Method and system for constructing and updating hardware asset portrait library of power monitoring system

Abstract

The invention discloses a method and system for constructing and updating a hardware asset portrait library of a power monitoring system, and relates to the technical field of cyberspace security, and the method comprises the steps: constructing a cyberspace hardware asset portrait library label of the power monitoring system, and carrying out the data processing; constructing a power monitoring system network space hardware asset portrait library, defining asset data attributes and calculating attribute similarity; and calculating a judgment index of the asset data attribute, and updating the hardware asset portrait library. According to the method, asset data are divided into three first-level labels and the data are converted into digital codes through label construction and data processing, so that standardized classification of equipment information is realized, the data storage efficiency and the standardization degree are improved, and convenience is provided for data sharing and exchange; through construction of the portrait library and calculation of judgment indexes of asset data attributes, data support is provided for security risk assessment, and operators can be helped to quickly position potential risks.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a method and system for constructing and updating a hardware asset portrait library of an electric power monitoring system. Background Art

[0002] As a core component of modern power systems, power monitoring systems undertake the key tasks of real-time monitoring, control and management of power equipment. With the advancement of power informatization and the continuous development of network technology, the scale and complexity of power monitoring systems are gradually increasing, and the cyberspace hardware assets involved are also increasing. At the same time, due to the increasing openness and complexity of cyberspace, power monitoring systems face security threats from all aspects. Therefore, it is particularly important to manage the cyberspace hardware assets of power monitoring systems comprehensively and accurately. Asset profiling is a management model that collects information from multiple dimensions of assets and describes and classifies them in detail. By building an asset profiling library, the hardware assets of the cyberspace of the power monitoring system can be described and recorded in detail, including key information such as the model, configuration, status, and location of the equipment. This information can provide strong data support for security management and help managers quickly locate and analyze potential security risks. At the same time, by building and updating the asset profiling library, the comprehensive and accurate management and protection of the cyberspace hardware assets of the power monitoring system can be achieved, and the security protection capability of the power system can be improved.

[0003] At present, there are still many problems in the construction of the spatial hardware asset portrait library of the power monitoring system. In terms of asset portrait library construction, when facing the large number of cyberspace hardware assets of the power monitoring system with different models and multi-source heterogeneous data, the operating personnel have the problem of not being able to intuitively and effectively grasp the safety status of the equipment, which is prone to network risk events caused by inadequate monitoring; and in terms of asset portrait library updates, there is a lack of unified and standardized update standards for the update of the cyberspace hardware asset portrait library of the power monitoring system, resulting in large differences in the format, content, update frequency, etc. of the portrait library. This inconsistency and non-standardization have brought difficulties to the sharing, comparison and analysis of the hardware asset portrait library of the power monitoring system, and reduced the use value of the hardware asset portrait library of the power monitoring system. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing technology has the problem that operating personnel cannot intuitively and effectively grasp the safety status of equipment, the update of the power system cyberspace hardware asset portrait library lacks a unified and standardized update standard, and how to reduce the transmission of network risk events and timely evaluate the safety status of assets.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a method for constructing and updating a hardware asset portrait library of a power monitoring system, comprising constructing a power monitoring system cyberspace hardware asset portrait library label and performing data processing; constructing a power monitoring system cyberspace hardware asset portrait library, defining asset data attributes and calculating attribute similarity; calculating judgment indicators of asset data attributes and updating the hardware asset portrait library.

[0007] As a preferred solution of the method for constructing and updating the hardware asset portrait library of the power monitoring system described in the present invention, wherein: the label for constructing the hardware asset portrait library of the power monitoring system cyberspace includes dividing the asset data into three parts: basic attribute W1, business attribute W2, and state attribute W3. W1, W2, and W3 are the first-level labels of the hardware asset portrait library of the power monitoring system cyberspace; the basic attribute W1 includes 6 second-level labels, namely, device type W 11 、Device NameW 12 、Equipment Specifications 13 、ManufacturerW 14 、Electrical parameters W 15 , Department W 16 ; Business attribute W2 includes 8 secondary tags, namely device ID number W 21 、MAC address W 22 、IP address W 23 , Purchase Date W 24 , Attack Type W 25 , Maintenance Records 26 , User login record W 27 、Service life W 28 ; The state attribute W3 includes 9 secondary tags, namely, device state W 31 , Health status 32 , Abnormal Behavior 33 、Environmental threats 34 , Virus Attack W 35 、File ChangeW 36 , peripheral access W 37 、User loginW 38 , malware threats 39 .

[0008] As a preferred solution of the method for constructing and updating the hardware asset portrait library of the power monitoring system described in the present invention, the data processing includes: the Chinese character part in the basic attribute W1 is represented by pinyin, converted into corresponding lowercase English letters, each department is represented by a fixed decimal code, the basic attribute W1 is encoded, and the lowercase English letters, uppercase English letters, numbers, and special symbols of each element in the basic attribute W1 are represented by corresponding AscII codes; the device type W 11 、Device NameW12 Each is allocated 320 bits, and the device specification is W 13 Allocate 160 bits, manufacturer W 14 Allocate 480 bits, electrical parameter W 15 180 positions are allocated, belonging to department W 16 Allocate 8 bits; if the elements in the basic attribute W1 cannot reach the corresponding number of bits, the method of zero padding is used to fill the corresponding number of bits after the insufficient elements; the Chinese characters in the business attribute W2 are expressed in pinyin and converted into corresponding lowercase English letters, and the purchase date W 24 、Service life W 28 It is represented by 6 decimal numbers, the first two digits represent the last two digits of the year, the middle two digits represent the month, and the last two digits represent the day. Each attack type is represented by a fixed decimal code, and the business attribute W2 is encoded. The lowercase English letters, uppercase English letters, numbers, and special symbols of each element in the business attribute W2 are represented by the corresponding AscII code; the device ID number W in the business attribute W2 is 21 Assign 19 bits, MAC address W 22 Allocate 48 bits, IP address W 23 Allocate 128 bits, purchase date W 24 、Service life W 28 Each is allocated 16 bits, attack type W 25 Allocate 8 bits, maintenance record W 26 , User login record W 27 Each is allocated 640 bits; if the elements in the business attribute W2 cannot reach the corresponding number of bits, the corresponding number of bits is filled with zeros after the insufficient elements; in the state attribute W3, when the device state is on, W 31 =1, when the device is off, W 31 =0; when health is good, W 32 =1, when health condition is not good, W 32 =0; when there is no abnormal behavior, W 33 =1, when there is abnormal behavior, W 33 =0; when there is no environmental threat, W 34 =1, when there is an environmental threat, W 34 =0; when there is no virus attack, W 35 =1, when there is a virus attack, W 35 =0; when there is no file change, W 36 =1, when there is a file change, W 36 =0; when there is an external device connected, W 37 =1, when no peripheral is connected, W 37 =0; when a user logs in, W 38 =1, when no user is logged in, W 38=0; when there is a malware threat, W 39 =1, when there is no malware threat, W 39 = 0; construct state attribute set W3 = {W 31 ,W 32 ,W 33 ,W 34 ,W 35 ,W 36 ,W 37 ,W 38 ,W 39}.

[0009] As a preferred solution of the method for constructing and updating the hardware asset portrait library of the power monitoring system described in the present invention, wherein: the construction of the power monitoring system cyberspace hardware asset portrait library includes assuming that there are N hardware devices in the power monitoring system, and the device data is encoded in the device data processing process to obtain W n ,n=1,2,···,N; basic properties of the nth hardware device Respectively expressed as The service attributes of the nth hardware device Respectively expressed as Status attributes of the nth hardware device Respectively expressed as Construct the encoded state attribute set Stored in the power monitoring system cyberspace hardware asset portrait library.

[0010] As a preferred solution of the method for constructing and updating the hardware asset portrait library of the power monitoring system described in the present invention, wherein: the definition of asset data attributes includes determining whether the device data in the hardware asset portrait library of the power monitoring system network space needs to be updated, defining the device to be determined as WN k ,k=1,2,3,···; set device WN k The asset data is divided into basic attributes Business attributes Status attributes are divided into three parts; WN k Basic properties Include device type Device Name Equipment Specifications Production factory Electrical parameters Department WN k Business attributes Include device ID number MAC Address IP address Purchase Date Attack Types Maintenance records User login records Service life WN k Status attributes Including device status Health status Abnormal behavior Environmental threats Virus Attack Document changes Peripheral access User login Malware threats Build WN k The state attribute set is expressed as:

[0011]

[0012] As a preferred solution of the method for constructing and updating the hardware asset portrait library of the power monitoring system described in the present invention, wherein: the calculation of attribute similarity includes: k ,k=1,2,3,···Basic properties In The basic attributes of N devices that already exist in the cyberspace hardware asset portrait library of the power monitoring system In Perform operations one by one and get WN k The basic attribute similarity calculation function WNW1 is expressed as:

[0013]

[0014] in, represents the exclusive OR operation, and Same The result is 0, if different, it is 1; set the device to be judged WN k ,k=1,2,3,···business attributes In The business attributes of N devices that already exist in the cyberspace hardware asset portrait library of the power monitoring system In Perform operations one by one and get WN k The business attribute similarity calculation function D 2j , expressed as:

[0015]

[0016] in, for and The absolute value of the difference is expressed as:

[0017]

[0018] Define WN as the state attribute set of the device to be judged. k The state attribute similarity calculation function is: It is expressed as:

[0019]

[0020] in, Represents the number of elements in the intersection of the two. Represents the number of elements in the union of the two. The value range is 0 to 1. The closer to 1, the more similar the two are, and the closer to 0, the less similar the two are.

[0021] As a preferred solution of the method for constructing and updating the hardware asset image library of the power monitoring system described in the present invention, the judgment index includes: k The basic attribute similarity calculation function WNW1 is expressed as:

[0022]

[0023] WNW1 is used as a judgment indicator for basic attributes. If WNW1=0, it indicates that the basic attribute information of the device is consistent with the existing device basic attribute information in the power monitoring system cyberspace hardware asset portrait library and will not be updated temporarily; if WNW1≠0, the data of the device will be added to the power monitoring system cyberspace hardware asset portrait library; based on WNW1 k The business attribute similarity calculation function D 2j , we get D2 = {D 2j}, j = 1, ..., 8, expressed as:

[0024]

[0025] Define the judgment index D of the business attribute, expressed as:

[0026]

[0027] Based on WN k The state attribute similarity calculation function is: Define the judgment index J of the state attribute, expressed as:

[0028]

[0029] The update standard of the cyberspace hardware asset portrait library of the power monitoring system is defined as updata = {WNW1, D, J}, which is expressed as:

[0030]

[0031] The power monitoring system cyberspace hardware asset portrait library update standard is used to determine whether the power monitoring system cyberspace hardware asset portrait library needs to be updated and the corresponding elements need to be updated.

[0032] Another object of the present invention is to provide a power monitoring system hardware asset portrait library construction and update system, which can update through equipment data to solve the current problem of large differences in portrait library format, content, and update frequency due to the lack of uniformity and standardization in asset portrait library updates.

[0033] As a preferred solution of the power monitoring system hardware asset portrait library construction and update system described in the present invention, it includes: a data processing module, a similarity calculation module, and a data update module; the data processing module is used to construct the power monitoring system cyberspace hardware asset portrait library label and perform data processing; the similarity calculation module is used to construct the power monitoring system cyberspace hardware asset portrait library, define asset data attributes and calculate attribute similarity; the data update module is used to calculate the judgment index of asset data attributes and update the hardware asset portrait library.

[0034] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a method for constructing and updating a hardware asset portrait library of a power monitoring system.

[0035] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for constructing and updating a hardware asset portrait library of a power monitoring system.

[0036] Beneficial effects of the present invention: The method for constructing and updating a hardware asset portrait library of a power monitoring system provided by the present invention constructs hardware asset portrait library tags, divides asset data into three first-level tags and further subdivides them, thereby realizing standardized classification of equipment information and facilitating management and query; by processing data, Chinese characters, dates and other information are converted into digital codes, thereby reducing data storage space and improving data storage efficiency, and at the same time, data of different types and formats can be converted into standardized digital codes to facilitate data sharing and exchange between different systems; by constructing a hardware asset portrait library in the cyberspace of the power monitoring system, the similarity of asset data attributes is calculated, which can not only provide data support for security risk assessment, but also help operating personnel quickly locate and analyze potential security risks; by calculating the judgment index of asset data attributes and updating the hardware asset portrait library in a timely manner, it can not only ensure that the equipment information stored in the portrait library is consistent with the actual situation, but also help operating personnel to promptly discover and respond to security threats, thereby improving the security protection capability of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0038] Figure 1 An overall flow chart of a method for constructing and updating a hardware asset portrait library of a power monitoring system provided in the first embodiment of the present invention.

[0039] Figure 2 An overall flow chart of a power monitoring system hardware asset portrait library construction and update system provided in the third embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0041] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a method for constructing and updating a hardware asset portrait library of a power monitoring system, comprising:

[0042] S1: Construct the cyberspace hardware asset portrait library label of the power monitoring system and perform data processing.

[0043] Furthermore, the construction of the power monitoring system cyberspace hardware asset portrait library label includes dividing the asset data into three parts: basic attribute W1, business attribute W2, and status attribute W3. W1, W2, and W3 are the first-level labels of the power monitoring system cyberspace hardware asset portrait library; the basic attribute W1 includes 6 second-level labels, namely, device type W 11 、Device NameW 12 、Equipment Specifications 13 、ManufacturerW 14 、Electrical parameters W 15 , Department W 16 ; Business attribute W2 includes 8 secondary tags, namely device ID number W 21 、MAC address W 22 、IP address W 23 , Purchase Date W 24 , Attack Type W 25 , Maintenance Records 26 , User login record W 27 、Service life W 28 ; The state attribute W3 includes 9 secondary tags, namely, device state W 31 , Health status 32 , Abnormal Behavior 33 、Environmental threats 34 , Virus Attack W 35 、File ChangeW 36 , peripheral access W 37 、User loginW 38 , malware threats 39 .

[0044] It should be noted that data processing includes converting the Chinese characters in the basic attribute W1 into corresponding lowercase English letters, representing each department with a fixed decimal code, encoding the basic attribute W1, and representing the lowercase English letters, uppercase English letters, numbers, and special symbols of each element in the basic attribute W1 with corresponding AscII codes; giving the device type W 11 、Device NameW 12 Each is allocated 320 bits, and the device specification is W 13 Allocate 160 bits, manufacturer W 14 Allocate 480 bits, electrical parameter W 15 180 positions are allocated, belonging to department W 16Allocate 8 bits; if the elements in the basic attribute W1 cannot reach the corresponding number of bits, the method of zero padding is used to fill the corresponding number of bits after the insufficient elements; the Chinese characters in the business attribute W2 are expressed in pinyin and converted into corresponding lowercase English letters, and the purchase date W 24 、Service life W 28 It is represented by 6 decimal numbers, the first two digits represent the last two digits of the year, the middle two digits represent the month, and the last two digits represent the day. Each attack type is represented by a fixed decimal code, and the business attribute W2 is encoded. The lowercase English letters, uppercase English letters, numbers, and special symbols of each element in the business attribute W2 are represented by the corresponding AscII code; the device ID number W in the business attribute W2 is 21 Assign 19 bits, MAC address W 22 Allocate 48 bits, IP address W 23 Allocate 128 bits, purchase date W 24 、Service life W 28 Each is allocated 16 bits, attack type W 25 Allocate 8 bits, maintenance record W 26 , User login record W 27 Each is allocated 640 bits; if the elements in the business attribute W2 cannot reach the corresponding number of bits, the corresponding number of bits is filled with zeros after the insufficient elements; in the state attribute W3, when the device state is on, W 31 =1, when the device is off, W 31 =0; when health is good, W 32 =1, when health condition is not good, W 32 =0; when there is no abnormal behavior, W 33 =1, when there is abnormal behavior, W 33 =0; when there is no environmental threat, W 34 =1, when there is an environmental threat, W 34 =0; when there is no virus attack, W 35 =1, when there is a virus attack, W 35 =0; when there is no file change, W 36 =1, when there is a file change, W 36 =0; when there is an external device connected, W 37 =1, when no peripheral is connected, W 37 =0; when a user logs in, W 38 =1, when no user is logged in, W 38 =0; when there is a malware threat, W 39 =1, when there is no malware threat, W 39 = 0; construct state attribute set W3 = {W 31 ,W 32 ,W 33 ,W34 ,W 35 ,W 36 ,W 37 ,W 38 ,W 39}.

[0045] It should also be noted that the construction of the power monitoring system cyberspace hardware asset portrait library label is to divide the data of the power monitoring system cyberspace hardware assets into three first-level labels, namely basic attributes, business attributes, and status attributes, and at the same time subdivide them into multiple second-level labels under each first-level label. This classification method makes the asset data clearer and more orderly, and convenient for management and query; data processing is to convert Chinese characters, dates and other information in basic attributes and business attributes into data codes, unify data of different types and formats into digital codes, convert each element in the status attribute into binary code, and construct a state attribute set. This method reduces data storage space while improving data storage efficiency, and digital coding is for the convenience of data sharing and exchange between different systems. In summary, this step realizes data normalization and standardization by classifying and encoding asset data, providing a reliable data foundation for subsequent portrait library construction and updating.

[0046] S2: Build a cyberspace hardware asset portrait library for the power monitoring system, define asset data attributes and calculate attribute similarity.

[0047] Furthermore, constructing the cyberspace hardware asset portrait library of the power monitoring system includes assuming that there are N hardware devices in the power monitoring system, and the device data is encoded in the device data processing process to obtain W n ,n=1,2,···,N; basic properties of the nth hardware device Respectively expressed as The service attributes of the nth hardware device Respectively expressed as Status attributes of the nth hardware device Respectively expressed as Construct the encoded state attribute set Stored in the power monitoring system cyberspace hardware asset portrait library.

[0048] It should be noted that defining asset data attributes includes determining whether the device data in the cyberspace hardware asset image library of the power monitoring system needs to be updated, and defining the device to be determined as WN k ,k=1,2,3,···; set device WN k The asset data is divided into basic attributes Business attributes Status attributes are divided into three parts; WN k Basic properties Include device type Device Name Equipment Specifications born Manufacturer Electrical parameters Department WN k Business attributes Include device ID number MAC Address IP address Purchase Date Attack Types Maintenance records User login records Service life WN k Status attributes Including device status Health status Abnormal behavior Environmental threats Virus Attack Document changes Peripheral access User login Malware threats Build WN k The state attribute set is expressed as:

[0049]

[0050] It should also be noted that calculating the attribute similarity includes converting the device WN to be judged k ,k=1,2,3,···Basic properties In The basic attributes of N devices that already exist in the cyberspace hardware asset portrait library of the power monitoring system In Perform operations one by one and get WN k The basic attribute similarity calculation function WNW1 is expressed as:

[0051]

[0052] in, represents the exclusive OR operation, and Same The result is 0, if different, it is 1; set the device to be judged WN k,k=1,2,3,···business attributes In The business attributes of N devices that already exist in the cyberspace hardware asset portrait library of the power monitoring system In Perform operations one by one and get WN k The business attribute similarity calculation function D 2j , expressed as:

[0053]

[0054] in, for and The absolute value of the difference is expressed as:

[0055]

[0056] Define WN as the state attribute set of the device to be judged. k The state attribute similarity calculation function is: It is expressed as:

[0057]

[0058] in, Represents the number of elements in the intersection of the two. Represents the number of elements in the union of the two. The value range is 0 to 1. The closer to 1, the more similar the two are, and the closer to 0, the less similar the two are.

[0059] It should also be noted that the construction of the portrait library is to collect data from all hardware devices in the power monitoring system, classify the data of each device according to basic attributes, business attributes, and status attributes, encode the data of each device, and store the encoded data in the hardware asset portrait library; defining asset data attributes is to determine whether the device data in the power monitoring system cyberspace hardware asset portrait library has properties that need to be updated, classify the device data that needs to be updated according to basic attributes, business attributes, and status attributes, and encode the data of each part; calculating attribute similarity is to compare the data in the basic attributes or business attributes or status attributes of the device that needs to be updated with the data in the portrait library. The data of the basic attributes, business attributes or status attributes of the equipment are compared one by one to calculate the similarity. The basic attribute similarity uses XOR operation. If they are the same, the result is 0, and if they are different, the result is 1. The business attribute similarity is calculated by calculating the absolute value of the difference between each attribute. The status attribute similarity is calculated by calculating the intersection and union of two status attribute sets, and calculating the proportion of the intersection to the union. The value range is 0-1. The closer to 1, the more similar. In summary, this step establishes a hardware asset portrait library and manages it in a standardized manner. By calculating the similarity of asset data attributes, it determines whether the device data needs to be updated and how to update it, which provides important data support for subsequent security risk assessment and risk warning.

[0060] S3: Calculate the judgment indicators of asset data attributes and update the hardware asset portrait library.

[0061] Furthermore, the judgment indicators include WN k The basic attribute similarity calculation function WNW1 is expressed as:

[0062]

[0063] WNW1 is used as a judgment indicator for basic attributes. If WNW1=0, it indicates that the basic attribute information of the device is consistent with the existing device basic attribute information in the power monitoring system cyberspace hardware asset portrait library and will not be updated temporarily; if WNW1≠0, the data of the device will be added to the power monitoring system cyberspace hardware asset portrait library; based on WNW1 k The business attribute similarity calculation function D 2j , we get D2 = {D 2j}, j = 1, ..., 8, expressed as:

[0064]

[0065] Define the judgment index D of the business attribute, expressed as:

[0066]

[0067] Based on WNk The state attribute similarity calculation function is: Define the judgment index J of the state attribute, expressed as:

[0068]

[0069] The update standard of the cyberspace hardware asset portrait library of the power monitoring system is defined as updata = {WNW1, D, J}, which is expressed as:

[0070]

[0071] The power monitoring system cyberspace hardware asset portrait library update standard is used to determine whether the power monitoring system cyberspace hardware asset portrait library needs to be updated and the corresponding elements need to be updated.

[0072] It should be noted that the calculation of the judgment index is based on the calculated attribute similarity, and the judgment indexes of the basic attributes, business attributes, and status attributes are calculated respectively. The judgment index is an important indicator for judging whether the device data needs to be updated; judging whether the device data needs to be updated is based on the judgment index. If the device data is consistent with the device data already existing in the portrait library, no update is required. If the device data is inconsistent with the device data already existing in the portrait library, it needs to be updated; updating the hardware asset portrait library is if the device data needs to be updated, then the updated device data is added to the hardware asset portrait library. If the device data does not need to be updated, no operation is performed. The update in this step selects the appropriate update strategy according to the specific situation during the implementation process. The update strategy includes incremental update, full update, and differential update, that is, only updating the changed data and keeping the original data unchanged, completely overwriting the original data with the device data, and only updating the changed data and recording the changed content.

[0073] Example 2 is an embodiment of the present invention, which provides a method for constructing and updating a hardware asset portrait library of a power monitoring system. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0074] First, a substation of a provincial power company was selected as the experimental object, and a portrait library of hardware assets in the cyberspace was constructed and updated. The substation has various hardware equipment, including transformers, circuit breakers, disconnectors, mutual inductors, computers, servers, and network switches.

[0075] First, according to the steps of the method of the present invention, a cyberspace hardware asset portrait library label of the power monitoring system is constructed, and the asset data is divided into three first-level labels: basic attributes, business attributes and status attributes. The basic attributes include six second-level labels: equipment type, equipment name, equipment specifications, manufacturer, electrical parameters, and department; the business attributes include eight second-level labels: equipment ID number, MAC address, IP address, purchase date, attack type, maintenance record, user registration record, and service life; the status attributes include nine second-level labels: equipment status, health status, abnormal behavior, environmental threat, virus attack, file change, peripheral access, user login, and malware threat.

[0076] Secondly, the collected equipment data is processed. The Chinese characters in the basic attributes and business attributes are represented by pinyin and converted into lowercase English letters. Each department is represented by decimal code. For basic attributes, 320 bits are allocated to the equipment type and equipment name, 160 bits to the equipment specifications, 480 bits to the manufacturer, 180 bits to the electrical parameters, and 8 bits to the department. For business attributes, 19 bits are allocated to the equipment ID number, 48 bits to the MAC address, 128 bits to the IP address, 16 bits to the purchase date and service life, 8 bits to the attack type, 640 bits to the maintenance record and user login record, and zero padding is used to fill the missing bits. Binary encoding is used for status attributes, 1 indicates the existence of the state, and 0 indicates the non-existence.

[0077] Finally, a cyberspace hardware asset portrait library of the power monitoring system is constructed, and the processed device data is stored in the portrait library. In order to verify the updating effect of the method of the present invention, 10 devices are selected for monitoring for 30 days, and the status changes of these devices are recorded every day. At the same time, various possible device status changes are simulated during the monitoring period, such as equipment failure, software update, and security incidents. The attribute similarity and judgment index calculations are performed on the data of these 10 devices every day. According to the calculation results, it is determined whether the portrait library needs to be updated, and the update status is recorded to obtain the attribute similarity data record table of 10 data devices per day.

[0078] Table 1 Attribute similarity data record table

[0079]

[0080]

[0081] According to the above data analysis, the method for constructing and updating the hardware asset portrait library of the power monitoring system proposed in the present invention has the ability to reflect the changes in equipment status more promptly, thereby improving the timeliness of the portrait library. The method achieves accurate update judgment by setting an update threshold. When one of the three attribute similarities is lower than the threshold, the system will trigger an update. For example, for server 2 and network switch 1, although the basic attributes and business attributes have high similarity, the update is still triggered because the status attribute similarity is lower than the threshold. The present invention has a high degree of accurate update judgment. The present invention adopts different similarity calculation methods for different types of attributes, reflecting a differentiated update strategy. It can be observed from the data that the change in status attributes is the main reason for triggering the update, which is consistent with the characteristics of the power system equipment. Compared with the traditional full update, the present invention adopts an incremental update method to only update the changed equipment information, which is more resource-saving. Therefore, our invention is creative.

[0082] Example 3, reference Figure 2 , as an embodiment of the present invention, provides a power monitoring system hardware asset portrait library construction and update system, including a portrait library standard component construction module, a data processing module, a portrait library construction module, and a data update module.

[0083] Among them, the portrait library standard component construction module is used for the construction of the portrait library standard components of the power monitoring system cyberspace hardware assets; the data processing module is used for equipment data processing; the portrait library construction module is used for the construction of the portrait library of the power monitoring system cyberspace hardware assets; and the data update module is used for equipment data update.

[0084] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0085] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0086] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0087] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0088] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for constructing and updating a hardware asset portrait library of a power monitoring system, characterized in that: include: Construct a cyberspace hardware asset portrait library label for the power monitoring system and perform data processing; Build a cyberspace hardware asset portrait library for the power monitoring system, define asset data attributes and calculate attribute similarity; Calculate the judgment indicators of asset data attributes and update the hardware asset portrait library.

2. The method for constructing and updating a hardware asset profile library of a power monitoring system according to claim 1, characterized in that: The construction of the power monitoring system cyberspace hardware asset portrait library label includes dividing the asset data into three parts: basic attribute W1, business attribute W2, and state attribute W3. W1, W2, and W3 are used as the first-level labels of the power monitoring system cyberspace hardware asset portrait library; The basic attribute W1 includes 6 secondary tags, namely, device type W 11 、Device NameW 12 、Equipment Specifications 13 、ManufacturerW 14 、Electrical parameters W 15 , Department W 16 ; Business attribute W2 includes 8 secondary tags, namely, device ID number W 21 、MAC address W 22 、IP address W 23 , Purchase Date W 24 , Attack Type W 25 , Maintenance Records 26 , User login record W 27 、Service life W 28 ; The state attribute W3 includes 9 secondary tags, namely, device state W 31 , Health status 32 , Abnormal Behavior 33 、Environmental threats 34 , Virus Attack W 35 、File ChangeW 36 , peripheral access W 37 、User loginW 38 , malware threats 39 .

3. The method for constructing and updating a hardware asset profile library of a power monitoring system according to claim 2, characterized in that: The data processing includes converting the Chinese character part in the basic attribute W1 into corresponding lowercase English letters by pinyin, and representing each department with a fixed decimal code, encoding the basic attribute W1, and representing the lowercase English letters, uppercase English letters, numbers, and special symbols of each element in the basic attribute W1 by corresponding AscII codes; Give device type W 11 、Device NameW 12 Each is allocated 320 bits, and the device specification is W 13 Allocate 160 bits, manufacturer W 14 Allocate 480 bits, electrical parameter W 15 180 positions are allocated, belonging to department W 16 Allocate 8 bits; If the elements in the basic attribute W1 cannot reach the corresponding number of digits, the corresponding number of digits will be filled after the insufficient elements by using zero padding; The Chinese characters in the business attribute W2 are expressed in pinyin and converted into corresponding lowercase English letters. 24 、Service life W 28 It is represented by 6 decimal numbers, the first two digits represent the last two digits of the year, the middle two digits represent the month, and the last two digits represent the day. Each attack type is represented by a fixed decimal code, and the business attribute W2 is encoded. The lowercase English letters, uppercase English letters, numbers, and special symbols of each element in the business attribute W2 are represented by the corresponding AscII code; Give the device ID number W in the business attribute W2 21 Assign 19 bits, MAC address W 22 Allocate 48 bits, IP address W 23 Allocate 128 bits, purchase date W 24 、Service life W 28 Each is allocated 16 bits, attack type W 25 Allocate 8 bits, maintenance record W 26 , User login record W 27 Each is allocated 640 bits; If the elements in the business attribute W2 cannot reach the corresponding number of digits, the corresponding number of digits will be filled by zero padding after the insufficient elements; In the state attribute W3, when the device state is on, W 31 =1, when the device is off, W 31 =0; When health is good, W 32 =1, when health condition is not good, W 32 =0; When there is no abnormal behavior, W 33 =1, when there is abnormal behavior, W 33 =0; When there is no environmental threat, W 34 =1, when there is an environmental threat, W 34 =0; When there is no virus attack, W 35 =1, when there is a virus attack, W 35 =0; When there is no file change, W 36 =1, when there is a file change, W 36 =0; When there is a peripheral connected, W 37 =1, when no peripheral is connected, W 37 =0; When a user logs in, W 38 =1, when no user is logged in, W 38 =0; When there is a malware threat, W 39 =1, when there is no malware threat, W 39 =0; Build state attribute set W3 = {W 31 ,W 32 ,W 33 ,W 34 ,W 35 ,W 36 ,W 37 ,W 38 ,W 39 }.

4. The method for constructing and updating a hardware asset profile library of a power monitoring system according to claim 3, characterized in that: The construction of the cyberspace hardware asset portrait library of the power monitoring system includes assuming that there are N hardware devices in the power monitoring system, and the device data is encoded in the device data processing process to obtain W n ,n=1,2,···,N; Basic properties of the nth hardware device Respectively expressed as The service attributes of the nth hardware device Respectively expressed as Status attributes of the nth hardware device Respectively expressed as Construct the encoded state attribute set Stored in the power monitoring system cyberspace hardware asset portrait library.

5. The method for constructing and updating a hardware asset profile library of a power monitoring system according to claim 4, characterized in that: The definition of asset data attributes includes determining whether the device data in the power monitoring system cyberspace hardware asset portrait library needs to be updated, and defining the device to be determined as WN k ,k=1,2,3,···; Connect the device to k The asset data is divided into basic attributes Business attributes The state attribute has three parts; WN k Basic properties Include device type Device Name Equipment Specifications Production factory Electrical parameters Department WN k Business attributes Include device ID number MAC Address IP address Purchase Date Attack Types Maintenance records User login records Service life WN k Status attributes Including device status Health status Abnormal behavior Environmental threats Virus Attack Document changes Peripheral access User login Malware threats Build WN k The state attribute set is expressed as:

6. The method for constructing and updating a hardware asset profile library of a power monitoring system according to claim 5, characterized in that: The calculation of attribute similarity includes: k ,k=1,2,3,···Basic properties In The basic attributes of N devices that already exist in the cyberspace hardware asset portrait library of the power monitoring system In Perform operations one by one and get WN k The basic attribute similarity calculation function WNW1 is expressed as: in, represents the XOR operation, and Same The result is 0, and 1 if different; Set the device to be judged WN k ,k=1,2,3,···business attributes In The business attributes of N devices that already exist in the cyberspace hardware asset portrait library of the power monitoring system In Perform operations one by one and get WN k The business attribute similarity calculation function D 2j , expressed as: in, for and The absolute value of the difference is expressed as: Define WN as the state attribute set of the device to be judged. k The state attribute similarity calculation function is: It is expressed as: in, Represents the number of elements in the intersection of the two. Represents the number of elements in the union of the two. The value range is 0 to 1. The closer to 1, the more similar the two are, and the closer to 0, the less similar the two are.

7. The method for constructing and updating a hardware asset profile library of a power monitoring system according to claim 6, characterized in that: The judgment index includes based on WN k The basic attribute similarity calculation function WNW1 is expressed as: WNW1 is used as a judgment indicator for basic attributes. If WNW1 = 0, it means that the basic attribute information of the device is consistent with the existing device basic attribute information in the cyberspace hardware asset portrait library of the power monitoring system, and it will not be updated for the time being; If WNW1≠0, the data of the device is added to the cyberspace hardware asset portrait library of the power monitoring system; Based on WN k The business attribute similarity calculation function D 2j , we get D2 = {D 2j }, j = 1, ..., 8, expressed as: Define the judgment index D of the business attribute, expressed as: Based on WN k The state attribute similarity calculation function is: Define the judgment index J of the state attribute, expressed as: The update standard of the cyberspace hardware asset portrait library of the power monitoring system is defined as updata = {WNW1, D, J}, which is expressed as: The power monitoring system cyberspace hardware asset portrait library update standard is used to determine whether the power monitoring system cyberspace hardware asset portrait library needs to be updated and the corresponding elements need to be updated.

8. A system using the method for constructing and updating a hardware asset profile library of a power monitoring system according to any one of claims 1 to 7, characterized in that: It includes data processing module, similarity calculation module and data updating module; The data processing module is used to construct a cyberspace hardware asset portrait library tag for the power monitoring system and perform data processing; The similarity calculation module is used to construct a cyberspace hardware asset portrait library for the power monitoring system, define asset data attributes and calculate attribute similarity; The data update module is used to calculate the judgment index of the asset data attribute and update the hardware asset portrait library.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for constructing and updating the hardware asset portrait library of the power monitoring system described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for constructing and updating a hardware asset portrait library of a power monitoring system according to any one of claims 1 to 7 are implemented.

Images