Smart power grid online safety operation and maintenance management method and system

Abstract

The invention discloses an intelligent power grid online safety operation and maintenance management method and system, and relates to the technical field of computer platform load balancing, and the method comprises the steps: obtaining data based on first collection, and recognizing a safety threat; performing first isolation on the threat, and storing security data; and emergency response and safety optimization are carried out. According to the intelligent power grid online safety operation and maintenance management method provided by the invention, rapid processing is carried out through a containerized threat isolation method, the safety and reliability of data are ensured through distributed storage, threat diffusion is effectively prevented, and protection of safety data is realized. And event tracking and safety evaluation report generation are carried out through the operation and maintenance management platform, autonomous and efficient emergency response and safety optimization are realized, and the safety protection capability of the power grid is comprehensively improved. The method has better effects in the aspects of reliability, timeliness and safety.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid security operation and maintenance, and specifically to a smart power grid online security operation and maintenance management method and system. Background Art

[0002] In the development of modern smart grids, the widespread application of information and intelligent technologies has greatly improved the operating efficiency and response speed of power grid systems. The digital construction of traditional power grids, based on real-time monitoring, data collection, fault diagnosis and other technologies, has realized remote management of power grid equipment, user terminals and network connections. With the introduction of microservice architecture, distributed computing and cloud platform technology, smart grids can perform distributed data collection, fault monitoring, flow control and automated operation and maintenance with higher efficiency, ensuring the reliability and continuity of power services. However, the security operation and maintenance technology of smart grids has gradually become weak in the face of increasingly complex security threats. The current smart grid operation and maintenance system faces multiple problems such as large-scale concurrency, data transmission security, and potential malicious traffic interference, requiring more intelligent online security operation and maintenance management methods.

[0003] There are many limitations in the existing smart grid operation and maintenance technology. First, most of the traditional power grid operation and maintenance monitoring technologies adopt centralized or single data collection methods, which are difficult to cover the multi-level and multi-node requirements of the entire power grid. A single data collection method is difficult to adapt to the complex microservice architecture, especially in the huge business network of the Southern Power Grid, where traditional collection methods cannot meet the requirements of real-time and full-link monitoring. In addition, when facing security threats, the existing technology lacks a flexible isolation mechanism, and cannot quickly locate the source of the fault and effectively isolate the threatened node, which may cause the threat to spread further and affect the stability of the overall system. Furthermore, the storage method of traditional power grid security data is also lacking in data encryption and backup redundancy, making it difficult to perform distributed encrypted storage of a large amount of security data, resulting in reduced data storage security. For emergency response when the system is threatened, traditional technologies mostly rely on manual intervention and cannot automatically isolate and block. In addition, the existing system lacks a real-time security optimization and operation and maintenance management platform, making it difficult to efficiently track events and conduct historical analysis. These technical deficiencies have caused the existing smart grid operation and maintenance system to be unable to meet the needs of the intelligent development of modern power grids in terms of security protection, isolation response and data storage. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing power grid operation and maintenance methods have limited data collection scope and insufficient threat isolation capabilities, and how to overcome the problem of low data storage security

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a smart grid online security operation and maintenance management method, comprising acquiring data based on a first acquisition and identifying security threats; performing a first isolation of threats and storing security data; and performing emergency response and security optimization.

[0007] As a preferred solution of the smart grid online security operation and maintenance management method described in the present invention, wherein: acquiring data based on the first acquisition includes the system acquiring full-link data in real time.

[0008] As a preferred solution of the smart grid online security operation and maintenance management method described in the present invention, identifying security threats includes identifying security threats and querying attack sources.

[0009] As a preferred solution of the smart grid online security operation and maintenance management method described in the present invention, the first isolation of the threat includes the system performing security isolation according to a preset security policy.

[0010] As a preferred solution of the smart grid online security operation and maintenance management method described in the present invention, storing security data includes encrypting and storing the data and setting access rights.

[0011] As a preferred solution of the smart grid online security operation and maintenance management method described in the present invention, emergency response and security optimization include triggering an emergency plan when a network attack or system intrusion is detected, notifying relevant security operation and maintenance personnel, and blocking the attack path through container scheduling.

[0012] As a preferred solution of the smart grid online security operation and maintenance management method described in the present invention, emergency response and security optimization also include collecting and monitoring security threats through a security operation and maintenance management platform, providing event tracking and fault handling history records, and generating security assessment reports.

[0013] Another object of the present invention is to provide a smart grid online security operation and maintenance management system, which can collect data in real time through distributed probes, can collect multiple data, and comprehensively analyze the operation and maintenance status to solve the problem of incomplete data collection in current power grid operation and maintenance technology.

[0014] As a preferred solution of the smart grid online security operation and maintenance management system described in the present invention, it includes: a data processing module, a security isolation module, and an emergency response module; the data processing module is used to obtain data based on the first acquisition and identify security threats; the security isolation module is used to perform a first isolation of threats and store security data; the emergency response module is used to perform emergency response and security optimization.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a method for online safe operation and maintenance management of a smart grid.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for online safe operation and maintenance management of a smart grid.

[0017] Beneficial effects of the present invention: The smart grid online security operation and maintenance management method provided by the present invention quickly processes through a containerized threat isolation method, and ensures the security and reliability of data through distributed storage, effectively preventing the spread of threats and achieving the protection of secure data. Event tracking and generation of security assessment reports through the operation and maintenance management platform can achieve autonomous and efficient emergency response and security optimization, and comprehensively improve the security protection capabilities of the power grid. The present invention achieves better results in terms of reliability, timeliness and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 An overall flow chart of a smart grid online security operation and maintenance management method provided for the first embodiment of the present invention.

[0020] Figure 2 An overall flow chart of a smart grid online security operation and maintenance management system provided for the third embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0022] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a smart grid online security operation and maintenance management method, comprising:

[0023] S1: Based on the first acquisition data, identify security threats.

[0024] Furthermore, acquiring data based on the first acquisition includes the system acquiring data of the entire link in real time.

[0025] Data types include real-time collection of operating status and security logs of network devices, application services, and container nodes to capture potential security threats.

[0026] Furthermore, the first collection can be a variety of methods, such as a data collection method based on distributed probes or a method of collecting data using edge computing nodes, or other data collection methods that can adapt to the complex and huge operation and maintenance network of the Southern Power Grid.

[0027] As a preferred embodiment, the first detection of the oscillation mode in this embodiment adopts data collection based on distributed probes, and its principle steps are: through distributed probes deployed in various microservice containers, physical nodes and virtual machines, network traffic, application logs, system performance data, etc. are collected in real time. Distributed probes can collect and transmit multi-layer data in real time to ensure coverage of the entire power grid system. Through probes distributed on the Southern Power Grid cloud platform, the security of each layer of equipment is monitored, including the integrity of data transmission and the security of service access.

[0028] In another feasible embodiment, the first acquisition uses edge computing nodes for data acquisition, and its principle steps are: using edge computing nodes, the data acquisition tasks are distributed to multiple nodes at the edge of the power grid network. Local data acquisition and preprocessing are deployed on each edge node. When the load is large, only key data or abnormal data is transmitted to the centralized monitoring platform to reduce the central processing load.

[0029] It should be noted that after acquiring the data, security threats are identified, which includes identifying security threats and querying the attack source. AI algorithms can be used to analyze security logs in real time, identify potential security threats (such as DDoS attacks, SQL injections, malicious traffic, etc.), and quickly perceive abnormal behaviors in the power grid.

[0030] Synchronously analyze network traffic data in real time, detect abnormal traffic patterns or attack behaviors, and find the source of the attack through call chain tracking.

[0031] S2: Isolate threats first and store safe data.

[0032] Furthermore, the first isolation of the threat includes the system performing security isolation according to a preset security policy.

[0033] It should be noted that the first isolation can be an isolation mechanism based on containerization technology, isolation based on network segmentation (Micro-segmentation), or other methods that can achieve security protection and quickly isolate threats.

[0034] As a preferred embodiment, in this embodiment, the first isolation adopts an isolation mechanism based on containerization technology, and the specific method is as follows: in the microservice architecture, each service in the system is encapsulated and run in an independent container. When the system detects a security threat or failure, the affected container is quickly isolated through the Kubernetes orchestration platform.

[0035] As a container management platform, Kubernetes dynamically adjusts container resources through scheduling strategies. After detecting abnormal behavior, it can immediately isolate the attacked service and initiate recovery operations such as container restart or migration.

[0036] In addition, through automatic restart or service replacement, the container is restored to a healthy state to prevent impact on adjacent services, thereby ensuring the timeliness and efficiency of fault isolation.

[0037] Kubernetes will continuously monitor the health status of each container. Once a security threat such as malicious traffic, resource anomalies, or service crashes is detected, it will immediately invoke the Pod isolation policy to place the problematic container into an isolation area and stop connecting to the external network.

[0038] The self-healing mechanism configured in the system will automatically reschedule healthy container instances to ensure uninterrupted service operation. In addition, all abnormal data recorded during the isolation period will be transmitted to the log analysis system to help operation and maintenance personnel conduct subsequent analysis.

[0039] In another feasible embodiment, the first isolation adopts an isolation mechanism based on network segmentation (Micro-segmentation). Network segmentation (Micro-segmentation) is a security strategy based on virtual network isolation, which divides different microservices, network segments, virtual machines or containers in the system into different virtual isolation areas in a fine-grained manner. Under the segmentation strategy, each network segment (or logical area) is subject to independent security policy management.

[0040] When a threat occurs, the system will dynamically adjust the segmentation strategy through network segmentation technology to quickly isolate the threatened segment and separate it from normal business traffic to prevent the lateral spread of attacks or faults.

[0041] As the threat is removed, the system can flexibly restore the network's connection status. The segmented isolation mechanism can not only effectively limit the spread of potential threats, but also cooperate with dynamic traffic control to achieve accurate identification and control of attack behaviors.

[0042] The specific implementation method is that based on SDN (Software Defined Network) technology, the system can flexibly orchestrate network segments. The SDN controller will automatically identify the traffic characteristics between each segment and isolate the attacked network segment based on the detection results of abnormal traffic.

[0043] During the isolation period, the system can implement strict access control policies on the isolated segments and redirect business traffic to unaffected segments or redundant links through dynamic traffic diversion technology to ensure uninterrupted system services.

[0044] The traffic monitoring module at the microservice level will continuously track the traffic characteristics of the isolated area and update the SDN policy library in a timely manner, laying the foundation for rapid response to potential threats in the future.

[0045] Furthermore, storing secure data includes encrypting the data and setting access permissions.

[0046] At the storage level, SM4 domestic cryptographic technology is used to encrypt important business data to ensure that even if the data is illegally obtained, it cannot be cracked and interpreted.

[0047] Use distributed storage technology to provide multiple copies and off-site backup mechanisms to prevent data loss or tampering.

[0048] Set access rights and adopt identity authentication mechanisms through protocols such as OAuth and LDAP to ensure the legitimacy of user identities, and limit user operation permissions based on role-based control (RBAC) to prevent unauthorized users from accessing sensitive data or key businesses.

[0049] During data storage, VPN tunnel and TLS encryption are used for transmission to prevent data from being tampered with or intercepted.

[0050] S3: Conduct emergency response and security optimization.

[0051] Furthermore, emergency response and security optimization include triggering emergency plans, notifying relevant security operations personnel, and blocking attack paths through container scheduling when a network attack or system intrusion is detected. The system will dynamically adjust security response measures according to the severity of the security incident. For example, minor anomalies only trigger alarms, while major security threats will automatically initiate higher-level protection measures such as isolation strategies and network protection.

[0052] It should be noted that emergency response and security optimization also include collecting and monitoring security threats through a security operation and maintenance management platform, providing event tracking and fault handling history records, and generating security assessment reports.

[0053] Example 2, an embodiment of the present invention, provides a smart grid online security operation and maintenance management method. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0054] First, the system is deployed in a simulated smart grid environment, which contains 50 physical nodes, 100 virtual machines and 200 microservice containers. All nodes are distributed in a large power data center and connected to the China Southern Power Grid cloud platform.

[0055] Distributed probes are deployed on each physical node, virtual machine, and microservice container of the power grid to collect network traffic, system performance data, application logs, and other data. Distributed probes collect data every 1 second and upload the data to the central data analysis system of the China Southern Power Grid Cloud Platform in real time. This central system integrates AI algorithms to identify various security threats, including DDoS attacks, SQL injections, and abnormal traffic. The system performs multi-level analysis on the collected data, and once abnormal behavior is detected, the attack source is tracked through call chain analysis.

[0056] After detecting an attack, the system automatically triggers isolation operations according to the preset security policy. The isolation mechanism is based on Kubernetes container orchestration. It isolates the attacked microservice container through policy scheduling, and performs operations such as container restart, migration, and replacement to achieve fault isolation and recovery. To ensure data security, all logs and event data involved are encrypted with SM4 and stored in a distributed storage system. This storage system provides multi-copy redundancy and off-site backup. Data access is based on RBAC control, and user permissions are verified through OAuth and LDAP.

[0057] Table 1 Experimental data comparison table

[0058]

[0059] Through the data in Table 1, we can clearly see the beneficial effects of the invention in many aspects. The data in the table show that in security threat scenarios such as DDoS attacks and SQL injections, the system's distributed probes can identify security threats in real time with a 99% recognition success rate, ensuring the system's security protection capabilities. In addition, parameters such as packet loss rate, network latency, and CPU and memory usage significantly increase when an attack occurs, indicating that the attack has a greater impact on the system's resources, but after the system starts emergency measures such as container isolation and restart, the impact of the attack quickly decreases, further verifying the effectiveness and reliability of the container isolation mechanism.

[0060] Compared with the prior art, the distributed probes in the present invention can quickly perceive anomalies through real-time data collection and analysis, improving the accuracy and response speed of threat identification. When facing complex security threats such as DDoS attacks or SQL injections, traditional methods usually rely on centralized monitoring, which has monitoring blind spots and cannot fully cover the complex operating environment of smart grids. The distributed probe and edge computing node collection method of the present invention can cover the entire link, ensuring the timeliness and comprehensiveness of data collection.

[0061] In terms of threat isolation and recovery, the present invention uses Kubernetes to automatically isolate the attacked container, reschedule and allocate resources, and ensure the continuity and stability of the system. The data table shows that under the attack state, the system successfully started the isolation operation, so that the number of container resource restarts was only 5 times / day, indicating that the isolation measures effectively prevented the spread of threats. Unlike traditional systems that require manual intervention, the automated isolation mechanism of this system can significantly improve response efficiency and reduce manual operation and maintenance costs.

[0062] Finally, in terms of data storage security, the average time consumed for data transmission encryption in Table 1 is 0.6ms, which shows that SM4 encryption and TLS transmission have a slight impact on system performance. In addition, RBAC permission control and multi-copy redundancy mechanisms ensure the secure storage of sensitive data, further improving the reliability of data security. Traditional methods usually use a single storage method, which makes it difficult to balance data encryption and fast access. The multi-level storage strategy of the present invention effectively enhances the data's anti-tampering and protection capabilities.

[0063] Example 3, reference Figure 2 , is an embodiment of the present invention, which provides a smart grid online security operation and maintenance management system, including a data processing module, a security isolation module, and an emergency response module;

[0064] Among them, the data processing module is used to obtain data based on the first collection and identify security threats; the security isolation module is used to perform a first isolation of threats and store security data; and the emergency response module is used to perform emergency response and security optimization.

[0065] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0066] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0067] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0068] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0069] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A smart grid online security operation and maintenance management method, characterized in that: include: Based on the first collected data, identify security threats; First isolate threats and store safe data; Conduct emergency response and security optimization.

2. The smart grid online security operation and maintenance management method according to claim 1, characterized in that: The acquiring of data based on the first acquisition includes the system acquiring data of the entire link in real time.

3. The smart grid online security operation and maintenance management method according to claim 2, characterized in that: The identifying of security threats includes identifying security threats and querying attack sources.

4. The smart grid online security operation and maintenance management method according to claim 3, characterized in that: The first isolation of the threat includes the system performing security isolation according to a preset security policy.

5. The smart grid online security operation and maintenance management method according to claim 4, characterized in that: The storing of secure data includes encrypting and storing the data and setting access rights.

6. The smart grid online security operation and maintenance management method according to claim 5, characterized in that: The emergency response and security optimization include triggering an emergency plan when a network attack or system intrusion is detected, notifying relevant security operation and maintenance personnel, and blocking the attack path through container scheduling.

7. The smart grid online security operation and maintenance management method according to claim 6, characterized in that: The emergency response and security optimization also include collecting and monitoring security threats through a security operation and maintenance management platform, providing event tracking and fault handling history records, and generating security assessment reports.

8. A system using the smart grid online security operation and maintenance management method according to any one of claims 1 to 7, characterized in that: Including data processing module, safety isolation module, emergency response module; The data processing module is used to identify security threats based on the first collected data; The security isolation module is used to perform a first isolation on threats and store security data; The emergency response module is used for emergency response and safety optimization.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the smart grid online security operation and maintenance management method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the smart grid online security operation and maintenance management method described in any one of claims 1 to 7 are implemented.

Images