Three-dimensional risk assessment method and system for network assets of power monitoring system

Abstract

The invention discloses a power monitoring system network asset three-dimensional risk assessment method and system, and relates to the technical field of power monitoring system security, and the method comprises the steps: constructing a power monitoring system network asset comprehensive evaluation index system; risk assessment robustness is calculated according to the equipment safety indexes; calculating risk assessment robustness for the privacy security index; risk assessment robustness is calculated according to the operation safety indexes; calculating variances of the correlation degree sequence, the similarity sequence and the fluctuation degree sequence of the total index; and judging the total index risk degree. According to the method, the power monitoring system can be helped to better know the network security condition and the faced security threat, risk behaviors in the network and high-risk assets with high-risk ports, security holes, non-compliant configuration and the like can be found in time, so that a corresponding security protection strategy is formulated, the network security protection capability is improved, and the method is scientific, reasonable and convenient to implement. And safe and reliable operation of the power monitoring system can be effectively ensured.

Description

Technical Field

[0001] The present invention relates to the field of power monitoring system safety technology, and in particular to a three-dimensional risk assessment method and system for network assets of a power monitoring system. Background Art

[0002] As the "nerve center" of power industry production, the power monitoring system is the core component of the critical information infrastructure of the power system. The importance of the power monitoring system makes it an important target of cyber attacks and cyber warfare. It is likely to further become an important target of cyber confrontation between countries and a key target of hacker organizations to carry out attacks and sabotage. With the continuous changes in attack methods, both in breadth and depth, the power monitoring system will face more diverse cyber attacks, and the security protection of the power monitoring system will also face greater challenges. In order to effectively respond to the threat of the power monitoring system, it is first necessary to assess the risk of network assets. There are still many problems in the current risk assessment, which are mainly reflected in:

[0003] (1) The current power monitoring system has a large number of network assets of different models and data from multiple sources, making it impossible for operators to grasp the security status of assets in a timely manner.

[0004] (2) Existing technologies have achieved the post-event location of relevant assets in cybersecurity threat management, but this relies on subjective human judgment and lacks the ability to monitor security risks in advance.

[0005] (3) Effective assessment of network asset risks has not yet been achieved, and the ability to respond in real time and accurately assess risks in emergency situations is insufficient. Summary of the invention

[0006] In view of the above-mentioned problems, the present invention is proposed.

[0007] Therefore, the technical problem solved by the present invention is that the security status is difficult to grasp in real time due to the large number of network assets, different models, and multi-source heterogeneity of data, as well as the defects of the existing technology that relies on post-analysis and manual judgment.

[0008] To solve the above technical problems, the present invention provides the following technical solution: a three-dimensional risk assessment method for network assets of a power monitoring system, which comprises the following steps:

[0009] Construct a comprehensive evaluation index system for network assets of the power monitoring system; calculate the robustness of risk assessment for equipment safety indicators; calculate the robustness of risk assessment for privacy security indicators; calculate the robustness of risk assessment for operational safety indicators; calculate the variance of the total indicator correlation sequence, similarity sequence, and volatility sequence; and determine the risk level of the total indicator.

[0010] As a preferred solution of the three-dimensional risk assessment method for network assets of the power monitoring system described in the present invention, the comprehensive evaluation index system of network assets of the power monitoring system includes equipment safety indicators, privacy security indicators and operational safety indicators.

[0011] The device security indicators include processor utilization, memory utilization, storage capacity, communication interface transmission efficiency, and network latency.

[0012] The privacy security indicators include real-time data transmission rate, historical data transmission rate, packet loss rate and communication delay.

[0013] The operational safety indicators include system failure frequency, failure recovery time, data density, security audit capabilities and timely incident response rate.

[0014] As a preferred solution of the three-dimensional risk assessment method for network assets of a power monitoring system described in the present invention, the risk assessment robustness includes correlation, similarity and volatility.

[0015] The calculation of risk assessment robustness for the equipment safety index includes collecting the i-th sub-index z in the equipment safety index. i The minimum value min i , maximum value max i , the current state value is now i , where i = 1, 2, ···, 5, and calculate the median of the equipment safety index as follows,

[0016]

[0017] By c i 'Forming the standardized median sequence of equipment safety indicators c1' = {c i '},i=1,2,···,5, define the current state value now i The current state value sequence of equipment safety indicators r1 = {now i}, i = 1, 2, ···, 5, and perform standardization as follows,

[0018]

[0019] By now i 'Forming the standardized current state value sequence of equipment safety indicators r1' = {now i '}, i = 1, 2, ···, 5, and calculate the relationship coefficient η1(i) between the standardized current state value sequence r1' of the equipment safety index and the standardized median value sequence c1' of the equipment safety index, as follows,

[0020]

[0021] Among them, ω represents the weight, max(c1') represents the maximum value of c1', and min(c1') represents the minimum value of c1'.

[0022] Define the weighted average value of η1(i) as the correlation degree of the equipment safety index f1 as follows,

[0023]

[0024] The cosine similarity formula is used to calculate the similarity S(f1) between the current state value sequence r1 of the equipment safety index in the equipment safety index f1 and the median sequence c1 of the equipment safety index, as follows:

[0025]

[0026] Calculate the average value c1 of the median sequence c1 of the equipment safety index f1 as follows:

[0027]

[0028] Calculate the current status value now of the equipment safety indicator f1 i The volatility sequence b1 = {b i},i=1,2,···,5,as follows,

[0029]

[0030] Calculate the volatility B(f1) of the equipment safety index f1 as follows:

[0031]

[0032] As a preferred solution of the three-dimensional risk assessment method for network assets of the power monitoring system described in the present invention, wherein: the calculation of the robustness of the risk assessment for the privacy security index includes collecting the minimum value min of the kth sub-indicator in the privacy security index k , maximum value max k 、Current state value now k , where k = 6, 7, 8, 9, and calculate the median value of the privacy security index c k ,as follows,

[0033]

[0034] By c k Form the median sequence of privacy security indicators c2 = {c k}, k = 6, 7, 8, 9, for c k Standardization is performed as follows:

[0035]

[0036] By c k 'Forming the standardized median sequence of privacy security indicators c2' = {c k '}, k = 6, 7, 8, 9, define the current state value now k The current state value sequence of privacy security indicators r2 = {now k}, k = 6, 7, 8, 9, and perform standardization as follows,

[0037]

[0038] By now k 'Forming the privacy security indicator standardized current state value sequence r2' = {now k '}, k = 6, 7, 8, 9, calculate the relationship coefficient η2(k) between the standardized current state value sequence r2' of the privacy security index and the standardized median value sequence c2' of the privacy security index, as follows,

[0039]

[0040] Among them, max(c2') is the maximum value of c2', and min(c2') is the minimum value of c2'.

[0041] Define the weighted average of η2(k) as the correlation of the privacy security index f2 as follows,

[0042]

[0043] The cosine similarity formula is used to calculate the similarity S(f2) between the current state value sequence r2 of the privacy security indicator in the privacy security indicator f2 and the median value sequence c2 of the privacy security indicator, as follows:

[0044]

[0045] Calculate the average value of the privacy security index f2 and the median sequence c2 of the privacy security index as follows,

[0046]

[0047] Calculate the current state value now of the privacy security indicator f2 k The volatility sequence b2 = {b k}, k = 6, 7, 8, 9, as follows,

[0048]

[0049] Calculate the volatility B(f2) of the privacy security index f2 as follows:

[0050]

[0051] As a preferred solution of the three-dimensional risk assessment method for network assets of the power monitoring system described in the present invention, wherein: the calculation of the robustness of the risk assessment for the operational safety index includes collecting the minimum value min of the qth sub-indicator in the operational safety index q , maximum value max q 、Current state value now q Where q = 10, 11, ···, 14, and calculate the median value c of the operational safety index q ,as follows,

[0052]

[0053] By c q Form the median sequence of operational safety indicators c3 = {c q},q=10,11,···,14,for c q Standardization is performed as follows:

[0054]

[0055] By c q 'Forming the standardized median sequence of operational safety indicators c3' = {c q '},q=10,11,···,14, define the current state value now q The current state value sequence of operational safety indicators r3 = {now q},q=10,11,···,14, and perform standardization as follows,

[0056]

[0057] By now q 'Forming the standardized current state value sequence of operational safety indicators r3' = {now q '},q=10,11,···,14, calculate the relationship coefficient η3(q) between the standardized current state value sequence r3' of the operational security index and the standardized median value sequence c3' of the privacy security index, as follows,

[0058]

[0059] Among them, max(c3') is the maximum value of c3', min(c3') is the minimum value of c3', and the weighted average value of η3(q) is defined as the correlation degree of the privacy security index f3. as follows,

[0060]

[0061] The cosine similarity formula is used to calculate the similarity S(f3) between the current state value sequence r3 of the operation safety index in the operation safety index f3 and the median sequence c3 of the operation safety index, as follows:

[0062]

[0063] Calculate the average value of the operation safety index f3 and the operation safety index median sequence c3 as follows,

[0064]

[0065] Calculate the current state value now of the operational safety indicator f3 q The volatility sequence b3 = {b q},q=10,11,···,14,as follows,

[0066]

[0067] Calculate the volatility B(f3) of the operational safety index f3 as follows:

[0068]

[0069] As a preferred solution of the three-dimensional risk assessment method for network assets of the power monitoring system described in the present invention, the variance of the correlation sequence among the variances of the total index correlation sequence, similarity sequence, and volatility sequence is expressed as:

[0070]

[0071] The variance of the similarity sequence is expressed as,

[0072]

[0073] The variance of the volatility series is expressed as,

[0074]

[0075] As a preferred solution of the three-dimensional risk assessment method of the power monitoring system network assets described in the present invention, wherein: the determination of the risk level of the total index includes defining h = {h1, h2, h3} to determine the risk level of the total index F = {f1, f2, f3}, wherein the value of h1 is determined by the variance of the correlation sequence and the average value of the correlation sequence, as follows,

[0076]

[0077] The value of h2 is determined by the variance of the similarity sequence and the average value of the similarity sequence, as follows:

[0078]

[0079] The value of h3 is determined by the variance of the volatility sequence and the average value of the volatility sequence, as follows:

[0080]

[0081] Define the risk index H as follows:

[0082] H=h1+h2+h3

[0083] The risk level of the total index F = {f1, f2, f3} is determined as follows:

[0084]

[0085] The corresponding evaluation results are the final results of the comprehensive evaluation of the network assets of the power monitoring system.

[0086] Another object of the present invention is to provide a three-dimensional risk assessment system for network assets of a power monitoring system, which can solve the problem that the existing system is difficult to timely grasp the security status of multi-source heterogeneous assets, relies on manual judgment and lacks real-time risk assessment and early warning capabilities by constructing a comprehensive evaluation system of three major indicators: equipment security, privacy security, and operational security, and combining multi-dimensional risk assessment methods such as correlation, similarity, and volatility.

[0087] To solve the above technical problems, the present invention provides the following technical solutions: a three-dimensional risk assessment system for network assets of a power monitoring system, comprising a data acquisition module, a standardization processing module, a correlation calculation module, a similarity calculation module, a volatility calculation module, a variance calculation module and a risk judgment module.

[0088] The data collection module is responsible for collecting security-related values ​​from devices, networks, and operations in real time;

[0089] The standardization processing module is responsible for standardizing the collected equipment safety indicators, privacy safety indicators, and operation safety indicators.

[0090] The correlation calculation module is responsible for calculating the correlation between equipment, privacy, and operational security indicators.

[0091] The similarity calculation module is responsible for calculating the similarity of equipment, privacy, and operational security indicators.

[0092] The volatility calculation module is responsible for calculating the volatility of equipment, privacy, and operational security indicators.

[0093] The variance calculation module is responsible for respectively calculating the variance of the total index correlation sequence, similarity sequence, and volatility sequence.

[0094] The risk assessment module calculates the risk of various indicators based on the variance and average of correlation, similarity and volatility, combines the risk of various indicators, generates a risk index H, and makes a final risk assessment conclusion.

[0095] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the three-dimensional risk assessment method for network assets of a power monitoring system as described above are implemented.

[0096] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the three-dimensional risk assessment method for network assets of a power monitoring system as described above.

[0097] Beneficial effects of the invention: The three-dimensional risk assessment method for network assets of the power monitoring system of the invention can help the power monitoring system better understand its network security status and the security threats it faces, and timely discover risky behaviors in the network, as well as high-risk assets such as high-risk ports, security loopholes, and non-compliant configurations, so as to formulate corresponding security protection strategies and improve network security protection capabilities. The method is scientific and reasonable and can effectively ensure the safe and reliable operation of the power monitoring system. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0099] Figure 1 This is an overall flow chart of a three-dimensional risk assessment method for network assets in a power monitoring system provided in the first embodiment of the present invention.

[0100] Figure 2 This is an overall framework diagram of a three-dimensional risk assessment system for network assets of a power monitoring system provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0101] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0102] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a three-dimensional risk assessment method for network assets of a power monitoring system, which is characterized by:

[0103] S1: Construct a comprehensive evaluation index system for network assets of power monitoring systems.

[0104] A comprehensive evaluation index system for network assets of power monitoring system is constructed from three dimensions: equipment security, privacy security and operation security. The index system includes 3 general indicators and 14 sub-indicators. The general index of the comprehensive evaluation index system for network assets of power monitoring system is expressed as F = {f1, f2, f3}, where the equipment security index is f1, which is specifically divided into 5 sub-indicators: processor utilization rate z1, memory utilization rate z2, storage capacity z3, communication interface transmission rate z4, network delay z5, privacy security index is f2, which is specifically divided into 4 sub-indicators: real-time data transmission rate z6, historical data transmission rate z7, packet loss rate z8, communication delay z9, and operation security index is f3, which is specifically divided into 5 sub-indicators: system failure frequency z 10 , fault recovery time z 11 , data density z 12 , security audit capability 13 , event timely response rate z 14 Therefore, the sub-index of the comprehensive evaluation index system of network assets of power monitoring system is expressed as Z = {z1,z2,···,z 14}.

[0105] Build a comprehensive evaluation index system for network assets of the power monitoring system, determine the appropriate data processing method for data of different indicators, and thus improve the accuracy of data processing.

[0106] S2: Calculate the robustness of risk assessment for equipment safety indicators.

[0107] Risk assessment robustness includes correlation, similarity, and volatility.

[0108] For the equipment safety index f1, collect the i-th sub-index z i The minimum value min i , maximum value max i 、Current state value now i Where i = 1, 2, ···, 5, and the median value of the equipment safety index is calculated as shown in formula (1):

[0109]

[0110] By c i Form the median sequence of equipment safety indicators c1 = {c i},i=1,2,···,5,for c iPerform standardization, as shown in formula (2):

[0111]

[0112] By c i 'Forming the standardized median sequence of equipment safety indicators c1' = {c i '},i=1,2,···,5, define the current state value now i The current state value sequence of equipment safety indicators r1 = {now i}, i = 1, 2, ···, 5, and perform standardization, as shown in formula (3):

[0113]

[0114] By now i 'Forming the standardized current state value sequence of equipment safety indicators r1' = {now i '}, i = 1, 2, ···, 5, calculate the relationship coefficient η1(i) between the standardized current state value sequence r1' of the equipment safety index and the standardized median value sequence c1' of the equipment safety index, as shown in formula (4):

[0115]

[0116] Where ω is the weight, ranging from (0,1), and the default setting is 0.5, which can be adjusted according to the specific situation. max(c1') is the maximum value of c1', min(c1') is the minimum value of c1', and the weighted average value of η1(i) is defined as the correlation degree of the equipment safety index f1. As shown in formula (5):

[0117]

[0118] The cosine similarity formula is used to calculate the similarity S(f1) between the current state value sequence r1 of the equipment safety index in the equipment safety index f1 and the median sequence c1 of the equipment safety index, as shown in formula (6):

[0119]

[0120] Calculate the average value of the equipment safety index f1 and the equipment safety index median sequence c1 As shown in formula (7):

[0121]

[0122] Calculate the current status value now of the equipment safety indicator f1 i The volatility sequence b1 = {b i},i=1,2,···,5, as shown in formula (8):

[0123]

[0124] Calculate the fluctuation B(f1) of the equipment safety index f1, as shown in formula (9):

[0125]

[0126] Through a series of standardized processing of equipment safety indicators, the median value is used as the evaluation standard of the state value to obtain the correlation and similarity of the equipment safety indicators. The average value is used as the evaluation standard of the current state value to obtain the volatility of the equipment safety indicators, thereby calculating the robustness of risk assessment of equipment safety indicators.

[0127] S3: Calculate the robustness of risk assessment for privacy and security indicators.

[0128] For the privacy security indicator f2, collect the kth sub-indicator z k The minimum value min k , maximum value max k 、Current state value now k Where k = 6, 7, 8, 9, and calculate the median value of the privacy security index c k , as shown in formula (10):

[0129]

[0130] By c k Form the median sequence of privacy security indicators c2 = {c k}, k = 6, 7, 8, 9, for c k Perform standardization, as shown in formula (11):

[0131]

[0132] By c k 'Forming the standardized median sequence of privacy security indicators c2' = {c k '}, k = 6, 7, 8, 9, define the current state value now k The current state value sequence of privacy security indicators r2 = {now k}, k = 6, 7, 8, 9, and perform standardization, as shown in formula (12):

[0133]

[0134] By now k 'Forming the privacy security indicator standardized current state value sequence r2' = {now k'}, k = 6, 7, 8, 9, calculate the relationship coefficient η2(k) between the standardized current state value sequence r2' of the privacy security index and the standardized median value sequence c2' of the privacy security index, as shown in formula (13):

[0135]

[0136] Where ω is the weight, ranging from (0,1), and is set to 0.5 by default. It can be adjusted according to the specific situation. max(c2') is the maximum value of c2', min(c2') is the minimum value of c2', and the weighted average value of η2(k) is defined as the correlation degree of the privacy security index f2. As shown in formula (14):

[0137]

[0138] The cosine similarity formula is used to calculate the similarity S(f2) between the current state value sequence r2 of the privacy security indicator in the privacy security indicator f2 and the median value sequence c2 of the privacy security indicator, as shown in formula (15):

[0139]

[0140] Calculate the average value c2 of the privacy security index f2 privacy security index median sequence c2, as shown in formula (16):

[0141]

[0142] Calculate the current state value now of the privacy security indicator f2 k The volatility sequence b2 = {b k}, k = 6, 7, 8, 9, as shown in formula (17):

[0143]

[0144] Calculate the volatility B(f2) of the privacy security index f2, as shown in formula (18):

[0145]

[0146] Through a series of standardized processing of privacy and security indicators, the median value is used as the evaluation standard of the state value to obtain the correlation and similarity of the privacy and security indicators. The average value is used as the evaluation standard of the current state value to obtain the volatility of the privacy and security indicators, thereby calculating the risk assessment robustness of the privacy and security indicators.

[0147] S4: Calculate the robustness of risk assessment for operational safety indicators.

[0148] For the operational safety indicator f3, collect the qth sub-indicator z q The minimum value minq , maximum value max q 、Current state value now q Where q = 10, 11, ···, 14, and calculate the median value c of the operational safety index q , as shown in formula (19):

[0149]

[0150] By c q Form the median sequence of operational safety indicators c3 = {c q},q=10,11,···,14,for c q Perform standardization, as shown in formula (20):

[0151]

[0152] By c q 'Forming the standardized median sequence of operational safety indicators c3' = {c q '},q=10,11,···,14, define the current state value now q The current state value sequence of operational safety indicators r3 = {now q},q=10,11,···,14, and perform standardization, as shown in formula (21):

[0153]

[0154] By now q 'Forming the standardized current state value sequence of operational safety indicators r3' = {now q '},q=10,11,···,14, calculate the relationship coefficient η3(q) between the standardized current state value sequence r3' of the operational security index and the standardized median value sequence c3' of the privacy security index, as shown in formula (22):

[0155]

[0156] Where ω is the weight, ranging from (0, 1), and is set to 0.5 by default. It can be adjusted according to the specific situation. max(c3') is the maximum value of c3', min(c3') is the minimum value of c3', and the weighted average value of η3(q) is defined as the correlation degree of the privacy security index f3. As shown in formula (23):

[0157]

[0158] The cosine similarity formula is used to calculate the similarity S(f3) between the current state value sequence r3 of the operation safety index in the operation safety index f3 and the median sequence c3 of the operation safety index, as shown in formula (24):

[0159]

[0160] Calculate the average value of the operation safety index f3 and the operation safety index median sequence c3 As shown in formula (25):

[0161]

[0162] Calculate the current state value now of the operational safety indicator f3 q The volatility sequence b3 = {b q},q=10,11,···,14, as shown in formula (26):

[0163]

[0164] Calculate the volatility B(f3) of the operational safety index f3, as shown in formula (27):

[0165]

[0166] Through a series of standardized processing of operational safety indicators, the median value is used as the evaluation standard of the state value to obtain the correlation and similarity of the operational safety indicators. The average value is used as the evaluation standard of the current state value to obtain the volatility of the operational safety indicators, thereby calculating the robustness of risk assessment of the operational safety indicators.

[0167] S5: Calculate the variance of the total index correlation sequence, similarity sequence, and volatility sequence.

[0168] The correlation sequence with total index F = {f1,f2,f3} The variance of the similarity sequence S = {S(f1), S(f2), S(f3)} and the volatility sequence B = {B(f1), B(f2), B(f3)} is used to judge the risk level of the total index F = {f1, f2, f3}. The variance formula of the correlation sequence of the total index F = {f1, f2, f3} is as shown in formula (28):

[0169]

[0170] The variance formula of the similarity sequence of the total index F = {f1, f2, f3} is as shown in formula (29):

[0171]

[0172] The variance formula of the volatility sequence of the total index F = {f1, f2, f3} is as follows:

[0173]

[0174] S6: Determine the risk level of the overall indicator.

[0175] Define h = {h1, h2, h3} to judge the risk level of the total index F = {f1, f2, f3}. The value of h1 is determined by the variance of the correlation sequence and the average value of the correlation sequence, as shown in formula (31):

[0176]

[0177] The value of h2 is determined by the variance of the similarity sequence and the average value of the similarity sequence, as shown in formula (32):

[0178]

[0179] The value of h3 is determined by the variance of the volatility sequence and the average value of the volatility sequence, as shown in formula (33):

[0180]

[0181] Calculate the variance of the total indicator correlation sequence, similarity sequence, and volatility sequence, and use the variance and the average value of the sequence as the standard for evaluating risk.

[0182] Define the risk index as H, as shown in formula (34):

[0183] H=h1+h2+h3(34)

[0184] Determine the risk level of the total index F = {f1, f2, f3}, as shown in formula (35):

[0185]

[0186] First, determine the scoring interval to which the risk index belongs, and then determine the risk level corresponding to the scoring interval. Finally, the level corresponding to the risk index H is the evaluation result of the network asset risk assessment of the power monitoring system.

[0187] The corresponding evaluation results are the final results of the comprehensive evaluation of the network assets of the power monitoring system.

[0188] Example 2, reference Figure 2 , which is an embodiment of the present invention, provides a system for a three-dimensional risk assessment method for network assets in a power monitoring system, characterized by: including a data acquisition module 100, a standardization processing module 200, a correlation calculation module 300, a similarity calculation module 400, a volatility calculation module 500, a variance calculation module 600 and a risk judgment module 700.

[0189] The data collection module 100 is responsible for collecting security-related values ​​from devices, networks, and operations in real time.

[0190] The standardization processing module 200 is responsible for standardizing the collected equipment security indicators, privacy security indicators, and operational security indicators.

[0191] The correlation calculation module 300 is responsible for calculating the correlation between equipment, privacy, and operational security indicators.

[0192] The similarity calculation module 400 is responsible for calculating the similarity of equipment, privacy, and operational security indicators.

[0193] The volatility calculation module 500 is responsible for calculating the volatility of equipment, privacy, and operational security indicators.

[0194] The variance calculation module 600 is responsible for respectively calculating the variance of the total index correlation sequence, similarity sequence, and volatility sequence.

[0195] The risk judgment module 700 calculates the risk of various indicators based on the variance and average of correlation, similarity and volatility, integrates the risk of various indicators, generates a risk index H, and makes a final risk assessment conclusion.

[0196] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0197] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0198] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0199] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0200] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A three-dimensional risk assessment method for network assets in a power monitoring system, characterized in that: include: Construct a comprehensive evaluation index system for network assets of power monitoring system; Calculate the robustness of risk assessment for equipment safety indicators; Calculate the robustness of risk assessment for privacy and security indicators; Calculate the robustness of risk assessments for operational safety indicators; Calculate the variance of the total index correlation sequence, similarity sequence, and volatility sequence; Determine the overall risk level of the indicator.

2. The three-dimensional risk assessment method for network assets of a power monitoring system according to claim 1, characterized in that: The comprehensive evaluation index system of network assets of the power monitoring system includes equipment safety index, privacy safety index and operation safety index; The device security indicators include processor utilization, memory utilization, storage capacity, communication interface transmission efficiency, and network latency; The privacy security indicators include real-time data transmission rate, historical data transmission rate, packet loss rate and communication delay; The operational safety indicators include system failure frequency, failure recovery time, data density, security audit capabilities and timely incident response rate.

3. The three-dimensional risk assessment method for network assets of a power monitoring system according to claim 2, characterized in that: The risk assessment robustness includes correlation, similarity and volatility; The calculation of the risk assessment robustness for the equipment safety index includes collecting the i-th sub-index z in the equipment safety index. i The minimum value min i , maximum value max i , the current state value now i , where i = 1, 2, ···, 5, and calculate the median of the equipment safety index as follows, By c i 'Forming the standardized median sequence of equipment safety indicators c1' = {c i '},i=1,2,···,5, define the current state value now i The current state value sequence of equipment safety indicators r1 = {now i }, i = 1, 2, ···, 5, and perform standardization as follows, By now i 'Forming the standardized current state value sequence of equipment safety indicators r1' = {now i '}, i = 1, 2, ···, 5, and calculate the relationship coefficient η1(i) between the standardized current state value sequence r1' of the equipment safety index and the standardized median value sequence c1' of the equipment safety index, as follows, Among them, ω represents the weight, max(c1') represents the maximum value of c1', and min(c1') represents the minimum value of c1'; Define the weighted average value of η1(i) as the correlation degree of the equipment safety index f1 as follows, The cosine similarity formula is used to calculate the similarity S(f1) between the current state value sequence r1 of the equipment safety index in the equipment safety index f1 and the median sequence c1 of the equipment safety index, as follows: Calculate the average value of the equipment safety index f1 and the equipment safety index median sequence c1 as follows, Calculate the current status value now of the equipment safety indicator f1 i The volatility sequence b1 = {b i },i=1,2,···,5,as follows, Calculate the volatility B(f1) of the equipment safety index f1 as follows:

4. The three-dimensional risk assessment method for network assets of a power monitoring system according to claim 3, characterized in that: The calculation of the robustness of risk assessment for the privacy security indicator includes collecting the minimum value min of the kth sub-indicator in the privacy security indicator. k , maximum value max k 、Current state value now k , where k = 6, 7, 8, 9, and calculate the median value of the privacy security index c k ,as follows, By c k Form the median sequence of privacy security indicators c2 = {c k }, k = 6, 7, 8, 9, for c k Standardization is performed as follows: By c k 'Forming the standardized median sequence of privacy security indicators c2' = {c k '}, k = 6, 7, 8, 9, define the current state value now k The current state value sequence of privacy security indicators r2 = {now k }, k = 6, 7, 8, 9, and perform standardization as follows, By now k 'Forming the privacy security indicator standardized current state value sequence r2' = {now k '}, k = 6, 7, 8, 9, calculate the relationship coefficient η2(k) between the standardized current state value sequence r2' of the privacy security index and the standardized median value sequence c2' of the privacy security index, as follows, Among them, max(c2') is the maximum value of c2', min(c2') is the minimum value of c2'; Define the weighted average of η2(k) as the correlation of the privacy security index f2 as follows, The cosine similarity formula is used to calculate the similarity S(f2) between the current state value sequence r2 of the privacy security indicator in the privacy security indicator f2 and the median value sequence c2 of the privacy security indicator, as follows: Calculate the average value of the privacy security index f2 and the median sequence c2 of the privacy security index as follows, Calculate the current state value now of the privacy security indicator f2 k The volatility sequence b2 = {b k }, k = 6, 7, 8, 9, as follows, Calculate the volatility B(f2) of the privacy security index f2 as follows:

5. The three-dimensional risk assessment method for network assets of a power monitoring system according to claim 4, characterized in that: The calculation of the robustness of risk assessment for the operational safety index includes collecting the minimum value min of the qth sub-indicator in the operational safety index. q , maximum value max q 、Current state value now q Where q = 10, 11, ···, 14, and calculate the median value c of the operational safety index q ,as follows, By c q Form the median sequence of operational safety indicators c3 = {c q },q=10,11,···,14,for c q Standardization is performed as follows: By c q 'Forming the standardized median sequence of operational safety indicators c3' = {c q '},q=10,11,···,14, define the current state value now q The current state value sequence of operational safety indicators r3 = {now q },q=10,11,···,14, and perform standardization as follows, By now q 'Forming the standardized current state value sequence of operational safety indicators r3' = {now q '},q=10,11,···,14, calculate the relationship coefficient η3(q) between the standardized current state value sequence r3' of the operational security index and the standardized median value sequence c3' of the privacy security index, as follows, Among them, max(c3') is the maximum value of c3', min(c3') is the minimum value of c3', and the weighted average value of η3(q) is defined as the correlation degree of the privacy security index f3. as follows, The cosine similarity formula is used to calculate the similarity S(f3) between the current state value sequence r3 of the operation safety index in the operation safety index f3 and the median sequence c3 of the operation safety index, as follows: Calculate the average value of the operation safety index f3 and the operation safety index median sequence c3 as follows, Calculate the current state value now of the operational safety indicator f3 q The volatility sequence b3 = {b q },q=10,11,···,14,as follows, Calculate the volatility B(f3) of the operational safety index f3 as follows:

6. The three-dimensional risk assessment method for network assets of a power monitoring system according to claim 5, characterized in that: The variance of the correlation sequence among the variances of the total index correlation sequence, similarity sequence, and volatility sequence is expressed as: The variance of the similarity sequence is expressed as, The variance of the volatility series is expressed as, 7. The three-dimensional risk assessment method for network assets of a power monitoring system according to claim 6, characterized in that: The method of judging the risk level of the total index includes defining h = {h1, h2, h3} to judge the risk level of the total index F = {f1, f2, f3}, wherein the value of h1 is determined by the variance of the correlation sequence and the average value of the correlation sequence, as follows: The value of h2 is determined by the variance of the similarity sequence and the average value of the similarity sequence, as follows: The value of h3 is determined by the variance of the volatility sequence and the average value of the volatility sequence, as follows: Define the risk index H as follows: H=h1+h2+h3 The risk level of the total index F = {f1, f2, f3} is determined as follows: The corresponding evaluation results are the final results of the comprehensive evaluation of the network assets of the power monitoring system.

8. A system using the three-dimensional risk assessment method for network assets of a power monitoring system as claimed in any one of claims 1 to 7, characterized in that: It comprises a data collection module (100), a standardization processing module (200), a correlation calculation module (300), a similarity calculation module (400), a volatility calculation module (500), a variance calculation module (600) and a risk judgment module (700); The data collection module (100) is responsible for collecting security-related values ​​from devices, networks, and operations in real time; The standardization processing module (200) is responsible for standardizing the collected equipment safety indicators, privacy safety indicators, and operation safety indicators; The correlation calculation module (300) is responsible for calculating the correlation between equipment, privacy, and operational security indicators; The similarity calculation module (400) is responsible for calculating the similarity of equipment, privacy, and operational security indicators; The volatility calculation module (500) is responsible for calculating the volatility of equipment, privacy, and operational security indicators; The variance calculation module (600) is responsible for respectively calculating the variance of the total index correlation sequence, similarity sequence, and volatility sequence; The risk judgment module (700) calculates the risk of various indicators based on the variance and average of the correlation, similarity and volatility, integrates the risk of various indicators, generates a risk index H, and makes a final risk assessment conclusion.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the three-dimensional risk assessment method for network assets of a power monitoring system described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the three-dimensional risk assessment method for network assets of a power monitoring system described in any one of claims 1 to 7 are implemented.

Images