Novel power system network security protection and verification method and system

Abstract

The invention discloses a novel power system network security protection and verification method and system. The method comprises the following steps: monitoring network traffic and log data, forming a network space behavior analysis rule by using a machine learning algorithm or a path search algorithm, and generating an attack path from an attacker perspective; constructing a network attack behavior event association model oriented to an attack and defense scene of the power system based on an analysis result of the attack path, and automatically identifying a network threat; aiming at the identified network threats, integrating power network security domain knowledge, a power monitoring system network plan and an on-site disposal scheme by utilizing a knowledge graph technology, and automatically generating a protection strategy; comprehensively evaluating the protection effect of the protection strategy through a pre-established evaluation system, and verifying and optimizing the protection effect by simulating a real attack and defense scene. According to the scheme of the invention, the accuracy and timeliness of threat identification are improved, and the verification process of a protection strategy is simplified.

Description

Technical Field

[0001] The present invention belongs to the field of power system network security, and in particular relates to a novel power system network security protection and verification method and system. Background Art

[0002] With the rapid development of network technology, the demand for security protection and verification technology in new power systems has become more urgent. Faced with complex and changing network challenges such as supply chain attacks and ransomware attacks, new power systems have made significant progress in strengthening their security protection mechanisms. However, in order to cope with the evolving external attack methods, it has become a vital task to achieve all-round and dynamic verification of security protection. Summary of the invention

[0003] In order to address the deficiencies in the prior art, the present invention provides a novel power system network security protection and verification method and system to improve the efficiency of formulation and execution of defense strategies, and ensure the effectiveness and adaptability of strategies through continuous verification and optimization.

[0004] In order to solve the above technical problems, the present invention adopts the following technical solutions.

[0005] The present invention first discloses a novel power system network security protection and verification method, which includes the following steps:

[0006] Step 1: Monitor network traffic and log data, use machine learning algorithms or path search algorithms to form cyberspace behavior analysis rules, and generate attack paths from the attacker's perspective;

[0007] Step 2: Based on the analysis results of the attack path, a network attack behavior event correlation model for power system attack and defense scenarios is constructed to automatically identify network threats;

[0008] Step 3: Based on the identified network threats, the knowledge graph technology is used to integrate the knowledge in the field of power network security, the network plan of the power monitoring system and the on-site disposal plan to automatically generate a protection strategy;

[0009] Step 4: Comprehensively evaluate the protection effect of the protection strategy through a pre-established evaluation system, and verify and optimize the protection effect by simulating real attack and defense scenarios.

[0010] The present invention further includes the following preferred embodiments:

[0011] The path search algorithm includes the Dijkstra algorithm and the A* algorithm. By representing the network topology as a graph, nodes represent network elements, and edges represent the connection relationship between elements, potential attack paths can be searched out using the path search.

[0012] The generating of the attack path from the attacker's perspective further includes:

[0013] By building a rule base based on expert knowledge and experience and analyzing the network traffic and log data through a logical reasoning engine, the attack path is derived.

[0014] The network attack behavior event association model is based on a machine learning algorithm or a deep learning model. The machine learning algorithm is a logistic regression algorithm, and its model is expressed as:

[0015]

[0016] Among them, x is the input feature, including features in network traffic and log data, w is the weight vector, b is the bias term, and y is the output, which represents the probability of an attack.

[0017] The automatic identification of network threats further includes:

[0018] Anomaly detection models are constructed using statistical or data mining methods to identify potential security threats by analyzing abnormal patterns in network traffic and log data; the anomaly detection model uses the K-nearest neighbor algorithm. Anomalies are defined as points that are farthest from most points; the anomaly score is defined by calculating the average distance from a point to its K nearest neighbors:

[0019]

[0020] Among them, x is the point to be detected, x i is the ith nearest neighbor of x, dist(x,x i ) is x and x i The distance between.

[0021] The automatic generation of protection strategies further includes:

[0022] Build a rule-based reasoning engine to make inferences and decisions based on the predefined rule base and the current network security situation, and generate corresponding protection strategies.

[0023] The comprehensive evaluation of the protection effect of the protection strategy further includes:

[0024] A multi-index comprehensive evaluation method is adopted, by selecting multiple evaluation indicators, and using weighted summation or fuzzy comprehensive evaluation method for comprehensive evaluation. The multiple evaluation indicators include attack success rate, response time, and resource consumption.

[0025] The present invention also discloses a novel power system network security protection and verification system using the aforementioned novel power system network security protection and verification method, comprising:

[0026] The attack path generation and analysis module is used to monitor network traffic and log data, use machine learning algorithms or path search algorithms to form cyberspace behavior analysis rules, and generate attack paths from the attacker's perspective;

[0027] The network threat identification module is used to build a network attack behavior event association model for power system attack and defense scenarios based on the analysis results of the attack path, and automatically identify network threats;

[0028] The protection strategy generation module is used to automatically generate protection strategies for identified network threats by integrating knowledge in the field of power network security, network plans for power monitoring systems, and on-site disposal plans using knowledge graph technology;

[0029] The protection effect evaluation and verification module is used to comprehensively evaluate the protection effect of the protection strategy through a pre-established evaluation system, and to verify and optimize the protection effect by simulating real attack and defense scenarios.

[0030] Accordingly, the present application also discloses a terminal, including a processor and a storage medium;

[0031] The storage medium is used to store instructions;

[0032] The processor is used to operate according to the instructions to execute the steps of the aforementioned novel power system network security protection and verification method.

[0033] Correspondingly, the present application also discloses a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the aforementioned new power system network security protection and verification method are implemented.

[0034] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a new power system network security protection and verification method and system, starting from the attacker's perspective, combined with machine learning algorithms to monitor network traffic and log data in real time, more accurately depict the attack path, and reduce false positives and missed reports; through in-depth analysis of the attack path, potential attack trends and patterns can be predicted; the network attack behavior event association model constructed in combination with attack path analysis can more accurately identify potential security threats; the protection strategy based on the attack path is more targeted and can more effectively resist specific types of network attacks, reducing the cost of manual intervention, improving the accuracy and timeliness of threat identification, and providing reliable security protection for new power systems; enhancing the system's predictability and real-time response capabilities, making security protection work more proactive and effective. Using knowledge graph technology to integrate information such as power network security knowledge, plans, and on-site disposal plans can generate protection strategies more systematically and respond more accurately to specific types of network attacks. Establishing a scientific evaluation system to quantify and score the protection effect of the protection strategy improves the objectivity of the evaluation. The comprehensive evaluation technology takes into account the protection effect indicators of multiple dimensions, which can more comprehensively reflect the protection capabilities of the system. Through the comprehensive evaluation results, we can clearly understand the system's protection shortcomings and advantages, and provide strong guidance for the formulation of improvement measures. The effectiveness of the protection strategy is verified through simulation verification technology, which simplifies the verification process of the protection strategy and reduces the verification cost and time. It enhances the pertinence and effectiveness of security protection work and improves the overall protection level. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flow chart of the novel power system network security protection and verification method in the present invention.

[0036] Figure 2 It is a simplified diagram of the protection strategy generation driven by the knowledge graph in the present invention.

[0037] Figure 3 It is the knowledge graph driven protection strategy in the present invention that generates the full graph. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0039] The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the protection scope of the present invention.

[0040] In view of the shortcomings of the prior art, the present invention proposes a new power system network security protection and verification method and system, which combines the attack path generation technology with the typical business characteristics of the new power system, analyzes the network attack behavior from the attacker's perspective, and extracts accurate cyberspace behavior analysis rules, so as to accurately depict the attacker's attack path. Further, the security threat analysis technology based on the attack path is introduced, and the artificial intelligence technology is integrated to deeply analyze the internal connections such as the composition of behavioral events and the temporal relationship in the attack process, and a network attack behavior event association model for the power system attack and defense scenario is constructed, so as to achieve rapid and accurate identification of security threats. Using the knowledge graph technology, the professional knowledge in the field of power network security, the network security plan of the power monitoring system, and the on-site disposal plan are deeply integrated to construct the power security knowledge graph, which not only provides a theoretical basis for the generation of security protection strategies, but also ensures the effectiveness of the strategies through simulation verification technology. Finally, based on the comprehensive evaluation technology of security protection strategies for attack and defense confrontation, the protection effect of security protection strategies is scored through a scientific evaluation system, so as to achieve a comprehensive and objective evaluation of the protection capability of the new power system in the attack and defense confrontation.

[0041] The present invention integrates cutting-edge technologies such as the ATT&CK framework, deep network traffic analysis, intelligent automatic intrusion detection, threat intelligence integration and situational awareness, dynamic generation of adaptive security protection strategies, and high-precision simulation verification. The ATT&CK framework provides a threat modeling foundation for the construction of security protection strategies; deep network traffic analysis technology monitors and analyzes network data flows in real time to capture abnormal signs; intelligent automatic intrusion detection technology responds quickly and effectively blocks potential threats; threat intelligence integration and situational awareness technology provide decision makers with a comprehensive and real-time security situation picture; adaptive security protection strategy dynamic generation technology automatically adjusts protection strategies according to threat changes; high-precision simulation verification technology simulates real attack and defense scenarios to conduct comprehensive and in-depth verification and optimization of security protection effects.

[0042] The present invention designs the following technical paths: first, based on the ATT&CK framework, a detailed threat model is constructed to lay the foundation for the formulation of security protection strategies; second, with the help of deep network traffic analysis technology, comprehensive monitoring of network activities is achieved; third, through intelligent automatic intrusion detection technology, rapid identification and effective response to potential threats are achieved; at the same time, threat intelligence integration and situational awareness technology are used to build a comprehensive security situation awareness system, which provides strong support for the dynamic adjustment of security protection strategies; finally, high-precision simulation verification technology is used to simulate the real attack and defense environment, and the security protection strategy is comprehensively verified and optimized to ensure that it can exert its maximum effectiveness in practical applications.

[0043] The present invention achieves a significant improvement in the security protection of new power systems through a modular and scalable simulation architecture design, combined with in-depth analysis of attack paths, intelligent threat identification, knowledge graph-driven protection strategy generation and verification, and comprehensive protection effect evaluation technology.

[0044] See also Figure 1 As shown, the novel power system network security protection and verification method disclosed in the present invention comprises the following steps:

[0045] Step 1: Monitor network traffic and log data, use machine learning algorithms or path search algorithms to form cyberspace behavior analysis rules, and generate attack paths from the attacker's perspective.

[0046] The novel power system security protection and verification method proposed in the present invention adopts a modular and scalable architecture design, as well as in-depth analysis of attack paths, intelligent threat identification, knowledge graph-driven protection strategy generation and verification, and integration of comprehensive protection effect evaluation technology.

[0047] Combining the business characteristics of the new power system, from the perspective of attackers, we use machine learning algorithms or path search algorithms to analyze network traffic, logs and other data, extract cyberspace behavior analysis rules, and generate detailed attack paths. Through the generation and analysis of attack paths, we can accurately depict the attack process and provide strong support for subsequent threat analysis and defense strategy formulation.

[0048] According to a further embodiment, in the algorithm for analyzing network traffic and log data, the present invention applies a logistic regression algorithm, whose model is expressed as:

[0049]

[0050] Among them, x is the input feature (such as network traffic, features in log data), w is the weight vector, b is the bias term, and y is the output (usually representing the probability of an attack occurring).

[0051] The path search algorithms include Dijkstra algorithm and A* algorithm, etc. By representing the network topology as a graph, nodes represent network elements, and edges represent the connection relationship between elements, these algorithms can be used to efficiently search for potential attack paths.

[0052] In an optional embodiment, a rule base based on expert knowledge and experience is further constructed, and network traffic and log data are analyzed through a logical reasoning engine to deduce possible attack paths.

[0053] Step 2: Based on the analysis results of the attack path, a network attack behavior event correlation model for power system attack and defense scenarios is constructed to automatically identify network threats.

[0054] Based on the results of attack path analysis, artificial intelligence technology is used to build a network attack behavior event correlation model to achieve automatic identification and rapid response of threats, so as to improve the accuracy and timeliness of threat identification and reduce the cost of manual intervention.

[0055] The association model usually involves the correlation analysis between events. The model used in the further embodiment of the present invention is a conditional probability model. That is, assuming there are two events A and B, the association between them can be expressed by the conditional probability P(B|A), that is, the probability of event B occurring after event A occurs:

[0056]

[0057] Among them, P(A,B) is the probability of A and B occurring at the same time, and P(A) is the probability of A occurring.

[0058] When performing threat identification, you can use traditional machine learning algorithms or deep learning models (such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), etc.) Deep learning models can automatically extract features from raw data and learn complex patterns, thereby improving the accuracy and robustness of threat identification.

[0059] Alternatively, an anomaly detection model is constructed using statistical or data mining methods to identify potential security threats by analyzing abnormal patterns in network traffic and log data. This method does not rely on specific attack path information, but makes judgments based on the abnormality of the data itself.

[0060] The anomaly detection algorithm used in a further embodiment of the present invention is the K-Nearest Neighbor (K-NN) algorithm. In K-NN, anomalies are defined as those points that are farthest from the majority of points. The anomaly score is defined by calculating the average distance from a point to its K nearest neighbors:

[0061]

[0062] Among them, x is the point to be detected, x i is the ith nearest neighbor of x, dist(x,x i ) is x and x i The distance between.

[0063] Step 3: For the identified network threats, use knowledge graph technology to integrate knowledge in the field of power network security, network plans for power monitoring systems, and on-site disposal plans to automatically generate protection strategies.

[0064] See also Figure 2 and Figure 3, using knowledge graph technology to integrate knowledge, plans and on-site disposal solutions in the field of power network security, automatically generate protection strategies, and verify their effectiveness through simulation, while simplifying the verification process and improving work efficiency.

[0065] In a further embodiment, in addition to using the knowledge graph, a rule-based reasoning engine can also be built to perform reasoning and decision-making based on a predefined rule base and the current network security situation to generate corresponding protection strategies.

[0066] Optionally, reinforcement learning is applied to the generation and verification of protection strategies. By defining appropriate reward functions and state spaces, the reinforcement learning model is trained to learn and optimize protection strategies in a simulated attack and defense environment, automatically adapt to different network security situations and attack methods, and generate more flexible and effective protection strategies.

[0067] In reinforcement learning, the reward function R(s,a) is used to define the immediate reward obtained after taking action a in state s. The state space S contains all possible states. The present invention uses the Q-learning reinforcement learning model to define a suitable reward function and state space, and its update rule is:

[0068]

[0069] Where r is the immediate reward, γ is the discount factor, α is the learning rate, s′ is the next state, and a′ is the possible action in the next state.

[0070] Step 4: Comprehensively evaluate the protection effect of the protection strategy through a pre-established evaluation system, and verify and optimize the protection effect by simulating real attack and defense scenarios.

[0071] Establish a scientific evaluation system, quantify and score the protective effects of protection strategies, achieve comprehensive evaluation, and provide a basis for continuous optimization of protection strategies by providing objective and comprehensive protection effect evaluation.

[0072] The evaluation system quantifies the score by integrating multiple indicators. The present invention uses weighted summation to integrate multiple evaluation indicators:

[0073]

[0074] Among them, Metric i is the value of the i-th evaluation index, w i is its corresponding weight, and n is the total number of evaluation indicators.

[0075] In a further embodiment, a multi-index comprehensive evaluation method is used to evaluate the protection effect. By selecting multiple representative evaluation indicators (such as attack success rate, response time, resource consumption, etc.), a weighted summation or fuzzy comprehensive evaluation method is used for comprehensive evaluation to comprehensively reflect the protection capability of the system.

[0076] The fuzzy comprehensive evaluation includes fuzzy set operations, such as fuzzy union and fuzzy intersection. The present invention uses the fuzzy comprehensive evaluation matrix V and the weight vector W to calculate the evaluation system:

[0077] Fuzzy Score=W·V (6)

[0078] Among them, V is the fuzzy evaluation matrix, whose elements represent the membership degree of each evaluation index at different fuzzy levels; W is the weight vector.

[0079] Optionally, design a series of comparative experiments to evaluate the effects of different protection strategies. Apply different protection strategies under the same experimental conditions, and record the experimental results for comparative analysis, which can intuitively show the differences and advantages and disadvantages between different strategies and provide strong support for optimizing protection strategies.

[0080] The beneficial effect of the present invention is that, compared with the prior art, the present invention provides a new power system network security protection and verification method and system, starting from the attacker's perspective, combined with machine learning algorithms to monitor network traffic and log data in real time, more accurately depict the attack path, and reduce false positives and missed reports; through in-depth analysis of the attack path, potential attack trends and patterns can be predicted; the network attack behavior event association model constructed in combination with attack path analysis can more accurately identify potential security threats; the protection strategy based on the attack path is more targeted and can more effectively resist specific types of network attacks, reducing the cost of manual intervention, improving the accuracy and timeliness of threat identification, and providing reliable security protection for new power systems; enhancing the system's predictability and real-time response capabilities, making security protection work more proactive and effective. Using knowledge graph technology to integrate information such as power network security knowledge, plans, and on-site disposal plans can generate protection strategies more systematically and respond more accurately to specific types of network attacks. Establishing a scientific evaluation system to quantify and score the protection effect of the protection strategy improves the objectivity of the evaluation. The comprehensive evaluation technology takes into account the protection effect indicators of multiple dimensions, which can more comprehensively reflect the protection capabilities of the system. Through the comprehensive evaluation results, we can clearly understand the system's protection shortcomings and advantages, and provide strong guidance for the formulation of improvement measures. The effectiveness of the protection strategy is verified through simulation verification technology, which simplifies the verification process of the protection strategy and reduces the verification cost and time. It enhances the pertinence and effectiveness of security protection work and improves the overall protection level.

[0081] The present invention may be a system, a method and / or a computer program product. The present invention also discloses a new power system network security protection and verification system based on the aforementioned new power system network security protection and verification method, comprising:

[0082] The attack path generation and analysis module is used to monitor network traffic and log data, use machine learning algorithms or path search algorithms to form cyberspace behavior analysis rules, and generate attack paths from the attacker's perspective;

[0083] The network threat identification module is used to build a network attack behavior event association model for power system attack and defense scenarios based on the analysis results of the attack path, and automatically identify network threats;

[0084] The protection strategy generation module is used to automatically generate protection strategies for identified network threats by integrating knowledge in the field of power network security, network plans for power monitoring systems, and on-site disposal plans using knowledge graph technology;

[0085] The protection effect evaluation and verification module is used to comprehensively evaluate the protection effect of the protection strategy through a pre-established evaluation system, and to verify and optimize the protection effect by simulating real attack and defense scenarios.

[0086] Based on the spirit of the present invention, those skilled in the art can easily think that a computer program product can be obtained based on the aforementioned new power system network security protection and verification method. The computer program product may include a computer-readable storage medium, which carries computer-readable program instructions for enabling a processor to implement various aspects of the present disclosure. That is, the present application also includes a terminal, including a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to perform the steps according to the aforementioned new power system network security protection and verification method.

[0087] Computer readable storage medium can be a tangible device that can keep and store the instructions used by the instruction execution device. Computer readable storage medium can be, for example, - but not limited to - electrical storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or any suitable combination of the above. More specific examples (non-exhaustive list) of computer readable storage medium include: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device, for example, punch card or groove protrusion structure with instructions stored thereon and any suitable combination of the above. Computer readable storage medium used here is not interpreted as instantaneous signal itself, such as radio wave or other free propagating electromagnetic wave, electromagnetic wave propagated by waveguide or other transmission medium (for example, light pulse by optical fiber cable) or electric signal transmitted by wire.

[0088] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0089] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network-including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may be personalized by utilizing the state information of a computer-readable program instruction, and the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A new power system network security protection and verification method, characterized in that: The following steps are involved: Step 1: Monitor network traffic and log data, use machine learning algorithms or path search algorithms to form cyberspace behavior analysis rules, and generate attack paths from the attacker's perspective; Step 2: Based on the analysis results of the attack path, a network attack behavior event correlation model for power system attack and defense scenarios is constructed to automatically identify network threats; Step 3: Based on the identified network threats, the knowledge graph technology is used to integrate the knowledge in the field of power network security, the network plan of the power monitoring system and the on-site disposal plan to automatically generate a protection strategy; Step 4: Comprehensively evaluate the protection effect of the protection strategy through a pre-established evaluation system, and verify and optimize the protection effect by simulating real attack and defense scenarios.

2. The novel power system network security protection and verification method according to claim 1 is characterized in that: The path search algorithm includes the Dijkstra algorithm and the A* algorithm. By representing the network topology as a graph, nodes represent network elements, and edges represent the connection relationship between elements, potential attack paths can be searched out using the path search.

3. The novel power system network security protection and verification method according to claim 2 is characterized in that: The generating of the attack path from the attacker's perspective further includes: By building a rule base based on expert knowledge and experience and analyzing the network traffic and log data through a logical reasoning engine, the attack path is derived.

4. The novel power system network security protection and verification method according to claim 3 is characterized in that: The network attack behavior event association model is based on a machine learning algorithm or a deep learning model; The machine learning algorithm is a logistic regression algorithm, and its model is expressed as: Among them, x is the input feature, including features in network traffic and log data, w is the weight vector, b is the bias term, and y is the output, which represents the probability of an attack.

5. The novel power system network security protection and verification method according to claim 4 is characterized in that: The automatic identification of network threats further includes: Use statistical or data mining methods to build anomaly detection models to identify potential security threats by analyzing abnormal patterns in network traffic and log data; The anomaly detection model uses the K-nearest neighbor algorithm; an anomaly point is defined as the point with the farthest distance from most points; the anomaly score is defined by calculating the average distance from a point to its K nearest neighbors: Among them, x is the point to be detected, x i is the ith nearest neighbor of x, dist(x,x i ) is x and x i The distance between.

6. The novel power system network security protection and verification method according to claim 5 is characterized in that: The automatic generation of protection strategies further includes: Build a rule-based reasoning engine to make inferences and decisions based on the predefined rule base and the current network security situation, and generate corresponding protection strategies.

7. The novel power system network security protection and verification method according to claim 6 is characterized in that: The comprehensive evaluation of the protection effect of the protection strategy further includes: A multi-index comprehensive evaluation method is adopted, by selecting multiple evaluation indicators, and using weighted summation or fuzzy comprehensive evaluation method for comprehensive evaluation. The multiple evaluation indicators include attack success rate, response time, and resource consumption.

8. A new type of power system network security protection and verification system, characterized in that: include: The attack path generation and analysis module is used to monitor network traffic and log data, use machine learning algorithms or path search algorithms to form cyberspace behavior analysis rules, and generate attack paths from the attacker's perspective; The network threat identification module is used to build a network attack behavior event association model for power system attack and defense scenarios based on the analysis results of the attack path, and automatically identify network threats; The protection strategy generation module is used to automatically generate protection strategies for identified network threats by integrating knowledge in the field of power network security, network plans for power monitoring systems, and on-site disposal plans using knowledge graph technology; The protection effect evaluation and verification module is used to comprehensively evaluate the protection effect of the protection strategy through a pre-established evaluation system, and to verify and optimize the protection effect by simulating real attack and defense scenarios.

9. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the new power system network security protection and verification method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the new power system network security protection and verification method described in any one of claims 1 to 7 are implemented.

Images