Automatic identification method for network security check of power system

Abstract

The invention discloses an automatic identification method for network security check of a power system, which relates to the technical field of automatic identification and comprises the following steps of: obtaining a plurality of groups of network segmentation granularities according to a network architecture and segmentation granularity adjustment parameters of the power system; acquiring actual application demand data of the plurality of groups of network segment granularities and security check effect data under the plurality of groups of network segment granularities; according to the actual application demand data and the security check effect data, a segmentation granularity evaluation model is constructed based on a convolutional neural network, and a segmentation granularity evaluation coefficient is generated; constructing a two-dimensional relation curve by using the segmentation granularity evaluation coefficient and the corresponding network segmentation granularity, carrying out data analysis on the two-dimensional relation curve, judging the network segmentation granularity which is most matched with a preset checking mode, and applying the network segmentation granularity to the network security checking of the power system; the method and the device are used for solving the problem that the network segmentation granularity is set based on experience, so that the effectiveness of the isolation attack and the influence on the network efficiency are unbalanced.

Description

Technical Field

[0001] The present invention relates to the technical field of network security verification, and more specifically, to an automatic identification method for network security verification of a power system. Background Art

[0002] The power system refers to the system that transmits and distributes electricity through the power grid. It usually covers multiple links such as power generation, transmission, and distribution. It is an important part of the national infrastructure.

[0003] Cybersecurity verification refers to the security inspection of information and communication technologies (such as SCADA systems, smart meters, control systems, etc.) during the operation of the power system to identify and evaluate possible cybersecurity threats.

[0004] Traditional network security verification methods mainly detect known attack patterns through predefined rules or signature libraries. Intrusion detection systems (IDS) monitor abnormal activities in network traffic or system logs and issue alarms; intrusion prevention systems (IPS) can not only detect anomalies, but also actively block these activities.

[0005] Firewalls are the most basic security measures in power system networks. They define access control policies to limit which network traffic can pass through. Combined with measures such as virtual private networks (VPNs) and network segmentation, the risk of external attacks can be reduced.

[0006] For example, the invention patent with announcement number: CN112333166B announces an automatic attack mode identification system based on the Internet of Things, including a network security monitoring system, an automatic attack mode identification module and a host. The network security monitoring system includes a security interaction platform and a logical isolation device at the boundary of the information intranet server and the information extranet server. The IPS / IDS device identifies intrusion threats; the honeypot system extracts the attack characteristics of the intruder; the APT attack detection device identifies advanced persistent threats; the attack tracing device restores the attack behavior and locates the intruder by locating the intruder information module; the DNS monitoring system locates the attacked host; the behavior tracking system and the behavior analysis and verification module form business access control, and the host is connected to the intranet server signal through the automatic attack mode identification module; it realizes active identification of intrusion threats, extraction of intruder attack characteristics, identification of advanced persistent threats, restoration of attack behavior, and positioning of intruders, thereby improving the protection of hosts and data.

[0007] For example, the invention patent with announcement number CN117118745B discloses a network security dynamic early warning system based on deep learning, which includes using a feature extraction module to pre-process the collected data, extracting features related to security threats, and correlating the extracted features to obtain a correlation mathematical model, and then using a deep learning algorithm to train the correlation mathematical model, and learning and pattern recognition the correlated features, thereby obtaining a mathematical model based on network security status and correlation status. The beneficial effect of the present invention is that it can monitor and analyze the network environment in real time, automatically identify potential security threats and issue early warnings, and through the use of deep learning technology, improve the detection and identification capabilities of emerging network attack methods and reduce network security risks.

[0008] The above disclosed technical solutions have at least the following technical problems: In the prior art, the network security verification of the power system mainly relies on manual review or a detection system based on static rules. When detecting known attack patterns through predefined rules or signature libraries, the network segmentation granularity has a profound impact on the effect of the network security verification of the power system; Segmenting the power system network too finely will greatly improve security and limit the possibility of attack spread, but it will also increase the complexity of system management, especially when dynamically adjusting strategies, which is prone to errors and increases communication delays; Overly extensive network segmentation cannot effectively isolate threats. Once a part is invaded, the entire power system may face greater risks.

[0009] Existing technologies set the network segmentation granularity based on experience, resulting in an imbalance between the effectiveness of isolating attacks and the impact on network efficiency.

[0010] In view of the above problems, the present invention proposes a solution. Summary of the invention

[0011] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides an automatic identification method for power system network security verification, which evaluates different network segmentation granularities to solve the problem that the setting of network segmentation granularity is based on experience, resulting in an imbalance between the effectiveness of isolating attacks and the impact on network efficiency.

[0012] To achieve the above object, the present invention provides the following technical solutions: The invention discloses an automatic identification method for network security verification of a power system, comprising the following steps: adjusting parameters according to the network architecture and segmentation granularity of the power system, setting a basic segmentation granularity, and processing the basic segmentation granularity several times in combination with random numbers to obtain several groups of network segmentation granularities; obtaining actual application demand data of several groups of network segmentation granularities and safety verification effect data under several groups of network segmentation granularities; constructing a segmentation granularity evaluation model based on a convolutional neural network according to the actual application demand data and the safety verification effect data, and generating a segmentation granularity evaluation coefficient; constructing a two-dimensional relationship curve between the segmentation granularity evaluation coefficient and the corresponding network segmentation granularity, performing data analysis on the two-dimensional relationship curve, judging the network segmentation granularity that best matches the preset verification mode, and applying it to the network security verification of the power system.

[0013] In a preferred embodiment, the segmentation granularity adjustment parameters include the number of segments, segmentation isolation method and segmentation depth; the basic segmentation granularity is set according to the network architecture of the power system and the segmentation granularity adjustment parameters, specifically: collecting and organizing the functional module division and equipment distribution of the power system, listing the main network nodes, and building the network architecture of the power system according to the communication relationship between different functional modules or devices; initially segmenting the network architecture of the power system according to functional segmentation, equipment segmentation and geographical segmentation; setting the initial segmentation according to any one of the segmentation granularity adjustment parameters to obtain several basic segmentation granularities; performing several disturbance processing on several basic segmentation granularities based on computer random numbers to obtain several groups of network segmentation granularities.

[0014] In a preferred embodiment, the actual application demand data includes an inter-segment communication delay impact coefficient; the specific method for obtaining the inter-segment communication delay impact coefficient is as follows: obtain the inter-node transmission delay data of each network node during the power system network security verification at different network segmentation granularities; standardize the inter-node transmission delay data to obtain the standardized inter-node transmission delay data; use the principal component method to analyze the standardized inter-node transmission delay data to obtain the characteristics of the inter-node transmission delay data; construct an inter-node transmission delay data matrix based on the characteristics of the inter-node transmission delay data; calculate the covariance matrix of the inter-node transmission delay data matrix; perform eigenvalue decomposition on the covariance matrix, and analyze and calculate the inter-segment communication delay impact coefficient.

[0015] In a preferred embodiment, the security verification effect data includes a false alarm and omission anomaly coefficient and an intrusion detection efficiency influence coefficient; the specific method for obtaining the false alarm and omission anomaly coefficient is as follows: based on the false alarm and omission anomalies of the security review, a review anomaly set is obtained, and the review anomaly set includes the types of false alarm and omission anomalies and the average false alarm and omission rates; the average false alarm and omission rates corresponding to various false alarm and omission anomalies in the review anomaly set are used as the anomaly type weight; based on the review anomaly set and the corresponding anomaly type weight, an anomaly false alarm and omission regression model is constructed to generate a false alarm and omission anomaly coefficient.

[0016] In a preferred embodiment, the specific method for obtaining the intrusion detection efficiency influence coefficient is as follows: perform intrusion detection experiments under each segmentation scheme, obtain the number of intrusion detection times, the total number of intrusions and the propagation bandwidth of the network nodes corresponding to the specific network segmentation granularity in the power grid system, and calculate the intrusion detection efficiency; obtain the intrusion detection efficiency at a preset time interval within a period of time, construct an intrusion detection efficiency set, perform data analysis on the intrusion detection efficiency set, and calculate the intrusion detection efficiency influence coefficient.

[0017] In a preferred embodiment, the segmentation granularity assessment coefficient and the corresponding network segmentation granularity are constructed into a two-dimensional relationship curve, specifically: different output segmentation granularity assessment coefficients are obtained from the segmentation granularity assessment models under different network segmentation granularities; a rectangular coordinate system is established, with the horizontal axis representing the network segmentation granularity and the vertical axis representing the segmentation granularity assessment coefficient; the segmentation granularity assessment coefficient corresponding to each network segmentation granularity is marked on the rectangular coordinate system to form data points; and the data points are connected to construct a two-dimensional relationship curve.

[0018] In a preferred embodiment, the two-dimensional relationship curve is subjected to data analysis to determine the network segmentation granularity that best matches the preset verification mode, and is applied to the power system network security verification, specifically: the corresponding segmentation granularity adjustment parameters are obtained according to the preset verification mode, and the corresponding basic segmentation granularity is obtained according to the corresponding segmentation granularity adjustment parameters; the network segmentation granularity obtained by random number processing based on the basic segmentation granularity is marked, and the network segmentation granularity corresponding to the largest segmentation granularity evaluation coefficient after marking and the quadratic derivative function closest to zero is taken as the best matching network segmentation granularity, and is applied to the power system network security verification.

[0019] Technical effects and advantages of the automatic identification method for power system network security verification of the present invention: 1. The present invention significantly improves the security and communication efficiency of the power network by reasonably setting the segmentation granularity and combining it with random number processing. First, the method realizes the effective segmentation of the power system network architecture by adjusting the number of segments, isolation mode and depth, so that the segmentation scheme matches the actual communication needs, thereby enhancing the isolation strength of the network and reducing the risk of attack. Secondly, the introduction of random numbers ensures the diversity of segmentation schemes, avoids subjective bias caused by empirical settings, and helps to find the best balance between large granularity and fine granularity, which not only improves the protection ability against attacks, but also ensures communication efficiency. In addition, by analyzing the cross-segment communication delay influence coefficient, false alarm and missed alarm anomaly coefficient and intrusion detection efficiency influence coefficient, this method can quantify the impact of network segmentation on actual operation, optimize the segmentation scheme, and ensure that the power system can respond quickly and maintain efficient operation performance when facing complex security threats, ultimately improving the overall security and efficiency of the system.

[0020] 2. The present invention constructs a segmentation granularity assessment model based on a convolutional neural network, and combines the cross-segment communication delay impact coefficient, the false alarm and missed alarm anomaly coefficient, and the intrusion detection efficiency impact coefficient to effectively generate a segmentation granularity assessment coefficient. The technical effect of this method is to achieve a scientific evaluation of the network segmentation of the power system, and can intuitively reflect the impact of different segmentation granularities on the safety verification effect. By constructing a two-dimensional relationship curve and performing data analysis, the network segmentation granularity that best matches the preset verification mode can be accurately determined, thereby optimizing the network architecture and improving overall security and communication efficiency. The advantage of this technology lies in its flexibility and adaptability. It can not only cope with complex security threats, but also can be dynamically adjusted according to actual application needs to ensure the stable operation of the power system in a high-risk environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a structural schematic diagram of the automatic identification method for power system network security verification of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Embodiment 1, Figure 1 The invention provides an automatic identification method for power system network security verification, comprising the following steps: S1, according to the network architecture and segmentation granularity adjustment parameters of the power system, the basic segmentation granularity is set, and the basic segmentation granularity is processed several times in combination with random numbers to obtain several groups of network segmentation granularities.

[0024] The segmentation granularity adjustment parameters include the number of segments, segmentation isolation mode and segmentation depth; The basic segmentation granularity is set according to the network architecture and segmentation granularity adjustment parameters of the power system, specifically: Collect and organize the functional module division and equipment distribution of the power system, list the main network nodes, and build the network architecture of the power system based on the communication relationship between different functional modules or equipment; Initial segmentation of the power system network architecture based on functional segmentation, equipment segmentation, and geographical segmentation; The initial segmentation is set according to any one of the segmentation granularity adjustment parameters to obtain a number of basic segmentation granularities; Based on computer random numbers, several basic segmentation granularities are perturbed several times to obtain several groups of network segmentation granularities.

[0025] It should be noted that the number of segments: the number of network segments directly determines the granularity of the segmentation, from a small number of large segments to a large number of small segments; segment isolation method: the isolation strength of the segmentation can be adjusted based on logical isolation (such as VLAN, subnet) or physical isolation (such as completely independent networks); segment depth: whether to further refine the segmentation within each area, for example, grouping different devices in each substation.

[0026] It should be noted that the initial segmentation is subdivided according to any one of the segmentation granularity adjustment parameters. Specifically, according to one of the segmentation granularity adjustment parameters such as depth, it is determined whether the segmentation is based on substation classification or segmentation at the equipment level, or segmentation at the module level.

[0027] It should be noted that the initial segmentation defines how the network is divided logically or physically, which can be specifically based on the following principles: functional segmentation: power generation, transmission, distribution and other modules are independent areas; equipment segmentation: such as communication equipment, monitoring equipment and control equipment are different segments; geographical segmentation: divided by substation, distribution station, power station or region.

[0028] The above method sets the basic segmentation granularity based on the network architecture of the power system and the segmentation granularity adjustment parameters, and processes the basic segmentation granularity in combination with random numbers, which effectively solves the problem of imbalance between the effectiveness of isolation attacks and network efficiency caused by the empirical setting of the traditional network segmentation granularity. First, the power system is initially segmented by the three parameters of segment number, isolation method and segment depth to ensure that the segmentation scheme matches the communication requirements and functional modules of the actual architecture. Then, random number processing introduces diversity to these basic schemes, so that the segmentation granularity does not only rely on empirical settings, but also generates different segmentation schemes through multiple disturbances. In this way, a balance can be found between larger granularity and fine granularity, which can not only enhance the isolation strength of the network, thereby improving the protection ability against attacks, but also avoid the decrease in communication efficiency caused by excessive segmentation. The introduction of random numbers also avoids subjective bias in the process of manual setting, further optimizes the generation of segmentation schemes, and ensures the dynamic balance between network security and efficiency.

[0029] S2, obtaining actual application demand data of several groups of network segmentation granularities and security verification effect data at several groups of network segmentation granularities.

[0030] The actual application demand data includes a cross-segment communication delay impact coefficient; The security verification effect data includes the false positive and false negative anomaly coefficient and the intrusion detection efficiency impact coefficient.

[0031] The cross-segment communication delay impact coefficient is used to measure the impact of network segmentation on communication efficiency, and mainly reflects whether communication across different segments increases the delay of data transmission or affects the reliability of transmission. In the power system, the setting of segmentation granularity directly affects the communication speed and stability between various functional modules and devices. The cross-segment communication delay impact coefficient helps determine whether segmentation has an adverse effect on real-time data exchange by evaluating the changes in communication delay under different network segmentation schemes, thereby ensuring that network efficiency is not significantly reduced while ensuring network isolation strength and protection effect, and solving the imbalance between attack protection and communication efficiency caused by experience settings in traditional segmentation granularity settings.

[0032] Analyzing the cross-segment communication delay impact coefficient has the following advantages in solving the problem that the setting of network segment granularity is based on experience, which leads to an imbalance between the effectiveness of isolating attacks and the impact on network efficiency: Quantifying the impact of communication delay: In actual power systems, the communication between different modules and devices after segmentation is often high-frequency and has high real-time requirements. The cross-segment communication delay impact coefficient can accurately evaluate the communication efficiency between each segment and avoid data transmission delay problems caused by segmentation that is too fine or too coarse. For example, if the power generation, transmission, and distribution modules are not segmented properly, the delay in cross-segment communication may cause a lag in the execution of control commands, thereby affecting the stability and response speed of the system.

[0033] Optimize the segmentation balance point: Different network segmentation granularities directly affect the attack isolation effect and network operation efficiency. This coefficient enables network designers to find the best balance between too fine segmentation (although security is enhanced, communication efficiency is reduced) and too coarse segmentation (although communication efficiency is improved, isolation effect is weakened) by actually evaluating the communication performance at each segmentation granularity. For example, by testing different numbers of segments, it can be determined at what segmentation level the communication between the power dispatching center and the substation should achieve the best effect.

[0034] Resolving the conflict between latency and security: In power systems, there is often a conflict between network security isolation and communication efficiency, especially when there are too many segments. Although security is improved, it may lead to a significant reduction in cross-segment communication efficiency, affecting real-time data transmission. Through the cross-segment communication delay impact coefficient, it can ensure that the core communication needs of the system are not affected while protecting against attacks, avoiding excessive firewall filtering and routing delays caused by excessive segmentation, thereby solving the problem of over-reliance on experience in traditional segmentation design and failure to quantify the impact of network segmentation on actual operation.

[0035] Dynamic adjustment and adaptation: The operating environment of the power system network is complex and changeable, and the operating requirements at different times or regions are different. The cross-segment communication delay impact coefficient can help dynamically adjust the network segmentation strategy according to real-time needs. For example, when the operating load is light, a smaller segment can be used to enhance safety, while when the load is high, the segmentation can be appropriately reduced to improve communication efficiency, ensuring that the system always operates in an efficient and safe state.

[0036] Reduce human experience errors: Traditional network segmentation granularity settings often rely on experience and preset standards, lack objective data support, and may cause false alarms and missed reports. The cross-segment communication delay impact coefficient provides actual data support for the system, reduces human experience errors, and ensures that the segmentation design is more scientific and reasonable. In the complex scenarios of the power system, it can effectively solve the imbalance problem caused by experience settings, making the network design more data-driven and intelligent.

[0037] Improve overall system performance: By analyzing the communication delay of different segmentation schemes, this coefficient can effectively identify the unreasonable segmentation parts, thereby optimizing the system structure and improving the overall operation efficiency. In practical applications, such as cross-segment communication between the power dispatching center and each substation, excessive delays may cause delays in emergency control and response, affecting system stability. By adjusting the segmentation granularity, the rapid response capability of the power system can be ensured while taking into account safety isolation.

[0038] The specific method for obtaining the cross-segment communication delay influence coefficient is as follows: Obtain the inter-node transmission delay data of each network node during the network security verification of the power system at different network segmentation granularities; The transmission delay data between nodes is standardized to obtain the standardized transmission delay data between nodes; The principal component method is used to analyze the standardized transmission delay data between nodes to obtain the characteristics of the transmission delay data between nodes; Constructing a transmission delay data matrix between nodes based on the characteristics of the transmission delay data between nodes; Calculate the covariance matrix of the transmission delay data matrix between nodes; Perform eigenvalue decomposition on the covariance matrix and analyze and calculate the cross-segment communication delay impact coefficient; The calculation formula of the covariance matrix is:

[0039] In the formula, is the covariance matrix, Q is the number of eigenvalues, is the transmission delay data matrix between nodes; The calculation formula of the cross-segment communication delay impact coefficient is:

[0040] In the formula, is the cross-segment communication delay impact coefficient, is the number of eigenvalues, is the i-th eigenvalue, is the sum of the eigenvalues, H is the number of rows of the transmission delay data matrix between nodes, Q is the number of columns of the transmission delay data matrix between nodes, is the element of the transmission delay data matrix between nodes, is the feature vector corresponding to the transmission delay data between the i-th nodes.

[0041] The false positive and false negative anomaly coefficient is used to measure whether the security verification system will produce false positives or false negatives due to improper segmentation settings under different network segmentation granularities. Especially in fine-grained segmentation, the system needs to process more segments, which increases the workload of the verification system and may cause system overload and the risk of false positives or false negatives. By analyzing this coefficient, the performance of the verification system under different segmentation strategies can be identified, solving the imbalance between the effectiveness of attack isolation and the load of the detection system caused by the segmentation granularity being too fine or too coarse in traditional empirical settings.

[0042] Analyzing the false positive and false negative anomaly coefficient has the following advantages in solving the problem that the setting of network segmentation granularity is based on experience, which leads to an imbalance between the effectiveness of isolating attacks and affecting network efficiency: Quantitative evaluation of system accuracy: Through the false positive and false negative anomaly coefficient, the accuracy of the verification system at different network segmentation granularities can be quantified to avoid relying solely on empirical settings. Especially in fine-grained segmentation, the detection system may face a large number of security events. This coefficient can identify the risks of false positives and false negatives caused by overly fine segmentation, which helps to adjust the segmentation strategy so that the system can maintain efficient and accurate detection capabilities when dealing with complex threats.

[0043] Balance isolation and detection load: By analyzing this coefficient, it can be clearly seen that although fine-grained segmentation can enhance the isolation effect, it may cause the verification system to overload and generate the risk of false positives and false negatives. At this time, the false positive and false negative anomaly coefficient can help network designers find the best balance between security isolation and detection load, avoiding detection bottlenecks caused by excessive segmentation and ensuring effective protection of the network against attacks.

[0044] Dynamically optimize the segmentation scheme: This coefficient provides a basis for dynamically adjusting the segmentation granularity. In different network scenarios, the system has different tolerances for false positives and false negatives. The false positive and false negative anomaly coefficient can adjust the segmentation scheme through real-time feedback, allowing the network to flexibly adjust in different scenarios, reducing the rigidity caused by fixed experience settings, and ensuring that the network always maintains efficient security detection capabilities in a dynamic environment.

[0045] Improve network efficiency and attack defense capabilities: By monitoring the anomaly coefficient of false positives and missed positives, the system can avoid unnecessary processing overhead caused by too many fine-grained segments. Appropriate segmentation granularity can not only improve detection efficiency, but also prevent detection overload, thereby effectively improving the overall network operation efficiency and attack defense capabilities, and achieving dual protection of security and efficiency.

[0046] Reduce operation and maintenance costs: False alarms and missed alarms directly affect the workload of the security team. By analyzing the abnormal coefficient of false alarms and missed alarms, unnecessary alarms can be reduced, the actual response rate of the verification system can be improved, and misjudgments and waste of resources caused by false alarms can be avoided, thereby reducing operation and maintenance costs. This advantage is particularly important in complex power system networks, ensuring the continuity and efficiency of system security operation and maintenance.

[0047] The specific method for obtaining the false positive or false negative anomaly coefficient is as follows: Based on the false positive and false negative anomalies of the security review, obtaining a review anomaly set, wherein the review anomaly set includes the types of the false positive and false negative anomalies and the average false positive and false negative rates; The average false positive and false negative rates corresponding to various false positive and false negative anomalies in the review anomaly set are used as the anomaly type weight; Anomaly false positive and false negative regression models are constructed based on the review anomaly set and the corresponding anomaly type weights to generate false positive and false negative anomaly coefficients.

[0048] The specific calculation formula of the false alarm and missed alarm anomaly coefficient is as follows:

[0049] In the formula, is the false positive and false negative anomaly coefficient, … is the anomaly type weight corresponding to false positive and false negative anomalies, … is the proportion of false positives and missed negatives in all total anomalies, is the computing power consumed by false positive and false negative anomalies, and n is the number of false positive and false negative anomalies.

[0050] The intrusion detection efficiency impact coefficient is used to evaluate the performance of the intrusion detection system at different network segmentation granularities, including the ability to detect and prevent potential attacks and the response speed of security verification. By conducting intrusion detection experiments under each segmentation scheme, the impact of different granularity segments on the detection effect can be observed, thereby quantifying the detection efficiency and response time of the system under a specific segmentation strategy. This coefficient helps identify the contradiction between effectiveness and efficiency that may exist in the segmentation setting process, ensuring that network segmentation can effectively enhance security protection capabilities while not significantly reducing the speed of security verification, thereby optimizing the setting of segmentation granularity.

[0051] Analyzing the intrusion detection efficiency impact coefficient has the following advantages in solving the problem that the setting of network segmentation granularity is based on experience, which leads to an imbalance between the effectiveness of isolating attacks and the impact on network efficiency: Quantifying intrusion detection capabilities: This coefficient can quantify the actual performance of the intrusion detection system at different segmentation granularities, providing a direct assessment of the ability to identify and prevent potential attacks. By comparing segmentation schemes of different granularities, you can clearly understand which settings can more effectively capture intrusion events and avoid security blind spots caused by empirical settings.

[0052] Optimize the selection of segmentation schemes: The intrusion detection efficiency impact coefficient enables network designers to compare multiple segmentation schemes and find the optimal segmentation granularity. In finer segments, the isolation effect may be improved, but at the same time, the efficiency of intrusion detection may be affected. This coefficient helps identify the best balance point to ensure that attacks can be effectively prevented without significantly affecting the system's response speed.

[0053] Improve response speed: By monitoring the security verification response speed at different segmentation granularities, the intrusion detection efficiency impact coefficient can guide network designers to optimize the system's real-time detection capabilities while maintaining high security. This is especially important for scenarios with high real-time requirements such as power systems, ensuring rapid response when facing attacks and reducing potential losses.

[0054] Dynamic adjustment and adaptability: The intrusion detection efficiency impact coefficient provides a basis for dynamically adjusting the segmentation granularity, allowing the network segmentation strategy to be optimized according to the actual operating environment and changes in attack patterns. For example, when the attack risk is high, a finer segmentation can be selected to improve the detection capability; when the operating load is high, the segmentation can be appropriately adjusted to improve the detection efficiency.

[0055] Reduce the risk of false alarms and missed alarms: By analyzing the intrusion detection effects at different segmentation granularities, the intrusion detection efficiency impact coefficient can help identify segmentation settings that may cause false alarms or missed alarms, thereby optimizing network segmentation, reducing unnecessary alarms and the burden on the detection system, and improving the overall work efficiency of the system.

[0056] Improve overall network security: By optimizing the network segmentation granularity to improve intrusion detection efficiency, this coefficient can enhance the network security of the entire power system, ensuring that it can maintain high detection efficiency and response capabilities when facing complex attacks, thereby effectively reducing system risks and improving its anti-attack capabilities.

[0057] The specific method for obtaining the intrusion detection efficiency influence coefficient is as follows: Intrusion detection experiments are conducted under each segmentation scheme to obtain the number of intrusion detections, the total number of intrusions, and the propagation bandwidth of network nodes corresponding to a specific network segmentation granularity in the power grid system, and calculate the intrusion detection efficiency; The intrusion detection efficiency at a preset time interval within a period of time is obtained, an intrusion detection efficiency set is constructed, data analysis is performed on the intrusion detection efficiency set, and the intrusion detection efficiency influence coefficient is calculated.

[0058] The specific calculation formula of the intrusion detection efficiency is as follows:

[0059] The specific calculation formula of the intrusion detection efficiency influence coefficient is as follows:

[0060] In the formula, For intrusion detection efficiency, is the number of times the node’s intrusion is detected, is the total number of intrusions, is the node number, , p is the total number of network nodes, is the response rate of the node, is the propagation bandwidth of the node; is the label of the topological relationship of the node, , q is the total number of topological relationships of nodes; is the intrusion detection efficiency influence coefficient, is the xth intrusion detection efficiency in the intrusion detection efficiency set, is the preset standard intrusion detection efficiency, and g is the total amount of data in the intrusion detection efficiency set.

[0061] This embodiment significantly improves the security and communication efficiency of the power network by reasonably setting the segmentation granularity and combining it with random number processing. First, the method achieves effective segmentation of the power system network architecture by adjusting the number of segments, isolation methods and depth, so that the segmentation scheme matches the actual communication needs, thereby enhancing the isolation strength of the network and reducing the risk of attacks. Secondly, the introduction of random numbers ensures the diversity of segmentation schemes, avoids subjective bias caused by empirical settings, and helps to find the best balance between large granularity and fine granularity, which not only improves the ability to protect against attacks, but also ensures communication efficiency. In addition, by analyzing the cross-segment communication delay influence coefficient, false alarm and missed alarm anomaly coefficient and intrusion detection efficiency influence coefficient, this method can quantify the impact of network segmentation on actual operation, optimize the segmentation scheme, and ensure that the power system can respond quickly and maintain efficient operation performance when facing complex security threats, ultimately improving the overall security and efficiency of the system.

[0062] Embodiment 2, S3, builds a segmented granularity assessment model based on a convolutional neural network according to actual application demand data and safety verification effect data, and generates a segmented granularity assessment coefficient.

[0063] The segmented granularity assessment model is constructed based on the convolutional neural network according to the actual application demand data and the safety verification effect data to generate the segmented granularity assessment coefficient, which is specifically: The acquired cross-segment communication delay impact coefficient, false positive and false negative anomaly coefficient, and intrusion detection efficiency impact coefficient are used to establish a segment granularity assessment model to generate a segment granularity assessment coefficient. The specific calculation formula of the segmented particle size evaluation coefficient is as follows:

[0064] In the formula, is the segmented granularity evaluation coefficient, is the preset proportional coefficient of the cross-segment communication delay impact coefficient, is the preset proportional coefficient of the false alarm and missed alarm anomaly coefficient, is the preset proportional coefficient of the intrusion detection efficiency influence coefficient, is the cross-segment communication delay impact coefficient, is the false positive and false negative anomaly coefficient, is the intrusion detection efficiency influence coefficient.

[0065] S4, constructing a two-dimensional relationship curve between the segmentation granularity assessment coefficient and the corresponding network segmentation granularity, and performing data analysis on the two-dimensional relationship curve to determine the network segmentation granularity that best matches the preset verification mode, and apply it to the power system network security verification.

[0066] The two-dimensional relationship curve between the segmentation granularity evaluation coefficient and the corresponding network segmentation granularity is constructed as follows: Obtain different output segmentation granularity assessment coefficients from segmentation granularity assessment models under different network segmentation granularities; A rectangular coordinate system is established, with the horizontal axis representing the network segmentation granularity and the vertical axis representing the segmentation granularity assessment coefficient; Mark the segmentation granularity assessment coefficient corresponding to each network segmentation granularity on the rectangular coordinate system to form a data point; Connect data points to construct a two-dimensional relationship curve.

[0067] The two-dimensional relationship curve is analyzed to determine the network segmentation granularity that best matches the preset verification mode, and is applied to the power system network security verification, specifically: Obtaining corresponding segmentation granularity adjustment parameters according to a preset verification mode, and obtaining corresponding basic segmentation granularity according to the corresponding segmentation granularity adjustment parameters; The network segmentation granularity obtained by random number processing based on the basic segmentation granularity is marked, and the network segmentation granularity corresponding to the largest segmentation granularity evaluation coefficient after marking and whose quadratic derivative function is closest to zero is taken as the most matching network segmentation granularity and applied to the power system network security verification.

[0068] This embodiment constructs a segmentation granularity assessment model based on a convolutional neural network, and combines the cross-segment communication delay impact coefficient, the false alarm and missed alarm anomaly coefficient, and the intrusion detection efficiency impact coefficient to effectively generate a segmentation granularity assessment coefficient. The technical effect of this method is that it realizes the scientific evaluation of the network segmentation of the power system, and can intuitively reflect the impact of different segmentation granularities on the safety verification effect. By constructing a two-dimensional relationship curve and performing data analysis, it is possible to accurately determine the network segmentation granularity that best matches the preset verification mode, thereby optimizing the network architecture and improving overall security and communication efficiency. The advantage of this technology lies in its flexibility and adaptability. It can not only cope with complex security threats, but also can be dynamically adjusted according to actual application needs to ensure the stable operation of the power system in a high-risk environment.

[0069] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0070] The above embodiments may be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0071] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0072] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0073] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0074] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for automatic identification of power system network security verification, characterized in that: The steps include: According to the network architecture and segmentation granularity adjustment parameters of the power system, the basic segmentation granularity is set, and the basic segmentation granularity is processed several times in combination with random numbers to obtain several groups of network segmentation granularities; Obtaining actual application demand data at several groups of network segmentation granularities and security verification effect data at several groups of network segmentation granularities; According to the actual application demand data and safety verification effect data, a segmented granularity assessment model is built based on a convolutional neural network to generate a segmented granularity assessment coefficient; A two-dimensional relationship curve is constructed between the segmentation granularity assessment coefficient and the corresponding network segmentation granularity, and data analysis is performed on the two-dimensional relationship curve to determine the network segmentation granularity that best matches the preset verification mode and apply it to the power system network security verification.

2. The automatic identification method for power system network security verification according to claim 1 is characterized in that: The segmentation granularity adjustment parameters include the number of segments, segmentation isolation mode and segmentation depth; The basic segmentation granularity is set according to the network architecture and segmentation granularity adjustment parameters of the power system, specifically: Collect and organize the functional module division and equipment distribution of the power system, list the main network nodes, and build the network architecture of the power system based on the communication relationship between different functional modules or equipment; Initial segmentation of the power system network architecture based on functional segmentation, equipment segmentation, and geographical segmentation; The initial segmentation is set according to any one of the segmentation granularity adjustment parameters to obtain a number of basic segmentation granularities; Based on computer random numbers, several basic segmentation granularities are perturbed several times to obtain several groups of network segmentation granularities.

3. The automatic identification method for power system network security verification according to claim 2 is characterized in that: The actual application demand data includes a cross-segment communication delay impact coefficient; the specific method for obtaining the cross-segment communication delay impact coefficient is as follows: Obtain the inter-node transmission delay data of each network node during the network security verification of the power system at different network segment granularities; The transmission delay data between nodes is standardized to obtain the standardized transmission delay data between nodes; The principal component method is used to analyze the standardized transmission delay data between nodes to obtain the characteristics of the transmission delay data between nodes; Constructing a transmission delay data matrix between nodes based on the characteristics of the transmission delay data between nodes; Calculate the covariance matrix of the transmission delay data matrix between nodes; The covariance matrix is ​​decomposed by eigenvalues, and the cross-segment communication delay impact coefficient is analyzed and calculated.

4. The automatic identification method for power system network security verification according to claim 3 is characterized in that: The security verification effect data includes the false positive and false negative anomaly coefficient and the intrusion detection efficiency impact coefficient; the specific method for obtaining the false positive and false negative anomaly coefficient is as follows: Based on the false positive and false negative anomalies of the security review, obtaining a review anomaly set, wherein the review anomaly set includes the types of the false positive and false negative anomalies and the average false positive and false negative rates; The average false positive and false negative rates corresponding to various false positive and false negative anomalies in the review anomaly set are used as the anomaly type weight; Anomaly false positive and false negative regression models are constructed based on the review anomaly set and the corresponding anomaly type weights to generate false positive and false negative anomaly coefficients.

5. The automatic identification method for power system network security verification according to claim 4 is characterized in that: The specific method for obtaining the intrusion detection efficiency influence coefficient is as follows: Intrusion detection experiments are conducted under each segmentation scheme to obtain the number of intrusion detections, the total number of intrusions, and the propagation bandwidth of network nodes corresponding to a specific network segmentation granularity in the power grid system, and calculate the intrusion detection efficiency; The intrusion detection efficiency at a preset time interval within a period of time is obtained, an intrusion detection efficiency set is constructed, data analysis is performed on the intrusion detection efficiency set, and the intrusion detection efficiency influence coefficient is calculated.

6. The automatic identification method for power system network security verification according to claim 5 is characterized in that: The two-dimensional relationship curve between the segmentation granularity evaluation coefficient and the corresponding network segmentation granularity is constructed as follows: Obtain different output segmentation granularity assessment coefficients from segmentation granularity assessment models under different network segmentation granularities; A rectangular coordinate system is established, with the horizontal axis representing the network segmentation granularity and the vertical axis representing the segmentation granularity assessment coefficient; Mark the segmentation granularity assessment coefficient corresponding to each network segmentation granularity on the rectangular coordinate system to form a data point; Connect data points to construct a two-dimensional relationship curve.

7. The automatic identification method for power system network security verification according to claim 6 is characterized in that: The two-dimensional relationship curve is analyzed to determine the network segmentation granularity that best matches the preset verification mode, and is applied to the power system network security verification, specifically: Obtaining corresponding segmentation granularity adjustment parameters according to a preset verification mode, and obtaining corresponding basic segmentation granularity according to the corresponding segmentation granularity adjustment parameters; The network segmentation granularity obtained by random number processing based on the basic segmentation granularity is marked, and the network segmentation granularity corresponding to the largest segmentation granularity evaluation coefficient after marking and whose quadratic derivative function is closest to zero is taken as the most matching network segmentation granularity and applied to the power system network security verification.

8. The automatic identification method for power system network security verification according to claim 7 is characterized in that: The calculation formula of the cross-segment communication delay impact coefficient is: In the formula, is the cross-segment communication delay impact coefficient, is the number of eigenvalues, is the i-th eigenvalue, is the sum of the eigenvalues, H is the number of rows of the transmission delay data matrix between nodes, Q is the number of columns of the transmission delay data matrix between nodes, is the element of the transmission delay data matrix between nodes, is the feature vector corresponding to the transmission delay data between the i-th nodes.

9. The automatic identification method for power system network security verification according to claim 8 is characterized in that: The specific calculation formula of the false alarm and missed alarm anomaly coefficient is as follows: In the formula, is the false positive and false negative anomaly coefficient, … is the anomaly type weight corresponding to false positive and false negative anomalies, … is the proportion of false positives and missed negatives in all total anomalies, is the computing power consumed by false positive and false negative anomalies, and n is the number of false positive and false negative anomalies.

10. The automatic identification method for power system network security verification according to claim 9 is characterized in that: The specific calculation formula of the intrusion detection efficiency is as follows: The specific calculation formula of the intrusion detection efficiency influence coefficient is as follows: In the formula, For intrusion detection efficiency, is the number of times the node’s intrusion is detected, is the total number of intrusions, is the node number, , p is the total number of network nodes, is the response rate of the node, is the propagation bandwidth of the node; is the label of the topological relationship of the node, , q is the total number of topological relationships of nodes; is the intrusion detection efficiency influence coefficient, is the xth intrusion detection efficiency in the intrusion detection efficiency set, is the preset standard intrusion detection efficiency, and g is the total amount of data in the intrusion detection efficiency set.

Images