network equipment in the photovoltaic area is determined, including: S401, calculating the similarity between the real-time operation behavior data and the historical operation behavior data; S402: When the similarity is less than a preset similarity threshold, it is determined that the network device logged in by the user has a security risk.

[0035] In an embodiment of the present invention, the real-time behavior data includes the real-time operation behavior data of the logged-in user, such as the way the user inputs identity information, the user's operation actions, etc., and the historical behavior data includes the historical operation behavior data of the logged-in user, such as the way the user inputs identity information during the historical login process, the user's historical operation habits on the network device, etc. Based on this, the similarity between the real-time operation behavior data and the historical operation behavior data is calculated. If the real-time operation behavior data is logged in by entering a user name and password, it means that the similarity between the real-time operation behavior data and the historical operation behavior data is high. If the real-time operation behavior data is logged in by entering a user name and password, and the historical operation behavior data is logged in by face recognition, it means that the similarity between the real-time operation behavior data and the historical operation behavior data is low, and the user may not be the administrator of the network device, and there is a network security risk. Of course, the calculation of the similarity between the real-time operation behavior data and the historical operation behavior data can be calculated based on data from multiple dimensions to obtain a more accurate similarity. Further, after calculating the similarity between the real-time operation behavior data and the historical operation behavior data, when the similarity is less than the preset similarity threshold, it is determined that the network device logged in by the user has a security risk.

[0036] The embodiment of the present invention compares the operation behavior data of the current user on the current network device with the historical operation behavior data of the user to determine whether the operation behavior of the current user is normal, thereby ensuring network security.

[0037] As a possible implementation mode of the present invention, in this implementation mode, the real-time behavior data includes website access data, and obtaining the real-time behavior data during the user login period includes: S501, obtaining the number of visits and the duration of visits to unknown websites by users and the number of visits and the duration of visits to risky websites by users within a unit time; S502, determining the total visit duration of the unknown website based on the number of visits and the visit duration of the unknown website; S503, when the single visit duration of a user to a risky website exceeds a preset visit duration threshold, the risky website is determined as a high-risk website, and the ratio of the number of visits to the high-risk website by the user to the number of visits to the risky website by the user in a unit time is calculated.

[0038] In an embodiment of the present invention, the network access behavior data of users can be collected by using a network monitoring tool, and the websites visited by users can be detected and analyzed. The number of times users visit unknown websites per unit time is collected, and the duration of each visit to unknown websites is collected. The duration of each visit to unknown websites is summed up to obtain the total duration of unknown website visits; the number of times users visit websites with security vulnerabilities (i.e., risky websites) per unit time is collected, and the duration of a single visit of users to websites with security vulnerabilities is collected. The ratio of the number of times users visit high-risk websites per unit time to the number of times users visit risky websites is calculated, and determined as the proportion of high-risk websites. Based on this, formula (2) can be used to calculate the website access safety factor: (2) in, For website access security factor, m is the number of visits to unknown websites by users per unit time, n is the number of visits to risky websites by users in a unit of time, T is the total duration of visits to unknown websites. is the ratio of the number of visits to high-risk websites to the number of visits to risky websites. is the preset weight coefficient, and .

[0039] Furthermore, when the website access safety factor is less than a preset safety factor threshold, it is determined that there is a security risk in the network device.

[0040] The embodiment of the present invention ensures the safety of photovoltaic area network equipment by counting websites visited by users through network equipment and determining whether there are security risks in the access according to the access data of unknown websites and dangerous websites.

[0041] In order to better implement the photovoltaic area network equipment safety monitoring method in the embodiment of the present invention, based on the photovoltaic area network equipment safety monitoring method, correspondingly, Figure 2 As shown, the embodiment of the present invention further provides a photovoltaic area network equipment safety monitoring device 600, comprising: The real-time data acquisition module 601 is used to acquire user login information of network devices deployed in the photovoltaic area and real-time behavior data during the user login period; A historical data acquisition module 602 is used to acquire the user's historical behavior data based on the user login information; The data comparison module 603 is used to determine the security status of each network device in the photovoltaic area based on the real-time behavior data and / or the historical behavior data.

[0042] The photovoltaic area network equipment safety monitoring device 600 provided in the above embodiment can implement the technical solution described in the above photovoltaic area network equipment safety monitoring method embodiment. The specific implementation principles of the above modules or units can refer to the corresponding contents in the above photovoltaic area network equipment safety monitoring method embodiment, which will not be repeated here.

[0043] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the photovoltaic area network equipment safety monitoring method of the aforementioned embodiment.

[0044] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, server, etc.) to perform all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0045] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the photovoltaic area network equipment safety monitoring method provided in the aforementioned embodiment.

[0046] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the computer program is executed by a processor to execute the photovoltaic area network equipment safety monitoring method provided in the above-mentioned embodiment.

[0047] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the technical solution of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0048] In summary, the present invention provides a photovoltaic area network equipment security monitoring method, device, equipment and medium, which obtains user login information of the network equipment in the photovoltaic area, collects real-time behavior data during the user's login to the network equipment, and obtains historical behavior data of the user during the historical login period. Through the real-time behavior data and / or historical behavior data, it is determined whether there are security risks in the network equipment in the photovoltaic area. There is no need for manual detection and monitoring of the security of the network equipment, and low-cost network security monitoring can be achieved.

[0049] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the embodiments disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A photovoltaic area network equipment safety monitoring method, characterized in that: include: Obtain user login information of network devices deployed in the photovoltaic area and real-time behavior data during user login; Acquire historical behavior data of the user based on the user login information; Based on the real-time behavior data and / or the historical behavior data, a security status of network devices in the photovoltaic zone is determined.

2. The photovoltaic area network equipment safety monitoring method according to claim 1 is characterized in that: The real-time behavior data includes real-time traffic; obtaining the real-time behavior data during the user login period includes: Acquire the real-time flow inflow value, real-time flow outflow value and data packet size of the network device according to a preset frequency; Calculate the traffic security calculation value based on the real-time traffic inflow value, the real-time traffic outflow value and the data packet size; The determining the security status of the network equipment in the photovoltaic area based on the real-time behavior data and / or the historical behavior data includes: When the traffic security calculation value is greater than a preset traffic security threshold, it is determined that there is a security risk in the network device.

3. The photovoltaic area network equipment safety monitoring method according to claim 2 is characterized in that: The historical behavior data includes a historical traffic inflow threshold, a historical traffic outflow threshold, and a historical data packet size threshold; the traffic safety calculation value calculated based on the real-time traffic inflow value, the real-time traffic outflow value, and the data packet size includes: Determining the traffic inflow abnormality frequency based on the number of abnormal traffic inflow values ​​in the real-time traffic inflow values, wherein the real-time traffic inflow value greater than the historical traffic inflow threshold value is the abnormal traffic inflow value; Determining the abnormal frequency of traffic outflow based on the number of abnormal traffic outflow values ​​in the real-time traffic outflow values, wherein the real-time traffic outflow value greater than the historical traffic outflow threshold is the abnormal traffic outflow value; determining a data packet abnormality frequency based on the number of abnormal data packets in the data packet size, wherein data packets larger than the historical data packet size threshold are abnormal data packets; A traffic safety calculation value is calculated based on the traffic inflow abnormal frequency, traffic outflow abnormal frequency and data packet abnormal frequency.

4. The photovoltaic area network equipment safety monitoring method according to claim 3 is characterized in that: The calculating of the traffic safety calculation value based on the traffic inflow abnormal frequency, the traffic outflow abnormal frequency and the data packet abnormal frequency includes: The flow safety calculation value is calculated using formula (1), which is: in, Calculate the value for traffic safety, The abnormal frequency of traffic inflow, is the abnormal frequency of traffic outflow, is the abnormal frequency of data packets, , , is the preset weight coefficient.

5. The photovoltaic area network equipment safety monitoring method according to claim 1, characterized in that: The real-time behavior data includes the real-time operation behavior data of the user, the historical behavior data includes the historical operation behavior data of the user, and determining the security status of the network equipment in the photovoltaic area based on the real-time behavior data and / or the historical behavior data includes: Calculating the similarity between the real-time operation behavior data and the historical operation behavior data; When the similarity is less than a preset similarity threshold, it is determined that there is a security risk in the network device.

6. The photovoltaic area network equipment safety monitoring method according to claim 1, characterized in that: The real-time behavior data includes website access data; obtaining the real-time behavior data during the user login period includes: Obtain the number of visits and duration of users to unknown websites and the number of visits and duration of users to risky websites within a unit of time; Determine the total visit duration of the unknown website based on the number of visits and the visit duration of the unknown website; When the duration of a user's single visit to a risky website exceeds a preset visit duration threshold, the risky website is determined as a high-risk website, and the ratio of the number of visits to the high-risk website by the user per unit time to the number of visits to the risky website by the user is calculated.

7. The photovoltaic area network equipment safety monitoring method according to claim 6, characterized in that: The determining the security status of the network equipment in the photovoltaic area based on the real-time behavior data and / or the historical behavior data includes: The website access safety factor is calculated using formula (2), which is: in, For website access security factor, m is the number of visits to unknown websites by users per unit time, n is the number of visits to risky websites by users in a unit of time, T is the total duration of visits to unknown websites. is the ratio of the number of visits to high-risk websites to the number of visits to risky websites. is the preset weight coefficient, and ; When the website access safety factor is less than a preset safety factor threshold, it is determined that the network device has a safety hazard.

8. A photovoltaic area network equipment safety monitoring device, characterized in that: include: A real-time data acquisition module is used to acquire user login information of network devices deployed in the photovoltaic area and real-time behavior data during user login; A historical data acquisition module is used to acquire the user's historical behavior data based on the user's login information; The data comparison module is used to determine the security status of the network equipment in the photovoltaic area based on the real-time behavior data and / or the historical behavior data.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the photovoltaic area network equipment safety monitoring method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the photovoltaic area network equipment safety monitoring method according to any one of claims 1 to 7 is implemented.

Images