Power system network security defense resource priority selection method and system

Abstract

The invention discloses a power system network security defense resource priority selection method and system, and relates to the technical field of power system network security defense, and the method comprises the steps: constructing a quintuple model of a power information physical system, and analyzing a working mechanism of the quintuple model; constructing a defense resource priority selection algorithm; the algorithm is executed using the defense action. According to the method, the identification capability of potential security threats is improved, the assessment precision of the system for security risks is enhanced, a scientific basis is provided for subsequent defense resource priority selection, the effectiveness of an overall defense strategy is improved, the stability of the system is maintained, the use efficiency of resources is optimized, unnecessary resource waste is reduced, and the method is suitable for popularization and application. The anti-attack capability and the restoring force of the system are improved, so that the safe and stable operation of the power system is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of power system network security defense, and in particular to a power system network security defense resource priority selection method and system. Background Art

[0002] With the rapid development of information technology, the application of power cyber-physical systems (CPS) in the power industry has become increasingly mature, and the accompanying power system network security defense technology has also developed rapidly. From the initial simple protection measures to today's highly integrated and intelligent defense system, the relevant technology has undergone an evolution from static protection to dynamic monitoring, from a single defense method to a diversified strategy combination. The current technology has covered multiple fields such as encrypted communications, distributed monitoring, big data analysis, and cloud computing, which has improved the power system's ability to identify and respond to network threats and provided strong technical support for the safe and stable operation of the power system.

[0003] However, in practical applications, the existing technology still has shortcomings, which to a certain extent affect the safe and stable operation of the power system. The integrity of the defense system is insufficient, and the coordination of various layers of technology is not ideal. The network threats faced by the power system are constantly changing, and the existing defense technology is often difficult to keep up with such changes. The traditional intrusion detection system (IDS) relies on a preset attack feature library and may not be able to effectively identify new attack methods. At the same time, the update and upgrade cycle of the defense system is long, resulting in the system protection capability lagging behind and being unable to keep up with the rapid changes of network threats when facing rapidly evolving network attacks. Insufficient human resources and technical expertise lead to poor implementation of defense measures, security vulnerabilities are difficult to patch in time, and the efficiency of responding to large-scale network attacks is low. There are problems with privacy protection and data security. With the deep integration of the power system and the Internet, a large amount of user data and system operation data are collected and analyzed. How to ensure the security of these data and prevent data leakage and abuse is a problem that the current technology needs to solve. In view of the above problems, the present invention proposes a new power system network security defense method, which aims to improve the adaptive capability of the defense system, resource allocation efficiency, real-time response speed and synergy between systems. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: the existing power system network security defense technical methods have insufficient adaptability, low resource allocation efficiency, slow real-time response speed, and how to effectively achieve collaborative defense between systems.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a method for selecting priority of network security defense resources in a power system, comprising constructing a five-tuple model of a power information-physical system, analyzing the working mechanism of the five-tuple model; constructing a defense resource priority selection algorithm; and using a defense action execution algorithm.

[0007] As a preferred solution of the method for selecting priority of power system network security defense resources described in the present invention, wherein: the construction of the five-tuple model of the power information-physical system includes simulating the interaction relationship between the attacker and the defender through the conversion rules of the finite state machine, and the node set N is expressed as:

[0008] N={N g , N l , N d , N s , N e}

[0009] Among them, N g represents the power station node, N l represents the transmission line node, N d Represents the power distribution node, N s represents the substation node, N e represents the terminal user node, and the permission set P is expressed as:

[0010] P = {p1, p2, p3}

[0011] Among them, p1 represents a low-authority node, p2 represents a medium-authority node, and p3 represents a high-authority node. The state set S describes the state of the network system at different time points, which is expressed as:

[0012] S = {s0, s1, s2, s3}

[0013] Among them, s0 represents the normal state, s1 represents the unstable state, s2 represents the slightly abnormal state, and s3 represents the seriously abnormal state.

[0014] As a preferred solution of the method for selecting priority of power system network security defense resources described in the present invention, wherein: the construction of the five-tuple model of the power information-physical system also includes event sets E, E A represents the attack event in the power system, E D represents the defense event in the power system and is expressed as:

[0015] E={E A , E D}

[0016] Among them, E A Including DDoS attacks, malware infections, data tampering incidents, E DIt represents the system's defense behaviors of detection, isolation, and repair. The event set contains events that occur in the network, including the interaction between attackers and defenders. Each event represents the execution of an attack or defense operation at a single point in time. The occurrence of an event triggers a state transition. When an attack or defense event occurs, the state of the network system changes according to the predetermined transition rules. The action set A is the specific operations taken by the defender in different states, expressed as:

[0017] A={a1,a2,a3,a4}

[0018] Among them, a1 represents attack detection, a2 represents attack isolation, a3 represents system repair, and a4 represents restoration of normal operation. Each action is a decision taken based on the current state and events.

[0019] As a preferred solution of the method for selecting priority of network security defense resources of power system described in the present invention, the working mechanism of the five-tuple model includes: when a certain attack and defense event E occurs, judging the risk caused by the system, the current attack behavior set is E A , the security defense strategy set is E D , for a single behavior e ai ∈E A , e di ∈E D , the resulting risk probability is expressed as:

[0020] r ij =f(e ai , e dj )

[0021] Among them, f(e ai , e dj ) is in e dj Under the defensive strategy condition, the attack behavior e ai The safety risk value caused by the system safety state s is used to calculate the system safety factor, which is expressed as:

[0022] s ij =1-f(e ai , e dj )

[0023] The relationship between the safety factor and the system state is expressed as:

[0024]

[0025] The system will select a corresponding action A based on the current state S and the nature of the event, and switch to the next state S′ according to the preset state transfer function. By repeating this process at different stages of network attack and defense, it simulates the continuous game process between attackers and defenders.

[0026] As a preferred solution of the method for selecting priority of network security defense resources of power system described in the present invention, wherein: the construction of defense resource priority selection algorithm includes: i and the impact on the power system, calculate the state weight S w (N i ), expressed as:

[0027]

[0028] Among them, α k is node N i In Status The influence coefficient under the node is calculated according to the node's authority level in the power system. w (N i ), expressed as:

[0029] P w (N i )=β·P i

[0030] Among them, β represents the weight coefficient, which is used to measure the impact of permissions on the defense strategy.

[0031] As a preferred solution of the method for selecting priority of network security defense resources of power system described in the present invention, wherein: the construction of defense resource priority selection algorithm also includes calculating node N i The cost of defense resources C i , C i Including time cost and resource occupation cost, expressed as:

[0032] C i =R i ·T i

[0033] Among them, R i represents the scarcity of defense resources, T i It represents the time required to respond to defense measures, comprehensively considers node status, authority, and resource cost, and calculates the priority of the node, which is expressed as:

[0034]

[0035] Nodes with high priority will be given priority to obtain defense resources. According to the node priority, the defense resource allocation ratio is calculated, which is expressed as:

[0036]

[0037] Among them, R alloc (N i ) indicates that it is assigned to node Ni The resource ratio of m is the total number of nodes.

[0038] As a preferred solution of the method for selecting priority of network security defense resources of power system described in the present invention, wherein: the use of defense action execution algorithm includes initialization, defining node set N, permission set P, state set S, event set E and action set A according to the power system structure, performing real-time detection, continuously monitoring the network status of the power system, and capturing attack events E in real time. A , perform status evaluation, evaluate the status of each node according to the attack event, and update the status S i , perform priority calculation, according to the formula Priority(N i ) Calculate the priority of each node, allocate resources, and allocate defense resources R to each node according to the priority alloc (N i ), defense action execution, execute defense action a for high priority nodes i ,Defense actions include isolation, repair, recovery, and status update.,According to the defense effect, the system status S is updated, and the priority is recalculated.

[0039] Another object of the present invention is to provide a power system network security defense resource priority selection system, which can solve the problems of unreasonable resource allocation and low response efficiency in the current power system network security defense technology by constructing a defense resource priority selection algorithm.

[0040] As a preferred solution of the power system network security defense resource priority selection system described in the present invention, it includes: a model building module, an algorithm selection module, and an algorithm execution module;

[0041] The model construction module is used to construct a five-tuple model of the power information-physical system and analyze the working mechanism of the five-tuple model; the algorithm selection module is used to construct a defense resource priority selection algorithm; and the algorithm execution module is used to execute the algorithm using a defense action.

[0042] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a method for selecting priority of power system network security defense resources.

[0043] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for selecting priority of power system network security defense resources.

[0044] Beneficial effects of the present invention: The power system network security defense resource priority selection method provided by the present invention constructs a five-tuple model of the power information-physical system, analyzes the working mechanism of the five-tuple model, improves the ability to identify potential security threats, and enhances the system's assessment accuracy of security risks. By analyzing the working mechanism of the five-tuple model, a scientific basis is provided for subsequent defense resource priority selection, and the effectiveness of the overall defense strategy is improved. A defense resource priority selection algorithm is constructed to ensure that defense resources can be allocated to key nodes in priority, thereby maintaining the stability of the system. By calculating the defense resource cost, the resource utilization efficiency is optimized, and unnecessary resource waste is reduced. Resources are allocated according to node priority, and the implementation speed and effect of defense measures are improved. The defense action execution algorithm is used to ensure that the system can continuously monitor the network status and quickly identify attack events. The system can dynamically adjust the defense strategy according to the current security status. By executing defense actions and updating the status, the system can effectively isolate attacks, repair vulnerabilities and restore normal operation, improve the system's anti-attack capability and resilience, thereby ensuring the safe and stable operation of the power system. The present invention has achieved better results in the defense resource priority selection, real-time response capability and overall system defense effectiveness of the power system network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0046] Figure 1 An overall flow chart of a method for selecting priority of power system network security defense resources provided in the first embodiment of the present invention.

[0047] Figure 2 A defense resource deployment flow chart of a power system network security defense resource priority selection method provided in a second embodiment of the present invention.

[0048] Figure 3 A 14-node power system structure diagram of a power system network security defense resource priority selection method provided by the second embodiment of the present invention.

[0049] Figure 4 An overall flow chart of a power system network security defense resource priority selection system provided for the third embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0051] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a method for selecting priority of network security defense resources in a power system, comprising:

[0052] S1: Construct a five-tuple model of the power cyber-physical system and analyze the working mechanism of the five-tuple model;

[0053] Furthermore, constructing the five-tuple model of the power cyber-physical system includes simulating the interaction between attackers and defenders through the conversion rules of the finite state machine. The node set N is expressed as:

[0054] N={N g , N l , N d , N s , N e}

[0055] Among them, N g represents the power station node, N l represents the transmission line node, N d Represents the power distribution node, N s represents the substation node, N e represents the terminal user node, and the permission set P is expressed as:

[0056] P = {p1, p2, p3}

[0057] Among them, p1 represents a low-authority node, p2 represents a medium-authority node, and p3 represents a high-authority node. The state set S describes the state of the network system at different time points, which is expressed as:

[0058] S = {s0, s1, s2, s3}

[0059] Among them, s0 represents the normal state, s1 represents the unstable state, s2 represents the slightly abnormal state, and s3 represents the seriously abnormal state.

[0060] It should be noted that the construction of the five-tuple model of the power cyber-physical system also includes the event set E, E A represents the attack event in the power system, E D represents the defense event in the power system and is expressed as:

[0061] E={EA , E D}

[0062] Among them, E A Including DDoS attacks, malware infections, data tampering incidents, E D It represents the system's defense behaviors of detection, isolation, and repair. The event set contains events that occur in the network, including the interaction between attackers and defenders. Each event represents the execution of an attack or defense operation at a single point in time. The occurrence of an event triggers a state transition. When an attack or defense event occurs, the state of the network system changes according to the predetermined transition rules. The action set A is the specific operations taken by the defender in different states, expressed as:

[0063] A={a1,a2,a3,a4}

[0064] Among them, a1 represents attack detection, a2 represents attack isolation, a3 represents system repair, and a4 represents restoration of normal operation. Each action is a decision taken based on the current state and events.

[0065] It should also be noted that the working mechanism of the five-tuple model includes judging the risk caused by the system when a certain attack and defense event E occurs, and the current attack behavior set is E A , the security defense strategy set is E D , for a single behavior e ai ∈E A , e di ∈E D , the resulting risk probability is expressed as:

[0066] r ij =f(e ai , e dj )

[0067] Among them, f(e ai , e dj ) is in e dj Under the defensive strategy condition, the attack behavior e ai The safety risk value caused by the system safety state s is used to calculate the system safety factor, which is expressed as:

[0068] s ij =1-f(e ai , e dj )

[0069] The relationship between the safety factor and the system state is expressed as:

[0070]

[0071] The system will select a corresponding action A based on the current state S and the nature of the event, and switch to the next state S′ according to the preset state transfer function. By repeating this process at different stages of network attack and defense, it simulates the continuous game process between attackers and defenders.

[0072] It should also be noted that constructing a five-tuple model of the power information-physical system and analyzing the working mechanism of the five-tuple model have improved the ability to identify potential security threats and enhanced the system's assessment accuracy of security risks. By analyzing the working mechanism of the five-tuple model, a scientific basis is provided for the subsequent priority selection of defense resources, thereby improving the effectiveness of the overall defense strategy.

[0073] S2: Construct a defense resource priority selection algorithm.

[0074] Furthermore, the defense resource priority selection algorithm is constructed including selecting the node status S i and the impact on the power system, calculate the state weight S w (N i ), expressed as:

[0075]

[0076] Among them, α k is node N i In Status The influence coefficient under the node is calculated according to the node's authority level in the power system. w (N i ), expressed as:

[0077] P w (N i )=β·P i

[0078] Among them, β represents the weight coefficient, which is used to measure the impact of permissions on the defense strategy.

[0079] It should be noted that the construction of the defense resource priority selection algorithm also includes computing node N i The cost of defense resources C i , C i Including time cost and resource occupation cost, expressed as:

[0080] C i =R i ·T i

[0081] Among them, R i represents the scarcity of defense resources, T i It represents the time required to respond to defense measures, comprehensively considers node status, authority, and resource cost, and calculates the priority of the node, which is expressed as:

[0082]

[0083] Nodes with high priority will be given priority to obtain defense resources. According to the node priority, the defense resource allocation ratio is calculated, which is expressed as:

[0084]

[0085] Among them, R alloc (N i ) indicates that it is assigned to node N i The resource ratio of m is the total number of nodes.

[0086] It should also be noted that the construction of a defense resource priority selection algorithm ensures that defense resources can be allocated to key nodes first, thereby maintaining the stability of the system. By calculating the defense resource cost, the efficiency of resource utilization is optimized, unnecessary resource waste is reduced, and resources are allocated according to node priority, which improves the implementation speed and effectiveness of defense measures.

[0087] S3: Execute the algorithm using defensive actions.

[0088] Furthermore, the use of the defense action execution algorithm includes initialization, defining the node set N, the permission set P, the state set S, the event set E and the action set A according to the power system structure, performing real-time detection, continuously monitoring the network status of the power system, and capturing the attack event E in real time. A , perform status evaluation, evaluate the status of each node according to the attack event, and update the status S i , perform priority calculation, according to the formula Priority(N i ) Calculate the priority of each node, allocate resources, and allocate defense resources R to each node according to the priority alloc (N i ), defense action execution, execute defense action a for high priority nodes i ,Defense actions include isolation, repair, recovery, and status update.,According to the defense effect, the system status S is updated, and the priority is recalculated.

[0089] It should be noted that the use of defense action execution algorithms ensures that the system can continuously monitor the network status and quickly identify attack events. The system can dynamically adjust the defense strategy according to the current security situation. By executing defense actions and updating the status, the system can effectively isolate attacks, repair vulnerabilities and restore normal operation, thereby improving the system's anti-attack capabilities and resilience, thereby ensuring the safe and stable operation of the power system.

[0090] Example 2, reference Figure 2-Figure 3, which is an embodiment of the present invention, provides a method for selecting priority of network security defense resources in a power system. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0091] First, the IEEE 14-node power grid system is selected as the experimental platform. The algorithm flow is as follows: Figure 2 As shown, the topology is Figure 3 As shown, the system simulates various network attack scenarios to verify the resource allocation strategy of the algorithm of the present invention in dealing with complex attack scenarios. Referring to Table 1, the authority level of each node in the power grid is divided. High-authority nodes such as power stations affect the stability of the entire system, while substations and user load nodes have lower authority.

[0092] Table 1. Permission level allocation results of different nodes

[0093] serial number Node Type Permission Level Permission value P 1、2、3 Main power station Advanced permissions 3 6、8 Secondary power station Advanced permissions 3 4、5 Transmission Station Intermediate permissions 2 9、10、11、12、13、14 Load Node Intermediate permissions 2 7 Substation Low-level permissions 1

[0094] Attack scenario setting and node status evaluation are performed. Assume that during system operation, node 4 is attacked by DDoS, and nodes 5 and 7 are affected by malware propagation. The status of these nodes are evaluated and assigned corresponding status values. The results are shown in Table 2.

[0095] Table 2 Status evaluation results of each node

[0096] Node Number Node Type Status value Si Status description 1、2、3 Main power station 0 normal 6、8 Secondary power station 0 normal 4 Transmission Station 1 Under DDoS attack 5 Transmission Station 2 Attacked by malware 9、10、11、12、13、14 Load Node 0 normal 7 Substation 2 Attacked by malware

[0097] Priority calculation is performed. According to the node status, authority, and defense resource cost, the priority of the node is calculated using the priority formula. The results are shown in Table 3. The following are the priority calculation results of nodes 4, 5, and 7:

[0098] Table 3 Calculation results of defense priority of each node

[0099]

[0100] The defense resource allocation ratio of each node is calculated according to the priority value. Assuming that the total defense resource is 100 units, the resource priority allocation formula is used. The resource allocation results of each node are shown in Table 4.

[0101] Table 4 Defense resource allocation results of each node

[0102] Node Number Priority value Priority(Ni) Allocation resource ratio Ralloc(Ni) 4 1.13 34.38％ 5 1.11 35.16％ 7 1 30.46％

[0103] Through calculation and allocation, it can be seen that in the case of limited resources, the algorithm gives priority to allocating more resources to the critical power generation and transmission nodes that are severely attacked by comprehensive consideration of the node status, authority and resource cost, ensuring that high-priority nodes are quickly protected. The results show that dynamic defense resource allocation can effectively reduce the spread of attacks and ensure that the system can protect high-priority nodes in a timely manner under limited resource conditions, ultimately improving the overall defense effect and recovery speed of the system. The dynamic defense resource priority selection algorithm of the present invention has been successfully applied to the IEEE14-node power grid, and its effectiveness in responding to network attacks has been verified. Through reasonable priority calculation and resource allocation, the power system can effectively resist network attacks and ensure the safe and stable operation of the system.

[0104] Example 3, reference Figure 4 , as an embodiment of the present invention, provides a power system network security defense resource priority selection system, including a model building module, an algorithm selection module, and an algorithm execution module.

[0105] The model construction module is used to construct the five-tuple model of the power information-physical system and analyze the working mechanism of the five-tuple model; the algorithm selection module is used to build the defense resource priority selection algorithm; and the algorithm execution module is used to execute the algorithm using defense actions.

[0106] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0107] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0108] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0109] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0110] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for selecting priority of power system network security defense resources, characterized in that: include: Construct a five-tuple model of the power cyber-physical system and analyze the working mechanism of the five-tuple model; Build a defense resource priority selection algorithm; Execute the algorithm using defensive actions.

2. The method for selecting priority of power system network security defense resources according to claim 1, characterized in that: The construction of the five-tuple model of the power cyber-physical system includes simulating the interaction relationship between the attacker and the defender through the conversion rules of the finite state machine. The node set N is expressed as: N={N g ,N l ,N d ,N s ,N e } Among them, N g represents the power station node, N l represents the transmission line node, N d Represents the power distribution node, N s represents the substation node, N e represents the terminal user node, and the permission set P is expressed as: P={p1,p2,p3} Among them, p1 represents a low-authority node, p2 represents a medium-authority node, and p3 represents a high-authority node. The state set S describes the state of the network system at different time points, which is expressed as: S={s0,s1,s2,s3} Among them, s0 represents the normal state, s1 represents the unstable state, s2 represents the slightly abnormal state, and s3 represents the seriously abnormal state.

3. The method for selecting priority of power system network security defense resources according to claim 2, characterized in that: The five-tuple model of the power information-physical system also includes event sets E, E A represents the attack event in the power system, E D represents the defense event in the power system and is expressed as: And={And A ,AND D } Among them, E A Including DDoS attacks, malware infections, data tampering incidents, E D It represents the system's defense behaviors of detection, isolation, and repair. The event set contains events that occur in the network, including the interaction between attackers and defenders. Each event represents the execution of an attack or defense operation at a single point in time. The occurrence of an event triggers a state transition. When an attack or defense event occurs, the state of the network system changes according to the predetermined transition rules. The action set A is the specific operations taken by the defender in different states, expressed as: A={a1,a2,a3,a4} Among them, a1 represents attack detection, a2 represents attack isolation, a3 represents system repair, and a4 represents restoration of normal operation. Each action is a decision taken based on the current state and events.

4. The method for selecting priority of power system network security defense resources according to claim 3, characterized in that: The working mechanism of the five-tuple model includes: when a certain attack and defense event E occurs, the risk caused by the system is judged, the current attack behavior set is Ea, and the security defense strategy set is E D , for a single behavior e ai ∈E A ,e di ∈E D , the resulting risk probability is expressed as: r ij =f(e ai ,e dj ) Among them, f(e ai ,e dj ) is in e dj Under the defensive strategy condition, the attack behavior e ai The safety risk value caused by the system safety state s is used to calculate the system safety factor, which is expressed as: s ij =1-f(e ai ,e dj ) The relationship between the safety factor and the system state is expressed as: The system will select a corresponding action A based on the current state S and the nature of the event, and switch to the next state S' according to the preset state transfer function. By repeating this process at different stages of network attack and defense, it simulates the continuous game process between attackers and defenders.

5. The method for selecting priority of power system network security defense resources according to claim 4, characterized in that: The construction of the defense resource priority selection algorithm includes: i and the impact on the power system, calculate the state weight S w (N i ), expressed as: Among them, α k is node N i In Status The influence coefficient under the node is calculated according to the node's authority level in the power system. w (N i ), expressed as: P w (N i )=β·P i Among them, β represents the weight coefficient, which is used to measure the impact of permissions on the defense strategy.

6. The method for selecting priority of power system network security defense resources according to claim 5, characterized in that: The construction of the defense resource priority selection algorithm also includes computing node N i The cost of defense resources C i , including time cost and resource occupation cost, expressed as: C i =R i ·T i Among them, R i represents the scarcity of defense resources, T i It represents the time required to respond to defense measures, comprehensively considers node status, authority, and resource cost, and calculates the priority of the node, which is expressed as: Nodes with high priority will be given priority to obtain defense resources. According to the node priority, the defense resource allocation ratio is calculated, which is expressed as: Among them, R alloc (N i ) indicates that it is assigned to node N i The resource ratio is m, and m is the total number of nodes.

7. The method for selecting priority of power system network security defense resources according to claim 6, characterized in that: The use of the defense action execution algorithm includes initialization, defining a node set N, a permission set P, a state set S, an event set E and an action set A according to the power system structure, performing real-time detection, continuously monitoring the network status of the power system, and capturing attack events E in real time. A , perform status evaluation, evaluate the status of each node according to the attack event, and update the status S i , perform priority calculation, according to the formula Priority(N i ) Calculate the priority of each node, allocate resources, and allocate defense resources R to each node according to the priority alloc (N i ), defense action execution, execute defense action a for high priority nodes i ,Defense actions include isolation, repair, recovery, and status update.,According to the defense effect, the system status S is updated, and the priority is recalculated.

8. A system using the method for selecting priority of power system network security defense resources according to any one of claims 1 to 7, characterized in that: Including model building module, algorithm selection module, algorithm execution module; The model building module is used to build a five-tuple model of the power information-physical system and analyze the working mechanism of the five-tuple model; The algorithm selection module is used to construct a defense resource priority selection algorithm; The algorithm execution module is used to execute the algorithm using the defensive action.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for selecting priority of power system network security defense resources according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for selecting priority of power system network security defense resources according to any one of claims 1 to 7 are implemented.

Images