Nuclear power plant network security emergency disposal method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a nuclear power plant network security emergency disposal method and device, equipment and a storage medium, and belongs to the technical field of nuclear power plant network security. The method comprises the following steps: acquiring an alarm level and alarm equipment of a safety alarm; obtaining a device class to which the alarm device belongs, and obtaining an alarm device class; according to the alarm grade and the alarm equipment category, setting an intrusion grade of the network security accident; and executing an intrusion emergency scheme corresponding to the intrusion level. According to the embodiment of the invention, the intrusion level of the network security accident is set according to the alarm level and the alarm equipment category, the intrusion level can reflect the severity of the network security accident and can also reflect the specific influence of the network security accident on the operation control of the nuclear power plant, and the emergency scheme with higher pertinence is formulated and executed based on the intrusion level. And the nuclear power plant network safety emergency disposal capability is improved.

Description

Technical Field

[0001] The present application relates to the technical field of nuclear power plant network security, and in particular to a nuclear power plant network security emergency response method and device, equipment and storage medium. Background Art

[0002] After the industrial control network of a nuclear power plant is attacked by a network security attack, corresponding measures need to be taken to isolate, detect and recover the network security attack to ensure that the availability of the industrial control system is not affected as much as possible.

[0003] In the related technology, nuclear power plants have established emergency response plans for cyber security incidents. After detecting a security incident alarm, the alarm signal is divided into different levels according to the severity of the cyber security incident, and the corresponding emergency response plan is selected according to the level of the alarm signal to handle the incident. However, the classification of alarm signal levels in this method is relatively rough and cannot accurately reflect the security threat to the nuclear power plant. Therefore, the network security emergency response capability of nuclear power plants needs to be further improved. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a nuclear power plant network security emergency response method and device, equipment and storage medium, aiming to improve the nuclear power plant network security emergency response capability.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a nuclear power plant network security emergency response method, the method comprising:

[0006] In response to a security alarm of a cyber security incident in a nuclear power plant, obtaining an alarm level and an alarm device of the security alarm;

[0007] According to the preset classification standards, nuclear power plant equipment is divided into at least two equipment categories;

[0008] From the at least two device categories, determine the device category to which the alarm device belongs, and obtain the alarm device category;

[0009] According to the alarm level and the alarm device category, the intrusion level of the network security incident is set; each intrusion level is correspondingly provided with an intrusion emergency plan;

[0010] The intrusion emergency plan corresponding to the intrusion level is executed.

[0011] In some embodiments, the at least two device classes include a first device class and a second device class; the security risk of the first device class is greater than the security risk of the second device class;

[0012] The step of setting the intrusion level of the network security incident according to the alarm level and the alarm device category includes:

[0013] If the alarm device category is the first device category and the alarm level is not the highest level, setting the intrusion level to be greater than the alarm level;

[0014] If the alarm device category is the first device category and the alarm level is the highest level, then the intrusion level is set to the highest level;

[0015] If the alarm device category is the second device category and the alarm level is not the lowest level, setting the intrusion level to be lower than the alarm level;

[0016] If the alarm device category is the second device category and the alarm level is the lowest level, the intrusion level is set to the lowest level.

[0017] In some embodiments, the at least two device classes further include a third device class; the security risk of the second device class is greater than the security risk of the third device class;

[0018] The step of setting the intrusion level of the network security incident according to the alarm level and the alarm device category further includes:

[0019] If the alarm device category is the third device category, the intrusion level is set to the lowest level.

[0020] In some embodiments, the intrusion emergency plan includes a first emergency plan, a second emergency plan, and a third emergency plan;

[0021] The executing the intrusion emergency plan corresponding to the intrusion level includes:

[0022] If the intrusion level is the lowest level, executing the first emergency plan, the first emergency plan includes detecting the state of the alarm device and restoring the alarm device;

[0023] If the intrusion level is neither the lowest level nor the highest level, the second emergency plan is executed, and the second emergency plan includes withdrawing the equipment status of the nuclear power plant, detecting the alarm equipment status, and isolating and restoring the alarm equipment;

[0024] If the intrusion level is the highest level, the third emergency plan is executed, and the third emergency plan includes running the backup shutdown system, detecting the status of the alarm equipment, and isolating and restoring the alarm equipment.

[0025] In some embodiments, operating the backup shutdown system includes:

[0026] Performing a shutdown operation on a reactor to bring the reactor into a subcritical state;

[0027] After the reactor reaches a subcritical state, a steam discharge valve of a secondary steam system corresponding to the reactor is opened to discharge steam from the inside of the reactor to the atmosphere;

[0028] Injecting cooling water into a reactor cooling system corresponding to the reactor to reduce the temperature of the reactor;

[0029] Closing the steam isolation valve of the secondary steam loop system to cut off the steam supply to the reactor;

[0030] Close the feedwater isolation valve of the reactor cooling system to cut off the cooling water supply to the reactor.

[0031] In some embodiments, further comprising:

[0032] Obtaining status parameters of the nuclear power plant equipment;

[0033] determining the operating state of the nuclear power plant according to the state parameter;

[0034] The step of setting the intrusion level of the network security incident according to the alarm level and the alarm device category includes:

[0035] If the operating state is normal, setting the intrusion level of the network security incident according to the alarm level and the alarm device category;

[0036] If the operating state is abnormal, the intrusion level of the network security incident is set to a preset level.

[0037] In some embodiments, determining the operating state of the nuclear power plant according to the state parameter includes:

[0038] Comparing the state parameter with a preset state parameter range to obtain a comparison result, wherein the comparison result is used to indicate a magnitude relationship between the state parameter and the state parameter range;

[0039] According to the comparison result, the operating status is classified as normal or abnormal.

[0040] In some embodiments, determining the operating state of the nuclear power plant according to the state parameter includes:

[0041] Build a state parameter rule base;

[0042] Determine whether the state parameter matches the state parameter rule base. If the state parameter matches the state parameter rule base, classify the operating state as normal; if the state parameter does not match the state parameter rule base, classify the operating state as abnormal.

[0043] In some embodiments, the at least two device classes include a first device class and a second device class; the security risk of the first device class is greater than the security risk of the second device class;

[0044] The obtaining of the status parameters of the nuclear power plant equipment includes:

[0045] Acquire status parameters of nuclear power plant equipment belonging to the first equipment class.

[0046] In some embodiments, each of the intrusion emergency plans is provided with a detection parameter set;

[0047] After executing the intrusion emergency plan corresponding to the intrusion level, the method further includes:

[0048] Obtaining a detection parameter set corresponding to the intrusion emergency plan,

[0049] According to the detection parameter set, it is determined whether the network security incident has been repaired. If the network security incident has been repaired, the execution of the intrusion emergency plan is stopped; otherwise, the execution of the intrusion emergency plan continues.

[0050] To achieve the above-mentioned purpose, a second aspect of the embodiment of the present application proposes a nuclear power plant network security emergency response device, the device comprising:

[0051] An alarm response module is used to respond to the security alarm of the nuclear power plant network security incident and obtain the alarm level and alarm device of the security alarm;

[0052] An intrusion level determination module is used to classify nuclear power plant equipment into at least two equipment categories according to a preset classification standard; determine the equipment category to which the alarm equipment belongs from the at least two equipment categories to obtain the alarm equipment category; set the intrusion level of the network security incident according to the alarm level and the alarm equipment category; and set an intrusion emergency plan corresponding to each intrusion level;

[0053] The emergency execution module is used to execute the intrusion emergency plan corresponding to the intrusion level.

[0054] To achieve the above objectives, a third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0055] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0056] The nuclear power plant network security emergency response method and device, equipment and storage medium proposed in this application divide the nuclear power plant equipment into multiple equipment categories according to preset classification standards, judge the equipment category to which the alarm equipment belongs, and obtain the alarm equipment category; according to the alarm level and the alarm equipment category, set the intrusion level of the network security accident, and the intrusion level can not only reflect the severity of the network security accident, but also reflect the specific impact of the network security accident on the operation and control of the nuclear power plant. Based on the intrusion level, a more targeted emergency plan is formulated and implemented to improve the network security emergency response capability of the nuclear power plant. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a flow chart of a nuclear power plant network security emergency response method provided by an embodiment of the present application;

[0058] Figure 2 yes Figure 1 Flow chart of step S104 in FIG.

[0059] Figure 3 yes Figure 1 Flow chart of step S104 in FIG.

[0060] Figure 4 yes Figure 3 Flow chart of step S303 in FIG.

[0061] Figure 5 It is a structural schematic diagram of a nuclear power plant network security emergency response device provided in an embodiment of the present application;

[0062] Figure 6 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0064] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0065] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "illustrative embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials, or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0066] In the description of this application, it should be noted that, unless otherwise clearly defined, the terms such as setting, installing, connecting, etc. should be understood in a broad sense, and technicians in the relevant technical field can reasonably determine the specific meanings of the above terms in this application in combination with the specific content of the technical solution. In addition, the identification of specific steps below does not represent a limitation on the order of steps and execution logic. The execution order and execution logic between each step should be understood and inferred with reference to the contents described in the embodiment.

[0067] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0068] The nuclear power plant network security emergency response method and device, electronic device and storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the nuclear power plant network security emergency response method in the embodiments of the present application is described.

[0069] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0070] Figure 1 is an optional flow chart of a nuclear power plant network security emergency response method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S105.

[0071] Step S101, in response to a security alarm of a network security incident in a nuclear power plant, obtaining an alarm level and an alarm device of the security alarm;

[0072] Step S102, classifying the nuclear power plant equipment into at least two equipment categories according to a preset classification standard;

[0073] Step S103, determining the device class to which the alarm device belongs from the at least two device classes, and obtaining the alarm device category;

[0074] Step S104, setting the intrusion level of the network security incident according to the alarm level and the alarm device category; and setting an intrusion emergency plan corresponding to each intrusion level;

[0075] Step S105: executing the intrusion emergency plan corresponding to the intrusion level.

[0076] Steps S101 to S105 shown in the embodiment of the present application divide nuclear power plant equipment into multiple equipment categories according to preset classification standards, determine the equipment category to which the alarm equipment belongs, and obtain the alarm equipment category; set the intrusion level of the network security accident according to the alarm level and the alarm equipment category. The intrusion level can not only reflect the severity of the network security accident, but also reflect the specific impact of the network security accident on the operation and control of the nuclear power plant. Based on the intrusion level, a more targeted emergency plan is formulated and implemented to improve the network security emergency response capability of the nuclear power plant.

[0077] In step S101 of some embodiments, a response may be performed after receiving a safety alarm from the nuclear power plant's industrial digital control system, and the alarm level and alarm device of the safety alarm may be obtained from the nuclear power plant's industrial digital control system; or a response may be performed after receiving a safety alarm from the nuclear power plant's network security comprehensive detection system, and the alarm level and alarm device of the safety alarm may be obtained from the nuclear power plant's network security comprehensive detection system; it is not limited to this.

[0078] In some more specific embodiments, the industrial digital control system of a nuclear power plant refers to a digital control system used for signal acquisition, control monitoring, shutdown protection, and safety facility activation of multiple process systems in a nuclear power plant. It can be divided into the following four levels according to vertical functions: process system interface layer, automatic control and protection layer, management and operation layer, and plant-wide information management layer. The industrial digital control system of a nuclear power plant may include, but is not limited to, sensors, actuators, digital processing units, and communication modules to achieve control of valves, switches, relays, and other equipment, as well as the acquisition, processing, and monitoring of equipment status parameters.

[0079] In some specific embodiments, the nuclear power plant network security integrated detection system refers to a management system for monitoring, evaluating and strengthening the network security of a nuclear power plant, and is used to prevent unauthorized access, service interruption, data leakage and network attacks. The nuclear power plant network security integrated detection system may include, but is not limited to, a network activity monitoring module, an access control module, an intrusion detection module, a data encryption module, and a network isolation module.

[0080] In step S102 of some embodiments, the at least two device classes have different security risks; or, the at least two device classes have different device reliability; but this is not limited thereto.

[0081] In step S102 of some embodiments, the safety level of nuclear power plant equipment may be used as a classification standard. Nuclear power plant equipment with a safety level of 1E is classified into the first equipment category, such as nuclear power plant equipment used to achieve safe shutdown, core cooling, containment isolation, and residual heat removal functions are classified into the first equipment category; nuclear power plant equipment with a safety level of NC+ is classified into the second equipment category, such as the diversified drive system of the nuclear power plant is classified into the second equipment category; nuclear power plant equipment with a safety level of NC is classified into the third equipment category, such as the conventional island system and its power supply equipment are classified into the third equipment category.

[0082] In step S102 of some embodiments, the quality assurance level of nuclear power plant equipment may also be used as a classification standard. Nuclear power plant equipment with a quality assurance level of Q1 is classified into the first equipment category, such as nuclear power plant equipment used to prevent radioactive emissions to the environment; nuclear power plant equipment with a quality assurance level of Q2 is classified into the second equipment category, such as nuclear power plant equipment used to control the operating status parameter values ​​of the nuclear power plant to remain within the safety limit, and its failure or failure may cause the action of safety equipment is classified into the second equipment category; nuclear power plant equipment with a quality assurance level of Q3 is classified into the third equipment category.

[0083] In step S102 of some embodiments, the identification level of nuclear power plant equipment can also be used as a classification standard. Nuclear power plant equipment with an identification level of K1 is classified into the first equipment category, such as nuclear power plant equipment and its power supply equipment installed in the containment and must operate normally under normal environmental conditions and accident conditions are classified into the first equipment category; nuclear power plant equipment with an identification level of K2 is classified into the second equipment category, such as safety-level equipment installed in the containment and may not operate normally under accident conditions is classified into the second equipment category; nuclear power plant equipment with an identification level of K3 is classified into the third equipment category, such as nuclear power plant equipment installed outside the containment is classified into the third equipment category.

[0084] Exemplarily, the first equipment category includes protection systems, which are used to automatically or manually trigger protection measures for nuclear power plants. The protection systems include reactor protection equipment, containment equipment, core cooling equipment, steam exhaust equipment, and loop coolant control equipment. The second equipment category includes primary and secondary loop operation control systems, backup protection systems, and accident handling systems. The primary and secondary loop operation control systems are used to monitor and control the operating status of the primary and secondary loops of nuclear power plants, including reactors, reactor coolant pumps, steam generators, regulators, control rod drive mechanisms, steam turbines, generators, feedwater deaerators, heaters, and condensate pumps. The backup protection system is used to provide operators with monitoring and control functions for nuclear power plants when the main control fails, including emergency diesel generator sets, backup disk equipment, and radioactive material monitoring and control equipment. The accident handling system is used to initiate emergency response procedures when an accident occurs, including emergency communication systems, radiation monitoring equipment, and accident cooling equipment.

[0085] See also Figure 2 In some embodiments, the at least two device classes include a first device class and a second device class, and the security risk of the first device class is greater than the security risk of the second device class; step S104 may include but is not limited to steps S201 to S204:

[0086] Step S201, if the alarm device category is the first device category and the alarm level is not the highest level, setting the intrusion level to be greater than the alarm level;

[0087] Step S202: if the alarm device category is the first device category and the alarm level is the highest level, then set the intrusion level to the highest level;

[0088] Step S203, if the alarm device category is the second device category and the alarm level is not the lowest level, setting the intrusion level to be lower than the alarm level;

[0089] Step S204: if the alarm device category is the second device category and the alarm level is the lowest level, then the intrusion level is set to the lowest level.

[0090] Exemplarily, the alarm levels are divided into the first warning level, the second warning level, and the third warning level from low to high; correspondingly, the intrusion levels are divided into the first intrusion level, the second intrusion level, and the third intrusion level from low to high. When the alarm device category is a protection system, that is, it belongs to the first device category, if the alarm level is the first warning level, the intrusion level is set to the second intrusion level; if the alarm level is the second warning level or the third warning level, the intrusion level is set to the third intrusion level. When the alarm device category is one of the primary and secondary circuit operation control systems, backup protection systems, or accident handling systems, that is, it belongs to the second device category, if the alarm level is the first warning level or the second warning level, the intrusion level is set to the first intrusion level; if the alarm level is the third warning level, the intrusion level is set to the second intrusion level.

[0091] It is easy to understand that the number of levels divided by the intrusion level can be greater than the number of levels divided by the alarm level. For example, the alarm level is divided into the first warning level, the second warning level, and the third warning level from low to high; the intrusion level is divided into the zeroth intrusion level, the first intrusion level, the second intrusion level, the third intrusion level, and the fourth intrusion level from low to high. When the alarm device category is a protection system, that is, it belongs to the first device category, if the alarm level is the first warning level, the intrusion level is set to the second intrusion level; if the alarm level is the second warning level, the intrusion level is set to the third intrusion level; if the alarm level is the third warning level, the intrusion level is set to the fourth intrusion level. When the alarm device category is one of the primary and secondary circuit operation control systems, backup protection systems, or accident handling systems, that is, it belongs to the second device category, if the alarm level is the first warning level, the intrusion level is set to the zeroth intrusion level; if the alarm level is the second warning level, the intrusion level is set to the first intrusion level; if the alarm level is the third warning level, the intrusion level is set to the second intrusion level.

[0092] In steps S201 to S204 shown in the embodiment of the present application, when the alarm device category is the first device category or the second device category, the intrusion level is adjusted upward or downward based on the alarm level, and the obtained intrusion level can accurately reflect the safety risk of the nuclear power plant.

[0093] See also Figure 2 In some embodiments, the at least two equipment classes further include a third equipment class, and the security risk of the second equipment class is greater than the security risk of the third equipment class; after step S204, the nuclear power plant network security emergency response method further includes step S205:

[0094] Step S205: If the alarm device category is the third device category, the intrusion level is set to the lowest level.

[0095] For example, the third equipment category may be an auxiliary equipment operation control system, which includes ventilation equipment, fire fighting equipment, waste treatment equipment, compressed air stations, etc. When the alarm equipment category is an auxiliary equipment operation control system, that is, it belongs to the third equipment category, the intrusion level is directly set to the first intrusion level.

[0096] In steps S201 to S205 shown in the embodiment of the present application, the intrusion level of the alarm device with the lowest security risk is directly set to the lowest level, which can reduce high-level emergency responses caused by local, non-critical accidents and avoid unnecessary waste of emergency resources.

[0097] See also Figure 3 In some embodiments, the intrusion emergency plan includes a first emergency plan, a second emergency plan and a third emergency plan. Step S104 may include but is not limited to steps S301 to S303:

[0098] Step S301, if the intrusion level is the lowest level, executing the first emergency plan, the first emergency plan includes detecting the alarm device status and restoring the alarm device;

[0099] Step S302: If the intrusion level is neither the lowest level nor the highest level, executing the second emergency plan, which includes withdrawing the nuclear power plant equipment status, detecting the alarm equipment status, and isolating and restoring the alarm equipment;

[0100] Step S303: If the intrusion level is the highest level, the third emergency plan is executed, and the third emergency plan includes running the backup shutdown system, detecting the status of the alarm device, and isolating and restoring the alarm device.

[0101] For example, the intrusion levels are divided into the first intrusion level, the second intrusion level, the third intrusion level, and the fourth intrusion level from low to high. If the intrusion level is the first intrusion level, the first emergency plan is executed; if the intrusion level is the second intrusion level or the third intrusion level, the second emergency plan is executed; if the intrusion level is the fourth intrusion level, the third emergency plan is executed.

[0102] In steps S301 to S303 shown in the embodiment of the present application, corresponding emergency plans are set for each intrusion level, so as to improve the level of refinement in responding to network security incidents and reduce adverse consequences caused by overreaction or underreaction.

[0103] See also Figure 4 In step S303 of some embodiments, the operation of the backup shutdown system may include but is not limited to steps S401 to S405:

[0104] Step S401, performing a shutdown operation on the reactor to make the reactor reach a subcritical state;

[0105] Step S402, after the reactor reaches a subcritical state, opening a steam discharge valve of a secondary steam system configured corresponding to the reactor to discharge steam from the inside of the reactor to the atmosphere;

[0106] Step S403, injecting cooling water into a reactor cooling system configured corresponding to the reactor to reduce the temperature of the reactor;

[0107] Step S404, closing the steam isolation valve of the secondary steam loop system to cut off the steam supply to the reactor;

[0108] Step S405, closing the water supply isolation valve of the reactor cooling system to cut off the cooling water supply to the reactor.

[0109] Steps S401 to S405 shown in the embodiment of the present application propose a bottom-line safety measure backup shutdown system, which can maximize the nuclear safety of the nuclear power plant under extreme circumstances.

[0110] In some embodiments, the nuclear power plant network security emergency response method may also include but is not limited to steps S501 to S502:

[0111] Step S501, obtaining status parameters of the nuclear power plant equipment;

[0112] Step S502, determining the operating state of the nuclear power plant according to the state parameter;

[0113] The step S104 may include but is not limited to steps S601 to S602:

[0114] Step S601, if the operating state is normal, setting the intrusion level of the network security incident according to the alarm level and the alarm device category;

[0115] Step S602: If the operating state is abnormal, the intrusion level of the network security incident is set to a preset level.

[0116] Exemplarily, the state parameters may include, but are not limited to, subcriticality, primary circuit water charge, primary circuit pressure, secondary circuit water charge, secondary circuit pressure, and core outlet temperature.

[0117] In steps S601 to S602 shown in the embodiment of the present application, based on the status parameters, it is determined whether the operating status of the nuclear power plant is normal or abnormal, and the intrusion level of the network security incident is set according to the alarm level and the type of alarm equipment only when the nuclear power plant is operating normally, so as to ensure the rational allocation of emergency resources and reduce the waste of emergency resources in non-critical periods; in the case of abnormal operation of the nuclear power plant, the intrusion level is directly set to the preset level, so as to respond quickly to potential security threats, avoid the security risks aggravated by the delay in evaluation time, and ensure the safe operation of the nuclear power plant.

[0118] In step S602 of some embodiments, the intrusion level of the network security incident is directly set to the highest level to achieve a rapid response to major security threats.

[0119] In some embodiments, step S502 may include but is not limited to steps S701 to S702:

[0120] Step S701, comparing the state parameter with a preset state parameter range to obtain a comparison result, wherein the comparison result is used to indicate a magnitude relationship between the state parameter and the state parameter range;

[0121] Step S702: Classify the operation status as normal or abnormal according to the comparison result.

[0122] In the steps S701 to S702 shown in the embodiment of the present application, the operating status of the nuclear power plant is judged through a preset status parameter range, thereby realizing an automated evaluation of the operating status of the nuclear power plant.

[0123] In some specific embodiments, before step S701, the nuclear power plant network security emergency response method also includes: performing data cleaning on the state parameters, and the data cleaning includes filtering out noise, filling missing values, data standardization, etc., to ensure the accuracy and availability of the state parameters.

[0124] In step S702 of some embodiments, if each of the state parameters is within the corresponding state parameter range, the operating state is classified as normal; if any of the state parameters exceeds the corresponding state parameter range, the operating state is classified as abnormal.

[0125] In step S702 of some embodiments, if multiple state parameters exceeding a preset quantity threshold are within the corresponding state parameter range, the operating state is classified as normal; if multiple state parameters exceeding a preset quantity threshold are beyond the corresponding state parameter range, the operating state is classified as abnormal. For example, if the total number of state parameters is 10, and 8 of them are within the corresponding state parameter range, exceeding the quantity threshold of 7, the operating state is classified as normal.

[0126] In some embodiments, step S502 may include but is not limited to steps S801 to S802:

[0127] Step S801, constructing a state parameter rule base;

[0128] Step S802, determine whether the state parameter matches the state parameter rule base. If the state parameter matches the state parameter rule base, classify the operating state as normal; if the state parameter does not match the state parameter rule base, classify the operating state as abnormal.

[0129] In steps S801 to S802 shown in the embodiment of the present application, the operating status of the nuclear power plant is judged by constructing a status parameter rule base, and the operating status of the nuclear power plant is automatically evaluated, which can more accurately evaluate the operating status of the nuclear power plant.

[0130] In some embodiments, step S801 may include but is not limited to: establishing a rule base according to historical data of the nuclear power plant equipment under normal operating conditions to obtain the state parameter rule base.

[0131] In some embodiments, step S802 may be to determine whether the state parameter can be hit in the state parameter rule base. If the state parameter is hit in the state parameter rule base, it is considered that the state parameter matches the state parameter rule base; otherwise, it is considered that the state parameter does not match the state parameter rule base. Step S802 may also be to determine whether the development trend of the state parameter conforms to the rules in the state parameter rule base. If it conforms to the rules in the state parameter rule base, it is considered that the state parameter matches the state parameter rule base; otherwise, it is considered that the state parameter does not match the state parameter rule base.

[0132] In some embodiments, the at least two device classes include a first device class and a second device class; the security risk of the first device class is greater than the security risk of the second device class; step S501 may include but is not limited to step S901:

[0133] Step S901, obtaining status parameters of nuclear power plant equipment belonging to the first equipment category.

[0134] Step S901 shown in the embodiment of the present application determines the operating status of the nuclear power plant based on the status parameters of the first equipment category with high security risks, so as to judge whether to set the intrusion level of the network security incident immediately or to set the intrusion level of the network security incident according to the alarm level and the alarm equipment category, which can further improve the response speed of network security incidents.

[0135] In some embodiments, each of the intrusion emergency plans is correspondingly provided with a detection parameter set; after step S105, the nuclear power plant network security emergency disposal method further includes steps S1001 to S1002:

[0136] Step S1001, obtaining a detection parameter set corresponding to the intrusion emergency plan,

[0137] Step S1002, judging whether the network security incident has been repaired according to the detection parameter set, if the network security incident has been repaired, stopping the execution of the intrusion emergency plan; otherwise, continuing to execute the intrusion emergency plan.

[0138] In steps S1001 to S1002 shown in the embodiment of the present application, by setting a detection parameter set corresponding to the intrusion emergency plan, it is determined whether the network security incident has been repaired, thereby improving the degree of automation in executing the intrusion emergency plan.

[0139] In some embodiments, the detection parameter set in step S1001 may include, but is not limited to: status parameters of alarm equipment, flag parameters for identifying whether the status action of evacuating the nuclear power plant equipment is completed, and status parameters of the backup shutdown system.

[0140] Exemplarily, the state parameters of the alarm device may include, but are not limited to, temperature parameters, pressure parameters, flow parameters, liquid level parameters, vibration parameters, and sound intensity parameters of the alarm device. The state parameters of the alarm device may reflect whether the device is in a normal operating state. The flag parameters used to identify whether the state action of withdrawing the nuclear power plant equipment is completed may include, but are not limited to, the insertion depth of the control rod, the flow change of the coolant, and the pressure change. The state parameters of the backup shutdown system may include, but are not limited to, the position of the control rod, the position of the absorber ball, and the pressure of the shutdown system. For example, in a high-temperature gas-cooled reactor nuclear power plant project, the backup shutdown system may include control rods and absorber balls, and its state parameters may involve the position and state of the control rod drive mechanism (CRDM) and the absorber ball (SAS) to ensure that when the main shutdown system fails, the backup system can reliably insert the control rod or release the absorber ball to stop the reactor.

[0141] In some embodiments, step S1002 may include but is not limited to: a detection parameter range for each detection parameter in a preset detection parameter set; if each detection parameter is within its corresponding detection parameter range, it is considered that the network security incident has been repaired and the execution of the intrusion emergency plan is stopped; if any detection parameter is not within its corresponding detection parameter range, it is considered that the network security incident has not been repaired and the intrusion emergency plan continues to be executed.

[0142] See also Figure 5The embodiment of the present application also provides a nuclear power plant network security emergency response device, which can implement the above-mentioned nuclear power plant network security emergency response method, and the device includes:

[0143] An alarm response module is used to respond to the security alarm of the nuclear power plant network security incident and obtain the alarm level and alarm device of the security alarm;

[0144] An intrusion level determination module is used to determine the device class to which the alarm device belongs from the at least two device classes, and obtain the alarm device category; according to the alarm level and the alarm device category, the intrusion level of the network security incident is set; each of the intrusion levels is correspondingly provided with an intrusion emergency plan;

[0145] The emergency execution module is used to execute the intrusion emergency plan corresponding to the intrusion level.

[0146] The specific implementation of the nuclear power plant network security emergency response device is basically the same as the specific implementation example of the nuclear power plant network security emergency response method mentioned above, and will not be repeated here.

[0147] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned nuclear power plant network security emergency response method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0148] See also Figure 6 , Figure 6 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0149] The processor 901 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0150] The memory 902 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 902 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 902, and the processor 901 calls and executes the nuclear power plant network security emergency response method of the embodiment of this application;

[0151] Input / output interface 903, used to implement information input and output;

[0152] Communication interface 904, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0153] A bus 905 that transmits information between various components of the device (e.g., the processor 901, the memory 902, the input / output interface 903, and the communication interface 904);

[0154] The processor 901 , the memory 902 , the input / output interface 903 and the communication interface 904 are connected to each other in communication within the device via a bus 905 .

[0155] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned nuclear power plant network security emergency response method.

[0156] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0157] The embodiments of the present application provide a nuclear power plant network security emergency response method, a nuclear power plant network security emergency response device, an electronic device, and a storage medium, which divide nuclear power plant equipment into multiple equipment categories according to a preset classification standard, determine the equipment category to which the alarm equipment belongs, and obtain the alarm equipment category; according to the alarm level and the alarm equipment category, set the intrusion level of the network security accident, which can not only reflect the severity of the network security accident, but also reflect the specific impact of the network security accident on the operation and control of the nuclear power plant. Based on the intrusion level, a more targeted emergency plan is formulated and implemented to improve the network security emergency response capability of the nuclear power plant.

[0158] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0159] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0160] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0161] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0162] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0163] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0164] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0165] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0166] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0167] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0168] The preferred embodiments of the present application are described above with reference to the accompanying drawings, but the scope of the rights of the present application is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present application should be within the scope of the rights of the present application.

Claims

1. A method for handling network security emergencies in a nuclear power plant, characterized in that: The method comprises: In response to a security alarm of a cyber security incident in a nuclear power plant, obtaining an alarm level and an alarm device of the security alarm; According to the preset classification standards, nuclear power plant equipment is divided into at least two equipment categories; From the at least two device categories, determine the device category to which the alarm device belongs, and obtain the alarm device category; According to the alarm level and the alarm device category, the intrusion level of the network security incident is set; each intrusion level is correspondingly provided with an intrusion emergency plan; The intrusion emergency plan corresponding to the intrusion level is executed.

2. The method according to claim 1, characterized in that The at least two device classes include a first device class and a second device class; the security risk of the first device class is greater than the security risk of the second device class; The step of setting the intrusion level of the network security incident according to the alarm level and the alarm device category includes: If the alarm device category is the first device category and the alarm level is not the highest level, setting the intrusion level to be greater than the alarm level; If the alarm device category is the first device category and the alarm level is the highest level, then the intrusion level is set to the highest level; If the alarm device category is the second device category and the alarm level is not the lowest level, setting the intrusion level to be lower than the alarm level; If the alarm device category is the second device category and the alarm level is the lowest level, the intrusion level is set to the lowest level.

3. The method according to claim 2, characterized in that The at least two device classes further include a third device class; the security risk of the second device class is greater than the security risk of the third device class; The step of setting the intrusion level of the network security incident according to the alarm level and the alarm device category further includes: If the alarm device category is the third device category, the intrusion level is set to the lowest level.

4. The method according to claim 1, characterized in that: The intrusion emergency plan includes a first emergency plan, a second emergency plan and a third emergency plan; The executing the intrusion emergency plan corresponding to the intrusion level includes: If the intrusion level is the lowest level, executing the first emergency plan, the first emergency plan includes detecting the state of the alarm device and restoring the alarm device; If the intrusion level is neither the lowest level nor the highest level, the second emergency plan is executed, and the second emergency plan includes withdrawing the equipment status of the nuclear power plant, detecting the alarm equipment status, and isolating and restoring the alarm equipment; If the intrusion level is the highest level, the third emergency plan is executed, and the third emergency plan includes running the backup shutdown system, detecting the status of the alarm equipment, and isolating and restoring the alarm equipment.

5. The method according to claim 4, characterized in that The operation backup shutdown system comprises: Performing a shutdown operation on a reactor to bring the reactor into a subcritical state; After the reactor reaches a subcritical state, a steam discharge valve of a secondary steam system corresponding to the reactor is opened to discharge steam from the reactor to the atmosphere; Injecting cooling water into a reactor cooling system corresponding to the reactor to reduce the temperature of the reactor; Closing the steam isolation valve of the secondary steam loop system to cut off the steam supply to the reactor; Close the feedwater isolation valve of the reactor cooling system to cut off the cooling water supply to the reactor.

6. The method according to claim 1, characterized in that Also includes: Obtaining status parameters of the nuclear power plant equipment; determining the operating state of the nuclear power plant according to the state parameter; The step of setting the intrusion level of the network security incident according to the alarm level and the alarm device category includes: If the operating state is normal, setting the intrusion level of the network security incident according to the alarm level and the alarm device category; If the operating state is abnormal, the intrusion level of the network security incident is set to a preset level.

7. The method according to claim 6, characterized in that Determining the operating state of the nuclear power plant according to the state parameter includes: Comparing the state parameter with a preset state parameter range to obtain a comparison result, wherein the comparison result is used to indicate a magnitude relationship between the state parameter and the state parameter range; According to the comparison result, the operating status is classified as normal or abnormal.

8. The method according to claim 6, characterized in that Determining the operating state of the nuclear power plant according to the state parameter includes: Build a state parameter rule base; Determine whether the state parameter matches the state parameter rule base. If the state parameter matches the state parameter rule base, classify the operating state as normal; if the state parameter does not match the state parameter rule base, classify the operating state as abnormal.

9. The method according to any one of claims 6 to 8, characterized in that: The at least two device classes include a first device class and a second device class; the security risk of the first device class is greater than the security risk of the second device class; The obtaining of the status parameters of the nuclear power plant equipment includes: Acquire status parameters of nuclear power plant equipment belonging to the first equipment class.

10. The method according to any one of claims 1 to 8, characterized in that: Each of the intrusion emergency plans is correspondingly provided with a detection parameter set; After executing the intrusion emergency plan corresponding to the intrusion level, the method further includes: Obtaining a detection parameter set corresponding to the intrusion emergency plan, Determining whether the network security incident has been repaired according to the detection parameter set, and if the network security incident has been repaired, stopping execution of the intrusion emergency plan; Otherwise, continue to execute the intrusion contingency plan.

11. A nuclear power plant network security emergency response device, characterized in that: The device comprises: An alarm response module is used to respond to the security alarm of the nuclear power plant network security incident and obtain the alarm level and alarm device of the security alarm; An intrusion level determination module is used to classify nuclear power plant equipment into at least two equipment categories according to a preset classification standard; determine the equipment category to which the alarm equipment belongs from the at least two equipment categories to obtain the alarm equipment category; set the intrusion level of the network security incident according to the alarm level and the alarm equipment category; and set an intrusion emergency plan corresponding to each intrusion level; The emergency execution module is used to execute the intrusion emergency plan corresponding to the intrusion level.

12. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the nuclear power plant network security emergency response method according to any one of claims 1 to 7 when executing the computer program.

13. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the nuclear power plant network security emergency response method described in any one of claims 1 to 7 is implemented.

Images